@open-everywhere/core 0.1.0

package/agent/channels/halt-per-wake.ts

@@ -0,0 +1,166 @@
+// halt-per-wake — WHICH ROOMS OF A COALESCED TURN THE PAUSE ACTUALLY COVERS (OPE-1759).
+//
+// THE DEFECT, in one sentence: `haltScopeForCtx` (access/halt.ts) resolves ONE address from the
+// turn's ctx, a turn that merged queued deliveries carries only the LAST delivery's auth, and the
+// seat paragraph is rendered once per turn — so a turn answering two rooms reads ONE room's halt and
+// states it in BOTH. On soak-2026-09-12-a the seat told a room nobody had stopped that everything was
+// paused, and the soak's own cross-room checker could not see it: that checker matches PLANTED
+// MARKERS and a halt claim carries none, which is why 27 replies looked clean.
+//
+// 🔴 THE MERGE THAT PRODUCES THAT TURN IS UNREACHABLE TODAY, AND THIS CODE STAYS ANYWAY (OPE-2041).
+// eve 0.52.5 narrowed its ADJACENT-QUEUED batching rule to "Only batch adjacent queued deliveries
+// when their full auth contexts match", enforced by `jsonValuesEqual(c.auth, t.auth)` in
+// `takeBufferedTurnDelivery`. OE stamps `oe_wake_id` and a per-delivery `oe_delivery_id` into
+// `auth.attributes`, so two AUTH-CARRYING deliveries on one unified window never compare equal and
+// eve never folds them. The OPE-1759 measurement was taken on eve 0.39.0, before the rule existed.
+// (eve's OTHER merge arm — a task COMPLETION COHORT — still fires, and is not this defect: those
+// deliveries carry no `auth`, so no room's halt address can displace another's.) What follows is a
+// DEFENSIVE GUARD, not a live fix: it is correct either way, and it is the right shape the day eve
+// batches authenticated deliveries again.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the impossibility offline.
+//
+// 🔴 WHY THIS IS A READ AND NOT A NEW ENFORCEMENT. A halted seat is already refused at every arrow,
+// per act, and this module changes none of that. What bled was the SENTENCE — and a sentence the room
+// reads is the whole of what a person has to go on, so a false one costs more than a refused call: it
+// tells a room its work has stopped when it has not, and the seat then declines work it could do.
+// (OPE-1758 recorded the same class from the other direction: a paragraph that over-claimed what the
+// pause reached made a seat refuse a read-only question it could have answered.)
+//
+// 🔴 IT NAMES NO ROOM, AND THAT IS DELIBERATE. The seat paragraph is PRODUCT COPY — it carries no
+// scope key, no level and no principal id (access/halt.ts `haltWidthClause`). A per-room render that
+// listed the paused conversations would publish this plane's address vocabulary into a room, which is
+// the rule that paragraph already holds. So the correction is to the CLAIM's reach, not to its
+// detail: a turn whose rooms disagree says the pause is partial and that it must be checked per room,
+// rather than asserting it everywhere.
+//
+// FAIL-SOFT ON EVERY UNKNOWN, in the SAME direction the single-address read already fails: an
+// unreadable store answers halted, so the degrade is the turn-wide paragraph it rendered before this
+// module existed — never a silently dropped pause.
+
+import type { BindableContext } from "../identity/binding.js";
+import { haltScopeFor, resolveHalt, type HaltDeps, type HaltState } from "../access/halt.js";
+import { resolveOwnWindowToken } from "../access/delegation-mount.js";
+import { getOperationalStore } from "../operational/provider.js";
+import type { PendingUnifiedWake } from "./unified-window.js";
+import { wakeSurfaceKeyFromTargetJson, WAKE_TARGET_TTL_MS } from "./unified-window.js";
+
+/** How many pending wakes one paragraph render will read. A "room" here is a conversation this seat
+ *  holds an UNANSWERED inbound wake in, which is what `listPendingUnifiedWakes` measures — a wider set
+ *  than the rooms one turn answers, and the copy below says so rather than rounding it down. A standing seat holding more conversations
+ *  than this is already past what one turn can answer; the cap bounds the store read, and reading a
+ *  prefix can only ever find FEWER disagreeing rooms — the direction that degrades to the turn-wide
+ *  paragraph rather than inventing a partial one. */
+const MAX_ROOMS_READ = 20;
+
+/** What one turn's rooms agree, or fail to agree, about the pause. */
+export type TurnHaltReach =
+  /** No conversation this turn holds is covered — render nothing, exactly as today. */
+  | { readonly kind: "none" }
+  /** Every conversation this turn holds is covered by a halt. `state` is the one to render, so the
+   *  width clause still names a real row. */
+  | { readonly kind: "all"; readonly state: HaltState }
+  /** THE BLEED CASE. Some of this turn's conversations are covered and some are not. `state` is a
+   *  covering one, kept so the paragraph can still say how wide THAT pause is. */
+  | { readonly kind: "partial"; readonly state: HaltState; readonly haltedRooms: number; readonly totalRooms: number };
+
+export interface TurnHaltReachDeps {
+  /** The org's active halt rows — `resolveHalt`'s own injectable reader, threaded through so this
+   *  module is decided by one store read rather than by two opinions about where rows live. */
+  readonly rows?: HaltDeps["rows"];
+  /** The pending-wake read. Injected in tests; the live default is the operational store's own. */
+  readonly pendingWakes?: (org: string, windowToken: string, afterIso: string, limit: number) => Promise<readonly PendingUnifiedWake[]>;
+}
+
+/**
+ * The halt reach across every conversation THIS turn holds an unanswered wake in.
+ *
+ * `turnState` is the caller's own single-address read (`resolveHalt(haltScopeForCtx(ctx))`) — the
+ * answer for the delivery whose auth the turn happens to carry. It is the floor here, never
+ * discarded: a turn with exactly one room, a turn whose window token cannot be read, and a turn whose
+ * wake rows predate the stored surface key all answer from it alone, which is byte-identical to the
+ * behaviour before this module existed.
+ *
+ * Never throws.
+ */
+export async function resolveTurnHaltReach(ctx: BindableContext, turnState: HaltState, org: string, deps: TurnHaltReachDeps = {}): Promise<TurnHaltReach> {
+  const floor: TurnHaltReach = turnState.halted ? { kind: "all", state: turnState } : { kind: "none" };
+  try {
+    const windowToken = resolveOwnWindowToken(ctx);
+    if (windowToken === undefined) return floor;
+    // The SAME pending-wake read the reply-freshness gate takes, bounded by the wake map's own TTL:
+    // a wake older than the map cannot be answered anyway, so counting it as a room would let an
+    // expired conversation decide what this turn says about the pause.
+    const afterIso = new Date(Date.now() - WAKE_TARGET_TTL_MS).toISOString();
+    let rows: readonly PendingUnifiedWake[];
+    try {
+      const list = deps.pendingWakes ?? ((o: string, t: string, a: string, l: number) => getOperationalStore().listPendingUnifiedWakes(o, t, a, l));
+      rows = await list(org, windowToken, afterIso, MAX_ROOMS_READ);
+    } catch {
+      return floor; // store unavailable ⇒ the turn-wide answer, which is what shipped
+    }
+    // ONE ENTRY PER SURFACE, not per wake: two wakes in one room are one room, and counting them
+    // twice would report a turn as "partial" because one room answered itself.
+    const surfaceKeys = new Set<string>();
+    for (const row of rows) {
+      const key = wakeSurfaceKeyFromTargetJson(row.targetJson);
+      if (key !== undefined) surfaceKeys.add(key);
+    }
+    if (surfaceKeys.size <= 1) return floor; // one room (or none nameable) ⇒ nothing to disagree about
+    // 🔴 ONE ROWS READ FOR THE WHOLE RENDER. `resolveHalt` pages the org's active halts itself and
+    // caches nothing, so asking it per room cost up to twenty queries on the SEAT PROMPT, which is
+    // rendered every turn. The rows are read once here and handed to every per-room decision, which
+    // also makes the twenty readings consistent with each other by construction.
+    let rowsOnce: HaltDeps["rows"] | undefined = deps.rows;
+    if (rowsOnce === undefined) {
+      try {
+        const active = await getOperationalStore().activeHalts(org);
+        rowsOnce = async () => active;
+      } catch {
+        return floor; // unreadable halts ⇒ the turn-wide paragraph, which is the fail-closed answer
+      }
+    }
+    let halted = 0;
+    let covering: HaltState | undefined = turnState.halted ? turnState : undefined;
+    for (const surfaceKey of surfaceKeys) {
+      const state = await resolveHalt(haltScopeFor({ org, scopeKey: surfaceKey }), { rows: rowsOnce }).catch(
+        (): HaltState => ({ halted: true, unreadable: "the halt state could not be read" }),
+      );
+      if (state.halted) {
+        halted++;
+        covering ??= state;
+      }
+    }
+    // 🔴 NO ROOM COVERED ⇒ THE FLOOR, NEVER SILENCE. This returned `{ kind: "none" }` and that was a
+    // FAIL-OPEN: the per-room reads key on a surface key alone, while `haltScopeForCtx` also composes
+    // the PERSON axis from the turn's principal — so a `level: "user"` halt, or a surface halt on a
+    // room with no pending wake row, is covered by the turn's own read and by none of these. Dropping
+    // the paragraph there would take a live pause off the seat prompt entirely, which is the one
+    // direction this module must never move. The floor is the single-address answer, unchanged.
+    if (halted === 0) return floor;
+    if (covering === undefined) return floor; // unreachable in practice; never guess a row
+    if (halted === surfaceKeys.size) return { kind: "all", state: covering };
+    return { kind: "partial", state: covering, haltedRooms: halted, totalRooms: surfaceKeys.size };
+  } catch {
+    return floor;
+  }
+}
+
+/**
+ * The one sentence a PARTIAL reach adds in front of the standing halt paragraph.
+ *
+ * 🔴 IT IS THE WHOLE OF THE FIX THE ROOM CAN SEE, so it has to be actionable rather than merely
+ * hedged: it tells the seat that the pause does not cover every conversation in front of it, and that
+ * a room it was not asked about must not be told it is paused. It names NO room and NO scope key —
+ * the same product-copy rule the paragraph itself holds — because what the seat needs is not this
+ * plane's addresses but the knowledge that the claim is not turn-wide.
+ */
+export function partialHaltPrefix(reach: TurnHaltReach): string | null {
+  if (reach.kind !== "partial") return null;
+  return (
+    `**This pause does NOT cover every conversation you are holding open** — it covers ` +
+    `${reach.haltedRooms} of the ${reach.totalRooms} with an unanswered message. So do not tell a room ` +
+    `that work is paused unless the pause reaches that room: saying it where it is untrue stops work ` +
+    `nobody stopped. The refusals themselves are decided per act, so a conversation the pause does not ` +
+    `reach keeps working normally and you will not be refused in it.`
+  );
+}

package/agent/channels/memory-claim-guard.ts

@@ -0,0 +1,425 @@
+// THE DURABILITY-CLAIM GUARD (OPE-1873) — A REPLY MAY NOT SAY A FACT WAS STORED UNLESS THE HOST
+// STORED IT.
+//
+// WHAT WAS MEASURED. Ship #213 and ship #214, the same gate on the same leg: S-MEM-READ's seed turn
+// asked the seat to remember a canary, the seat answered "Recorded and verified for the team: the
+// OPE121 canary code is *obsidian-30653*. The durable note and curated memory index were updated",
+// and the audit held ZERO `memory.write` rows for that turn. On #214 J2 took the identical shape.
+// Two ships, two legs, one sentence that was not true.
+//
+// THE PROMPT ALREADY FORBIDS IT, AND THAT IS THE POINT. `instructions/seat-prompt.ts`'s honest-ack
+// rule (OPE-1688, OPE-1692) says it in the model's own terms — "A fact is stored when the file edit
+// happened … Name the thing that now exists". It was written after ships #193 and #194 measured the
+// same defect on J2. It did not hold. A rule a model must remember is not a control, the same way
+// `reply-provenance.ts`'s reserved footer marker is a control and asking the model not to type one
+// would not be. So the HOST decides this at the choke point, out of its own observation.
+//
+// ── WHAT COUNTS AS EVIDENCE ─────────────────────────────────────────────────────────────────────
+// A landed `memory.write` for THIS turn, recorded by the one write road
+// (`memory/write-road.ts` → `memory/write-evidence.ts`). Nothing else: not a tool the model says it
+// called, not a file it says it edited, not an operational write to the status board.
+//
+// 🔴 A DELEGATED WRITE IS EVIDENCE, AND IT IS THE ORDINARY CASE. A conversational seat delegates the
+// write; the worker edits the shared tree; `hooks/spawn-taint.ts` flushes at the settlement edge,
+// INSIDE the turn and before the seat composes its answer. So an honest delegated ack keeps its
+// sentence, byte for byte.
+//
+// 🔴 A SEAT'S OWN SANDBOX EDIT IS EVIDENCE WHEN A MEMBER ASKED FOR IT, AND NOT OTHERWISE (OPE-1915).
+// An explicit remember-ask arms `memory/write-intent.ts`, and `hooks/memory.ts`
+// `flushWriteIntentMemory` runs the `session-persist` road at both `reply` tool variants, its only
+// callers, before the post. So the row exists by the time this module reads the ledger, and the ack
+// keeps its sentence. On EITHER seat shape a delegated ask's settlement answer leaves by one of
+// those two doors (OPE-2013). Two terminal-prose planes used to deliver an answer past them, and both
+// are deleted: the addressed-mention bridge in `channels/unified.ts` (OPE-1982), and
+// `postTerminalProse` (OPE-2006), so a per-surface turn's closing prose is now dropped and audited.
+// An edit nobody asked for still persists at `turn.completed`, after the reply has left, and a seat
+// claiming completed durable storage before that persist has run is claiming something that has not
+// happened — the exact defect, not a false positive against it. The honest sentence is still
+// available: say what was written down, and that the save completes with the turn.
+//
+// ── WHAT THE GUARD DOES TO AN UNBACKED CLAIM, AND WHAT IT DOES NOT SEE ──────────────────────────
+// It STRIKES the claiming SENTENCE and appends one host-voiced line in its place. It does not
+// rewrite the answer, drop the useful content, or fail the reply: every sentence that is not itself
+// a claim goes out unchanged. A reader then sees the fact the turn produced and an honest note that
+// the durable save is not recorded — which is strictly more than the fabrication told them.
+//
+// 🔴 WHAT IS ENFORCED IS A SET OF KNOWN CLAIM SHAPES, NOT THE WHOLE CLASS, and the difference is
+// worth stating plainly because the protection is only as wide as {@link CLAIM_PATTERNS}. Six
+// shapes are struck today: a completed storage verb beside a durable-store noun, the same pair in
+// the mirror order, "have remembered", a claim about the curated memory index, a present-location
+// claim ("it's now in durable notes"), and a reply that OPENS with a storage verb. A sentence that
+// claims durability in some other wording — an emoji, a paraphrase nobody has written yet — posts.
+// The tests carry the measured fabrication verbatim, so a shape that ships is a shape a test can be
+// given; nothing here claims the list is closed. Ship #216 proved that the hard way: it posted "It's
+// now in durable notes and the curated memory index" — no storage verb anywhere in it — and the
+// first five shapes all walked past, so the guard's own denial posted BESIDE the standing claim.
+//
+// 🔴 AND IT STRIKES BY SENTENCE, so a sentence carrying BOTH a claim and an answer loses the answer
+// too. {@link ACK_BEFORE} exists because the commonest such shape — "the code is X, recorded in the
+// team memory file" — was struck whole in review, which would have deleted the very fact a recall
+// turn was asked for.
+//
+// 🔴 THE DIRECTION IS ONE DIRECTION. This module can strike a claim that was true (a write the host
+// did not observe); it can never let through a claim the host has no write for. A withheld true
+// claim costs one sentence. An allowed false one costs the reader's trust in every ack the
+// deployment will ever make, which is the asymmetry `reply-provenance.ts` states for its own ledger.
+//
+// 🔴 A CROSS-TURN `edit_reply` READS EMPTY, AND THE CLAIM IS THEN STRUCK. The ledger is
+// turn-stamped, so an edit made on a LATER turn holds none of the original turn's write evidence and
+// this guard strikes a claim the first post was entitled to. It is the same bound
+// `reply-provenance.ts` states for its own ledger — an edit drops the footer the original post
+// earned — and it falls the same way: the edited message says the save is not recorded rather than
+// asserting one the editing turn cannot see. Closing it needs a durable per-message record of what
+// the posting turn held, which nothing keeps today.
+//
+// FAIL-SOFT. A text with no claim in it comes back BYTE-IDENTICAL, which is every ordinary reply.
+// Outside an eve context the ledger answers "nothing observed", so a claim is struck rather than
+// allowed — the under-claiming direction again.
+
+import { appendAudit } from "../audit/audit.js";
+import { factStoredThisTurn } from "../memory/write-evidence.js";
+import type { ReplyAudit } from "./reply-post.js";
+
+/** The audit action one withheld durability claim writes. Ids, counts and the claim's SHAPE — never
+ *  the sentence, which is model text that may quote ingested content. */
+export const MEMORY_CLAIM_WITHHELD_ACTION = "memory.claim_withheld";
+
+/** The line the host puts in a struck claim's place. Host-voiced, plain text on purpose: it renders
+ *  the same on Slack, Discord, Teams, Notion, Linear and GitHub, like the provenance footer.
+ *
+ *  🔴 IT CLAIMS NOTHING ABOUT THE FUTURE, and that is deliberate. A seat's own sandbox edit persists
+ *  at `turn.completed`, seconds after this line is posted — so "not saved" would be true when the
+ *  room read it and false a moment later, with no later message to correct it. What the host can
+ *  stand behind for ever is what it observed at post time: no durable write is recorded FOR THIS
+ *  TURN. */
+export const WITHHELD_CLAIM_NOTE =
+  "(No durable memory write is recorded for this turn, so I cannot say the note is stored.)";
+
+/** WHICH shape of claim was struck. A closed set, so the audit row can be counted and joined without
+ *  ever carrying the sentence itself. */
+export type MemoryClaimShape = "stored" | "remembered" | "index-updated";
+
+/** One claim the detector found, as a SENTENCE INDEX and a shape — never the text. */
+export interface MemoryClaim {
+  readonly shape: MemoryClaimShape;
+  /** Which sentence of the reply it was, zero-based. Lets an operator find it in the posted body
+   *  without the row carrying a copy. */
+  readonly sentence: number;
+}
+
+/**
+ * The claim patterns, in the order they are tested.
+ *
+ * 🔴 MOST NEED A COMPLETED-STORAGE VERB AND A DURABLE-STORE NOUN IN THE SAME SENTENCE, and that
+ * conjunction is what keeps the detector off ordinary prose. "I remember you asked about this"
+ * carries the verb and no store. "Your notes file is in the team silo" carries the store and no
+ * completed verb. Neither is a claim that THIS turn stored something, and neither matches. The one
+ * exception is {@link BARE_ACK_PATTERN} below, which needs no noun and pays for that with a narrow
+ * anchor and its own carve-out.
+ *
+ * FUTURE, CONDITIONAL AND NEGATED FORMS ARE DELIBERATELY OUT. {@link MODAL_BEFORE},
+ * {@link MODAL_IN_SPAN} and {@link NEGATION_BEFORE} keep them out. "I'll save this", "the memory
+ * index will be refreshed tonight", "I'm writing it down now" and "nothing is stored in memory yet"
+ * are all honest sentences — two of them are exactly what the seat prompt asks for on the turn this
+ * guard would otherwise have nothing to offer. Striking them would leave a seat no true thing to
+ * say, which is how a guard teaches a model to say nothing at all.
+ */
+const CLAIM_PATTERNS: readonly { readonly shape: MemoryClaimShape; readonly re: RegExp }[] = [
+  // "the durable note … was updated", "saved to memory", "stored in the team silo", "written to the
+  // memory file". The verb is past or present-perfect; the store noun is one of ours.
+  {
+    shape: "stored",
+    re: /\b(?:saved|stored|written|recorded|persisted|committed)\b[^.!?\n]*\b(?:memory|silo|durable|notes?\s+file|memory\s+file)\b/i,
+  },
+  // The mirror order: "memory updated", "the durable note was updated", "silo now holds".
+  // 🔴 `notes?` IS PLURAL-TOLERANT, and the singular spelling was a measured miss: ship #216 posted
+  // "durable notes" and this pattern's `durable\s+note\b` did not reach it.
+  {
+    shape: "stored",
+    re: /\b(?:memory|silo|durable\s+notes?|memory\s+file|notes?\s+file)\b[^.!?\n]*\b(?:was|were|is|are|has been|have been|now)\b[^.!?\n]*\b(?:saved|stored|written|recorded|persisted|updated|committed)\b/i,
+  },
+  // "I've remembered that", "this is now remembered for the team" — the verb IS the store.
+  { shape: "remembered", re: /\b(?:have|has|i've|we've)\s+(?:now\s+)?remembered\b|\bis\s+now\s+remembered\b/i },
+  // The second half of the measured sentence: the curated index. It names a host artefact, so the
+  // noun alone is specific enough — no ordinary reply says this by accident.
+  { shape: "index-updated", re: /\b(?:curated\s+)?memory\s+index\b[^.!?\n]*\b(?:updated|refreshed|rebuilt|written)\b/i },
+  // 🔴 THE PRESENT-LOCATION CLAIM, and it exists because ship #216 posted one the four patterns above
+  // all walk past: "It's now in durable notes and the curated memory index." There is no storage VERB
+  // in it at all — the claim is carried by "is now in" plus the store, so the verb-bearing shapes
+  // cannot reach it. The guard appended its denial and left the claim standing beside it, which is
+  // the contradiction OPE-1912 measured.
+  //
+  // 🔴 `now` IS REQUIRED, AND IT IS WHAT KEEPS A STANDING DESCRIPTION OUT. "Your notes file is in the
+  // team silo" says where memory lives and claims no write; "it's NOW in durable notes" says this
+  // turn put it there.
+  //
+  // 🔴 IT TAKES {@link TRAILING_CLAUSE} AND {@link CITATION_IN_SENTENCE} AS CARVE-OUTS, because
+  // without them it is an ANSWER SHREDDER — the exact failure {@link ACK_BEFORE} exists to stop on
+  // pattern 1. "The OPE121 canary code is obsidian-30653, and it's now in memory." carries the fact a
+  // recall turn was asked for AND a claim about it; the strike is by sentence, so striking it deletes
+  // the canary. A claim JOINED to earlier content by a comma or a semicolon is a trailing clause on a
+  // stated fact, and it stands. The measured ship #216 sentence opens its own sentence, so it is
+  // struck, and so is a bare "The note is now in durable notes."
+  //
+  // 🔴 THE WINDOW IS SHORT AND COMMA-FREE, WHICH IS THE ONLY THING HOLDING THIS SHAPE TO ONE CLAUSE.
+  // Unlike the four above, this pattern has no verb to anchor on, so a roomy span drifts: with
+  // `[^.!?\n]{0,20}` it read "the thread is now in the channel, so the memory index will pick it up"
+  // as a claim — the preposition belonged to `channel` and the store noun belonged to the next clause.
+  // A comma ends a clause, and twelve characters is room for one adjective ("curated ", "shared ")
+  // and no more. The named articles are a separate group so they do not spend that budget.
+  {
+    shape: "stored",
+    re: /\b(?:is|are|it's|that's|they're|we're)\s+now\s+(?:in|inside|within|part\s+of)\s+(?:the\s+|your\s+|our\s+|my\s+|team\s+)*[^.!?\n,]{0,12}?\b(?:durable\s+notes?|memory\s+index|memory\s+file|notes?\s+file|memory|silo)\b/i,
+  },
+  // 🔴 THE BARE ACK, and it exists because the FIRST half of the measured fabrication has no store
+  // noun at all: "Recorded and verified for the team: the OPE121 canary code is *obsidian-30653*."
+  // A reply that OPENS with a storage verb is acking the ask, and on a turn with no write that ack
+  // is the fabrication. See {@link EXTERNAL_DESTINATION} for the one thing that takes it back out.
+  // `noted` is NOT in the verb set: `instructions/seat-prompt.ts` offers "Noted — tonight's on-call
+  // handle is ONCALL-6225, from Ana" as the model answer, so striking it would put this module and
+  // the prompt in direct contradiction.
+  { shape: "stored", re: /^[\s*_>\-#]*(?:recorded|saved|stored|persisted)\b/i },
+];
+
+/** The bare-ack pattern, named so the header can point at it. */
+const BARE_ACK_PATTERN = CLAIM_PATTERNS[CLAIM_PATTERNS.length - 1]!;
+
+/** The PRESENT-LOCATION pattern — the only one with no storage verb in it, which is why it alone
+ *  takes {@link TRAILING_CLAUSE}. Positioned second from last, in front of the bare ack. */
+const PRESENT_LOCATION_PATTERN = CLAIM_PATTERNS[CLAIM_PATTERNS.length - 2]!;
+
+/** Does earlier content in the same sentence end at a clause boundary before the match?
+ *
+ *  🔴 IT IS THE ANSWER GUARD FOR {@link PRESENT_LOCATION_PATTERN}. That shape anchors on "is now in"
+ *  rather than on a verb or a store noun, so it happily matches a claim tacked onto the END of a
+ *  sentence that states a fact — and the strike is by sentence, so taking it would take the fact.
+ *  A comma or a semicolon in front of the match is exactly that shape. A claim that OPENS its own
+ *  sentence has no earlier content to lose and is struck. */
+const TRAILING_CLAUSE = /[,;]/;
+
+/** The VERB-FIRST pattern — the only one whose match can begin on a completed verb that is really a
+ *  locative modifier, which is why {@link ACK_BEFORE} is tested for this pattern alone. Three of the
+ *  other five anchor on a noun or on a fixed auxiliary-plus-verb phrase, where the same test would
+ *  reject every ordinary subject ("The durable note … were updated" opens with "The"); the bare ack
+ *  anchors on the start of the sentence, so the test is meaningless for it. {@link
+ *  PRESENT_LOCATION_PATTERN} has the same answer-deleting hazard as this one and answers it with
+ *  {@link TRAILING_CLAUSE} instead — it anchors on a subject pronoun, which ACK_BEFORE reads as an
+ *  ack wherever it stands. */
+const VERB_FIRST_PATTERN = CLAIM_PATTERNS[0]!;
+
+/** A destination OUTSIDE the memory plane, which makes a bare ack a report about somewhere else.
+ *
+ *  🔴 IT ONLY EVER TAKES THE BARE ACK BACK OUT, never one of the noun-bearing patterns. "Recorded in
+ *  the release notes on GitHub" and "Saved to the ticket" are true statements about a system the room
+ *  can go and read, and the seat prompt explicitly keeps a repository path for that reason. A
+ *  sentence that names BOTH an external destination and a memory silo still matches pattern 1, which
+ *  this list does not touch. */
+const EXTERNAL_DESTINATION =
+  /\b(?:github|linear|notion|jira|slack|discord|teams|pull\s+request|issue|ticket|release\s+notes?|changelog|repo(?:sitory)?|branch|commit|channel|thread|document)\b/i;
+
+/** A CITATION — a concrete file, with a path or an extension — which makes a bare ack a pointer
+ *  rather than an ack.
+ *
+ *  🔴 IT ALSO KEEPS TWO HOST REWRITES OUT OF EACH OTHER'S WAY. `turn-delivery.ts`
+ *  `truncateMemoryCitationPaths` runs at the same choke points, immediately before this guard, and
+ *  rewrites a memory citation down to its silo-relative path — so "recorded in
+ *  soak-brain/standing.md#L2." reaches this module already handled by the rule that owns it. Striking
+ *  it here would delete a pointer that plane deliberately kept.
+ *
+ *  THE RESIDUAL, STATED: a fabricated ack that names a plausible path ("Recorded in team-brain/
+ *  notes.md") is not struck by the bare-ack pattern. It is still struck by pattern 1 whenever the
+ *  sentence also carries a store noun, and the seat prompt bans naming a memory location at all
+ *  (`instructions/seat-prompt.ts`, "Name WHAT you recorded, never WHERE you put it"), so the shape
+ *  this leaves open is one the prompt already forbids for a different reason. */
+const CITATION_IN_SENTENCE = /[^\s]+\/[^\s]+|\.(?:md|txt)\b/i;
+
+/**
+ * A modal or a conditional standing IN FRONT of the matched verb, which makes the sentence a PLAN
+ * rather than a report.
+ *
+ * 🔴 IT IS TESTED ON THE TEXT BEFORE THE MATCH, not on the sentence as a whole, and the distinction
+ * is the whole reason it is a separate check. "That will be stored in memory" and "I stored it in
+ * memory, and I'll tell the others" both contain `will`; only the first is a plan. A whole-sentence
+ * exclusion would wave the second through, which is the over-claiming direction this module never
+ * takes. The 40-character window keeps the modal ATTACHED to the verb: a modal three clauses back
+ * governs a different verb.
+ */
+const MODAL_BEFORE = /\b(?:will|'ll|shall|would|could|can|should|must|going\s+to|about\s+to|let\s+me|once|after|when|if|before)\b[^.!?\n]{0,40}$/i;
+
+/** The same modal test, INSIDE the matched span.
+ *
+ *  🔴 {@link MODAL_BEFORE} ALONE IS NOT ENOUGH, because two patterns match from the NOUN. In "the
+ *  memory index will be refreshed tonight" the match starts at `memory`, so the modal sits inside the
+ *  span where the before-test can never see it, and the sentence was struck as a completed claim. Both
+ *  checks run, and a modal in either place makes the sentence a plan. */
+const MODAL_IN_SPAN = /\b(?:will|'ll|shall|would|could|should|must|going\s+to|about\s+to)\b/i;
+
+/** A negation in front of the match, which inverts the claim.
+ *
+ *  "Nothing is stored in memory yet" and "I have not saved anything to memory" are the HONEST
+ *  sentences a seat says when it could not write, and both carry a completed verb beside a store
+ *  noun. Striking them would delete the very admission this guard exists to produce. */
+const NEGATION_BEFORE = /\b(?:not|never|nothing|none|no|cannot|unable)\b[^.!?\n]{0,40}$|n't\s[^.!?\n]{0,40}$/i;
+
+/** The same negation test INSIDE the matched span, for the noun-anchored patterns. "The memory file
+ *  was not updated" matches from `memory`, so the `not` lands inside the span where
+ *  {@link NEGATION_BEFORE} cannot see it — the mirror of the {@link MODAL_IN_SPAN} gap. */
+const NEGATION_IN_SPAN = /\b(?:not|never|nothing|none|cannot|unable)\b|n't\b/i;
+
+/** Is the matched storage verb an ACK, or a locative modifier on a sentence that is really reporting
+ *  a fact?
+ *
+ *  🔴 THIS IS WHAT STOPS THE GUARD DELETING AN ANSWER. S-MEM-READ's recall turn asks the seat where
+ *  it found a fact, and the natural reply — "The OPE121 canary code is obsidian-30653, recorded in
+ *  the team memory file." — carries a completed verb and a store noun while claiming no write at all.
+ *  The strike is by SENTENCE, so waving that through would take the canary with it and turn a
+ *  fabrication guard into an answer shredder.
+ *
+ *  An ack opens its sentence, or follows a first-person agent or a completion auxiliary within a
+ *  short window. A verb hanging off a comma after a stated fact is a modifier, and stands. */
+const ACK_BEFORE = /(?:^[\s*_>\-#]*|\b(?:i|we|it|that|this|which|they|has|have|had|is|are|was|were|been|now|already|just|i've|we've)\s+(?:\w+\s+){0,1})$/i;
+
+/** Split a reply into sentences for a claim detector.
+ *
+ *  Crude on purpose: `.`, `!`, `?` and a newline end a sentence, and nothing else does. A detector
+ *  that tried to be clever about abbreviations would differ from what a reader sees, and the unit
+ *  the guard strikes must be the unit a reader reads. An over-long "sentence" costs a longer strike;
+ *  it never costs a missed claim, because every pattern is anchored inside one segment anyway.
+ *
+ *  🔴 EXPORTED FOR `channels/approval-claim-guard.ts`, WHICH STRIKES AT THE SAME CHOKE POINT
+ *  (OPE-1876). Two guards that disagreed about where a sentence ends would strike overlapping spans
+ *  on one body and leave a reader a half-sentence. One definition is what stops that, so this splits
+ *  every claim guard's sentences and neither guard keeps a copy. */
+export function replySentences(text: string): readonly { readonly text: string; readonly start: number; readonly end: number }[] {
+  const out: { text: string; start: number; end: number }[] = [];
+  let start = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i]!;
+    if (ch === "." || ch === "!" || ch === "?" || ch === "\n") {
+      // Absorb a run of terminators, so the strike leaves no orphan punctuation behind. The
+      // whitespace AFTER them opens the next segment, which is what leaves no double space when a
+      // sentence in the middle of a reply is struck.
+      let end = i + 1;
+      while (end < text.length && (text[end] === "." || text[end] === "!" || text[end] === "?")) end++;
+      out.push({ text: text.slice(start, end), start, end });
+      start = end;
+      i = end - 1;
+    }
+  }
+  if (start < text.length) out.push({ text: text.slice(start), start, end: text.length });
+  return out;
+}
+
+/**
+ * Every completed-durability claim in one reply — PURE, so the patterns are testable over fixture
+ * text with no eve context, no audit store and no reply.
+ */
+export function detectDurabilityClaims(text: string): readonly MemoryClaim[] {
+  const claims: MemoryClaim[] = [];
+  const sentences = replySentences(text);
+  for (let i = 0; i < sentences.length; i++) {
+    const s = sentences[i]!.text;
+    for (const p of CLAIM_PATTERNS) {
+      const m = p.re.exec(s);
+      if (m === null) continue;
+      const before = s.slice(0, m.index);
+      if (MODAL_BEFORE.test(before) || MODAL_IN_SPAN.test(m[0])) continue; // a plan, not a report
+      if (NEGATION_BEFORE.test(before) || NEGATION_IN_SPAN.test(m[0])) continue; // an admission, not a claim
+      // The bare ack carries no store noun, so an external destination is all that separates it from
+      // a true report about another system.
+      if (p === BARE_ACK_PATTERN && (EXTERNAL_DESTINATION.test(s) || CITATION_IN_SENTENCE.test(s))) continue;
+      // A verb-less present-location claim tacked onto a stated fact is a trailing clause, and the
+      // strike is by sentence — so taking it would delete the answer. A citation is spared for the
+      // same reason it is on the bare ack: `turn-delivery.ts` deliberately kept that pointer.
+      if (p === PRESENT_LOCATION_PATTERN && (TRAILING_CLAUSE.test(before) || CITATION_IN_SENTENCE.test(s))) continue;
+      // A completed verb hanging off a stated fact is a locative modifier, not an ack.
+      if (p === VERB_FIRST_PATTERN && !ACK_BEFORE.test(before)) continue;
+      claims.push({ shape: p.shape, sentence: i });
+      break; // one claim per sentence — the strike is by sentence, so a second shape adds nothing
+    }
+  }
+  return claims;
+}
+
+/** What the guard did to one reply. */
+export interface MemoryClaimGuardResult {
+  /** The body to post. BYTE-IDENTICAL to the input whenever nothing was struck and the input carried
+   *  no earlier copy of {@link WITHHELD_CLAIM_NOTE} — which is every ordinary reply. */
+  readonly body: string;
+  /** The claims struck, empty when the reply kept its text. */
+  readonly withheld: readonly MemoryClaim[];
+}
+
+/**
+ * Strike every unbacked durability claim from one reply — PURE, given the evidence verdict.
+ *
+ * `stored` is the host's own answer to "did a fact reach a silo this turn". `true` returns the text
+ * untouched: the claim is backed, so the reader may have it.
+ */
+export function applyMemoryClaimGuard(text: string, stored: boolean): MemoryClaimGuardResult {
+  // 🔴 STRIP ANY EXISTING NOTE FIRST, ON BOTH ARMS. The note is host-voiced and this function runs on
+  // the edit door too, so a model echoing a previously posted body back through `edit_reply` would
+  // otherwise accumulate one copy per edit — the same idempotency `reply-provenance.ts`'s forged-footer
+  // strip keeps for its own marker. Stripping on the `stored` arm as well is what lets a later turn
+  // that DID write take the note back off.
+  const hadNote = text.includes(WITHHELD_CLAIM_NOTE);
+  const bare = hadNote ? text.split(WITHHELD_CLAIM_NOTE).join("").trimEnd() : text;
+  if (stored) return { body: bare, withheld: [] };
+  const claims = detectDurabilityClaims(bare);
+  // A body that already carries the note and no longer carries a claim is a re-post or an edit of a
+  // reply this guard already handled. The world has not changed — there is still no write for this
+  // turn — so the note is re-attached rather than quietly dropped, and nothing is audited a second
+  // time: the withheld list is what the audit row counts, and this round withheld nothing.
+  if (claims.length === 0) return { body: hadNote ? `${bare}\n\n${WITHHELD_CLAIM_NOTE}` : bare, withheld: [] };
+  const struck = new Set(claims.map((c) => c.sentence));
+  const sentences = replySentences(bare);
+  const kept = sentences.filter((_, i) => !struck.has(i)).map((s) => s.text);
+  // The note replaces the struck sentences ONCE, however many there were: a reply that made the same
+  // claim three ways is one unbacked claim to a reader, and three copies of the note would read as a
+  // rendering fault.
+  const body = `${kept.join("").trimEnd()}\n\n${WITHHELD_CLAIM_NOTE}`.trimStart();
+  return { body, withheld: claims };
+}
+
+/**
+ * Write the durable row for one withheld claim — best-effort, never throws, never fails the reply.
+ *
+ * 🔴 THE ROW NAMES THE CLAIM BY SHAPE AND POSITION, NEVER BY TEXT. The struck sentence is model
+ * output that can quote ingested content, and this plane's rows carry ids and counts only. A reader
+ * who needs the sentence has the posted body, where the note says one was struck.
+ */
+export async function auditWithheldMemoryClaim(
+  audit: ReplyAudit | undefined,
+  platform: string,
+  withheld: readonly MemoryClaim[],
+): Promise<void> {
+  if (!audit || withheld.length === 0) return;
+  await appendAudit({
+    org: audit.org,
+    platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: MEMORY_CLAIM_WITHHELD_ACTION,
+    detail: {
+      claims: withheld.length,
+      shapes: [...new Set(withheld.map((c) => c.shape))],
+      sentences: withheld.map((c) => c.sentence),
+      ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+      ...(audit.turnId ? { turnId: audit.turnId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * The whole per-reply step, in one call every choke point makes: read this turn's write evidence,
+ * strike what it cannot back, and hand back the body plus the claims to audit.
+ *
+ * ONE function because the four reply doors DRIFTED before over exactly this kind of shared step
+ * (`reply-provenance.ts` `applyReplyProvenance` says the same of itself): a door that struck a
+ * fabricated claim and a door that posted it would make the guard look like a rendering glitch.
+ */
+export function guardMemoryClaims(text: string, audit: ReplyAudit | undefined): MemoryClaimGuardResult {
+  return applyMemoryClaimGuard(text, factStoredThisTurn(audit?.turnId));
+}