@open-everywhere/core 0.1.0

package/dist/agent/channels/egress-spoof.js

@@ -0,0 +1,36 @@
+// egress-spoof — the one exit every outbound room post passes through under `OE_EGRESS_SPOOF`, the local-eval flag that must swallow a vendor call before the transport. THE GATE SITS IN TWO LAYERS: the SPINES, where every post that owes its caller a usable answer gates itself and hands back a synthetic id or a `true`, so the caller's own bookkeeping reads as it would on a live surface; and the SLACK BRIDGE (channels/slack-bridge.ts), through which every OTHER core feature posts to Slack, and which gates its room-WRITE methods by allowlist and answers Slack's own success shape.
+// A new post site calls `swallowRoomPost` or `swallowRoomOp` BEFORE it resolves a transport or looks up a provider registry; there is no process-wide network interception, so a bundle that posts through neither seam is outside the flag.
+// 🔴 OPERATOR CAVEAT: `onVercel()` is the ONE refusal this module enforces, so keeping `OE_EGRESS_SPOOF=1` out of a self-host or `OE_PLATFORM`-labelled deploy is an operator responsibility. With the flag set on a non-Vercel deploy, every reply, card, notice and reaction that reaches one of the two layers above is swallowed behind a `console.warn` — a post hands back a synthetic id, an edit or reaction a bare `true` — and the audit rows read as normal.
+import { onVercel } from "../access/platform.js";
+/**
+ * True when the local-eval spoof is armed; THROWS on Vercel, where the flag is a deploy misconfiguration rather than a transport failure.
+ * Read at call time and never cached: the integration tier arms and disarms the flag around individual legs.
+ */
+function egressSpoofArmed() {
+    if (process.env.OE_EGRESS_SPOOF !== "1")
+        return false;
+    if (onVercel())
+        throw new Error("OE_EGRESS_SPOOF is a local-eval flag — refusing on Vercel.");
+    return true;
+}
+/**
+ * Swallow one outbound room post and hand back a SYNTHETIC message id, or undefined when the spoof is not armed and the caller must reach the real transport.
+ * `what` and `idTag` are contract, not decoration: eval harnesses score off the log line and integration tests match the `spoof-<idTag>-…` id shape.
+ */
+export function swallowRoomPost(what, idTag) {
+    if (!egressSpoofArmed())
+        return undefined;
+    console.warn(`[oe] OE_EGRESS_SPOOF: swallowed ${what}`);
+    return `spoof-${idTag}-${Date.now()}`;
+}
+/**
+ * Swallow one outbound room op that owes no message id — an edit, a reaction, a void notice. True when it was swallowed and the caller must not reach a transport.
+ * A swallowed op reports SUCCESS, so the caller's own bookkeeping reads exactly as it would on a live surface.
+ */
+export function swallowRoomOp(what) {
+    if (!egressSpoofArmed())
+        return false;
+    console.warn(`[oe] OE_EGRESS_SPOOF: swallowed ${what}`);
+    return true;
+}
+//# sourceMappingURL=egress-spoof.js.map

package/dist/agent/channels/egress-spoof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-spoof.js","sourceRoot":"","sources":["../../../agent/channels/egress-spoof.ts"],"names":[],"mappings":"AAAA,wkBAAwkB;AACxkB,6OAA6O;AAC7O,wcAAwc;AAExc,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEjD;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,gBAAgB,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/agent/channels/engaged-wake.d.ts

@@ -0,0 +1,86 @@
+import type { Partition } from "../memory/partition.js";
+import type { WakeAddressing, WakeFollowUp } from "./wake-envelope.js";
+/**
+ * The `<wake follow-up>` contract an engaged conversation's judged wake states — the ONE helper
+ * every enveloped surface calls, so no two can drift.
+ *
+ * 🔴 `threadEngaged` IS THE ONLY INPUT, AND THE ADDRESSING NEVER SUBSTITUTES FOR IT. A
+ * `thread-follow` tier looks like the answer and is not: every producer of it reaches that tier past
+ * an `isEngaged` gate that reads `row !== null` ({@link isThreadEngaged}), which a WARM row satisfies
+ * — Slack's name-drop latch and Discord's thread name-drop both write `participating: false`, and a
+ * seat that was never invited is exactly the seat whose reply bar the watcher row exists to RAISE.
+ * Deriving the contract from the tier would tell it the opposite. So each caller passes the row it
+ * already read, spelled the same way everywhere: `participating === true && stopped !== true`.
+ *
+ * Absent (undefined) on every other wake ⇒ no attribute ⇒ a byte-identical render.
+ */
+export declare function engagedFollowUpContract(f: {
+    readonly addressing: WakeAddressing;
+    readonly threadEngaged?: boolean;
+}): WakeFollowUp | undefined;
+/**
+ * The enrolment fact for a surface whose engaged follow-up carries NO `<wake>` envelope — GitHub's
+ * native `githubChannel` session, where eve renders the comment itself and the only seam OE owns is
+ * the inbound hook's `context` array.
+ *
+ * 🔴 IT SAYS THE SAME THING THE ATTRIBUTE SAYS, IN THE WORDS A SEAT WITH NO ENVELOPE CAN USE. The
+ * standing "Reading a wake" block teaches `follow-up="thread-engaged"`, but that block is spliced
+ * ONLY into a session that can receive an envelope (instructions/access.ts), so a native GitHub seat
+ * never reads it. Quoting the raw attribute here would therefore hand the model a token it was never
+ * taught. The prose states the fact, names the consequence, and names the way out — which is the
+ * whole of what the attribute means.
+ *
+ * 🔴 IT STOPS AT "addressed you" AND CLAIMS NO ANSWER. The mark runs at INGRESS, above the turn
+ * (`github.ts` marks on every admitted @mention), so a mention the seat declined with `no_reply`
+ * enrols the container just the same. "and you answered it" would be a trusted host line asserting a
+ * reply that may not exist, which is a thing the seat would then reason and report from.
+ *
+ * TRUSTED, and structurally so: it is an OE-authored constant with no interpolation point, appended
+ * by the host beside the delivery rather than inside any message body.
+ */
+export declare const ENGAGED_FOLLOW_UP_CONTEXT: string;
+/**
+ * Is THIS conversation enrolled, in the sense the ruling means — "a message here is addressed to the
+ * seat by construction"? The predicate the silence verb asks before it accepts `addressed_to_other`.
+ *
+ * 🔴 IT IS THE NARROWEST OF THE READINGS IN PLAY, AND THAT IS THE POINT. A row exists for two quite
+ * different reasons: an @mention (or an earned reply) ENROLLED the conversation, which every
+ * surface's mark spells `participating: true`; or a name-drop / room watch LATCHED it warm, which
+ * they spell `participating: false` (discord-gateway.ts's name-drop mark, teams-engagement.ts's room
+ * row). Only the first is an invitation, and only an invitation makes a later message addressed by
+ * construction. A stopped row is excluded for the obvious reason: `stand_down` has already run.
+ *
+ * 🔴 IT IS THE SAME EXPRESSION EVERY CALLER OF {@link engagedFollowUpContract} PASSES, and that is
+ * what keeps the refusal inside the telling: a WARM conversation is told nothing and refused nothing.
+ * One case runs the other way, and it is deliberate: TEAMS marks
+ * `participating: true` and then forwards its engaged channel follow-up to the native path, which
+ * builds no wake, so a Teams seat can be refused a reason it was never told about. That is
+ * deliberate rather than tolerated — the refusal's own copy STATES the enrolment
+ * ({@link NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL}), so a seat the telling has not reached yet learns it
+ * at the only moment it matters. The telling is the primary; this is the backstop.
+ *
+ * FAIL-SOFT: no anchor, no row, or an unreadable store (`getThreadEngagement` swallows) all answer
+ * false ⇒ the call proceeds ⇒ nothing about a healthy turn changes for want of a store read.
+ */
+export declare function conversationEnrolledForSilence(p: Partition, anchor: string | undefined): Promise<boolean>;
+/** The audit action a refused `no_reply addressed_to_other` on an engaged wake writes. Named for the
+ *  EFFECT, like every other row in this plane, so it survives the verb or the reason being renamed. */
+export declare const NO_REPLY_ON_ENGAGED_ACTION = "reply.no_reply_addressed_to_other_refused";
+/**
+ * What the silence verb answers when the model claims an engaged conversation's message was for
+ * somebody else.
+ *
+ * 🔴 IT MUST NOT STEER THE SEAT INTO A REPLY IT DOES NOT HAVE. The corrective states the fact the
+ * registry holds, then names the two honest endings that remain — answer, or say silence with a
+ * reason that is actually true. A message that only said "reply" would buy a confabulated answer on
+ * the turns where the seat genuinely has nothing, which is the failure mode `nothing_to_add` exists
+ * for.
+ *
+ * 🔴 AND IT NAMES NO EXCEPTION THE GUARD DOES NOT HONOUR. An earlier draft said "addressed to you
+ * unless it names somebody else". The guard has no such carve-out — it refuses the reason on an
+ * enrolled conversation whatever the body says — so a seat reading a message that DID name somebody
+ * else would call the same reason again, be refused by the same text, and spend a step per round
+ * (the arm has no valve). Copy that describes a door the code does not open is a loop.
+ */
+export declare const NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL: string;
+//# sourceMappingURL=engaged-wake.d.ts.map

package/dist/agent/channels/engaged-wake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engaged-wake.d.ts","sourceRoot":"","sources":["../../../agent/channels/engaged-wake.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAwBvE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE;IACzC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,YAAY,GAAG,SAAS,CAE3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,QAIiC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/G;AAED;uGACuG;AACvG,eAAO,MAAM,0BAA0B,8CAA8C,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,QAIJ,CAAC"}

package/dist/agent/channels/engaged-wake.js

@@ -0,0 +1,146 @@
+// engaged-wake — the ONE place that says how an ENGAGED conversation's enrolment reaches the model,
+// and the ONE refusal that stops the model re-deciding addressing on such a wake.
+//
+// 🔴 WHAT THIS EXISTS TO STOP (OPE-1740, measured on deploy #200, `J-ENGAGED-github`). An @mention
+// engaged a GitHub issue, the plain follow-up in that issue woke the seat, and the model answered
+// `no_reply reason:"addressed_to_other"` — it read the follow-up as somebody else's. It was right to
+// ask the question and wrong about the answer, because nothing in its turn context said the issue was
+// enrolled: on a repo the native leg owns, GitHub's engaged follow-up rides eve's NATIVE
+// `githubChannel` session, which renders the comment body and no `<wake>` envelope at all. Slack,
+// Linear and Notion had said it since OPE-1673 and OPE-1711 (`follow-up="thread-engaged"`), and
+// Notion's engaged follow-up replied on that same deploy. The fact was per-surface; the defect was
+// the surfaces that lacked it.
+//
+// 🔴 "GITHUB HAS NO ENVELOPE" IS TRUE OF ONE LEG, NOT OF THE SURFACE (OPE-1745 § 1). GitHub runs two
+// legs over one webhook, and on a SEATED, operator-vouched repo the native leg stands down for every
+// comment (`shouldSuppressNativeMention`, github.ts) — the engaged follow-up is then the AMBIENT
+// leg's, and that leg renders a `channel-watch` envelope. It states `follow-up="thread-engaged"`
+// through {@link engagedFollowUpContract}, like Slack, Linear and Notion (OPE-2093).
+//
+// THE RULING THIS ENCODES (the brain, 2026-09-12): a follow-up in a conversation the seat is ENGAGED
+// on is addressed to the seat BY CONSTRUCTION — that is what engagement means. So the seat is TOLD
+// (below, `engagedFollowUpContract` for a surface with an envelope, {@link ENGAGED_FOLLOW_UP_CONTEXT}
+// for one without), and the silence verb REFUSES the one reason that contradicts the telling
+// ({@link NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL}). Neither half is a judgement the model re-makes.
+//
+// 🔴 THE REFUSAL IS NARROW ON PURPOSE. It refuses exactly `addressed_to_other`, and nothing else: a
+// seat that is enrolled and has genuinely nothing to add still has `nothing_to_add`, a seat asked to
+// leave still has `stand_down`, and every other closed reason is untouched. Silence stays available;
+// only the claim "this was for someone else" is refused, because the engagement registry already
+// answered that question with the opposite verdict.
+import { getThreadEngagement } from "./engagement.js";
+/**
+ * Does this rendered addressing carry a `<wake>` envelope the enrolment can hang an attribute on,
+ * AND leave the reply bar to the seat's own judgement, AND state no follow-up contract of its own?
+ *
+ * Three exclusions, each for its own reason:
+ *  • `direct` renders the body VERBATIM with no envelope (normalized-wake.ts W4), so an attribute
+ *    there would be dropped on the floor.
+ *  • `direct-mention` renders the envelope but is ADDRESSED — it is owed an answer whatever the
+ *    conversation's enrolment says, so telling it "you are already enrolled" decides nothing. This
+ *    and the one above are the exclusions Slack, Linear and Notion each wrote by hand before this
+ *    helper existed.
+ *  • 🔴 `name-drop` OWNS ITS OWN CONTRACT, and it is not always this one. The name-drop mechanic
+ *    states `follow-up` itself ({@link NormalizedWake.nameDrop}) — `channel-not-following` on a base
+ *    channel, where a reply deliberately does NOT enrol — and a relay that reported no bot name
+ *    states NOTHING, which is a FIDELITY guard the Discord builders document by name. Answering here
+ *    would overwrite the first case's meaning where the mechanic is present and break the second's
+ *    byte-identity where it is not.
+ */
+function judgedAddressing(addressing) {
+    return addressing !== "direct" && addressing !== "direct-mention" && addressing !== "name-drop";
+}
+/**
+ * The `<wake follow-up>` contract an engaged conversation's judged wake states — the ONE helper
+ * every enveloped surface calls, so no two can drift.
+ *
+ * 🔴 `threadEngaged` IS THE ONLY INPUT, AND THE ADDRESSING NEVER SUBSTITUTES FOR IT. A
+ * `thread-follow` tier looks like the answer and is not: every producer of it reaches that tier past
+ * an `isEngaged` gate that reads `row !== null` ({@link isThreadEngaged}), which a WARM row satisfies
+ * — Slack's name-drop latch and Discord's thread name-drop both write `participating: false`, and a
+ * seat that was never invited is exactly the seat whose reply bar the watcher row exists to RAISE.
+ * Deriving the contract from the tier would tell it the opposite. So each caller passes the row it
+ * already read, spelled the same way everywhere: `participating === true && stopped !== true`.
+ *
+ * Absent (undefined) on every other wake ⇒ no attribute ⇒ a byte-identical render.
+ */
+export function engagedFollowUpContract(f) {
+    return judgedAddressing(f.addressing) && f.threadEngaged === true ? "thread-engaged" : undefined;
+}
+/**
+ * The enrolment fact for a surface whose engaged follow-up carries NO `<wake>` envelope — GitHub's
+ * native `githubChannel` session, where eve renders the comment itself and the only seam OE owns is
+ * the inbound hook's `context` array.
+ *
+ * 🔴 IT SAYS THE SAME THING THE ATTRIBUTE SAYS, IN THE WORDS A SEAT WITH NO ENVELOPE CAN USE. The
+ * standing "Reading a wake" block teaches `follow-up="thread-engaged"`, but that block is spliced
+ * ONLY into a session that can receive an envelope (instructions/access.ts), so a native GitHub seat
+ * never reads it. Quoting the raw attribute here would therefore hand the model a token it was never
+ * taught. The prose states the fact, names the consequence, and names the way out — which is the
+ * whole of what the attribute means.
+ *
+ * 🔴 IT STOPS AT "addressed you" AND CLAIMS NO ANSWER. The mark runs at INGRESS, above the turn
+ * (`github.ts` marks on every admitted @mention), so a mention the seat declined with `no_reply`
+ * enrols the container just the same. "and you answered it" would be a trusted host line asserting a
+ * reply that may not exist, which is a thing the seat would then reason and report from.
+ *
+ * TRUSTED, and structurally so: it is an OE-authored constant with no interpolation point, appended
+ * by the host beside the delivery rather than inside any message body.
+ */
+export const ENGAGED_FOLLOW_UP_CONTEXT = "You are already engaged in this conversation — an earlier message here addressed you. A later " +
+    "message in this same conversation is therefore for you, even when it does not name you again: " +
+    "that is what being engaged here means, and it is why this one woke you. Answer it. If the people " +
+    "here ask you to stop following the conversation, call `stand_down`.";
+/**
+ * Is THIS conversation enrolled, in the sense the ruling means — "a message here is addressed to the
+ * seat by construction"? The predicate the silence verb asks before it accepts `addressed_to_other`.
+ *
+ * 🔴 IT IS THE NARROWEST OF THE READINGS IN PLAY, AND THAT IS THE POINT. A row exists for two quite
+ * different reasons: an @mention (or an earned reply) ENROLLED the conversation, which every
+ * surface's mark spells `participating: true`; or a name-drop / room watch LATCHED it warm, which
+ * they spell `participating: false` (discord-gateway.ts's name-drop mark, teams-engagement.ts's room
+ * row). Only the first is an invitation, and only an invitation makes a later message addressed by
+ * construction. A stopped row is excluded for the obvious reason: `stand_down` has already run.
+ *
+ * 🔴 IT IS THE SAME EXPRESSION EVERY CALLER OF {@link engagedFollowUpContract} PASSES, and that is
+ * what keeps the refusal inside the telling: a WARM conversation is told nothing and refused nothing.
+ * One case runs the other way, and it is deliberate: TEAMS marks
+ * `participating: true` and then forwards its engaged channel follow-up to the native path, which
+ * builds no wake, so a Teams seat can be refused a reason it was never told about. That is
+ * deliberate rather than tolerated — the refusal's own copy STATES the enrolment
+ * ({@link NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL}), so a seat the telling has not reached yet learns it
+ * at the only moment it matters. The telling is the primary; this is the backstop.
+ *
+ * FAIL-SOFT: no anchor, no row, or an unreadable store (`getThreadEngagement` swallows) all answer
+ * false ⇒ the call proceeds ⇒ nothing about a healthy turn changes for want of a store read.
+ */
+export async function conversationEnrolledForSilence(p, anchor) {
+    if (!anchor)
+        return false;
+    const row = await getThreadEngagement(p, anchor);
+    return row !== null && row.participating === true && row.stopped !== true;
+}
+/** The audit action a refused `no_reply addressed_to_other` on an engaged wake writes. Named for the
+ *  EFFECT, like every other row in this plane, so it survives the verb or the reason being renamed. */
+export const NO_REPLY_ON_ENGAGED_ACTION = "reply.no_reply_addressed_to_other_refused";
+/**
+ * What the silence verb answers when the model claims an engaged conversation's message was for
+ * somebody else.
+ *
+ * 🔴 IT MUST NOT STEER THE SEAT INTO A REPLY IT DOES NOT HAVE. The corrective states the fact the
+ * registry holds, then names the two honest endings that remain — answer, or say silence with a
+ * reason that is actually true. A message that only said "reply" would buy a confabulated answer on
+ * the turns where the seat genuinely has nothing, which is the failure mode `nothing_to_add` exists
+ * for.
+ *
+ * 🔴 AND IT NAMES NO EXCEPTION THE GUARD DOES NOT HONOUR. An earlier draft said "addressed to you
+ * unless it names somebody else". The guard has no such carve-out — it refuses the reason on an
+ * enrolled conversation whatever the body says — so a seat reading a message that DID name somebody
+ * else would call the same reason again, be refused by the same text, and spend a step per round
+ * (the arm has no valve). Copy that describes a door the code does not open is a loop.
+ */
+export const NO_REPLY_ADDRESSED_TO_OTHER_REFUSAL = "You are engaged in this conversation, so a message here is addressed to you — " +
+    "`addressed_to_other` is not available on this wake. Answer it, or, if you truly have nothing to " +
+    "add, call `no_reply` again with `nothing_to_add`. If they asked you to stop following the " +
+    "conversation, call `stand_down` instead.";
+//# sourceMappingURL=engaged-wake.js.map

package/dist/agent/channels/engaged-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engaged-wake.js","sourceRoot":"","sources":["../../../agent/channels/engaged-wake.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,yFAAyF;AACzF,kGAAkG;AAClG,gGAAgG;AAChG,mGAAmG;AACnG,+BAA+B;AAC/B,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,qFAAqF;AACrF,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,sGAAsG;AACtG,6FAA6F;AAC7F,iGAAiG;AACjG,EAAE;AACF,oGAAoG;AACpG,qGAAqG;AACrG,qGAAqG;AACrG,iGAAiG;AACjG,oDAAoD;AAGpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB,CAAC,UAA0B;IAClD,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,gBAAgB,IAAI,UAAU,KAAK,WAAW,CAAC;AAClG,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAGvC;IACC,OAAO,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,gGAAgG;IAChG,gGAAgG;IAChG,mGAAmG;IACnG,qEAAqE,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,CAAY,EAAE,MAA0B;IAC3F,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;AAC5E,CAAC;AAED;uGACuG;AACvG,MAAM,CAAC,MAAM,0BAA0B,GAAG,2CAA2C,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAC9C,gFAAgF;IAChF,kGAAkG;IAClG,4FAA4F;IAC5F,0CAA0C,CAAC"}

package/dist/agent/channels/engagement.d.ts

@@ -0,0 +1,132 @@
+import type { EngagementRow } from "../operational/store.js";
+import { type Partition } from "../memory/partition.js";
+import type { WakeReason, WakeTrust, WakeMessageSender } from "./wake-envelope.js";
+export declare const WARM_SILENT_LIMIT = 3;
+/** The options {@link markThreadEngaged} accepts. Everything except {@link EngageOpts.byOwnPost} is
+ *  handed to the store unchanged; that one is a HOST-SIDE rule and never reaches it. */
+export interface EngageOpts {
+    readonly participating?: boolean;
+    readonly ownerToken?: string;
+    readonly kind?: "thread" | "spawned";
+    readonly engagedBy?: string;
+    /**
+     * THIS PROMOTION IS THE AGENT'S OWN POST, not an invitation from a person — so it must NOT lift a stand-down. See {@link ownPostMustNotRevive} for the measurement and the rule.
+     * Pass it on every promotion whose trigger is the agent posting; leave it off on a promotion whose trigger is an @mention, a DM or any other human address.
+     */
+    readonly byOwnPost?: boolean;
+}
+/**
+ * 🔴 THE AGENT'S OWN POST IS NOT A RE-INVITATION (OPE-1669). The store clears `stopped` on any promotion that carries no already-recorded promoter id, and a posted reply promotes with none — so the acknowledgement `stand_down` asks for was UNDOING the stop it had just recorded, and the next plain thread-follow was admitted at the door as if nothing had happened.
+ * MEASURED on ship #191 (deploy `dpl_EXAMPLE000000000000000000003`): `engagement.stood_down marked:true` at 18:30:09Z on anchor `1788978576.441969`, the acknowledgement posted at 18:30:27Z, and a plain `thread-follow` wake was answered at 18:30:43Z. Zero `reply.forced` rows — the reply plane behaved; the REGISTRY ROW had been un-stopped between the two.
+ * THE RULE, and it is one line: a promotion caused by the agent's own post is DOWNGRADED to a plain refresh while the row is stopped. A plain refresh advances `last_turn_at` and touches nothing else, so the stop survives and the thread stays quiet until a person @mentions the agent back in.
+ * IT COSTS THE PROMOTION NOTHING THAT MATTERS. The only work `participating` does on a stopped row is clear the stop and reset the warm silent streak, and neither has a reader while the thread is stopped: the door drops every non-mention wake, and the revival path promotes with `participating: true` itself.
+ * PURE, so the rule is testable without a store.
+ */
+export declare function ownPostMustNotRevive(opts: EngageOpts | undefined, stopped: boolean): boolean;
+/**
+ * Engage a thread, or refresh its last-turn time. Best-effort: it never blocks a turn.
+ * `opts.participating` PROMOTES the thread to an invited participant and resets its silent streak; the default — a warm-on-wake latch or a plain refresh — never downgrades an already-participating thread. `ownerToken` and `kind` are a pure passthrough, because no routing decision lives here.
+ * `opts.engagedBy` NAMES THE PROMOTING EVENT (OPE-1527, widened by OPE-1562): a promotion repeating ANY id the row still records cannot clear `stopped`. The row keeps a BOUNDED LIST of recent promoters, so a redelivery of a SUPERSEDED promotion is guarded too — only a promotion that the bound has pushed off the list clears again. Pass the platform's own event id on every promotion that a redelivery can repeat; omit it and the clearing rule is exactly what it was.
+ * `opts.byOwnPost` COSTS ONE ROW READ, and only on a promotion that declares itself (OPE-1669). The read is what makes {@link ownPostMustNotRevive} decidable; every other call reaches the store exactly as before. 🔴 The read and the write are not one statement, so a `stand_down` landing BETWEEN them is still lifted — a window of one store round-trip on the agent's own post path, against today's every-post-lifts-it. Closing it needs the rule inside the store's own `markEngaged`, which is a change to both backings.
+ */
+export declare function markThreadEngaged(p: Partition, threadTs: string, atIso: string, opts?: EngageOpts): Promise<void>;
+/** The full engagement record for a thread (or null). Fail-soft: a store error reads as
+ *  null — the same fail-closed posture as {@link isThreadEngaged}. */
+export declare function getThreadEngagement(p: Partition, threadTs: string): Promise<EngagementRow | null>;
+/** Bump a thread's silent-streak counter, returning the new value (0 if no record /
+ *  on error). Best-effort: engagement bookkeeping must never fail a turn. */
+export declare function bumpThreadSilentStreak(p: Partition, threadTs: string): Promise<number>;
+/** Drop a thread's engagement (explicit stop). Returns whether a record was removed. */
+export declare function disengageThread(p: Partition, threadTs: string): Promise<boolean>;
+/**
+ * Mark a thread STOPPED without deleting its engagement row. On the WINDOW path a stop cannot disengage by delete: the wake gate never reads engagement there, so a deleted row suppresses nothing and a post-stop follow-up would still wake the supervisor. The durable `stopped` flag IS the suppression signal instead.
+ * Best-effort — a store error reads as false, with no marker written — and cleared by a re-invitation.
+ */
+export declare function markThreadStopped(p: Partition, threadTs: string): Promise<boolean>;
+/**
+ * Is this thread's durable STOOD-DOWN flag set RIGHT NOW? The read the reply path makes per post (OPE-1520): the flag was previously read only at wake time, so a stand-down stored MID-TURN said nothing to the turn that was already running and the seat kept posting after acknowledging the stop.
+ * 🔴 FAIL-OPEN, the opposite direction to {@link isThreadEngaged}, and the difference is deliberate. That predicate decides whether to BARGE IN, where "unknown" must mean stay out. This one decides whether to SILENCE an answer the model has already written, where "unknown" must mean deliver — a store hiccup that swallowed replies would be a far worse failure than one that posts a message into a conversation the agent was asked to leave.
+ * `anchor` is the ENGAGEMENT-REGISTRY key, the one `tools/stand_down.ts` writes the flag at — pass the caller's own `binding.engagementKey ?? binding.threadTs`, never a reply target. Absent reads as NOT stopped: a turn with no anchor holds no row to have been marked.
+ */
+export declare function isThreadStopped(p: Partition, anchor: string | undefined): Promise<boolean>;
+/**
+ * The ROOM-GRAIN engagement row's address for a partition — the row an UNDIRECTED room wake stores itself at, and the row a stop from such a wake lands on (OPE-1511).
+ *
+ * 🔴 WHY A SECOND GRAIN EXISTS AT ALL. The ordinary engagement row is keyed per CONVERSATION (a Slack thread, a Teams reply chain), because that is the container an @mention engages. A surface whose wake gate watches the whole ROOM — Teams' single-window Leg A — wakes on messages in conversations no @mention ever touched, so no conversation row exists for a stop to mark, and `stand_down` refuses on a wake it can plainly see. The standing rule is that a stored stop exists exactly where a stored wake exists, so the room wake stores a room row and the stop marks that one.
+ *
+ * The address is the DOMAIN grain (`partition.domainKey`) and the anchor is its last segment.
+ *
+ * 🔴 IT IS ALWAYS A SEPARATE ROW FROM THE CONVERSATION'S, INCLUDING WHERE THE TWO GRAINS COINCIDE, and reading it any other way will mislead you about where a stop landed. The anchor here is a `seg()`-SANITISED key segment; the conversation row's anchor is `binding.engagementKey`, deliberately RAW so it matches the platform's own ingress byte for byte. A Teams message at a channel root has `conversation.id === channelId` and therefore one surface key — and still two rows, `19-abc-thread.tacv2` and `19:abc@thread.tacv2`, because the two anchors spell that id differently. Nothing breaks: the room row's writer and reader both come through this function, and the conversation row's writer and reader both use the raw key. They are two registries that never consult each other.
+ *
+ * PURE: it derives an address and reads nothing. A partition whose domain key carries no third segment — a synthetic control or routine partition, never a chat surface — falls back to the partition's own surface for the anchor. Both callers derive through this one function, so the pair stays internally consistent whatever it returns.
+ */
+export declare function roomEngagementAddress(p: Partition): {
+    readonly partition: Partition;
+    readonly anchor: string;
+};
+/** Is this thread currently engaged? Fail-closed: a store error reads as NOT engaged. */
+export declare function isThreadEngaged(p: Partition, threadTs: string): Promise<boolean>;
+/** Inputs the message-event router extracts from a raw Slack `message` event. */
+export interface ReplyDeliveryInput {
+    /** Whether (org, channel, threadTs) is in the engagement registry. */
+    readonly isEngaged: boolean;
+    /**
+     * The thread's durable STOOD-DOWN marker: the agent judged it was asked to stop following here and set the flag, and a re-invitation clears it.
+     * A FLAG, NOT A DELETED ROW, and that is the whole point: a delete suppresses nothing anywhere the wake gate does not consult the registry, so a post-stop follow-up still woke the agent. Optional, and absent reads as NOT stopped.
+     */
+    readonly stopped?: boolean;
+    /** The author is a bot (`bot_id` set) — never deliver (stops self-trigger loops). */
+    readonly authorIsBot: boolean;
+    /** The event is itself an app_mention — handled by the normal mention path, not here. */
+    readonly isAppMention: boolean;
+    /** The message carries a thread_ts (it's a thread reply). Engagement is per-thread. */
+    readonly inThread: boolean;
+    /**
+     * Slack message subtype. Any subtype disqualifies EXCEPT `message_changed`: an edit of an existing message is itself wake-worthy, because the human may be correcting or adding to what they are asking.
+     * That is noise-safe because `no_reply` lets the judged turn decline a trivial edit, instead of the event being dropped outright.
+     */
+    readonly subtype?: string;
+}
+/** The {@link ReplyDecision.reason} a STOOD-DOWN thread's dropped delivery carries. Exported so a
+ *  surface can tell THIS refusal apart from every other disqualifier and write its own drop row
+ *  (OPE-1669) — matching the returned text against a copy of the wording would drift the day the
+ *  copy is reworded, and the drop would then go silent again with no test to notice. */
+export declare const STAND_DOWN_DELIVERY_REFUSAL = "asked to stand down in this thread \u2014 @mention to pull the agent back in";
+export interface ReplyDecision {
+    readonly deliver: boolean;
+    /** Human-readable rationale (for logs + the test oracle). */
+    readonly reason: string;
+}
+/**
+ * Decide whether a raw non-mention message should be delivered to an engaged thread's session. The ORDER encodes the policy and is fail-safe: every disqualifier is checked before the single `deliver: true`.
+ * Only an engaged, in-thread, human, non-mention, non-subtype message gets through, so the agent follows threads it was invited into and stays out of everything else.
+ */
+export declare function shouldDeliverReply(input: ReplyDeliveryInput): ReplyDecision;
+/** Participation-certainty status for a wake (see the section header). */
+export type ParticipationStatus = "addressed" | "participating" | "uncertain";
+/** The structured wake-envelope signals the classifier reads — all already carried by the wake
+ *  envelope (wake-envelope.ts): the trigger message's `mention` flag + `trust` tier + sender `from`
+ *  kind, and the wake `reason`. No I/O, no engagement-registry read (engagement is folded into the
+ *  `thread-activity` reason, which by definition means an engaged thread). */
+export interface ParticipationSignals {
+    /** The trigger carried an explicit @mention / direct address of the agent. */
+    readonly mention: boolean;
+    readonly reason: WakeReason;
+    /** The trigger author's trust tier (principal/peer/relay/unauth). */
+    readonly trust: WakeTrust;
+    /** The trigger author kind (human/agent/self/system/bot). */
+    readonly senderKind: WakeMessageSender;
+}
+export interface ParticipationDecision {
+    readonly status: ParticipationStatus;
+    /** True iff the status is `uncertain` — the signal to behave conservatively (lean to silence). */
+    readonly conservative: boolean;
+    /** Human-readable rationale (for logs + the test oracle), same shape as {@link ReplyDecision}. */
+    readonly reason: string;
+}
+/**
+ * Classify a wake's participation certainty from its structured envelope signals — pure and deterministic, with no model and no I/O.
+ * ORDER encodes the policy, most-certain first: a direct address or an owed-work reason wins over author trust; an unaddressed post from an unvouched human or a foreign bot is uncertain regardless of the ambient reason; an engaged-thread reply is `participating`, and everything else is `uncertain`.
+ */
+export declare function classifyParticipation(s: ParticipationSignals): ParticipationDecision;
+//# sourceMappingURL=engagement.d.ts.map

package/dist/agent/channels/engagement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engagement.d.ts","sourceRoot":"","sources":["../../../agent/channels/engagement.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAInF,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;wFACwF;AACxF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE5F;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBvH;AAED;sEACsE;AACtE,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAOvG;AAED;6EAC6E;AAC7E,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5F;AAED,wFAAwF;AACxF,wBAAsB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOxF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAMhG;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,SAAS,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAO9G;AAED,yFAAyF;AACzF,wBAAsB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOtF;AAKD,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,qFAAqF;IACrF,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;wFAGwF;AACxF,eAAO,MAAM,2BAA2B,iFAA4E,CAAC;AAErH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAa3E;AAKD,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,eAAe,GAAG,WAAW,CAAC;AAE9E;;;8EAG8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kGAAkG;IAClG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,oBAAoB,GAAG,qBAAqB,CAcpF"}

package/dist/agent/channels/engagement.js

@@ -0,0 +1,182 @@
+// engagement — "reply without re-tagging": a thread is ENGAGED when the agent is @mentioned in it, a later NON-mention reply in that thread is then delivered to the thread's live session, and the thread DISENGAGES when the agent judges it was asked to stop.
+// There is no TTL — being asked back with an @mention is the only way back in. This module is the DURABLE and PURE half, the registry wrappers over the operational store plus the policy predicates, so the wiring that receives raw message events embeds no judgement of its own.
+import { getOperationalStore } from "../operational/provider.js";
+import { domainKeyOf } from "../memory/partition.js";
+// Warm-thread shed threshold: after this many consecutive silent WOKEN turns, a WARM surface — one latched by a name-drop wake that never earned a reply — auto-disengages, so a one-off name-drop does not leave the bot quietly following a thread forever.
+// PARTICIPATING surfaces are EXEMPT: they are sticky, and an explicit stop is their only off-switch. It lives here rather than per surface, so every platform's handler reads ONE constant and the threshold can never drift between them.
+export const WARM_SILENT_LIMIT = 3;
+/**
+ * 🔴 THE AGENT'S OWN POST IS NOT A RE-INVITATION (OPE-1669). The store clears `stopped` on any promotion that carries no already-recorded promoter id, and a posted reply promotes with none — so the acknowledgement `stand_down` asks for was UNDOING the stop it had just recorded, and the next plain thread-follow was admitted at the door as if nothing had happened.
+ * MEASURED on ship #191 (deploy `dpl_EXAMPLE000000000000000000003`): `engagement.stood_down marked:true` at 18:30:09Z on anchor `1788978576.441969`, the acknowledgement posted at 18:30:27Z, and a plain `thread-follow` wake was answered at 18:30:43Z. Zero `reply.forced` rows — the reply plane behaved; the REGISTRY ROW had been un-stopped between the two.
+ * THE RULE, and it is one line: a promotion caused by the agent's own post is DOWNGRADED to a plain refresh while the row is stopped. A plain refresh advances `last_turn_at` and touches nothing else, so the stop survives and the thread stays quiet until a person @mentions the agent back in.
+ * IT COSTS THE PROMOTION NOTHING THAT MATTERS. The only work `participating` does on a stopped row is clear the stop and reset the warm silent streak, and neither has a reader while the thread is stopped: the door drops every non-mention wake, and the revival path promotes with `participating: true` itself.
+ * PURE, so the rule is testable without a store.
+ */
+export function ownPostMustNotRevive(opts, stopped) {
+    return opts?.byOwnPost === true && opts.participating === true && stopped;
+}
+/**
+ * Engage a thread, or refresh its last-turn time. Best-effort: it never blocks a turn.
+ * `opts.participating` PROMOTES the thread to an invited participant and resets its silent streak; the default — a warm-on-wake latch or a plain refresh — never downgrades an already-participating thread. `ownerToken` and `kind` are a pure passthrough, because no routing decision lives here.
+ * `opts.engagedBy` NAMES THE PROMOTING EVENT (OPE-1527, widened by OPE-1562): a promotion repeating ANY id the row still records cannot clear `stopped`. The row keeps a BOUNDED LIST of recent promoters, so a redelivery of a SUPERSEDED promotion is guarded too — only a promotion that the bound has pushed off the list clears again. Pass the platform's own event id on every promotion that a redelivery can repeat; omit it and the clearing rule is exactly what it was.
+ * `opts.byOwnPost` COSTS ONE ROW READ, and only on a promotion that declares itself (OPE-1669). The read is what makes {@link ownPostMustNotRevive} decidable; every other call reaches the store exactly as before. 🔴 The read and the write are not one statement, so a `stand_down` landing BETWEEN them is still lifted — a window of one store round-trip on the agent's own post path, against today's every-post-lifts-it. Closing it needs the rule inside the store's own `markEngaged`, which is a change to both backings.
+ */
+export async function markThreadEngaged(p, threadTs, atIso, opts) {
+    try {
+        // `byOwnPost` is a HOST-SIDE rule, so it is stripped here rather than handed to a store that has
+        // no column for it.
+        const { byOwnPost, ...store } = opts ?? {};
+        // The CHEAP HALF first: the row read is paid only by a promotion that declares itself the
+        // agent's own post, so every other caller reaches the store on exactly today's path.
+        // 🔴 The read is {@link isThreadStopped}, which is FAIL-OPEN: a store error reads as NOT stopped
+        // and the promotion goes through. That is the same direction the rest of this plane takes, and
+        // the cost of the other one would be a thread trapped silent by a hiccup nobody can see.
+        const stopped = byOwnPost === true && store.participating === true ? await isThreadStopped(p, threadTs) : false;
+        // The downgrade drops `engagedBy` with `participating`, because the promoter list only ever
+        // records PROMOTIONS and a refresh is not one.
+        const effective = ownPostMustNotRevive(opts, stopped) ? { ...store, participating: false, engagedBy: undefined } : store;
+        await getOperationalStore().markEngaged(p.org, p.surfaceKey, threadTs, atIso, effective);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] markEngaged failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+    }
+}
+/** The full engagement record for a thread (or null). Fail-soft: a store error reads as
+ *  null — the same fail-closed posture as {@link isThreadEngaged}. */
+export async function getThreadEngagement(p, threadTs) {
+    try {
+        return await getOperationalStore().getEngagement(p.org, p.surfaceKey, threadTs);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] getEngagement failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+        return null;
+    }
+}
+/** Bump a thread's silent-streak counter, returning the new value (0 if no record /
+ *  on error). Best-effort: engagement bookkeeping must never fail a turn. */
+export async function bumpThreadSilentStreak(p, threadTs) {
+    try {
+        return await getOperationalStore().bumpSilentStreak(p.org, p.surfaceKey, threadTs);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] bumpSilentStreak failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+        return 0;
+    }
+}
+/** Drop a thread's engagement (explicit stop). Returns whether a record was removed. */
+export async function disengageThread(p, threadTs) {
+    try {
+        return await getOperationalStore().disengage(p.org, p.surfaceKey, threadTs);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] disengage failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+        return false;
+    }
+}
+/**
+ * Mark a thread STOPPED without deleting its engagement row. On the WINDOW path a stop cannot disengage by delete: the wake gate never reads engagement there, so a deleted row suppresses nothing and a post-stop follow-up would still wake the supervisor. The durable `stopped` flag IS the suppression signal instead.
+ * Best-effort — a store error reads as false, with no marker written — and cleared by a re-invitation.
+ */
+export async function markThreadStopped(p, threadTs) {
+    try {
+        return await getOperationalStore().markStopped(p.org, p.surfaceKey, threadTs);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] markStopped failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+        return false;
+    }
+}
+/**
+ * Is this thread's durable STOOD-DOWN flag set RIGHT NOW? The read the reply path makes per post (OPE-1520): the flag was previously read only at wake time, so a stand-down stored MID-TURN said nothing to the turn that was already running and the seat kept posting after acknowledging the stop.
+ * 🔴 FAIL-OPEN, the opposite direction to {@link isThreadEngaged}, and the difference is deliberate. That predicate decides whether to BARGE IN, where "unknown" must mean stay out. This one decides whether to SILENCE an answer the model has already written, where "unknown" must mean deliver — a store hiccup that swallowed replies would be a far worse failure than one that posts a message into a conversation the agent was asked to leave.
+ * `anchor` is the ENGAGEMENT-REGISTRY key, the one `tools/stand_down.ts` writes the flag at — pass the caller's own `binding.engagementKey ?? binding.threadTs`, never a reply target. Absent reads as NOT stopped: a turn with no anchor holds no row to have been marked.
+ */
+export async function isThreadStopped(p, anchor) {
+    if (anchor === undefined || anchor.length === 0)
+        return false;
+    // {@link getThreadEngagement} already reads null on a store error, which IS the fail-open answer
+    // here — so this reads the row through it rather than repeating the catch and risking a copy that
+    // fails in the other direction.
+    return (await getThreadEngagement(p, anchor))?.stopped === true;
+}
+/**
+ * The ROOM-GRAIN engagement row's address for a partition — the row an UNDIRECTED room wake stores itself at, and the row a stop from such a wake lands on (OPE-1511).
+ *
+ * 🔴 WHY A SECOND GRAIN EXISTS AT ALL. The ordinary engagement row is keyed per CONVERSATION (a Slack thread, a Teams reply chain), because that is the container an @mention engages. A surface whose wake gate watches the whole ROOM — Teams' single-window Leg A — wakes on messages in conversations no @mention ever touched, so no conversation row exists for a stop to mark, and `stand_down` refuses on a wake it can plainly see. The standing rule is that a stored stop exists exactly where a stored wake exists, so the room wake stores a room row and the stop marks that one.
+ *
+ * The address is the DOMAIN grain (`partition.domainKey`) and the anchor is its last segment.
+ *
+ * 🔴 IT IS ALWAYS A SEPARATE ROW FROM THE CONVERSATION'S, INCLUDING WHERE THE TWO GRAINS COINCIDE, and reading it any other way will mislead you about where a stop landed. The anchor here is a `seg()`-SANITISED key segment; the conversation row's anchor is `binding.engagementKey`, deliberately RAW so it matches the platform's own ingress byte for byte. A Teams message at a channel root has `conversation.id === channelId` and therefore one surface key — and still two rows, `19-abc-thread.tacv2` and `19:abc@thread.tacv2`, because the two anchors spell that id differently. Nothing breaks: the room row's writer and reader both come through this function, and the conversation row's writer and reader both use the raw key. They are two registries that never consult each other.
+ *
+ * PURE: it derives an address and reads nothing. A partition whose domain key carries no third segment — a synthetic control or routine partition, never a chat surface — falls back to the partition's own surface for the anchor. Both callers derive through this one function, so the pair stays internally consistent whatever it returns.
+ */
+export function roomEngagementAddress(p) {
+    const roomKey = domainKeyOf(p);
+    const segs = roomKey.split("/");
+    return {
+        partition: { ...p, surface: segs[2] ?? p.surface, surfaceKey: roomKey, key: roomKey, domainKey: roomKey },
+        anchor: segs[2] ?? p.surface,
+    };
+}
+/** Is this thread currently engaged? Fail-closed: a store error reads as NOT engaged. */
+export async function isThreadEngaged(p, threadTs) {
+    try {
+        return (await getOperationalStore().getEngagement(p.org, p.surfaceKey, threadTs)) !== null;
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:engagement] getEngagement failed (${p.surfaceKey}/${threadTs}): ${String(err)}`);
+        return false; // unknown → don't barge in
+    }
+}
+/** The {@link ReplyDecision.reason} a STOOD-DOWN thread's dropped delivery carries. Exported so a
+ *  surface can tell THIS refusal apart from every other disqualifier and write its own drop row
+ *  (OPE-1669) — matching the returned text against a copy of the wording would drift the day the
+ *  copy is reworded, and the drop would then go silent again with no test to notice. */
+export const STAND_DOWN_DELIVERY_REFUSAL = "asked to stand down in this thread — @mention to pull the agent back in";
+/**
+ * Decide whether a raw non-mention message should be delivered to an engaged thread's session. The ORDER encodes the policy and is fail-safe: every disqualifier is checked before the single `deliver: true`.
+ * Only an engaged, in-thread, human, non-mention, non-subtype message gets through, so the agent follows threads it was invited into and stays out of everything else.
+ */
+export function shouldDeliverReply(input) {
+    if (input.subtype && input.subtype !== "message_changed") {
+        return { deliver: false, reason: `message subtype "${input.subtype}" — not a plain reply` };
+    }
+    if (input.authorIsBot)
+        return { deliver: false, reason: "author is a bot — would self-trigger" };
+    if (input.isAppMention)
+        return { deliver: false, reason: "app_mention — handled by the mention path" };
+    if (!input.inThread)
+        return { deliver: false, reason: "not a thread reply — engagement is per-thread" };
+    if (!input.isEngaged)
+        return { deliver: false, reason: "thread is not engaged — only @mention/DM starts engagement" };
+    // LAST disqualifier before the single `deliver: true`, deliberately after `isEngaged`: a stood-down
+    // thread is still ENGAGED (the row survives, which is what lets the marker be read at all), so
+    // this cannot be folded into the engagement check.
+    if (input.stopped)
+        return { deliver: false, reason: STAND_DOWN_DELIVERY_REFUSAL };
+    return { deliver: true, reason: "engaged thread, human reply — deliver to the live session" };
+}
+/**
+ * Classify a wake's participation certainty from its structured envelope signals — pure and deterministic, with no model and no I/O.
+ * ORDER encodes the policy, most-certain first: a direct address or an owed-work reason wins over author trust; an unaddressed post from an unvouched human or a foreign bot is uncertain regardless of the ambient reason; an engaged-thread reply is `participating`, and everything else is `uncertain`.
+ */
+export function classifyParticipation(s) {
+    if (s.mention)
+        return { status: "addressed", conservative: false, reason: "directly @mentioned/addressed" };
+    if (s.reason === "dm")
+        return { status: "addressed", conservative: false, reason: "direct message" };
+    if (s.reason === "dispatch" || s.reason === "spawn") {
+        return { status: "addressed", conservative: false, reason: `harness/agent handed this session owed work (${s.reason})` };
+    }
+    // Unaddressed post from a foreign bot or an unvouched (unauth) human is never a participation
+    // obligation — the doc's other-assistant / unauth reference-only postures.
+    if (s.senderKind === "bot")
+        return { status: "uncertain", conservative: true, reason: "foreign-bot post, not addressed to you" };
+    if (s.trust === "unauth")
+        return { status: "uncertain", conservative: true, reason: "unvouched (unauth) author, not addressed to you" };
+    if (s.reason === "thread-activity") {
+        return { status: "participating", conservative: false, reason: "reply in a thread you are engaged in" };
+    }
+    return { status: "uncertain", conservative: true, reason: `ambient ${s.reason} with no direct address` };
+}
+//# sourceMappingURL=engagement.js.map