@open-everywhere/core 0.1.0

package/dist/agent/channels/halt-per-wake.js

@@ -0,0 +1,148 @@
+// halt-per-wake — WHICH ROOMS OF A COALESCED TURN THE PAUSE ACTUALLY COVERS (OPE-1759).
+//
+// THE DEFECT, in one sentence: `haltScopeForCtx` (access/halt.ts) resolves ONE address from the
+// turn's ctx, a turn that merged queued deliveries carries only the LAST delivery's auth, and the
+// seat paragraph is rendered once per turn — so a turn answering two rooms reads ONE room's halt and
+// states it in BOTH. On soak-2026-09-12-a the seat told a room nobody had stopped that everything was
+// paused, and the soak's own cross-room checker could not see it: that checker matches PLANTED
+// MARKERS and a halt claim carries none, which is why 27 replies looked clean.
+//
+// 🔴 THE MERGE THAT PRODUCES THAT TURN IS UNREACHABLE TODAY, AND THIS CODE STAYS ANYWAY (OPE-2041).
+// eve 0.52.5 narrowed its ADJACENT-QUEUED batching rule to "Only batch adjacent queued deliveries
+// when their full auth contexts match", enforced by `jsonValuesEqual(c.auth, t.auth)` in
+// `takeBufferedTurnDelivery`. OE stamps `oe_wake_id` and a per-delivery `oe_delivery_id` into
+// `auth.attributes`, so two AUTH-CARRYING deliveries on one unified window never compare equal and
+// eve never folds them. The OPE-1759 measurement was taken on eve 0.39.0, before the rule existed.
+// (eve's OTHER merge arm — a task COMPLETION COHORT — still fires, and is not this defect: those
+// deliveries carry no `auth`, so no room's halt address can displace another's.) What follows is a
+// DEFENSIVE GUARD, not a live fix: it is correct either way, and it is the right shape the day eve
+// batches authenticated deliveries again.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the impossibility offline.
+//
+// 🔴 WHY THIS IS A READ AND NOT A NEW ENFORCEMENT. A halted seat is already refused at every arrow,
+// per act, and this module changes none of that. What bled was the SENTENCE — and a sentence the room
+// reads is the whole of what a person has to go on, so a false one costs more than a refused call: it
+// tells a room its work has stopped when it has not, and the seat then declines work it could do.
+// (OPE-1758 recorded the same class from the other direction: a paragraph that over-claimed what the
+// pause reached made a seat refuse a read-only question it could have answered.)
+//
+// 🔴 IT NAMES NO ROOM, AND THAT IS DELIBERATE. The seat paragraph is PRODUCT COPY — it carries no
+// scope key, no level and no principal id (access/halt.ts `haltWidthClause`). A per-room render that
+// listed the paused conversations would publish this plane's address vocabulary into a room, which is
+// the rule that paragraph already holds. So the correction is to the CLAIM's reach, not to its
+// detail: a turn whose rooms disagree says the pause is partial and that it must be checked per room,
+// rather than asserting it everywhere.
+//
+// FAIL-SOFT ON EVERY UNKNOWN, in the SAME direction the single-address read already fails: an
+// unreadable store answers halted, so the degrade is the turn-wide paragraph it rendered before this
+// module existed — never a silently dropped pause.
+import { haltScopeFor, resolveHalt } from "../access/halt.js";
+import { resolveOwnWindowToken } from "../access/delegation-mount.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { wakeSurfaceKeyFromTargetJson, WAKE_TARGET_TTL_MS } from "./unified-window.js";
+/** How many pending wakes one paragraph render will read. A "room" here is a conversation this seat
+ *  holds an UNANSWERED inbound wake in, which is what `listPendingUnifiedWakes` measures — a wider set
+ *  than the rooms one turn answers, and the copy below says so rather than rounding it down. A standing seat holding more conversations
+ *  than this is already past what one turn can answer; the cap bounds the store read, and reading a
+ *  prefix can only ever find FEWER disagreeing rooms — the direction that degrades to the turn-wide
+ *  paragraph rather than inventing a partial one. */
+const MAX_ROOMS_READ = 20;
+/**
+ * The halt reach across every conversation THIS turn holds an unanswered wake in.
+ *
+ * `turnState` is the caller's own single-address read (`resolveHalt(haltScopeForCtx(ctx))`) — the
+ * answer for the delivery whose auth the turn happens to carry. It is the floor here, never
+ * discarded: a turn with exactly one room, a turn whose window token cannot be read, and a turn whose
+ * wake rows predate the stored surface key all answer from it alone, which is byte-identical to the
+ * behaviour before this module existed.
+ *
+ * Never throws.
+ */
+export async function resolveTurnHaltReach(ctx, turnState, org, deps = {}) {
+    const floor = turnState.halted ? { kind: "all", state: turnState } : { kind: "none" };
+    try {
+        const windowToken = resolveOwnWindowToken(ctx);
+        if (windowToken === undefined)
+            return floor;
+        // The SAME pending-wake read the reply-freshness gate takes, bounded by the wake map's own TTL:
+        // a wake older than the map cannot be answered anyway, so counting it as a room would let an
+        // expired conversation decide what this turn says about the pause.
+        const afterIso = new Date(Date.now() - WAKE_TARGET_TTL_MS).toISOString();
+        let rows;
+        try {
+            const list = deps.pendingWakes ?? ((o, t, a, l) => getOperationalStore().listPendingUnifiedWakes(o, t, a, l));
+            rows = await list(org, windowToken, afterIso, MAX_ROOMS_READ);
+        }
+        catch {
+            return floor; // store unavailable ⇒ the turn-wide answer, which is what shipped
+        }
+        // ONE ENTRY PER SURFACE, not per wake: two wakes in one room are one room, and counting them
+        // twice would report a turn as "partial" because one room answered itself.
+        const surfaceKeys = new Set();
+        for (const row of rows) {
+            const key = wakeSurfaceKeyFromTargetJson(row.targetJson);
+            if (key !== undefined)
+                surfaceKeys.add(key);
+        }
+        if (surfaceKeys.size <= 1)
+            return floor; // one room (or none nameable) ⇒ nothing to disagree about
+        // 🔴 ONE ROWS READ FOR THE WHOLE RENDER. `resolveHalt` pages the org's active halts itself and
+        // caches nothing, so asking it per room cost up to twenty queries on the SEAT PROMPT, which is
+        // rendered every turn. The rows are read once here and handed to every per-room decision, which
+        // also makes the twenty readings consistent with each other by construction.
+        let rowsOnce = deps.rows;
+        if (rowsOnce === undefined) {
+            try {
+                const active = await getOperationalStore().activeHalts(org);
+                rowsOnce = async () => active;
+            }
+            catch {
+                return floor; // unreadable halts ⇒ the turn-wide paragraph, which is the fail-closed answer
+            }
+        }
+        let halted = 0;
+        let covering = turnState.halted ? turnState : undefined;
+        for (const surfaceKey of surfaceKeys) {
+            const state = await resolveHalt(haltScopeFor({ org, scopeKey: surfaceKey }), { rows: rowsOnce }).catch(() => ({ halted: true, unreadable: "the halt state could not be read" }));
+            if (state.halted) {
+                halted++;
+                covering ??= state;
+            }
+        }
+        // 🔴 NO ROOM COVERED ⇒ THE FLOOR, NEVER SILENCE. This returned `{ kind: "none" }` and that was a
+        // FAIL-OPEN: the per-room reads key on a surface key alone, while `haltScopeForCtx` also composes
+        // the PERSON axis from the turn's principal — so a `level: "user"` halt, or a surface halt on a
+        // room with no pending wake row, is covered by the turn's own read and by none of these. Dropping
+        // the paragraph there would take a live pause off the seat prompt entirely, which is the one
+        // direction this module must never move. The floor is the single-address answer, unchanged.
+        if (halted === 0)
+            return floor;
+        if (covering === undefined)
+            return floor; // unreachable in practice; never guess a row
+        if (halted === surfaceKeys.size)
+            return { kind: "all", state: covering };
+        return { kind: "partial", state: covering, haltedRooms: halted, totalRooms: surfaceKeys.size };
+    }
+    catch {
+        return floor;
+    }
+}
+/**
+ * The one sentence a PARTIAL reach adds in front of the standing halt paragraph.
+ *
+ * 🔴 IT IS THE WHOLE OF THE FIX THE ROOM CAN SEE, so it has to be actionable rather than merely
+ * hedged: it tells the seat that the pause does not cover every conversation in front of it, and that
+ * a room it was not asked about must not be told it is paused. It names NO room and NO scope key —
+ * the same product-copy rule the paragraph itself holds — because what the seat needs is not this
+ * plane's addresses but the knowledge that the claim is not turn-wide.
+ */
+export function partialHaltPrefix(reach) {
+    if (reach.kind !== "partial")
+        return null;
+    return (`**This pause does NOT cover every conversation you are holding open** — it covers ` +
+        `${reach.haltedRooms} of the ${reach.totalRooms} with an unanswered message. So do not tell a room ` +
+        `that work is paused unless the pause reaches that room: saying it where it is untrue stops work ` +
+        `nobody stopped. The refusals themselves are decided per act, so a conversation the pause does not ` +
+        `reach keeps working normally and you will not be refused in it.`);
+}
+//# sourceMappingURL=halt-per-wake.js.map

package/dist/agent/channels/halt-per-wake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt-per-wake.js","sourceRoot":"","sources":["../../../agent/channels/halt-per-wake.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAC/F,+EAA+E;AAC/E,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,yFAAyF;AACzF,8FAA8F;AAC9F,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,0CAA0C;AAC1C,wFAAwF;AACxF,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,kGAAkG;AAClG,qGAAqG;AACrG,iFAAiF;AACjF,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAC/F,sGAAsG;AACtG,uCAAuC;AACvC,EAAE;AACF,8FAA8F;AAC9F,qGAAqG;AACrG,mDAAmD;AAGnD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiC,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEvF;;;;;qDAKqD;AACrD,MAAM,cAAc,GAAG,EAAE,CAAC;AAqB1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB,EAAE,SAAoB,EAAE,GAAW,EAAE,IAAI,GAAsB,EAAE;IAC9H,MAAM,KAAK,GAAkB,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrG,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,gGAAgG;QAChG,6FAA6F;QAC7F,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE,IAAI,IAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9I,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,kEAAkE;QAClF,CAAC;QACD,6FAA6F;QAC7F,2EAA2E;QAC3E,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,4BAA4B,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACzD,IAAI,GAAG,KAAK,SAAS;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,0DAA0D;QACnG,+FAA+F;QAC/F,+FAA+F;QAC/F,gGAAgG;QAChG,6EAA6E;QAC7E,IAAI,QAAQ,GAAiC,IAAI,CAAC,IAAI,CAAC;QACvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC5D,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,CAAC,8EAA8E;YAC9F,CAAC;QACH,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,QAAQ,GAA0B,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CACpG,GAAc,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,kCAAkC,EAAE,CAAC,CACpF,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,EAAE,CAAC;gBACT,QAAQ,KAAK,KAAK,CAAC;YACrB,CAAC;QACH,CAAC;QACD,iGAAiG;QACjG,kGAAkG;QAClG,gGAAgG;QAChG,kGAAkG;QAClG,6FAA6F;QAC7F,4FAA4F;QAC5F,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,6CAA6C;QACvF,IAAI,MAAM,KAAK,WAAW,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,CACL,oFAAoF;QACpF,GAAG,KAAK,CAAC,WAAW,WAAW,KAAK,CAAC,UAAU,qDAAqD;QACpG,kGAAkG;QAClG,oGAAoG;QACpG,iEAAiE,CAClE,CAAC;AACJ,CAAC"}

package/dist/agent/channels/memory-claim-guard.d.ts

@@ -0,0 +1,77 @@
+import type { ReplyAudit } from "./reply-post.js";
+/** The audit action one withheld durability claim writes. Ids, counts and the claim's SHAPE — never
+ *  the sentence, which is model text that may quote ingested content. */
+export declare const MEMORY_CLAIM_WITHHELD_ACTION = "memory.claim_withheld";
+/** The line the host puts in a struck claim's place. Host-voiced, plain text on purpose: it renders
+ *  the same on Slack, Discord, Teams, Notion, Linear and GitHub, like the provenance footer.
+ *
+ *  🔴 IT CLAIMS NOTHING ABOUT THE FUTURE, and that is deliberate. A seat's own sandbox edit persists
+ *  at `turn.completed`, seconds after this line is posted — so "not saved" would be true when the
+ *  room read it and false a moment later, with no later message to correct it. What the host can
+ *  stand behind for ever is what it observed at post time: no durable write is recorded FOR THIS
+ *  TURN. */
+export declare const WITHHELD_CLAIM_NOTE = "(No durable memory write is recorded for this turn, so I cannot say the note is stored.)";
+/** WHICH shape of claim was struck. A closed set, so the audit row can be counted and joined without
+ *  ever carrying the sentence itself. */
+export type MemoryClaimShape = "stored" | "remembered" | "index-updated";
+/** One claim the detector found, as a SENTENCE INDEX and a shape — never the text. */
+export interface MemoryClaim {
+    readonly shape: MemoryClaimShape;
+    /** Which sentence of the reply it was, zero-based. Lets an operator find it in the posted body
+     *  without the row carrying a copy. */
+    readonly sentence: number;
+}
+/** Split a reply into sentences for a claim detector.
+ *
+ *  Crude on purpose: `.`, `!`, `?` and a newline end a sentence, and nothing else does. A detector
+ *  that tried to be clever about abbreviations would differ from what a reader sees, and the unit
+ *  the guard strikes must be the unit a reader reads. An over-long "sentence" costs a longer strike;
+ *  it never costs a missed claim, because every pattern is anchored inside one segment anyway.
+ *
+ *  🔴 EXPORTED FOR `channels/approval-claim-guard.ts`, WHICH STRIKES AT THE SAME CHOKE POINT
+ *  (OPE-1876). Two guards that disagreed about where a sentence ends would strike overlapping spans
+ *  on one body and leave a reader a half-sentence. One definition is what stops that, so this splits
+ *  every claim guard's sentences and neither guard keeps a copy. */
+export declare function replySentences(text: string): readonly {
+    readonly text: string;
+    readonly start: number;
+    readonly end: number;
+}[];
+/**
+ * Every completed-durability claim in one reply — PURE, so the patterns are testable over fixture
+ * text with no eve context, no audit store and no reply.
+ */
+export declare function detectDurabilityClaims(text: string): readonly MemoryClaim[];
+/** What the guard did to one reply. */
+export interface MemoryClaimGuardResult {
+    /** The body to post. BYTE-IDENTICAL to the input whenever nothing was struck and the input carried
+     *  no earlier copy of {@link WITHHELD_CLAIM_NOTE} — which is every ordinary reply. */
+    readonly body: string;
+    /** The claims struck, empty when the reply kept its text. */
+    readonly withheld: readonly MemoryClaim[];
+}
+/**
+ * Strike every unbacked durability claim from one reply — PURE, given the evidence verdict.
+ *
+ * `stored` is the host's own answer to "did a fact reach a silo this turn". `true` returns the text
+ * untouched: the claim is backed, so the reader may have it.
+ */
+export declare function applyMemoryClaimGuard(text: string, stored: boolean): MemoryClaimGuardResult;
+/**
+ * Write the durable row for one withheld claim — best-effort, never throws, never fails the reply.
+ *
+ * 🔴 THE ROW NAMES THE CLAIM BY SHAPE AND POSITION, NEVER BY TEXT. The struck sentence is model
+ * output that can quote ingested content, and this plane's rows carry ids and counts only. A reader
+ * who needs the sentence has the posted body, where the note says one was struck.
+ */
+export declare function auditWithheldMemoryClaim(audit: ReplyAudit | undefined, platform: string, withheld: readonly MemoryClaim[]): Promise<void>;
+/**
+ * The whole per-reply step, in one call every choke point makes: read this turn's write evidence,
+ * strike what it cannot back, and hand back the body plus the claims to audit.
+ *
+ * ONE function because the four reply doors DRIFTED before over exactly this kind of shared step
+ * (`reply-provenance.ts` `applyReplyProvenance` says the same of itself): a door that struck a
+ * fabricated claim and a door that posted it would make the guard look like a rendering glitch.
+ */
+export declare function guardMemoryClaims(text: string, audit: ReplyAudit | undefined): MemoryClaimGuardResult;
+//# sourceMappingURL=memory-claim-guard.d.ts.map

package/dist/agent/channels/memory-claim-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-claim-guard.d.ts","sourceRoot":"","sources":["../../../agent/channels/memory-claim-guard.ts"],"names":[],"mappings":"AAgFA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;yEACyE;AACzE,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAEpE;;;;;;;YAOY;AACZ,eAAO,MAAM,mBAAmB,6FAC4D,CAAC;AAE7F;yCACyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,YAAY,GAAG,eAAe,CAAC;AAEzE,sFAAsF;AACtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC;2CACuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA8KD;;;;;;;;;;oEAUoE;AACpE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,CAkB/H;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAyB3E;AAED,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACrC;0FACsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,sBAAsB,CAuB3F;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,UAAU,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,sBAAsB,CAErG"}

package/dist/agent/channels/memory-claim-guard.js

@@ -0,0 +1,389 @@
+// THE DURABILITY-CLAIM GUARD (OPE-1873) — A REPLY MAY NOT SAY A FACT WAS STORED UNLESS THE HOST
+// STORED IT.
+//
+// WHAT WAS MEASURED. Ship #213 and ship #214, the same gate on the same leg: S-MEM-READ's seed turn
+// asked the seat to remember a canary, the seat answered "Recorded and verified for the team: the
+// OPE121 canary code is *obsidian-30653*. The durable note and curated memory index were updated",
+// and the audit held ZERO `memory.write` rows for that turn. On #214 J2 took the identical shape.
+// Two ships, two legs, one sentence that was not true.
+//
+// THE PROMPT ALREADY FORBIDS IT, AND THAT IS THE POINT. `instructions/seat-prompt.ts`'s honest-ack
+// rule (OPE-1688, OPE-1692) says it in the model's own terms — "A fact is stored when the file edit
+// happened … Name the thing that now exists". It was written after ships #193 and #194 measured the
+// same defect on J2. It did not hold. A rule a model must remember is not a control, the same way
+// `reply-provenance.ts`'s reserved footer marker is a control and asking the model not to type one
+// would not be. So the HOST decides this at the choke point, out of its own observation.
+//
+// ── WHAT COUNTS AS EVIDENCE ─────────────────────────────────────────────────────────────────────
+// A landed `memory.write` for THIS turn, recorded by the one write road
+// (`memory/write-road.ts` → `memory/write-evidence.ts`). Nothing else: not a tool the model says it
+// called, not a file it says it edited, not an operational write to the status board.
+//
+// 🔴 A DELEGATED WRITE IS EVIDENCE, AND IT IS THE ORDINARY CASE. A conversational seat delegates the
+// write; the worker edits the shared tree; `hooks/spawn-taint.ts` flushes at the settlement edge,
+// INSIDE the turn and before the seat composes its answer. So an honest delegated ack keeps its
+// sentence, byte for byte.
+//
+// 🔴 A SEAT'S OWN SANDBOX EDIT IS EVIDENCE WHEN A MEMBER ASKED FOR IT, AND NOT OTHERWISE (OPE-1915).
+// An explicit remember-ask arms `memory/write-intent.ts`, and `hooks/memory.ts`
+// `flushWriteIntentMemory` runs the `session-persist` road at both `reply` tool variants, its only
+// callers, before the post. So the row exists by the time this module reads the ledger, and the ack
+// keeps its sentence. On EITHER seat shape a delegated ask's settlement answer leaves by one of
+// those two doors (OPE-2013). Two terminal-prose planes used to deliver an answer past them, and both
+// are deleted: the addressed-mention bridge in `channels/unified.ts` (OPE-1982), and
+// `postTerminalProse` (OPE-2006), so a per-surface turn's closing prose is now dropped and audited.
+// An edit nobody asked for still persists at `turn.completed`, after the reply has left, and a seat
+// claiming completed durable storage before that persist has run is claiming something that has not
+// happened — the exact defect, not a false positive against it. The honest sentence is still
+// available: say what was written down, and that the save completes with the turn.
+//
+// ── WHAT THE GUARD DOES TO AN UNBACKED CLAIM, AND WHAT IT DOES NOT SEE ──────────────────────────
+// It STRIKES the claiming SENTENCE and appends one host-voiced line in its place. It does not
+// rewrite the answer, drop the useful content, or fail the reply: every sentence that is not itself
+// a claim goes out unchanged. A reader then sees the fact the turn produced and an honest note that
+// the durable save is not recorded — which is strictly more than the fabrication told them.
+//
+// 🔴 WHAT IS ENFORCED IS A SET OF KNOWN CLAIM SHAPES, NOT THE WHOLE CLASS, and the difference is
+// worth stating plainly because the protection is only as wide as {@link CLAIM_PATTERNS}. Six
+// shapes are struck today: a completed storage verb beside a durable-store noun, the same pair in
+// the mirror order, "have remembered", a claim about the curated memory index, a present-location
+// claim ("it's now in durable notes"), and a reply that OPENS with a storage verb. A sentence that
+// claims durability in some other wording — an emoji, a paraphrase nobody has written yet — posts.
+// The tests carry the measured fabrication verbatim, so a shape that ships is a shape a test can be
+// given; nothing here claims the list is closed. Ship #216 proved that the hard way: it posted "It's
+// now in durable notes and the curated memory index" — no storage verb anywhere in it — and the
+// first five shapes all walked past, so the guard's own denial posted BESIDE the standing claim.
+//
+// 🔴 AND IT STRIKES BY SENTENCE, so a sentence carrying BOTH a claim and an answer loses the answer
+// too. {@link ACK_BEFORE} exists because the commonest such shape — "the code is X, recorded in the
+// team memory file" — was struck whole in review, which would have deleted the very fact a recall
+// turn was asked for.
+//
+// 🔴 THE DIRECTION IS ONE DIRECTION. This module can strike a claim that was true (a write the host
+// did not observe); it can never let through a claim the host has no write for. A withheld true
+// claim costs one sentence. An allowed false one costs the reader's trust in every ack the
+// deployment will ever make, which is the asymmetry `reply-provenance.ts` states for its own ledger.
+//
+// 🔴 A CROSS-TURN `edit_reply` READS EMPTY, AND THE CLAIM IS THEN STRUCK. The ledger is
+// turn-stamped, so an edit made on a LATER turn holds none of the original turn's write evidence and
+// this guard strikes a claim the first post was entitled to. It is the same bound
+// `reply-provenance.ts` states for its own ledger — an edit drops the footer the original post
+// earned — and it falls the same way: the edited message says the save is not recorded rather than
+// asserting one the editing turn cannot see. Closing it needs a durable per-message record of what
+// the posting turn held, which nothing keeps today.
+//
+// FAIL-SOFT. A text with no claim in it comes back BYTE-IDENTICAL, which is every ordinary reply.
+// Outside an eve context the ledger answers "nothing observed", so a claim is struck rather than
+// allowed — the under-claiming direction again.
+import { appendAudit } from "../audit/audit.js";
+import { factStoredThisTurn } from "../memory/write-evidence.js";
+/** The audit action one withheld durability claim writes. Ids, counts and the claim's SHAPE — never
+ *  the sentence, which is model text that may quote ingested content. */
+export const MEMORY_CLAIM_WITHHELD_ACTION = "memory.claim_withheld";
+/** The line the host puts in a struck claim's place. Host-voiced, plain text on purpose: it renders
+ *  the same on Slack, Discord, Teams, Notion, Linear and GitHub, like the provenance footer.
+ *
+ *  🔴 IT CLAIMS NOTHING ABOUT THE FUTURE, and that is deliberate. A seat's own sandbox edit persists
+ *  at `turn.completed`, seconds after this line is posted — so "not saved" would be true when the
+ *  room read it and false a moment later, with no later message to correct it. What the host can
+ *  stand behind for ever is what it observed at post time: no durable write is recorded FOR THIS
+ *  TURN. */
+export const WITHHELD_CLAIM_NOTE = "(No durable memory write is recorded for this turn, so I cannot say the note is stored.)";
+/**
+ * The claim patterns, in the order they are tested.
+ *
+ * 🔴 MOST NEED A COMPLETED-STORAGE VERB AND A DURABLE-STORE NOUN IN THE SAME SENTENCE, and that
+ * conjunction is what keeps the detector off ordinary prose. "I remember you asked about this"
+ * carries the verb and no store. "Your notes file is in the team silo" carries the store and no
+ * completed verb. Neither is a claim that THIS turn stored something, and neither matches. The one
+ * exception is {@link BARE_ACK_PATTERN} below, which needs no noun and pays for that with a narrow
+ * anchor and its own carve-out.
+ *
+ * FUTURE, CONDITIONAL AND NEGATED FORMS ARE DELIBERATELY OUT. {@link MODAL_BEFORE},
+ * {@link MODAL_IN_SPAN} and {@link NEGATION_BEFORE} keep them out. "I'll save this", "the memory
+ * index will be refreshed tonight", "I'm writing it down now" and "nothing is stored in memory yet"
+ * are all honest sentences — two of them are exactly what the seat prompt asks for on the turn this
+ * guard would otherwise have nothing to offer. Striking them would leave a seat no true thing to
+ * say, which is how a guard teaches a model to say nothing at all.
+ */
+const CLAIM_PATTERNS = [
+    // "the durable note … was updated", "saved to memory", "stored in the team silo", "written to the
+    // memory file". The verb is past or present-perfect; the store noun is one of ours.
+    {
+        shape: "stored",
+        re: /\b(?:saved|stored|written|recorded|persisted|committed)\b[^.!?\n]*\b(?:memory|silo|durable|notes?\s+file|memory\s+file)\b/i,
+    },
+    // The mirror order: "memory updated", "the durable note was updated", "silo now holds".
+    // 🔴 `notes?` IS PLURAL-TOLERANT, and the singular spelling was a measured miss: ship #216 posted
+    // "durable notes" and this pattern's `durable\s+note\b` did not reach it.
+    {
+        shape: "stored",
+        re: /\b(?:memory|silo|durable\s+notes?|memory\s+file|notes?\s+file)\b[^.!?\n]*\b(?:was|were|is|are|has been|have been|now)\b[^.!?\n]*\b(?:saved|stored|written|recorded|persisted|updated|committed)\b/i,
+    },
+    // "I've remembered that", "this is now remembered for the team" — the verb IS the store.
+    { shape: "remembered", re: /\b(?:have|has|i've|we've)\s+(?:now\s+)?remembered\b|\bis\s+now\s+remembered\b/i },
+    // The second half of the measured sentence: the curated index. It names a host artefact, so the
+    // noun alone is specific enough — no ordinary reply says this by accident.
+    { shape: "index-updated", re: /\b(?:curated\s+)?memory\s+index\b[^.!?\n]*\b(?:updated|refreshed|rebuilt|written)\b/i },
+    // 🔴 THE PRESENT-LOCATION CLAIM, and it exists because ship #216 posted one the four patterns above
+    // all walk past: "It's now in durable notes and the curated memory index." There is no storage VERB
+    // in it at all — the claim is carried by "is now in" plus the store, so the verb-bearing shapes
+    // cannot reach it. The guard appended its denial and left the claim standing beside it, which is
+    // the contradiction OPE-1912 measured.
+    //
+    // 🔴 `now` IS REQUIRED, AND IT IS WHAT KEEPS A STANDING DESCRIPTION OUT. "Your notes file is in the
+    // team silo" says where memory lives and claims no write; "it's NOW in durable notes" says this
+    // turn put it there.
+    //
+    // 🔴 IT TAKES {@link TRAILING_CLAUSE} AND {@link CITATION_IN_SENTENCE} AS CARVE-OUTS, because
+    // without them it is an ANSWER SHREDDER — the exact failure {@link ACK_BEFORE} exists to stop on
+    // pattern 1. "The OPE121 canary code is obsidian-30653, and it's now in memory." carries the fact a
+    // recall turn was asked for AND a claim about it; the strike is by sentence, so striking it deletes
+    // the canary. A claim JOINED to earlier content by a comma or a semicolon is a trailing clause on a
+    // stated fact, and it stands. The measured ship #216 sentence opens its own sentence, so it is
+    // struck, and so is a bare "The note is now in durable notes."
+    //
+    // 🔴 THE WINDOW IS SHORT AND COMMA-FREE, WHICH IS THE ONLY THING HOLDING THIS SHAPE TO ONE CLAUSE.
+    // Unlike the four above, this pattern has no verb to anchor on, so a roomy span drifts: with
+    // `[^.!?\n]{0,20}` it read "the thread is now in the channel, so the memory index will pick it up"
+    // as a claim — the preposition belonged to `channel` and the store noun belonged to the next clause.
+    // A comma ends a clause, and twelve characters is room for one adjective ("curated ", "shared ")
+    // and no more. The named articles are a separate group so they do not spend that budget.
+    {
+        shape: "stored",
+        re: /\b(?:is|are|it's|that's|they're|we're)\s+now\s+(?:in|inside|within|part\s+of)\s+(?:the\s+|your\s+|our\s+|my\s+|team\s+)*[^.!?\n,]{0,12}?\b(?:durable\s+notes?|memory\s+index|memory\s+file|notes?\s+file|memory|silo)\b/i,
+    },
+    // 🔴 THE BARE ACK, and it exists because the FIRST half of the measured fabrication has no store
+    // noun at all: "Recorded and verified for the team: the OPE121 canary code is *obsidian-30653*."
+    // A reply that OPENS with a storage verb is acking the ask, and on a turn with no write that ack
+    // is the fabrication. See {@link EXTERNAL_DESTINATION} for the one thing that takes it back out.
+    // `noted` is NOT in the verb set: `instructions/seat-prompt.ts` offers "Noted — tonight's on-call
+    // handle is ONCALL-6225, from Ana" as the model answer, so striking it would put this module and
+    // the prompt in direct contradiction.
+    { shape: "stored", re: /^[\s*_>\-#]*(?:recorded|saved|stored|persisted)\b/i },
+];
+/** The bare-ack pattern, named so the header can point at it. */
+const BARE_ACK_PATTERN = CLAIM_PATTERNS[CLAIM_PATTERNS.length - 1];
+/** The PRESENT-LOCATION pattern — the only one with no storage verb in it, which is why it alone
+ *  takes {@link TRAILING_CLAUSE}. Positioned second from last, in front of the bare ack. */
+const PRESENT_LOCATION_PATTERN = CLAIM_PATTERNS[CLAIM_PATTERNS.length - 2];
+/** Does earlier content in the same sentence end at a clause boundary before the match?
+ *
+ *  🔴 IT IS THE ANSWER GUARD FOR {@link PRESENT_LOCATION_PATTERN}. That shape anchors on "is now in"
+ *  rather than on a verb or a store noun, so it happily matches a claim tacked onto the END of a
+ *  sentence that states a fact — and the strike is by sentence, so taking it would take the fact.
+ *  A comma or a semicolon in front of the match is exactly that shape. A claim that OPENS its own
+ *  sentence has no earlier content to lose and is struck. */
+const TRAILING_CLAUSE = /[,;]/;
+/** The VERB-FIRST pattern — the only one whose match can begin on a completed verb that is really a
+ *  locative modifier, which is why {@link ACK_BEFORE} is tested for this pattern alone. Three of the
+ *  other five anchor on a noun or on a fixed auxiliary-plus-verb phrase, where the same test would
+ *  reject every ordinary subject ("The durable note … were updated" opens with "The"); the bare ack
+ *  anchors on the start of the sentence, so the test is meaningless for it. {@link
+ *  PRESENT_LOCATION_PATTERN} has the same answer-deleting hazard as this one and answers it with
+ *  {@link TRAILING_CLAUSE} instead — it anchors on a subject pronoun, which ACK_BEFORE reads as an
+ *  ack wherever it stands. */
+const VERB_FIRST_PATTERN = CLAIM_PATTERNS[0];
+/** A destination OUTSIDE the memory plane, which makes a bare ack a report about somewhere else.
+ *
+ *  🔴 IT ONLY EVER TAKES THE BARE ACK BACK OUT, never one of the noun-bearing patterns. "Recorded in
+ *  the release notes on GitHub" and "Saved to the ticket" are true statements about a system the room
+ *  can go and read, and the seat prompt explicitly keeps a repository path for that reason. A
+ *  sentence that names BOTH an external destination and a memory silo still matches pattern 1, which
+ *  this list does not touch. */
+const EXTERNAL_DESTINATION = /\b(?:github|linear|notion|jira|slack|discord|teams|pull\s+request|issue|ticket|release\s+notes?|changelog|repo(?:sitory)?|branch|commit|channel|thread|document)\b/i;
+/** A CITATION — a concrete file, with a path or an extension — which makes a bare ack a pointer
+ *  rather than an ack.
+ *
+ *  🔴 IT ALSO KEEPS TWO HOST REWRITES OUT OF EACH OTHER'S WAY. `turn-delivery.ts`
+ *  `truncateMemoryCitationPaths` runs at the same choke points, immediately before this guard, and
+ *  rewrites a memory citation down to its silo-relative path — so "recorded in
+ *  soak-brain/standing.md#L2." reaches this module already handled by the rule that owns it. Striking
+ *  it here would delete a pointer that plane deliberately kept.
+ *
+ *  THE RESIDUAL, STATED: a fabricated ack that names a plausible path ("Recorded in team-brain/
+ *  notes.md") is not struck by the bare-ack pattern. It is still struck by pattern 1 whenever the
+ *  sentence also carries a store noun, and the seat prompt bans naming a memory location at all
+ *  (`instructions/seat-prompt.ts`, "Name WHAT you recorded, never WHERE you put it"), so the shape
+ *  this leaves open is one the prompt already forbids for a different reason. */
+const CITATION_IN_SENTENCE = /[^\s]+\/[^\s]+|\.(?:md|txt)\b/i;
+/**
+ * A modal or a conditional standing IN FRONT of the matched verb, which makes the sentence a PLAN
+ * rather than a report.
+ *
+ * 🔴 IT IS TESTED ON THE TEXT BEFORE THE MATCH, not on the sentence as a whole, and the distinction
+ * is the whole reason it is a separate check. "That will be stored in memory" and "I stored it in
+ * memory, and I'll tell the others" both contain `will`; only the first is a plan. A whole-sentence
+ * exclusion would wave the second through, which is the over-claiming direction this module never
+ * takes. The 40-character window keeps the modal ATTACHED to the verb: a modal three clauses back
+ * governs a different verb.
+ */
+const MODAL_BEFORE = /\b(?:will|'ll|shall|would|could|can|should|must|going\s+to|about\s+to|let\s+me|once|after|when|if|before)\b[^.!?\n]{0,40}$/i;
+/** The same modal test, INSIDE the matched span.
+ *
+ *  🔴 {@link MODAL_BEFORE} ALONE IS NOT ENOUGH, because two patterns match from the NOUN. In "the
+ *  memory index will be refreshed tonight" the match starts at `memory`, so the modal sits inside the
+ *  span where the before-test can never see it, and the sentence was struck as a completed claim. Both
+ *  checks run, and a modal in either place makes the sentence a plan. */
+const MODAL_IN_SPAN = /\b(?:will|'ll|shall|would|could|should|must|going\s+to|about\s+to)\b/i;
+/** A negation in front of the match, which inverts the claim.
+ *
+ *  "Nothing is stored in memory yet" and "I have not saved anything to memory" are the HONEST
+ *  sentences a seat says when it could not write, and both carry a completed verb beside a store
+ *  noun. Striking them would delete the very admission this guard exists to produce. */
+const NEGATION_BEFORE = /\b(?:not|never|nothing|none|no|cannot|unable)\b[^.!?\n]{0,40}$|n't\s[^.!?\n]{0,40}$/i;
+/** The same negation test INSIDE the matched span, for the noun-anchored patterns. "The memory file
+ *  was not updated" matches from `memory`, so the `not` lands inside the span where
+ *  {@link NEGATION_BEFORE} cannot see it — the mirror of the {@link MODAL_IN_SPAN} gap. */
+const NEGATION_IN_SPAN = /\b(?:not|never|nothing|none|cannot|unable)\b|n't\b/i;
+/** Is the matched storage verb an ACK, or a locative modifier on a sentence that is really reporting
+ *  a fact?
+ *
+ *  🔴 THIS IS WHAT STOPS THE GUARD DELETING AN ANSWER. S-MEM-READ's recall turn asks the seat where
+ *  it found a fact, and the natural reply — "The OPE121 canary code is obsidian-30653, recorded in
+ *  the team memory file." — carries a completed verb and a store noun while claiming no write at all.
+ *  The strike is by SENTENCE, so waving that through would take the canary with it and turn a
+ *  fabrication guard into an answer shredder.
+ *
+ *  An ack opens its sentence, or follows a first-person agent or a completion auxiliary within a
+ *  short window. A verb hanging off a comma after a stated fact is a modifier, and stands. */
+const ACK_BEFORE = /(?:^[\s*_>\-#]*|\b(?:i|we|it|that|this|which|they|has|have|had|is|are|was|were|been|now|already|just|i've|we've)\s+(?:\w+\s+){0,1})$/i;
+/** Split a reply into sentences for a claim detector.
+ *
+ *  Crude on purpose: `.`, `!`, `?` and a newline end a sentence, and nothing else does. A detector
+ *  that tried to be clever about abbreviations would differ from what a reader sees, and the unit
+ *  the guard strikes must be the unit a reader reads. An over-long "sentence" costs a longer strike;
+ *  it never costs a missed claim, because every pattern is anchored inside one segment anyway.
+ *
+ *  🔴 EXPORTED FOR `channels/approval-claim-guard.ts`, WHICH STRIKES AT THE SAME CHOKE POINT
+ *  (OPE-1876). Two guards that disagreed about where a sentence ends would strike overlapping spans
+ *  on one body and leave a reader a half-sentence. One definition is what stops that, so this splits
+ *  every claim guard's sentences and neither guard keeps a copy. */
+export function replySentences(text) {
+    const out = [];
+    let start = 0;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === "." || ch === "!" || ch === "?" || ch === "\n") {
+            // Absorb a run of terminators, so the strike leaves no orphan punctuation behind. The
+            // whitespace AFTER them opens the next segment, which is what leaves no double space when a
+            // sentence in the middle of a reply is struck.
+            let end = i + 1;
+            while (end < text.length && (text[end] === "." || text[end] === "!" || text[end] === "?"))
+                end++;
+            out.push({ text: text.slice(start, end), start, end });
+            start = end;
+            i = end - 1;
+        }
+    }
+    if (start < text.length)
+        out.push({ text: text.slice(start), start, end: text.length });
+    return out;
+}
+/**
+ * Every completed-durability claim in one reply — PURE, so the patterns are testable over fixture
+ * text with no eve context, no audit store and no reply.
+ */
+export function detectDurabilityClaims(text) {
+    const claims = [];
+    const sentences = replySentences(text);
+    for (let i = 0; i < sentences.length; i++) {
+        const s = sentences[i].text;
+        for (const p of CLAIM_PATTERNS) {
+            const m = p.re.exec(s);
+            if (m === null)
+                continue;
+            const before = s.slice(0, m.index);
+            if (MODAL_BEFORE.test(before) || MODAL_IN_SPAN.test(m[0]))
+                continue; // a plan, not a report
+            if (NEGATION_BEFORE.test(before) || NEGATION_IN_SPAN.test(m[0]))
+                continue; // an admission, not a claim
+            // The bare ack carries no store noun, so an external destination is all that separates it from
+            // a true report about another system.
+            if (p === BARE_ACK_PATTERN && (EXTERNAL_DESTINATION.test(s) || CITATION_IN_SENTENCE.test(s)))
+                continue;
+            // A verb-less present-location claim tacked onto a stated fact is a trailing clause, and the
+            // strike is by sentence — so taking it would delete the answer. A citation is spared for the
+            // same reason it is on the bare ack: `turn-delivery.ts` deliberately kept that pointer.
+            if (p === PRESENT_LOCATION_PATTERN && (TRAILING_CLAUSE.test(before) || CITATION_IN_SENTENCE.test(s)))
+                continue;
+            // A completed verb hanging off a stated fact is a locative modifier, not an ack.
+            if (p === VERB_FIRST_PATTERN && !ACK_BEFORE.test(before))
+                continue;
+            claims.push({ shape: p.shape, sentence: i });
+            break; // one claim per sentence — the strike is by sentence, so a second shape adds nothing
+        }
+    }
+    return claims;
+}
+/**
+ * Strike every unbacked durability claim from one reply — PURE, given the evidence verdict.
+ *
+ * `stored` is the host's own answer to "did a fact reach a silo this turn". `true` returns the text
+ * untouched: the claim is backed, so the reader may have it.
+ */
+export function applyMemoryClaimGuard(text, stored) {
+    // 🔴 STRIP ANY EXISTING NOTE FIRST, ON BOTH ARMS. The note is host-voiced and this function runs on
+    // the edit door too, so a model echoing a previously posted body back through `edit_reply` would
+    // otherwise accumulate one copy per edit — the same idempotency `reply-provenance.ts`'s forged-footer
+    // strip keeps for its own marker. Stripping on the `stored` arm as well is what lets a later turn
+    // that DID write take the note back off.
+    const hadNote = text.includes(WITHHELD_CLAIM_NOTE);
+    const bare = hadNote ? text.split(WITHHELD_CLAIM_NOTE).join("").trimEnd() : text;
+    if (stored)
+        return { body: bare, withheld: [] };
+    const claims = detectDurabilityClaims(bare);
+    // A body that already carries the note and no longer carries a claim is a re-post or an edit of a
+    // reply this guard already handled. The world has not changed — there is still no write for this
+    // turn — so the note is re-attached rather than quietly dropped, and nothing is audited a second
+    // time: the withheld list is what the audit row counts, and this round withheld nothing.
+    if (claims.length === 0)
+        return { body: hadNote ? `${bare}\n\n${WITHHELD_CLAIM_NOTE}` : bare, withheld: [] };
+    const struck = new Set(claims.map((c) => c.sentence));
+    const sentences = replySentences(bare);
+    const kept = sentences.filter((_, i) => !struck.has(i)).map((s) => s.text);
+    // The note replaces the struck sentences ONCE, however many there were: a reply that made the same
+    // claim three ways is one unbacked claim to a reader, and three copies of the note would read as a
+    // rendering fault.
+    const body = `${kept.join("").trimEnd()}\n\n${WITHHELD_CLAIM_NOTE}`.trimStart();
+    return { body, withheld: claims };
+}
+/**
+ * Write the durable row for one withheld claim — best-effort, never throws, never fails the reply.
+ *
+ * 🔴 THE ROW NAMES THE CLAIM BY SHAPE AND POSITION, NEVER BY TEXT. The struck sentence is model
+ * output that can quote ingested content, and this plane's rows carry ids and counts only. A reader
+ * who needs the sentence has the posted body, where the note says one was struck.
+ */
+export async function auditWithheldMemoryClaim(audit, platform, withheld) {
+    if (!audit || withheld.length === 0)
+        return;
+    await appendAudit({
+        org: audit.org,
+        platform,
+        workspace: audit.workspace,
+        surface: audit.surface,
+        principalId: audit.principalId,
+        action: MEMORY_CLAIM_WITHHELD_ACTION,
+        detail: {
+            claims: withheld.length,
+            shapes: [...new Set(withheld.map((c) => c.shape))],
+            sentences: withheld.map((c) => c.sentence),
+            ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+            ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+            ...(audit.turnId ? { turnId: audit.turnId } : {}),
+        },
+    }).catch(() => undefined);
+}
+/**
+ * The whole per-reply step, in one call every choke point makes: read this turn's write evidence,
+ * strike what it cannot back, and hand back the body plus the claims to audit.
+ *
+ * ONE function because the four reply doors DRIFTED before over exactly this kind of shared step
+ * (`reply-provenance.ts` `applyReplyProvenance` says the same of itself): a door that struck a
+ * fabricated claim and a door that posted it would make the guard look like a rendering glitch.
+ */
+export function guardMemoryClaims(text, audit) {
+    return applyMemoryClaimGuard(text, factStoredThisTurn(audit?.turnId));
+}
+//# sourceMappingURL=memory-claim-guard.js.map