@open-everywhere/core 0.1.0

package/dist/agent/channels/attachments.js

@@ -0,0 +1,157 @@
+// attachments — the NEUTRAL, platform-keyed seam an attachment reader consults to turn a model-named attachment id into bytes, without the tool knowing which chat platform minted the id. Core owns the registry and the resolve entry points; each channel adapter plugs a resolver in at boot.
+// The plane is PURE INDIRECTION and adds no trust of its own: each resolver owns its full provenance and fetch discipline, no resolver ever sees a raw host URL, an id no resolver claims answers `undefined` so the caller fails closed, and a resolver that owns an id but cannot fetch it THROWS.
+import { admitProviderRegistration } from "../access/provider-selection.js";
+/** Thrown by {@link GuardedAttachment.pull} when an upload exceeds the caller's `maxBytes`. `phase`
+ *  distinguishes the pre-read Content-Length rejection ("declared" — nothing was downloaded) from the
+ *  post-read cap ("actual" — a chunked response overran an absent/short Content-Length). */
+export class AttachmentOversizeError extends Error {
+    bytes;
+    phase;
+    maxBytes;
+    constructor(bytes, phase, maxBytes) {
+        super(`attachment too large (${bytes} bytes; max ${maxBytes})`);
+        this.bytes = bytes;
+        this.phase = phase;
+        this.maxBytes = maxBytes;
+        this.name = "AttachmentOversizeError";
+    }
+}
+const resolvers = new Map();
+/** Register a channel adapter's attachment resolver (adapter/channel boot). Idempotent per
+ *  platform key: a re-registration replaces the prior resolver for that platform. */
+export function registerAttachmentResolver(resolver) {
+    if (!admitProviderRegistration(resolver.platform, "attachment-resolver"))
+        return;
+    resolvers.set(resolver.platform, resolver);
+}
+/**
+ * Resolve a model-named attachment id to its bytes, trying each registered resolver in registration order; the first to return a value wins.
+ * `undefined` when NO resolver claims the id, so the caller fails closed. A resolver that owns the id but fails to fetch THROWS, and that propagates as a genuine error.
+ */
+export async function resolveAttachment(attachmentId, ctx) {
+    for (const resolver of resolvers.values()) {
+        const res = await resolver.resolve(attachmentId, ctx);
+        if (res)
+            return res;
+    }
+    return undefined;
+}
+/**
+ * Resolve a model-named attachment id to a SIZE-GUARDED source, trying each registered resolver's `resolveGuarded` in registration order; the first to return a value wins.
+ * `undefined` when no resolver claims the id or its platform supports no guarded read, so the caller fails closed. A resolver that owns the id but fails to probe THROWS; the bounded fetch itself is deferred to {@link GuardedAttachment.pull}.
+ */
+export async function resolveGuardedAttachment(attachmentId, ctx) {
+    for (const resolver of resolvers.values()) {
+        if (!resolver.resolveGuarded)
+            continue;
+        const res = await resolver.resolveGuarded(attachmentId, ctx);
+        if (res)
+            return res;
+    }
+    return undefined;
+}
+export function _resetAttachmentPlaneForTest() {
+    resolvers.clear();
+}
+/** How many elements one brief carries. A wake can name more uploads than a worker will ever read,
+ *  and the block rides beside a model's own words — a bound keeps a pathological wake from crowding
+ *  the caller's message out.
+ *
+ *  🔴 THE BOUND KEEPS THE NEWEST, NOT THE OLDEST. An envelope renders its BACKSCROLL first and the
+ *  trigger message LAST, and a coalesced delivery can carry several envelopes, so a bound that broke
+ *  at the first eight would drop the file the person just uploaded and keep eight older ones — the
+ *  exact `unknown-attachment` symptom this carriage exists to close. */
+const MAX_BRIEF_ATTACHMENTS = 8;
+const ATTACHMENT_ELEMENT_RE = /<attachment\b([^>]*)\/>/g;
+/** What a chat platform's file id may look like. Deliberately narrow — Slack's `F0…`, Discord's
+ *  snowflake, Teams' GUID and a URL-safe key all fit, and nothing with a space, a quote, an angle
+ *  bracket or a newline does. An id that fails this is DROPPED, never repaired. */
+const ATTACHMENT_ID_RE = /^[A-Za-z0-9._:@+~-]{1,128}$/;
+/** The longest label this carriage will re-emit. A name is a person-chosen string and has no natural
+ *  bound; the brief is not the place to discover one. */
+const MAX_LABEL_CHARS = 200;
+/** Characters that cannot appear inside a RENDERED attribute value, because
+ *  channels/wake-envelope.ts `escapeXml` has already replaced every one of them. A value carrying one
+ *  did not come from the renderer, so the label is dropped rather than re-emitted. */
+const UNRENDERABLE_LABEL_RE = /[<>"&\n\r]/;
+function attrOf(attrs, name) {
+    const m = new RegExp(`\\b${name}="([^"]*)"`).exec(attrs);
+    const value = m?.[1];
+    return value !== undefined && value.length > 0 ? value : undefined;
+}
+/** A label this carriage will re-emit, or `undefined`. See {@link UNRENDERABLE_LABEL_RE}. */
+function labelOf(attrs, name) {
+    const value = attrOf(attrs, name);
+    if (value === undefined || value.length > MAX_LABEL_CHARS)
+        return undefined;
+    return UNRENDERABLE_LABEL_RE.test(value) ? undefined : value;
+}
+/**
+ * Lift the `<attachment/>` elements out of ONE rendered wake envelope.
+ *
+ * An element with no admissible `id` is DROPPED: the id is the only thing a worker can resolve, so an
+ * element without one would hand the worker the same filename that failed. The last
+ * {@link MAX_BRIEF_ATTACHMENTS} survive.
+ *
+ * ── WHAT STOPS AN AUTHOR FORGING AN ELEMENT, STATED HONESTLY BECAUSE THE OBVIOUS ANSWER IS INCOMPLETE
+ * The obvious answer is the renderer: channels/wake-envelope.ts runs `escapeXml` over every message
+ * body on both its fenced and its unfenced arm, so a person who types `<attachment id="…"/>` into a
+ * Slack message reaches a rendered envelope as `&lt;attachment id=…`. That holds — for a RENDERED
+ * ENVELOPE.
+ *
+ * 🔴 IT DOES NOT HOLD FOR EVERY DELIVERY. `channels/normalized-wake.ts` `renderWake` emits an
+ * `addressing === "direct"` trigger as the author's body VERBATIM and unescaped, and Discord
+ * classifies every DM and every mention as `direct`. So a caller that points this parser at a raw
+ * delivery is pointing it at author-authored bytes. `isWakeEnvelopeShaped` is the caller's gate, and
+ * on that path it is a heuristic rather than a proof — a body can spell `<message` too.
+ *
+ * SO THE CONTROL IS HERE, NOT UPSTREAM, and it is admission rather than trust: an `id` must match
+ * {@link ATTACHMENT_ID_RE}, and a `kind`/`name`/`mimetype` that is over-long or carries a character
+ * the renderer's own escaping would have removed is dropped. A forged element can therefore name at
+ * most a plausible file id — which the SEAT's model already holds in its own envelope and could type
+ * into the brief by hand — and can carry no prose, no framing and no markup into the block.
+ */
+export function parseWakeAttachments(envelope) {
+    const found = [];
+    for (const m of envelope.matchAll(ATTACHMENT_ELEMENT_RE)) {
+        const attrs = m[1] ?? "";
+        const id = attrOf(attrs, "id");
+        if (id === undefined || !ATTACHMENT_ID_RE.test(id))
+            continue;
+        found.push({ id, kind: labelOf(attrs, "kind"), name: labelOf(attrs, "name"), mimeType: labelOf(attrs, "mimetype") });
+    }
+    return found.slice(-MAX_BRIEF_ATTACHMENTS);
+}
+/** The block a worker brief carries. Empty string for no attachments, so the caller appends nothing
+ *  at all on the overwhelmingly common path and the brief stays byte-identical to the model's own
+ *  words. */
+function renderAttachmentBrief(attachments) {
+    if (attachments.length === 0)
+        return "";
+    const elements = attachments
+        .map((a) => {
+        const attr = (n, v) => (v === undefined ? "" : ` ${n}="${v}"`);
+        return `<attachment${attr("kind", a.kind)} id="${a.id}"${attr("name", a.name)}${attr("mimetype", a.mimeType)}/>`;
+    })
+        .join("\n");
+    return [
+        "",
+        "<delegated-attachments>",
+        "The conversation this task came from carries the files below. To read one, pass its `id` — never",
+        "its name — as the attachment reference. A name resolves to nothing.",
+        elements,
+        "</delegated-attachments>",
+    ].join("\n");
+}
+/**
+ * Append the delegation brief's attachment block to a worker `message`.
+ *
+ * A strict no-op when the wake named no attachment, which is nearly every delegation. The block goes
+ * AFTER the caller's own words so the task statement still leads — the worker reads its instruction
+ * first and the file table second.
+ */
+export function withDelegatedAttachments(message, attachments) {
+    const block = renderAttachmentBrief(attachments);
+    return block.length === 0 ? message : `${message}\n${block}`;
+}
+//# sourceMappingURL=attachments.js.map

package/dist/agent/channels/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../../../agent/channels/attachments.ts"],"names":[],"mappings":"AAAA,kSAAkS;AAClS,qSAAqS;AAGrS,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAgC5E;;4FAE4F;AAC5F,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAErC,KAAK;IACL,KAAK;IACL,QAAQ;IAHnB,YACW,KAAa,EACb,KAA4B,EAC5B,QAAgB;QAEzB,KAAK,CAAC,yBAAyB,KAAK,eAAe,QAAQ,GAAG,CAAC,CAAC;qBAJvD,KAAK;qBACL,KAAK;wBACL,QAAQ;QAGjB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAgBD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;AAExD;qFACqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,QAA4B;IACrE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QAAE,OAAO;IACjF,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,GAAoB;IAChF,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,YAAoB,EAAE,GAAoB;IACvF,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,cAAc;YAAE,SAAS;QACvC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAC7D,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAoCD;;;;;;;wEAOwE;AACxE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAEzD;;mFAEmF;AACnF,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD;yDACyD;AACzD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;sFAEsF;AACtF,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,SAAS,MAAM,CAAC,KAAa,EAAE,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,6FAA6F;AAC7F,SAAS,OAAO,CAAC,KAAa,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IAC5E,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED;;aAEa;AACb,SAAS,qBAAqB,CAAC,WAAuC;IACpE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,WAAW;SACzB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,CAAqB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3F,OAAO,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IACnH,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO;QACL,EAAE;QACF,yBAAyB;QACzB,kGAAkG;QAClG,qEAAqE;QACrE,QAAQ;QACR,0BAA0B;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,WAAuC;IAC/F,MAAM,KAAK,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC;AAC/D,CAAC"}

package/dist/agent/channels/aws-sso-callback.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=aws-sso-callback.d.ts.map

package/dist/agent/channels/aws-sso-callback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sso-callback.d.ts","sourceRoot":"","sources":["../../../agent/channels/aws-sso-callback.ts"],"names":[],"mappings":""}

package/dist/agent/channels/aws-sso-callback.js

@@ -0,0 +1,8 @@
+// Deployment mount for `GET /oauth/v1/aws-sso/callback`; the behaviour lives in connections/aws-sso-callback.ts.
+// The completer resolves per request, so the route fails closed whenever the AWS adapter is not registered.
+import { defineChannel, GET } from "eve/channels";
+import { OE_AWS_SSO_CALLBACK_PATH, handleAwsSsoCallback } from "../connections/aws-sso-callback.js";
+export default defineChannel({
+    routes: [GET(OE_AWS_SSO_CALLBACK_PATH, async (req) => handleAwsSsoCallback(req))],
+});
+//# sourceMappingURL=aws-sso-callback.js.map

package/dist/agent/channels/aws-sso-callback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sso-callback.js","sourceRoot":"","sources":["../../../agent/channels/aws-sso-callback.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,4GAA4G;AAE5G,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAEpG,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;CAClF,CAAC,CAAC"}

package/dist/agent/channels/backscroll-window.d.ts

@@ -0,0 +1,76 @@
+import type { WakeMessageInput, WakeTrust } from "./wake-envelope.js";
+import { type SeatAdmissionFn } from "./seat-admission.js";
+/**
+ * A surface-neutral backscroll message: the least-common-denominator shape every fetch adapter normalizes its raw API JSON into, so this core never sees platform specifics.
+ * Already visibility-gated by the adapter.
+ */
+export interface NormalizedMessage {
+    /** Opaque platform message id (Slack ts, Discord snowflake, …) — rendered as the message `id`. */
+    readonly id: string;
+    /** Epoch milliseconds of the message — the only time input this core reasons over (ordering and
+     *  the rendered `sent-at`). The adapter computes it from its platform ts. */
+    readonly ms: number;
+    /** Raw platform author id (for `author-id` / @-tagging); undefined for the bot's OWN posts
+     *  (`sender==="self"`). For a `human` it is the user id; for a `bot` it is the foreign bot's id. */
+    readonly authorId?: string;
+    /** Who authored this message: `self` = the bot's OWN prior post (→ `from="self"`); `human` = a
+     *  workspace member (→ `from="human"`); `bot` = an ATTRIBUTABLE foreign bot (→ `from="bot"`,
+     *  clearly bot-flagged MARKED AWARENESS, CONTEXT-ONLY — never emitted as a wake trigger). */
+    readonly sender: "self" | "human" | "bot";
+    /** `channel` = a top-level channel message; `thread` = a reply inside a thread (→ `type="thread"`
+     *  + `thread="<root id>"`). */
+    readonly type: "channel" | "thread";
+    /** The thread ROOT id when `type==="thread"` — rendered as the `thread` attribute. */
+    readonly threadId?: string;
+    /** The message text (untrusted by provenance — the envelope renderer wraps + escapes it). */
+    readonly text: string;
+}
+/**
+ * THE ONE SENDER RULE EVERY CATCH-UP FETCH TAKES (OPE-1857) — the vendor's own two signals in, the
+ * neutral {@link NormalizedMessage.sender} out. A surface contributes the FACTS it read; this
+ * decides what they mean, so six adapters cannot spell one classification six ways.
+ *
+ * `self` — this deployment authored the message. It wins over everything: our own words are never a
+ * foreign bot.
+ * `bot` — the vendor POSITIVELY said the author is a machine.
+ * 🔴 EVERYTHING ELSE IS A PERSON, AND AN ABSENT SIGNAL IS THE CASE THIS RULE EXISTS FOR. `bot`
+ * undefined means the surface could not tell, and an author it could not tell about is a person it
+ * could not VOUCH — which is the fail-closed answer, because the tier such a person floors at is
+ * `unauth` (see {@link fetchedBackscroll}'s per-sender default) and a policy judges that tier.
+ * Reading an absent signal as `bot` is fail-OPEN in the only direction that matters here: the
+ * default `wide` admission policy refuses every bot, so a surface whose vendor omits the field
+ * refuses EVERY author on EVERY wake and its seat reads the room as permanently silent.
+ * THAT IS MEASURED, NOT THEORETICAL. Notion serves a comment's `created_by` as a PARTIAL user —
+ * `id` and `object`, no `type` (packages/providers/notion/agent/channels/notion-api.ts) — and its
+ * catch-up normalizer read the absent `type` as "not a person". Ship #212 read the seat's page,
+ * kept the four comments through the bounds, and the admission policy then refused all four
+ * (`seat.catch_up outcome=empty raw=4 kept=0 reason=admission-dropped-all`). A real page member's
+ * comment was refused by exactly that arithmetic, so the defect was never about the e2e driver.
+ * 🔴 IT IS THE SAME RULE channels/seat-admission.ts ALREADY FIXES for the rendered context-line
+ * road: "a line the surface could not attribute is a person it could not vouch". One road spelled it
+ * and the other did not, which is the whole of OPE-1857.
+ * Pure.
+ */
+export declare function catchUpSender(f: {
+    readonly self: boolean;
+    readonly bot?: boolean;
+}): NormalizedMessage["sender"];
+/** The rendered token cost of one normalized message, by the proxy above. Pure. */
+export declare function approxMessageTokens(m: NormalizedMessage): number;
+/** Per-message trust resolver (identity/wake-trust.ts vocabulary): the caller that KNOWS the surface
+ *  facts maps each message's author to its tier — build one with `backscrollTrustResolver`. Absent,
+ *  {@link toWakeMessage} falls back to its fail-closed per-sender default. */
+export type BackscrollTrustFor = (m: NormalizedMessage) => WakeTrust;
+/**
+ * The OLDEST bound of a seat's catch-up read: the seat's own last wake, floored by `maxReachbackHours` so a seat that has been quiet for a month reads the recent tail rather than a month of history. Returns epoch milliseconds. Pure.
+ * `maxReachbackHours` is the ADAPTER's own bootstrap reachback, passed in rather than redeclared here, so the catch-up floor and the bootstrap window can never drift apart. The adapter applies the same floor to its raw fetch; this is the caller-side statement of the same bound, and the two agreeing is the point.
+ * `lastWakeAt` absent or unparseable ⇒ the floor alone, which is exactly the bootstrap window a first wake already took — so a seat with no recorded wake degrades to today's behaviour instead of reading nothing.
+ */
+export declare function seatCatchUpSinceMs(lastWakeAt: string | null | undefined, nowMs: number, maxReachbackHours: number): number;
+/**
+ * The whole core in one call: order the fetched window oldest-first, apply the domain's ADMISSION policy, keep the NEWEST admitted messages that fit `capTokens`, and emit them oldest-first as wake messages.
+ * ONE BUNDLE, not one per surface: a caller with several containers passes them all together, so the cap is shared and the result is one interleaved timeline, which is what a single window IS. Pure, and it always keeps at least one message when anything was admitted.
+ * 🔴 ADMISSION RUNS BEFORE THE CAP, never after: a refused author's bytes must not eat an admitted message out of the cap, which is the difference between "the seat did not read that bot" and "the seat read the bot instead of the person". The policy judges the RESOLVED trust tier, so the tier is computed once here and reused for the render.
+ */
+export declare function fetchedBackscroll(messages: readonly NormalizedMessage[], capTokens?: number, trustFor?: BackscrollTrustFor, admit?: SeatAdmissionFn): WakeMessageInput[];
+//# sourceMappingURL=backscroll-window.d.ts.map

package/dist/agent/channels/backscroll-window.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backscroll-window.d.ts","sourceRoot":"","sources":["../../../agent/channels/backscroll-window.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAExE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;iFAC6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;wGACoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;iGAE6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IAC1C;mCAC+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC;IACpC,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAGhH;AAUD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAEhE;AAED;;8EAE8E;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EAAE,iBAAiB,KAAK,SAAS,CAAC;AAsBrE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAM1H;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,GAAE,MAAuB,EAClC,QAAQ,CAAC,EAAE,kBAAkB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB,gBAAgB,EAAE,CAiBpB"}

package/dist/agent/channels/backscroll-window.js

@@ -0,0 +1,106 @@
+// backscroll-window — the platform-NEUTRAL read of a container's own history for a standing seat: the BOOTSTRAP path for a seat with no recorded tail to inherit (a brand-new channel or domain, or a generation minted before the tail ring existed), and the SINCE-LAST-WAKE catch-up every later wake takes (OPE-1695 (b)). A rotation that HAS a tail rebuilds from channels/session-tail.ts instead, at zero platform calls.
+// 🔴 THE CATCH-UP IS WHAT MAKES A STANDING SEAT AWARE WITHOUT A QUEUE. A seat wakes on addressing, or on ambient talk where the domain says so; everything that happened in between — the room's own conversation, and the replies inside threads a worker or a thread seat owns — enters the NEXT wake as capped, admission-filtered context. No queue, no turn per message, and the seat is never told about a room it did not read.
+// 🔴 THE SURFACE BOUND, stated here because this core is the shared half: the catch-up needs an ADAPTER that can fetch a normalized window of its own container history. Every surface registers one now (channels/seat-catch-up.ts, OPE-1726), and that registry — not this file — is where a reader checks whether a given surface can catch up. A platform with no registered fetch reports the catch-up UNAVAILABLE in its wake rather than rendering an empty context. That names a STRUCTURAL absence only: a REGISTERED fetch that fails stays fail-soft to empty (channels/seat-catch-up.ts), so a revoked history scope does read as a quiet room.
+// The visibility and trust gate is the ADAPTER's job, never this core's: each adapter drops unattributable senders during normalization, so every message arriving here is one a live wake could surface. An ATTRIBUTABLE foreign bot is not dropped — it arrives tagged `bot`, marked awareness and context-only — and the DOMAIN's admission function decides whether it, or anyone else, enters (channels/seat-admission.ts).
+import { tailTokenCap } from "./session-tail.js";
+import { admitToSeat } from "./seat-admission.js";
+/**
+ * THE ONE SENDER RULE EVERY CATCH-UP FETCH TAKES (OPE-1857) — the vendor's own two signals in, the
+ * neutral {@link NormalizedMessage.sender} out. A surface contributes the FACTS it read; this
+ * decides what they mean, so six adapters cannot spell one classification six ways.
+ *
+ * `self` — this deployment authored the message. It wins over everything: our own words are never a
+ * foreign bot.
+ * `bot` — the vendor POSITIVELY said the author is a machine.
+ * 🔴 EVERYTHING ELSE IS A PERSON, AND AN ABSENT SIGNAL IS THE CASE THIS RULE EXISTS FOR. `bot`
+ * undefined means the surface could not tell, and an author it could not tell about is a person it
+ * could not VOUCH — which is the fail-closed answer, because the tier such a person floors at is
+ * `unauth` (see {@link fetchedBackscroll}'s per-sender default) and a policy judges that tier.
+ * Reading an absent signal as `bot` is fail-OPEN in the only direction that matters here: the
+ * default `wide` admission policy refuses every bot, so a surface whose vendor omits the field
+ * refuses EVERY author on EVERY wake and its seat reads the room as permanently silent.
+ * THAT IS MEASURED, NOT THEORETICAL. Notion serves a comment's `created_by` as a PARTIAL user —
+ * `id` and `object`, no `type` (packages/providers/notion/agent/channels/notion-api.ts) — and its
+ * catch-up normalizer read the absent `type` as "not a person". Ship #212 read the seat's page,
+ * kept the four comments through the bounds, and the admission policy then refused all four
+ * (`seat.catch_up outcome=empty raw=4 kept=0 reason=admission-dropped-all`). A real page member's
+ * comment was refused by exactly that arithmetic, so the defect was never about the e2e driver.
+ * 🔴 IT IS THE SAME RULE channels/seat-admission.ts ALREADY FIXES for the rendered context-line
+ * road: "a line the surface could not attribute is a person it could not vouch". One road spelled it
+ * and the other did not, which is the whole of OPE-1857.
+ * Pure.
+ */
+export function catchUpSender(f) {
+    if (f.self)
+        return "self";
+    return f.bot === true ? "bot" : "human";
+}
+/** Characters per token — the same deliberately-low proxy channels/session-tail.ts uses, so the two
+ *  paths cost a message the same way and one cap governs both. */
+const CHARS_PER_TOKEN = 4;
+/** Per-message rendered overhead in tokens: the `<message …>` attributes plus the untrusted
+ *  wrapper. Rounded UP so the proxy never under-counts and busts the real cap. */
+const PER_MESSAGE_OVERHEAD_TOKENS = 110;
+/** The rendered token cost of one normalized message, by the proxy above. Pure. */
+export function approxMessageTokens(m) {
+    return Math.ceil((m.text.length + (m.authorId?.length ?? 0)) / CHARS_PER_TOKEN) + PER_MESSAGE_OVERHEAD_TOKENS;
+}
+/**
+ * Map one normalized message onto the wake envelope's {@link WakeMessageInput}. Neutral: the adapter has already gated visibility, so the sender kind maps 1:1 onto the envelope `from`.
+ * Bot messages are CONTEXT-ONLY — this path never sets `trigger`, so a foreign bot is marked awareness and never a response obligation.
+ */
+function toWakeMessage(m, trustFor) {
+    return {
+        from: m.sender,
+        author: m.sender === "self" ? "self" : m.authorId ?? "unknown",
+        ...(m.authorId ? { authorId: m.authorId } : {}),
+        id: m.id,
+        sentAt: new Date(m.ms).toISOString(),
+        // Every LIVE call site wires `trustFor` with a real roster-derived tier; the bare default only serves pure and test callers.
+        // It is FAIL-CLOSED per sender: a `human` that cannot be resolved without surface facts falls to `unauth`, and `self`/`bot` are machine authors at the `relay` floor. It never defaults UP to peer.
+        trust: trustFor ? trustFor(m) : m.sender === "human" ? "unauth" : "relay",
+        type: m.type,
+        ...(m.threadId ? { threadRoot: m.threadId } : {}),
+        body: m.text,
+    };
+}
+/**
+ * The OLDEST bound of a seat's catch-up read: the seat's own last wake, floored by `maxReachbackHours` so a seat that has been quiet for a month reads the recent tail rather than a month of history. Returns epoch milliseconds. Pure.
+ * `maxReachbackHours` is the ADAPTER's own bootstrap reachback, passed in rather than redeclared here, so the catch-up floor and the bootstrap window can never drift apart. The adapter applies the same floor to its raw fetch; this is the caller-side statement of the same bound, and the two agreeing is the point.
+ * `lastWakeAt` absent or unparseable ⇒ the floor alone, which is exactly the bootstrap window a first wake already took — so a seat with no recorded wake degrades to today's behaviour instead of reading nothing.
+ */
+export function seatCatchUpSinceMs(lastWakeAt, nowMs, maxReachbackHours) {
+    const floor = nowMs - maxReachbackHours * 3600_000;
+    if (typeof lastWakeAt !== "string" || lastWakeAt.length === 0)
+        return floor;
+    const at = Date.parse(lastWakeAt);
+    if (!Number.isFinite(at))
+        return floor;
+    return Math.max(at, floor);
+}
+/**
+ * The whole core in one call: order the fetched window oldest-first, apply the domain's ADMISSION policy, keep the NEWEST admitted messages that fit `capTokens`, and emit them oldest-first as wake messages.
+ * ONE BUNDLE, not one per surface: a caller with several containers passes them all together, so the cap is shared and the result is one interleaved timeline, which is what a single window IS. Pure, and it always keeps at least one message when anything was admitted.
+ * 🔴 ADMISSION RUNS BEFORE THE CAP, never after: a refused author's bytes must not eat an admitted message out of the cap, which is the difference between "the seat did not read that bot" and "the seat read the bot instead of the person". The policy judges the RESOLVED trust tier, so the tier is computed once here and reused for the render.
+ */
+export function fetchedBackscroll(messages, capTokens = tailTokenCap(), trustFor, admit) {
+    if (messages.length === 0)
+        return [];
+    const graded = [...messages]
+        .sort((a, b) => a.ms - b.ms)
+        // Every LIVE call site wires `trustFor`; the bare default is the same fail-closed per-sender one
+        // {@link toWakeMessage} applies, resolved here ONCE so admission and the render read one value.
+        .map((m) => ({ ...m, trust: trustFor ? trustFor(m) : m.sender === "human" ? "unauth" : "relay" }));
+    const admitted = admit ? admitToSeat(graded, admit) : graded;
+    const kept = [];
+    let tokens = 0;
+    for (let i = admitted.length - 1; i >= 0; i--) {
+        const cost = approxMessageTokens(admitted[i]);
+        if (tokens + cost > capTokens && kept.length > 0)
+            break;
+        tokens += cost;
+        kept.unshift(admitted[i]);
+    }
+    return kept.map((m) => toWakeMessage(m, () => m.trust));
+}
+//# sourceMappingURL=backscroll-window.js.map

package/dist/agent/channels/backscroll-window.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backscroll-window.js","sourceRoot":"","sources":["../../../agent/channels/backscroll-window.ts"],"names":[],"mappings":"AAAA,kaAAka;AACla,uaAAua;AACva,4nBAA4nB;AAC5nB,iaAAia;AAGja,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAwB,MAAM,qBAAqB,CAAC;AA4BxE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,aAAa,CAAC,CAAqD;IACjF,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1C,CAAC;AAED;kEACkE;AAClE,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;kFACkF;AAClF,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,CAAoB;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,GAAG,2BAA2B,CAAC;AAChH,CAAC;AAOD;;;GAGG;AACH,SAAS,aAAa,CAAC,CAAoB,EAAE,QAA6B;IACxE,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,MAAM;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,SAAS;QAC9D,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;QACpC,6HAA6H;QAC7H,oMAAoM;QACpM,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;QACzE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE,KAAa,EAAE,iBAAyB;IAChH,MAAM,KAAK,GAAG,KAAK,GAAG,iBAAiB,GAAG,QAAQ,CAAC;IACnD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsC,EACtC,SAAS,GAAW,YAAY,EAAE,EAClC,QAA6B,EAC7B,KAAuB;IAEvB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5B,iGAAiG;QACjG,gGAAgG;SAC/F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,OAAiB,EAAE,CAAC,CAAC,CAAC;IAC3H,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,IAAI,GAAoD,EAAE,CAAC;IACjE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,MAAM,GAAG,IAAI,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QACxD,MAAM,IAAI,IAAI,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/agent/channels/cancel-note.d.ts

@@ -0,0 +1,45 @@
+/** What a cancelled turn had already done, held until the next turn has read it. */
+export interface PendingCancelNote {
+    /** The turn that was cancelled. Guards the clear so the cancelled turn's own end cannot eat it. */
+    readonly turnId: string;
+    /** Model calls that completed before the cancel — "how far in was it". */
+    readonly steps: number;
+    /** Tool names that actually EXECUTED, oldest first. Names only (the taint rule above). */
+    readonly ran: readonly string[];
+    /**
+     * WHO asked for the stop — the principal id from the paired `turn.cancel_requested` audit row.
+     * ABSENT IS A REAL AND EXPECTED STATE, not a degradation: eve's event carries no actor, so a cancel OE did not mediate leaves it absent and the reminder says "by a person". Never substitute a placeholder, and never a display NAME, which would put directory-sourced text into the trusted standing block.
+     */
+    readonly by?: string;
+    /**
+     * Are {@link steps} and {@link ran} MEASURED? `false` says the per-turn accumulator died with the cancelled step, so both fields are unknown and neither may be rendered.
+     * ABSENT MEANS `true`. Never default it the other way: a missing flag rendering as "unknown" would silently blank the reconstruction on the path that works.
+     */
+    readonly accounted?: boolean;
+}
+/** Record the reconstruction for the NEXT turn to read. Called from the `turn.cancelled` hook. */
+export declare function setPendingCancelNote(note: PendingCancelNote): void;
+/**
+ * Add the requester to the note THIS turn already wrote. A separate call rather than a field on `setPendingCancelNote`, because the requester needs an AWAIT — an audit read — and the reconstruction must be durable BEFORE the hook awaits anything.
+ * So a slow or failed audit read costs the requester's name and nothing else. `turnId` guards the update, so a note belonging to some other turn can never be relabelled.
+ */
+export declare function attachCancelNoteRequester(turnId: string, by: string): void;
+/** The pending reconstruction, or `null` when the last turn ended normally. */
+export declare function readPendingCancelNote(): PendingCancelNote | null;
+/**
+ * Clear the note once a LATER turn a PERSON sent has ended — the turn that was shown it. `endedTurnId` is the turn that just finished, and a note is dropped only when that turn is NOT the cancelled one.
+ * Without that first guard, a runtime that emitted `turn.completed` alongside `turn.cancelled` for the same turn would delete the note before any turn could render it, and the feature would fail silently.
+ *
+ * 🔴 `retires` IS THE SECOND GUARD, AND IT IS WHAT MAKES THE NOTE REACH A PERSON (OPE-2051; Tommy's ruling of 2026-09-24). The caller passes FALSE for a turn the deployment minted for ITSELF — a task spawn, a task settling, an approval-decision wake, a routine fire. It does NOT cover the auto-redrive, whose corrective wake re-stamps the ORIGINAL wake id while the attendedness column is sticky-true, so a correction of a person's own dropped answer still reads attended; `hooks/turn-anchor.ts` states that bound in full. Such a turn ending between the cancel and the human's next message used to retire the reconstruction, and the human's next prompt then carried nothing; this header calls the note "the only thing standing between a cancel and a silent double-execution", so the loss is the safety property rather than cosmetics.
+ * The DEFAULT IS TRUE, so a caller that cannot establish the fact keeps the behaviour this function has always had. `hooks/turn-anchor.ts` is the one product caller: it reads the ending turn's own wake row and asks its `inbound` column — the fact the divert already decides once — and it pays that read only on a turn that finds a note pending.
+ * 🔴 THE BOUND, STATED RATHER THAN ASSUMED: the fact is written at the WINDOW DIVERT alone, so the guard holds on a windowed deployment only. A per-surface deployment mints internal wakes too — a routine fire that finds no window falls through to its surface's own send (`routines/ingress.ts`, `schedules/dispatch.ts`, both directly after their `if (diverted) return;`) — and registers no wake row at all, so the read finds nothing, answers ATTENDED and the note retires on the first later turn, exactly as before this ticket. Closing that half needs a wake row from those two send sites, which is not this seam.
+ */
+export declare function clearPendingCancelNoteAfter(endedTurnId: string, retires?: boolean): void;
+/**
+ * The model-facing reconstruction, as a ready-to-emit `<system-reminder>` block, or `null` when the previous turn was not cancelled. PURE, so the wording is testable without a runtime.
+ * It says the three things the model cannot work out for itself: that it was stopped, how far it got, and that the named actions are MISSING FROM ITS HISTORY but REALLY HAPPENED. That last clause is the only thing standing between a cancel and a silent double-execution. It names who stopped the turn only when that is known — a placeholder would read as a fact about the actor.
+ */
+export declare function formatCancelNoteReminder(note: PendingCancelNote | null): string | null;
+/** The reminder for THIS session's pending cancel, or `null`. The seam instructions/access.ts calls. */
+export declare function renderPendingCancelNote(): string | null;
+//# sourceMappingURL=cancel-note.d.ts.map

package/dist/agent/channels/cancel-note.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel-note.d.ts","sourceRoot":"","sources":["../../../agent/channels/cancel-note.ts"],"names":[],"mappings":"AAKA,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAUD,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAMlE;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAM1E;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,IAAI,iBAAiB,GAAG,IAAI,CAMhE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,UAAO,GAAG,IAAI,CAOrF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAqCtF;AAED,wGAAwG;AACxG,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAEvD"}

package/dist/agent/channels/cancel-note.js

@@ -0,0 +1,99 @@
+// cancel-note — the agent-facing half of the cancelled-turn reconstruction. A cancel rolls the model's history back to the last completed model call, so the tool calls inside the aborted step are DISCARDED FROM HISTORY even though their side effects already happened and cannot be undone. The history cannot be repaired, so this note is the only thing that closes the gap.
+// TAINT: every byte is OE-controlled — a step count, tool names from eve's own registered roster, and one principal id read from an OE audit row. No message content reaches this text. Never widen it to carry tool ARGUMENTS, RESULTS or a display name, which are the untrusted content the boundary exists to keep out.
+import { defineState } from "eve/context";
+/** How many executed tool names the reminder lists before summarising the rest. Short on purpose —
+ *  this lands in a system prompt the model reads every turn, not in a report. */
+const MAX_NAMED_ACTIONS = 6;
+// Durable per-session slot. Fail-soft on every access: outside an eve session context (unit tests,
+// sessionless schedules) `defineState` throws, and a missing reconstruction must never break a turn.
+const slot = defineState("open-everywhere.cancel-note.pending", () => null);
+/** Record the reconstruction for the NEXT turn to read. Called from the `turn.cancelled` hook. */
+export function setPendingCancelNote(note) {
+    try {
+        slot.update(() => note);
+    }
+    catch {
+        /* no session context — nothing to carry the note to */
+    }
+}
+/**
+ * Add the requester to the note THIS turn already wrote. A separate call rather than a field on `setPendingCancelNote`, because the requester needs an AWAIT — an audit read — and the reconstruction must be durable BEFORE the hook awaits anything.
+ * So a slow or failed audit read costs the requester's name and nothing else. `turnId` guards the update, so a note belonging to some other turn can never be relabelled.
+ */
+export function attachCancelNoteRequester(turnId, by) {
+    try {
+        slot.update((prev) => (prev && prev.turnId === turnId ? { ...prev, by } : prev));
+    }
+    catch {
+        /* no session context */
+    }
+}
+/** The pending reconstruction, or `null` when the last turn ended normally. */
+export function readPendingCancelNote() {
+    try {
+        return slot.get();
+    }
+    catch {
+        return null; // no session context
+    }
+}
+/**
+ * Clear the note once a LATER turn a PERSON sent has ended — the turn that was shown it. `endedTurnId` is the turn that just finished, and a note is dropped only when that turn is NOT the cancelled one.
+ * Without that first guard, a runtime that emitted `turn.completed` alongside `turn.cancelled` for the same turn would delete the note before any turn could render it, and the feature would fail silently.
+ *
+ * 🔴 `retires` IS THE SECOND GUARD, AND IT IS WHAT MAKES THE NOTE REACH A PERSON (OPE-2051; Tommy's ruling of 2026-09-24). The caller passes FALSE for a turn the deployment minted for ITSELF — a task spawn, a task settling, an approval-decision wake, a routine fire. It does NOT cover the auto-redrive, whose corrective wake re-stamps the ORIGINAL wake id while the attendedness column is sticky-true, so a correction of a person's own dropped answer still reads attended; `hooks/turn-anchor.ts` states that bound in full. Such a turn ending between the cancel and the human's next message used to retire the reconstruction, and the human's next prompt then carried nothing; this header calls the note "the only thing standing between a cancel and a silent double-execution", so the loss is the safety property rather than cosmetics.
+ * The DEFAULT IS TRUE, so a caller that cannot establish the fact keeps the behaviour this function has always had. `hooks/turn-anchor.ts` is the one product caller: it reads the ending turn's own wake row and asks its `inbound` column — the fact the divert already decides once — and it pays that read only on a turn that finds a note pending.
+ * 🔴 THE BOUND, STATED RATHER THAN ASSUMED: the fact is written at the WINDOW DIVERT alone, so the guard holds on a windowed deployment only. A per-surface deployment mints internal wakes too — a routine fire that finds no window falls through to its surface's own send (`routines/ingress.ts`, `schedules/dispatch.ts`, both directly after their `if (diverted) return;`) — and registers no wake row at all, so the read finds nothing, answers ATTENDED and the note retires on the first later turn, exactly as before this ticket. Closing that half needs a wake row from those two send sites, which is not this seam.
+ */
+export function clearPendingCancelNoteAfter(endedTurnId, retires = true) {
+    if (!retires)
+        return;
+    try {
+        slot.update((prev) => (prev && prev.turnId !== endedTurnId ? null : prev));
+    }
+    catch {
+        /* no session context */
+    }
+}
+/**
+ * The model-facing reconstruction, as a ready-to-emit `<system-reminder>` block, or `null` when the previous turn was not cancelled. PURE, so the wording is testable without a runtime.
+ * It says the three things the model cannot work out for itself: that it was stopped, how far it got, and that the named actions are MISSING FROM ITS HISTORY but REALLY HAPPENED. That last clause is the only thing standing between a cancel and a silent double-execution. It names who stopped the turn only when that is known — a placeholder would read as a fact about the actor.
+ */
+export function formatCancelNoteReminder(note) {
+    if (!note)
+        return null;
+    const where = note.steps === 1 ? "one step in" : `${note.steps} steps in`;
+    // "by a person" is the fallback, not a default to be dressed up. Both arms are one clause, so the
+    // unnamed output is byte-for-byte what it was before requesters could be named at all.
+    const who = note.by ? `by \`${note.by}\`` : "by a person";
+    // THE UNACCOUNTED ARM: the accumulator died with the cancelled step, so this reminder can say neither how far the model got nor which tools ran.
+    // It still carries the one thing the safety property rests on — that invisible work in the interrupted turn REALLY HAPPENED — and it asks rather than lists, because saying "No tool had finished running" here would be the exact double-execution this module exists to prevent.
+    if (note.accounted === false) {
+        return (`<system-reminder>\nYour PREVIOUS turn in this session was CANCELLED ${who} — you did not finish, ` +
+            `and your final message (if you had started one) was never recorded.\n` +
+            `The cancel also discarded the record of what you had already done. Any tool you called in that ` +
+            `turn is missing from your history above, and its effects are REAL.\n` +
+            `Do not silently start again from the beginning. Ask what was already done before you redo it.` +
+            `\n</system-reminder>`);
+    }
+    const head = `<system-reminder>\nYour PREVIOUS turn in this session was CANCELLED ${who} — you were stopped ` +
+        `${where}, you did not finish, and your final message (if you had started one) was never recorded.`;
+    const tail = `\nDo not silently start again from the beginning. Take the actions below as ALREADY DONE, and if ` +
+        `you are unsure whether the interrupted work should continue, ask before you redo it.\n</system-reminder>`;
+    if (note.ran.length === 0) {
+        return `${head}\nNo tool had finished running, so nothing was left half-done.${tail}`;
+    }
+    const named = note.ran.slice(-MAX_NAMED_ACTIONS);
+    const more = note.ran.length - named.length;
+    const list = named.map((n) => `\`${n}\``).join(", ");
+    const earlier = more > 0 ? ` (and ${more} earlier)` : "";
+    return (`${head}\n` +
+        `These tools DID run and their effects are REAL, but the cancel rolled them out of your history, ` +
+        `so you cannot see them above: ${list}${earlier}.` +
+        tail);
+}
+/** The reminder for THIS session's pending cancel, or `null`. The seam instructions/access.ts calls. */
+export function renderPendingCancelNote() {
+    return formatCancelNoteReminder(readPendingCancelNote());
+}
+//# sourceMappingURL=cancel-note.js.map

package/dist/agent/channels/cancel-note.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel-note.js","sourceRoot":"","sources":["../../../agent/channels/cancel-note.ts"],"names":[],"mappings":"AAAA,qXAAqX;AACrX,4TAA4T;AAE5T,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAsB1C;iFACiF;AACjF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,mGAAmG;AACnG,qGAAqG;AACrG,MAAM,IAAI,GAAG,WAAW,CAA2B,qCAAqC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAEtG,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAc,EAAE,EAAU;IAClE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,qBAAqB;IACpC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAmB,EAAE,OAAO,GAAG,IAAI;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA8B;IACrE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,WAAW,CAAC;IAC1E,kGAAkG;IAClG,uFAAuF;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;IAC1D,iJAAiJ;IACjJ,mRAAmR;IACnR,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,CACL,uEAAuE,GAAG,yBAAyB;YACnG,uEAAuE;YACvE,iGAAiG;YACjG,sEAAsE;YACtE,+FAA+F;YAC/F,sBAAsB,CACvB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,uEAAuE,GAAG,sBAAsB;QAChG,GAAG,KAAK,2FAA2F,CAAC;IACtG,MAAM,IAAI,GACR,mGAAmG;QACnG,0GAA0G,CAAC;IAC7G,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,iEAAiE,IAAI,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,OAAO,CACL,GAAG,IAAI,IAAI;QACX,kGAAkG;QAClG,iCAAiC,IAAI,GAAG,OAAO,GAAG;QAClD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,uBAAuB;IACrC,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/agent/channels/channel-key.d.ts

@@ -0,0 +1,19 @@
+export declare const CHANNEL_KEY_PREFIX = "ch_";
+export interface ChannelAddress {
+    /** The binding.ts platform id ("slack", "discord", "teams", …). */
+    readonly platform: string;
+    /** The platform's own container id (a Slack channel id, a Discord channel/thread id, …). */
+    readonly container: string;
+}
+/**
+ * Mint the channel key for one container.
+ * Fail-soft: the pure wake renderer must never throw, so an empty platform or container returns the container id unchanged instead of a key that decodes to nothing.
+ */
+export declare function encodeChannelKey(platform: string, container: string): string;
+/**
+ * Read a channel key back to its (platform, container) pair, or `null` for anything that is not one.
+ * Strict: a non-canonical body, a missing `:` or an empty side all answer `null`, so the caller refuses instead of guessing a platform.
+ */
+export declare function decodeChannelKey(key: string): ChannelAddress | null;
+export declare function isChannelKey(s: string): boolean;
+//# sourceMappingURL=channel-key.d.ts.map

package/dist/agent/channels/channel-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-key.d.ts","sourceRoot":"","sources":["../../../agent/channels/channel-key.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAExC,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAI5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAmBnE;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C"}