@open-everywhere/core 0.1.0

package/dist/agent/hooks/spawn-taint.js

@@ -0,0 +1,1200 @@
+// The turn boundary lives in ONE hook file because eve gives no ordering guarantee BETWEEN hook files: the reset must provably precede every taint seed.
+// Any future taint producer that fires at turn.started must be an attribute in TAINT_SEED_ATTRS, never a markUntrustedIngestedThisTurn call in another hook file.
+import { defineHook } from "eve/hooks";
+import { defineState } from "eve/context";
+import { OE_SPAWN_TAINTED_ATTR } from "../channels/unified.js";
+import { beginTaintTurn, markUntrustedIngestedThisTurn, registerTaintFlipObserver, registerTaintKindObserver, taintKindsThisTurn, untrustedIngestedThisTurn, OE_TAINTED_FIRE_ATTR, OE_CHAT_NONMEMBER_ATTR, } from "../access/taint-signal.js";
+import { INGESTION_KINDS } from "../access/taint-tiers.js";
+import { markSubagentTainted, claimSubagentCallClean, markSubagentCallTainted, subagentCallTaintRecord, rememberTaskCall, rememberTaskAgent, taskCallLink, taskAgentLink, } from "../access/subagent-taint.js";
+import { readDelegationFailure, readTaskReceipt, taskNotificationFailure, taskNotificationStartsWithTerminal, taskViewsOf, terminalTaskNotifications, terminalTaskViewsOf, } from "../access/background-tasks.js";
+import { JOB_TAINT_ATTR } from "../access/job-posture.js";
+import { beginTaintVerdictTurn, registerTaintVerdictSink, taintEnabled, taintMode } from "../access/taint-enforcement.js";
+import { appendAudit } from "../audit/audit.js";
+import { auditErrorDetail, auditErrorFrames } from "../audit/tool-action.js";
+import { bindFrom, currentSessionId, currentTurnId, deliveryStampOf, deploymentOrg, inheritedWakeStampOf, isSubagentChildContext, isUnifiedWindowContext, } from "../identity/binding.js";
+import { resolveOwnWindowToken } from "../access/delegation-mount.js";
+import { advanceDelegatedTaskWake, delegatedTaskDispatchAuthority, installTaskWake, openTaskWake, rememberDelegatedTaskBinding, rememberDelegatedTaskWake } from "../channels/task-wake.js";
+import { noteTurnBoundary, taskWakeThisTurn, uningressedTurn } from "../access/task-wake-signal.js";
+import { clearStreamDropRetries, streamDropRetriesThisTurn } from "../model/stream-drop-retry.js";
+import { addressedWakeThisTurn, exactDispatchWakeThisTurn, noteTaskDispatchedThisTurn } from "../access/dispatch-origin-signal.js";
+import { requesterThisTurn } from "../access/requester-identity.js";
+import { noteSettlementDispatchAuthority, settlementDispatchAuthorityThisTurn } from "../access/settlement-dispatch-signal.js";
+import { claimPromisedReport, notePendingDelegation, noteDelegationSettled, noteSettlementReportOwed } from "../access/pending-delegation-signal.js";
+import { clearGenerationDelegation, noteGenerationDelegation } from "../channels/generation-retirement.js";
+import { delegatedSecondAddress, delegatingParentLink, settleDelegatedReads } from "../channels/delegated-provenance.js";
+import { stampReadReach } from "../channels/read-reach.js";
+import { resolvePartition } from "../memory/partition.js";
+import { flushDirtyTreeAtTurnEnd, flushSettledMemory, noteTaskDispatched, noteTaskSettled, noteTaskViews } from "./settlement-flush.js";
+// This sink is the LOG, never the control: decideIngestion classifies with no reference to it, so a process that never loaded this hook still enforces and simply writes no rows. Nothing here may grow into the decision path.
+const TAINT_VERDICT_ACTION = "taint.verdict";
+/**
+ * WHICH TURN WROTE A VERDICT ROW (OPE-1907) — ids only, and every one of them OPTIONAL.
+ *
+ * 🔴 WHY THE ROW NEEDS IT. A `taint.verdict` row carried no session identity at all, so the only
+ * way to attribute one to a particular wake was to scan a time window and hope nothing else ran in
+ * it. S-TAINT-DRYRUN's Notion arm did exactly that, and could not tell its own forged replay's
+ * verdict from an ambient one. `sessionId` + `turnId` join the row to the `wake.turn_start` row of
+ * the turn that ingested, which is already keyed by `wakeId`.
+ *
+ * 🔴 `parentSessionId` IS THE IMMEDIATE DELEGATING PARENT, NOT A TRANSITIVE ROOT. The seat delegates
+ * the read to a worker, so the verdict is written under the WORKER's session while the wake joins
+ * to the SEAT's. One hop is what `delegatingParentLink` can establish, and claiming a root over a
+ * deeper chain would be a claim this data does not support.
+ *
+ * Absent values are OMITTED, never written as `undefined`: a key with no value reads, to anyone
+ * querying the trail, like a value that was looked for and found empty. IDS ONLY — the content
+ * invariant on this row (names, tiers and reasons, never a byte of what was ingested) is unchanged.
+ */
+export function taintVerdictIdentityDetail(turn, subagent) {
+    const out = {};
+    if (turn?.sessionId)
+        out.sessionId = turn.sessionId;
+    if (turn?.turnId)
+        out.turnId = turn.turnId;
+    const parent = subagent?.parent?.sessionId;
+    // A session is never its own parent — a self-link would make the join look like a delegation.
+    if (parent && parent !== turn?.sessionId)
+        out.parentSessionId = parent;
+    return out;
+}
+/** Read the two identity slots without letting an unreadable one cost the row. The sink runs on the
+ *  ingestion path, where a missing eve context is a normal shape, so this fails to `{}`. */
+function liveTaintVerdictIdentity() {
+    try {
+        return taintVerdictIdentityDetail(turnIdentity.get(), subagentIdentity.get());
+    }
+    catch {
+        return {};
+    }
+}
+registerTaintVerdictSink((row) => {
+    void appendAudit({
+        org: deploymentOrg(),
+        // No platform or workspace is reachable at an ingestion site, and inventing one would be a lie in a taint-clean field; `ingest` names the plane the row came from.
+        platform: "ingest",
+        workspace: row.kind,
+        action: TAINT_VERDICT_ACTION,
+        // Names, tiers and reasons ONLY — never a byte of what was ingested. Plus the turn's own ids,
+        // which are what makes one row attributable to one wake.
+        detail: { ...row, ...liveTaintVerdictIdentity() },
+    }).catch(() => undefined);
+});
+/** Additive-only: a new taint producer adds its attribute name here, and the one consumer below is unchanged. */
+export const TAINT_SEED_ATTRS = [
+    OE_SPAWN_TAINTED_ATTR,
+    OE_TAINTED_FIRE_ATTR,
+    JOB_TAINT_ATTR,
+    OE_CHAT_NONMEMBER_ATTR,
+];
+/** Read `current` ONLY, never the session's `initiator`: initiator attributes are session-invariant, so seeding off them would re-taint every turn of a child or job session forever. */
+function currentAttrs(ctx) {
+    return ctx.session?.auth?.current?.attributes;
+}
+/** eve can hand an attribute back as `string[]` (the same collapse routines/routine.ts's
+ *  routineMarker and access/job-posture.ts's stamp readers do) — so a seed check that only matched
+ *  the scalar spelling would silently miss the array one. */
+function stampedTrue(v) {
+    const first = Array.isArray(v) ? v[0] : v;
+    return first === "true" || first === true;
+}
+export function seedIfTainted(ctx) {
+    try {
+        const attrs = currentAttrs(ctx);
+        for (const name of TAINT_SEED_ATTRS) {
+            if (stampedTrue(attrs?.[name])) {
+                markUntrustedIngestedThisTurn();
+                return;
+            }
+        }
+    }
+    catch {
+        // Best-effort: seeding the belt must never disturb the turn (the approval-card control is primary).
+    }
+}
+/** When the turn id is UNREADABLE the two resets go opposite ways — the taint signal keeps its state, the verdict memo clears. The memo governs audit rows only, so a missed reset can never cost an ingestion its verdict. */
+export function openTaintTurn(ctx) {
+    // Identity FIRST: `seedIfTainted` below can fire the flip observer synchronously on this same turn, and the observer reads this slot, so an unset slot would lose the child's own mark.
+    rememberSubagentIdentity(ctx);
+    rememberTurnIdentity(ctx);
+    let turnId;
+    try {
+        turnId = currentTurnId(ctx);
+    }
+    catch {
+        turnId = undefined; // unreadable ⇒ beginTaintTurn keeps the stricter (unreset) state
+    }
+    beginTaintTurn(turnId);
+    beginTaintVerdictTurn(turnId);
+    seedIfTainted(ctx);
+    adoptParentTurnTaint(ctx);
+    // OPE-1467, and it must sit AFTER the line above rather than beside `rememberTurnIdentity`: this
+    // write overwrites the pin this session's own parent put in the bag, and the adoption reads that
+    // pin. See {@link recordDispatchTurnForChildren}.
+    recordDispatchTurnForChildren();
+    announceTaintOff(ctx);
+}
+const TAINT_MODE_ACTION = "taint.mode";
+const taintModeAnnounced = defineState("open-everywhere.taint-mode-announced", () => false);
+/** Write the once-per-session `taint.mode` row when — and only when — the model is OFF, so an audit trail with the security model disabled never reads identically to a clean one. */
+export function announceTaintOff(ctx) {
+    try {
+        if (taintEnabled())
+            return false;
+        let first = false;
+        taintModeAnnounced.update((cur) => {
+            if (cur === true)
+                return true;
+            first = true;
+            return true;
+        });
+        if (!first)
+            return false;
+        const sessionId = ctx.session?.id;
+        void appendAudit({
+            org: deploymentOrg(),
+            platform: "ingest",
+            workspace: "taint",
+            action: TAINT_MODE_ACTION,
+            detail: {
+                mode: taintMode(),
+                ...(typeof sessionId === "string" && sessionId.length > 0 ? { session: sessionId } : {}),
+                marking: "disabled",
+                fencing: "unchanged",
+            },
+        }).catch(() => undefined);
+        return true;
+    }
+    catch {
+        /* the stamp is a recorder, never a gate — a turn may not fail because its posture went unlogged */
+        return false;
+    }
+}
+// eve never delivers `subagent.called` through hook dispatch, so the CHILD writes a call-keyed marker under a key the parent reconstructs from its own session id and the `callId` on the result.
+/** Resolved at `turn.started`, where a ctx exists, and read by the flip observer, where one does not. `parent` is null for a root session and for a child eve gave no usable link. */
+const subagentIdentity = defineState("open-everywhere.subagent-taint.identity", () => null);
+/** Second source: the child's `subagent:<parentSessionId>:<callId>` continuation token, parsed only on that exact shape with colon-free ids — anything ambiguous is declined.
+ *  ONE implementation, in `channels/delegated-provenance.ts`: the provenance plane keys its own per-delegation row on the same pair, and two copies of this parse drifting apart would let the two planes disagree about which delegation a worker belongs to. */
+function readParentLink(ctx) {
+    return delegatingParentLink(ctx);
+}
+/**
+ * CLEAR-FIRST on every turn, so a slot can never outlive the session shape that wrote it.
+ * On the first turn a session is identified as a child, claim the call-keyed marker CLEAN (put-if-absent, fire-and-forget), so an absent marker later means lost, not clean.
+ */
+function rememberSubagentIdentity(ctx) {
+    try {
+        const c = ctx;
+        const sessionId = c.session?.id;
+        const child = isSubagentChildContext(c) && typeof sessionId === "string" && sessionId.length > 0;
+        const parent = child ? readParentLink(ctx) : null;
+        let firstSightingWithParent = false;
+        subagentIdentity.update((cur) => {
+            if (!child)
+                return null;
+            firstSightingWithParent = cur === null && parent !== null;
+            return { org: deploymentOrg(), sessionId, parent };
+        });
+        if (firstSightingWithParent && parent !== null) {
+            void claimSubagentCallClean(deploymentOrg(), parent.sessionId, parent.callId);
+        }
+    }
+    catch {
+        /* no eve context — nothing to remember, and the observer's null read is the inert answer */
+    }
+}
+registerTaintFlipObserver(() => {
+    recordTurnTaintForChildren();
+    let who = null;
+    try {
+        who = subagentIdentity.get();
+    }
+    catch {
+        who = null;
+    }
+    if (who === null)
+        return; // not a child (the overwhelmingly common case) — one slot read, no I/O
+    void markSubagentTainted(who.org, who.sessionId);
+    writeCallTaintMarker();
+});
+/** Every write to the call-keyed marker is chained here so the row settles on the LAST list issued: three writes land on one key in an ordinary two-source turn and they carry DIFFERENT payloads, so a late-landing first write would overwrite the superset. */
+let callTaintMarkerQueue = Promise.resolve();
+/** The kind list is read here rather than passed in, so both seams that issue this write carry the full list the turn has reached. Fire-and-forget. */
+function writeCallTaintMarker() {
+    let who = null;
+    try {
+        who = subagentIdentity.get();
+    }
+    catch {
+        who = null;
+    }
+    if (who === null || who.parent === null)
+        return;
+    let kinds = [];
+    try {
+        kinds = taintKindsThisTurn();
+    }
+    catch {
+        kinds = []; // unreadable ⇒ the bare marker, which is what this row carried before OPE-1251
+    }
+    const link = who.parent;
+    const org = who.org;
+    callTaintMarkerQueue = callTaintMarkerQueue.then(() => markSubagentCallTainted(org, link.sessionId, link.callId, kinds)).catch(() => undefined);
+}
+// Re-stamp when the kind list GROWS: the flip observer fires on the turn's first mark only, so a turn that read two sources handed its child one.
+registerTaintKindObserver(() => {
+    recordTurnTaintForChildren();
+    writeCallTaintMarker();
+});
+// FAIL DIRECTION OPEN: an unreadable or unwritable auth bag means no stamp, and no stamp reads as a clean parent turn.
+// FRAGILITY TRIPWIRE: this leg mutates an eve-owned auth object, so an eve bump that freezes `attributes` or gives `AuthKey` a copying codec turns it silently OFF; `scripts/native-subagent-test.ts` §D9 asserts those facts against the installed bytes.
+const TAINT_FORWARD_ACTION = "taint.forward";
+/** Deliberately NOT in TAINT_SEED_ATTRS: that table means the bare value `true`, and this discriminated stamp must be read through matchingForwardStamp instead. */
+export const OE_PARENT_TURN_TAINTED_ATTR = "oe_parent_turn_tainted";
+/**
+ * Names the turn that DISPATCHED a native child, `<sessionId>|<turnId>`, written by every turn of every session, tainted or clean. eve's `session.parent.turn` is not read: eve 0.51.0 re-pointed it to the dispatching turn PLUS ONE.
+ * It is an identity fact and never a taint signal, and it is deliberately absent from TAINT_SEED_ATTRS. Written AFTER the adoption reads it — see recordDispatchTurnForChildren.
+ */
+export const OE_DISPATCH_TURN_ATTR = "oe_dispatch_turn";
+function renderForwardStamp(sessionId, turnId, kinds) {
+    const named = kinds.filter((k) => INGESTION_KINDS.includes(k));
+    return named.length > 0 ? `${sessionId}|${turnId}|${named.join(",")}` : `${sessionId}|${turnId}`;
+}
+/** The kind tail is admitted BY TABLE, never by shape: a name that is not in INGESTION_KINDS is dropped, so nothing reaching an auth bag can put a name of its own choosing into a memory bullet or an approval card. */
+function parseForwardStamp(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    const parts = value.split("|");
+    if (parts.length < 2 || parts.length > 3)
+        return null;
+    const [sessionId, turnId, tail] = parts;
+    if (sessionId === undefined || sessionId.length === 0 || turnId === undefined || turnId.length === 0)
+        return null;
+    const kinds = (tail ?? "").split(",").filter((k) => INGESTION_KINDS.includes(k));
+    return { sessionId, turnId, kinds, raw: value };
+}
+/** `attrs` is the LIVE auth-attributes object held by reference — that reference is the carriage. Null when the bag is unreachable, which makes the stamp a no-op and the leg fail OPEN. */
+const turnIdentity = defineState("open-everywhere.taint-forward.turn-identity", () => null);
+/** Holds the TURN ID rather than a boolean, so a long-lived window re-arms on every new turn without needing its own reset at the boundary. Only the audit row is deduped. */
+const turnTaintRecorded = defineState("open-everywhere.taint-forward.recorded", () => null);
+/** The live auth-attributes bag for this delivery, creating it when `auth.current` exists without
+ *  one. Returns `null` when there is no writable bag — the fail-OPEN direction. */
+function writableAuthAttrs(ctx) {
+    try {
+        const current = ctx.session?.auth?.current;
+        if (current === undefined || current === null)
+            return null;
+        const attrs = current.attributes;
+        if (typeof attrs === "object" && attrs !== null)
+            return attrs;
+        // eve populates `attributes` on every delivery OE mints, so this arm is the unmeasured shape
+        // (another channel, a future eve). Creating the bag is still the propagating direction.
+        const fresh = {};
+        current.attributes = fresh;
+        return current.attributes === fresh ? fresh : null;
+    }
+    catch {
+        return null;
+    }
+}
+function rememberTurnIdentity(ctx) {
+    try {
+        const c = ctx;
+        const sessionId = c.session?.id;
+        const turnId = currentTurnId(c);
+        const attrs = writableAuthAttrs(ctx);
+        turnIdentity.update(() => typeof sessionId === "string" && sessionId.length > 0 && typeof turnId === "string" && turnId.length > 0
+            ? { org: deploymentOrg(), sessionId, turnId, attrs }
+            : null);
+    }
+    catch {
+        /* no eve context — nothing to remember, and the writer's null read is the inert answer */
+    }
+}
+/** SYNCHRONOUS AND I/O-FREE by design, and it never throws: it runs on the ingestion path, and neither side of this hop may add a store read to a turn preamble. */
+export function recordTurnTaintForChildren() {
+    try {
+        if (!untrustedIngestedThisTurn())
+            return false; // only a tainted turn has anything to hand on
+        const who = turnIdentity.get();
+        if (who === null || who.attrs === null)
+            return false; // no readable identity or bag ⇒ fail OPEN
+        const stamp = renderForwardStamp(who.sessionId, who.turnId, taintKindsThisTurn());
+        who.attrs[OE_PARENT_TURN_TAINTED_ATTR] = stamp;
+        if (who.attrs[OE_PARENT_TURN_TAINTED_ATTR] !== stamp)
+            return false; // a frozen bag: the tripwire case
+        let first = false;
+        turnTaintRecorded.update((cur) => {
+            if (cur === who.turnId)
+                return cur;
+            first = true;
+            return who.turnId;
+        });
+        if (first) {
+            void appendAudit({
+                org: who.org,
+                platform: "ingest",
+                workspace: "taint",
+                action: TAINT_FORWARD_ACTION,
+                // Identifiers only — never a byte of what was ingested.
+                detail: { leg: "mark", session: who.sessionId, turn: who.turnId },
+            }).catch(() => undefined);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** eve's pinned `session.parent.turn` is deliberately never read on this leg: it names the FIRST dispatch, and since eve 0.51.0 it names the dispatching turn plus one. */
+function readParentSession(ctx) {
+    const sessionId = ctx.session?.parent?.sessionId;
+    if (typeof sessionId === "string" && sessionId.length > 0)
+        return sessionId;
+    return readParentLink(ctx)?.sessionId ?? null;
+}
+/** A child's own `turn.sequence` is 0 on its first turn only. An UNREADABLE sequence answers false, which keeps the narrower pin comparison in force. */
+function laterTurnOfSameChild(ctx) {
+    const seq = ctx.session?.turn?.sequence;
+    return typeof seq === "number" && seq > 0;
+}
+/** Keyed `<stamp>@<the turn id that consumed it>`, because eve re-executes an uncommitted `turn.started` body on redelivery: keyed on the stamp alone, the replay would refuse its own adoption and the child would write an unmarked bullet. Bounded, oldest dropped first. */
+const adoptedForwardStamps = defineState("open-everywhere.taint-forward.adopted-stamps", () => []);
+/** An unreadable turn id yields the bare stamp, which is the stricter refuse-on-replay behaviour and the only honest answer when the turn cannot be named. */
+function memoKey(raw, turnId) {
+    return typeof turnId === "string" && turnId.length > 0 ? `${raw}@${turnId}` : raw;
+}
+const MAX_REMEMBERED_STAMPS = 16;
+/** A PURE READ whose answer is valid only BEFORE this turn's own adoption runs — the adoption's mark fires the flip observer, which re-stamps the same bag — so any later reader must use adoptedParentTurnTaintThisTurn instead. */
+function matchingForwardStamp(ctx) {
+    try {
+        const parentSession = readParentSession(ctx);
+        if (parentSession === null)
+            return null;
+        const raw = currentAttrs(ctx)?.[OE_PARENT_TURN_TAINTED_ATTR];
+        const stamp = parseForwardStamp(Array.isArray(raw) ? raw[0] : raw);
+        if (stamp === null || stamp.sessionId !== parentSession)
+            return null;
+        // The turn half is compared only on the child's FIRST turn, where the pin names the turn that really dispatched it; on a later turn no pin can be shown to describe the delivery, so the adopted-stamp memo discriminates instead.
+        // An absent or unparseable pin REFUSES, which on this leg is the OPEN direction — a refused adoption is an UNTAINTED child. It inverts every other unreadable-signal arm here, so a parent on an older build stamps a taint with no pin and its first-turn children do not adopt.
+        if (!laterTurnOfSameChild(ctx)) {
+            const rawPin = currentAttrs(ctx)?.[OE_DISPATCH_TURN_ATTR];
+            const pin = parseForwardStamp(Array.isArray(rawPin) ? rawPin[0] : rawPin);
+            if (pin === null || pin.sessionId !== parentSession || pin.turnId !== stamp.turnId)
+                return null;
+        }
+        // The memo is consulted with THIS turn's key, so a redelivered body meets its own entry and
+        // re-adopts, while a later turn of the same child meets the earlier turn's entry and refuses.
+        let ownTurnId;
+        try {
+            ownTurnId = currentTurnId(ctx);
+        }
+        catch {
+            ownTurnId = undefined;
+        }
+        const memo = adoptedForwardStamps.get();
+        if (memo.includes(memoKey(stamp.raw, ownTurnId)))
+            return stamp; // this turn's own replay ⇒ re-adopt
+        return memo.some((k) => k === stamp.raw || k.startsWith(`${stamp.raw}@`)) ? null : stamp;
+    }
+    catch {
+        return null;
+    }
+}
+/** Written on EVERY turn, tainted or clean, and on a `taint.mode: "off"` deployment too: gating it would make its absence mean two things, and flipping the mode on would leave every live parent's children unable to discriminate. */
+function recordDispatchTurnForChildren() {
+    try {
+        const who = turnIdentity.get();
+        if (who === null || who.attrs === null)
+            return false; // no readable identity or bag
+        // The same two-field rendering the taint stamp uses, with no kind tail — this attribute carries
+        // an identity, never a disclosure.
+        const pin = renderForwardStamp(who.sessionId, who.turnId, []);
+        who.attrs[OE_DISPATCH_TURN_ATTR] = pin;
+        return who.attrs[OE_DISPATCH_TURN_ATTR] === pin; // a frozen bag: the same tripwire case
+    }
+    catch {
+        return false;
+    }
+}
+/** The bag is a CARRIAGE, not a durable record of the adoption: the same turn that reads it also overwrites it, so a later reader gets a confident `false` from it. */
+const parentTurnTaintAdopted = defineState("open-everywhere.taint-forward.adopted", () => null);
+/**
+ * Do NOT re-derive this from the auth bag: eve awaits `turn.started` before it emits `message.received`, so every later hook edge reads the bag after the flip observer re-stamped it with this session's own pair, and a bag-reading fence never fires.
+ * Scoped to the CURRENT turn; an unreadable turn id on either side answers `true`, the direction that refuses capture.
+ */
+export function adoptedParentTurnTaintThisTurn(ctx) {
+    try {
+        const recorded = parentTurnTaintAdopted.get();
+        if (recorded === null)
+            return false; // no adoption in this session at all — the common case
+        let turnId;
+        try {
+            turnId = currentTurnId(ctx);
+        }
+        catch {
+            turnId = undefined;
+        }
+        if (recorded.length === 0 || typeof turnId !== "string" || turnId.length === 0)
+            return true;
+        return recorded === turnId;
+    }
+    catch {
+        // No eve context ⇒ no session, so there is no turn to capture a message for either. Unreachable
+        // from the one caller, which always holds a hook context.
+        return false;
+    }
+}
+/** An EMPTY list still marks, with no class named: that is what a leg honestly knows when the carrier said tainted and nothing more. */
+function adoptKinds(kinds) {
+    if (kinds.length === 0)
+        markUntrustedIngestedThisTurn();
+    else
+        for (const kind of kinds)
+            markUntrustedIngestedThisTurn(kind);
+}
+/** SYNCHRONOUS AND I/O-FREE, which is the property the design exists for: eve re-executes an uncommitted step body on redelivery, so a store read in a child's turn preamble re-runs with it. */
+export function adoptParentTurnTaint(ctx) {
+    if (!taintEnabled())
+        return false;
+    try {
+        const stamp = matchingForwardStamp(ctx);
+        if (stamp === null)
+            return false;
+        // Written BEFORE the mark: the mark re-stamps the bag through the flip observer, so this slot is the only record of the adoption, and no observer may see a half-set state.
+        let ownTurnId;
+        try {
+            ownTurnId = currentTurnId(ctx);
+        }
+        catch {
+            ownTurnId = undefined; // unreadable ⇒ the empty sentinel, which reads as "this turn" downstream
+        }
+        parentTurnTaintAdopted.update(() => (typeof ownTurnId === "string" ? ownTurnId : ""));
+        adoptedForwardStamps.update((cur) => {
+            const key = memoKey(stamp.raw, ownTurnId);
+            return cur.includes(key) ? cur : [...cur, key].slice(-MAX_REMEMBERED_STAMPS);
+        });
+        adoptKinds(stamp.kinds);
+        const sessionId = ctx.session?.id;
+        void appendAudit({
+            org: deploymentOrg(),
+            platform: "ingest",
+            workspace: "taint",
+            action: TAINT_FORWARD_ACTION,
+            detail: {
+                leg: "adopt",
+                ...(typeof sessionId === "string" && sessionId.length > 0 ? { session: sessionId } : {}),
+                parentSession: stamp.sessionId,
+                parentTurn: stamp.turnId,
+                kinds: [...stamp.kinds],
+            },
+        }).catch(() => undefined);
+        return true;
+    }
+    catch {
+        // Fail-OPEN, matching this leg's documented direction: an unreadable forward signal cannot be
+        // told apart from a genuinely clean parent turn, and the alternative taints every worker.
+        return false;
+    }
+}
+/** `ownSessionId` must be the PARENT's own session id, read straight off `ctx` and never off an eve event. Returns whether the parent's turn was marked, for the test. */
+export async function adoptSubagentTaint(callId, ownSessionId) {
+    // The switch is checked here too: the mark below is already inert when the model is off, but the marker READ is a store round trip on every delegation result.
+    if (!taintEnabled())
+        return false;
+    try {
+        const record = await subagentCallTaintRecord(deploymentOrg(), ownSessionId, callId);
+        if (record?.tainted === false)
+            return false; // a positively-known CLEAN child — the common case
+        // FAIL CLOSED: a TAINTED row and a missing row are treated the same, because a missing record can only mean the record was lost.
+        // That premise holds only while the caller intercepts every background receipt ahead of the sync branch — a parked receipt is also a `subagent-result` with a real callId, and reaching this read on one fails closed on every clean delegation. Do not weaken that ordering.
+        adoptKinds(record?.kinds ?? []);
+        return true;
+    }
+    catch {
+        // OPE-437 FAIL CLOSED: the read itself threw — same reasoning as the `undefined` branch above.
+        markUntrustedIngestedThisTurn();
+        return true;
+    }
+}
+// A background delegation has TWO edges: the DISPATCH receipt, where no child has run and nothing may be adopted, and the SETTLEMENT, where the marker is read and adopted fail-closed.
+// Two edges prove a settlement — a terminal task view and the settlement notification — and both run applyTaskSettlement. A path that delivers a child's output with no view would need its own branch here.
+/** Ids only — never the brief, never the child's output. */
+export const TASK_STARTED_ACTION = "delegation.task_started";
+// A settled task's WORKER parks as a live but inert durable session until its seat generation is retired (channels/generation-retirement.ts); the audit rows below are the only census of that population.
+/** Ids and the marker verdict only. Also the parked-worker census: one row per settled task, naming the agent handle whose worker parks at that moment. */
+export const TASK_SETTLED_ACTION = "delegation.task_settled";
+/**
+ * The row that says a settlement moved a WORKER's connector reads onto the SEAT's provenance ledger
+ * (OPE-1849). Ids and COUNTS only — which delegation, how many sources, and the proof the seat could
+ * offer — never a connection name: the reader learns that through the reply's own `reply.provenance`
+ * row, under the reach rule, and this row must not become a second disclosure surface for it.
+ *
+ * It is written whenever the worker recorded ANYTHING, carried or withheld, and `detail.outcome` says
+ * which: `carried`, `not-completed` (the worker died or was reaped) or `wake-unprovable` (the turn's
+ * address names another conversation). So its absence on a settlement means the worker read no
+ * connector, or the dispatch join row this carriage joins through was not written — a
+ * `taint.mode: "off"` deployment writes none. That is the countable difference between "the footer
+ * had nothing to say" and "the carriage never ran", which is the question ship #211 could not answer.
+ */
+export const DELEGATED_PROVENANCE_ACTION = "delegation.provenance_carried";
+/**
+ * The row an operator counts dead delegations from and then diagnoses them by: ids, the tool, eve's error class and eve's error TEXT, scrubbed and truncated. It never carries the child's output.
+ * Two edges write it — a failure result, which names no task, and a settlement whose status is `failed`. `cancelled` is not a death on the settlement edge: there it is the deployment's own reaper.
+ * Each row also names the EDGE that wrote it and how its `error` was read ({@link DelegationFailureEdge}, {@link DelegationFailureParse}). A settlement whose dispatch row was lost records no `call` and no `tool`, and still records the error.
+ */
+export const TASK_FAILED_ACTION = "delegation.task_failed";
+/** AWAITED by both call sites, unlike the fire-and-forget rows next door: both sites already await store work, so the row costs no extra round trip, and awaiting means a failure that ends the turn still leaves its row. */
+async function noteDelegationFailure(failure, taskId, ownSessionId, turnId, edge, parse) {
+    await appendAudit({
+        org: deploymentOrg(),
+        platform: "ingest",
+        workspace: "delegation",
+        action: TASK_FAILED_ACTION,
+        // Every key is written, empty or not: a failure result names no task, and a settlement whose dispatch row was lost names no call and no tool. A reader must not have to tell absent from unknown.
+        detail: {
+            task: taskId,
+            call: failure.callId ?? "",
+            tool: failure.tool ?? "",
+            // The error text is upstream-authored — on the settlement edge it is read off a member-visible notification — so it is scrubbed of credential shapes and capped by the one audit redaction in audit/tool-action.ts, and nothing keys on it.
+            error: auditErrorDetail(failure.errorText ?? "").error,
+            // eve's own class, kept as its own field rather than folded into `error`: an operator counts
+            // deaths by class and diagnoses them by text, and one field cannot do both.
+            //
+            // 🔴 SCRUBBED AND CAPPED THE SAME WAY `error` IS, because it is the same kind of string. eve's
+            // PASS-THROUGH arm forwards the CHILD's own object verbatim, so `code` can be any text the
+            // child wrote; on the notification edge a forged line can choose it outright. `appendAudit`
+            // applies no scrub of its own, so without this call the class reached the row unstruck and
+            // unbounded while three doc sites said it was struck. A real class word
+            // (`SUBAGENT_EXECUTION_FAILED`) passes through untouched.
+            errorClass: auditErrorDetail(failure.errorClass ?? "").error,
+            // OPE-1737 round 2: HOW `error` was obtained, so an empty-looking row is never ambiguous.
+            // `json`/`text` — read off eve's own payload; `raw` — the notification's own paragraph,
+            // because no payload read; `result` — off eve's result envelope on the failure-result edge;
+            // `none` — no text existed on this edge at all, which only the task-VIEW edge can report.
+            parse,
+            // 🔴 WHICH EDGE WROTE THIS ROW, and it is NOT eve's status word any more (OPE-1737, round 2).
+            // Ship #201's three rows all said `outcome: "failed"` — the settlement edge's only possible
+            // value AND the failure-result edge's fallback — so the row could not say which reader
+            // produced its empty fields. The three values are disjoint by construction and each names one
+            // call site below.
+            outcome: edge,
+            // eve's own status word, which `outcome` used to carry. `failed` on every settlement row;
+            // `failed` or `cancelled` on the failure-result edge.
+            status: failure.status,
+            ...(ownSessionId.length > 0 ? { session: ownSessionId } : {}),
+            ...(turnId !== undefined && turnId.length > 0 ? { turn: turnId } : {}),
+        },
+    }).catch(() => undefined);
+}
+/**
+ * The row that says WHICH LINE killed a delegated worker, written by the worker itself.
+ *
+ * WHY IT EXISTS (OPE-1751). {@link TASK_FAILED_ACTION} is written by the PARENT and can only carry
+ * what eve's settlement payload holds, which is `{code, message}` — no stack, by construction. On
+ * ship #199, #203 and #205 that left three deploys of dead workers naming one class
+ * (`SUBAGENT_EXECUTION_FAILED`) and one message (`Cannot read properties of undefined (reading
+ * 'push')`) with nothing to place it against, and two root-cause runs failed on exactly that gap.
+ * This row is the worker's own side of the same death, and it carries the stack FRAMES.
+ *
+ * 🔴 WHAT IT DOES NOT COVER, and the honest bound: eve's TERMINAL failure site — the outer catch in
+ * `execution/workflow-entry.js`, which is where an error that escapes the turn loop lands —
+ * dispatches to NO hook (measured and recorded in hooks/learn.ts and hooks/routine-outcome.ts). So a
+ * throw that never reaches a classified turn failure still writes nothing here. This arm covers the
+ * classified path, where eve emits `turn.failed` before finalizing the task as errored.
+ */
+const WORKER_TURN_FAILED_ACTION = "delegation.worker_turn_failed";
+/** Lets a settlement read the marker under the session that DISPATCHED the child, not the session that happens to be peeking. Conservative, like readParentLink: colon-free ids only. */
+function parentSessionOfChildToken(childToken) {
+    const m = /^subagent:([^:]+):([^:]+)$/.exec(childToken);
+    return m === null ? undefined : m[1];
+}
+/** The child token is RESOLVED, not derived (a continuation reaches the same child under a NEW callId), and the task-keyed row is read FIRST, so a redelivered receipt returns the recorded link and writes nothing twice. */
+export async function noteTaskReceipt(receipt, ownSessionId) {
+    const org = deploymentOrg();
+    let link = null;
+    let continuation = false;
+    let replay = false;
+    try {
+        // The join rows serve the taint read at settlement only, so an opted-out deployment must not pay a store round trip for them; the audit row below is a delegation trail, not a taint control, and is written either way.
+        if (taintEnabled() && ownSessionId.length > 0) {
+            const already = await taskCallLink(org, receipt.taskId);
+            if (already !== undefined) {
+                // OPE-586: a prior pass over this exact receipt already recorded the join (and, by the same
+                // pass, already wrote the audit row below) — a redelivered step, not a new dispatch.
+                replay = true;
+                link = already;
+            }
+            else {
+                const pinned = receipt.agentId === null ? undefined : await taskAgentLink(org, ownSessionId, receipt.agentId);
+                // A continuation always arrives under a NEW callId, so a pinned row whose callId equals this receipt's own is this same dispatch replaying after a crash between the two writes below — never a genuine continuation.
+                continuation = pinned !== undefined && pinned.callId !== receipt.callId;
+                // The worker's AGENT HANDLE rides the join row from here on, because a notification-driven settlement has no task view to read it off. A pinned continuation row keeps whatever it already holds.
+                const fresh = {
+                    callId: receipt.callId,
+                    childToken: `subagent:${ownSessionId}:${receipt.callId}`,
+                    ...(receipt.tool.length > 0 ? { tool: receipt.tool } : {}),
+                };
+                link = pinned ?? fresh;
+                if (link.agentId === undefined && receipt.agentId !== null)
+                    link = { ...link, agentId: receipt.agentId };
+                if (link.tool === undefined && receipt.tool.length > 0)
+                    link = { ...link, tool: receipt.tool };
+                // BOTH writes are AWAITED: the settlement that reads these rows can be a whole turn later, so a write still in flight when the handler returns would fail closed for no reason.
+                if (receipt.agentId !== null && !continuation)
+                    await rememberTaskAgent(org, ownSessionId, receipt.agentId, link);
+                await rememberTaskCall(org, receipt.taskId, link);
+            }
+        }
+    }
+    catch {
+        /* best-effort: a lost join degrades settlement to the fail-CLOSED read, never to fail-open */
+    }
+    if (replay)
+        return link; // OPE-586: already recorded by an earlier pass — no second audit row
+    void appendAudit({
+        org,
+        platform: "ingest",
+        workspace: "delegation",
+        action: TASK_STARTED_ACTION,
+        detail: {
+            task: receipt.taskId,
+            call: receipt.callId,
+            agent: receipt.agentId ?? "",
+            ...(ownSessionId.length > 0 ? { session: ownSessionId } : {}),
+            continuation,
+        },
+    }).catch(() => undefined);
+    return link;
+}
+/** Fails CLOSED on a lost join row and on a lost marker: a terminal view is eve's own proof that a child ran to a final state, so an absent record can only mean it was lost. */
+export async function adoptTaskTaint(view, ownSessionId) {
+    const org = deploymentOrg();
+    let marker = "off";
+    let adopted = false;
+    let kinds = [];
+    try {
+        if (taintEnabled()) {
+            const link = await taskCallLink(org, view.taskId);
+            if (link === undefined) {
+                marker = "lost";
+            }
+            else {
+                const parentSession = parentSessionOfChildToken(link.childToken) ?? ownSessionId;
+                const record = await subagentCallTaintRecord(org, parentSession, link.callId);
+                marker = record === undefined ? "lost" : record.tainted ? "tainted" : "clean";
+                if (record?.tainted === true)
+                    kinds = record.kinds;
+            }
+            if (marker !== "clean") {
+                adoptKinds(kinds);
+                adopted = true;
+            }
+        }
+    }
+    catch {
+        // Same fail-closed direction as the sync branch: the read itself threw, which is a lost record.
+        marker = "lost";
+        kinds = [];
+        markUntrustedIngestedThisTurn();
+        adopted = true;
+    }
+    void appendAudit({
+        org,
+        platform: "ingest",
+        workspace: "delegation",
+        action: TASK_SETTLED_ACTION,
+        // Ids and the verdict only — `lastOutput` holds the child's prose and is never read here.
+        // `agent` is the worker's AGENT HANDLE, not its session id, and cannot address the worker: eve strips the session id out of every view OE sees. It joins this row to the dispatch row.
+        detail: {
+            task: view.taskId,
+            status: view.status,
+            ...(ownSessionId.length > 0 ? { session: ownSessionId } : {}),
+            agent: view.agentId ?? "",
+            marker,
+            adopted,
+            kinds: [...kinds],
+        },
+    }).catch(() => undefined);
+    return adopted;
+}
+/**
+ * The settlement side effects for one batch of TERMINAL task views, shared by the task-view edge and the notification edge so the two cannot drift apart.
+ * The ORDER inside is load-bearing: the wake identity installs BEFORE the taint adoption, whose row records the stale inherited address, and the adoption runs last so its auth stamp reaches a child dispatched later in the same turn. It does not flush memory — each caller owns that.
+ */
+export async function applyTaskSettlement(views, ownSessionId, ctx, settlement = {}) {
+    if (views.length === 0)
+        return false;
+    // The error belongs to the ONE notification that carried it, so it is spent only on a single-view batch; a task view's `lastOutput` is the child's prose and no audit row may hold it.
+    const failure = views.length === 1 ? settlement.failure : undefined;
+    // The notification edge is explicit because a multi-notification batch has no one failure
+    // payload to act as its discriminator. `failure` remains narrowed to one view so its parse/error
+    // fields can never be attributed to another task in the batch.
+    const edge = settlement.notification === true || failure !== undefined ? "notification" : "settlement";
+    // A legacy single link is narrowed with its one failure. Notification batches instead pass the
+    // per-task `links` map so provenance and failure handling consume the same one read for each task.
+    const settlementLink = views.length === 1 ? settlement.link : undefined;
+    const bind = ctx;
+    // The RAW delivery stamp, never `currentWakeId`: this field records the stale id the turn WOULD have replied under, and `currentWakeId` now answers `undefined` on exactly these turns.
+    const inheritedWakeId = inheritedWakeStampOf(bind);
+    const wakeTurnId = currentTurnId(bind);
+    // FIRST and never throwing: a task the model has now seen finish no longer holds this turn's wake open. It matters only for a settlement inside the dispatching turn.
+    for (const view of views)
+        noteDelegationSettled(wakeTurnId, view.taskId);
+    // The durable twin of the line above. Found through the task's own reverse pointer, never through this seat's token: this turn's seat may already be a later generation.
+    for (const view of views)
+        await clearGenerationDelegation(deploymentOrg(), view.taskId);
+    // THE SEAT'S OWN PARTITION, resolved ONCE for the whole batch: it is a property of the settling
+    // turn, not of any one task. Unreadable ⇒ `undefined`, which `stampReadReach` reads as "the host
+    // could not place this seat" and stamps `"none"` — counted by kind, never named.
+    let seatSurfaceKey;
+    try {
+        seatSurfaceKey = resolvePartition(bind).surfaceKey;
+    }
+    catch {
+        seatSurfaceKey = undefined;
+    }
+    for (const view of views) {
+        // ONE join read per view, shared by the provenance carriage and the failure row below. It used to
+        // sit inside the `failed` arm; hoisting it costs the common settlement one store read and buys
+        // both readers the SAME answer, which a second read on a transient store error could not.
+        const link = settlement.links?.has(view.taskId)
+            ? settlement.links.get(view.taskId)
+            : settlementLink !== undefined
+                ? settlementLink
+                : await taskCallLink(deploymentOrg(), view.taskId);
+        const install = await installTaskWake({
+            org: deploymentOrg(),
+            taskId: view.taskId,
+            status: view.status,
+            sessionId: ownSessionId,
+            turnId: wakeTurnId,
+            inheritedWakeId,
+        });
+        if (edge === "notification" && settlement.authorizeRedispatch === true) {
+            // A terminal task view selected by the model retains reply/taint handling but never becomes
+            // dispatch origin. The flattened notification must also start with the terminal header. Every
+            // header participates in ambiguity: a second missing, legacy or wrong-session row blocks the
+            // whole batch instead of silently leaving the first task authoritative.
+            noteSettlementDispatchAuthority(wakeTurnId, view.taskId, install.outcome === "installed" || install.outcome === "already" ? install.dispatchAuthority : undefined);
+        }
+        // THE FOLLOW-THROUGH DUTY arms only where the seat PROMISED a report for this task AND the wake install landed, so the turn holds the address to post it under; a duty with no route is a loop the model cannot win.
+        if (install.outcome === "installed" && claimPromisedReport(view.taskId)) {
+            noteSettlementReportOwed(wakeTurnId, view.taskId, install.wakeId ?? undefined);
+        }
+        // OPE-1849 — THE WORKER'S CONNECTOR READS BECOME THIS SEAT'S PROVENANCE, and it runs AFTER the
+        // wake install deliberately: the install is what gives this turn its own address. Stamped with
+        // `stampReadReach`, the one expression a seat-turn read is stamped with, so the reach rule cannot
+        // tell a carried read from a seat-turn one. A settlement with no join row spends nothing — see
+        // `channels/delegated-provenance.ts`.
+        if (link !== undefined) {
+            // Stamped ONCE and used for both the attribution and the row that counts it, so the row can
+            // never report a proof the ledger entries do not hold.
+            const reach = stampReadReach(bind, wakeTurnId, seatSurfaceKey);
+            // 🔴 THE WAKE PROOF MUST NAME THIS TASK'S OWN CONVERSATION, AND THE TURN'S ADDRESS DOES NOT
+            // ALWAYS DO SO. `stampReadReach` reads `currentWakeId`, which answers the wake this TURN
+            // adopted — and two ordinary paths make that another conversation's:
+            //   • `adoptTaskWakeThisTurn` is FIRST-WRITE-WINS (access/task-wake-signal.ts), so when two
+            //     tasks settle into one turn every task after the first is stamped with the FIRST one's
+            //     wake;
+            //   • `installTaskWake` refuses on an INGRESSED turn, so a settlement seen through a task VIEW
+            //     on a member's own turn falls back to that member's delivery stamp.
+            // On a unified seat both name a SIBLING conversation, and `provenanceForReply` names a
+            // `"wake"`-proved read on any reply answering that wake — which is exactly the disclosure
+            // OPE-1713 closed for a seat-turn read ("a unified reply answering wake B named a read made
+            // under wake A"). So the wake arm carries ONLY where the turn's address is this task's own
+            // minted wake, which `installTaskWake` hands back whatever its outcome. The surface arm needs
+            // no such check: a per-surface seat holds ONE conversation, so its partition is exact.
+            //
+            // 🔴 AND ONLY A COMPLETED DELEGATION IS A SOURCE. A worker that read Notion and then died gives
+            // the seat a failure to report, not an answer drawn on Notion, so footing its reads would print
+            // a receipt for an answer with no sources. `failed` and `cancelled` are spent, never carried.
+            const wakeProvable = reach.proof !== "wake" || (install.wakeId !== null && reach.wakeId === install.wakeId);
+            const provable = view.status === "completed" && wakeProvable;
+            // 🔴 AND THE SEAT REPLIES UNDER THE OTHER ONE (OPE-1869). Everything above proves the carriage
+            // against the task's own MINTED wake, which is the id this turn now answers under. It is not
+            // the id the reply carries: the `reply` tool fences the wake the turn was DELIVERED with — the
+            // stamp recorded just above as `inheritedWakeId` — so `provenanceForReply` compared the minted
+            // id against the delivered one and named nothing. Ship #213 is the whole measurement: six
+            // replies whose reads the settle had carried (`delegation.provenance_carried … found:4
+            // outcome:"carried"`) each footed none (`reply.provenance … reads:4 named:0 withheld:1`).
+            // 🔴 AND IT IS PROVED, NOT ASSUMED. `installTaskWake` adopts only on an UNINGRESSED turn, whose
+            // inherited stamp is by OPE-585's own finding "whichever conversation happened to run last" —
+            // on a unified seat, routinely a SIBLING. So `delegatedSecondAddress` compares the two ids by
+            // ORIGIN against the wake map and withholds anything it cannot place in this task's own room.
+            // Fail-closed: no row, no store, no origin ⇒ `undefined`, and the read keeps one address.
+            // Asked only where the answer can matter: the wake arm, on a settlement that is carrying. A
+            // per-surface seat holds ONE conversation, so its proof is already exact and a second wake id
+            // is dropped by `noteConnectorRead` — computing one there would buy two store reads per
+            // settlement and change nothing.
+            const alsoWakeId = provable && reach.proof === "wake"
+                ? await delegatedSecondAddress({
+                    org: deploymentOrg(),
+                    taskWakeId: install.wakeId,
+                    inheritedWakeId,
+                    outcome: install.outcome,
+                })
+                : undefined;
+            const spend = await settleDelegatedReads({
+                org: deploymentOrg(),
+                childToken: link.childToken,
+                // THE SEAT'S OWN SESSION, read the same way the reply reads it (`replyAuditFor` takes
+                // `ctx.session?.id`) rather than from this hook's own `ownSessionId` argument: a carried
+                // record's label is stored under (session, turn) and resolved under the reply's (session,
+                // turn), so the two ends must read ONE expression or a label lands under a key nothing looks
+                // up. Absent stores no label, which foots the connection alone.
+                sessionId: currentSessionId(bind),
+                turnId: wakeTurnId,
+                // 🔴 WITHHELD STILL SPENDS THE ROW. Reads this seat cannot place must reach NO reply, and
+                // leaving them in the row only moves the wrong attribution onto the worker's next brief.
+                reach: provable ? { ...reach, ...(alsoWakeId !== undefined ? { alsoWakeId } : {}) } : undefined,
+            });
+            if (spend.found > 0) {
+                void appendAudit({
+                    org: deploymentOrg(),
+                    platform: "ingest",
+                    workspace: "delegation",
+                    action: DELEGATED_PROVENANCE_ACTION,
+                    // Ids and COUNTS only: which delegation, how many sources the worker recorded, how many
+                    // this seat could attribute, and why. Never a connection name — that reaches the reader
+                    // through the reply's own `reply.provenance` row, under the reach rule, and this row is not
+                    // a second disclosure surface for it.
+                    detail: {
+                        task: view.taskId,
+                        call: link.callId,
+                        reads: spend.carried,
+                        found: spend.found,
+                        // `carried` / `not-completed` / `wake-unprovable` — a withheld settlement is a decision,
+                        // and an operator asking "why does this reply name nothing" must be able to read which.
+                        outcome: provable ? "carried" : view.status !== "completed" ? "not-completed" : "wake-unprovable",
+                        proof: reach.proof,
+                        ...(ownSessionId.length > 0 ? { session: ownSessionId } : {}),
+                        ...(wakeTurnId !== undefined && wakeTurnId.length > 0 ? { turn: wakeTurnId } : {}),
+                    },
+                }).catch(() => undefined);
+            }
+        }
+        // OPE-1654, the settlement half of the failure row. `failed` only: `cancelled` is the
+        // deployment's own reaper, not a dead read — see {@link TASK_FAILED_ACTION}.
+        //
+        // OPE-1737 — AND IT NAMES THE CALL, THE TOOL AND THE ERROR. The first two come off OE's own
+        // dispatch row, never off the notification, so a row with no join records neither. The third is
+        // the notification's own error paragraph, which is the only place eve puts a dead child's error
+        // where OE can reach it. A forged notification for an id this org never minted therefore still
+        // puts one scrubbed, capped string in a row that this settlement writes either way — round 2 of
+        // OPE-1737 accepted that, because the gate that used to prevent it also silenced every real
+        // failure whose join row was lost.
+        if (view.status === "failed") {
+            // `link` is the loop's own single read, taken above: a second read on a turn-preamble edge costs a round trip and can disagree with the first on a transient store error, printing a settled row that names the worker beside a failure row claiming the join was lost.
+            await noteDelegationFailure({
+                status: view.status,
+                // 🔴 THE ERROR IS NO LONGER GATED ON THE JOIN ROW (OPE-1737, round 2). It used to sit
+                // inside the `link !== undefined` arm, so a settlement whose dispatch row was lost — or a
+                // deployment with the taint plane off, which writes no dispatch row at all — recorded NO
+                // reason for the death. That is the undiagnosable row this ticket exists to remove, and
+                // the gate bought nothing: the text is upstream-authored on this edge whatever the join
+                // says, and it lands scrubbed and capped in a DETAIL field nothing keys on.
+                errorText: failure?.errorText ?? "",
+                errorClass: failure?.errorClass ?? "",
+                // The CALL and the TOOL stay gated, because they are OE's own facts. A forged settlement
+                // for a task this org never minted must never put a call id in the audit log.
+                ...(link !== undefined ? { callId: link.callId, tool: link.tool ?? "" } : {}),
+            }, view.taskId, ownSessionId, wakeTurnId, edge, failure?.parse ?? "none");
+        }
+    }
+    let any = false;
+    for (const view of views)
+        any = (await adoptTaskTaint(view, ownSessionId)) || any;
+    // Same belt as the sync branch, for the same reason: an adopted taint must reach the auth bag
+    // before the seat's next model call can delegate again.
+    if (any)
+        recordTurnTaintForChildren();
+    return any;
+}
+/**
+ * THE NOTIFICATION SETTLEMENT EDGE (OPE-904) — the settlement route that survives eve 0.40.0.
+ *
+ * ── WHY IT HAD TO EXIST ─────────────────────────────────────────────────────────────────────────
+ * Every settlement side effect above used to key on a task-VIEW tool result. eve 0.40.0 DELETES
+ * `task_peek`, which leaves `task_cancel` as the only view-bearing tool — and nobody cancels a task
+ * that finished on its own. So an ordinary settlement would reach NO OE edge: no wake identity, so
+ * the turn answers under the previous conversation's address or not at all; no taint adoption, so a
+ * child that read untrusted content hands its parent a clean signal; and no live-set clear, so the
+ * fan-out guard holds the memory flush closed until the hold bound retires the id.
+ *
+ * ── IT IS ALSO STRICTLY WIDER THAN THE EDGE IT REPLACES ─────────────────────────────────────────
+ * The view edge only ever fired when the model chose to look. Three shipped limits were written
+ * down as consequences of that and are closed by this edge, not merely preserved:
+ *   • OPE-597 — a settlement turn that read no view held NO address and could only `no_reply`;
+ *   • OPE-592's stated limit — such a turn reached no persist route either;
+ *   • OPE-563's stated limit — and adopted no taint.
+ * A notification arrives on EVERY settlement, so all three now have a route with no tool call in it.
+ *
+ * ── THE FENCES, AND WHY A FORGED NOTIFICATION IS INERT ──────────────────────────────────────────
+ * The text is model-visible and a member could type it. Three independent fences, each sufficient:
+ *   1. {@link installTaskWake} installs only on an UNINGRESSED turn. A member's message is an
+ *      ingressed turn carrying its own delivery stamp, so the install refuses it;
+ *   2. every consequence is BOUNDED. The match is LINE-anchored, not message-anchored
+ *      ({@link readTaskNotification}'s own header states why: eve folds a task COMPLETION COHORT of
+ *      caller-less deliveries into one string — the one merge arm still live on 0.54.3 (OPE-2042) —
+ *      so a message-anchored match would miss real settlements and fail OPEN on the
+ *      taint plane). So a member CAN put this sentence on a line of their own message. What that
+ *      buys is fenced everywhere it lands: the taint adoption only tightens, the address install is
+ *      refused by fence 1, and the OPE-1737 failure row records a call and a tool only for a task
+ *      with a dispatch row this org minted. Its `error` is recorded whatever the join says — one
+ *      scrubbed string capped at 300 characters, in a DETAIL field nothing keys on, in a row the
+ *      settlement writes anyway;
+ *   3. every consequence keys on a durable row THIS org minted at dispatch. An id with no row takes
+ *      the `no-row` outcome, which is audited and already handled.
+ * The taint adoption is the one act with no row of its own to key on — and it fails CLOSED (an
+ * unknown task id reads as a lost marker and MARKS the turn), so a forged notification can only
+ * make the deployment stricter.
+ *
+ * ── THE MEMORY FLUSH IS DEFERRED, ON PURPOSE ────────────────────────────────────────────────────
+ * A persist reads the sandbox and a provider. This edge is in the turn PREAMBLE, where this file's
+ * 🔴 rule keeps I/O light. So the notification does the two cheap bookkeeping acts instead —
+ * {@link noteTaskSettled} drops the settled id from the fan-out guard's live set and re-marks the
+ * tree dirty — and OPE-611's `turn.completed` backstop, which already runs on every turn of a
+ * session that has delegated, then performs the persist with the guard open. The child's edits
+ * reach the store on the SAME turn the notification arrived, which is one turn earlier than the
+ * view edge managed even when the model did peek.
+ *
+ * Returns whether the turn adopted a taint, purely so the test can assert on it.
+ */
+export async function settleFromTaskNotification(message, ownSessionId, ctx) {
+    const views = terminalTaskNotifications(message);
+    if (views.length === 0)
+        return false;
+    const settled = [];
+    const links = new Map();
+    for (const view of views) {
+        let next = view;
+        if (!links.has(view.taskId)) {
+            try {
+                links.set(view.taskId, await taskCallLink(deploymentOrg(), view.taskId));
+            }
+            catch {
+                links.set(view.taskId, undefined);
+                /* the census field degrades to "" — never a reason to skip a settlement */
+            }
+        }
+        const link = links.get(view.taskId);
+        if (link?.agentId !== undefined)
+            next = { ...view, agentId: link.agentId };
+        // BEFORE the side effects, and synchronous: the fan-out guard must stop counting this child as
+        // a live writer before the turn-end backstop asks.
+        noteTaskSettled(next);
+        settled.push(next);
+    }
+    return applyTaskSettlement(settled, ownSessionId, ctx, {
+        notification: true,
+        links,
+        authorizeRedispatch: taskNotificationStartsWithTerminal(message),
+        ...(settled.length === 1 ? { failure: taskNotificationFailure(message) } : {}),
+    });
+}
+export default defineHook({
+    events: {
+        // DO NOT READ THE STORE HERE: eve re-executes an uncommitted inline step body on redelivery, and the forward leg's first cut reproduced it under load — 4429 re-executions of one step, then CorruptedEventLogError, and the turn was lost (OPE-465).
+        // The whole handler is synchronous, and the dispatch pin is written LAST because the adoption one line above is the reader of the pin this session arrived with.
+        "turn.started": (_event, ctx) => {
+            openTaintTurn(ctx);
+            // The RAW delivery stamp, never `currentWakeId`: `currentWakeId` answers `undefined` on an uningressed turn, so passing it here would feed the comparison its own output and classify the next turn on a cleared value.
+            const bind = ctx;
+            noteTurnBoundary(currentTurnId(bind), deliveryStampOf(bind));
+            // The stream-drop retry count is PER TURN (OPE-2132), so it is cleared at the same boundary the
+            // taint turn opens at. Without the clear, a session's second failing turn would report the
+            // first turn's retry and the row would name a re-send that turn never made.
+            clearStreamDropRetries();
+        },
+        // This handler runs on EVERY message in the deployment, so the pure pre-filter comes first and nothing touches the store until it matches; the persist stays on the `turn.completed` backstop.
+        "message.received": async (event, ctx) => {
+            try {
+                if (isSubagentChildContext(ctx))
+                    return;
+                const ownSessionId = ctx.session?.id;
+                if (typeof ownSessionId !== "string" || ownSessionId.length === 0)
+                    return;
+                await settleFromTaskNotification(event.data?.message, ownSessionId, ctx);
+            }
+            catch {
+                /* the belt is best-effort; the parent's approval controls are unchanged */
+            }
+        },
+        // The memory backstop runs on `turn.completed` because `session.completed` fires for NO session on this build (measured on prod over 36 h: 9 sessions, 67 turns, zero).
+        "turn.completed": async (_event, ctx) => {
+            try {
+                await flushDirtyTreeAtTurnEnd(ctx);
+            }
+            catch {
+                /* the next settlement or turn-end backstop still persists this tree */
+            }
+        },
+        // The WORKER's own side of a death. It is the mirror of the parent's `delegation.task_failed`: that row names the class, this one names the LINE. Restricted to a delegated child, because a seat's own failed turn is another plane's business and this row's whole readership is "which worker died where".
+        "turn.failed": async (event, ctx) => {
+            try {
+                const bind = ctx;
+                if (!isSubagentChildContext(bind))
+                    return;
+                const ownSessionId = ctx.session?.id;
+                const data = event.data;
+                const turnId = currentTurnId(bind);
+                await appendAudit({
+                    org: deploymentOrg(),
+                    // Same partition as the parent's failure row, so one query answers both sides of a death.
+                    platform: "ingest",
+                    workspace: "delegation",
+                    action: WORKER_TURN_FAILED_ACTION,
+                    // Ids, eve's own class and message, and the stack FRAMES — never a byte the worker read or wrote. `frames` is empty when eve's payload carried no stack, which is itself the diagnosis on a row whose error came back as a bare value.
+                    detail: {
+                        code: auditErrorDetail(typeof data?.code === "string" ? data.code : "").error,
+                        error: auditErrorDetail(typeof data?.message === "string" ? data.message : "").error,
+                        frames: auditErrorFrames(data?.details),
+                        ...(typeof ownSessionId === "string" && ownSessionId.length > 0 ? { session: ownSessionId } : {}),
+                        ...(turnId !== undefined && turnId.length > 0 ? { turn: turnId } : {}),
+                        // 🔴 HOW MANY TIMES THIS TURN'S MODEL STEP WAS RE-SENT (OPE-2132). A worker retries one
+                        // transient stream drop and then fails on the second, so a row carrying `retried: 1` is
+                        // the SECOND drop and a row without the field is a death nothing re-ran. Without it the
+                        // two are the same row, and "the retry did not help" reads as "the retry never ran".
+                        ...(streamDropRetriesThisTurn() > 0 ? { retried: streamDropRetriesThisTurn() } : {}),
+                    },
+                }).catch(() => undefined);
+            }
+            catch {
+                /* a diagnostic row is never worth failing a turn that is already failing */
+            }
+        },
+        // PRE-DISPATCH POINTER. `action.result` is too late to be the child's only address: a lightly
+        // loaded runtime may launch the child as soon as the action starts. Record the parent wake under
+        // the host call id first; the receipt below advances it to the task's retargetable wake.
+        "actions.requested": async (event, ctx) => {
+            if (isSubagentChildContext(ctx))
+                return;
+            const ownSessionId = ctx.session?.id;
+            if (typeof ownSessionId !== "string" || ownSessionId.length === 0)
+                return;
+            const bind = ctx;
+            const turnId = currentTurnId(bind);
+            const actions = event.data?.actions ?? [];
+            for (const action of actions) {
+                const delegated = action.kind === "subagent-call" || (action.kind === "tool-call" && action.toolName === "agent");
+                if (delegated && typeof action.callId === "string" && action.callId.length > 0) {
+                    const settlement = settlementDispatchAuthorityThisTurn(turnId);
+                    const uningressedUnifiedTurn = isUnifiedWindowContext(bind) && uningressedTurn(turnId);
+                    // Routine/job host wakes can also be unified and uningressed. They retain the exact wake
+                    // already recorded by their host path. This stricter branch belongs only to turns where
+                    // settlement handling left an explicit authority verdict or installed a task reply wake.
+                    const settlementTurn = uningressedUnifiedTurn && (settlement.kind !== "none" || taskWakeThisTurn(turnId) !== undefined);
+                    // An uningressed unified settlement turn has no human delivery to authorize a fallback.
+                    // Refuse only delegation: ordinary reply and bookkeeping actions retain their existing
+                    // first-write-wins address behavior on view-only or ambiguous settlement turns.
+                    if (settlementTurn && settlement.kind !== "single") {
+                        throw new Error("delegated task dispatch authority is missing or ambiguous — refusing child launch before an exact wake is addressed");
+                    }
+                    const settlementAuthority = settlement.kind === "single" ? settlement.authority : undefined;
+                    const wakeId = settlementTurn
+                        ? settlementAuthority?.wakeId
+                        : addressedWakeThisTurn(turnId) ?? exactDispatchWakeThisTurn(turnId);
+                    // This is the last edge before Eve may launch the child. If the pointer cannot be made
+                    // durable, abort the dispatch instead of allowing a worker with unbound authority. The
+                    // unified pointer resolves requester/member/binding atomically from that wake's row; the
+                    // mutable last-delivery auth is never paired with an addressed sibling wake.
+                    if (wakeId !== undefined) {
+                        try {
+                            await rememberDelegatedTaskWake(deploymentOrg(), ownSessionId, action.callId, wakeId);
+                        }
+                        catch {
+                            throw new Error("delegated task dispatch authority is missing or ambiguous — refusing child launch before an exact wake is addressed");
+                        }
+                    }
+                    else if (!isUnifiedWindowContext(bind)) {
+                        const requester = requesterThisTurn(turnId);
+                        const nonMemberWake = bind.session?.auth?.current?.attributes?.[OE_CHAT_NONMEMBER_ATTR] === "true";
+                        await rememberDelegatedTaskBinding(deploymentOrg(), ownSessionId, action.callId, bindFrom(bind), requester, nonMemberWake);
+                    }
+                    else
+                        throw new Error("delegated task dispatch authority is missing or ambiguous — refusing child launch before an exact wake is addressed");
+                }
+            }
+        },
+        // THREE BRANCHES, AND THEIR ORDER IS LOAD-BEARING: a parked task receipt is ALSO a `subagent-result` with a real callId, so the receipt branch must run BEFORE the sync branch or every clean delegation fails closed at dispatch.
+        "action.result": async (event, ctx) => {
+            try {
+                if (isSubagentChildContext(ctx))
+                    return;
+                const result = event.data?.result;
+                const ownSessionId = ctx.session?.id;
+                if (typeof ownSessionId !== "string" || ownSessionId.length === 0)
+                    return;
+                // BRANCH 1 — DISPATCH. Remember the join and adopt nothing; the child has not run.
+                const receipt = readTaskReceipt(result);
+                if (receipt !== null) {
+                    await noteTaskReceipt(receipt, ownSessionId);
+                    // Mint the wake identity HERE from the exact parent-session + call pointer written before
+                    // launch. The receipt never reselects from mutable turn/session state.
+                    const bind = ctx;
+                    const dispatchTurnId = currentTurnId(bind);
+                    // This pointer is the sole unified receipt authority. A missing row refuses before mint;
+                    // native binding-only delegation retains its existing non-unified path.
+                    const prelaunchAuthority = await delegatedTaskDispatchAuthority(deploymentOrg(), ownSessionId, receipt.callId);
+                    if (isUnifiedWindowContext(bind) && prelaunchAuthority === undefined) {
+                        throw new Error("delegated task authority disappeared before receipt");
+                    }
+                    const dispatchWakeId = prelaunchAuthority?.wakeId;
+                    const ownWindowToken = resolveOwnWindowToken(bind);
+                    const minted = await openTaskWake({
+                        org: deploymentOrg(),
+                        taskId: receipt.taskId,
+                        parentWakeId: dispatchWakeId,
+                        windowToken: ownWindowToken,
+                    });
+                    if (minted !== null) {
+                        if (prelaunchAuthority === undefined)
+                            throw new Error("delegated task authority disappeared before receipt");
+                        await advanceDelegatedTaskWake(deploymentOrg(), ownSessionId, receipt.callId, receipt.taskId, minted, prelaunchAuthority);
+                    }
+                    // From here this seat generation owes a worker its answer. The ledger is durable and keyed on the generation's own continuation token, because the retirement drain runs in a different session on a later wake.
+                    await noteGenerationDelegation(deploymentOrg(), ownWindowToken, receipt.taskId);
+                    if (minted !== null)
+                        noteTaskDispatchedThisTurn(dispatchTurnId, receipt.taskId, minted);
+                    // From this instant the turn has asked a worker for an answer it does not hold, and the reply plane reads this to refuse a `done:true` that would close the conversation first.
+                    notePendingDelegation(dispatchTurnId, receipt.taskId, dispatchWakeId);
+                    // OPE-592: from this instant a child holds the parent's memory tree. Counting it live is
+                    // what stops a LATER sibling's settlement from flushing a file this one is mid-write in.
+                    noteTaskDispatched(receipt.taskId);
+                    return;
+                }
+                // Only TERMINAL views adopt: a `working` or `input_required` child can still read untrusted content.
+                // The fan-out guard is reconciled against EVERY view first, ahead of the early return, because a `working` sibling in the same peek is the sharpest evidence another child still holds the tree.
+                noteTaskViews(taskViewsOf(result));
+                const terminal = terminalTaskViewsOf(result);
+                if (terminal.length > 0) {
+                    await applyTaskSettlement(terminal, ownSessionId, ctx);
+                    // LAST on this branch: the flush awaits I/O, and an adopted taint must reach the auth bag before anything else can delegate.
+                    await flushSettledMemory(ctx, "task-settled");
+                    return;
+                }
+                // Written here rather than as a branch of its own so it falls through to BRANCH 3: a dead delegation is still a `subagent-result` with a real callId, and a child that read a hostile page and then crashed has still put its taint in the marker.
+                const failure = readDelegationFailure(result);
+                if (failure !== null) {
+                    // OPE-1737 round 2: `parse: "result"` — this edge reads every field off eve's own result
+                    // envelope and never touches a notification text, so neither the payload reader nor its
+                    // raw fallback applies here.
+                    await noteDelegationFailure(failure, "", ownSessionId, currentTurnId(ctx), "result", "result");
+                }
+                if (result?.kind !== "subagent-result" || typeof result.callId !== "string")
+                    return;
+                if (await adoptSubagentTaint(result.callId, ownSessionId)) {
+                    // The flip observer has already stamped the bag; this call is the explicit belt, so an adopted taint is in the auth bag before the seat's next model call can delegate again.
+                    recordTurnTaintForChildren();
+                }
+                // WHETHER THIS BRANCH IS STILL REACHED ON A 0.51.0 BUILD IS UNPROVEN (OPE-1440): every delegation parks, and the receipt branch intercepts it. It is kept as a durability BELT, not a gate — do not read its presence as evidence that it runs.
+                // It runs on every sync return, not only a tainted one: durability is not a taint control.
+                await flushSettledMemory(ctx, "delegation-returned");
+            }
+            catch {
+                /* the belt is best-effort; the parent's approval controls are unchanged */
+            }
+        },
+    },
+});
+//# sourceMappingURL=spawn-taint.js.map