@open-everywhere/core 0.1.0

package/dist/agent/channels/reply-provenance.js

@@ -0,0 +1,662 @@
+// REPLY PROVENANCE (OPE-1608) — WHICH CONNECTORS A TURN READ TO PRODUCE THIS REPLY.
+//
+// A reply that read three Notion pages, a Linear issue and a GitHub pull request used to carry no
+// trace of that to the reader. Memory citations were the only provenance a room ever saw
+// (`turn-delivery.ts` truncateMemoryCitationPaths), and they say nothing about the connector plane.
+// This module adds the second half: the connectors the turn READ, recorded as a durable row and
+// rendered as a compact footer at the same reply choke points the citation render already runs at.
+//
+// 🔴 THE SOURCE IS THE HOST'S OBSERVATION, NEVER THE MODEL'S SELF-REPORT. Every entry originates at
+// `hooks/connector-audit.ts`, from eve's `action.result` event — the same seam that writes the
+// `connector.op` audit row, on the same call, for the same op. Three doors reach the ledger from
+// there and none weakens that: `channels/read-reach.ts` for a first-party read tool, which records
+// what the HOST itself fetched; the same module's BORROW door, which records what a lent,
+// credential-granted tool fetched, from the mount's own execute; and
+// `channels/delegated-provenance.ts` at a delegation SETTLE, which moves entries a WORKER's own copy
+// of this seam observed into the seat's turn. A model cannot add an entry, cannot remove one, and
+// cannot make one say something the op did not do. That is the point: a model asked to list its own
+// sources may not know them and may invent them, and a fabricated source list is worse than none
+// because it reads as a receipt.
+//
+// The ledger being unforgeable is only half of it, because a model can still TYPE a footer-shaped
+// line. So the marker is RESERVED: `stripForgedFooter` strikes any line of the model's own text that
+// opens with it, on every reply, including the replies this module adds nothing to. Without that
+// strip the guarantee above would hold of the ledger and of nothing a reader can see.
+//
+// READ VERBS ONLY. A write announces itself through its own flow — a created page, a posted comment
+// — so only the `read` op tier reaches this ledger. A failed op does not reach it either: nothing
+// was read, so nothing was drawn on.
+//
+// ── 🔴 NO FOOTER IS NOT "NOTHING WAS READ". READ THIS BEFORE CITING THE ABSENCE ─────────────────
+// The footer is a POSITIVE signal only. Its absence means this ledger holds nothing for this turn,
+// and two routes reach a source without ever filling it. Neither is a defect; each is a boundary this
+// module cannot see past, and an operator who reads a bare reply as "consulted nothing" is wrong.
+//
+//   1. A CROSS-TURN edit. The ledger is turn-stamped, so an `edit_reply` on a LATER turn reads empty
+//      and re-renders without the footer the original post earned.
+//   2. A terminal reply whose channel STATE names no conversation. Every terminal-prose route that
+//      resolves a partition carries its turn id since OPE-1639, but the unidentifiable-state
+//      fallback posts through eve's raw primitive instead of this spine (channels/slack.ts), so it
+//      renders no footer and writes no row. It is the degenerate case, not a route a seat chooses.
+//
+// 🔴 A BORROWED READ IS NO LONGER ONE OF THEM (OPE-2018). A credential-grant call arrives as
+// `grant__<owner>_<connector>__<tool>`, and `hooks/connector-audit.ts` still returns on that reserved
+// namespace before either write — the connection segment of such a name is the literal string "grant"
+// and names no system. The MOUNT records the read instead, through `channels/read-reach.ts`'s borrow
+// door, with the grant row's own connection name and its PINNED target. Provenance therefore follows
+// the fetch: a reply built on a lent tool's bytes names the target that tool actually read, so a
+// misattribution in the model's prose is contradicted by a host-written line in the same message. The
+// grant plane's `grant.*` rows are unchanged and still carry both principals.
+//
+// 🔴 A DELEGATED READ IS NO LONGER A BOUNDARY IN GENERAL, AND IT IS THE ONE THAT MATTERS MOST
+// (OPE-1849). Every conversational seat is worker-only for the connector ops, so the ordinary shape
+// of a connector answer IS a delegated read — and a bare list would then describe the common case as
+// a boundary. `channels/delegated-provenance.ts` carries a worker's reads onto the delegating seat's
+// turn at the settle, so a delegated read fills THIS ledger and renders THIS footer. A missing footer
+// after a delegation is a DEFECT wherever the taint plane is on. It stays a bound in three narrower
+// places that module states in full: a `taint.mode: "off"` deployment, which writes none of the
+// dispatch rows the carriage joins through; a seat that answers on a LATER turn than the settlement;
+// and a settlement whose wake proof names another conversation, which is withheld on purpose.
+//
+// The direction is deliberate and it is one direction: this module UNDER-reports. It can fail to
+// name a source the turn really read; it can never name one the turn did not.
+//
+// ── THE REACH RULE, AND WHY IT IS THIS STRICT ───────────────────────────────────────────────────
+// Naming a source is a DISCLOSURE. "We read the acquisition planning page" tells a room that such a
+// page exists, which is a fact the room may not be entitled to even when the connector read was
+// itself legitimate. So a source is named only where the host can PROVE the reply lands in the room
+// the read was scoped to, and every other source is counted by kind alone ("in another domain").
+//
+// THE PROOF IS PER POSTURE, AND THE SEAT THAT MADE THE READ CHOOSES IT (OPE-1713). Each read carries
+// exactly ONE proof, stamped by `hooks/connector-audit.ts` at the moment the op ran, where the host
+// knows which seat it is on. A reply then applies the proof the READ carries — never the other one —
+// so a read recorded under the stronger proof can never be waved through by the weaker.
+//
+//   • PER-SURFACE SEAT — the proof is the partition SURFACE, and it is exact: the seat holds one
+//     conversation, the read and the reply resolve the same partition inside one turn, so equal
+//     surfaces mean the same room. Such a delivery carries no wake id at all (OPE-1601).
+//   • UNIFIED SEAT — the proof is the WAKE, and the surface key is deliberately NOT recorded. A
+//     unified window holds SEVERAL conversations in one turn and every one of them resolves the SAME
+//     partition off the coalesced delivery's auth stamps, so a read made for conversation A and a
+//     reply posted into conversation B compare EQUAL on the surface. Measured on base `e3626f17`,
+//     before this rule: a unified `reply` answering wake B named a read made under wake A. The wake
+//     recorded on the read is compared against the wake the reply ANSWERS — the tool's fenced `wake`
+//     argument, which since OPE-1982 is the only way a unified reply names a conversation at all.
+//     🔴 AND ONE CONVERSATION CAN HOLD TWO WAKE IDS, SO A READ MAY CARRY TWO (OPE-1869). At a
+//     delegation settlement `installTaskWake` mints the task its own wake and the turn adopts it, so
+//     the carried reads are stamped with THAT id — while the seat replies under the stamp the turn
+//     was DELIVERED with. Comparing only the first named nothing: ship #213 filed six
+//     `reply.provenance` rows, every one `named: 0` beside a settlement that had carried the reads.
+//     So {@link ConnectorRead.alsoWakeId} holds the second address and the rule below accepts
+//     EITHER. Only `channels/delegated-provenance.ts` sets it, only at that settlement, and only
+//     after `delegatedSecondAddress` reads both wake rows back and proves they resolve to the SAME
+//     conversation — an unprovable stamp is withheld, so OPE-1713 stays closed. A seat-turn read
+//     carries one address and is unchanged.
+//
+// The wake a read is stamped with is `addressedWakeThisTurn(turnId) ?? currentWakeId(ctx)` — the same
+// expression and the same ruling OPE-601 settled for the dispatch edge: the wake a turn ADDRESSES is
+// a statement the turn made, where the delivery a merge kept last is an accident. A read the host
+// can place under neither proof is counted by kind on every reply, which is the fail-closed floor.
+// 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THE PREFERENCE AND ITS RESIDUAL ARE BOTH STILL
+// LIVE (OPE-2042). eve batches adjacent queued deliveries only when their full auth contexts match,
+// and OE stamps a fresh per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying
+// deliveries on one unified window never compare equal; only the caller-less task COMPLETION COHORT
+// still folds, and it carries no `auth` at all. That closes ONE road. A turn still holds MORE THAN
+// ONE conversation without any merge: the reply fence's same-conversation and pending arms admit a
+// sibling wake, and a turn woken by an INTERNAL wake answers a conversation whose envelope is in the
+// seat's shared context — the measured 2026-08-15 case. So the residual below is REACHABLE, and is
+// stated rather than papered over for that reason.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the MERGE road alone.
+//
+// 🔴 THE RESIDUAL, IN BOTH ORDERINGS, STATED RATHER THAN PAPERED OVER. It exists only on a turn that
+// holds MORE THAN ONE conversation, and on such a turn it is open for the whole turn — the two
+// orderings between them leave no window where the stamp is proven:
+//
+//   • BEFORE the turn addresses anything, a read for conversation B is stamped with `currentWakeId`,
+//     which is the delivery a merge kept LAST. Answer that conversation and B's read is named there.
+//   • AFTER the turn addresses wake A, `addressedWakeThisTurn` is FIXED — first addressed wins, and
+//     it never moves again (access/dispatch-origin-signal.ts). So every later read is stamped A
+//     whichever conversation it served, and a second post to A, or an `edit_reply` on A — which
+//     re-derives the footer from the live ledger — names it into A's room.
+//
+// It is the mirror of OPE-601's own accepted residual, which states both orderings for the same
+// mechanism, and it is bounded the same way: both conversations sit inside ONE operator-vouched
+// window, and the room already learns "1 in another domain" without it. It shrinks to NOTHING on a
+// single-wake turn, which is the ordinary shape. Closing it needs a host count of the wakes one
+// delivery coalesced, which nothing records today.
+//
+// 🔴 WHAT THE RESIDUAL MAY DISCLOSE, RESTATED (OPE-2018). It was the connection NAME alone — never a
+// record, never an op argument. An AUTHORED read is unchanged and still discloses the name alone
+// there, because rule (ii) is decided against the turn's own arrival stamp. A BORROWED read may now
+// carry its record across it, and the grant is what bounds that: the sibling conversations of a
+// standing grant's window are rooms of the domain its owner tapped, so the pinned target's label
+// lands only where that owner already lends the credential. An op argument still reaches no reader.
+//
+// ── NAMING A RECORD — THE NARROW YES, AND THE TWO PROOFS IT TAKES (OPE-1714) ────────────────────
+// OPE-1713 ruled the footer names the CONNECTION alone, because a record title tells a room that
+// such a record exists. Tommy reopened exactly one door on 2026-09-11: the footer MAY name a record,
+// on the same one line, when BOTH of these hold — and it stays the connection-only line otherwise.
+//
+//   (i)  THE REPLY LANDS IN THE ROOM THE READ WAS SCOPED TO. That is the reach rule above, unchanged
+//        and applied per reply. A read this room may not even be told about can never be named by it.
+//   (ii) THE RECORD'S ID ALREADY APPEARED IN THAT ROOM. Decided at the READ, in `channels/read-reach.ts`,
+//        against the host's own wake stamps: the record is the one the turn ARRIVED on — the Linear
+//        issue the comment sits on, the Notion page the comment sits in. A room whose own subject is
+//        that record already holds its id, so naming it discloses nothing the room did not have.
+//
+// The example the header opens with is the case this still refuses: "the acquisition planning page"
+// is a page the room never named, so (ii) fails and the footer says `notion` and no more.
+//
+// 🔴 A BORROWED READ ANSWERS (ii) FROM THE GRANT ROW (OPE-2018). Its record is the target the grant
+// PINS, named by the label the REQUESTER wrote when they asked and the owner approved on their card.
+// Nothing is inferred from a wake stamp, because the grant itself answers the question: a row is
+// spendable only in the session it was minted for, or in the domain its owner tapped, so every room
+// the record can reach is a room whose seat may spend that grant. `channels/read-reach.ts`
+// `noteBorrowedRecordRead` carries the whole argument — including why the grant-use notice is a
+// SECOND disclosure rather than the premise. A grant that does not pin its tool's target, and a row
+// with no recoverable label, both carry no record at all.
+//
+// THE LINE STAYS ONE LIGHT LINE, and the record names are what pays for that. They ride INSIDE the
+// existing line as `notion (Q3 planning)`, never a second line, never a block, never a card; and when
+// the line passes {@link MAX_FOOTER_CHARS} they are the first — and the only — thing dropped.
+//
+// A CONNECTOR OP NAMES NO RECORD. eve's `action.result` hands the hook untyped JSON from a remote MCP
+// server, so naming the record it read would mean guessing at keys in third-party content, which is a
+// heuristic where this module needs a host observation. The two authored tools (`read_notion_page`,
+// `read_linear_issue`) know what they read because they fetched it, and they reach the ledger through
+// the door in `channels/read-reach.ts` — NOT by widening `isConnectorOpTool`, whose `vendor__op`
+// contract the approver chain and the taint column rely on. A BORROWED read names a record for the
+// opposite reason: its target was decided by the GRANT ROW before the call, so the host knows it
+// without reading one vendor byte.
+//
+// FAIL-SOFT, ALWAYS. Outside an eve context every function no-ops or answers "nothing read", which
+// degrades to the pre-OPE-1608 behaviour — a reply with no footer, never a failed reply. Provenance
+// is a courtesy to the reader; it is never worth losing the answer over.
+import { defineState } from "eve/context";
+import { appendAudit } from "../audit/audit.js";
+const slot = defineState("open-everywhere.reply-provenance", () => ({}));
+/** How many distinct reads one turn records. A research turn reads a handful of systems; the cap only
+ *  stops a looping turn from growing the serialized container without bound. Past the cap the ledger
+ *  stops recording, so the footer UNDERSTATES rather than growing — the safe direction for a claim
+ *  about sources, and the reason the durable row carries the same truncated list the footer does. */
+const MAX_READS = 32;
+/** How many connectors the footer names before it stops listing. A footer is a courtesy line, not a
+ *  bibliography, and a reply trailing twenty connector names is noise. Past this the remainder is
+ *  counted, never dropped silently. */
+const MAX_NAMED = 6;
+/** How long the whole footer LINE may be before the record names come off it.
+ *
+ *  🔴 THE FOOTER IS ONE LIGHT LINE, AND THIS IS WHAT KEEPS IT ONE (Tommy, 2026-09-11). A connection
+ *  name is a short host-chosen word; a record title is arbitrary prose somebody typed into a page
+ *  header, and six of them turn a courtesy line into a paragraph a cross-surface UI cannot hide. So
+ *  the line has a budget, and {@link renderProvenanceFooter} spends it on the connection names FIRST.
+ *  The budget never drops a connection name, an overflow count or an other-domain count — a record
+ *  name is the first and the only thing it takes off. */
+const MAX_FOOTER_CHARS = 160;
+/** How much of one record title the footer will ever carry. Past this the title is not clipped, it is
+ *  DROPPED by the budget above — a half-title reads as a rendering fault, where an absent one reads
+ *  as the connection-only footer every other reply carries. */
+const MAX_RECORD_NAME_CHARS = 120;
+/** How many record names this PROCESS keeps at once, across every session warm on it. Small — each
+ *  value is at most {@link MAX_RECORD_NAME_CHARS} — and bounded for the same reason as
+ *  {@link MAX_READS}: a looping turn must not grow a container without end. Past it the oldest entry
+ *  goes, and a reply whose name has been evicted renders the connection alone. */
+const MAX_RECORD_NAMES = 256;
+/** THE RECORD DISPLAY NAMES — THIS TURN, THIS PROCESS, AND NOWHERE ELSE (OPE-1714).
+ *
+ *  🔴 IT IS A PLAIN MAP RATHER THAN A `defineState` SLOT, DELIBERATELY. Everything in the slot is
+ *  serialized into the session context and can be read back by a later deployment; the ledger's
+ *  "ids and verbs only" contract exists to keep op OUTPUT out of exactly that. A record title is op
+ *  output. Holding it here means it lives for the turn that read it and dies with the process — the
+ *  render resolves it, the durable row never sees it, and a resumed session finds nothing and falls
+ *  back to the connection name alone. */
+const recordNames = new Map();
+/** The key one record's display name is held under, or `undefined` when the host cannot build one —
+ *  which stores no name and resolves none, so the footer says the connection alone.
+ *
+ *  🔴 THE SESSION ID IS PART OF THE KEY, AND IT IS LOAD-BEARING (OPE-423). The ledger above is a
+ *  `defineState` slot scoped to ONE eve session, so a bare turn id identifies a turn inside it. This
+ *  map is PROCESS-GLOBAL — every session warm on the instance shares it — and eve mints `turn.id` as
+ *  `turn_<sequence>`, so two sessions' first turns are both `turn_0`. Keyed on the turn alone, one
+ *  workspace's issue title would sit under another workspace's identifier and be footed into the
+ *  wrong room. `identity/binding.ts`'s `currentSessionId` doc states the same trap for the step
+ *  boundary. The TURN is in the key too, so yesterday's title can never be footed onto today's reply;
+ *  and the `kind`, because two systems can mint the same id string and they are not one record. */
+function recordNameKey(sessionId, turnId, kind, id) {
+    if (sessionId === undefined || sessionId.length === 0)
+        return undefined;
+    if (turnId === undefined || turnId.length === 0)
+        return undefined;
+    if (kind.length === 0 || id.length === 0)
+        return undefined;
+    return `${sessionId}::${turnId}::${kind}::${id}`;
+}
+/** The op tier that counts as READING. Written as a constant so the hook and this module cannot
+ *  disagree about which verbs produce provenance (`access/connector-op-gating.ts` owns the tiering). */
+export const PROVENANCE_READ_TIER = "read";
+/** The audit action one landed reply writes to record what it drew on. STORE FIRST is the ruling
+ *  (Tommy, 2026-09-08): the render is a first cut that is expected to change, and the row is the
+ *  durable part, so the row carries the FULL list while the footer carries the reach-safe view. */
+export const REPLY_PROVENANCE_ACTION = "reply.provenance";
+/** Read the durable value defensively — a resumed session can hand back anything a previous
+ *  deployment wrote. Anything unrecognised reads as "no record", which is "no footer". */
+/** Read one entry's record reference defensively, on the same terms as everything else in
+ *  {@link readState}: anything this deployment does not recognise reads as "no record", which renders
+ *  the connection name alone. */
+function readRecord(v) {
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    const raw = v;
+    if (typeof raw.kind !== "string" || raw.kind.length === 0)
+        return undefined;
+    if (typeof raw.id !== "string" || raw.id.length === 0)
+        return undefined;
+    return { kind: raw.kind, id: raw.id };
+}
+function readState(v) {
+    if (v === null || typeof v !== "object")
+        return {};
+    const s = v;
+    if (typeof s.turn !== "string" || s.turn.length === 0)
+        return {};
+    const reads = Array.isArray(s.reads)
+        ? s.reads.flatMap((r) => {
+            if (typeof r !== "object" || r === null)
+                return [];
+            const raw = r;
+            if (typeof raw.connection !== "string" || raw.connection.length === 0)
+                return [];
+            if (typeof raw.op !== "string" || raw.op.length === 0)
+                return [];
+            const record = readRecord(raw.record);
+            return [
+                {
+                    ...(record !== undefined ? { record } : {}),
+                    // FAIL CLOSED on anything this deployment does not recognise, including an entry written
+                    // before the discriminator existed: `"none"` is counted by kind and never named.
+                    proof: raw.proof === "surface" || raw.proof === "wake" ? raw.proof : "none",
+                    connection: raw.connection,
+                    op: raw.op,
+                    ...(typeof raw.surfaceKey === "string" && raw.surfaceKey.length > 0 ? { surfaceKey: raw.surfaceKey } : {}),
+                    ...(typeof raw.wakeId === "string" && raw.wakeId.length > 0 ? { wakeId: raw.wakeId } : {}),
+                    // 🔴 THE SECOND ADDRESS SURVIVES THE ROUND TRIP, OR THE WHOLE CARRIAGE IS POINTLESS
+                    // (OPE-1869). This reader rebuilds every entry field by field, so a field it does not
+                    // copy is a field the reply never sees — the settle would stamp the second address and
+                    // the reach rule would find it gone. Read on the same fail-closed terms as `wakeId`, and
+                    // only BESIDE one: alone it would name nothing, because the wake arm needs the first id
+                    // to have been recorded at all.
+                    ...(typeof raw.wakeId === "string" && raw.wakeId.length > 0 && typeof raw.alsoWakeId === "string" && raw.alsoWakeId.length > 0 ? { alsoWakeId: raw.alsoWakeId } : {}),
+                },
+            ];
+        })
+        : [];
+    return { turn: s.turn, reads };
+}
+/**
+ * Record that THIS turn READ something through a connector.
+ *
+ * Called from `hooks/connector-audit.ts` beside the `connector.op` row it already writes, for a
+ * `read`-tier op that did not error. Deduplicated on the whole entry, so a turn that pages a list
+ * twenty times contributes one source rather than twenty. No-op without a turn id.
+ */
+export function noteConnectorRead(turnId, read) {
+    if (turnId === undefined || turnId.length === 0)
+        return;
+    if (read.connection.length === 0 || read.op.length === 0)
+        return;
+    const entry = {
+        proof: read.proof,
+        connection: read.connection,
+        op: read.op,
+        ...(read.surfaceKey !== undefined && read.surfaceKey.length > 0 ? { surfaceKey: read.surfaceKey } : {}),
+        ...(read.wakeId !== undefined && read.wakeId.length > 0 ? { wakeId: read.wakeId } : {}),
+        // Kept only beside a wake proof it actually widens: an entry with no `wakeId` is not named by the
+        // wake arm at all, so a second wake id on it could only ever be dead weight in the durable row.
+        ...(read.proof === "wake" && read.wakeId !== undefined && read.wakeId.length > 0 && read.alsoWakeId !== undefined && read.alsoWakeId.length > 0 && read.alsoWakeId !== read.wakeId
+            ? { alsoWakeId: read.alsoWakeId }
+            : {}),
+        ...(read.record !== undefined && read.record.kind.length > 0 && read.record.id.length > 0 ? { record: { kind: read.record.kind, id: read.record.id } } : {}),
+    };
+    // Deduplicated on the WHOLE entry, the proof and the wake included: the same op run under two of a
+    // coalesced turn's wakes is two reachable sources, and folding them would name one room's read in
+    // the other. The RECORD is part of the identity too: two pages read on one connection are two
+    // reads, and folding them would lose the first record's name behind the second's entry.
+    const same = (a, b) => a.connection === b.connection &&
+        a.op === b.op &&
+        a.proof === b.proof &&
+        a.surfaceKey === b.surfaceKey &&
+        a.wakeId === b.wakeId &&
+        // The SECOND address is part of the entry, so it is part of the key (OPE-1869) — "the WHOLE
+        // entry" above is only true while this line exists. Two entries alike but for it are two
+        // differently-reachable sources, and folding them would make which one survives depend on
+        // arrival order.
+        a.alsoWakeId === b.alsoWakeId &&
+        a.record?.kind === b.record?.kind &&
+        a.record?.id === b.record?.id;
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (state.turn !== turnId)
+                return { turn: turnId, reads: [entry] };
+            const reads = state.reads ?? [];
+            if (reads.length >= MAX_READS || reads.some((r) => same(r, entry)))
+                return state;
+            return { turn: turnId, reads: [...reads, entry] };
+        });
+    }
+    catch {
+        /* no eve context — nothing to record, and never a reason to disturb the turn */
+    }
+}
+/**
+ * Flatten a record title into something that can only ever be PART OF ONE LINE.
+ *
+ * 🔴 THE TITLE IS UNTRUSTED EXTERNAL CONTENT, AND THIS IS THE FENCE. Anyone who can name a Notion
+ * page or a Linear issue chooses these bytes, and they are about to be written into a reply body by
+ * the HOST, under the host's own reserved marker. A title carrying a newline would split the footer
+ * into two lines, and the second line — attacker-chosen text, with no marker on it — would read as
+ * part of the answer and would survive {@link stripForgedFooter} on an `edit_reply` round trip,
+ * accumulating one copy per edit. So every control and format character becomes a space and every
+ * run of whitespace collapses to one: the result cannot contain a line break, and the footer stays
+ * the one line the ruling requires.
+ *
+ * Answers `undefined` for a title that is empty once flattened — a nameless record renders as its
+ * connection alone.
+ */
+function flattenRecordName(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const flat = raw
+        .replace(/\p{C}/gu, " ")
+        // 🔴 AND THE FOOTER'S OWN GRAMMAR GOES WITH THE NEWLINE. The line is `prefix` plus items joined
+        // by ", ", with a record rendered as `connection (title)`. A title is untrusted, so a title
+        // reading `Q3, workday-hr, 2 more` would put two source names and an overflow count inside the
+        // host's vouched line, and an unbalanced `)` would close the parenthetical and continue as
+        // host-voiced prose. Both forge exactly what `stripForgedFooter` exists to stop, so the three
+        // characters that carry the grammar become spaces.
+        .replace(/[(),]/gu, " ")
+        .replace(/\s+/gu, " ")
+        .trim();
+    // A title that still carries the reserved marker is DROPPED rather than shown: nothing legitimate
+    // needs it, and the connection-only line is always a safe render.
+    if (flat.includes(PROVENANCE_FOOTER_PREFIX))
+        return undefined;
+    // Cut by CODE POINT, never by UTF-16 unit: `slice` can split an astral character in half and leave
+    // a lone surrogate in a message body.
+    return flat.length === 0 ? undefined : Array.from(flat).slice(0, MAX_RECORD_NAME_CHARS).join("");
+}
+/**
+ * Remember one record's DISPLAY NAME for the length of this turn, in this process.
+ *
+ * Called by the authored-tool door (`channels/read-reach.ts`) beside the ledger entry it writes, and
+ * only for a record the room is entitled to see. The name never reaches the ledger, the session
+ * context or the durable row — see {@link recordNames} for why that is the whole point.
+ */
+export function rememberRecordName(sessionId, turnId, kind, id, name) {
+    const key = recordNameKey(sessionId, turnId, kind, id);
+    if (key === undefined)
+        return;
+    const flat = flattenRecordName(name);
+    if (flat === undefined)
+        return;
+    // BOUNDED BY OLDEST-OUT, not by clearing on a turn change. Several sessions interleave across an
+    // `await` on one instance, and a clear-on-change map would evict a live turn's name the moment
+    // another session read something — the reply would then lose a name it had earned. A `Map`
+    // iterates in insertion order, so the oldest entry is the one that goes.
+    recordNames.delete(key);
+    if (recordNames.size >= MAX_RECORD_NAMES) {
+        const oldest = recordNames.keys().next();
+        if (oldest.done !== true)
+            recordNames.delete(oldest.value);
+    }
+    recordNames.set(key, flat);
+}
+/** The display name for one recorded record, or `undefined` when this process does not hold one —
+ *  a resumed session, another process, a reply the host cannot place in a session, a title that
+ *  flattened to nothing, or a turn that has since moved on. Every one of those renders the
+ *  connection name alone. */
+function recordDisplayName(sessionId, turnId, record) {
+    if (record === undefined)
+        return undefined;
+    const key = recordNameKey(sessionId, turnId, record.kind, record.id);
+    return key === undefined ? undefined : recordNames.get(key);
+}
+/**
+ * Every connector read THIS turn recorded, or an empty list.
+ *
+ * Answers empty for an unreadable turn id, for a record stamped for another turn, for a turn that
+ * read nothing, and whenever the eve context is unavailable — all of which render no footer, the
+ * fail-soft direction.
+ */
+export function connectorReadsThisTurn(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return [];
+    let state;
+    try {
+        state = readState(slot.get());
+    }
+    catch {
+        return [];
+    }
+    if (state.turn !== turnId)
+        return [];
+    return state.reads ?? [];
+}
+/**
+ * Apply the reach rule to this turn's reads for a reply going out under `audit`.
+ *
+ * Returns `undefined` when the turn read nothing — the "off when a turn read nothing" condition,
+ * expressed as an absent value so no caller can render an empty footer by accident.
+ *
+ * A source is NAMED only where the proof the READ carries holds against this reply — its surface for
+ * a read made on a per-surface seat, its wake for one made on a unified seat. See the module header
+ * for why the surface proves nothing on a unified seat.
+ */
+function provenanceForReply(reads, audit, sessionId, turnId) {
+    if (reads.length === 0)
+        return undefined;
+    // The reply's two room keys — one per proof. EACH READ NAMES WHICH ONE APPLIES, in its own `proof`
+    // field, because the recording end already decided that: `hooks/connector-audit.ts` stamps a
+    // per-surface read `"surface"` and a unified read `"wake"`. So a unified read can never be waved
+    // through by a surface comparison, whatever the reply's own fields happen to say, and a read
+    // carrying neither proof (`"none"`) is named by nothing.
+    //
+    // `roomKey` is rebuilt from the three fields the audit struct already carries — the same
+    // `platform/workspace/surface` shape `resolvePartition` hands the hook, so the two ends compare
+    // like for like. It is `undefined` on a reply the host could not place, and on any struct whose
+    // labels name the WINDOW rather than a room — the `platform: "unified"` sentinel just above.
+    //
+    // `wakeKey` is the wake this reply ANSWERS: the `reply` tool's fenced `wake` argument.
+    // `undefined` means a reply that names no conversation, which proves nothing and names nothing.
+    const wakeKey = audit?.wakeId !== undefined && audit.wakeId.length > 0 ? audit.wakeId : undefined;
+    const roomKey = audit === undefined || audit.platform === "unified" || audit.surface === undefined || audit.surface.length === 0
+        ? undefined
+        : `${audit.platform}/${audit.workspace}/${audit.surface}`;
+    const named = [];
+    const other = new Set();
+    // THE RECORD NAMES, AND WHY THEY ARE GATHERED HERE AND NOWHERE EARLIER (OPE-1714). A record name
+    // needs BOTH halves of the disclosure rule, and only this loop holds both: the entry carries a
+    // record ONLY where the read end proved the room already holds that id, and `visible` is the reach
+    // rule saying this reply lands in that same room. One name per connection — the FIRST such read of
+    // the turn — because the line is a courtesy, not a bibliography, and a second title on one
+    // connection is the noise the ruling forbids.
+    const records = {};
+    for (const r of reads) {
+        const visible = r.proof === "wake"
+            ? // EITHER address of ONE conversation names the read (OPE-1869). `alsoWakeId` is set only by
+                // the delegation settle, and only where the turn adopted this task's own minted wake, so
+                // the second id is that same turn's own delivery stamp — the id this reply answers under.
+                // A read with no `alsoWakeId` is unchanged, which is every seat-turn read.
+                wakeKey !== undefined && (r.wakeId === wakeKey || r.alsoWakeId === wakeKey)
+            : r.proof === "surface"
+                ? roomKey !== undefined && r.surfaceKey === roomKey
+                : false;
+        if (visible) {
+            if (!named.includes(r.connection))
+                named.push(r.connection);
+            if (records[r.connection] === undefined) {
+                const name = recordDisplayName(sessionId, turnId, r.record);
+                if (name !== undefined)
+                    records[r.connection] = name;
+            }
+        }
+        else if (!named.includes(r.connection)) {
+            other.add(r.connection);
+        }
+    }
+    // A connection read BOTH in this room and elsewhere is already named, so it must not also be
+    // counted as another domain — the name is out either way, and double-counting would tell the room
+    // there was a source that does not exist.
+    for (const n of named)
+        other.delete(n);
+    return { named, otherDomains: other.size, ...(Object.keys(records).length > 0 ? { records } : {}) };
+}
+/** The footer's leading marker — and, because {@link stripForgedFooter} strikes it out of the model's
+ *  own text, the string that RESERVES this line shape for the host. One constant so the render and
+ *  the strip can never disagree about what the marker is. */
+export const PROVENANCE_FOOTER_PREFIX = "Sources read this turn:";
+/**
+ * Strike every line of the model's text that opens with {@link PROVENANCE_FOOTER_PREFIX}.
+ *
+ * 🔴 WITHOUT THIS THE WHOLE GUARANTEE IS DECORATIVE. Nothing else stops a model ending its answer
+ * with `Sources read this turn: notion, workday-hr` on a turn that read nothing at all. The host
+ * would correctly add no footer, the room would read a fabricated receipt in the exact shape of a
+ * host-recorded one, and the reader has no way to tell them apart — which is worse than having no
+ * footer, because the shape is what earns the trust.
+ *
+ * So the marker is RESERVED, the same way `truncateMemoryCitationPaths` reserves the memory mount:
+ * both rewrite the model's own bytes at the choke point, and both do it because the model cannot be
+ * asked to remember. It runs on EVERY reply, including one that adds no footer — a turn that read
+ * nothing is exactly the turn a forged line does the most damage on.
+ *
+ * It also makes the render IDEMPOTENT, which the edit door needs: a model that echoes a previously
+ * posted body back into `edit_reply` gets one footer, not two.
+ *
+ * 🔴 IT TOLERATES MARKDOWN DECORATION, and it has to. A model writes `**Sources read this turn:** …`
+ * or `> Sources read this turn: …` as readily as the bare line, and every one of those renders in a
+ * room as the same receipt. A strip anchored on the bare marker alone would leave the forgeries that
+ * LOOK MOST like a host line — the bolded one most of all — so the leading run of whitespace and
+ * `* _ > - #` is skipped before the marker is matched.
+ *
+ * Conservative past that point: only a line whose first CONTENT is the marker is struck. A sentence
+ * mentioning the phrase mid-line, a quotation of one inside a code block, and every other byte pass
+ * through untouched.
+ */
+function stripForgedFooter(text) {
+    if (!text.includes(PROVENANCE_FOOTER_PREFIX))
+        return text;
+    const forged = (line) => line.replace(/^[\s*_>\-#]+/, "").startsWith(PROVENANCE_FOOTER_PREFIX);
+    return text
+        .split("\n")
+        .filter((line) => !forged(line))
+        .join("\n")
+        .trimEnd();
+}
+/**
+ * Render the footer, or `undefined` when there is nothing a reader may be told.
+ *
+ * Compact by design and deliberately plain text: it runs on Slack, Discord, Teams, Notion, Linear
+ * and GitHub alike, and the one markup every one of those renders the same way is none.
+ */
+function renderProvenanceFooter(p) {
+    if (p === undefined)
+        return undefined;
+    const listed = p.named.slice(0, MAX_NAMED);
+    const overflow = p.named.length - listed.length;
+    // The two remainders are separate sentences of the same claim and must not be merged: an overflow
+    // is a source this room MAY see that the line had no room for, while another domain is a source it
+    // may NOT see at all. Collapsing them into one number would misstate which.
+    const tail = [];
+    if (overflow > 0)
+        tail.push(`${overflow} more`);
+    if (p.otherDomains > 0)
+        tail.push(`${p.otherDomains} in another domain`);
+    if (listed.length === 0 && tail.length === 0)
+        return undefined;
+    const line = (items) => `${PROVENANCE_FOOTER_PREFIX} ${[...items, ...tail].join(", ")}`;
+    const items = listed.map((c) => {
+        const record = p.records?.[c];
+        return record === undefined ? c : `${c} (${record})`;
+    });
+    // 🔴 THE RECORD NAMES COME OFF FIRST, AND THEY ARE THE ONLY THING THAT COMES OFF. Drop from the
+    // LAST decorated name backward until the line fits its budget: the connection names, the overflow
+    // count and the other-domain count are the claim about SOURCES and survive every time, while a
+    // record name is the extra the ruling made droppable. A line still over budget once every record
+    // name is gone is today's connection-only line, which is never worse than before this fold.
+    for (let i = items.length - 1; i >= 0 && line(items).length > MAX_FOOTER_CHARS; i--)
+        items[i] = listed[i];
+    return line(items);
+}
+/**
+ * Append the footer to a reply body, or return the body untouched.
+ *
+ * 🔴 UNTOUCHED IS THE COMMON CASE AND IT IS BYTE-EXACT. A turn that read no connector, and whose text
+ * carries no forged marker, gets its text back identical — which is what keeps the OPE-1516 silence
+ * intact for every reply this feature has nothing to say about
+ * (`packages/core/scripts/reply-delegation-pending-test.ts` §10).
+ *
+ * The one text this DOES rewrite with no footer to add is a forged one; see {@link stripForgedFooter}
+ * for why a read-nothing turn is exactly where that matters.
+ */
+function withProvenanceFooter(text, p) {
+    const body = stripForgedFooter(text);
+    const footer = renderProvenanceFooter(p);
+    return footer === undefined ? body : `${body}\n\n${footer}`;
+}
+/**
+ * Write the durable provenance row for ONE landed reply — best-effort, never throws, never fails the
+ * reply, and a no-op when the turn read nothing.
+ *
+ * THE ROW CARRIES THE FULL LIST, the footer carries the reach-safe view, and the row records how many
+ * sources the footer withheld. That asymmetry is the point: the row is an internal record answering
+ * "what did this reply actually draw on", and an answer that had already dropped the redacted sources
+ * could not answer it. The row is readable with `readAudit({ action: "reply.provenance" })`.
+ *
+ * 🔴 Its `platform` COLUMN names the SURFACE the reply landed on — the `platform` ARGUMENT, not
+ * `audit.platform` — so it files beside the `reply.post` row it describes rather than under the
+ * route that carried it. See `channels/reply-post.ts` `auditReplyPost` for the measurement.
+ * `audit.platform` stays the turn's partition, and {@link provenanceForReply} still reads its
+ * `"unified"` value as the sentinel for "these labels name the window, not a room".
+ */
+export async function auditReplyProvenance(audit, messageId, platform, reads, shown) {
+    if (!audit || reads.length === 0)
+        return;
+    const connections = [...new Set(reads.map((r) => r.connection))];
+    await appendAudit({
+        org: audit.org,
+        platform,
+        workspace: audit.workspace,
+        surface: audit.surface,
+        principalId: audit.principalId,
+        action: REPLY_PROVENANCE_ACTION,
+        detail: {
+            id: messageId,
+            platform,
+            connections,
+            ops: [...new Set(reads.map((r) => `${r.connection}/${r.op}`))],
+            reads: reads.length,
+            named: shown?.named.length ?? 0,
+            // How many connections the reach rule withheld from THIS room. A row with `named: 0` and a
+            // non-zero `withheld` is exactly what an operator asking "why does my footer name nothing"
+            // needs to see: the turn read those systems and this room could not be shown them — on a
+            // wake-addressed reply, because they were read under a different wake.
+            withheld: connections.length - (shown?.named.length ?? 0),
+            ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+            ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+        },
+    }).catch(() => undefined);
+}
+/**
+ * The whole per-reply step, in one call both choke points make: read this turn's sources, apply the
+ * reach rule, and hand back the body to post plus the view to audit.
+ *
+ * ONE function because two choke points DRIFTED before over exactly this kind of shared step (see
+ * `recordLandedPost`): a post that footed its sources and an edit that silently stripped them would
+ * make the footer look like a rendering glitch rather than a record.
+ */
+export function applyReplyProvenance(text, audit) {
+    const reads = connectorReadsThisTurn(audit?.turnId);
+    const shown = provenanceForReply(reads, audit, audit?.sessionId, audit?.turnId);
+    return { body: withProvenanceFooter(text, shown), bare: withProvenanceFooter(text, undefined), footer: renderProvenanceFooter(shown), reads, shown };
+}
+//# sourceMappingURL=reply-provenance.js.map