@open-everywhere/core 0.1.0

package/dist/agent/identity/surface-parity.d.ts

@@ -0,0 +1,274 @@
+/** One cell: a bare `supported`, `{ supported }` with a caveat, or `{ unsupported }` with a reason that names the platform limit or the ticket that closes the gap. An empty note or reason reds the lint, and there is deliberately no "unknown" cell. */
+export type CapabilityDeclaration = "supported" | {
+    readonly supported: string;
+} | {
+    readonly unsupported: string;
+};
+/** Which table a capability renders into, and therefore which part of the contract it answers. */
+export type CapabilityGroup = "seam" | "shape" | "verb";
+export interface SurfaceCapability {
+    /** Stable key. Verb rows use the verb's own tool name so the row and the tool cannot drift apart. */
+    readonly id: string;
+    readonly label: string;
+    readonly section: string;
+    readonly group: CapabilityGroup;
+}
+/**
+ * EVERY capability the chat-surface contract names, in the order the generated tables print.
+ *
+ * 🔴 ADDING A ROW IS A DELIBERATE ACT: the moment a row lands here, all six provider declarations
+ * stop compiling until each one answers it. That is the point — a capability that reaches the
+ * contract without every surface stating its position is the exact failure OPE-1499 closes.
+ */
+export declare const SURFACE_CAPABILITIES: readonly [{
+    readonly id: "identity-mapper";
+    readonly label: "Identity mapper";
+    readonly section: "§2.1";
+    readonly group: "seam";
+}, {
+    readonly id: "capability-manifest";
+    readonly label: "Capability manifest";
+    readonly section: "§2.4";
+    readonly group: "seam";
+}, {
+    readonly id: "post-arm";
+    readonly label: "Post arm";
+    readonly section: "§4.1";
+    readonly group: "seam";
+}, {
+    readonly id: "wake-origin-codec";
+    readonly label: "Wake-origin codec";
+    readonly section: "§2.3";
+    readonly group: "seam";
+}, {
+    readonly id: "unified-action-plane";
+    readonly label: "**Unified component plane** (`dispatchUnifiedActions`)";
+    readonly section: "§4.1";
+    readonly group: "seam";
+}, {
+    readonly id: "origin-placement-carry";
+    readonly label: "**Wake-origin placement carry** (`placementRef`/`carryPlacement`)";
+    readonly section: "§2.3";
+    readonly group: "seam";
+}, {
+    readonly id: "read-adapter";
+    readonly label: "Read adapter";
+    readonly section: "§4.5";
+    readonly group: "seam";
+}, {
+    readonly id: "reaction-feedback-ingest";
+    readonly label: "Reaction **feedback** ingest";
+    readonly section: "§4.9";
+    readonly group: "seam";
+}, {
+    readonly id: "ancillary-ops";
+    readonly label: "Ancillary ops (`SurfaceMessageOps`)";
+    readonly section: "§5";
+    readonly group: "seam";
+}, {
+    readonly id: "ambient-engagement-seam";
+    readonly label: "**Ambient engagement seam**";
+    readonly section: "§2.5";
+    readonly group: "seam";
+}, {
+    readonly id: "engaged-row-promotion";
+    readonly label: "**Engaged wake row promotion** (`thread-follow`)";
+    readonly section: "§2.5";
+    readonly group: "seam";
+}, {
+    readonly id: "owned-thread-ingress";
+    readonly label: "**Owned-thread ingress divert**";
+    readonly section: "§2.6";
+    readonly group: "seam";
+}, {
+    readonly id: "seat-catch-up";
+    readonly label: "**Seat catch-up read** (since last wake)";
+    readonly section: "§2.5";
+    readonly group: "seam";
+}, {
+    readonly id: "seat-context-admission";
+    readonly label: "**Seat context-line admission** (`admitContextLines`)";
+    readonly section: "§2.5";
+    readonly group: "seam";
+}, {
+    readonly id: "approval-card";
+    readonly label: "**Approval card** (tappable Approve/Reject)";
+    readonly section: "§4.1";
+    readonly group: "seam";
+}, {
+    readonly id: "judge-lift-notice";
+    readonly label: "**Judge-lift notice** (a lifted act leaves a trace)";
+    readonly section: "§4.1";
+    readonly group: "seam";
+}, {
+    readonly id: "addressed-leg";
+    readonly label: "Addressed (@mention) leg";
+    readonly section: "§2.2";
+    readonly group: "shape";
+}, {
+    readonly id: "ambient-leg";
+    readonly label: "Ambient (non-mention) leg";
+    readonly section: "§2.5";
+    readonly group: "shape";
+}, {
+    readonly id: "name-drop-mention";
+    readonly label: "Name-drop / structured mention";
+    readonly section: "§2.5";
+    readonly group: "shape";
+}, {
+    readonly id: "message-edit-wake";
+    readonly label: "Message-EDIT wake";
+    readonly section: "§2.5";
+    readonly group: "shape";
+}, {
+    readonly id: "threads";
+    readonly label: "Threads";
+    readonly section: "§4.6";
+    readonly group: "shape";
+}, {
+    readonly id: "rooms";
+    readonly label: "Standing rooms *(not §4.5's `read_channel` container)*";
+    readonly section: "§4.7.1";
+    readonly group: "shape";
+}, {
+    readonly id: "dm";
+    readonly label: "DM (`dm`)";
+    readonly section: "§4.7.2";
+    readonly group: "shape";
+}, {
+    readonly id: "mpim";
+    readonly label: "Group DM (`mpim`)";
+    readonly section: "§4.7.2";
+    readonly group: "shape";
+}, {
+    readonly id: "reply";
+    readonly label: "`reply`";
+    readonly section: "§4.1";
+    readonly group: "verb";
+}, {
+    readonly id: "edit_reply";
+    readonly label: "`edit_reply`";
+    readonly section: "§4.2";
+    readonly group: "verb";
+}, {
+    readonly id: "react";
+    readonly label: "`react`";
+    readonly section: "§4.3";
+    readonly group: "verb";
+}, {
+    readonly id: "no_reply";
+    readonly label: "`no_reply`";
+    readonly section: "§4.4";
+    readonly group: "verb";
+}, {
+    readonly id: "read_channel";
+    readonly label: "`read_channel`";
+    readonly section: "§4.5";
+    readonly group: "verb";
+}, {
+    readonly id: "read_thread";
+    readonly label: "`read_thread`";
+    readonly section: "§4.6";
+    readonly group: "verb";
+}, {
+    readonly id: "search";
+    readonly label: "`search`";
+    readonly section: "§4.7";
+    readonly group: "verb";
+}, {
+    readonly id: "post_message";
+    readonly label: "`post_message` (P1)";
+    readonly section: "§4.7.1";
+    readonly group: "verb";
+}, {
+    readonly id: "dm_person";
+    readonly label: "`dm_person` (P2)";
+    readonly section: "§4.7.2";
+    readonly group: "verb";
+}, {
+    readonly id: "set_dm_delivery";
+    readonly label: "`set_dm_delivery` (P2, recipient)";
+    readonly section: "§4.7.2";
+    readonly group: "verb";
+}, {
+    readonly id: "stop";
+    readonly label: "`stop` (human)";
+    readonly section: "§4.8";
+    readonly group: "verb";
+}, {
+    readonly id: "ack_stop_glyph";
+    readonly label: "`ack`: ✋ glyph";
+    readonly section: "§4.9";
+    readonly group: "verb";
+}, {
+    readonly id: "ack_cancel_note";
+    readonly label: "`ack`: cancel note";
+    readonly section: "§4.9";
+    readonly group: "verb";
+}, {
+    readonly id: "stand_down";
+    readonly label: "`stand_down`";
+    readonly section: "§4.10";
+    readonly group: "verb";
+}, {
+    readonly id: "post_file";
+    readonly label: "`post_file`";
+    readonly section: "§7.4";
+    readonly group: "verb";
+}];
+/** Every capability id, as a union — a provider declaration must answer each one. */
+export type SurfaceCapabilityId = (typeof SURFACE_CAPABILITIES)[number]["id"];
+/**
+ * One provider's answer to every row. A mapped type over the id union, so OMITTING A ROW IS A TYPE
+ * ERROR at the provider — the lint below is the second net, for the fixture/JS callers the compiler
+ * never sees.
+ */
+export type SurfaceParityDeclaration = {
+    readonly [K in SurfaceCapabilityId]: CapabilityDeclaration;
+};
+/**
+ * Register one platform's surface-parity declaration. Called once from the bundle's own
+ * `register<X>Provider()`, beside `registerCapabilityManifest` — the same provider-bundle seam,
+ * so a bundle states its parity in the one place it states everything else.
+ */
+export declare function registerSurfaceParity(platform: string, declaration: SurfaceParityDeclaration): void;
+export declare function surfaceParityFor(platform: string): SurfaceParityDeclaration | undefined;
+/** Every platform that has registered a declaration, sorted. */
+export declare function registeredSurfaceParityPlatforms(): readonly string[];
+export declare function isSupported(cell: CapabilityDeclaration): boolean;
+export declare function declarationNote(cell: CapabilityDeclaration): string | undefined;
+export interface ParityProblem {
+    readonly platform: string;
+    /** The capability the problem is about, or undefined for a whole-platform problem. */
+    readonly capability?: string;
+    readonly message: string;
+}
+/** A machine probe of one capability: the set of platforms where the code itself registers that arm. The lint supplies it by booting the provider bundles, so a declaration that disagrees with the code reds. */
+export type CapabilityProbe = ReadonlyMap<string, ReadonlySet<string>>;
+/**
+ * Check every platform's declaration for totality, reasoned absences, and — where a probe exists —
+ * agreement with the code.
+ *
+ * `declarations` takes `unknown` values on purpose. The type system already stops a provider from
+ * omitting a row; this function is the net under the cases the compiler cannot see (a fixture, a
+ * hand-built object, a bundle loaded from JS), and it can only be that net if it accepts a shape
+ * the type forbids. The unit test builds exactly such fixtures.
+ *
+ * Pure: reads nothing, writes nothing, and returns every problem it finds rather than throwing on
+ * the first — a provider author fixing one row at a time pays one lint run per row otherwise.
+ */
+export declare function checkSurfaceParity(declarations: ReadonlyMap<string, unknown>, probes?: CapabilityProbe): readonly ParityProblem[];
+/**
+ * The markdown table for one capability group, sourced entirely from the declarations.
+ *
+ * Deterministic: rows in {@link SURFACE_CAPABILITIES} order, columns in the caller's platform
+ * order, so a re-run over unchanged declarations renders byte-identical output and the generator
+ * writes nothing (scripts/write-if-changed.ts).
+ */
+export declare function renderParityTable(group: CapabilityGroup, declarations: ReadonlyMap<string, SurfaceParityDeclaration>, platforms: readonly string[]): string;
+/**
+ * The matrix `npm run lint:surface-parity` prints to stdout — the whole ledger in one screen, so a
+ * reader sees the gaps without opening the doc. Plain text, aligned, no markdown.
+ */
+export declare function renderParityMatrix(declarations: ReadonlyMap<string, SurfaceParityDeclaration>, platforms: readonly string[]): string;
+//# sourceMappingURL=surface-parity.d.ts.map

package/dist/agent/identity/surface-parity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-parity.d.ts","sourceRoot":"","sources":["../../../agent/identity/surface-parity.ts"],"names":[],"mappings":"AAKA,2PAA2P;AAC3P,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,kGAAkG;AAClG,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,qGAAqG;IACrG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;;;;GAMG;AAOH,eAAO,MAAM,oBAAoB;iBAEzB,iBAAiB;oBAAS,iBAAiB;sBAAW,MAAM;oBAAS,MAAM;;iBAC3E,qBAAqB;oBAAS,qBAAqB;sBAAW,MAAM;oBAAS,MAAM;;iBACnF,UAAU;oBAAS,UAAU;sBAAW,MAAM;oBAAS,MAAM;;iBAC7D,mBAAmB;oBAAS,mBAAmB;sBAAW,MAAM;oBAAS,MAAM;;iBAU/E,sBAAsB;oBAAS,wDAAwD;sBAAW,MAAM;oBAAS,MAAM;;iBASvH,wBAAwB;oBAAS,mEAAmE;sBAAW,MAAM;oBAAS,MAAM;;iBACpI,cAAc;oBAAS,cAAc;sBAAW,MAAM;oBAAS,MAAM;;iBACrE,0BAA0B;oBAAS,8BAA8B;sBAAW,MAAM;oBAAS,MAAM;;iBACjG,eAAe;oBAAS,qCAAqC;sBAAW,IAAI;oBAAS,MAAM;;iBAC3F,yBAAyB;oBAAS,6BAA6B;sBAAW,MAAM;oBAAS,MAAM;;iBAU/F,uBAAuB;oBAAS,kDAAkD;sBAAW,MAAM;oBAAS,MAAM;;iBAQlH,sBAAsB;oBAAS,iCAAiC;sBAAW,MAAM;oBAAS,MAAM;;iBAQhG,eAAe;oBAAS,0CAA0C;sBAAW,MAAM;oBAAS,MAAM;;iBAWlG,wBAAwB;oBAAS,uDAAuD;sBAAW,MAAM;oBAAS,MAAM;;iBAiBxH,eAAe;oBAAS,6CAA6C;sBAAW,MAAM;oBAAS,MAAM;;iBAWrG,mBAAmB;oBAAS,qDAAqD;sBAAW,MAAM;oBAAS,MAAM;;iBAEjH,eAAe;oBAAS,0BAA0B;sBAAW,MAAM;oBAAS,OAAO;;iBACnF,aAAa;oBAAS,2BAA2B;sBAAW,MAAM;oBAAS,OAAO;;iBAClF,mBAAmB;oBAAS,gCAAgC;sBAAW,MAAM;oBAAS,OAAO;;iBAM7F,mBAAmB;oBAAS,mBAAmB;sBAAW,MAAM;oBAAS,OAAO;;iBAChF,SAAS;oBAAS,SAAS;sBAAW,MAAM;oBAAS,OAAO;;iBAM5D,OAAO;oBAAS,wDAAwD;sBAAW,QAAQ;oBAAS,OAAO;;iBAC3G,IAAI;oBAAS,WAAW;sBAAW,QAAQ;oBAAS,OAAO;;iBAC3D,MAAM;oBAAS,mBAAmB;sBAAW,QAAQ;oBAAS,OAAO;;iBAErE,OAAO;oBAAS,SAAS;sBAAW,MAAM;oBAAS,MAAM;;iBACzD,YAAY;oBAAS,cAAc;sBAAW,MAAM;oBAAS,MAAM;;iBACnE,OAAO;oBAAS,SAAS;sBAAW,MAAM;oBAAS,MAAM;;iBACzD,UAAU;oBAAS,YAAY;sBAAW,MAAM;oBAAS,MAAM;;iBAC/D,cAAc;oBAAS,gBAAgB;sBAAW,MAAM;oBAAS,MAAM;;iBACvE,aAAa;oBAAS,eAAe;sBAAW,MAAM;oBAAS,MAAM;;iBACrE,QAAQ;oBAAS,UAAU;sBAAW,MAAM;oBAAS,MAAM;;iBAC3D,cAAc;oBAAS,qBAAqB;sBAAW,QAAQ;oBAAS,MAAM;;iBAC9E,WAAW;oBAAS,kBAAkB;sBAAW,QAAQ;oBAAS,MAAM;;iBACxE,iBAAiB;oBAAS,mCAAmC;sBAAW,QAAQ;oBAAS,MAAM;;iBAC/F,MAAM;oBAAS,gBAAgB;sBAAW,MAAM;oBAAS,MAAM;;iBAC/D,gBAAgB;oBAAS,gBAAgB;sBAAW,MAAM;oBAAS,MAAM;;iBACzE,iBAAiB;oBAAS,oBAAoB;sBAAW,MAAM;oBAAS,MAAM;;iBAC9E,YAAY;oBAAS,cAAc;sBAAW,OAAO;oBAAS,MAAM;;iBACpE,WAAW;oBAAS,aAAa;sBAAW,MAAM;oBAAS,MAAM;EACxB,CAAC;AAElD,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,QAAQ,EAAE,CAAC,IAAI,mBAAmB,GAAG,qBAAqB;CAC3D,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,GAAG,IAAI,CAGnG;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS,CAEvF;AAED,gEAAgE;AAChE,wBAAgB,gCAAgC,IAAI,SAAS,MAAM,EAAE,CAEpE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAEhE;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAG/E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,kNAAkN;AAClN,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AAYvE;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAC1C,MAAM,GAAE,eAA2B,GAClC,SAAS,aAAa,EAAE,CA+F1B;AAiBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAC3D,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,MAAM,CAeR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EAC3D,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,MAAM,CAgCR"}

package/dist/agent/identity/surface-parity.js

@@ -0,0 +1,357 @@
+// The per-provider declaration of every capability the chat-surface contract names; the lint and the contract's parity tables are projections of it. It gates nothing at runtime — the runtime gate is the capability manifest in identity/capabilities.ts, and the two must not merge.
+import { admitProviderRegistration } from "../access/provider-selection.js";
+import { processRegistryMap } from "../lib/process-registry.js";
+/**
+ * EVERY capability the chat-surface contract names, in the order the generated tables print.
+ *
+ * 🔴 ADDING A ROW IS A DELIBERATE ACT: the moment a row lands here, all six provider declarations
+ * stop compiling until each one answers it. That is the point — a capability that reaches the
+ * contract without every surface stating its position is the exact failure OPE-1499 closes.
+ */
+// 🔴 `satisfies`, NEVER a `: readonly SurfaceCapability[]` ANNOTATION. That annotation WIDENED the
+// tuple, so `(typeof SURFACE_CAPABILITIES)[number]["id"]` collapsed to `string`,
+// {@link SurfaceParityDeclaration} became an index signature with no required keys, and the
+// compile-time half of the promise above was inert — an unanswered row typechecked clean and only
+// `lint:surface-parity` caught it. `satisfies` checks every entry against the shape and keeps the
+// literal tuple, which is what makes the id union real.
+export const SURFACE_CAPABILITIES = [
+    // --- §7.1 registration seams -----------------------------------------------------------------
+    { id: "identity-mapper", label: "Identity mapper", section: "§2.1", group: "seam" },
+    { id: "capability-manifest", label: "Capability manifest", section: "§2.4", group: "seam" },
+    { id: "post-arm", label: "Post arm", section: "§4.1", group: "seam" },
+    { id: "wake-origin-codec", label: "Wake-origin codec", section: "§2.3", group: "seam" },
+    // 🔴 THE COMPONENT PLANE, NOT THE CARD (OPE-1720). Core has rendered a bridged eve approval as a
+    // TAPPABLE card since `PostArm` grew `dispatchUnifiedActions`, and `unified.ts`'s `input.requested`
+    // handler asks the REGISTRY — never a platform list — whether this surface can carry buttons. What
+    // nothing recorded was the answer: ONE provider implemented the member, so on five surfaces a
+    // governed connector write silently degraded to prose and no gate could tell that apart from a
+    // surface that had deliberately declined. The declaration carries a second obligation the reason
+    // string must honour — an arm may declare this only once its surface routes the `oe_input:` tap
+    // BACK, because a button that settles nothing is worse than no button on a governed write. This row
+    // is where each surface answers "can a unified post here carry a button, and does its tap land".
+    { id: "unified-action-plane", label: "**Unified component plane** (`dispatchUnifiedActions`)", section: "§4.1", group: "seam" },
+    // 🔴 THE PLACEMENT, NOT THE CONVERSATION (OPE-1826). `sameUnifiedConversation` compares
+    // `unifiedThreadRef` alone, so on a surface whose post anchor sits OUTSIDE that identity — Slack's
+    // `replyAnchorTs`, Discord's `messageId` — two wakes in one container are ONE conversation naming
+    // two different messages to hang under. The carry that repairs it was written for Slack and read as
+    // cross-surface; five codecs registered no arm and nothing said whether that was a considered
+    // absence or an unfinished one, while `unified.ts` hardcoded `platform === "slack"` beside it. This
+    // row is where each surface answers "does my origin carry a placement outside its identity", and an
+    // `unsupported` cell naming the thread key that already settles it is a complete answer.
+    { id: "origin-placement-carry", label: "**Wake-origin placement carry** (`placementRef`/`carryPlacement`)", section: "§2.3", group: "seam" },
+    { id: "read-adapter", label: "Read adapter", section: "§4.5", group: "seam" },
+    { id: "reaction-feedback-ingest", label: "Reaction **feedback** ingest", section: "§4.9", group: "seam" },
+    { id: "ancillary-ops", label: "Ancillary ops (`SurfaceMessageOps`)", section: "§5", group: "seam" },
+    { id: "ambient-engagement-seam", label: "**Ambient engagement seam**", section: "§2.5", group: "seam" },
+    // 🔴 THE AUDIT ROW, NOT THE WAKE (OPE-1752). The wake is the row above; this row asks a narrower
+    // question about the `<platform>.dispatched` record it leaves behind. An ambient classifier
+    // answers "did this comment ADDRESS the agent", so it calls an engaged follow-up and unowned room
+    // chatter alike `channel-watch` — and a surface that writes THAT word into its dispatch row cannot
+    // tell the two apart afterwards. `gateEngagedWake` skips on an EMPTY dispatch read only, so an
+    // unpromoted row is a hard `J-ENGAGED-<platform>` failure against a healthy deployment. It cost a
+    // journey three times: Notion (OPE-1510), Linear (OPE-1578) and GitHub (OPE-1752), each found in
+    // production rather than by a gate, because nothing said which surfaces carried the mapping. This
+    // row is where each surface answers "does my dispatch row promote an engaged follow-up".
+    { id: "engaged-row-promotion", label: "**Engaged wake row promotion** (`thread-follow`)", section: "§2.5", group: "seam" },
+    // 🔴 THE INGRESS SEAM, NOT THE ROUTING RULE (OPE-1719). The rule — an owned thread's follow-up
+    // goes to the owner, and the standing seat stays ambiently aware — lives in core and is one
+    // decision for every surface. What varied, invisibly, was whether a surface ASKED: the inbound
+    // divert had one production caller for weeks. A thread seat spawned from Teams, GitHub, Linear or
+    // Notion was then silently orphaned, because nothing read its ownership row; on Discord no seat
+    // could be spawned at all, because no Discord wake was thread-scoped. This row is where each
+    // surface answers "does my ingest consult thread ownership".
+    { id: "owned-thread-ingress", label: "**Owned-thread ingress divert**", section: "§2.6", group: "seam" },
+    // 🔴 THE FETCH, NOT THE CATCH-UP RULE (OPE-1726). The rule — every wake reads the seat's own
+    // container since its last wake, admission-filtered and capped — lives in core and is one decision
+    // for every surface (channels/seat-catch-up.ts). What varies is whether a surface can READ its own
+    // history at wake time, and for five of them the honest answer was "it does not, and nothing says
+    // so": a seat answered once and then went blind between its own wakes, rendering the same empty
+    // context a genuinely quiet room renders. This row is where each surface answers "can my seat
+    // catch up", and an `unsupported` cell is what the wake's own UNAVAILABLE note states out loud.
+    { id: "seat-catch-up", label: "**Seat catch-up read** (since last wake)", section: "§2.5", group: "seam" },
+    // 🔴 THE SLOT, NOT THE POLICY (OPE-1838). The policy — which authors enter a standing seat's
+    // context — lives in core as a named function a domain selects (channels/seat-admission.ts), and is
+    // one decision for every surface. What varies is whether a surface's name-drop hydration POURS INTO
+    // the seat's context slot at all, and whether that pour goes through `admitContextLines`. A surface
+    // that fills the slot beside the road hands the seat the very messages the domain's catch-up just
+    // refused — one author, two answers, inside one wake. That is the OPE-1800 class, and it survived
+    // on GitHub and Linear for weeks because the slot fill and the road were separate facts nothing
+    // joined. This row is where each surface answers "does my hydration fill the seat's context slot,
+    // and does it fill it through the one road", and an `unsupported` cell naming an empty slot is a
+    // complete answer — there is no unpoliced pour to declare.
+    { id: "seat-context-admission", label: "**Seat context-line admission** (`admitContextLines`)", section: "§2.5", group: "seam" },
+    // 🔴 THE VENUE, NOT THE APPROVAL (OPE-1838). Every governed act is proposed through ONE core path
+    // (approvals/flow.ts `requestApproval`), and that path renders a TAPPABLE Approve/Reject card only
+    // where the surface can carry one: Slack through the built-in Block Kit render, any other surface
+    // through a `CardPoster` its own bundle registers. `hasApprovalCardPath` is that question, and this
+    // row is where each surface answers it — because until the row existed the answer was a fact only
+    // the code knew, so a bundle that DROPPED its poster and one that never wrote one read identically.
+    //
+    // 🔴 WHAT A CARDLESS SURFACE COSTS DEPENDS ON THE CALLER, AND THE ROW DOES NOT SETTLE IT. A propose
+    // site that takes the venue walk (approvals/card-venue.ts `approvalVenueFor`) is redirected to a
+    // card-capable room in the SAME domain, or refused when the domain holds none — one or the other,
+    // never a silent allow. The sites OUTSIDE that walk answer differently, and one of them fails OPEN:
+    // the spend checkpoint (spend/checkpoint.ts `requireSessionContinuation`) reads this same predicate,
+    // and where it is false it audits `checkpoint.trip` with `allowed: true` and lets the consequential
+    // tool run. `rotate_webhook` refuses outright instead, deliberately carved out of the venue sweep.
+    // So this cell says "can this room card in place", which is a property of the ROOM — it is not a
+    // claim that every governed ask reaches a human on a surface where the answer is no.
+    { id: "approval-card", label: "**Approval card** (tappable Approve/Reject)", section: "§4.1", group: "seam" },
+    // 🔴 THE TRACE, NOT THE BUTTON (OPE-1854). The approver chain can LOWER a gated verb: the frozen
+    // args then execute with NO card, and the room's only record of an act nobody was asked about is
+    // the judge-lift notice. Until this row existed nothing asked each surface whether that notice
+    // arrives, and the answer was no on four of six — `requestApproval` admitted a registered notice
+    // poster or Slack's built-in render and nothing else, so on Teams, GitHub, Linear and Notion a
+    // lifted act left the room silent while the same act in a Slack channel posted a notice with an
+    // overrule button. This row is where each surface answers "does a lifted act leave a trace in my
+    // room", and it is the TRACE it asks about: where no component plane can carry the tap, the
+    // shared text render spells the overrule out in words, and that is a complete `supported` answer.
+    // An `unsupported` cell here means the room gets NOTHING, which needs a reason naming the limit.
+    { id: "judge-lift-notice", label: "**Judge-lift notice** (a lifted act leaves a trace)", section: "§4.1", group: "seam" },
+    { id: "addressed-leg", label: "Addressed (@mention) leg", section: "§2.2", group: "shape" },
+    { id: "ambient-leg", label: "Ambient (non-mention) leg", section: "§2.5", group: "shape" },
+    { id: "name-drop-mention", label: "Name-drop / structured mention", section: "§2.5", group: "shape" },
+    // 🔴 THE EDIT IS A WAKE LEG, SO IT IS A ROW (OPE-1673). `shouldDeliverReply` carves
+    // `message_changed` out of its blanket subtype refusal, which reads as a cross-surface rule and is
+    // not one: five surfaces never receive the event at all, each stopped by a filter its own bundle
+    // does not own. Nothing said so anywhere, so "an edit of an engaged message wakes nothing" could
+    // only be found by driving a live deployment. This row is where each surface answers it.
+    { id: "message-edit-wake", label: "Message-EDIT wake", section: "§2.5", group: "shape" },
+    { id: "threads", label: "Threads", section: "§4.6", group: "shape" },
+    // 🔴 NOT §4.5's "room". §4.5 is titled "`read_channel` — read this room" and §4.6.1 names a room
+    // for all six surfaces, GitHub's issue included. THIS row asks a narrower question: does the
+    // surface carry a STANDING container — one that exists before any work item and holds chat that
+    // is not about one — which is the container §4.7.1's `post_message` targets and the only kind that
+    // can carry ambient room chatter. One word for one thing: the label says which sense this is.
+    { id: "rooms", label: "Standing rooms *(not §4.5's `read_channel` container)*", section: "§4.7.1", group: "shape" },
+    { id: "dm", label: "DM (`dm`)", section: "§4.7.2", group: "shape" },
+    { id: "mpim", label: "Group DM (`mpim`)", section: "§4.7.2", group: "shape" },
+    { id: "reply", label: "`reply`", section: "§4.1", group: "verb" },
+    { id: "edit_reply", label: "`edit_reply`", section: "§4.2", group: "verb" },
+    { id: "react", label: "`react`", section: "§4.3", group: "verb" },
+    { id: "no_reply", label: "`no_reply`", section: "§4.4", group: "verb" },
+    { id: "read_channel", label: "`read_channel`", section: "§4.5", group: "verb" },
+    { id: "read_thread", label: "`read_thread`", section: "§4.6", group: "verb" },
+    { id: "search", label: "`search`", section: "§4.7", group: "verb" },
+    { id: "post_message", label: "`post_message` (P1)", section: "§4.7.1", group: "verb" },
+    { id: "dm_person", label: "`dm_person` (P2)", section: "§4.7.2", group: "verb" },
+    { id: "set_dm_delivery", label: "`set_dm_delivery` (P2, recipient)", section: "§4.7.2", group: "verb" },
+    { id: "stop", label: "`stop` (human)", section: "§4.8", group: "verb" },
+    { id: "ack_stop_glyph", label: "`ack`: ✋ glyph", section: "§4.9", group: "verb" },
+    { id: "ack_cancel_note", label: "`ack`: cancel note", section: "§4.9", group: "verb" },
+    { id: "stand_down", label: "`stand_down`", section: "§4.10", group: "verb" },
+    { id: "post_file", label: "`post_file`", section: "§7.4", group: "verb" },
+];
+const BY_ID = new Map(SURFACE_CAPABILITIES.map((c) => [c.id, c]));
+// Process-global, mirroring identity/capabilities.ts: a bundle registers from one module identity and the lint reads from another. Registration is selection-gated, so an unselected bundle writes no row.
+const DECLARATIONS = processRegistryMap("surface-parity.v1");
+/**
+ * Register one platform's surface-parity declaration. Called once from the bundle's own
+ * `register<X>Provider()`, beside `registerCapabilityManifest` — the same provider-bundle seam,
+ * so a bundle states its parity in the one place it states everything else.
+ */
+export function registerSurfaceParity(platform, declaration) {
+    if (!admitProviderRegistration(platform, "surface-parity"))
+        return;
+    DECLARATIONS.set(platform, declaration);
+}
+export function surfaceParityFor(platform) {
+    return DECLARATIONS.get(platform);
+}
+/** Every platform that has registered a declaration, sorted. */
+export function registeredSurfaceParityPlatforms() {
+    return [...DECLARATIONS.keys()].sort();
+}
+export function isSupported(cell) {
+    return cell === "supported" || (typeof cell === "object" && "supported" in cell);
+}
+export function declarationNote(cell) {
+    if (cell === "supported")
+        return undefined;
+    return "supported" in cell ? cell.supported : cell.unsupported;
+}
+function isDeclarationShape(value) {
+    if (value === "supported")
+        return true;
+    if (typeof value !== "object" || value === null)
+        return false;
+    const keys = Object.keys(value);
+    if (keys.length !== 1)
+        return false;
+    const only = keys[0];
+    if (only !== "supported" && only !== "unsupported")
+        return false;
+    return typeof value[only] === "string";
+}
+/**
+ * Check every platform's declaration for totality, reasoned absences, and — where a probe exists —
+ * agreement with the code.
+ *
+ * `declarations` takes `unknown` values on purpose. The type system already stops a provider from
+ * omitting a row; this function is the net under the cases the compiler cannot see (a fixture, a
+ * hand-built object, a bundle loaded from JS), and it can only be that net if it accepts a shape
+ * the type forbids. The unit test builds exactly such fixtures.
+ *
+ * Pure: reads nothing, writes nothing, and returns every problem it finds rather than throwing on
+ * the first — a provider author fixing one row at a time pays one lint run per row otherwise.
+ */
+export function checkSurfaceParity(declarations, probes = new Map()) {
+    const problems = [];
+    for (const platform of [...declarations.keys()].sort()) {
+        const declared = declarations.get(platform);
+        if (typeof declared !== "object" || declared === null) {
+            problems.push({
+                platform,
+                message: `declared a surface-parity value that is not an object (got ${typeof declared}).`,
+            });
+            continue;
+        }
+        const rows = declared;
+        for (const capability of SURFACE_CAPABILITIES) {
+            const cell = rows[capability.id];
+            if (cell === undefined) {
+                problems.push({
+                    platform,
+                    capability: capability.id,
+                    message: `does not declare \`${capability.id}\` (${capability.label}, ${capability.section}). ` +
+                        `Every capability the contract names must be answered \`"supported"\` or ` +
+                        `\`{ unsupported: "<reason>" }\` — an unanswered row is an invisible gap.`,
+                });
+                continue;
+            }
+            if (!isDeclarationShape(cell)) {
+                problems.push({
+                    platform,
+                    capability: capability.id,
+                    message: `declares \`${capability.id}\` as a value that is not a capability declaration. ` +
+                        `Use \`"supported"\`, \`{ supported: "<note>" }\`, or \`{ unsupported: "<reason>" }\`.`,
+                });
+                continue;
+            }
+            const note = declarationNote(cell);
+            if (note !== undefined && note.trim() === "") {
+                const kind = isSupported(cell) ? "supported" : "unsupported";
+                problems.push({
+                    platform,
+                    capability: capability.id,
+                    message: `declares \`${capability.id}\` as \`{ ${kind}: "" }\` — an empty ${kind === "supported" ? "note" : "reason"}. ` +
+                        (kind === "unsupported"
+                            ? "Name the platform limit, or the ticket that closes the gap."
+                            : "Say what the caveat is, or declare a bare `\"supported\"`."),
+                });
+                continue;
+            }
+            const probe = probes.get(capability.id);
+            if (probe === undefined)
+                continue;
+            const wired = probe.has(platform);
+            const claims = isSupported(cell);
+            if (claims && !wired && cell === "supported") {
+                // A bare `"supported"` the code cannot confirm. `{ supported: "<note>" }` is the escape
+                // hatch for a capability wired somewhere the probe does not look (Slack's inline ops), and
+                // it is exempt on purpose — the note is the author saying so out loud.
+                problems.push({
+                    platform,
+                    capability: capability.id,
+                    message: `declares \`${capability.id}\` supported, but the code registers no such arm for this platform. ` +
+                        `Either wire it, declare \`{ unsupported: "<reason>" }\`, or — if it is wired somewhere this probe ` +
+                        `does not look — say where with \`{ supported: "<note>" }\`.`,
+                });
+            }
+            else if (!claims && wired) {
+                problems.push({
+                    platform,
+                    capability: capability.id,
+                    message: `declares \`${capability.id}\` unsupported ("${note ?? ""}"), but the code DOES register that arm ` +
+                        `for this platform. The gap closed and the declaration was not updated — update it, and the ` +
+                        `generated table follows.`,
+                });
+            }
+        }
+        for (const id of Object.keys(rows).sort()) {
+            if (!BY_ID.has(id)) {
+                problems.push({
+                    platform,
+                    capability: id,
+                    message: `declares \`${id}\`, which is not a capability in SURFACE_CAPABILITIES. Renamed, or a typo?`,
+                });
+            }
+        }
+    }
+    return problems;
+}
+/**
+ * A note/reason made safe for a markdown table cell. A `|` would end the cell early and a newline
+ * would end the ROW, so either one silently corrupts every column to its right — a reason nobody
+ * proof-reads is exactly where one lands.
+ */
+function escapeCell(text) {
+    return text.replace(/\s*\n\s*/gu, " ").replace(/\|/gu, "\\|");
+}
+function renderCell(cell) {
+    if (cell === "supported")
+        return "✅";
+    if ("supported" in cell)
+        return `✅ ${escapeCell(cell.supported)}`;
+    return `❌ ${escapeCell(cell.unsupported)}`;
+}
+/**
+ * The markdown table for one capability group, sourced entirely from the declarations.
+ *
+ * Deterministic: rows in {@link SURFACE_CAPABILITIES} order, columns in the caller's platform
+ * order, so a re-run over unchanged declarations renders byte-identical output and the generator
+ * writes nothing (scripts/write-if-changed.ts).
+ */
+export function renderParityTable(group, declarations, platforms) {
+    const rows = SURFACE_CAPABILITIES.filter((c) => c.group === group);
+    const header = `| Capability | ${platforms.join(" | ")} |`;
+    const rule = `|---|${platforms.map(() => "---").join("|")}|`;
+    const body = rows.map((c) => {
+        const cells = platforms.map((p) => {
+            const declared = declarations.get(p);
+            // Unreachable through the generator, which runs the check first — but a table that silently
+            // printed a blank cell for a missing declaration would recreate the very gap this replaces.
+            if (declared === undefined)
+                return "⚠️ no declaration";
+            return renderCell(declared[c.id]);
+        });
+        return `| ${c.label} ${c.section} | ${cells.join(" | ")} |`;
+    });
+    return [header, rule, ...body].join("\n");
+}
+/**
+ * The matrix `npm run lint:surface-parity` prints to stdout — the whole ledger in one screen, so a
+ * reader sees the gaps without opening the doc. Plain text, aligned, no markdown.
+ */
+export function renderParityMatrix(declarations, platforms) {
+    const labelWidth = Math.max(...SURFACE_CAPABILITIES.map((c) => c.id.length), "capability".length);
+    const colWidth = Math.max(...platforms.map((p) => p.length), 3);
+    const pad = (s, n) => s + " ".repeat(Math.max(0, n - s.length));
+    const lines = [];
+    lines.push(`${pad("capability", labelWidth)}  ${platforms.map((p) => pad(p, colWidth)).join("  ")}`);
+    lines.push(`${"-".repeat(labelWidth)}  ${platforms.map(() => "-".repeat(colWidth)).join("  ")}`);
+    let group;
+    let gaps = 0;
+    for (const c of SURFACE_CAPABILITIES) {
+        if (c.group !== group) {
+            group = c.group;
+            lines.push(`[${group}]`);
+        }
+        const cells = platforms.map((p) => {
+            const declared = declarations.get(p);
+            if (declared === undefined)
+                return pad("?", colWidth);
+            const cell = declared[c.id];
+            if (!isSupported(cell))
+                gaps += 1;
+            return pad(isSupported(cell) ? (cell === "supported" ? "yes" : "yes*") : "NO", colWidth);
+        });
+        lines.push(`${pad(c.id, labelWidth)}  ${cells.join("  ")}`);
+    }
+    lines.push("");
+    lines.push(`${SURFACE_CAPABILITIES.length} capabilities × ${platforms.length} surfaces = ` +
+        `${SURFACE_CAPABILITIES.length * platforms.length} cells; ${gaps} declared unsupported ` +
+        `(yes* = supported with a stated caveat).`);
+    return lines.join("\n");
+}
+//# sourceMappingURL=surface-parity.js.map