@open-everywhere/core 0.1.0

package/agent/tools/reply.ts

@@ -0,0 +1,757 @@
+// reply posts a message into this conversation MID-TURN and returns its id, so posting is an ACTION the model takes rather than the end of its turn; it keeps working and finishes with `no_reply`. Every post is recorded in the own-post ledger, which is the fence deciding what `edit_reply` may touch.
+// Mounted only where the bound surface's capability manifest declares `midTurnPost`. The bar is honest availability: never expose a `reply` that would throw when called. Not consequential, so no approval, but still audited.
+
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { bindFrom, deploymentOrg, isUnifiedWindowContext, currentWakeId, currentSessionId, currentTurnId, windowGrainOf, windowTaskLabelOf, type BindableContext } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { flushWriteIntentMemory, type MemoryPersistContext } from "../hooks/memory.js";
+import { isThreadStopped } from "../channels/engagement.js";
+import { noteTurnCloseoutRefusal } from "../model/turn-closeout.js";
+import { durableTurnKey, noteStoppedAck, stoppedAckSpent } from "../model/turn-state.js";
+import { capabilitiesFor } from "../identity/capabilities.js";
+import {
+  resolveReplyTarget,
+  replyEditLocus,
+  postReply,
+  auditReplyRefused,
+  auditReplyForced,
+  replyAuditFor,
+  REPLY_DEDUPE_SKIPPED_ID,
+  type ReplierLabel,
+} from "../channels/reply-post.js";
+import {
+  replyFreshness,
+  staleReplyRefusalMessage,
+  markStaleRefusedThisTurn,
+  wasStaleRefusedThisTurn,
+  REPLY_STALE_REFUSAL_REASON,
+  REPLY_FORCED_AUDIT_REASON,
+} from "../channels/reply-freshness.js";
+import { refuseIfShouldFold } from "../channels/reply-fold.js";
+import { tailWindow } from "../channels/session-tail-record.js";
+import { replierLabelFor, PENDING_WORK_INSTRUCTION } from "../channels/turn-delivery.js";
+import { withRunRefusalBlock } from "../routines/report.js";
+import { consumeRoutineRunPermissionRefusals } from "../approvals/card-signal.js";
+import { noteTerminalCallGrain } from "../channels/turn-terminal-actions.js";
+import {
+  markRepliedThisTurn,
+  markWakeDoneThisTurn,
+  markWakeRepliedThisTurn,
+  isWakeDoneThisTurn,
+  isWakeDeclinedThisTurn,
+  markDoneRefusedThisTurn,
+  wasDoneRefusedThisTurn,
+  WAKE_DECLINED_REFUSAL_REASON,
+  WAKE_DONE_REFUSAL_REASON,
+  WAKE_DONE_FORCED_AUDIT_REASON,
+  wakeDeclinedRefusalMessage,
+  REPLY_STOPPED_REFUSAL_REASON,
+  markStoppedAckThisTurn,
+  wasStoppedAckSpentThisTurn,
+  noteForcedOverrideThisTurn,
+  FORCED_OVERRIDE_TURN_LIMIT,
+  REPLY_FORCED_LOOP_REASON,
+} from "../channels/reply-signal.js";
+import { markStandDownSilenceThisTurn, REPLY_STAND_DOWN_ACK_ACTION } from "../channels/stand-down-silence.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { END_TURN_WITH_SENTINEL_INSTRUCTION } from "../channels/normalized-wake.js";
+import {
+  resolveAnswerableReplyTarget,
+  replyRefusalMessage,
+  answeredThisTurnRefusalMessage,
+  boundConversationOrigin,
+  sameUnifiedConversation,
+  deliveryReachedOwedConversation,
+} from "../channels/unified-window.js";
+import { addressedWakeThisTurn, claimTasksForAddressedWake } from "../access/dispatch-origin-signal.js";
+import {
+  DELEGATION_PENDING_REFUSAL_REASON,
+  SETTLEMENT_REPORT_POSTED_ACTION,
+  delegationPendingRefusalMessage,
+  dischargeSettlementReport,
+  notePromisedReport,
+  pendingDelegationOwing,
+  pendingDelegationThisTurn,
+  pendingDelegationsOwing,
+  settlementReportOwedOn,
+} from "../access/pending-delegation-signal.js";
+import { retargetTaskWakes, taskWakeUnreadRefusalMessage, TASK_WAKE_UNREAD_REFUSAL_REASON } from "../channels/task-wake.js";
+import { uningressedTurn } from "../access/task-wake-signal.js";
+import { silentRoutineThisTurn } from "../routines/report.js";
+import { resolveOwnWindowToken } from "../access/delegation-mount.js";
+import { postUnifiedReply, unifiedEditLocus, terminalPostClosesConversation } from "../channels/unified-reply.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { preRegisterDynamicVariants } from "../access/window-gated.js";
+
+/**
+ * The replier-tier label for THIS tool call's session: a task-grain (worker) session brackets, every other grain posts bare.
+ * A genuine tool `ctx`, so both host stamps resolve reliably — unlike a channel-event handler's ctx, which is why the provider channel files snapshot the same stamps at `turn.started` instead.
+ */
+function replierFor(ctx: BindableContext): ReplierLabel | undefined {
+  return replierLabelFor(windowGrainOf(ctx), windowTaskLabelOf(ctx));
+}
+
+/** What the stored stand-down says about ONE `reply` call — see {@link standDownState}. */
+interface StandDownState {
+  /** The bound conversation carries the durable `stopped` flag right now. */
+  readonly stopped: boolean;
+  /** …and this turn has already spent its one post into that conversation, so REFUSE. The valve is
+   *  spent by ANY post while the flag is on, not only by an acknowledgement of the stop — see
+   *  {@link stoppedRefusalText} for the turn where those two differ. */
+  readonly refuse: boolean;
+}
+
+/** The verdict for a call the stand-down cannot reach — every fail-open path answers this. */
+const STAND_DOWN_CLEAR: StandDownState = { stopped: false, refuse: false };
+
+/**
+ * What the model reads when the stored stand-down refuses a further post. It states the fact, names
+ * nothing to override (a stop is not a matter of style, so there is no valve here) and names the ONE
+ * way out, which is to stop.
+ *
+ * 🔴 IT SAYS "POSTED", NOT "ACKNOWLEDGED" (OPE-1522). The valve this refusal reports is spent by ANY
+ * post into a stopped conversation ({@link markStoppedAckThisTurn} runs on every successful one), not
+ * only by an acknowledgement of the stop. On Discord and Teams the registry anchor is the channel or
+ * conversation id, so a stood-down conversation woken later by a path that marks no participation — a
+ * routine fire, a worker completion post — gets one post and then this refusal, in a turn where no
+ * acknowledgement was ever owed or sent. The earlier copy asserted one had gone out, which was false
+ * in exactly that turn. What IS true on every path here is that this turn has already posted once
+ * into the conversation, so that is what the copy says.
+ */
+function stoppedRefusalText(): string {
+  return (
+    "You were asked to stand down in this conversation and that stop is recorded, so nothing was posted. " +
+    "You have already posted here once this turn; anything further is exactly what the person asked you to stop doing. " +
+    `${END_TURN_WITH_SENTINEL_INSTRUCTION} Someone @mentioning you is what brings you back.`
+  );
+}
+
+/**
+ * THE STORED STAND-DOWN, RE-READ PER POST (OPE-1520).
+ *
+ * A stand-down writes the durable `stopped` flag into the engagement registry, and until this read
+ * existed only the WAKE GATES consulted it: the flag suppressed the NEXT turn and said nothing to
+ * the turn that was already running. Measured live 2026-09-07 — the seat acknowledged the stop and
+ * then posted the same answer six more times in that same turn.
+ *
+ * 🔴 IT READS THE WRITER'S OWN KEY. `tools/stand_down.ts` marks `binding.engagementKey ??
+ * binding.threadTs` under `resolvePartition(ctx)`, so this reads exactly that pair. Deriving a key
+ * from the reply TARGET instead would mean re-deriving every platform's registry key at a second
+ * site, where the two could drift; and the caller is what constrains this to a post that is
+ * actually going to the bound conversation (see each call site).
+ *
+ * THE FIRST POST AFTER THE FLAG LANDS IS ALLOWED. `stand_down` asks the model for a one-line
+ * acknowledgement and then the end of the turn, so refusing every post would eat the
+ * acknowledgement the human is owed and turn a working stop into a silent one.
+ *
+ * 🔴 WHICH ROUTE THAT ACKNOWLEDGEMENT TAKES IS THE SEAT'S, NOT THIS FILE'S (OPE-1580). `stand_down`
+ * names one route per delivery arm: `reply` on the two arms whose closing prose the host drops, and
+ * the turn's FINAL TEXT on the two arms that post it. So this valve is not the only route out, and
+ * on a `dual-mode` seat the acknowledgement can land without spending it at all — which is why the
+ * owed-acknowledgement guard (channels/reply-signal.ts §STOOD-DOWN) reads two signals rather than
+ * this mark alone. Do not re-derive "the model acknowledges with `reply`" from this paragraph: that
+ * claim, stated to every seat, is the defect OPE-1580 closed.
+ *
+ * 🔴 THE VALVE IS SPENT BY THE POST, NEVER BY THIS READ — this function reports, it does not
+ * record, and {@link markStoppedAckThisTurn} runs beside `markRepliedThisTurn` once the message is
+ * really out. Four gates below this one can still refuse the acknowledgement call (the `done` valve,
+ * the delegation-pending refusal, the freshness gate and the should-be-edit fold), and every one of
+ * them invites the model to re-send. Spending the valve on the refused call would meet that re-send
+ * with `stopped`, so the acknowledgement would never land — the exact inversion of this file's own
+ * POST-THEN-MARK rule.
+ *
+ * 🔴 THE VALVE HAS A DURABLE HALF (OPE-1551). `wasStoppedAckSpentThisTurn` reads an eve
+ * `defineState` slot, and eve serializes that slot into the TURN STEP's own input and output — one
+ * durable step per turn — so a mid-turn write survives only if the step completes. A turn
+ * interrupted by a timeout or a redeploy re-runs from the context as it stood at the turn's START,
+ * where the valve reads UNSPENT, while the post it already made is still in the room: a platform
+ * post is not rolled back. So the valve is read from BOTH halves and spent in both, exactly as the
+ * closeout latch is, and the durable row is only touched on the rare turn where the flag is
+ * actually on.
+ *
+ * FAIL-OPEN in every direction — an unbindable ctx, an unreadable store, an unwritable turn slot all
+ * read as "post it". Silencing an answer the model has already written is a worse failure than one
+ * extra message in a conversation the agent was asked to leave, and the turn-closeout latch bounds
+ * how many of those there can be.
+ */
+async function standDownState(
+  bind: BindableContext,
+  turnId: string | undefined,
+  /** Does the post this call is about go to the conversation the stored flag is keyed on? Asked ONLY
+   *  once the flag is known to be ON, so a caller whose answer costs a store read pays it on the rare
+   *  turn rather than on every reply. Absent ⇒ the caller has already constrained the post itself
+   *  (the per-surface variant, which can only post where it was woken). */
+  namesBoundConversation?: () => Promise<boolean>,
+): Promise<StandDownState> {
+  try {
+    const binding = bindFrom(bind);
+    const stopped = await isThreadStopped(resolvePartition(bind), binding.engagementKey ?? binding.threadTs);
+    if (!stopped) return STAND_DOWN_CLEAR;
+    if (namesBoundConversation !== undefined && !(await namesBoundConversation())) return STAND_DOWN_CLEAR;
+    if (wasStoppedAckSpentThisTurn(turnId)) return { stopped, refuse: true };
+    // The durable half, read only on a turn that is already speaking into a stopped conversation.
+    const rowKey = standDownRowKey(bind, turnId);
+    return { stopped, refuse: rowKey !== undefined && (await stoppedAckSpent(rowKey)) };
+  } catch {
+    return STAND_DOWN_CLEAR;
+  }
+}
+
+/** The durable row this turn's stand-down valve is stored under — the SAME (session, turn) pair the
+ *  step counter and the closeout latch use, so one turn is never addressed two ways. `undefined`
+ *  whenever the turn has no durable half at all: no turn id, or a sessionless turn, whose bare
+ *  `turn_N` key is shared by every session's Nth turn (OPE-1551). */
+function standDownRowKey(bind: BindableContext, turnId: string | undefined): string | undefined {
+  if (turnId === undefined || turnId.length === 0) return undefined;
+  try {
+    return durableTurnKey(currentSessionId(bind), turnId);
+  } catch {
+    return undefined;
+  }
+}
+
+/** Spend the stand-down valve in BOTH halves — the turn slot the same-instance reads use, and the
+ *  durable row that survives an instance change. Called only after a post really landed, never on
+ *  the read (see {@link standDownState}'s POST-THEN-MARK note). Never throws.
+ *
+ *  🔴 IT ALSO LATCHES THE TURN SILENT AND WRITES THE SEPARATOR ROW (OPE-1647). Both are here, and
+ *  only here, because this is the one moment the host KNOWS a post has landed in a conversation the
+ *  stored stop is on — the read above reports, and a refused call must change nothing.
+ *  THE LATCH stops the turn's trailing final text from following the acknowledgement out
+ *  (channels/stand-down-silence.ts). On every arm whose closing prose posts that text posts, and a `no_reply`
+ *  REFUSED by the owed acknowledgement records no silence for the completion handler to read, so
+ *  nothing else was holding that door: deploy #187 posted the acknowledgement at 09:40:50 and its
+ *  trailing prose at 09:41:01.
+ *  THE ROW says a post went out through a door that READ the stored stop and spent its one-post
+ *  valve. `reply.post` alone cannot say that: it records that bytes left, never whether the
+ *  conversation was stopped at the time.
+ *  🔴 IT COVERS THE `reply` VERB ONLY, AND THE SCOPE IS THE POINT. `stand_down` names one route per
+ *  delivery arm (OPE-1580), and on Linear's native arm — the one seat left whose closing prose POSTS
+ *  — the acknowledgement is the turn's FINAL TEXT, emitted by the framework's own default poster,
+ *  which reads no stop and therefore writes no row here. So an absent row is NOT by itself a stop
+ *  violation, and nothing downstream may read it that way: it separates the two doors, not the two
+ *  intentions.
+ *  🔴 IT CARRIES THE ANCHOR, so the separation is actually runnable. The row's partition names the
+ *  SURFACE — on Slack a channel, which holds many threads — so an operator pairing this row with a
+ *  `reply.post` by partition and timestamp alone cannot tell two threads of one channel apart. The
+ *  anchor is the engagement registry's own key, the same one `standDownState` reads above and
+ *  `engagement.stood_down` writes, so the three rows join on one value. It is UNGATED, like the
+ *  `reply.no_reply_after_stand_down` row it joins to, because a stop the person asked for has to be
+ *  countable in the actions-only posture prod runs in.
+ *  🔴 `arm`, NOT `route`. Every other `reply.*` row spells `detail.route` in the
+ *  `"tool" | "terminal" | "bridge"` vocabulary (`channels/reply-post.ts`), and both doors here are
+ *  `"tool"` posts. Reusing the key for a second enum would file one meaning under two vocabularies in
+ *  one table, which is the drift one-word-one-meaning exists to stop. */
+async function spendStoppedAck(bind: BindableContext, turnId: string | undefined, arm: "unified" | "per-surface"): Promise<void> {
+  markStoppedAckThisTurn(turnId);
+  markStandDownSilenceThisTurn(turnId);
+  const rowKey = standDownRowKey(bind, turnId);
+  if (rowKey !== undefined) await noteStoppedAck(rowKey);
+  // Read the anchor the same way `standDownState` does, and fail SOFT: an unbindable ctx costs the
+  // row its join key, never the post that already landed.
+  let anchor: string | undefined;
+  let sessionId: string | undefined;
+  try {
+    const binding = bindFrom(bind);
+    anchor = binding.engagementKey ?? binding.threadTs;
+    sessionId = currentSessionId(bind);
+  } catch {
+    /* the row still records that a stopped conversation was posted into */
+  }
+  await auditToolAction(bind, REPLY_STAND_DOWN_ACK_ACTION, {
+    arm,
+    ...(anchor !== undefined ? { anchor } : {}),
+    ...(sessionId !== undefined ? { sessionId } : {}),
+  });
+}
+
+// The single-window unified variant. A cross-surface session can have several surfaces' wakes coalesced into one turn, so "post into this conversation" is ambiguous by construction: the model NAMES the wake it answers and the host resolves the target from the durable wakeId→origin map. It selects from wakes it was actually shown and never authors an address; an unknown or expired id fails CLOSED.
+// This is the ONLY reply route on the unified channel — its terminal completion is structurally dropped — so arming it unconditionally there is what keeps the channel able to speak. Exported so the offline first-turn probe sends the REAL description and input schema rather than a hand-copied one.
+export const unifiedReplyEntry = defineTool({
+    description:
+      "Post a reply into the conversation a specific wake came from, without ending your turn. " +
+      "You are a cross-surface session: each wake envelope carries a `wake-id` naming where it " +
+      "came from — pass the wake-id of the wake you are answering, this turn's or any earlier " +
+      "wake in this session you have not yet answered, and your reply is posted into exactly " +
+      "that conversation (its Slack thread, its GitHub issue, …). You cannot target anywhere " +
+      "else. Posting is an action, not turn-completion: reply, keep working, and finish with " +
+      "`no_reply` when you're done — your terminal text is never posted. One answer is ONE " +
+      "reply: once you answer a wake with `done: true`, replying to that same wake again in " +
+      "this turn is refused. Wherever the conversation can still take one, a second message is " +
+      "discouraged rather than blocked. When you plan a multi-part answer, pass `done: false` on " +
+      "the earlier parts.",
+    inputSchema: z.object({
+      text: z.string().min(1).describe("The message to post (the target surface's markdown). One curated message, not a stack."),
+      wake: z.string().min(1).describe("The `wake-id` from the envelope of the wake you are answering — your reply posts into that wake's conversation."),
+      done: z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe(
+          "Leave true (the default) to mark this wake answered. Once you mark a wake done, a further reply to that SAME wake in this same turn is REFUSED and posts nothing; a second message is discouraged rather than blocked, and `force: true` posts it at the cost of a near-duplicate in the room. On a surface where your answer CLOSES the conversation — a Linear @mention reply ends the agent session it answers — nothing further can land, so that refusal stands and `force` does not open it. Set false ONLY when you know you will reply to this same wake again later — e.g. you are reporting progress now and the full answer comes after delegated work finishes. While a background worker you started this turn has not reported, `done: true` is REFUSED: you do not have its answer yet, so post a hand-off note with `done: false` and answer when the report arrives.",
+        ),
+      force: z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe(
+          "Leave false. Set true ONLY to override a host refusal about the state of the room: that this conversation has moved on (newer messages you have not read are on their way to you), that your own last message here is still the newest one and this should be an edit, or that you already answered this wake in this turn. It posts your reply anyway. It does NOT override a refusal about what the room can still receive — where your answer closed the conversation, no flag reopens it. Use it when posting NOW as a separate message matters more — a time-critical alert, a hand-off note, or something that genuinely has to notify the room again. It costs the room a near-duplicate to read, and it is recorded.",
+        ),
+    }),
+    outputSchema: z.object({ posted: z.boolean(), id: z.string(), note: z.string() }),
+    // NO `approval:` — same dynamic-tool-on-resumed-session pin as the base variant below.
+    async execute(input, ctx) {
+      // The authority fence: the reply target is constrained to a wake THIS SESSION genuinely holds, never any wakeId the org-wide map has ever seen. Without it, injected content in one surface could name a historical wakeId and post into a different conversation the session once saw.
+      // It admits this turn's wake, a different wake naming the SAME conversation, and any pending, unanswered, in-TTL wake registered against this session's own window token. That last arm is what makes a COALESCED turn competent: a turn that merged queued deliveries carries only the LAST delivery's auth.
+      // 🔴 THAT MERGE IS UNREACHABLE ON eve 0.54.3, AND THE ARM STAYS ANYWAY (OPE-2042). eve batches adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one unified window never compare equal. Only the caller-less task COMPLETION COHORT still folds, and it carries no `auth` at all. But arm 4 is LIVE regardless: it admits a pending, unanswered wake registered on this window by an EARLIER turn, which no merge rule touches. `scripts/coalesced-delivery-merge-assumption-test.ts` pins the MERGE road alone.
+      const bind = ctx as BindableContext;
+      const turnWake = currentWakeId(bind);
+      const windowToken = resolveOwnWindowToken(bind);
+      const turnId = currentTurnId(bind);
+
+      // A turn may not answer a wake it already DECLINED. eve treats a step with no tool call and no text as a failure and reissues the call once with a nudge commanding a reply, so a turn that chose silence is told to speak and then answers the wake it just declined.
+      // Declining a wake and then answering it is a contradiction inside one turn, always, so this refusal cannot suppress a legitimate reply.
+      // 🔴 AND IT ENDS THE TURN (OPE-1520). The refusal alone left the model free to try again three
+      // seconds later, which it did 68 times on one prod turn while a background worker it had
+      // dispatched sat unstarted — eve only begins a dispatched child once the parent PARKS. The
+      // latch makes the next model round-trip resolve the text-only stub (model/turn-closeout.ts →
+      // model/step-boundary.ts `closed` tier), so the turn ends and the child starts at once.
+      if (isWakeDeclinedThisTurn(turnId, input.wake)) {
+        await noteTurnCloseoutRefusal(bind, WAKE_DECLINED_REFUSAL_REASON);
+        await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), WAKE_DECLINED_REFUSAL_REASON);
+        throw new Error(wakeDeclinedRefusalMessage());
+      }
+
+      // An uningressed turn that installed no task identity holds no address: eve wakes a delegating seat when its background child settles and brings no auth, so `currentWakeId` answers undefined and the fence's mismatch copy would re-disclose exactly the wrong address.
+      // Reaching this arm means the task's wake row could not be found — expired, never minted, or a dispatch older than the leg — so there is no recovery left and the copy names `no_reply` instead.
+      if (turnWake === undefined && uningressedTurn(turnId)) {
+        await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), TASK_WAKE_UNREAD_REFUSAL_REASON);
+        throw new Error(taskWakeUnreadRefusalMessage());
+      }
+
+      const org = deploymentOrg();
+      const store = getOperationalStore();
+      const resolution = await resolveAnswerableReplyTarget(store, org, turnWake, windowToken, turnId, input.wake);
+      if (!resolution.ok) {
+        // A refusal is RECORDED, which is what makes a fire steered at an id it does not hold visible instead of merely quiet. The mismatch copy re-discloses this turn's own host-stamped wake-id, gated on the silent-routine signal so that carve-out cannot be reopened through an error message.
+        // Audited BEFORE the throw and best-effort, so a store hiccup can never turn a refusal into a different error than the one the model needs to read.
+        await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), resolution.reason);
+        throw new Error(replyRefusalMessage(resolution.reason, input.wake, { turnWake, silent: silentRoutineThisTurn() }));
+      }
+      const origin = resolution.origin;
+
+      // THE STORED STAND-DOWN, RE-READ (OPE-1520) — see {@link standDownState} above for the failure
+      // and the fail direction. It reads the writer's own registry key, so the caller must constrain
+      // it to a post that is actually going to the BOUND conversation. Placed below the authority
+      // fence, so an unheld wake is refused for the address it named rather than for a stop in a
+      // conversation it never reached.
+      // 🔴 THE CONSTRAINT IS THE CONVERSATION, NOT THE WAKE ID (OPE-1524). The fence's arm 2 admits
+      // a DIFFERENT wake naming the SAME conversation, and this gate used to fire only on the turn's
+      // OWN wake — so a post under an OLDER wake id for the thread the seat had just been asked to
+      // leave bypassed the read entirely, and could repeat the OPE-1520 failure verbatim.
+      // `boundConversationOrigin` resolves the origin THIS TURN'S wake was registered against, and
+      // `sameUnifiedConversation` compares that origin with the one this post is going to. Comparing
+      // two ORIGINS is what asks the real question without re-deriving any platform's registry key at
+      // a second site — the shape OPE-1520 refused, because two sites deriving one key drift.
+      // The `input.wake === turnWake` arm stays as a FLOOR: it needs no store read, and it keeps the
+      // narrow case working on a turn whose own wake row has since aged out of the map.
+      // LAZY, so the widening costs the ordinary reply nothing: the predicate is asked only once the
+      // stored flag is known to be ON, which is the rare turn. A sibling wake in a conversation
+      // nobody stopped never pays the extra lookup.
+      const standDown = await standDownState(bind, turnId, async () => {
+        if (input.wake === turnWake) return true;
+        const boundOrigin = await boundConversationOrigin(store, org, turnWake);
+        return boundOrigin !== undefined && sameUnifiedConversation(boundOrigin, origin);
+      });
+      if (standDown.refuse) {
+        await noteTurnCloseoutRefusal(bind, REPLY_STOPPED_REFUSAL_REASON);
+        await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), REPLY_STOPPED_REFUSAL_REASON);
+        throw new Error(stoppedRefusalText());
+      }
+
+      // Same-turn teeth for `done`. The fence above admits this turn's own wake unconditionally so a multi-part answer stays possible, which left `done: true` with nothing the model could feel inside the turn that set it. The narrowing is exactly one shape — same turn, same wake, already marked done — and `done: false` records nothing, so a planned multi-part answer never meets this arm at all.
+      // 🔴 IT DISCOURAGES THE SECOND ANSWER RATHER THAN BLOCKING IT (OPE-1452). OPE-568 built this arm as a hard refusal that read no flag, and it was the last gate on this path that refused a DUPLICATE POST outright — the should-be-edit policy and the freshness gate both refuse once and honour `force`. Tommy's ruling of 2026-09-03 ("we should never be hard-blocking this, it's okay for the model to double-post, just discouraged") reaches this arm exactly as it reaches those, so it holds the same valve: refuse once per turn per wake, then stand aside.
+      // 🔴 IT READS THE ORIGIN, SO IT SITS BELOW THE FENCE — this is why it is here and not above, where OPE-568 put it. A valve that opens where the second post CANNOT LAND is worse than the wall it replaced: the model reads "send this same call again and it posts", re-sends, and hits a platform error with no steer left. The fence is what resolves the origin the predicate needs. Moving it costs no fence verdict: this arm only ever fires on a wake THIS turn answered, which arm 2 (the turn's own wake) and arm 4 (`answeredTurnId === turnId`) both admit.
+      // 🔴 HOW MANY TIMES THIS CALL OVERRODE A HOST VERDICT (OPE-1659). Each of the three
+      // discouraged-duplicate gates below answers for itself, and the highest answer decides two
+      // things after the post: whether the success note repeats a promise the override has just
+      // disproved, and whether this turn keeps running. `0` means nothing was overridden, which is
+      // every ordinary reply. See channels/reply-signal.ts §FORCED for the live measurement.
+      let doneOverrides = 0;
+      let staleOverrides = 0;
+      /** The `done` teeth's verdict was overridden — recorded below, once the gates that can still
+       *  refuse this call have passed. See the arm itself for why the two are split. */
+      let doneForced = false;
+      if (isWakeDoneThisTurn(turnId, input.wake)) {
+        if (terminalPostClosesConversation(origin)) {
+          // THE WALL, unchanged from OPE-568 and deliberately reading no `force`: the first `done:true` post ENDED this conversation (a Linear `response` Agent Activity ends its agent session, OPE-869), so there is no second post to permit. Not marked refused either — a wall refuses every time, and the way out is a NEWER wake, which the copy names.
+          await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), WAKE_DONE_REFUSAL_REASON);
+          throw new Error(replyRefusalMessage("answered", input.wake));
+        }
+        // 🔴 THE FORCE CHECK SITS ABOVE THE REFUSE-ONCE RECORD, and the order is the whole point: the refusal copy PROMISES "pass `force: true` … and the override is recorded". A model that reads that refusal and then passes the flag is exactly the caller the promise is made to, and gating this branch on the record would have skipped the row for that one caller — the row would exist only where `force` arrived BEFORE any refusal, which is the caller who never read the promise.
+        if (input.force === true) {
+          // 🔴 THE VERDICT IS DECIDED HERE, AND RECORDED BELOW THE DELEGATION GATE. This arm knows the
+          // model overrode the `done` teeth, but the next gate down can still REFUSE the call and post
+          // nothing. Recording here would count an override that never reached the room: it would
+          // write a `reply.forced` row for an unsent message, and — worse — spend one of the turn's two
+          // overrides, so the NEXT genuine forced post would end the turn as if it were the second.
+          // The flag travels; `noteForcedOverrideThisTurn` runs once every pre-post refusal has passed.
+          doneForced = true;
+        } else if (!wasDoneRefusedThisTurn(turnId, input.wake)) {
+          markDoneRefusedThisTurn(turnId, input.wake);
+          await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), WAKE_DONE_REFUSAL_REASON);
+          throw new Error(answeredThisTurnRefusalMessage(input.wake));
+        }
+        // A BARE RE-SEND after the spent refusal writes no row, and that is not the same gap: nothing was overridden there. The valve stood aside, which the refusal already told the model it would.
+      }
+
+      // A turn may not CLOSE a wake its own running worker still owes. A seat that answers before the worker reports can post a fabricated result and mark the wake ANSWERED, which makes its own correction — written seconds later — unpostable.
+      // A hand-off note still posts with `done: false`. This is not a check on what the text says: the host cannot grade a listing's truth, but it knows the turn asked a worker for this answer and has not received it. Placed AFTER the fence, and read BEFORE the post so the address claim below cannot change the verdict underneath it.
+      const owingTask = pendingDelegationOwing(turnId, input.wake, addressedWakeThisTurn(turnId));
+      if (owingTask !== undefined && input.done !== false) {
+        await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), DELEGATION_PENDING_REFUSAL_REASON);
+        throw new Error(delegationPendingRefusalMessage());
+      }
+
+      // 🔴 THE `done` OVERRIDE IS RECORDED HERE, NOT AT THE ARM THAT DECIDED IT (OPE-1659). Every gate
+      // above this line can still refuse the call, and `delegation-pending` reads LIVE turn state — a
+      // turn that answered this wake, then dispatched a worker against it, then forced a second answer
+      // draws that refusal and posts nothing. Recording the override at the arm would write a
+      // `reply.forced` row for a message the room never saw, and spend one of the turn's two overrides
+      // on it, so the next genuine forced post would end the turn as if it were the second.
+      // The row still precedes the post, like the freshness and fold rows below, so all three count the
+      // same thing: a verdict this call really overrode on its way to the choke point.
+      if (doneForced) {
+        doneOverrides = noteForcedOverrideThisTurn(turnId, WAKE_DONE_FORCED_AUDIT_REASON, input.wake);
+        // The override is a ROW, so the pair (refusals, overrides) says whether the steer works. Its own reason, never a fold or freshness one — those count different decisions.
+        // ONE ROW PER WAKE PER TURN — the same key this arm's refusal record uses. The second override
+        // of one wake is the same decision again, and the live turn that wrote 100 of them buried the
+        // trail rather than extending it. The call still POSTS either way.
+        if (doneOverrides === 1) await auditReplyForced(replyAuditFor(bind, "tool", input.wake), WAKE_DONE_FORCED_AUDIT_REASON);
+      }
+
+      // The send is the consistency point: a burst does not arrive as one turn, so the model answers a room that has already moved on. This is the LAST refusal before the post — every guard above decides whether this turn MAY speak to this wake, and this one decides whether what it is about to say is still current. It reads the PENDING-WAKE STORE, not the turn wake: eve writes a turn's auth bag exactly once, from the first step, so `currentWakeId` is turn-constant and could never carry this signal. It refuses at most ONCE per turn per wake and fails open in every unknown direction, because a lost answer is worse than a stale one.
+      // `force` OVERRIDES the verdict, it does not skip the read. Running the check anyway is what makes a `reply.forced` row mean the model overrode a REAL staleness verdict rather than passed a flag on a conversation where nothing had raced.
+      if (!wasStaleRefusedThisTurn(turnId, input.wake)) {
+        const freshness = await replyFreshness(store, org, { target: origin, windowToken, inputWake: input.wake, turnWake });
+        if (freshness.stale && input.force !== true) {
+          markStaleRefusedThisTurn(turnId, input.wake);
+          await auditReplyRefused(replyAuditFor(bind, "tool", input.wake), REPLY_STALE_REFUSAL_REASON);
+          throw new Error(staleReplyRefusalMessage(freshness));
+        }
+        // 🔴 ONE ROW PER WAKE PER TURN, like the two sibling gates (OPE-1659). This gate's own
+        // refuse-once record is written on the REFUSAL alone, so before this the force branch re-read
+        // the store and re-wrote the row on every call of a looping turn.
+        if (freshness.stale) {
+          staleOverrides = noteForcedOverrideThisTurn(turnId, REPLY_FORCED_AUDIT_REASON, input.wake);
+          if (staleOverrides === 1) await auditReplyForced(replyAuditFor(bind, "tool", input.wake), REPLY_FORCED_AUDIT_REASON);
+        }
+      }
+
+      // 🔴 IS THIS POST THE SETTLEMENT REPORT THIS TURN OWES? (OPE-1753.) Asked HERE, above the fold
+      // gate that reads it, and reused after the post to discharge the duty. It must be resolved
+      // before the post either way, so the delivery cannot change the verdict underneath it.
+      // It compares CONVERSATIONS, never wake ids: the duty is armed with the wake the settlement
+      // installed — the task's own reply address — while the model replies under the wake of the
+      // conversation that asked, so the two name one room through two ids and an id test would
+      // answer false on the ordinary case. `deliveryReachedOwedConversation` states that in full.
+      const owedReport = settlementReportOwedOn(turnId);
+      const isSettlementReport =
+        owedReport !== undefined && (await deliveryReachedOwedConversation(store, org, owedReport.wake, input.wake, origin));
+
+      // The should-be-edit policy: when this seat's own last post is still the newest message in the room, a second post stacks where an edit would read as one message. Placed LAST, after the freshness gate — if newer messages arrived the model must re-decide WHAT to say before it is worth asking whether to fold — and refuse-once is keyed on the ROOM, not the wake, because the fold is about what the room last heard.
+      // The locus is the pure post-time `unifiedEditLocus`, the address the ledger row was WRITTEN at. NOT `resolveUnifiedEditLocus`: that retarget is what `edit_reply` needs to REACH a Discord auto-thread, which is a different question.
+      const foldOverrides = await refuseIfShouldFold({
+        store,
+        window: tailWindow(),
+        platform: origin.platform,
+        locus: unifiedEditLocus(origin),
+        turnId,
+        audit: replyAuditFor(bind, "tool", input.wake),
+        // 🔴 OPE-905 — WHICH WAKE THIS POST ANSWERS. A fold target that answered a DIFFERENT wake is
+        // not a fold target: merging the answer to question 2 into the message that answers question
+        // 1 is what the model declined on 9 of 9 measured occasions.
+        answeringWake: input.wake,
+        force: input.force === true,
+        // 🔴 OPE-1753 — THE SETTLEMENT REPORT IS EXEMPT from this policy. `channels/reply-fold.ts`'s
+        // `settlementReport` input carries the whole argument: the fold's "nobody spoke since our
+        // last post" proxy is false on a settlement turn, because the worker spoke.
+        // ASKED ONCE, ABOVE, and reused below to discharge the duty — one question, one answer, so
+        // the gate this post skipped and the row it writes can never disagree about whether this
+        // post WAS the report.
+        settlementReport: isSettlementReport,
+      });
+
+      // OPE-1358 — WHAT THIS RUN COULD NOT DO, appended below the model's own text. Read-and-reset,
+      // so it rides the first message this run posts after the refusal and never repeats. Empty on
+      // every turn that was refused nothing, which is every ordinary reply.
+      // `input.wake` is passed so a fire whose own turn was DROPPED still carries its refusal block:
+      // the corrective re-drive is a new turn, and the wake it re-stamps is what links the two
+      // (OPE-1982, `approvals/card-signal.ts`). On every ordinary reply the ledger is empty and this
+      // reads exactly as it did.
+      const framed = withRunRefusalBlock(input.text, consumeRoutineRunPermissionRefusals(input.wake));
+
+      // OPE-1915 — AN EXPLICIT REMEMBER-ASK PERSISTS BEFORE THE POST, NOT AFTER IT. `session-persist`
+      // is the only road whose write this turn's evidence ledger records as a stored FACT, so it is
+      // the only write the claim guard inside this post can ever see; running it at `turn.completed`
+      // alone put every seat's own edit behind its own ack. A no-op on every turn nobody asked to
+      // remember anything, and it never throws.
+      await flushWriteIntentMemory(ctx as MemoryPersistContext);
+
+      // The canonical `reply.post` row is written INSIDE `postUnifiedReply`, the choke point, carrying this turn's wakeId and sessionId for the transcript join.
+      // `done` rides with it because one arm cannot post without it: a Linear `response` Agent Activity ENDS the agent session, so a hand-off note posted as one makes the real answer unpostable. Every other arm ignores the intent.
+      const id = await postUnifiedReply(
+        origin,
+        framed,
+        {},
+        replyAuditFor(ctx as BindableContext, "tool", input.wake),
+        replierFor(bind),
+        { terminal: input.done !== false },
+      );
+      markRepliedThisTurn(turnId);
+      // OPE-1520 — the stand-down acknowledgement is spent HERE, by a post that really landed, not
+      // by the read above: a call the gates below the read then refused must still be re-sendable.
+      // Both halves (OPE-1551): the turn slot, and the durable row that survives an instance change.
+      if (standDown.stopped) await spendStoppedAck(bind, turnId, "unified");
+      // OPE-816 — the per-wake accounting audit's evidence that THIS wake was acted on, `done` or
+      // not (channels/reply-signal.ts §REPLIED). Deliberately broader than the `done:true`-only mark
+      // below: a hand-off note (`done:false`) is still an action, not a dropped wake.
+      markWakeRepliedThisTurn(turnId, input.wake);
+      // OPE-819 — say WHICH GRAIN spoke, so the empty-step guard never silences a worker (a worker
+      // mounts `reply` too, and its empty final step is a real failure its caller is waiting on).
+      noteTerminalCallGrain(bind);
+
+      // OPE-1655 — THE PROMISE. This post rode a worker that has not reported, which is exactly the
+      // hand-off note `delegationPendingRefusalMessage` asks the model for. Recording it here is what
+      // makes the seat owe a report when the worker settles: on ship #188 five scenarios posted this
+      // note and then said nothing at settlement. EVERY task owed to this wake is recorded, not only
+      // the one the guard named, because a turn that fans out to several workers owes a report on
+      // whichever settles first. Session-durable, never-throws, and never a reason to fail a
+      // delivered reply.
+      if (owingTask !== undefined) {
+        for (const task of pendingDelegationsOwing(turnId, input.wake, addressedWakeThisTurn(turnId))) notePromisedReport(task);
+      }
+      // …and the other end of it: this post may BE the report a settlement turn owed. Discharging the
+      // duty is what stops the silence guard refusing a turn that has already delivered, and the row
+      // is the settle → reply link — the task the settlement wake arrived for, beside the wake the
+      // report reached. Written only on the turn that owed one, so an ordinary reply writes nothing.
+      //
+      // 🔴 THE CONVERSATION IS CHECKED, NOT THE TURN. A standing seat holds several conversations in
+      // one turn: A, where it said "I've started …", and B, a queued question. A's worker settles and
+      // the duty arms; the model then answers B. Discharging on any post would clear the duty and
+      // write a row naming B — a row asserting room A was told, while room A heard nothing. So the
+      // owed wake's conversation is resolved and compared, and a post to a sibling leaves the duty
+      // armed. Same-wake first, so the common case costs no store read.
+      // Best-effort throughout: a store hiccup here must never turn a delivered reply into a tool
+      // error, and an unresolvable owed wake leaves the duty armed rather than writing a false link.
+      if (owedReport !== undefined && isSettlementReport) {
+        dischargeSettlementReport();
+        await auditToolAction(ctx, SETTLEMENT_REPORT_POSTED_ACTION, { task: owedReport.task, wake: input.wake });
+      }
+
+      // The addressed wake is this turn's statement about which conversation it is working for, and a background task dispatched earlier in the same turn owes its answer there. A turn that merged queued deliveries carries only the LAST delivery's auth, so the dispatch edge's `currentWakeId` can name a SIBLING conversation. That merge is unreachable on eve 0.54.3 — only the caller-less task COMPLETION COHORT still folds, and it carries no `auth` — but the re-point is still LIVE: a turn woken by an INTERNAL wake answers a sibling conversation through the reply fence with no merge at all — the measured 2026-08-15 case (OPE-2042).
+      // AFTER the post, deliberately: this must never be able to turn a delivered reply into a tool error. The claim empties the ledger, so only the FIRST reply of a turn moves anything.
+      const claimed = claimTasksForAddressedWake(turnId, input.wake);
+      if (claimed.length > 0) {
+        await retargetTaskWakes({ org, tasks: claimed, addressedWakeId: input.wake, windowToken, turnId });
+      }
+
+      // 🔴 POST **THEN** MARK — the order is load-bearing (OPE-161 §5, F3). A turn that dies
+      // between the two leaves the wake PENDING, so the worst case is a later duplicate reply,
+      // never a lost answer. The reverse order lets a FAILED post consume the wake and then refuse
+      // the retry — an answer the human is waiting for becomes permanently unsendable.
+      // Best-effort: a store hiccup here must never turn a delivered reply into a tool error.
+      if (input.done !== false) {
+        await store.markUnifiedWakeAnswered(org, input.wake, new Date().toISOString(), turnId).catch(() => undefined);
+        // …and the SAME-TURN half of the same mark (OPE-568), read by the same-turn `done` teeth —
+        // which sit just below the authority fence in this execute (OPE-1452 moved them there so
+        // they can read the origin) — on the next call. Turn-local and never-throws, so it cannot
+        // change what the post above already did — the post-then-mark order is untouched.
+        markWakeDoneThisTurn(turnId, input.wake);
+      }
+      // 🔴 THE SPIN ENDS HERE (OPE-1659). A repeated override of one verdict in one turn is not a new
+      // judgement, and until this arm existed nothing on the host noticed it: the live loop stopped
+      // only when the session hit its 30,000,000-token limit, after 40 copies of one answer.
+      // AFTER THE POST, ALWAYS. The latch refuses nothing — it makes the NEXT model round-trip resolve
+      // the text-only stub (model/step-boundary.ts `closed` tier), so this message and every earlier
+      // one still land, and Tommy's ruling of 2026-09-03 is untouched: the double post is discouraged,
+      // never blocked. What ends is the turn, which is the same question `declined-this-turn` asks.
+      // Best-effort, like every mark below the post: `noteTurnCloseoutRefusal` never throws.
+      const overrides = Math.max(doneOverrides, staleOverrides, foldOverrides);
+      if (overrides >= FORCED_OVERRIDE_TURN_LIMIT) await noteTurnCloseoutRefusal(bind, REPLY_FORCED_LOOP_REASON);
+
+      // Affirm the wake's state at the moment of compliance, so the same-turn `done` teeth below the fence are the backstop rather than the teacher.
+      // It states the REFUSAL, not the valve behind it (OPE-1452): the guard's own copy names the way past it at the moment the model needs it, and naming it here would read as an invitation on every ordinary reply.
+      // 🔴 AND IT NEVER PROMISES A REFUSAL THE HOST WILL NOT MAKE (OPE-1659). On a call that OVERRODE a
+      // verdict the model has just proved "a second call is refused" false, so repeating it teaches the
+      // model that the host's words do not track what the host does. The overridden branch says what is
+      // true instead.
+      // 🔴 IT BRANCHES ON `doneOverrides`, NEVER ON THE TURN-WIDE MAX. This sentence asserts ONE gate's
+      // verdict — the same-turn `done` teeth — and the other two count calls where those teeth never
+      // fired. A FIRST `done:true` answer forced past a stale or fold verdict has `doneOverrides === 0`
+      // and a non-zero max, and the max-branched copy told it "this wake was already ANSWERED" (false,
+      // it is the first answer) and "a further call is NOT refused" (false — `isWakeDoneThisTurn` is
+      // true from here, so the next call draws `answered-this-turn`). That is this ticket's own defect
+      // inverted: the note would invite the very call it was wrong about.
+      const doneNote =
+        input.done !== false
+          ? doneOverrides === 0
+            ? " This wake is now ANSWERED — do not reply to it again in this turn; a second call is refused."
+            : " This wake was already ANSWERED and you overrode that verdict, so a further call is NOT refused — it just repeats you in the room."
+          : " This wake stays OPEN (`done:false`) — reply to it again when the rest of the answer is ready.";
+      // WHAT TO DO INSTEAD, named at the moment the model can still act on it. This is the signal the
+      // looping seat never got: it read `posted: true` and an unchanged note on all 40 of its posts.
+      // 🔴 IT NAMES AN ID ONLY WHERE ONE EXISTS. `postUnifiedReply` answers the dedupe sentinel when
+      // `postOnce` suppressed byte-identical text (channels/reply-post.ts `REPLY_DEDUPE_SKIPPED_ID`),
+      // and steering `edit_reply` at that string would refuse as `not-own-post` — a steer the model
+      // cannot follow is worse than none. The verb is named either way; only the argument drops.
+      const editSteer = id === REPLY_DEDUPE_SKIPPED_ID ? "`edit_reply`" : `\`edit_reply\` with wake \`${input.wake}\` and message_id \`${id}\``;
+      const overrideNote =
+        overrides === 0
+          ? ""
+          : overrides >= FORCED_OVERRIDE_TURN_LIMIT
+            ? ` You have now overridden the same host verdict ${overrides} times in this turn, so this turn ENDS after your next step. Post nothing further here: to correct what you said, call ${editSteer}.`
+            : ` You overrode a host verdict, so this landed as a SECOND message beside your own last one. Prefer ${editSteer} over a third message here, and finish with \`no_reply\` when you are done.`;
+      // 🔴 AND THE TAIL DOES NOT SAY "KEEP WORKING" TO A TURN THAT IS ENDING. Two sentences in one note
+      // pulling opposite ways is the same defect as the false refusal promise above.
+      const tailNote =
+        overrides >= FORCED_OVERRIDE_TURN_LIMIT ? " Your terminal prose is still discarded." : " Keep working if needed; your terminal prose is still discarded.";
+      // Only on the post that RODE a pending worker; every other reply reads byte-identical prose.
+      // The sentence itself lives in `channels/turn-delivery.ts` — one string, shared with the other
+      // three doors, which face the same hazard on the same condition (OPE-1544, OPE-1575).
+      const pendingNote = owingTask !== undefined ? PENDING_WORK_INSTRUCTION : "";
+      return {
+        posted: true,
+        id,
+        note: `Turn reply requirement satisfied — posted to ${origin.platform}.${doneNote}${overrideNote}${pendingNote}${tailNote}`,
+      };
+    },
+});
+
+// The base (per-surface) variant, registered under its own `_base` entryKey by the dispatcher below. One description everywhere: the steer is fewer, curated messages, and `edit_reply` is how the model keeps one of them right.
+// 🔴 This string must NOT claim a post is final. A per-surface seat holds `edit_reply` and reads a seat prompt that offers it, and a model that believes a post is final does not reach for the verb it holds. Exported so its pinning test reads the real description rather than a copy.
+export const baseReplyEntry = defineTool({
+        description:
+          "Post a message into this conversation NOW, without ending your turn. Posting is an " +
+          "action, not turn-completion: reply, keep working, and finish with `no_reply` when " +
+          "you're done. A reply NOTIFIES the channel — use it for an answer, a question, a " +
+          "result, or a blocker, never for a mere progress tick. Send fewer, curated messages " +
+          "rather than a running status: to correct one you already sent, call `edit_reply` with " +
+          "the id this tool returned instead of posting again. Posts into the conversation that " +
+          "woke you; you can't target another place.",
+        inputSchema: z.object({
+          text: z.string().min(1).describe("The message to post (channel mrkdwn/markdown). Keep it one curated message, not a stack."),
+        }),
+        // `note` carries the pending-work instruction on the turns that owe it (OPE-1575). A result key
+        // absent from the schema is a key the model may never be shown, so the sentence needs a declared
+        // field to ride; the field is always present and always a sentence, so the constant's own
+        // leading-space contract holds on this door as it does on the unified one.
+        // 🔴 WHAT ADDING IT DOES TO A REPLAYED SESSION, MEASURED — NOT what a zod object would do. eve
+        // persists the SERIALIZED output schema with the session (`serializeOutputSchema`) and rebuilds
+        // the tool from that copy on a replay (`toOutputSchema`, i.e. `z.fromJSONSchema`), taking
+        // `execute` from the durable callback slot. That round trip emits `additionalProperties: false`,
+        // so the rebuilt schema is STRICT: a session that persisted the old `{ posted, id }` holds a
+        // schema that would REJECT this execute's third key with `unrecognized_keys`. It does not strip
+        // it. Nothing throws for a different reason — eve ATTACHES the rebuilt schema to the tool
+        // definition and never validates a tool RESULT against it (`harness/execute-tool.js` does not
+        // mention `outputSchema` at all), so the schema decides nothing at the moment the result is
+        // returned. The residual is exactly that: a consumer that DOES apply the schema — eve's bundled
+        // MCP server has a `validateToolOutput` — would reject on a session replayed from a pre-change
+        // schema, until that session ends. scripts/reply-delegation-pending-test.ts §12e drives the real
+        // pairing and holds the tripwire on the "never validates" half.
+        outputSchema: z.object({ posted: z.boolean(), id: z.string(), note: z.string() }),
+        // NO `approval:` — same DYNAMIC-tool-on-resumed-session pin as react.ts/read_thread.ts:
+        // an approval fn registered at session.started doesn't replay-lookup on a resumed session,
+        // forcing an ungrantable "user-approval" that kills the turn. Absent approval === never().
+        async execute(input, ctx) {
+          const target = resolveReplyTarget(ctx);
+          if (!target) {
+            throw new Error(
+              "reply couldn't resolve this conversation — try again from a real channel, thread, or discussion, not a synthetic context.",
+            );
+          }
+          // The should-be-edit policy's per-surface half: same module, same verdict, same refuse-once-per-room valve. This variant has no `force` input, so a re-send is the only valve, and it is OFF wherever the session files no ring.
+          // No `answeringWake`, because this variant takes no wake ARGUMENT and its turn holds no wake stamp either — a per-surface delivery never carries `oe_wake_id` (channels/turn-delivery.ts states where that stamp is written). Its verdict keeps the pre-OPE-905 shape, unchanged.
+          // 🔴 IN PRACTICE OPE-1528 TURNS THE POLICY OFF HERE, and by the other half of the rule: this variant's posts are recorded with NO wake either, so every ring row a seat mounting it produces is a target whose own wake is unknown, and an unknown target never folds. Giving this variant a wake id would restore the policy AND arm the OPE-905 guard on it — that is the fix, not softening the target rule. It is not free: the wake would ride `replyAuditFor` into this variant's `reply.post` rows too, which is an audit-shape change and its own ticket.
+          const bindBase = ctx as BindableContext;
+          const baseTurnId = currentTurnId(bindBase);
+          // THE STORED STAND-DOWN, RE-READ (OPE-1520) — the same guard as the unified variant, and
+          // it needs no wake gate here: this variant "posts into the conversation that woke you; you
+          // can't target another place", so the bound registry key IS the key of the room this post
+          // is going to.
+          const standDownBase = await standDownState(bindBase, baseTurnId);
+          if (standDownBase.refuse) {
+            await noteTurnCloseoutRefusal(bindBase, REPLY_STOPPED_REFUSAL_REASON);
+            await auditReplyRefused(replyAuditFor(bindBase, "tool"), REPLY_STOPPED_REFUSAL_REASON);
+            throw new Error(stoppedRefusalText());
+          }
+          // 🔴 THE PENDING-WORK CONDITION, ON THE PER-SURFACE DOOR (OPE-1575). A standing channel-root
+          // seat on a per-surface deployment delegates — `access/window-gate-manifest.ts` scopes the verb
+          // as `agent: ["standing", "thread"]` — and the resolver below mounts THIS variant for that seat.
+          // So it can dispatch a worker and then post, and until this read the sentence reached the
+          // unified doors alone. Read BEFORE the post, like the unified door, so the platform call cannot
+          // change the verdict underneath it.
+          // 🔴 WHAT IT ASKS ABOUT, and why it is the WAKE-FREE reader (OPE-1601). A per-surface delivery
+          // carries NO `oe_wake_id` — the stamp is written on the unified window divert alone — so
+          // `currentWakeId` is `undefined` here on every turn, and the wake-keyed sibling REFUSES an
+          // empty wake. This seat holds ONE conversation for the whole turn, so "a worker this turn
+          // dispatched is still running" and "a worker this conversation is owed" are the same fact;
+          // `access/pending-delegation-signal.ts` states that equality and why it holds here alone.
+          const owingTask = pendingDelegationThisTurn(baseTurnId);
+          // Only a session that files a ring can draw this verdict, so the store is not even resolved
+          // for the sessions that never could — every native, task and DM seat.
+          const foldWindow = tailWindow();
+          if (foldWindow) {
+            await refuseIfShouldFold({
+              store: getOperationalStore(),
+              window: foldWindow,
+              platform: target.platform,
+              locus: replyEditLocus(target),
+              turnId: baseTurnId,
+              audit: replyAuditFor(bindBase, "tool"),
+            });
+          }
+          // OPE-1915 — the same in-turn persist the unified door runs, for the same reason. One word,
+          // one meaning across the doors: a seat cannot read a difference that is not there.
+          await flushWriteIntentMemory(ctx as MemoryPersistContext);
+          // The canonical reply.post row is written INSIDE postReply (the choke point) —
+          // route:"tool". Mark BEFORE it (best-effort, never-throws) — this is what lets the
+          // bare-stop check (slack-events.ts isBareStop) know the turn DID post even if its
+          // final text completion comes back empty. See channels/reply-signal.ts.
+          const id = await postReply(target, input.text, replyAuditFor(bindBase, "tool"), replierFor(bindBase));
+          markRepliedThisTurn(baseTurnId);
+          // OPE-1520 — spent by a post that really landed; see `standDownState`'s POST-THEN-MARK note.
+          if (standDownBase.stopped) await spendStoppedAck(bindBase, baseTurnId, "per-surface");
+          noteTerminalCallGrain(bindBase); // OPE-819 — see the unified variant above
+          // The SAME sentence the unified doors append, on the same condition — one word, one meaning
+          // across all four doors, so a seat cannot read a difference that is not there (OPE-1575).
+          // The lead sentence claims nothing this door cannot keep: it never says the terminal prose is
+          // discarded, because two of the per-surface arms POST that prose (channels/reply-signal.ts
+          // §STOOD-DOWN names which), and it carries no `done` state, because this variant has no `done`.
+          return {
+            posted: true,
+            id,
+            note: `Posted to ${target.platform}.${owingTask !== undefined ? PENDING_WORK_INSTRUCTION : ""}`,
+          };
+        },
+});
+// eve keys a durable dynamic-tool callback on `(toolName, phase)` alone, so two entries named `reply` share ONE `execute` slot and the last resolver in the process wins it. A replayed turn rebuilds the tool from its persisted description and schema but takes `execute` from that slot: a unified seat was measured being offered the unified contract while running the per-surface implementation, which holds no wake-authority fence and no `wake` input, and a fabricated wake id posted.
+// `preRegisterDynamicVariants` gives eve one dispatcher and persists each variant's key in its own durable closure, so a replay runs the exact variant the session mounted.
+preRegisterDynamicVariants("reply", { _base: baseReplyEntry, _single: unifiedReplyEntry });
+
+export default defineDynamic({
+  events: {
+    "session.started": (_event, ctx) => {
+      // A single-window unified session gets the map-addressed variant REGARDLESS of the origin platform's manifest, because the unified channel posts through its own arms rather than reply-post.ts's.
+      // Checked on the RAW channel kind, so it can never trigger off a normal per-surface session.
+      const bind = ctx as BindableContext;
+      if (isUnifiedWindowContext(bind)) return unifiedReplyEntry;
+      const manifest = capabilitiesFor(bind);
+      if (!manifest.midTurnPost) return null; // hide where there's no mid-turn post primitive
+      // There is deliberately NO grain gate here. The old one hid `reply` on a Linear container-supervisor turn, because such a turn holds no agent session and the arm's only route was the Agent-Session activity; the arm now carries a second honest route for exactly that turn, so the premise is false and re-adding a gate would hide a verb that works.
+      // The honest-availability bar this file's header states is still enforced one rung lower, at `resolveReplyTarget`: a turn whose binding names no postable anchor gets a refusal that says so, rather than a silent absence.
+      return baseReplyEntry;
+    },
+  },
+});