@open-everywhere/core 0.1.0

package/dist/agent/channels/session-park.js

@@ -0,0 +1,170 @@
+// session-park — the LIVENESS remedy for a standing seat that reaches eve's session-token bound. eve does not FAIL there, and that is verified rather than assumed: OE satisfies BOTH of the park arm's disjuncts, because it never passes a non-default `mode` and the send path sets the request-input capability, so the FAIL arm — the sole producer of the session-token-limit code and message — is UNREACHABLE from every OE surface, which is why the send-rejection classifier that used to exist never fired. `scripts/session-park-test.ts` pins the dist fragments structurally. eve instead emits a harness-authored continuation prompt and PARKS the workflow. Nothing answers that prompt, so the parked seat NEVER SPEAKS AGAIN — with no audit row, no notice and no rotation, silence is the failure mode, which is exactly why nothing surfaced it.
+// The remedy RETIRES THE GENERATION rather than inventing a mechanism: it saturates the rotation counter every surface's front already consults before it delivers the next wake, so the seat rotates through its own established path. It never answers the prompt with `continue`, which would grant a fresh budget on the same session and re-park forever, and it does not redeliver the parked message. A session with no `channel_session` row cannot be rotated and gets the audit row with `remedy: "none"`, so the event is visible instead of silent.
+import { appendAudit } from "../audit/audit.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { supervisorRotateTokenBudget } from "./turn-delivery.js";
+import { DM_SEAT_ROTATE_TOKEN_BUDGET } from "./dm-seat.js";
+import { standingSeatRegistryKey } from "./unified-supervisor.js";
+/** eve's synthetic tool name on a harness-authored session-limit continuation prompt
+ *  (harness/session-limit-continuation.js SESSION_LIMIT_CONTINUATION_TOOL_NAME). A STABLE STRING
+ *  CONSTANT, not a minified local — safe to match on, and pinned in session-park-test.ts. */
+export const SESSION_LIMIT_CONTINUATION_TOOL_NAME = "session_limit_continuation";
+/** eve's request-id grammar for the TOKEN-COUNT bounds (`<sessionId>:limit:input|output:<total>`).
+ *
+ *  🔴 NOTHING IN THE DETECTOR CALLS THIS. `detectSessionLimitPark` discriminates on the TOOL NAME
+ *  alone, deliberately, so a future eve that keeps the name and re-shapes the id still detects the
+ *  park. This constant is a PINNED MIRROR of eve's grammar, and `session-park-test.ts` is its only
+ *  consumer: the test asserts OE's source is byte-identical to eve's, so a drift in eve's id shape
+ *  reds there instead of silently rotting a comment. Read it as a drift tripwire, not a live guard —
+ *  an earlier version of this doc called it a "corroborating signal", which implied a runtime read
+ *  that has never existed.
+ *
+ *  🔴 TWO CONSTANTS, NOT ONE ALTERNATION, AND THE FLAGS ARE PART OF THE MIRROR. eve keeps these as
+ *  two separate regexes with DIFFERENT flags — the count arm is `/u`, the cost arm is `/iu`. Folding
+ *  them into one `/…|…/iu` would make OE accept `:LIMIT:INPUT:5`, which eve's own predicate rejects,
+ *  so the tripwire would no longer be a mirror. Keep each arm byte-identical to its eve counterpart
+ *  and OR them in {@link isSessionLimitRequestId}, exactly as eve's predicate does. */
+export const SESSION_LIMIT_REQUEST_ID_RE = /:limit:(?:input|output):\d+$/u;
+/** eve's request-id grammar for the TOKEN-COST bound (eve 0.51.1). A dollar figure, so it may carry
+ *  a decimal point or an exponent — and `i` because eve's own cost pattern carries `i`. */
+export const SESSION_LIMIT_COST_REQUEST_ID_RE = /:limit:token-cost:\d+(?:\.\d+)?(?:e[+-]?\d+)?$/iu;
+/** eve's `isSessionLimitContinuationRequestId`, mirrored: either bound's grammar. */
+export function isSessionLimitRequestId(requestId) {
+    return SESSION_LIMIT_REQUEST_ID_RE.test(requestId) || SESSION_LIMIT_COST_REQUEST_ID_RE.test(requestId);
+}
+/** The durable audit action for "a session parked on eve's token bound". Actions-only log: this is
+ *  the ONE record that a standing seat stopped being able to answer, and (when it applies) that OE
+ *  retired the generation in response — there is no conversation to reconstruct it from. */
+export const SESSION_PARK_AUDIT_ACTION = "session.token_limit_park";
+/**
+ * At most one park row per (org, registry key or token) per window. A seat that CAN rotate parks at most once more before its front re-keys it.
+ * A seat that cannot rotate would otherwise write a row on every subsequent wake.
+ */
+export const PARK_AUDIT_WINDOW_MS = 60 * 60_000;
+/**
+ * The counter delta that RETIRES a standing seat's current generation on the spot. DERIVED, not a magic number: the bump adds to a non-negative total, so adding the LARGEST token budget in the tree guarantees the sum reaches whichever threshold `shouldRotate` is called with. Read at call time, so it tracks any env override.
+ * This is the one place the cumulative-token counter is not a measurement at all: it is a deliberate signal, written by us, meaning "this generation is spent".
+ */
+export function parkRotateDelta() {
+    return Math.max(supervisorRotateTokenBudget(), DM_SEAT_ROTATE_TOKEN_BUDGET);
+}
+function numberOrUndefined(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+/**
+ * Is ONE entry of an `input.requested` batch eve's harness-authored session-limit continuation prompt? THE discrimination between eve's PARK and every other kind of input request, in one place.
+ * TWO CONSUMERS, ONE PREDICATE: the park detector selects the requests this module owns and channels/question-bridge.ts selects the complement, so no request is ever handled twice — or, the failure this closes, by neither. Defensive by design, because it runs on a turn that has already parked, where a shape drift must degrade to a verdict rather than throw.
+ */
+export function isSessionLimitContinuationRequest(request) {
+    if (request === null || typeof request !== "object")
+        return false;
+    return request.action?.toolName === SESSION_LIMIT_CONTINUATION_TOOL_NAME;
+}
+/**
+ * Is this `input.requested` batch eve's session-token-limit park? It returns the violation when it is, and `undefined` for every other input request.
+ * Those are NOT this module's to remedy — the question bridge posts them to the originating surface — and the detector must never claim one.
+ */
+export function detectSessionLimitPark(requests) {
+    if (!Array.isArray(requests))
+        return undefined;
+    for (const r of requests) {
+        if (!isSessionLimitContinuationRequest(r))
+            continue;
+        const req = r;
+        const requestId = typeof req.requestId === "string" ? req.requestId : "";
+        // TWO ACTION-INPUT SHAPES, because eve mints two. A token-COUNT violation carries
+        // `{kind, limit, usedTokens}`; a token-COST violation carries `{kind, limitUsd, usedCostUsd}`
+        // (harness/session-limit-continuation.js, pinned structurally in session-park-test.ts §4).
+        // Read BOTH pairs unconditionally: each is absent on the other kind, so a shape drift that
+        // moved a number degrades to "no number" rather than to a wrong one.
+        const input = (req.action?.input ?? {});
+        const kind = input.kind === "input" || input.kind === "output" || input.kind === "token-cost" ? input.kind : "unknown";
+        const limit = numberOrUndefined(input.limit);
+        const usedTokens = numberOrUndefined(input.usedTokens);
+        const limitUsd = numberOrUndefined(input.limitUsd);
+        const usedCostUsd = numberOrUndefined(input.usedCostUsd);
+        return {
+            kind,
+            ...(limit !== undefined ? { limit } : {}),
+            ...(usedTokens !== undefined ? { usedTokens } : {}),
+            ...(limitUsd !== undefined ? { limitUsd } : {}),
+            ...(usedCostUsd !== undefined ? { usedCostUsd } : {}),
+            requestId,
+        };
+    }
+    return undefined;
+}
+/**
+ * The throttle identity. Both parts are OE-derived: the org, and either a derived registry key or an OE- or eve-minted token.
+ * Never a model- or vendor-supplied string, so a hostile stream cannot mint fresh keys to defeat the throttle.
+ */
+export function parkThrottleKey(registryKey, token) {
+    return `sessionpark:${registryKey ?? `token:${typeof token === "string" ? token : "unknown"}`}`;
+}
+/**
+ * Handle ONE detected session-limit park: retire the standing seat's generation, so the next wake rotates, and write the durable row.
+ * Best-effort throughout, in the house posture: a store or audit failure is logged and swallowed, because this runs inside a hook on a turn that has already parked. The remedy is attempted BEFORE the audit, so the row can report what actually happened.
+ */
+export async function handleSessionLimitPark(scope, park, deps = {}) {
+    const store = deps.store ?? getOperationalStore();
+    const registryKey = standingSeatRegistryKey(scope.token, scope.domainKey);
+    const token = typeof scope.token === "string" ? scope.token : undefined;
+    let remedy = "none";
+    if (registryKey !== undefined && token !== undefined) {
+        try {
+            const matched = await store.bumpChannelSessionUsage(scope.org, registryKey, token, parkRotateDelta());
+            remedy = matched > 0 ? "rotate_on_next_wake" : "already_rotated";
+        }
+        catch (err) {
+            // The remedy failed, but the row below still records the park — a park we know about and
+            // could not remedy is exactly the case an operator must be able to see.
+            console.warn(`[open-everywhere:session-park] generation retire failed for ${registryKey}: ${String(err)}`);
+            remedy = "already_rotated";
+        }
+    }
+    const nowIso = (deps.now?.() ?? new Date()).toISOString();
+    const throttleKey = parkThrottleKey(registryKey, scope.token);
+    // FAIL-OPEN on a throttle-store error — emit the row (routines/fire-audit.ts's rationale: the
+    // throttle and the append hit the same store, so failing closed would silence a genuine event).
+    let first = true;
+    try {
+        first = await store.markEventSeen(scope.org, throttleKey, nowIso, PARK_AUDIT_WINDOW_MS);
+    }
+    catch {
+        first = true;
+    }
+    if (!first)
+        return { remedy, ...(registryKey !== undefined ? { registryKey } : {}), audited: false };
+    await (deps.audit ?? appendAudit)({
+        org: scope.org,
+        platform: scope.platform,
+        workspace: scope.workspace,
+        surface: scope.surface,
+        // No acting human — eve's harness parked the turn — so a synthetic, low-cardinality service
+        // identity, the same posture routines/fire-audit.ts takes for an autonomous fire.
+        principalId: "eve:harness",
+        action: SESSION_PARK_AUDIT_ACTION,
+        detail: {
+            // Ids, counts and OE-controlled enums only. eve's `prompt` text is NOT carried.
+            remedy,
+            kind: park.kind,
+            requestId: park.requestId,
+            ...(park.limit !== undefined ? { limit: park.limit } : {}),
+            ...(park.usedTokens !== undefined ? { usedTokens: park.usedTokens } : {}),
+            // The COST bound's own pair. The action name stays `session.token_limit_park` for all three
+            // bounds — one action, one query — and `kind` is what tells a spend park from a token park.
+            ...(park.limitUsd !== undefined ? { limitUsd: park.limitUsd } : {}),
+            ...(park.usedCostUsd !== undefined ? { usedCostUsd: park.usedCostUsd } : {}),
+            ...(scope.sessionId !== undefined ? { sessionId: scope.sessionId } : {}),
+            ...(registryKey !== undefined ? { registryKey } : {}),
+            ...(token !== undefined ? { token } : {}),
+            note: remedy === "rotate_on_next_wake"
+                ? "the seat's generation was retired — the next wake rotates to a fresh session; the parked message was NOT redelivered"
+                : remedy === "already_rotated"
+                    ? "no live registry row matched this token — the generation had already been retired/rotated"
+                    : "this session has no channel_session row (thread seat / task / native) — it cannot be rotated and will not answer again; start a fresh thread",
+        },
+    }).catch(() => undefined);
+    return { remedy, ...(registryKey !== undefined ? { registryKey } : {}), audited: true };
+}
+//# sourceMappingURL=session-park.js.map

package/dist/agent/channels/session-park.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-park.js","sourceRoot":"","sources":["../../../agent/channels/session-park.ts"],"names":[],"mappings":"AAAA,w0BAAw0B;AACx0B,giBAAgiB;AAEhiB,OAAO,EAAE,WAAW,EAAmB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE;;6FAE6F;AAC7F,MAAM,CAAC,MAAM,oCAAoC,GAAG,4BAA4B,CAAC;AAEjF;;;;;;;;;;;;;;uFAcuF;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAE3E;2FAC2F;AAC3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,kDAAkD,CAAC;AAEnG,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACzG,CAAC;AAED;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAEpE;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,EAAE,2BAA2B,CAAC,CAAC;AAC9E,CAAC;AAuBD,SAAS,iBAAiB,CAAC,CAAU;IACnC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClE,OAAQ,OAA+C,CAAC,MAAM,EAAE,QAAQ,KAAK,oCAAoC,CAAC;AACpH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAA8B,EAAE,CAAC;QAC/C,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAAE,SAAS;QACpD,MAAM,GAAG,GAAG,CAA8E,CAAC;QAC3F,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,kFAAkF;QAClF,8FAA8F;QAC9F,2FAA2F;QAC3F,2FAA2F;QAC3F,qEAAqE;QACrE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAMrC,CAAC;QACF,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO;YACL,IAAI;YACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,SAAS;SACV,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA4CD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,WAA+B,EAAE,KAAc;IAC7E,OAAO,eAAe,WAAW,IAAI,SAAS,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAgB,EAAE,IAAsB,EAAE,IAAI,GAAa,EAAE;IACxG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC;IAClD,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAExE,IAAI,MAAM,GAAe,MAAM,CAAC;IAChC,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yFAAyF;YACzF,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC,+DAA+D,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3G,MAAM,GAAG,iBAAiB,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,8FAA8F;IAC9F,gGAAgG;IAChG,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAErG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;QAChC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,4FAA4F;QAC5F,kFAAkF;QAClF,WAAW,EAAE,aAAa;QAC1B,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE;YACN,gFAAgF;YAChF,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,4FAA4F;YAC5F,4FAA4F;YAC5F,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,EACF,MAAM,KAAK,qBAAqB;gBAC9B,CAAC,CAAC,sHAAsH;gBACxH,CAAC,CAAC,MAAM,KAAK,iBAAiB;oBAC5B,CAAC,CAAC,2FAA2F;oBAC7F,CAAC,CAAC,8IAA8I;SACvJ;KACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE1B,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1F,CAAC"}

package/dist/agent/channels/session-resume.d.ts

@@ -0,0 +1,26 @@
+/** eve's message for a run whose event ids the current runtime cannot read positions out of. The
+ *  ONE such string in the installed eve dist (0.38.3, compiled/_chunks/workflow) — matched as a
+ *  substring so the variable event id in the middle of the sentence does not defeat it. */
+export declare const UNREADABLE_WORLD_MESSAGE = "This World allocates event positions the runtime cannot read";
+/** The narrower half of the same sentence. Kept as a SECOND required marker rather than a second
+ *  accepted alternative: both must appear, so a future message that merely mentions a slot number in
+ *  another context cannot trip the classifier on its own. */
+export declare const SLOT_NUMBERED_MARKER = "not slot-numbered";
+/**
+ * eve's stable error CODE for a fatal break of the World contract the runtime needs.
+ * eve redelivers a RECOVERABLE world blip down a different path, so this code denotes the non-retryable half of the world-error family.
+ */
+export declare const WORLD_CONTRACT_ERROR_CODE = "WORLD_CONTRACT_ERROR";
+/**
+ * Is this failure the UNRESUMABLE class — a session no retry can resume? Pure, total and fail-soft: a non-string message classifies FALSE, because a true verdict throws away a window's accumulated context.
+ * Two independent positives: the message carries BOTH markers of the unreadable-World sentence, or the code is eve's `WORLD_CONTRACT_ERROR`. Nothing else matches.
+ */
+export declare function isUnresumableSessionError(message: unknown, code?: unknown): boolean;
+/**
+ * The audit `detail` fragment that LABELS a failure row with this verdict, spread into the existing supervisor failure rows so the class is queryable without a new action.
+ * Always present, never conditional: `unresumable: false` states that OE looked and said no, where an absent field would read as "not measured".
+ */
+export declare function unresumableAuditDetail(message: unknown, code?: unknown): {
+    unresumable: boolean;
+};
+//# sourceMappingURL=session-resume.d.ts.map

package/dist/agent/channels/session-resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume.d.ts","sourceRoot":"","sources":["../../../agent/channels/session-resume.ts"],"names":[],"mappings":"AAGA;;2FAE2F;AAC3F,eAAO,MAAM,wBAAwB,iEAAiE,CAAC;AAEvG;;6DAE6D;AAC7D,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAInF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG;IAAE,WAAW,EAAE,OAAO,CAAA;CAAE,CAEjG"}

package/dist/agent/channels/session-resume.js

@@ -0,0 +1,34 @@
+// session-resume — the classifier for a durable session the current eve runtime can NEVER resume, as opposed to one that failed once and would succeed on a retry. The condition is permanent, so it wants a new generation, not a retry.
+// This seam never sees the failure itself: it throws in the queue-triggered turn, below eve's harness, and emits no userland event. The remedy is pre-dispatch rotation in channels/runtime-rotation.ts.
+/** eve's message for a run whose event ids the current runtime cannot read positions out of. The
+ *  ONE such string in the installed eve dist (0.38.3, compiled/_chunks/workflow) — matched as a
+ *  substring so the variable event id in the middle of the sentence does not defeat it. */
+export const UNREADABLE_WORLD_MESSAGE = "This World allocates event positions the runtime cannot read";
+/** The narrower half of the same sentence. Kept as a SECOND required marker rather than a second
+ *  accepted alternative: both must appear, so a future message that merely mentions a slot number in
+ *  another context cannot trip the classifier on its own. */
+export const SLOT_NUMBERED_MARKER = "not slot-numbered";
+/**
+ * eve's stable error CODE for a fatal break of the World contract the runtime needs.
+ * eve redelivers a RECOVERABLE world blip down a different path, so this code denotes the non-retryable half of the world-error family.
+ */
+export const WORLD_CONTRACT_ERROR_CODE = "WORLD_CONTRACT_ERROR";
+/**
+ * Is this failure the UNRESUMABLE class — a session no retry can resume? Pure, total and fail-soft: a non-string message classifies FALSE, because a true verdict throws away a window's accumulated context.
+ * Two independent positives: the message carries BOTH markers of the unreadable-World sentence, or the code is eve's `WORLD_CONTRACT_ERROR`. Nothing else matches.
+ */
+export function isUnresumableSessionError(message, code) {
+    if (typeof code === "string" && code === WORLD_CONTRACT_ERROR_CODE)
+        return true;
+    if (typeof message !== "string" || message.length === 0)
+        return false;
+    return message.includes(UNREADABLE_WORLD_MESSAGE) && message.includes(SLOT_NUMBERED_MARKER);
+}
+/**
+ * The audit `detail` fragment that LABELS a failure row with this verdict, spread into the existing supervisor failure rows so the class is queryable without a new action.
+ * Always present, never conditional: `unresumable: false` states that OE looked and said no, where an absent field would read as "not measured".
+ */
+export function unresumableAuditDetail(message, code) {
+    return { unresumable: isUnresumableSessionError(message, code) };
+}
+//# sourceMappingURL=session-resume.js.map

package/dist/agent/channels/session-resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume.js","sourceRoot":"","sources":["../../../agent/channels/session-resume.ts"],"names":[],"mappings":"AAAA,0OAA0O;AAC1O,yMAAyM;AAEzM;;2FAE2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,8DAA8D,CAAC;AAEvG;;6DAE6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,IAAc;IACxE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC9F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,IAAc;IACrE,OAAO,EAAE,WAAW,EAAE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AACnE,CAAC"}

package/dist/agent/channels/session-tail-record.d.ts

@@ -0,0 +1,65 @@
+import type { OperationalStore } from "../operational/store.js";
+import { type SessionTailWakeRow } from "./session-tail.js";
+import type { WakeMessageInput } from "./wake-envelope.js";
+/** What the workflow process needs to know to file a post against the right generation. Seeded once
+ *  per turn from the turn-start hook, which is the only place holding a live context. */
+export interface TailWindow {
+    readonly org: string;
+    /** The `channel_session` registry key — the same key the spend hook's counter bump targets. */
+    readonly registryKey: string;
+    /** The generation's bare continuation token. It is the ring's partition, so a straggler post from
+     *  a retired generation files under the retired token and is simply never read again. */
+    readonly token: string;
+    readonly platform?: string;
+    /** WHICH ROOM this turn is happening in — the per-container surface key. On a cross-surface window
+     *  it is what stops the seat's own posts merging into one undifferentiated stream. */
+    readonly container?: string;
+}
+/**
+ * WHICH GENERATION, if any, this turn files its posts against — the ONE rule that decides it, kept PURE so it is testable without a live turn. Only a STANDING grain gets a window: a task worker, a thread seat, a native/DM/subagent session and any foreign or unparseable token all answer `null`.
+ * The grain test is deliberately NOT `isSupervisorToken`: a delegated worker's TASK WINDOW token carries that substring, and recording its posts would file them on a ring no rotation ever reads. `rawToken` is eve's continuation token verbatim — the namespace strip is this function's job, not the caller's.
+ */
+export declare function tailWindowFor(input: {
+    readonly org: string;
+    readonly domainKey: string;
+    /** The PER-CONTAINER surface key, not the registry key: on a cross-surface window the registry row
+     *  is one domain but the rooms are many, and this is what tells them apart. */
+    readonly surfaceKey: string;
+    readonly rawToken: unknown;
+    readonly platform?: string;
+}): TailWindow | null;
+/** Seed the per-turn window facts. Called from the turn-start hook. Silently does nothing outside a
+ *  session context (a sessionless schedule, an eval) — those runs have no seat to record for. */
+export declare function seedTailWindow(w: TailWindow | null): void;
+/** The seeded window, or null. Exported for tests. */
+export declare function tailWindow(): TailWindow | null;
+/**
+ * Record ONE delivered wake message onto the outgoing generation's ring (ingress process).
+ * `entry` is built by the caller from the trigger it already holds, so this function makes no judgement about trust, authorship or visibility: re-deciding any of it here would be a second opinion that can disagree with the first.
+ * 🔴 THE ROW TYPE REQUIRES `refuted` (OPE-1747, {@link SessionTailWakeRow}). A record site that cannot name its author's refutation does not compile, which is what makes the author grain reach EVERY surface's tail rather than the one surface that remembered. Resolve it through `tailAuthorGrain` over the same facts the taint join reads — never by hand, and never by omitting the field, which the read path takes as UNGRADED.
+ */
+export declare function recordWakeTail(org: string, registryKey: string, token: string, entry: SessionTailWakeRow, store?: OperationalStore): Promise<void>;
+/**
+ * Record ONE post the seat actually made (workflow process, from the choke point's success path). A post is always `from: "self"` and `trust: "relay"`, the machine-author floor — never raised for being the agent's own words, because the tier says who authored the bytes.
+ * It has exactly TWO callers, both SHARED seams rather than per-surface wiring, and a new post path that reaches neither must call this itself. `id` is what lets a confirmed `edit_reply` rewrite this exact entry, `wake` says which wake the post answered, and the function does nothing when no window is seeded.
+ */
+export declare function recordPostTail(post: {
+    readonly text: string;
+    readonly at: string;
+    readonly platform?: string;
+    readonly id?: string;
+    readonly wake?: string;
+}, store?: OperationalStore): Promise<void>;
+/**
+ * Rewrite the TEXT of the ring row a confirmed `edit_reply` just changed on the platform — the confirmed-success path ONLY, never a definitive refusal and never an ambiguous outcome, which does not know whether the platform changed anything.
+ * The ring is the seat's own record of the room, so once the room's copy changes the ring's copy must change with it. Matched by `messageId` against the ring's `post` rows, so {@link recordPostTail} threading `id` through is the precondition. Best-effort and silent on a miss.
+ */
+export declare function editPostTail(messageId: string, text: string, store?: OperationalStore): Promise<boolean>;
+/**
+ * THE ROTATION READ (ingress process): take the OUTGOING generation's recorded tail, capped and rendered, and drop its ring. Call it with the token of the generation being RETIRED, before minting its successor.
+ * It returns the wake messages the fresh generation's first wake should carry, oldest-first, or `[]` — the caller's signal to fall back to a capped platform fetch. The ring is CLEARED after the read: it has served its only purpose, and the next generation is already writing its own under a different token.
+ *
+ * 🔴 IT IS ALSO THE ROTATION NOTICE (OPE-627). Every standing seat's rotate leg calls this function, with the token of the generation it is about to retire, and it is the ONE seam that holds that token — so it is where {@link noteGenerationForRetirement} learns which generation is owed a reap of its parked workers. The note is in-memory, costs no I/O, and is a no-op for a per-container token; channels/generation-retirement.ts carries the whole design and the three guards that decide whether the retirement is actually issued. Placed BEFORE the tail read, so a store failure that loses the tail does not also lose the retirement.
+ */
+export declare function carryTailForward(org: string, registryKey: string, outgoingToken: string | undefined, store?: OperationalStore): Promise<WakeMessageInput[]>;
+//# sourceMappingURL=session-tail-record.d.ts.map

package/dist/agent/channels/session-tail-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tail-record.d.ts","sourceRoot":"","sources":["../../../agent/channels/session-tail-record.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAa,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,oBAAoB,CAAC;AAEtE;yFACyF;AACzF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;6FACyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;0FACsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;mFAC+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,UAAU,GAAG,IAAI,CAUpB;AAED;iGACiG;AACjG,wBAAgB,cAAc,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,IAAI,CAMzD;AAED,sDAAsD;AACtD,wBAAgB,UAAU,IAAI,UAAU,GAAG,IAAI,CAM9C;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,kBAAkB,EACzB,KAAK,GAAE,gBAAwC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IACJ,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,EACD,KAAK,GAAE,gBAAwC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,gBAAwC,GAAG,OAAO,CAAC,OAAO,CAAC,CASrI;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,GAAE,gBAAwC,GAC9C,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAe7B"}

package/dist/agent/channels/session-tail-record.js

@@ -0,0 +1,129 @@
+// session-tail-record — the two WRITERS behind the standing-seat tail. channels/session-tail.ts owns what a tail IS and how it renders; this file owns how it gets recorded.
+// Two seams in two processes, by design: {@link recordWakeTail} runs in the INGRESS process on the structured trigger message, so a tail never inherits a rendered block, and {@link recordPostTail} runs in the WORKFLOW process only AFTER the surface accepted the post, so a reply the arm refused leaves no memory of having been said. Both are BEST-EFFORT and never throw into a caller — a lost entry costs a little continuity, a throw would cost a wake or a post.
+import { defineState } from "eve/context";
+import { getOperationalStore } from "../operational/provider.js";
+import { noteGenerationForRetirement } from "./generation-retirement.js";
+import { buildTail } from "./session-tail.js";
+import { standingSeatRegistryKey } from "./unified-supervisor.js";
+import { bareTokenFromEveContext, classifySessionId } from "./window-key.js";
+const windowSlot = defineState("open-everywhere.session-tail-window", () => null);
+/**
+ * WHICH GENERATION, if any, this turn files its posts against — the ONE rule that decides it, kept PURE so it is testable without a live turn. Only a STANDING grain gets a window: a task worker, a thread seat, a native/DM/subagent session and any foreign or unparseable token all answer `null`.
+ * The grain test is deliberately NOT `isSupervisorToken`: a delegated worker's TASK WINDOW token carries that substring, and recording its posts would file them on a ring no rotation ever reads. `rawToken` is eve's continuation token verbatim — the namespace strip is this function's job, not the caller's.
+ */
+export function tailWindowFor(input) {
+    const token = bareTokenFromEveContext(input.rawToken);
+    if (token === undefined || classifySessionId(token).grain !== "standing")
+        return null;
+    return {
+        org: input.org,
+        registryKey: standingSeatRegistryKey(token, input.domainKey) ?? input.domainKey,
+        token,
+        ...(input.platform ? { platform: input.platform } : {}),
+        container: input.surfaceKey,
+    };
+}
+/** Seed the per-turn window facts. Called from the turn-start hook. Silently does nothing outside a
+ *  session context (a sessionless schedule, an eval) — those runs have no seat to record for. */
+export function seedTailWindow(w) {
+    try {
+        windowSlot.update(() => w);
+    }
+    catch {
+        /* no session context — nothing to seed */
+    }
+}
+/** The seeded window, or null. Exported for tests. */
+export function tailWindow() {
+    try {
+        return windowSlot.get();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Record ONE delivered wake message onto the outgoing generation's ring (ingress process).
+ * `entry` is built by the caller from the trigger it already holds, so this function makes no judgement about trust, authorship or visibility: re-deciding any of it here would be a second opinion that can disagree with the first.
+ * 🔴 THE ROW TYPE REQUIRES `refuted` (OPE-1747, {@link SessionTailWakeRow}). A record site that cannot name its author's refutation does not compile, which is what makes the author grain reach EVERY surface's tail rather than the one surface that remembered. Resolve it through `tailAuthorGrain` over the same facts the taint join reads — never by hand, and never by omitting the field, which the read path takes as UNGRADED.
+ */
+export async function recordWakeTail(org, registryKey, token, entry, store = getOperationalStore()) {
+    try {
+        await store.appendSessionTail(org, registryKey, token, entry);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:session-tail] wake entry not recorded (${registryKey}): ${String(err)}`);
+    }
+}
+/**
+ * Record ONE post the seat actually made (workflow process, from the choke point's success path). A post is always `from: "self"` and `trust: "relay"`, the machine-author floor — never raised for being the agent's own words, because the tier says who authored the bytes.
+ * It has exactly TWO callers, both SHARED seams rather than per-surface wiring, and a new post path that reaches neither must call this itself. `id` is what lets a confirmed `edit_reply` rewrite this exact entry, `wake` says which wake the post answered, and the function does nothing when no window is seeded.
+ */
+export async function recordPostTail(post, store = getOperationalStore()) {
+    const w = tailWindow();
+    if (!w)
+        return;
+    try {
+        await store.appendSessionTail(w.org, w.registryKey, w.token, {
+            kind: "post",
+            at: post.at,
+            from: "self",
+            trust: "relay",
+            // GRADED, and the answer is always the same one (OPE-1747): the seat's own words, authored by
+            // this deployment. Written rather than omitted because an omitted `refuted` reads as UNGRADED,
+            // and a post row that read as ungraded would have the seat's own replies withheld from its
+            // successor generation under `authorGrain: "withhold"`.
+            refuted: false,
+            author: "self",
+            ...(post.platform ?? w.platform ? { platform: post.platform ?? w.platform } : {}),
+            ...(w.container ? { container: w.container } : {}),
+            ...(post.id ? { id: post.id } : {}),
+            ...(post.wake ? { wake: post.wake } : {}),
+            text: post.text,
+        });
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:session-tail] post entry not recorded (${w.registryKey}): ${String(err)}`);
+    }
+}
+/**
+ * Rewrite the TEXT of the ring row a confirmed `edit_reply` just changed on the platform — the confirmed-success path ONLY, never a definitive refusal and never an ambiguous outcome, which does not know whether the platform changed anything.
+ * The ring is the seat's own record of the room, so once the room's copy changes the ring's copy must change with it. Matched by `messageId` against the ring's `post` rows, so {@link recordPostTail} threading `id` through is the precondition. Best-effort and silent on a miss.
+ */
+export async function editPostTail(messageId, text, store = getOperationalStore()) {
+    const w = tailWindow();
+    if (!w)
+        return false;
+    try {
+        return await store.editSessionTailPost(w.org, w.registryKey, w.token, messageId, text);
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:session-tail] post entry not edited (${w.registryKey}): ${String(err)}`);
+        return false;
+    }
+}
+/**
+ * THE ROTATION READ (ingress process): take the OUTGOING generation's recorded tail, capped and rendered, and drop its ring. Call it with the token of the generation being RETIRED, before minting its successor.
+ * It returns the wake messages the fresh generation's first wake should carry, oldest-first, or `[]` — the caller's signal to fall back to a capped platform fetch. The ring is CLEARED after the read: it has served its only purpose, and the next generation is already writing its own under a different token.
+ *
+ * 🔴 IT IS ALSO THE ROTATION NOTICE (OPE-627). Every standing seat's rotate leg calls this function, with the token of the generation it is about to retire, and it is the ONE seam that holds that token — so it is where {@link noteGenerationForRetirement} learns which generation is owed a reap of its parked workers. The note is in-memory, costs no I/O, and is a no-op for a per-container token; channels/generation-retirement.ts carries the whole design and the three guards that decide whether the retirement is actually issued. Placed BEFORE the tail read, so a store failure that loses the tail does not also lose the retirement.
+ */
+export async function carryTailForward(org, registryKey, outgoingToken, store = getOperationalStore()) {
+    if (!outgoingToken)
+        return [];
+    noteGenerationForRetirement({ org, registryKey, token: outgoingToken });
+    try {
+        const ring = await store.readSessionTail(org, registryKey, outgoingToken);
+        const tail = buildTail(ring);
+        // Cleared AFTER the render, not before: a throw in buildTail would otherwise drop the ring and
+        // lose the tail with no way back. Its own catch — a failed clear costs a bounded number of rows
+        // that nothing reads, which is not worth failing a wake for.
+        await store.clearSessionTail(org, registryKey, outgoingToken).catch(() => { });
+        return tail;
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:session-tail] tail not carried forward (${registryKey}): ${String(err)}`);
+        return []; // fail SOFT to the platform-fetch fallback — a rotation never waits on the tail
+    }
+}
+//# sourceMappingURL=session-tail-record.js.map

package/dist/agent/channels/session-tail-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tail-record.js","sourceRoot":"","sources":["../../../agent/channels/session-tail-record.ts"],"names":[],"mappings":"AAAA,6KAA6K;AAC7K,+cAA+c;AAE/c,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,SAAS,EAA2B,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAkB7E,MAAM,UAAU,GAAG,WAAW,CAAoB,qCAAqC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAErG;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAQ7B;IACC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,WAAW,EAAE,uBAAuB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS;QAC/E,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,SAAS,EAAE,KAAK,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,cAAc,CAAC,CAAoB;IACjD,IAAI,CAAC;QACH,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,WAAmB,EACnB,KAAa,EACb,KAAyB,EACzB,KAAK,GAAqB,mBAAmB,EAAE;IAE/C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2DAA2D,WAAW,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAMC,EACD,KAAK,GAAqB,mBAAmB,EAAE;IAE/C,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE;YAC3D,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,OAA2B;YAClC,8FAA8F;YAC9F,+FAA+F;YAC/F,2FAA2F;YAC3F,wDAAwD;YACxD,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC,WAAW,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAiB,EAAE,IAAY,EAAE,KAAK,GAAqB,mBAAmB,EAAE;IACjH,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC,WAAW,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,WAAmB,EACnB,aAAiC,EACjC,KAAK,GAAqB,mBAAmB,EAAE;IAE/C,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAC9B,2BAA2B,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,+FAA+F;QAC/F,gGAAgG;QAChG,6DAA6D;QAC7D,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,4DAA4D,WAAW,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,CAAC,CAAC,gFAAgF;IAC7F,CAAC;AACH,CAAC"}

package/dist/agent/channels/session-tail.d.ts

@@ -0,0 +1,90 @@
+import type { WakeMessageInput, WakeTrust } from "./wake-envelope.js";
+import type { IngestedChatMessage } from "../access/taint-signal.js";
+import type { AuthorTrustQuery } from "../identity/author-trust.js";
+/**
+ * One recorded conversational event on a standing seat's generation.
+ * Deliberately FLAT and small: it is stored as JSON in an operational row, so every field has to survive a round-trip through the store with no adapter knowledge. It carries the facts a wake render needs and nothing else.
+ */
+export interface SessionTailEntry {
+    /** `wake` = a message the room sent that woke the seat; `post` = the seat's own reply. */
+    readonly kind: "wake" | "post";
+    /** ISO-8601 of the event. The ONLY ordering key — one window's ring is one timeline. */
+    readonly at: string;
+    /** Who authored it. A `post` is always `self`; a `wake` is `human` or `bot`. */
+    readonly from: "self" | "human" | "bot";
+    /** The trust tier resolved at ingestion. A `post` is `relay` (a machine author, the floor). */
+    readonly trust: WakeTrust;
+    /**
+     * The surface POSITIVELY REFUTED this author's membership, as {@link IngestedChatMessage.refuted} means it (OPE-1747). Written at EVERY record site through {@link tailAuthorGrain}, so it is present — `true` OR `false` — on every row this deployment records.
+     * 🔴 ABSENT IS NOT "NOT REFUTED". It means the row was written before the field existed, so the author was never graded at all, and `withholdsBody` (access/external-policy.ts) reads that UNKNOWN as the fail-closed answer under `authorGrain: "withhold"`. That is the whole reason the field is written even when the answer is `false`: a present `false` is a graded answer, and only a MISSING field is unknown.
+     */
+    readonly refuted?: boolean;
+    /** The OPERATOR's author-trust register query for this row's author — Discord's and Notion's only per-author refutation, since neither surface can answer the membership question itself. Read by the taint join and by the withhold grain, exactly as it is off a {@link WakeMessageInput}. Absent is normal: most surfaces have a verdict of their own and every unarmed tenant contributes nothing. */
+    readonly authorTrust?: AuthorTrustQuery;
+    /** Display name for the render's `author` attribute. Falls back to the raw id at the caller. */
+    readonly author: string;
+    /** Raw platform author id, where the surface knows one (absent on the seat's own posts). */
+    readonly authorId?: string;
+    /** Platform message id, where the surface knows one. */
+    readonly id?: string;
+    /**
+     * WHICH WAKE THIS POST ANSWERED — `post` rows only. A `wake` row never carries it, because the ring's wake rows are messages from the room and the OE wake id is not one of their facts.
+     * It exists for ONE reader, the should-be-edit policy, which must not tell a turn to fold its answer to one question into the message that answers another. Absent on an older row and on the per-surface reply path, and absent reads as "unknown".
+     */
+    readonly wake?: string;
+    /** The surface this happened on — the reason one ring can hold a whole cross-surface domain. */
+    readonly platform?: string;
+    /**
+     * WHICH ROOM it was said in — the container's surface key, rendered as the message's `container` attribute.
+     * It is the cross-surface context-bleed guard on a flat tail: one window can hold several rooms, and a seat that cannot tell them apart can answer into the wrong one.
+     */
+    readonly container?: string;
+    /** The thread ROOT id when this happened inside a thread. */
+    readonly threadRoot?: string;
+    /** The message text. Untrusted by provenance; the wake renderer wraps and escapes it. */
+    readonly text: string;
+}
+/**
+ * A row at a RECORD site: {@link SessionTailEntry} with `refuted` REQUIRED (OPE-1747).
+ * 🔴 REQUIRED HERE, OPTIONAL ON THE READ SHAPE, AND THAT ASYMMETRY IS THE WHOLE DESIGN. The read shape must tolerate a row persisted before the field existed, so it cannot require the field; a WRITER always knows the answer, so it must not be allowed to omit it. `typecheck:all` is then the parity gate: a surface that records a wake without resolving its author's refutation does not compile.
+ */
+export type SessionTailWakeRow = Omit<SessionTailEntry, "refuted"> & {
+    readonly refuted: boolean;
+};
+/**
+ * THE ONE ROAD every tail record site resolves its author grain through (OPE-1747) — read straight off the SAME {@link IngestedChatMessage} facts the surface already handed the taint join, so a tail row and the join can never disagree about one author.
+ * Before this existed no record site wrote either field, so `tailEntryToWakeMessage` handed `withholdsBody` neither, `nonMemberChatTrust` had nothing to answer with, and a refuted author's bytes reached the model out of a tail-built envelope on a deployment that had declared they must not.
+ * `refuted` is NORMALISED to a boolean on purpose: a graded "no" must be recorded as `false` rather than omitted, because an omitted field is what the read path reads as UNKNOWN. `authorTrust` stays omitted when the surface has none — there the absence is honest, and both the join and the withhold grain already read a missing register as "contributes nothing".
+ */
+export declare function tailAuthorGrain(facts: IngestedChatMessage): {
+    readonly refuted: boolean;
+    readonly authorTrust?: AuthorTrustQuery;
+};
+/** Hard ceiling on ring rows kept per generation. It is a STORAGE bound, not the context bound —
+ *  {@link selectTail}'s token cap is what decides how much reaches the model. Sized so the cap is
+ *  always the binding constraint for any realistic message length. */
+export declare const SESSION_TAIL_MAX_ENTRIES = 200;
+/** The rendered token cost of one entry, by the proxy above. Pure. */
+export declare function approxEntryTokens(e: SessionTailEntry): number;
+/** The shipped tail cap in tokens. A FUNCTION, not a const: a module-load read in core runs before
+ *  `registerSettings`, so a const could never see an app override (the OPE-409 rule). */
+export declare function tailTokenCap(): number;
+/**
+ * Select the tail that fits the cap: walk the ring NEWEST-FIRST, keep entries while they fit, and return what survived in OLDEST-FIRST order, ready to render.
+ * Most-recent-first selection is the whole policy — no clustering, no spine, no enrichment reachback, no session grouping. It ALWAYS keeps at least one entry when the ring is non-empty, so a single oversized message degrades to "one message" rather than to silence.
+ */
+export declare function selectTail(ring: readonly SessionTailEntry[], capTokens?: number): SessionTailEntry[];
+/**
+ * Map one recorded entry onto the wake envelope's {@link WakeMessageInput}. The seat's own post renders `from="self"`, which is what makes the tail read as ITS OWN conversation rather than as channel documentation it happens to hold: a fenced line presents the agent's words as established content with no history, and the agent then quotes its own wording back as a document instead of owning the act.
+ * `trigger` is never set here — a tail entry is context, and the ONE trigger of a wake is the live message that woke it.
+ *
+ * 🔴 IT CARRIES THE AUTHOR GRAIN ACROSS (OPE-1747), so a tail-built envelope is judged by the same two legs a freshly-fetched one is: `refuted` for the surface's own verdict, `authorTrust` for the operator's register. Until it did, `withholdsBody` answered false on every tail sibling and a refuted author's bytes reached the model on a deployment that declared they must not.
+ * A row with NO `refuted` field was written before that field existed, so its author was never graded. It rides as `ungraded: true` — the fail-closed input for the withhold grain, and deliberately NOT `refuted: true`, which would be a claim about the author that nothing measured and would mark the turn on the shipped `taint` grain. A `post` row is exempt by its tier: the seat's own words are `relay`, the machine floor, which every leg refuses to grade.
+ */
+export declare function tailEntryToWakeMessage(e: SessionTailEntry): WakeMessageInput;
+/**
+ * The whole core in one call: order the ring, cap it, and emit oldest-first wake messages.
+ * The sort by `at` is NOT redundant with the store's ordering: one window's ring takes writes from two processes, so insertion order can differ from real time by the width of that race, and the rendered tail must read as a conversation.
+ */
+export declare function buildTail(ring: readonly SessionTailEntry[], capTokens?: number): WakeMessageInput[];
+//# sourceMappingURL=session-tail.d.ts.map

package/dist/agent/channels/session-tail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-tail.d.ts","sourceRoot":"","sources":["../../../agent/channels/session-tail.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;IACxC,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,0YAA0Y;IAC1Y,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,gGAAgG;IAChG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnG;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAElI;AAED;;sEAEsE;AACtE,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAW5C,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED;yFACyF;AACzF,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EAAE,SAAS,GAAE,MAAuB,GAAG,gBAAgB,EAAE,CAUpH;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,CAe5E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,gBAAgB,EAAE,EAAE,SAAS,GAAE,MAAuB,GAAG,gBAAgB,EAAE,CAGnH"}