@open-everywhere/core 0.1.0

package/dist/agent/channels/chat-turn-audit.js

@@ -0,0 +1,18 @@
+// Chat-surface audit partition type. The chat channels' terminal `message.completed` handlers run with no auth context, so they rebuild an audit partition from live session state.
+// They hand it to channels/reply-post.ts, which owns the one canonical `reply.post` row for every terminal reply that leaves the host.
+import { appendAudit } from "../audit/audit.js";
+/**
+ * Record a chat-surface turn whose final text was the bare NO_REPLY sentinel — the sentinel-route twin of the `reply.no_reply_observed` row tools/no_reply.ts writes. Best-effort: appendAudit never throws.
+ * `sessionId` joins the row back to the transcript; `wakeId` is unified-window-only and is what tells two sentinel rows on one session apart.
+ */
+export async function auditNoReplySentinelObserved(partition, sessionId, wakeId) {
+    await appendAudit({
+        org: partition.org,
+        platform: partition.platform,
+        workspace: partition.workspace,
+        surface: partition.surface,
+        action: "reply.no_reply_observed",
+        detail: { route: "sentinel", ...(sessionId ? { sessionId } : {}), ...(wakeId ? { wakeId } : {}) },
+    });
+}
+//# sourceMappingURL=chat-turn-audit.js.map

package/dist/agent/channels/chat-turn-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-turn-audit.js","sourceRoot":"","sources":["../../../agent/channels/chat-turn-audit.ts"],"names":[],"mappings":"AAAA,oLAAoL;AACpL,uIAAuI;AAGvI,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,SAA6B,EAAE,SAAkB,EAAE,MAAe;IACnH,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAClG,CAAC,CAAC;AACL,CAAC"}

package/dist/agent/channels/closing-prose-drop.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The audit action a dropped turn-final prose carries, on every seat and every surface. ONE greppable string, and the SAME value `channels/supervisor-complete.ts` writes.
+ * 🔴 THE NAME SAYS "supervisor" AND THE EVENT IS WIDER THAN THAT. It is kept because it is the registered action a reader already joins on ({@link ../audit/action-registry.js}), and renaming an audit action rewrites history that cannot be rewritten: every row already written carries the old name, so a rename splits one event into two names across the boundary. What the row means is stated here rather than read off its spelling.
+ */
+export declare const CLOSING_PROSE_DROPPED_ACTION = "turn.supervisor_prose_dropped";
+/** The partition a drop row is filed under — the seat's own, read from the channel state the completion handler holds. A completion handler has no live auth ctx, so every field comes from that state. */
+export interface ClosingProseDropRow {
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface?: string;
+    readonly principalId?: string;
+}
+/** Everything one drop needs. `anchor` is the surface's own reply address in id form (`{ threadTs }`,
+ *  `{ channelId }`, `{ conversationId }`, `{ issueNumber }`) — ids and counts only, never message
+ *  text, like every other detail on this plane. */
+export interface ClosingProseDrop {
+    readonly row: ClosingProseDropRow;
+    readonly chars: number;
+    readonly sessionId?: string;
+    readonly anchor: Record<string, unknown>;
+    /** The surface's logger — the drop is loud in the log, because the answer the model wrote is gone
+     *  and an operator reading "why did this turn go quiet" must find it here. */
+    readonly log: (msg: string) => void;
+}
+/**
+ * Record that this turn's closing prose was DROPPED — write the one row, log the line, post nothing.
+ * Best-effort and never throws: the drop has already happened by the time this runs, so a failed row must not fail the turn on top of losing the answer.
+ *
+ * 🔴 THERE IS NO SECOND CHANCE HERE, AND THAT IS THE DESIGN (brain ruling, 2026-09-25). No re-send, no queue, and no host-side re-post: a second delivery road is exactly what the reply-delivery doctrine removed. What makes the drop safe is the INSTRUCTION — a seat on a surface declaring `closingProseDropped` reads the `reply-only` delivery arm, whose copy states that the turn-final text is discarded and that `reply` is the only way its words leave the session.
+ * 🔴 THAT INSTRUCTION REACHES A SEAT BY ONE OF TWO SLOTS, AND BOTH ARE REQUIRED. A supervisor-shaped session reads it inside its persona; a session whose token is NOT supervisor-shaped — the `native`-grain @mention thread these five handlers mostly serve, and the DM seat — renders no persona at all, and reads the arm through the `delivery` slot instead (`instructions/access.ts` `renderDeliverySlot`). Delete that slot and the drop becomes silent on the largest seat population there is, which is the OPE-771 loss: 23 of 36 owed answers written as closing prose by a seat whose prompt described a delivery its surface does not do.
+ */
+export declare function dropClosingProse(drop: ClosingProseDrop): Promise<void>;
+//# sourceMappingURL=closing-prose-drop.d.ts.map

package/dist/agent/channels/closing-prose-drop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"closing-prose-drop.d.ts","sourceRoot":"","sources":["../../../agent/channels/closing-prose-drop.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,eAAO,MAAM,4BAA4B,kCAAkC,CAAC;AAE5E,2MAA2M;AAC3M,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;kFAC8E;IAC9E,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW5E"}

package/dist/agent/channels/closing-prose-drop.js

@@ -0,0 +1,29 @@
+// closing-prose-drop — WHAT A CHAT SURFACE DOES WITH A TURN'S CLOSING PROSE NOW THAT NOTHING POSTS IT (OPE-2006). The `reply` tool is the only channel a seat's words leave by, so a turn that ends in prose and never called `reply` has said nothing to the room. This module writes the row that records it, and it posts nothing by construction: it holds no post target, no arm and no transport.
+// IT IS THE PER-SURFACE TWIN OF `channels/supervisor-complete.ts`. That module owns the TICKETING supervisor's terminal record — one row per turn, closing a `<platform>.dispatched` row a webhook opened. This one owns the ordinary chat seat's drop, where there is no dispatched row to close and the drop row is the whole record. Both write the SAME action, because the event is the same event: a turn produced an answer and took no action to deliver it.
+// WHY NOT A NEW ACTION NAME (brain ruling, 2026-09-25): a drop is audited with the nearest EXISTING action, never a new one. `turn.supervisor_prose_dropped` is that action — it is registered, the scorers and the audit gates already read it, and a second name for one event would split every count that asks "how often did an answer never leave".
+import { appendAudit } from "../audit/audit.js";
+/**
+ * The audit action a dropped turn-final prose carries, on every seat and every surface. ONE greppable string, and the SAME value `channels/supervisor-complete.ts` writes.
+ * 🔴 THE NAME SAYS "supervisor" AND THE EVENT IS WIDER THAN THAT. It is kept because it is the registered action a reader already joins on ({@link ../audit/action-registry.js}), and renaming an audit action rewrites history that cannot be rewritten: every row already written carries the old name, so a rename splits one event into two names across the boundary. What the row means is stated here rather than read off its spelling.
+ */
+export const CLOSING_PROSE_DROPPED_ACTION = "turn.supervisor_prose_dropped";
+/**
+ * Record that this turn's closing prose was DROPPED — write the one row, log the line, post nothing.
+ * Best-effort and never throws: the drop has already happened by the time this runs, so a failed row must not fail the turn on top of losing the answer.
+ *
+ * 🔴 THERE IS NO SECOND CHANCE HERE, AND THAT IS THE DESIGN (brain ruling, 2026-09-25). No re-send, no queue, and no host-side re-post: a second delivery road is exactly what the reply-delivery doctrine removed. What makes the drop safe is the INSTRUCTION — a seat on a surface declaring `closingProseDropped` reads the `reply-only` delivery arm, whose copy states that the turn-final text is discarded and that `reply` is the only way its words leave the session.
+ * 🔴 THAT INSTRUCTION REACHES A SEAT BY ONE OF TWO SLOTS, AND BOTH ARE REQUIRED. A supervisor-shaped session reads it inside its persona; a session whose token is NOT supervisor-shaped — the `native`-grain @mention thread these five handlers mostly serve, and the DM seat — renders no persona at all, and reads the arm through the `delivery` slot instead (`instructions/access.ts` `renderDeliverySlot`). Delete that slot and the drop becomes silent on the largest seat population there is, which is the OPE-771 loss: 23 of 36 owed answers written as closing prose by a seat whose prompt described a delivery its surface does not do.
+ */
+export async function dropClosingProse(drop) {
+    drop.log(`closing prose DROPPED (${drop.chars}c) — nothing posted; a reply must come from the reply tool`);
+    await appendAudit({
+        org: drop.row.org,
+        platform: drop.row.platform,
+        workspace: drop.row.workspace,
+        surface: drop.row.surface,
+        principalId: drop.row.principalId,
+        action: CLOSING_PROSE_DROPPED_ACTION,
+        detail: { ...drop.anchor, chars: drop.chars, ...(drop.sessionId ? { sessionId: drop.sessionId } : {}) },
+    }).catch(() => undefined);
+}
+//# sourceMappingURL=closing-prose-drop.js.map

package/dist/agent/channels/closing-prose-drop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"closing-prose-drop.js","sourceRoot":"","sources":["../../../agent/channels/closing-prose-drop.ts"],"names":[],"mappings":"AAAA,wYAAwY;AACxY,qcAAqc;AACrc,0VAA0V;AAE1V,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,+BAA+B,CAAC;AAwB5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAsB;IAC3D,IAAI,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,KAAK,4DAA4D,CAAC,CAAC;IAC3G,MAAM,WAAW,CAAC;QAChB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG;QACjB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS;QAC7B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO;QACzB,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;QACjC,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACxG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC"}

package/dist/agent/channels/command-registration.d.ts

@@ -0,0 +1,62 @@
+/** Where one platform registers this deployment's commands. */
+export interface SurfaceCommandScope {
+    /**
+     * The platform-native rooms to register into — a Discord GUILD id. At least one entry; each is a
+     * tracked literal from the app's config, never an env value.
+     *
+     * A room-scoped registration appears in that room INSTANTLY. The vendor-wide ("global") scope is
+     * deliberately not expressible here: on Discord it takes up to an hour to propagate, which no
+     * boot-time reconcile can prove, so it stays the operator CLI's job.
+     */
+    readonly scopes: readonly string[];
+}
+/** What one platform's reconcile did. `skipped` = it could not run and that is not an error. */
+export type SurfaceCommandStatus = "unchanged" | "updated" | "skipped" | "failed" | "unsupported";
+export interface SurfaceCommandOutcome {
+    readonly status: SurfaceCommandStatus;
+    /**
+     * One human-readable line for the boot log. 🔴 NEVER a credential and never a vendor response
+     * body — a bot token and an error payload both reach the log through this field or not at all.
+     */
+    readonly detail: string;
+}
+/** A bundle's reconcile: compare the declared set against what the vendor holds, write on a
+ *  difference. MUST NOT throw — the plane logs what it returns. */
+export type SurfaceCommandReconciler = (scope: SurfaceCommandScope) => Promise<SurfaceCommandOutcome>;
+/**
+ * Declare the rooms `platform` registers this deployment's commands into. Called from the app's
+ * config-as-code, so every failure here is a fail-LOUD config error: a malformed line is a line
+ * nobody reviewed correctly, and accepting it would register nothing while looking configured.
+ *
+ * Re-declaring a platform REPLACES its scope, matching every other `register*` seam in this tree.
+ */
+export declare function declareSurfaceCommandScope(platform: string, scope: SurfaceCommandScope): void;
+/**
+ * Register the vendor half for `platform`. A bundle calls this from its own `register*Provider()`.
+ * Refused — and the platform stays absent from this plane — when the provider is not in this
+ * deployment's declared selection.
+ */
+export declare function registerSurfaceCommandReconciler(platform: string, reconciler: SurfaceCommandReconciler): void;
+/** The declared scope for `platform`, or undefined. The reconciler's own tests read it. */
+export declare function surfaceCommandScopeFor(platform: string): SurfaceCommandScope | undefined;
+export interface SurfaceCommandReport {
+    readonly platform: string;
+    readonly outcome: SurfaceCommandOutcome;
+}
+/**
+ * THE BOOT CALL. Run every declared platform's reconcile and log ONE line per platform.
+ *
+ * 🔴 NEVER THROWS, and never rejects. A reconciler that throws anyway is reported as `failed` with
+ * its message — the deployment boots either way, because a stale command list is a smaller failure
+ * than a deployment that will not answer.
+ *
+ * A platform with a declared scope and NO reconciler is reported `unsupported` and warned loudly:
+ * that is an operator who named a room on a platform this deployment does not carry, and a silent
+ * skip there is the "configured but doing nothing" state this plane exists to end.
+ */
+export declare function reconcileSurfaceCommands(deps?: {
+    readonly log?: (line: string) => void;
+}): Promise<readonly SurfaceCommandReport[]>;
+/** Test-only: drop every declaration and reconciler so a suite can start from an empty plane. */
+export declare function resetSurfaceCommandRegistryForTest(): void;
+//# sourceMappingURL=command-registration.d.ts.map

package/dist/agent/channels/command-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-registration.d.ts","sourceRoot":"","sources":["../../../agent/channels/command-registration.ts"],"names":[],"mappings":"AAwCA,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,gGAAgG;AAChG,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;mEACmE;AACnE,MAAM,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAKtG;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAsB7F;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAG7G;AAED,2FAA2F;AAC3F,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAExF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAwB7I;AAED,iGAAiG;AACjG,wBAAgB,kCAAkC,IAAI,IAAI,CAGzD"}

package/dist/agent/channels/command-registration.js

@@ -0,0 +1,128 @@
+// THE SURFACE-COMMAND RECONCILE PLANE (OPE-1687) — how a deployment's own slash commands reach the
+// vendor without an operator running anything.
+//
+// WHAT IT HOLDS. A chat platform that carries slash commands keeps its command list on the VENDOR's
+// side, not in the deployment. The code declares a command set; the vendor holds whatever the last
+// write left there. The two drift the moment the code changes, and until this plane existed the only
+// thing that closed the gap was an operator CLI (`scripts/register-discord-commands.ts`) that runs on
+// a box holding the bot token. A deployment holds that token; the operator often does not. So a
+// declared command reached the vendor only by a step nobody could take, and `/oe rate` shipped
+// invisible.
+//
+// THE INVARIANT: the DEPLOYMENT reconciles its own declared command set, once per process start, and
+// a reconcile that changes nothing writes nothing. Two halves meet here:
+//
+//   • the APP declares WHERE (`declareSurfaceCommandScope`) — the rooms this deployment registers
+//     its commands into. A Discord guild id is a TRACKED literal under Tommy's ruling of 2026-09-07
+//     (config lives in Git and changes by PR; env keeps infrastructure only), so the declaration is a
+//     config module, never a variable;
+//   • the PROVIDER BUNDLE declares HOW (`registerSurfaceCommandReconciler`) — the vendor call that
+//     compares and writes. Core names no vendor and holds no command shape.
+//
+// `reconcileSurfaceCommands()` is the app's ONE boot call that joins them, and it is the same posture
+// the other boot-time checks in `agent/lib/register-adapters.ts` carry: AVAILABILITY OVER INTEGRITY,
+// never throws. A deployment must boot and serve turns even when the vendor's command API is down —
+// the worst outcome of a failed reconcile is a stale command list, which is exactly the state the
+// deployment was already in.
+//
+// 🔴 WHY BOOT AND NOT A DEPLOY RUNG. A control route the deploy chain calls would work and costs one
+// more moving part: a route, a token and a rung inside `scripts/deploy/`. Boot needs none of them and
+// lands at the same moment anyway — `deploy:verify` probes the deployment over HTTP right after the
+// alias moves, and that probe IS the cold start this plane rides. The cost is bounded and stated: one
+// vendor read per process start, and a write only on a real difference. A deployment that declares no
+// scope pays nothing at all.
+//
+// 🔴 A DECLARATION THAT REGISTERS NOWHERE IS REFUSED. `declareSurfaceCommandScope` throws on an empty
+// scope list, the same fail-loud posture `registerSurfaces` takes on a line that would grant nothing:
+// a config line that silently does nothing is how a command set stays unregistered for a month.
+import { admitProviderRegistration } from "../access/provider-selection.js";
+const SCOPES = new Map();
+const RECONCILERS = new Map();
+/**
+ * Declare the rooms `platform` registers this deployment's commands into. Called from the app's
+ * config-as-code, so every failure here is a fail-LOUD config error: a malformed line is a line
+ * nobody reviewed correctly, and accepting it would register nothing while looking configured.
+ *
+ * Re-declaring a platform REPLACES its scope, matching every other `register*` seam in this tree.
+ */
+export function declareSurfaceCommandScope(platform, scope) {
+    const key = typeof platform === "string" ? platform.trim() : "";
+    if (key.length === 0) {
+        throw new Error("declareSurfaceCommandScope: the platform must be a non-empty name (e.g. \"discord\").");
+    }
+    const seen = new Set();
+    for (const raw of scope.scopes) {
+        const entry = typeof raw === "string" ? raw.trim() : "";
+        if (entry.length === 0) {
+            throw new Error(`declareSurfaceCommandScope("${key}"): a scope entry is blank. Every entry names one room (a Discord guild id).`);
+        }
+        if (seen.has(entry)) {
+            throw new Error(`declareSurfaceCommandScope("${key}"): scope "${entry}" is listed twice. A room is registered once.`);
+        }
+        seen.add(entry);
+    }
+    if (seen.size === 0) {
+        throw new Error(`declareSurfaceCommandScope("${key}"): the scope list is empty, so this declaration would register the commands nowhere. Name at least one room, or delete the declaration.`);
+    }
+    SCOPES.set(key, { scopes: [...seen] });
+}
+/**
+ * Register the vendor half for `platform`. A bundle calls this from its own `register*Provider()`.
+ * Refused — and the platform stays absent from this plane — when the provider is not in this
+ * deployment's declared selection.
+ */
+export function registerSurfaceCommandReconciler(platform, reconciler) {
+    if (!admitProviderRegistration(platform, "surface-command-reconciler"))
+        return;
+    RECONCILERS.set(platform, reconciler);
+}
+/** The declared scope for `platform`, or undefined. The reconciler's own tests read it. */
+export function surfaceCommandScopeFor(platform) {
+    return SCOPES.get(platform);
+}
+/**
+ * THE BOOT CALL. Run every declared platform's reconcile and log ONE line per platform.
+ *
+ * 🔴 NEVER THROWS, and never rejects. A reconciler that throws anyway is reported as `failed` with
+ * its message — the deployment boots either way, because a stale command list is a smaller failure
+ * than a deployment that will not answer.
+ *
+ * A platform with a declared scope and NO reconciler is reported `unsupported` and warned loudly:
+ * that is an operator who named a room on a platform this deployment does not carry, and a silent
+ * skip there is the "configured but doing nothing" state this plane exists to end.
+ */
+export async function reconcileSurfaceCommands(deps = {}) {
+    const log = deps.log ?? ((line) => console.info(line));
+    const reports = [];
+    for (const [platform, scope] of [...SCOPES.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        const reconciler = RECONCILERS.get(platform);
+        let outcome;
+        if (reconciler === undefined) {
+            outcome = {
+                status: "unsupported",
+                detail: `no command reconciler is registered for "${platform}" — the declaration in the app's config names a platform this deployment does not carry, so nothing was registered.`,
+            };
+        }
+        else {
+            try {
+                outcome = await reconciler(scope);
+            }
+            catch (err) {
+                outcome = { status: "failed", detail: `the reconciler threw: ${err instanceof Error ? err.message : String(err)}` };
+            }
+        }
+        reports.push({ platform, outcome });
+        const line = `[open-everywhere:command-registration] ${platform}: ${outcome.status} — ${outcome.detail}`;
+        if (outcome.status === "failed" || outcome.status === "unsupported")
+            console.warn(line);
+        else
+            log(line);
+    }
+    return reports;
+}
+/** Test-only: drop every declaration and reconciler so a suite can start from an empty plane. */
+export function resetSurfaceCommandRegistryForTest() {
+    SCOPES.clear();
+    RECONCILERS.clear();
+}
+//# sourceMappingURL=command-registration.js.map

package/dist/agent/channels/command-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-registration.js","sourceRoot":"","sources":["../../../agent/channels/command-registration.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,+CAA+C;AAC/C,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,sGAAsG;AACtG,gGAAgG;AAChG,+FAA+F;AAC/F,aAAa;AACb,EAAE;AACF,qGAAqG;AACrG,yEAAyE;AACzE,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,sGAAsG;AACtG,uCAAuC;AACvC,mGAAmG;AACnG,4EAA4E;AAC5E,EAAE;AACF,sGAAsG;AACtG,qGAAqG;AACrG,oGAAoG;AACpG,kGAAkG;AAClG,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,6BAA6B;AAC7B,EAAE;AACF,sGAAsG;AACtG,sGAAsG;AACtG,gGAAgG;AAEhG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AA+B5E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;AACtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgB,EAAE,KAA0B;IACrF,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,8EAA8E,CAAC,CAAC;QACpI,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,cAAc,KAAK,+CAA+C,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,+BAA+B,GAAG,0IAA0I,CAC7K,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,QAAgB,EAAE,UAAoC;IACrG,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;QAAE,OAAO;IAC/E,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAAI,GAA8C,EAAE;IACjG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAA8B,CAAC;QACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,GAAG;gBACR,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,4CAA4C,QAAQ,qHAAqH;aAClL,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACtH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,0CAA0C,QAAQ,KAAK,OAAO,CAAC,MAAM,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACzG,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACnF,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,kCAAkC;IAChD,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/dist/agent/channels/context-render.d.ts

@@ -0,0 +1,111 @@
+import { type WakeMessageInput, type WakeTrust } from "./wake-envelope.js";
+import type { AuthorTrustQuery } from "../identity/author-trust.js";
+export declare const MAX_MESSAGES = 10;
+export declare const MAX_CHARS = 12000;
+export declare const WAKE_BACKSCROLL_MAX = 10;
+/** Structured speaker attribution — kept explicit (never flattened to a bare id) so a
+ * multi-party transcript can't drift speakers, and the model can tell the agent's own voice
+ * from humans and other bots. */
+export type SenderType = "user" | "bot" | "agent" | "unknown";
+export interface ContextLine {
+    readonly senderType: SenderType;
+    /** Platform user id (for `user`) or bot id (for `bot`); omitted for `agent`/`unknown`. */
+    readonly senderId?: string;
+    /** A per-line identifier (Slack ts / Discord message id) — opaque here, used for ordering upstream. */
+    readonly ts: string;
+    readonly text: string;
+    /**
+     * Per-line wake-trust tier. Absent means UNGRADED, which is still legal: a surface's regrade step is a caller-side ADDITION, never a required one.
+     * A line resolved `"unauth"` renders its reference-only teaching note and is a candidate for the taint join via {@link contextLineIngestion}.
+     */
+    readonly trust?: WakeTrust;
+    /**
+     * The surface POSITIVELY refuted this author's membership — a separate field from `trust` rather than something re-derived from it.
+     * The RENDER never reads it: a refuted line's attribution prefix is byte-identical to any other `unauth` line's. Two readers do — the taint join, and {@link contextLinesNotInEnvelope}, which exempts a refuted line from the once-only render because the envelope's copy of that message may be graded by a different leg, or by none.
+     */
+    readonly refuted?: boolean;
+    /**
+     * The OPERATOR's author-trust register query for this line's author — Discord's and Notion's only per-author refutation, since neither surface can answer the membership question itself.
+     * Read ONLY by the taint join's register leg. It never demotes `trust`: the register is a JOIN-only fact.
+     */
+    readonly authorTrust?: AuthorTrustQuery;
+}
+/**
+ * Map one {@link ContextLine} onto the taint join's per-message input shape. All three fields are read from the SAME line the render reads, so the render and the join can never disagree about one line.
+ * The return is structural rather than typed, to avoid a core-to-core import cycle: access/taint-signal.ts already imports this module.
+ */
+export declare function contextLineIngestion(l: ContextLine): {
+    readonly trust?: WakeTrust;
+    readonly refuted?: boolean;
+    readonly authorTrust?: AuthorTrustQuery;
+};
+/**
+ * ONE WAKE RENDERS EACH ROOM MESSAGE ONCE (OPE-1743). A seated name-drop wake reads the room TWICE — the seat's own since-last-wake catch-up, rendered as envelope SIBLINGS, and the name-drop hydration, rendered inside the untrusted CONTEXT block — and for a seat that woke minutes ago but last replied an hour ago the first set sits INSIDE the second. Left alone the model is served each overlapping message twice, under two different attributions.
+ * This drops the hydration's copy of every message the envelope already carries, matched on the message id. 🔴 THE CALLER OWES ONE NAMESPACE: it must pass an envelope whose `id`s and lines whose `ts` are the same kind of value. That holds where both are the platform's own message id — a Slack `ts`, a Discord message id — and NOT everywhere: GitHub's and Linear's supervisors build a context line's `ts` from an issue label (`#123`, `OPE-1`), which no sibling id ever equals, so a match there would never fire. THE ENVELOPE WINS where both copies are policed the same way: its siblings carry per-message author, trust tier and send time, while a context line carries an attribution prefix alone, so keeping the envelope copy loses no framing.
+ * Order is kept, and a message the envelope does NOT carry stays — the hydration's whole point is the older conversation the catch-up window never reached.
+ *
+ * 🔴 A POSITIVELY REFUTED AUTHOR'S LINE IS EXEMPT (OPE-1742), AND THE REASON IS ATTRIBUTION, NOT CONTAINMENT — DO NOT READ IT AS A SECURITY CONTROL. "The envelope copy loses no framing" is what licenses the drop, and for a refuted author that premise fails: the two slots are withheld by DIFFERENT legs — the envelope's siblings by `withholdsBody` over each message's own resolved facts (access/external-policy.ts), this slot by the hydration's per-author probe (`withholdWakeBodies`, `excludedAuthorId`) — and the two can disagree. The two Slack envelope arms disagree differently, and both were measured:
+ *  • the FETCHED arm carries the refutation. `regradeSlackBackscrollTrust` sets `refuted: true` on the sibling, so `withholdsBody` withholds the envelope copy as well. Here the exemption changes the COUNT and nothing else.
+ *  • the TAIL arm carries the refutation TOO, since OPE-1747: a tail row records `refuted` and `authorTrust` through `tailAuthorGrain`, and `tailEntryToWakeMessage` copies both, so `withholdsBody` withholds a tail-borne copy exactly as it withholds a fetched one. A row persisted BEFORE that field existed carries no `refuted` at all and rides as `ungraded: true`, which the withhold grain reads as the fail-closed answer — so it is withheld rather than shown, never graded "not refuted". WHAT STILL LICENSES THE EXEMPTION on those facts: the hydrated copy is the only one carrying THIS route's own regrade, and the two slots are still withheld by different legs — the envelope's by `withholdsBody` over each message's resolved facts, this slot by the hydration's per-author probe — so the two can still disagree about one message.
+ * THE COST, STATED: one duplicated line per positively-refuted author per wake, capped like every other line by {@link MAX_MESSAGES} — and on the SHIPPED `taint` grain both copies are VERBATIM, which is the double render OPE-1743 exists to remove. The exemption is a deliberate carve-out from that rule for the one author class whose two copies are not interchangeable.
+ */
+export declare function contextLinesNotInEnvelope(lines: readonly ContextLine[], envelope: readonly WakeMessageInput[]): ContextLine[];
+/**
+ * THE TWO SLICES ONE HYDRATION PRODUCES, and the ORDER that produces them (OPE-1749).
+ * The order is the whole point: DE-DUPLICATE against the envelope FIRST, cap SECOND. Capping first
+ * spends the count budget on lines the de-duplication then drops, so a wake whose envelope overlaps
+ * the hydration renders a SHALLOW block — ten lines fetched, five dropped, five rendered — while five
+ * older messages the envelope never carried sit just outside the cap.
+ */
+export interface HydrationSlices {
+    /** WHAT RENDERS: the lines not already in the envelope, capped to the count and char budget. */
+    readonly rendered: ContextLine[];
+    /**
+     * WHAT INGESTED, for the taint join — the rendered lines PLUS the lines the de-duplication dropped, in the caller's original order.
+     * The two differ for a reason on each side. A DE-DUPLICATED line's bytes DID enter, through the envelope sibling that replaced it, and only the hydrated copy carries the regrade's `refuted` fact — so it stays in the join. A CAP-DROPPED line's bytes entered NOWHERE, so it must not: a join over a message that did not ingest would claim an exposure that did not happen.
+     */
+    readonly ingested: ContextLine[];
+}
+/**
+ * Resolve a hydration's two slices in the ONE order that is correct (OPE-1749). Pure.
+ *
+ * 🔴 THE ORDER LIVES HERE, IN CORE, AND NOWHERE ELSE. Every surface hydrates through this module and
+ * through {@link renderContext}, so an order decided inside one provider's route is an order the other
+ * five drift from — which is exactly what happened: Slack's name-drop road capped inside its hydrator
+ * and de-duplicated in its route, two files apart. {@link renderWake} applies this road for every
+ * surface, and the call is IDEMPOTENT, so a surface that resolved its own slices first loses nothing.
+ *
+ * 🔴 THE READ-MORE HINT IS KEYED TO {@link HydrationSlices.rendered}, AND THIS ORDER IS WHAT MAKES THAT
+ * HONEST. `renderContext` appends the hint only when the kept slice FILLS the count cap — a claim that
+ * there is more history to fetch. Under cap-then-de-duplicate the rendered slice fell short of the cap
+ * whenever the envelope overlapped, so the one wake that had MOST history to point at was the wake
+ * that suppressed the hint. De-duplicating first fills the cap whenever enough non-duplicate lines
+ * exist, so the hint now fires on exactly the wakes that have more to read. Driving the hint off the
+ * PRE-de-duplication length would have claimed a cap the render did not hit, so the hint stays keyed to
+ * what rendered and the ORDER is what was wrong.
+ */
+export declare function hydrationSlices(lines: readonly ContextLine[], envelope: readonly WakeMessageInput[], opts?: {
+    readonly maxMessages?: number;
+    readonly maxChars?: number;
+}): HydrationSlices;
+/**
+ * Render the gathered lines into ONE untrusted-wrapped context entry, or null when empty. `lines` must be oldest-first, and the MOST RECENT are kept when over the count or char budget.
+ * `opts.readMoreHint` is appended AFTER the untrusted block, and only when the rendered slice fills MAX_MESSAGES exactly: it is OUR trusted instruction and must never sit inside the wrap where channel content lives. A surface with no read tools passes no hint.
+ */
+export declare function renderContext(lines: readonly ContextLine[], source: string, opts?: {
+    readonly readMoreHint?: string;
+}): string | null;
+/**
+ * Cap a line list to a count and total-chars budget, keeping the MOST RECENT lines — the same trim-and-restore-order algorithm {@link renderContext} runs internally.
+ * For a caller that needs the CAPPED LINES themselves rather than a rendered, wrapped string — Slack's name-drop hydration caps its thread leg with this AFTER the domain's admission policy has run (OPE-1744). `renderContext` keeps its own copy so its live paths carry no regression risk.
+ */
+export declare function capLines(lines: readonly ContextLine[], opts?: {
+    readonly maxMessages?: number;
+    readonly maxChars?: number;
+}): ContextLine[];
+/**
+ * Keep only what a warm conversation would have shown SINCE the agent last spoke: a resumed session already holds everything up to and including its own last reply, and re-injecting it is waste that can confuse the model about what is new.
+ * When the agent never spoke here there is no boundary, so it keeps everything and the caller's count cap trims to the recent tail. Pure over ContextLine[], so every surface's fetcher shares it.
+ */
+export declare function sinceLastAgentReply(lines: readonly ContextLine[]): ContextLine[];
+//# sourceMappingURL=context-render.d.ts.map

package/dist/agent/channels/context-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-render.d.ts","sourceRoot":"","sources":["../../../agent/channels/context-render.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAMpE,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,SAAS,QAAS,CAAC;AAIhC,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;iCAEiC;AACjC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uGAAuG;IACvG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAExJ;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,WAAW,EAAE,CAI7H;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,EACrC,IAAI,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,eAAe,CAQjB;AAWD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5C,MAAM,GAAG,IAAI,CA4Bf;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,SAAS,WAAW,EAAE,EAC7B,IAAI,GAAE;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,WAAW,EAAE,CAcf;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,EAAE,CAShF"}

package/dist/agent/channels/context-render.js

@@ -0,0 +1,148 @@
+// context-render — the platform-neutral core behind every surface's "give the model the surrounding conversation" enrichment: the ContextLine shape and speaker attribution, the count and char caps, the oldest-first render, the untrusted wrap, and the "since the agent last spoke" slice. The raw-message mapping and the read-more hint's tool names stay with their platform and are fed in.
+// UNTRUSTED BY PROVENANCE: every rendered line was written by arbitrary channel members, so the whole block is wrapped and the model must treat it as DATA, never instructions. That is a SECURITY invariant, and it lives here so every surface that renders context is fenced identically. Any read-more hint is OUR trusted instruction, so it is appended OUTSIDE the wrap.
+import { ingestUntrusted } from "../access/untrusted.js";
+import { noteIngestionVerdict } from "../access/taint-enforcement.js";
+import { taintMarkLands } from "../access/taint-signal.js";
+import { UNAUTH_SYSTEM_NOTE } from "./wake-envelope.js";
+import { redactMachineLinkCodes } from "../identity/link-challenge.js";
+// Bounds on what we INJECT (the full history stays reachable on demand via per-surface read
+// tools where they exist). Caps both count and characters so a long channel can't blow the
+// turn's context budget. 10 auto-loaded messages orients the model without dumping a backscroll.
+export const MAX_MESSAGES = 10;
+export const MAX_CHARS = 12_000;
+// The count cap the WAKE and backscroll fetchers request from the platform API.
+// A separate named constant from MAX_MESSAGES so it can be tuned independently — a wake fires far more often than a mention — even though the two currently agree. renderContext still applies MAX_MESSAGES and MAX_CHARS on top as a second bound.
+export const WAKE_BACKSCROLL_MAX = 10;
+/**
+ * Map one {@link ContextLine} onto the taint join's per-message input shape. All three fields are read from the SAME line the render reads, so the render and the join can never disagree about one line.
+ * The return is structural rather than typed, to avoid a core-to-core import cycle: access/taint-signal.ts already imports this module.
+ */
+export function contextLineIngestion(l) {
+    return { trust: l.trust, refuted: l.refuted, authorTrust: l.authorTrust };
+}
+/**
+ * ONE WAKE RENDERS EACH ROOM MESSAGE ONCE (OPE-1743). A seated name-drop wake reads the room TWICE — the seat's own since-last-wake catch-up, rendered as envelope SIBLINGS, and the name-drop hydration, rendered inside the untrusted CONTEXT block — and for a seat that woke minutes ago but last replied an hour ago the first set sits INSIDE the second. Left alone the model is served each overlapping message twice, under two different attributions.
+ * This drops the hydration's copy of every message the envelope already carries, matched on the message id. 🔴 THE CALLER OWES ONE NAMESPACE: it must pass an envelope whose `id`s and lines whose `ts` are the same kind of value. That holds where both are the platform's own message id — a Slack `ts`, a Discord message id — and NOT everywhere: GitHub's and Linear's supervisors build a context line's `ts` from an issue label (`#123`, `OPE-1`), which no sibling id ever equals, so a match there would never fire. THE ENVELOPE WINS where both copies are policed the same way: its siblings carry per-message author, trust tier and send time, while a context line carries an attribution prefix alone, so keeping the envelope copy loses no framing.
+ * Order is kept, and a message the envelope does NOT carry stays — the hydration's whole point is the older conversation the catch-up window never reached.
+ *
+ * 🔴 A POSITIVELY REFUTED AUTHOR'S LINE IS EXEMPT (OPE-1742), AND THE REASON IS ATTRIBUTION, NOT CONTAINMENT — DO NOT READ IT AS A SECURITY CONTROL. "The envelope copy loses no framing" is what licenses the drop, and for a refuted author that premise fails: the two slots are withheld by DIFFERENT legs — the envelope's siblings by `withholdsBody` over each message's own resolved facts (access/external-policy.ts), this slot by the hydration's per-author probe (`withholdWakeBodies`, `excludedAuthorId`) — and the two can disagree. The two Slack envelope arms disagree differently, and both were measured:
+ *  • the FETCHED arm carries the refutation. `regradeSlackBackscrollTrust` sets `refuted: true` on the sibling, so `withholdsBody` withholds the envelope copy as well. Here the exemption changes the COUNT and nothing else.
+ *  • the TAIL arm carries the refutation TOO, since OPE-1747: a tail row records `refuted` and `authorTrust` through `tailAuthorGrain`, and `tailEntryToWakeMessage` copies both, so `withholdsBody` withholds a tail-borne copy exactly as it withholds a fetched one. A row persisted BEFORE that field existed carries no `refuted` at all and rides as `ungraded: true`, which the withhold grain reads as the fail-closed answer — so it is withheld rather than shown, never graded "not refuted". WHAT STILL LICENSES THE EXEMPTION on those facts: the hydrated copy is the only one carrying THIS route's own regrade, and the two slots are still withheld by different legs — the envelope's by `withholdsBody` over each message's resolved facts, this slot by the hydration's per-author probe — so the two can still disagree about one message.
+ * THE COST, STATED: one duplicated line per positively-refuted author per wake, capped like every other line by {@link MAX_MESSAGES} — and on the SHIPPED `taint` grain both copies are VERBATIM, which is the double render OPE-1743 exists to remove. The exemption is a deliberate carve-out from that rule for the one author class whose two copies are not interchangeable.
+ */
+export function contextLinesNotInEnvelope(lines, envelope) {
+    if (lines.length === 0 || envelope.length === 0)
+        return [...lines];
+    const rendered = new Set(envelope.map((m) => m.id));
+    return lines.filter((l) => l.refuted === true || !rendered.has(l.ts));
+}
+/**
+ * Resolve a hydration's two slices in the ONE order that is correct (OPE-1749). Pure.
+ *
+ * 🔴 THE ORDER LIVES HERE, IN CORE, AND NOWHERE ELSE. Every surface hydrates through this module and
+ * through {@link renderContext}, so an order decided inside one provider's route is an order the other
+ * five drift from — which is exactly what happened: Slack's name-drop road capped inside its hydrator
+ * and de-duplicated in its route, two files apart. {@link renderWake} applies this road for every
+ * surface, and the call is IDEMPOTENT, so a surface that resolved its own slices first loses nothing.
+ *
+ * 🔴 THE READ-MORE HINT IS KEYED TO {@link HydrationSlices.rendered}, AND THIS ORDER IS WHAT MAKES THAT
+ * HONEST. `renderContext` appends the hint only when the kept slice FILLS the count cap — a claim that
+ * there is more history to fetch. Under cap-then-de-duplicate the rendered slice fell short of the cap
+ * whenever the envelope overlapped, so the one wake that had MOST history to point at was the wake
+ * that suppressed the hint. De-duplicating first fills the cap whenever enough non-duplicate lines
+ * exist, so the hint now fires on exactly the wakes that have more to read. Driving the hint off the
+ * PRE-de-duplication length would have claimed a cap the render did not hit, so the hint stays keyed to
+ * what rendered and the ORDER is what was wrong.
+ */
+export function hydrationSlices(lines, envelope, opts = {}) {
+    const deduped = contextLinesNotInEnvelope(lines, envelope);
+    const rendered = capLines(deduped, opts);
+    const kept = new Set(rendered);
+    // Only the lines the CAP dropped leave the join. `capLines` also drops an empty-text line, which
+    // belongs on this side too: a line that rendered nothing ingested nothing.
+    const droppedByCap = new Set(deduped.filter((l) => !kept.has(l)));
+    return { rendered, ingested: lines.filter((l) => !droppedByCap.has(l)) };
+}
+// Structured, unambiguous attribution prefix for one line.
+// `trust=unauth` is appended ONLY where the regrade step demoted this line, so an ungraded or member-authored line's attribution is byte-identical to before the field existed.
+function attribution(l) {
+    const trustPart = l.trust === "unauth" ? " trust=unauth" : "";
+    if (l.senderType === "agent")
+        return "[sender_type=agent]";
+    if (l.senderId)
+        return `[sender_type=${l.senderType} sender_id=${l.senderId}${trustPart}]`;
+    return `[sender_type=${l.senderType}${trustPart}]`;
+}
+/**
+ * Render the gathered lines into ONE untrusted-wrapped context entry, or null when empty. `lines` must be oldest-first, and the MOST RECENT are kept when over the count or char budget.
+ * `opts.readMoreHint` is appended AFTER the untrusted block, and only when the rendered slice fills MAX_MESSAGES exactly: it is OUR trusted instruction and must never sit inside the wrap where channel content lives. A surface with no read tools passes no hint.
+ */
+export function renderContext(lines, source, opts = {}) {
+    const kept = [];
+    let chars = 0;
+    let hasUnauth = false;
+    // Keep the MOST RECENT messages when over budget (drop from the top), then restore order.
+    for (let i = lines.length - 1; i >= 0 && kept.length < MAX_MESSAGES; i--) {
+        const l = lines[i];
+        // A user's claim must remain intact for the link-claim hook. Every other sender class is a
+        // machine/unknown history projection, never evidence for a claim, so a host-posted bearer code
+        // is removed before this side-channel context reaches the model.
+        const text = (l.senderType === "user" ? l.text : redactMachineLinkCodes(l.text)).trim();
+        if (!text)
+            continue;
+        const rendered = `${attribution(l)} ${text}`;
+        if (chars + rendered.length > MAX_CHARS && kept.length > 0)
+            break;
+        chars += rendered.length;
+        kept.unshift(rendered);
+        if (l.trust === "unauth")
+            hasUnauth = true;
+    }
+    if (kept.length === 0)
+        return null;
+    const body = `Recent conversation (oldest first), for context:\n${kept.join("\n")}`;
+    // RENDER-TIME INGESTION FENCES, NEVER TAINTS, BY DESIGN. Backscroll is composed in the ingress process, outside any turn context, so the taint half no-ops here every time — which is the wanted behaviour: chat-message content is TRUSTED by the ratified source-tier table, and tainting the conversation the agent is sitting in is the always-on bit that was removed.
+    // The verdict is DECLARED as a separate call and reports `taintsToday` from the RUNTIME rather than from a hardcoded claim: no context means silent agreement with the trusted row, a context means an over-taint row saying this render has started running in-turn. The wrap below carries no `ingestion:` opt on purpose, because the table would then SILENCE that alarm instead of raising it.
+    noteIngestionVerdict({ kind: "chat-message", label: "context-render" }, taintMarkLands());
+    const wrapped = ingestUntrusted(body, { source });
+    // The hint sits after the untrusted block's own trailing notice — unambiguously ours, not part of the channel transcript it describes — and only when the slice hit the cap and a hint was given.
+    // The trusted unauth teaching note rides BEFORE it, driven by the STRUCTURED `trust` field on a rendered line, so a hostile body cannot fake it.
+    const withNote = hasUnauth ? `${wrapped}\n\n${UNAUTH_SYSTEM_NOTE}` : wrapped;
+    return kept.length === MAX_MESSAGES && opts.readMoreHint ? `${withNote}\n\n${opts.readMoreHint}` : withNote;
+}
+/**
+ * Cap a line list to a count and total-chars budget, keeping the MOST RECENT lines — the same trim-and-restore-order algorithm {@link renderContext} runs internally.
+ * For a caller that needs the CAPPED LINES themselves rather than a rendered, wrapped string — Slack's name-drop hydration caps its thread leg with this AFTER the domain's admission policy has run (OPE-1744). `renderContext` keeps its own copy so its live paths carry no regression risk.
+ */
+export function capLines(lines, opts = {}) {
+    const maxMessages = opts.maxMessages ?? MAX_MESSAGES;
+    const maxChars = opts.maxChars ?? MAX_CHARS;
+    const kept = [];
+    let chars = 0;
+    for (let i = lines.length - 1; i >= 0 && kept.length < maxMessages; i--) {
+        const l = lines[i];
+        const text = l.text.trim();
+        if (!text)
+            continue;
+        if (chars + text.length > maxChars && kept.length > 0)
+            break;
+        chars += text.length;
+        kept.unshift(l);
+    }
+    return kept;
+}
+/**
+ * Keep only what a warm conversation would have shown SINCE the agent last spoke: a resumed session already holds everything up to and including its own last reply, and re-injecting it is waste that can confuse the model about what is new.
+ * When the agent never spoke here there is no boundary, so it keeps everything and the caller's count cap trims to the recent tail. Pure over ContextLine[], so every surface's fetcher shares it.
+ */
+export function sinceLastAgentReply(lines) {
+    let lastAgent = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (lines[i].senderType === "agent") {
+            lastAgent = i;
+            break;
+        }
+    }
+    return lastAgent >= 0 ? lines.slice(lastAgent + 1) : [...lines];
+}
+//# sourceMappingURL=context-render.js.map

package/dist/agent/channels/context-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-render.js","sourceRoot":"","sources":["../../../agent/channels/context-render.ts"],"names":[],"mappings":"AAAA,oYAAoY;AACpY,gXAAgX;AAEhX,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAyC,MAAM,oBAAoB,CAAC;AAE/F,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,4FAA4F;AAC5F,2FAA2F;AAC3F,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC,gFAAgF;AAChF,oPAAoP;AACpP,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AA+BtC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAc;IACjD,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAA6B,EAAE,QAAqC;IAC5G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAmBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA6B,EAC7B,QAAqC,EACrC,IAAI,GAAkE,EAAE;IAExE,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAc,QAAQ,CAAC,CAAC;IAC5C,iGAAiG;IACjG,2EAA2E;IAC3E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAc,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,2DAA2D;AAC3D,gLAAgL;AAChL,SAAS,WAAW,CAAC,CAAc;IACjC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,qBAAqB,CAAC;IAC3D,IAAI,CAAC,CAAC,QAAQ;QAAE,OAAO,gBAAgB,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,QAAQ,GAAG,SAAS,GAAG,CAAC;IAC3F,OAAO,gBAAgB,CAAC,CAAC,UAAU,GAAG,SAAS,GAAG,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,KAA6B,EAC7B,MAAc,EACd,IAAI,GAAuC,EAAE;IAE7C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,0FAA0F;IAC1F,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC,EAAE,EAAE,CAAC;QACzE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,2FAA2F;QAC3F,+FAA+F;QAC/F,iEAAiE;QACjE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QAClE,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS,GAAG,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,qDAAqD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACpF,4WAA4W;IAC5W,oYAAoY;IACpY,oBAAoB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAClD,kMAAkM;IAClM,iJAAiJ;IACjJ,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,kBAAkB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7E,OAAO,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CACtB,KAA6B,EAC7B,IAAI,GAAkE,EAAE;IAExE,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;QAC7D,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA6B;IAC/D,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YACpC,SAAS,GAAG,CAAC,CAAC;YACd,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/agent/channels/control-mcp.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
+export default _default;
+//# sourceMappingURL=control-mcp.d.ts.map

package/dist/agent/channels/control-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-mcp.d.ts","sourceRoot":"","sources":["../../../agent/channels/control-mcp.ts"],"names":[],"mappings":""}