@open-everywhere/core 0.1.0

package/agent/channels/delegated-provenance.ts

@@ -0,0 +1,506 @@
+// DELEGATED PROVENANCE (OPE-1849) — A WORKER'S CONNECTOR READS, CARRIED ONTO THE DELEGATING REPLY.
+//
+// `channels/reply-provenance.ts` names the connectors a TURN read. Its ledger is a `defineState`
+// slot, and `defineState` is scoped to ONE eve session and stamped with ONE turn. A delegated read
+// satisfies neither half: the read runs inside a WORKER's session and the seat answers from its own
+// turn, so the posting turn reads an EMPTY ledger, writes no `reply.provenance` row and renders no
+// footer. That module's header used to list a DELEGATED read among the boundaries it cannot see past.
+// This module IS the route past it, which is why that list no longer carries it.
+//
+// 🔴 IT IS THE MEMBER'S PROBLEM, NOT A BOOKKEEPING ONE. Every conversational seat is WORKER-ONLY for
+// the connector ops (`access/worker-capability-index.generated.ts` — `connection_search` and
+// `connector` are in both worker-only sets), so a member who asks the DM seat a question that needs
+// a connector gets an answer the seat DELEGATED. Before this module that answer carried no footer at
+// all, which is the class of "no footer" that is a defect rather than a bound.
+//
+// ── THE SHAPE, AND WHY IT MIRRORS THE TAINT PLANE ───────────────────────────────────────────────
+// The same cross-session problem is already solved once in this repository, for the same reason and
+// at the same two edges: `access/subagent-taint.ts` has the CHILD write a durable, call-keyed row and
+// the PARENT read it at settlement. This module is that shape applied to provenance:
+//
+//   • THE WORKER WRITES. {@link noteDelegatedRead} is called from the same two sites that fill the
+//     turn-local ledger — `hooks/connector-audit.ts` for a connector op, `channels/read-reach.ts` for
+//     an authored read tool — and it no-ops outside a subagent child, so a seat's own read never
+//     reaches this store.
+//   • THE SEAT CARRIES AT SETTLEMENT. {@link settleDelegatedReads} runs inside `applyTaskSettlement`
+//     (`hooks/spawn-taint.ts`), the ONE settle path both settlement edges share, and writes each read
+//     into the PARENT turn's ledger through `noteConnectorRead`. From that instant the seat's reply
+//     is indistinguishable from a seat-turn read: the same ledger, the same reach rule, the same
+//     footer render, the same durable row. There is no per-surface arm anywhere on this road.
+//
+// ── IDS AND VERBS, PLUS ONE HOST-AUTHORED LABEL ONE DOOR PROVES ────────────────────────────────
+// A row here carries the CONNECTION and the OP. Two more things are deliberately left behind, and
+// each absence is a decision rather than an omission. The third — the RECORD — crosses through ONE
+// door only, and that door's licence is stated with it:
+//
+//   1. 🔴 THE TAINT MARK NEVER TRAVELS AS PROVENANCE. A worker's taint is adopted by
+//      `adoptTaskTaint` on its own row, under its own fail-CLOSED rules, and it says something about
+//      what the worker READ — not about which system a reply drew on. Folding the two would make a
+//      taint verdict readable as a source list and a source list readable as a verdict. The two
+//      planes settle on the same edge and share nothing.
+//   2. THE REACH PROOF. A worker's own surface key and wake id describe the WORKER's context, and
+//      naming a source is a disclosure that must be proved against the room the SEAT replies into.
+//      So the proof is stamped fresh at the settle, by the seat, with `stampReadReach` — the same
+//      one expression a seat-turn read is stamped with (`channels/read-reach.ts`). One road.
+//      🔴 ON THE WAKE ARM THAT STAMP NEEDS BOTH OF THE CONVERSATION'S IDS (OPE-1869). The settling
+//      turn has just adopted the task's OWN minted wake, so `stampReadReach` reads that id — and the
+//      seat then replies under the stamp the turn was DELIVERED with, which `installTaskWake` records
+//      as `inheritedWakeId`. One conversation, two ids, and a reach rule that matched only the first
+//      of them named nothing: ship #213 carried four reads on six replies and footed zero
+//      (`reply.provenance … reads:4 named:0 withheld:1`). `hooks/spawn-taint.ts` now passes the
+//      inherited stamp as `alsoWakeId` beside the minted one, and it passes it only where the turn
+//      really adopted this task's wake — the same condition that makes the carriage provable at all.
+//   3. THE RECORD, AND THE ANSWER DEPENDS ON THE DOOR. Naming a record needs BOTH halves of the
+//      disclosure rule. The two doors answer the second half — "this room is entitled to the name" —
+//      from different facts, so they cross this boundary differently.
+//      · THE CONNECTOR DOOR CARRIES NO RECORD (OPE-1714). `channels/read-reach.ts` answers that half
+//        from the turn's own ARRIVAL STAMP, and the stamp it reads inside a worker is the WORKER's.
+//        A worker's wake stamps describe no room the seat replies into, so the proof does not cross,
+//        and a carried connector read renders as the connection name alone. That is the
+//        under-reporting direction `reply-provenance.ts` errs in everywhere else.
+//      · THE BORROW DOOR CARRIES ONE, WITH ITS LABEL (OPE-2026). A borrowed read never used the
+//        arrival stamp. Its record is the GRANT ROW, and its label is that row's PINNED TARGET — the
+//        requester's own words, which the owner approved on their card, admitted by
+//        `grantTargetIsPinned`. `access/credential-grant-scope.ts` then spends the row only in the
+//        session it was minted for, or in the domain its owner tapped, so every room this label can
+//        reach is a room whose WORKERS may spend this grant — a lent tool mounts on the workers and
+//        never on the seat (`tools/grant_tools.ts`, OPE-2023), which is the very asymmetry this
+//        carriage exists to cross. The room question is answered for THIS door, on the grant rather
+//        than on any wake, which is why the ground above does not reach it.
+//      🔴 THE LABEL IS THE ONLY DISPLAY TEXT THIS ROW HOLDS, AND IT IS NOT OP OUTPUT. The ledger
+//      keeps titles out of durable storage because a title is the op's OUTPUT, and a stored one
+//      outlives the turn that read it. A pinned target label is neither: it is model-authored at ASK
+//      time and never an op response, the owner approved that exact wording, and this row expires in
+//      six hours. It is capped at
+//      {@link MAX_DELEGATED_RECORD_NAME_CHARS} all the same, so one grant cannot grow the row
+//      without bound. The durable `reply.provenance` audit row is UNCHANGED and still carries no
+//      record at all — the label reaches the reader through the footer alone.
+//
+// ── THE BOUNDS, STATED ──────────────────────────────────────────────────────────────────────────
+// Three under-report, and one — the last — can OVER-report. It is stated rather than papered over,
+// on the same terms `reply-provenance.ts` states its own coalesced-turn residual.
+//
+// 1. THE JOIN IS THE TAINT PLANE'S. The carriage joins WORKER to SEAT through the dispatch row
+//    `access/subagent-taint.ts` writes (`taskCallLink`), and that row is written only when the taint
+//    plane is on. On a `taint.mode: "off"` deployment there is no join, so a delegated read is not
+//    carried and the reply renders as it did before this module. A missing footer after a delegation
+//    is a defect wherever the taint plane is ON, and a bound where it is off.
+// 2. THE CARRIAGE LANDS ON THE SETTLING TURN, AND THE LEDGER IS STILL TURN-KEYED. A seat that waits
+//    and answers on a LATER turn reads an empty ledger again. That is not the ordinary shape — the
+//    settlement installs the task's own wake and arms the follow-through duty precisely so the seat
+//    answers on the turn it was woken by (`channels/task-wake.ts`,
+//    `access/pending-delegation-signal.ts`) — but it is a real bound.
+// 3. A DELEGATION THE SEAT CANNOT PROVE A ROOM FOR IS SPENT, NOT CARRIED. `hooks/spawn-taint.ts`
+//    withholds a settlement whose wake proof names ANOTHER conversation, and one that did not
+//    complete. Those reads reach no reply at all, which is the fail-closed floor.
+// 4. 🔴 TWO BRIEFS TO ONE PERSISTENT WORKER SHARE ONE ROW, AND THAT WINDOW CAN OVER-REPORT. The key
+//    is the child's continuation token, and `rememberTaskAgent` pins the FIRST dispatch's call for a
+//    persistent `agentId`, so every continuation brief to that worker writes into one row. The spend
+//    below closes the ordinary sequence — brief one settles, the row empties, brief two starts clean
+//    — but not two edges of it: a read that lands AFTER the settlement read the row survives to the
+//    next brief's answer, and a second brief that starts reading before the first settles has its
+//    reads carried by the first. A ONE-SHOT delegation is unaffected: it mints a new call, so it
+//    mints a new row. Closing it needs a per-brief key, which eve gives the worker no way to derive
+//    (the task id is `sha256(parentSessionId, parentTurnId, callId)`, and a worker holds no parent
+//    turn id). What bounds it today is that the disclosure is a CONNECTION NAME — or, for a borrowed
+//    read, that name and the grant's PINNED TARGET — inside ONE seat's own conversation, between two
+//    briefs that seat itself commissioned. The grant bounds its own label further: the row is
+//    spendable only in the conversation or the domain its owner approved, so the label reaches no
+//    room the owner does not already lend the credential to.
+// Every bound is countable: the settle records what it found and what it carried.
+//
+// FAIL-SOFT, ALWAYS, on both edges. A store that is down costs a footer and never a read, a
+// settlement or a reply.
+
+import { getOperationalStore } from "../operational/provider.js";
+import { deploymentOrg, isSubagentChildContext, type BindableContext } from "../identity/binding.js";
+import { noteConnectorRead, rememberRecordName, type ConnectorRead } from "./reply-provenance.js";
+import { resolveUnifiedWakeTarget, sameUnifiedConversation } from "./unified-window.js";
+// Type-only, and it stays that way: `task-wake.ts` imports nothing from this module, so the closed
+// union can be named here without a cycle.
+import type { TaskWakeInstall } from "./task-wake.js";
+
+/** Key prefix. Its OWN namespace, so a provenance row can never be confused with the taint plane's
+ *  `oe-subagent-taint:` / `oe-task-call:` rows or the wake plane's `oe-task-wake:` rows in the same
+ *  task-result slice. */
+const DELEGATED_PROVENANCE_PREFIX = "oe-delegated-provenance:";
+
+/** The same six hours every other per-delegation row keeps. The bound is the CHILD's lifetime, not
+ *  the seat's turn: a background settlement reads this row a whole turn — or several — later. */
+const DELEGATED_PROVENANCE_TTL_MS = 6 * 60 * 60 * 1000;
+
+/** How many distinct reads ONE delegation carries. The same cap the turn-local ledger keeps
+ *  (`MAX_READS`), for the same reason: past it the row stops growing, so the footer UNDERSTATES
+ *  rather than letting a looping worker grow a stored container without bound. */
+const MAX_DELEGATED_READS = 32;
+
+/** How long one carried record's display label may be. The same 120 the turn-local name map caps at
+ *  (`reply-provenance.ts` MAX_RECORD_NAME_CHARS), so a label that survives this row is a label the
+ *  render can still show whole. The cut is by CODE POINT, never by UTF-16 unit, so it can never
+ *  leave a lone surrogate in a stored string. */
+const MAX_DELEGATED_RECORD_NAME_CHARS = 120;
+
+/** WHICH RECORD one carried read pulled, and the label the room may see for it. Written by the
+ *  BORROW door alone — see ground 3 in this file's header for why that door proves the room's
+ *  entitlement where the connector door cannot. */
+export interface DelegatedReadRecord {
+  /** The record's kind — `credential-grant` for the one door that writes this. Keyed on by
+   *  `rememberRecordName`, so it must be the same string `channels/read-reach.ts` records. */
+  readonly kind: string;
+  /** The record's id — the GRANT ROW's id, which is an id in a ledger of ids. */
+  readonly id: string;
+  /** The record's display label — the grant's PINNED TARGET, host-admitted and never vendor bytes.
+   *  It is the only display text this whole module stores. */
+  readonly name: string;
+}
+
+/** One read a worker made, as little of it as the seat's footer needs. IDS AND VERBS, plus the ONE
+ *  label the borrow door proves a room is entitled to — see this file's header for the two fields
+ *  that are deliberately absent, the taint mark first among them. */
+export interface DelegatedRead {
+  /** The connection the op ran under — the operator-chosen connector name (`notion`, `linear`),
+   *  which is the display name too. Never a credential id and never a record id. */
+  readonly connection: string;
+  /** The op verb (`get_page`, `list_issues`). The durable `reply.provenance` row keeps it; the
+   *  footer never shows it. */
+  readonly op: string;
+  /** The record this read pulled, where the door that made it proved the room may be told its name.
+   *  ABSENT is the ordinary case — every connector-door read, and every borrowed read whose grant
+   *  row holds no recoverable pinned label — and it renders the connection name alone. */
+  readonly record?: DelegatedReadRecord;
+}
+
+/** The PARENT SESSION and CALL one worker was dispatched under, or `null` when this context names no
+ *  delegating parent. */
+export interface DelegatingParentLink {
+  readonly sessionId: string;
+  readonly callId: string;
+}
+
+/**
+ * The delegating parent of THIS context, from eve's continuation token first and its typed session
+ * linkage second.
+ *
+ * 🔴 CONSERVATIVE ON BOTH ARMS, AND THE TOKEN PARSE IS COLON-FREE BY CONSTRUCTION. eve mints the
+ * token as `subagent:<parentSessionId>:<callId>`, and a greedy parse of an id that itself contains a
+ * colon yields a pair naming no session — which would key a store row nothing ever reads, or worse,
+ * one another delegation reads. Anything ambiguous is declined, and a declined link means no
+ * carriage: the fail-soft direction on both edges.
+ *
+ * `hooks/spawn-taint.ts` reads the SAME answer for the taint plane's own call-keyed marker, so the
+ * two planes cannot disagree about which delegation a worker belongs to.
+ */
+export function delegatingParentLink(ctx: unknown): DelegatingParentLink | null {
+  try {
+    const token = (ctx as { channel?: { continuationToken?: unknown } }).channel?.continuationToken;
+    if (typeof token === "string") {
+      const m = /^subagent:([^:]+):([^:]+)$/.exec(token);
+      if (m !== null) return { sessionId: m[1]!, callId: m[2]! };
+    }
+    const parent = (ctx as { session?: { parent?: { sessionId?: unknown; callId?: unknown } } }).session?.parent;
+    const sessionId = parent?.sessionId;
+    const callId = parent?.callId;
+    if (typeof sessionId === "string" && sessionId.length > 0 && typeof callId === "string" && callId.length > 0) {
+      return { sessionId, callId };
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** eve's own spelling of the child's continuation token, which is what BOTH ends key on: the worker
+ *  derives it from its own context, and the seat reads it straight off the dispatch join row
+ *  (`TaskCallLink.childToken`). Deriving it twice from the same two ids is what lets a settlement
+ *  find the row a worker wrote without either end guessing. */
+function childContinuationToken(link: DelegatingParentLink): string {
+  return `subagent:${link.sessionId}:${link.callId}`;
+}
+
+/** The store key for one delegation's read list. */
+export function delegatedProvenanceKey(childToken: string): string {
+  return `${DELEGATED_PROVENANCE_PREFIX}${childToken}`;
+}
+
+/** Bound one carried label, by CODE POINT. It bounds the STORED ROW and nothing else: the render's
+ *  own guard — `rememberRecordName`'s flatten, which collapses whitespace and refuses a label
+ *  spelling the footer marker — still runs at the settle, so this function is a size bound and never
+ *  a content one. */
+function capRecordName(name: string): string {
+  const chars = Array.from(name);
+  return chars.length <= MAX_DELEGATED_RECORD_NAME_CHARS ? name : chars.slice(0, MAX_DELEGATED_RECORD_NAME_CHARS).join("");
+}
+
+/** Read one row defensively — a row written by an earlier deployment can hold anything, and anything
+ *  unrecognised reads as "nothing was read", which renders no footer. */
+function parseDelegatedReads(raw: string | null): readonly DelegatedRead[] {
+  if (raw === null) return [];
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    const reads = (parsed as { reads?: unknown } | null)?.reads;
+    if (!Array.isArray(reads)) return [];
+    return reads.flatMap((r): DelegatedRead[] => {
+      const row = r as { connection?: unknown; op?: unknown; record?: unknown } | null;
+      if (typeof row?.connection !== "string" || row.connection.length === 0) return [];
+      if (typeof row.op !== "string" || row.op.length === 0) return [];
+      // The record is read back with the SAME all-or-nothing rule it is written under: a row whose
+      // record is half-shaped carries no record at all, so a name can never be attributed to a
+      // record the row does not identify. An earlier deployment wrote no record and reads clean.
+      const rec = row.record as { kind?: unknown; id?: unknown; name?: unknown } | null | undefined;
+      const record =
+        typeof rec?.kind === "string" &&
+        rec.kind.length > 0 &&
+        typeof rec.id === "string" &&
+        rec.id.length > 0 &&
+        typeof rec.name === "string" &&
+        rec.name.length > 0
+          ? { kind: rec.kind, id: rec.id, name: capRecordName(rec.name) }
+          : undefined;
+      return [{ connection: row.connection, op: row.op, ...(record === undefined ? {} : { record }) }];
+    });
+  } catch {
+    return [];
+  }
+}
+
+async function readDelegatedReads(org: string, childToken: string): Promise<readonly DelegatedRead[]> {
+  try {
+    if (childToken.length === 0) return [];
+    return parseDelegatedReads(await getOperationalStore().getTaskResult(org, delegatedProvenanceKey(childToken)));
+  } catch {
+    return [];
+  }
+}
+
+async function writeDelegatedReads(org: string, childToken: string, reads: readonly DelegatedRead[]): Promise<void> {
+  await getOperationalStore().putTaskResult(
+    org,
+    delegatedProvenanceKey(childToken),
+    JSON.stringify({ reads: [...reads] }),
+    new Date().toISOString(),
+    DELEGATED_PROVENANCE_TTL_MS,
+  );
+}
+
+/** Every write to one delegation's row is chained here, for the same reason
+ *  `hooks/spawn-taint.ts` chains its call-keyed marker: the append is a READ-MODIFY-WRITE, and two
+ *  reads landing on one tick would otherwise each write the row they read and lose one entry. One
+ *  worker session runs in one process, so one queue serialises every writer of that session's
+ *  rows. */
+let appendQueue: Promise<unknown> = Promise.resolve();
+
+/** Append one read to a delegation's row, deduplicated on the WHOLE entry so a worker that pages a
+ *  list twenty times contributes one source. Past {@link MAX_DELEGATED_READS} the row stops growing.
+ *
+ *  🔴 THE RECORD IS PART OF THE IDENTITY, the same rule `noteConnectorRead` keeps for the ledger. A
+ *  borrowed read's op is the HOST-AUTHORED constant `credential_grant_borrow`, so two grants read in
+ *  one brief agree on connection AND op and differ only here. WHAT THE KEY BUYS: a LABELLED read no
+ *  longer folds into an unlabelled one on the same connection, so a pinned target survives a brief
+ *  that also made a label-less borrowed call; and the durable `reply.provenance` counts two grants as
+ *  two sources rather than one.
+ *  🔴 WHAT IT DOES NOT CLOSE, so nobody reads more into it. `provenanceForReply` names ONE record per
+ *  connection — the FIRST visible read's — so a second grant on one connection is carried and
+ *  counted, never named. Widening that is the ledger's ruling to revisit, not this key's.
+ *  The label is left out of the key on purpose: one grant row has one id, so two entries that agree
+ *  on kind and id are one record whatever the label spells. */
+async function appendDelegatedRead(org: string, childToken: string, read: DelegatedRead): Promise<void> {
+  const cur = await readDelegatedReads(org, childToken);
+  if (cur.length >= MAX_DELEGATED_READS) return;
+  if (cur.some((r) => r.connection === read.connection && r.op === read.op && r.record?.kind === read.record?.kind && r.record?.id === read.record?.id)) return;
+  await writeDelegatedReads(org, childToken, [...cur, read]);
+}
+
+/**
+ * Record that a WORKER read something through a connector, for the delegating seat's reply footer.
+ *
+ * Called beside every `noteConnectorRead` — `hooks/connector-audit.ts` for a connector op and
+ * `channels/read-reach.ts` for an authored read tool — so a read reaches the seat by whichever door
+ * it was made through. A NO-OP outside a subagent child, which is what keeps a seat's own read off
+ * this store entirely: the turn-local ledger already holds it, and a seat has no parent to carry it
+ * to.
+ *
+ * 🔴 `record` IS THE BORROW DOOR'S ALONE (OPE-2026). The caller passes one only where it has proved
+ * the delegating room may be told the name — which today is the borrow door, off the grant row's own
+ * pinned target. Every other caller omits it, and the carried read then renders as the connection
+ * name alone. A half-shaped record (an empty kind, id or label) is dropped rather than stored, so
+ * the row can never name a record it cannot identify.
+ *
+ * Fire-and-forget and never throws: a read that cannot be recorded is still a read that happened.
+ */
+export function noteDelegatedRead(bind: BindableContext, connection: string, op: string, record?: DelegatedReadRecord): void {
+  try {
+    if (connection.length === 0 || op.length === 0) return;
+    if (!isSubagentChildContext(bind)) return;
+    const link = delegatingParentLink(bind);
+    if (link === null) return;
+    const org = deploymentOrg();
+    const childToken = childContinuationToken(link);
+    const carried =
+      record !== undefined && record.kind.length > 0 && record.id.length > 0 && record.name.length > 0
+        ? { kind: record.kind, id: record.id, name: capRecordName(record.name) }
+        : undefined;
+    const read: DelegatedRead = { connection, op, ...(carried === undefined ? {} : { record: carried }) };
+    appendQueue = appendQueue.then(() => appendDelegatedRead(org, childToken, read)).catch(() => undefined);
+  } catch {
+    /* no deployment identity, no readable context — never a reason to disturb the read */
+  }
+}
+
+/** What one settlement did with a delegation's recorded reads.
+ *
+ *  The two numbers are separate because they answer different questions, and an operator reading a
+ *  footerless reply needs both: `found` says whether the WORKER end recorded anything at all, and
+ *  `carried` says whether the SEAT could attribute it. `found > 0` with `carried === 0` is a
+ *  withheld settlement, which is a decision, not a fault. */
+export interface DelegatedReadSettlement {
+  readonly found: number;
+  readonly carried: number;
+}
+
+/**
+ * SETTLE EDGE — SPEND one delegation's recorded reads, attributing them to the PARENT TURN's
+ * provenance ledger when the seat can prove a room for them.
+ *
+ * Called from `applyTaskSettlement`, which is the one path both settlement edges — the task VIEW and
+ * the task NOTIFICATION — already share, so neither can settle without spending. Where the reads are
+ * attributed they become ordinary ledger entries: the seat's reply applies the reach rule to them,
+ * renders the footer and writes `reply.provenance` exactly as it does for a read the seat made
+ * itself.
+ *
+ * 🔴 `reach: undefined` SPENDS WITHOUT ATTRIBUTING, and that is a first-class outcome rather than an
+ * error path. The caller withholds a settlement it cannot place in a room — a wake proof naming
+ * ANOTHER conversation, a delegation that did not complete — and those reads must then reach NO
+ * reply: leaving them in the row would simply move the wrong attribution onto the next brief.
+ *
+ * 🔴 THE ROW IS ALWAYS SPENT, AND THE ORDER IS LOAD-BEARING. A persistent worker takes a SECOND
+ * brief on the SAME continuation token (`rememberTaskAgent` pins the first dispatch's call), so a row
+ * left in place would foot brief one's sources onto brief two's answer. Attributing BEFORE clearing
+ * means a store failure on the clear costs a repeat, which `noteConnectorRead`'s whole-entry dedupe
+ * absorbs inside one turn; clearing first would cost the attribution itself. The spend does not close
+ * the shared-token residual — see bound 4 in this file's header for the two edges it leaves open.
+ *
+ * 🔴 A SECOND DELEGATION ATTRIBUTED IN THE SAME TURN APPENDS. The ledger keys on the TURN and appends
+ * within it, and each delegation owns its own store row, so two workers' reads both reach one reply
+ * and neither overwrites the other.
+ *
+ * Never throws: a lost row, an unreadable store and an unusable token all answer `{found: 0,
+ * carried: 0}`, which renders the reply exactly as it rendered before this module.
+ */
+/**
+ * THE SECOND ADDRESS OF ONE CONVERSATION (OPE-1869) — is `inherited` the same conversation as the
+ * task's own minted `taskWake`, proved against the wake map rather than assumed?
+ *
+ * 🔴 WHY THE PROOF IS REQUIRED AND AN `installed` OUTCOME IS NOT ENOUGH. `installTaskWake` adopts
+ * only on an UNINGRESSED turn, and OPE-585 named exactly what such a turn's inherited stamp is: eve
+ * wakes the delegating parent with NO auth, so the turn keeps the PREVIOUS delivery's `oe_wake_id` —
+ * "whichever conversation happened to run last". On a unified seat that is routinely a SIBLING
+ * conversation. Naming this task's reads under it would tell conversation A what conversation B
+ * consulted, which is the OPE-1713 disclosure `settleDelegatedReads`'s wake arm exists to close. So
+ * the two ids are compared by ORIGIN: `openTaskWake` copies the task wake's origin from the
+ * dispatching turn's own wake, so two rows that agree under {@link sameUnifiedConversation} are one
+ * room and the disclosure is to the room that asked.
+ *
+ * FAIL-CLOSED AND NEVER THROWS. A missing row, an unreadable store, an unregistered origin: every one
+ * answers `false`, which withholds the second address and leaves the read named under the task wake
+ * alone — today's behaviour, which under-reports rather than over-discloses.
+ */
+async function sameConversationAsTaskWake(org: string, taskWake: string, inherited: string): Promise<boolean> {
+  if (taskWake === inherited) return false; // Nothing to widen: one id is already the whole address.
+  try {
+    const store = getOperationalStore();
+    // `resolveUnifiedWakeTarget` is the road `openTaskWake` itself reads origins through — it
+    // re-validates the stored JSON rather than trusting it, and answers `null` on every unreadable
+    // shape, so a corrupt row withholds instead of comparing two half-parsed objects.
+    const [a, b] = await Promise.all([resolveUnifiedWakeTarget(store, org, taskWake), resolveUnifiedWakeTarget(store, org, inherited)]);
+    if (a === null || b === null) return false;
+    return sameUnifiedConversation(a, b);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The inherited stamp, admitted as a read's SECOND address or withheld (OPE-1869). Exported so the
+ * settlement edge states the rule in one call AND so the suite can drive the rule directly —
+ * `delegated-provenance-test.ts` §10 asserts each of the four refusal arms below against it, because
+ * one settlement drive can only ever exercise one of them.
+ *
+ * `undefined` in, `undefined` out — a settlement with no inherited stamp, or one the wake map cannot
+ * place in the task's own conversation, carries the task wake alone.
+ */
+export async function delegatedSecondAddress(input: {
+  readonly org: string;
+  /** The task's own minted wake — the id `stampReadReach` put on the carried reads. */
+  readonly taskWakeId: string | null;
+  /** `inheritedWakeStampOf` — the raw delivery stamp the seat will reply under. */
+  readonly inheritedWakeId: string | undefined;
+  /** `installTaskWake`'s verdict. Only `installed` means this turn adopted THIS task's wake; on
+   *  `already` a sibling task took the turn first and on `ingressed` the turn brought its own
+   *  delivery.
+   *  🔴 THIS CHECK IS LOAD-BEARING, NOT A RESTATEMENT OF `wakeProvable`. That guard compares
+   *  `install.wakeId` against `reach.wakeId`, which is `addressedWakeThisTurn(turnId) ??
+   *  currentWakeId(ctx)`. On the `currentWakeId` arm it does withhold `already` and `ingressed`. On
+   *  the ADDRESSED arm it does not: a turn that addressed this task's own minted wake before the
+   *  settle satisfies `wakeProvable` on either outcome, and this check is the only thing left
+   *  withholding. Deleting it would still be origin-proved, and it would widen the admitted set with
+   *  nothing covering the widening.
+   *  Typed as the install's own union so a rename of the literal reds a typecheck rather than
+   *  silently turning the second address off for good. */
+  readonly outcome: TaskWakeInstall["outcome"];
+}): Promise<string | undefined> {
+  const { taskWakeId, inheritedWakeId } = input;
+  if (input.outcome !== "installed") return undefined;
+  if (taskWakeId === null || taskWakeId.length === 0) return undefined;
+  if (inheritedWakeId === undefined || inheritedWakeId.length === 0) return undefined;
+  return (await sameConversationAsTaskWake(input.org, taskWakeId, inheritedWakeId)) ? inheritedWakeId : undefined;
+}
+
+export async function settleDelegatedReads(input: {
+  readonly org: string;
+  /** `TaskCallLink.childToken` — the dispatch join row's own copy of the token the worker wrote
+   *  under. Read off the row rather than rebuilt, so the seat never guesses which call it settled. */
+  readonly childToken: string;
+  /** The SEAT's own eve session — `currentSessionId` on the settling turn, the same expression
+   *  `replyAuditFor` reads for the reply. It is the other half of the key a carried record's display
+   *  label is stored under (OPE-2026): `rememberRecordName`'s map is PROCESS-GLOBAL and eve repeats
+   *  `turn_0` across sessions, so a label stored under the turn alone would be resolved for another
+   *  session's turn. Absent stores no label, and the footer then names the connection alone. */
+  readonly sessionId: string | undefined;
+  /** The PARENT turn the reads are being attributed to — `currentTurnId` on the settling turn. */
+  readonly turnId: string | undefined;
+  /** The proof THIS SEAT can offer for the room it is about to reply into, stamped fresh by
+   *  `stampReadReach` at the settle — never the worker's own (see this file's header). `undefined`
+   *  withholds: the row is spent and nothing reaches the ledger. */
+  readonly reach: Pick<ConnectorRead, "proof" | "surfaceKey" | "wakeId" | "alsoWakeId"> | undefined;
+}): Promise<DelegatedReadSettlement> {
+  const none: DelegatedReadSettlement = { found: 0, carried: 0 };
+  try {
+    if (input.childToken.length === 0) return none;
+    const reads = await readDelegatedReads(input.org, input.childToken);
+    if (reads.length === 0) return none;
+    const reach = input.reach;
+    if (reach !== undefined) {
+      for (const read of reads) {
+        noteConnectorRead(input.turnId, {
+          ...reach,
+          connection: read.connection,
+          op: read.op,
+          ...(read.record === undefined ? {} : { record: { kind: read.record.kind, id: read.record.id } }),
+        });
+        // AND THE LABEL, UNDER THE SEAT'S OWN SESSION AND TURN (OPE-2026). The worker stored its copy
+        // under the WORKER's session and turn, which this process may not even hold any more, so the
+        // carriage re-states it here — the one place that knows both the label and the room the
+        // reply will go out in. It runs ONLY on the attributing arm: a withheld settlement must
+        // reach no reply, and a name left behind for a read that was never attributed would sit in
+        // the map until it aged out.
+        if (read.record !== undefined) {
+          rememberRecordName(input.sessionId, input.turnId, read.record.kind, read.record.id, read.record.name);
+        }
+      }
+    }
+    await writeDelegatedReads(input.org, input.childToken, []).catch(() => undefined);
+    return { found: reads.length, carried: reach === undefined ? 0 : reads.length };
+  } catch {
+    return none;
+  }
+}