@open-everywhere/core 0.1.0

package/agent/channels/name-drop-wake-audit.ts

@@ -0,0 +1,162 @@
+// name-drop-wake-audit — THE NAME-DROP ROAD'S OWN TWO ROWS (OPE-1899).
+//
+// THE GAP THIS CLOSES. A surface with no @mention primitive addresses the agent by NAME, and the
+// `nameDropWake` road is what turns that into a wake. The road wrote NO row when it ADMITTED a
+// message: Slack's chat-silence auditing was removed on 2026-07-14, and the drop rows
+// (`surface.wake_dropped`) deliberately skip the ordinary non-candidates. So from outside the
+// deployment a seat that woke and judged NO_REPLY and a `nameDropWake` that is DEAD — a broken
+// word-boundary matcher, a dropped domain flag, a dead dispatch — are the same silence. The e2e
+// pack's S9 could only SKIP on that silence, which is a leg that can never fail, so the road could
+// rot green forever.
+//
+// THE TWO ROWS, and why there are exactly two:
+//   • {@link NAME_DROP_WOKE_ACTION} — the road ADMITTED this message and dispatched a wake. It is
+//     the POSITIVE observable the pack asserts on: a row here plus no reply is a judged silence, no
+//     row at all is a dead road.
+//   • {@link NAME_DROP_SILENT_ACTION} — the road judged NO WAKE on a message that NAMED the agent,
+//     and the reason says which gate refused. Without it the positive row alone cannot tell a
+//     message nobody named from one the domain flag or the internal probe refused.
+//
+// 🔴 THE SILENT ROW IS BOUNDED TO A CANDIDATE, AND THAT BOUND IS THE WHOLE COST CONTROL. Every
+// message in a watched room runs the road, and almost all of them fail on "the text does not say the
+// agent's name". A row per message would drown the trail it exists to make readable — the same
+// reasoning `surface.wake_dropped` states for the ordinary disqualifiers. So a caller writes this
+// row ONLY where the agent's name MATCHED and a LATER gate refused, which is a real refusal of an
+// otherwise-admittable wake and a low-volume class by construction.
+//
+// BEST-EFFORT BY CONTRACT, like every other wake row: never throws, never blocks a route, never
+// changes a decision. An unreachable store costs one row, never a wake.
+
+import { appendAudit } from "../audit/audit.js";
+
+/** The road ADMITTED a name-drop and dispatched a wake — the positive observable (OPE-1899). */
+export const NAME_DROP_WOKE_ACTION = "surface.name_drop_woke";
+
+/** The road refused to wake a message that NAMED the agent, and `detail.reason` says which gate
+ *  refused. Never written for a message that named nobody — see the header's bound. */
+export const NAME_DROP_SILENT_ACTION = "surface.name_drop_silent";
+
+/**
+ * Which session the admitted name-drop woke. `seat` is the room's STANDING seat (Slack's
+ * OPE-1725 hand-off); `native` is the per-thread session an unseated deployment opens. The two are
+ * different products for the same address, so the row says which one answered.
+ */
+export type NameDropRoad = "seat" | "native";
+
+/**
+ * WHO decided the wake. `built-in` is the shipped name-drop policy; `arm` is a deployment's
+ * registered `decideWake` arm filling an abstention (channels/wake-arm.ts). An operator reading
+ * back "why did the agent join this conversation" needs the two apart — an arm-added wake is the
+ * deployment's own rule, not the product's.
+ */
+export type NameDropVia = "built-in" | "arm";
+
+/** The partition columns every wake row is keyed by — the caller resolves them, because only the
+ *  surface knows how its own ids compose. */
+export interface NameDropAuditKey {
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  /** The acting member, when the surface knows one. */
+  readonly principalId?: string;
+  /** The surface-native container the message arrived in — a Slack channel id, a Discord channel
+   *  id. Carried as `detail.container` so a reader can join the row to the room without parsing the
+   *  partition key. */
+  readonly container: string;
+  /** The triggering message's own surface locator — a Slack `ts`, a Discord message id — or `null`
+   *  where the surface gives none. `null` rather than an omitted key, so the row SAYS the surface
+   *  carries no locator instead of reading like a lost value. */
+  readonly ts: string | null;
+}
+
+/** The append seam. Defaults to the live audit sink; injected so the rows are testable without a
+ *  store, and so a test can see the exact detail object a row carries. */
+export type NameDropAuditAppend = (entry: {
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  readonly principalId?: string;
+  readonly action: string;
+  readonly detail: Readonly<Record<string, unknown>>;
+}) => Promise<void>;
+
+/** Build the row both emitters append — one place, so the two rows carry the same columns and a
+ *  reader can join them. Exported for the contract test, which asserts the detail against the
+ *  action registry's declared field list. */
+export function nameDropAuditRow(
+  key: NameDropAuditKey,
+  action: string,
+  reason: string,
+  extra: Readonly<Record<string, unknown>> = {},
+): {
+  readonly org: string;
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  readonly principalId?: string;
+  readonly action: string;
+  readonly detail: Readonly<Record<string, unknown>>;
+} {
+  return {
+    org: key.org,
+    platform: key.platform,
+    workspace: key.workspace,
+    ...(key.surface === undefined ? {} : { surface: key.surface }),
+    ...(key.principalId === undefined ? {} : { principalId: key.principalId }),
+    action,
+    detail: { reason, container: key.container, ts: key.ts, ...extra },
+  };
+}
+
+/**
+ * THE POSITIVE ROW: the name-drop road admitted this message and a wake was dispatched.
+ *
+ * Called at the ONE point on each surface where the road has decided to wake and nothing below it
+ * can refuse on the NAME — so the row means "the road did its job", never "a turn ran".
+ *
+ * 🔴 SAY WHAT IT DOES NOT CLAIM. Gates BELOW this line can still refuse the turn: the tenant fence,
+ * the spend cap, and on a seated Slack channel the seat road's own checks. Each of those writes its
+ * OWN refusal row, so a reader sees the road admitting and the turn being refused as two separate
+ * facts. That split is the point — the question this row answers is "did `nameDropWake` run and
+ * admit at all", which is exactly the one a clean silence could not answer before.
+ */
+export async function auditNameDropWoke(
+  key: NameDropAuditKey,
+  reason: string,
+  opts: { readonly road: NameDropRoad; readonly via: NameDropVia; readonly append?: NameDropAuditAppend },
+): Promise<void> {
+  const append = opts.append ?? ((e) => appendAudit(e));
+  try {
+    await append(nameDropAuditRow(key, NAME_DROP_WOKE_ACTION, reason, { road: opts.road, via: opts.via }));
+  } catch {
+    /* observability only — never block a route or change its decision */
+  }
+}
+
+/**
+ * THE NEGATIVE ROW: the agent was NAMED and the road refused to wake.
+ *
+ * 🔴 THE CALLER OWES THE BOUND, NOT THIS FUNCTION. It cannot re-derive "the name matched" from a
+ * reason string without keeping a copy of every disqualifier, which is the stale-copy shape
+ * `nameDropAbstained` exists to avoid. So each call site passes only a refusal it has already
+ * established was a refusal of a CANDIDATE.
+ * WHERE THAT IS PINNED, exactly: `slack-engagement-test.ts` drives the real `routeNameDropEvent` and
+ * asserts that a message naming nobody leaves this road rowless. It pins the route AS SHIPPED — with
+ * no `decideWake` arm registered, such a message returns before either write. The explicit
+ * `textMatchesName` guards the route also carries are reachable only on the ARM path, and no test
+ * drives an arm today; that half of the bound is unproven and is stated here rather than assumed.
+ */
+export async function auditNameDropSilent(
+  key: NameDropAuditKey,
+  reason: string,
+  opts: { readonly append?: NameDropAuditAppend } = {},
+): Promise<void> {
+  const append = opts.append ?? ((e) => appendAudit(e));
+  try {
+    await append(nameDropAuditRow(key, NAME_DROP_SILENT_ACTION, reason));
+  } catch {
+    /* observability only — never block a route or change its decision */
+  }
+}

package/agent/channels/native-wake-retry.ts

@@ -0,0 +1,62 @@
+// native-wake-retry — the ONE bounded 429 road for topology-off wake dispatches (OPE-1881).
+//
+// A native wake goes straight from a provider adapter to eve's queue. It has no unified-window
+// wakeId and no `wake.ingress` row, so this module must not manufacture either. It mints one
+// deliveryId for the queue dispatch and keeps it stable across refused attempts. That id groups the
+// retry rows for this dispatch; it deliberately claims no join to ingress, turn-start or reply rows.
+
+import { randomUUID } from "node:crypto";
+
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/binding.js";
+import { withRetryAfterThrown } from "./rate-limit-retry.js";
+import {
+  WAKE_DISPATCH_OPERATION,
+  WAKE_DISPATCH_RETRY_POLICY,
+  WAKE_RETRY_ACTION,
+  wakeRetryDetail,
+} from "./wake-timing.js";
+
+/** Real surface attribution already held by a provider at its native launch seam. */
+export interface NativeWakeRetryAttribution {
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surfaceKey: string;
+}
+
+/**
+ * Dispatch one native wake through the shared wake policy.
+ *
+ * Only a proven rate-limit refusal is retried. Every other throw escapes unchanged on its first
+ * attempt, so an ambiguous transport failure can never wake a seat twice. Callers keep their
+ * existing failure catch OUTSIDE this function; after refusal exhaustion, strand classification
+ * therefore runs in exactly the same order it did before this wrapper existed.
+ */
+export async function dispatchNativeWakeWithRetry<T>(
+  send: () => Promise<T>,
+  attribution: NativeWakeRetryAttribution,
+): Promise<T> {
+  const deliveryId = randomUUID();
+  return withRetryAfterThrown(send, {
+    surface: attribution.platform,
+    operation: WAKE_DISPATCH_OPERATION,
+    ...WAKE_DISPATCH_RETRY_POLICY,
+    onRefusal: (refusal) =>
+      appendAudit({
+        org: deploymentOrg(),
+        platform: attribution.platform,
+        workspace: attribution.workspace,
+        surface: attribution.surfaceKey,
+        action: WAKE_RETRY_ACTION,
+        detail: wakeRetryDetail({
+          deliveryId,
+          surfaceKey: attribution.surfaceKey,
+          attempt: refusal.attempt,
+          delayMs: refusal.delayMs,
+          waitedMs: refusal.waitedMs,
+          outcome: refusal.outcome,
+          refusalStatus: refusal.refusalStatus,
+        }),
+      }).catch(() => undefined),
+  });
+}

package/agent/channels/no-reply-signal.ts

@@ -0,0 +1,49 @@
+// Per-session "the `no_reply` tool was called this turn" signal, the twin of approvals/card-signal.ts. A tool call cannot reach the channel event handler that later decides the turn's fate, so a session-scoped slot is the seam between them. SCOPE: `defineState`, per-session and deliberately NOT a module global — see approvals/card-signal.ts's header for why a module-level flag would interleave concurrently-served sessions' turns.
+// Fail-soft on both sides: `defineState` throws outside an eve context, and a signal-less turn must behave exactly like one that never called the tool.
+
+import { defineState } from "eve/context";
+
+/** Closed reason enum for the `no_reply` tool — see tools/no_reply.ts. */
+export type NoReplyReason =
+  | "addressed_to_other"
+  | "reacted_instead"
+  | "nothing_to_add"
+  | "not_relevant"
+  | "duplicate"
+  | "user_requested_silence"
+  | "awaiting_context"
+  | "other";
+
+const slot = defineState<NoReplyReason | null>("open-everywhere.no-reply-tool-called", () => null);
+
+export function markNoReplyThisTurn(reason: NoReplyReason): void {
+  try {
+    slot.update(() => reason);
+  } catch {
+    /* no session context here — nothing to signal, never blocks the tool call */
+  }
+}
+
+/**
+ * PEEK without consuming — for a mid-turn reader that must not disturb the read-and-reset contract, which `message.completed` owns.
+ * Fail-soft: no session context answers `null`.
+ */
+export function peekNoReplyThisTurn(): NoReplyReason | null {
+  try {
+    return slot.get();
+  } catch {
+    return null;
+  }
+}
+
+/** Read-and-reset: was `no_reply` called this turn, and with what reason? Always
+ *  clears the slot in the same call so the NEXT turn starts clean. */
+export function consumeNoReplyThisTurn(): NoReplyReason | null {
+  try {
+    const was = slot.get();
+    slot.update(() => null);
+    return was;
+  } catch {
+    return null;
+  }
+}

package/agent/channels/normalized-wake.ts

@@ -0,0 +1,285 @@
+// normalized-wake — ONE typed shape every inbound event normalizes into, and ONE renderer that turns it into the turn message an OE-owned dispatch sends. The renderer NEVER branches on `platform`: a branch inside it is exactly the drift this module exists to kill. It is PURE and platform-agnostic and must NEVER import a surface file — surface files import THIS, never the reverse.
+// SECURITY, carried structurally: every surface-supplied string in the shape is RAW, and escaping and untrusted-wrapping happen ONLY inside the envelope and context renderers, so no caller string reaches a trusted prose frame; the attributes are renderer-side emissions from typed fields, so they cannot be forged; the type never carries a pre-rendered string; and a `direct` body is never wrapped while a judged one always is. A JUDGED WAKE RENDERS ITS ENVELOPE AND NOTHING ABOVE IT — the attributes carry the facts and one standing block carries the policy, so there is no per-wake preamble and no second render to fall back to.
+
+import {
+  renderWakeEnvelope,
+  type WakeReason,
+  type WakeMessageInput,
+  type WakeChannelMeta,
+  type WakeThreadMeta,
+  type WakeParticipant,
+  type WakeAddressing,
+  type WakeEngagementTier,
+  type WakeFollowUp,
+} from "./wake-envelope.js";
+import { hydrationSlices, renderContext, type ContextLine } from "./context-render.js";
+// OPE-746 — the opaque channel key. A PURE leaf module with no imports of its own, so it keeps this
+// module's "imports only wake-envelope + context-render" discipline honest: it adds an encoder, not
+// a dependency on any surface.
+import { encodeChannelKey } from "./channel-key.js";
+
+// `WakeAddressing`/`WakeEngagementTier` are DEFINED in wake-envelope.ts (OPE-684 S1 moved them
+// there so the schema-only envelope can render them as `<wake>` attributes) and re-exported here so
+// every existing importer of this module keeps compiling unchanged (adapter-api.ts, every provider's
+// wake builder, control/test-route.ts).
+export type { WakeAddressing, WakeEngagementTier } from "./wake-envelope.js";
+
+// The silence vocabulary: TRUSTED, core-owned constants naming the silence contract. The render no longer emits them — a judged wake is its envelope alone — but the sentinel is still the string a turn-final text is matched against, and the standing prompt names both.
+// They live here rather than in a surface file, so no dialect can drift its own copy.
+
+/** Turn-final text that means "post nothing" (see slack-events.ts isNoReply). */
+export const NO_REPLY_SENTINEL = "NO_REPLY";
+
+/**
+ * The trigger-message id prefix the ONE corrective re-drive wake carries (`redrive-<original wake id>`, minted in channels/unified-redrive.ts's `buildRedriveWake`). It reaches the served prompt as a `<message … id="redrive-…">` attribute, so it is the marker that names a corrective turn to any reader of the prompt alone.
+ * 🔴 IT IS A MARKER, NOT A GATE (OPE-1982). Nothing in the product branches on it: the corrective wake is an ordinary ambient wake and the seat must not treat it as special. The SCRIPTED MODEL reads it (agent/model/scripted-resolve.ts) to tell the one legitimate cross-turn re-entry of a still-registered script — a turn the host itself re-drove — from the handle leak the OPE-727 guard exists to catch. It lives here, beside the silence vocabulary, so the builder and that reader cannot drift two copies of the string.
+ */
+export const REDRIVE_TRIGGER_ID_PREFIX = "redrive-";
+
+/**
+ * THE ONE SENTENCE THAT ENDS A SILENT TURN. eve runs one step per model call and reads a step with no tool call and no text as a FAILURE, then reissues the call once with a nudge to answer now — so a turn that correctly chose silence gets commanded to reply.
+ * Every terminal-verb result that ends a turn in silence therefore NAMES this output, which makes the next step non-empty and keeps eve out of its recovery path. Three sites say it, and they must say the SAME thing, because they are all answering the same nudge.
+ */
+export const END_TURN_WITH_SENTINEL_INSTRUCTION = `Now end the turn: output exactly ${NO_REPLY_SENTINEL} and nothing else.`;
+
+/**
+ * Shared addendum for every judged-silence instruction: prefer the `no_reply` TOOL over the bare sentinel where one is available, because it is audited and carries a closed reason on the identical suppression path.
+ * It lives in ONE place rather than copy-pasted across every wake instruction.
+ */
+export const PREFER_NO_REPLY_TOOL =
+  `If you have a \`no_reply\` tool, prefer calling it (with a reason) over the bare ` +
+  `${NO_REPLY_SENTINEL} text — it's audited and unambiguous; the text sentinel still works if you don't.`;
+
+/**
+ * The wake TRIGGER — a discriminated union. `message` is a message that woke the agent; {@link mkMessageTrigger} stamps `trigger: true` on it, so the renderer's exactly-one-trigger-message invariant is satisfied structurally rather than by convention.
+ * `notice` is a wake that NO message caused: OE itself woke the session to tell it something (an approval decision). Its whole cause is OE's own instruction, which rides {@link NormalizedWake.systemNote}; the envelope then carries no `<message>` element at all.
+ * 🔴 A NOTICE NEVER INVENTS A MESSAGE. A synthetic `relay` message would put OE's own instruction inside the untrusted fence with a `source` label that claims a chat message, and an instruction-following model correctly refuses it (OPE-2065). It would also hand every trigger-body consumer an "author's body" that nobody wrote.
+ */
+export type NormalizedWakeTrigger =
+  | {
+      readonly kind: "message";
+      readonly message: WakeMessageInput; // body RAW; renderer escapes + wraps (W1)
+    }
+  | { readonly kind: "notice" };
+
+// How the trigger addresses the agent: it decides whether the wake is ENVELOPED at all, and renders as the `<wake addressing>` attribute. `direct` is the person's own request on a single-surface session — body unwrapped, no envelope, because the session is bound to that one conversation.
+// `direct-mention` is the same request delivered into a SINGLE-WINDOW session and is rendered WITH the full judged envelope so the `wake-id` survives: a cross-surface turn's terminal prose is structurally dropped, so the only reply route is the reply tool echoing that id, and a raw body would strip it and make the mention unanswerable. `thread-follow`, `channel-watch` and `name-drop` are the three judged tiers, in rising order of bar.
+
+// Engagement calibration for a `channel-watch` wake — the per-(surface, domain) dial memory/domain.ts resolves; this module only RENDERS it.
+// It renders as the `<wake engagement>` attribute INCLUDING a resolved `"neutral"`, so a reader can tell "resolved neutral" from "never resolved". The standing "Reading a wake" block states what each tier asks of the model.
+
+/**
+ * The conversational locus of the wake — the two-level collapse every surface maps into, a container holding a conversation.
+ * It reuses the envelope's existing meta types, so each surface's render stays byte-identical.
+ */
+export interface WakeLocus {
+  /** The CONTAINER: Slack/Discord channel, Notion page, GitHub repo, Linear team. */
+  readonly channel: WakeChannelMeta;
+  /** The CONVERSATION, when the wake is conversation-scoped (Slack thread ts, Discord thread
+   *  channel id, Notion discussion id, …). Absent = container-scoped (top-level message,
+   *  supervisor wake). */
+  readonly thread?: WakeThreadMeta;
+}
+
+export interface NormalizedWake {
+  /** Platform id (binding.ts vocabulary). For audit/log labels and the ingest registry key ONLY —
+   *  renderWake NEVER branches on it (that is the whole point). */
+  readonly platform: string;
+  /** Existing union (wake-envelope.ts) — NOT extended here. */
+  readonly reason: WakeReason;
+  readonly addressing: WakeAddressing;
+  /** The CONTAINER noun for this locus — "channel" (default, Slack/Discord) or "doc" (Notion).
+   *  Renders as the `<channel container>` attribute; unset ⇒ "channel". */
+  readonly containerNoun?: string;
+  // The room shape is NOT a field here: it reaches the model on the attribute that always carried it, `<channel type>`.
+  /** Engagement calibration ({@link WakeEngagementTier}) — renders as the `<wake engagement>`
+   *  attribute, a resolved `"neutral"` included. */
+  readonly engagementTier?: WakeEngagementTier;
+  // The cross-surface disclosure rule is NOT a field here: the standing "Reading a wake" block states it once for the session, which is where a standing rule belongs.
+  /**
+   * Host-minted wake id, rendered as the `<wake wake-id>` attribute — the SINGLE-WINDOW path only. It is the id the model echoes to the `reply` tool so the host can resolve the wake's origin, because a turn that merged cross-surface deliveries carries one auth snapshot that cannot address each wake. That merge is unreachable on eve 0.54.3 — only the caller-less task completion cohort folds, and it carries no `auth` — but the id is still LOAD-BEARING: every single-window reply resolves its target by it, and the fence admits sibling wakes with no merge (OPE-2042).
+   * Unset means no attribute, and the session then has no id to route a `reply` through.
+   */
+  readonly wakeId?: string;
+  /**
+   * The follow-up contract for a wake that is NOT a name-drop, rendered as the `<wake follow-up>` attribute.
+   * The name-drop mechanic states its own value under {@link NormalizedWake.nameDrop}; this field is what lets an ALREADY-ENGAGED conversation state `"thread-engaged"` on a judged ambient wake, which is a fact the envelope vocabulary has always carried and no builder could set.
+   * MEASURED WHY (ship #195, deploy `dpl_EXAMPLE000000000000000000001`): the F-EDIT leg's edit wake reached the seat with `addressing="channel-watch"` and no `follow-up`, in a thread the same seat had answered 65 s earlier, and the seat declined it as `no_reply reason:"not_relevant"` — "The headcount update was not addressed to me". The enrolment was in the engagement registry the whole time; nothing on the wake said so.
+   * Absent ⇒ no attribute, which is every wake that states no contract. {@link NormalizedWake.nameDrop} wins where both are somehow set, so the name-drop render is byte-identical.
+   */
+  readonly followUp?: WakeFollowUp;
+  readonly locus: WakeLocus;
+  /** id→name/handle directory (untrusted profile content; the envelope escapes it). */
+  readonly participants?: readonly WakeParticipant[];
+  /** ENVELOPE-SIBLING backscroll (oldest-first, no trigger flags): the supervisor first-wake
+   *  clustered bundle. Renders as <session>-grouped / flat <message> siblings before the trigger. */
+  readonly backscroll?: readonly WakeMessageInput[];
+  /** SIDE-CHANNEL conversation context (mention/name-drop hydration): RAW ContextLines — the
+   *  renderer calls the shared renderContext itself (W3). Rendered into RenderedWake.context. */
+  readonly contextLines?: readonly ContextLine[];
+  /** renderContext's `source` label. Required when contextLines is non-empty. */
+  readonly contextSource?: string;
+  /** Trusted, adapter-authored "fetch more" hint naming REAL tools on this surface (surfaces with
+   *  no read tools pass none — honest availability, same doctrine as the CapabilityManifest).
+   *  Appended OUTSIDE the untrusted wrap by renderContext. */
+  readonly readMoreHint?: string;
+  /**
+   * name-drop addressing only. `followUp` is the honest follow-up contract — three values, because three engagement mechanics exist today — rendered as the `<wake follow-up>` attribute.
+   * There is deliberately no matched-name member: the standing identity line states the agent's own name every turn, so the wake never needed to.
+   */
+  readonly nameDrop?: {
+    readonly followUp: WakeFollowUp;
+  };
+  /**
+   * A "changed since your last wake" PUSH — a FULLY-FORMED, TRUSTED, OE-computed `<system-reminder>` block, appended after the rendered envelope on its own line, so the model is TOLD which memory silos changed.
+   * It is trusted ONLY because every byte is built from OE-CONTROLLED pointers, never memory-file content, and the renderer emits it VERBATIM, adding no interpolation point. Unset means nothing is appended, and it is ignored on a raw `direct` wake, which stays verbatim.
+   */
+  readonly memoryDelta?: string;
+  /**
+   * This surface cannot read its own history between wakes, so the seat's since-last-wake catch-up did not run (channels/seat-catch-up.ts `catchUpUnavailableReason`). Rendered as a trusted `<system-note>` inside the envelope — see {@link WakeEnvelopeInput.catchUpUnavailable} for why an empty context must not be readable as a quiet room.
+   * Absent ⇒ nothing is appended. Ignored on a raw `direct` wake, which stays verbatim.
+   */
+  readonly catchUpUnavailable?: string;
+  /**
+   * OE's OWN instruction for this wake, rendered as a trusted `<system-note>` inside the envelope — see {@link WakeEnvelopeInput.systemNote} for why it must never ride a fenced message body.
+   * Only an OE builder sets it: the auto-redrive's correction (channels/unified-redrive.ts `buildRedriveWake`) and the approval-decision notice (approvals/decision-wake.ts `buildApprovalDecisionWake`, a `notice` trigger whose note is its whole cause).
+   * Absent ⇒ nothing is appended. Ignored on a raw `direct` wake, which stays verbatim. REQUIRED, non-empty, on a `notice` trigger — the renderer throws otherwise.
+   */
+  readonly systemNote?: string;
+  readonly trigger: NormalizedWakeTrigger;
+}
+
+/** What the single renderer emits — the exact shape every OE-owned dispatch already sends. */
+export interface RenderedWake {
+  /** The turn message: the `<wake>` envelope (judged) or the raw driver text (direct). */
+  readonly message: string;
+  /** Untrusted-wrapped context blocks (renderContext output) — omitted when empty, so the eve
+   *  SendPayload stays `message`-only on the no-context path (today's exact behaviour). */
+  readonly context?: readonly string[];
+}
+
+/** One inbound-event mapper: a raw surface payload becomes a NormalizedWake, or null to drop. The uniform seam every surface builder conforms to. */
+export type WakeIngest<Raw> = (raw: Raw) => NormalizedWake | null;
+
+/**
+ * Wrap a fully-built trigger message as the sole `{ kind: "message" }` trigger.
+ * It STAMPS `trigger: true` structurally — callers never set it — so the renderer's exactly-one-trigger invariant is satisfied by construction rather than by convention.
+ */
+export function mkMessageTrigger(message: WakeMessageInput): NormalizedWakeTrigger {
+  return { kind: "message", message: { ...message, trigger: true } };
+}
+
+/**
+ * The SINGLE wake renderer — no platform branch. `direct` emits the trigger body VERBATIM and unwrapped; every judged addressing emits the `<wake>` envelope ALONE, body untrusted-wrapped by the envelope renderer, with nothing rendered above it.
+ * Context is the untrusted-wrapped block when there are context lines, and is omitted otherwise so the payload stays message-only. `now` is a clock seam, so the envelope's current time is deterministic in tests.
+ */
+export function renderWake(nw: NormalizedWake, now: () => string = () => new Date().toISOString()): RenderedWake {
+  let message: string;
+  switch (nw.trigger.kind) {
+    case "message": {
+      if (nw.addressing === "direct") {
+        // W4: the addressed turn is the conversation driver — verbatim, never untrusted-wrapped.
+        message = nw.trigger.message.body;
+      } else {
+        message = renderWakeEnvelope({
+            reason: nw.reason,
+            currentTime: now(),
+            wakeId: nw.wakeId,
+            // The typed facts the model reads its obligation off: `addressing` mirrors the wake's own value and is never rendered on `direct`, which this branch never runs for; `engagement` mirrors the tier, a resolved "neutral" included; `follow-up` is the name-drop mechanic's own value, or the builder-stated contract for a wake that has one ({@link NormalizedWake.followUp}), and is undefined on every wake that states neither.
+            // `channel.container` falls back to the wake's container noun, then to "channel".
+            addressing: nw.addressing,
+            engagement: nw.engagementTier,
+            followUp: nw.nameDrop?.followUp ?? nw.followUp,
+            // The always-known platform drives each message body's untrusted-wrap `source` label — the ONE platform-DERIVED token in the render.
+            // It is NOT a code branch: it is input DATA interpolated into a provenance label, exactly like an author name, and it is distinct from the locus platform, which the platform-blind render does not emit at all.
+            sourcePlatform: nw.platform,
+            // THE OPAQUE CHANNEL KEY: `<channel id>` carries the KEY, never the raw vendor id, so the model never holds two names for one place and never states a surface — the read verbs take this exact string.
+            // Minting it HERE, in the SINGLE renderer, is what makes that true on every surface at once: no provider builder has to know about the key, and none can forget it. This is still not a platform BRANCH — the platform is input data fed to a pure encoder.
+            channel: {
+              ...nw.locus.channel,
+              id: encodeChannelKey(nw.platform, nw.locus.channel.id),
+              container: nw.locus.channel.container ?? nw.containerNoun ?? "channel",
+            },
+            participants: nw.participants,
+            thread: nw.locus.thread,
+            // Oldest-first backscroll siblings, ending at the sole trigger (renderWakeEnvelope's
+            // own exactly-one-trigger / trigger-last invariant).
+            messages: [...(nw.backscroll ?? []), nw.trigger.message],
+            catchUpUnavailable: nw.catchUpUnavailable,
+            systemNote: nw.systemNote,
+        });
+      }
+      break;
+    }
+    case "notice": {
+      // A notice is never `direct`: nobody addressed the seat, so there is no body to pass verbatim.
+      // It has no triggering message, so it has no backscroll to end at one either. Both are builder
+      // bugs, and they fail loud here rather than rendering a wake with a cause nobody can read.
+      if (nw.addressing === "direct") throw new Error("renderWake: a notice wake cannot be direct");
+      if (nw.backscroll && nw.backscroll.length > 0) throw new Error("renderWake: a notice wake carries no backscroll");
+      if (nw.systemNote === undefined || nw.systemNote.length === 0) throw new Error("renderWake: a notice wake needs a non-empty systemNote");
+      message = renderWakeEnvelope({
+        reason: nw.reason,
+        currentTime: now(),
+        wakeId: nw.wakeId,
+        addressing: nw.addressing,
+        engagement: nw.engagementTier,
+        followUp: nw.nameDrop?.followUp ?? nw.followUp,
+        channel: {
+          ...nw.locus.channel,
+          id: encodeChannelKey(nw.platform, nw.locus.channel.id),
+          container: nw.locus.channel.container ?? nw.containerNoun ?? "channel",
+        },
+        participants: nw.participants,
+        thread: nw.locus.thread,
+        messages: [],
+        catchUpUnavailable: nw.catchUpUnavailable,
+        systemNote: nw.systemNote,
+      });
+      break;
+    }
+    default: {
+      // Step-5 `{ kind: "event" }` lands here as a compile-forced addition, not a silent
+      // fall-through (there is no event consumer yet — no-extrapolation discipline).
+      const _exhaustive: never = nw.trigger;
+      throw new Error(`renderWake: unknown trigger kind ${String((_exhaustive as { kind?: unknown }).kind)}`);
+    }
+  }
+
+  // The "changed since your last wake" PUSH, appended after the envelope on its own line. It is an OPAQUE TRUSTED CONSTANT — built entirely from OE-controlled pointers, with no interpolation here.
+  // Only on an ENVELOPED wake, never a raw `direct` body, which must stay verbatim; unset means nothing is appended at all.
+  if (nw.memoryDelta !== undefined && nw.addressing !== "direct") {
+    message = `${message}\n\n${nw.memoryDelta}`;
+  }
+
+  // Side-channel conversation context: the renderer calls renderContext itself (W3 — the type never
+  // carries a pre-rendered string). renderContext returns null when every line is empty; a
+  // non-empty contextLines with all-empty text therefore renders no context block.
+  //
+  // 🔴 THE CAP SITS BELOW THE DE-DUPLICATION, HERE (OPE-1749). This is the SINGLE wake renderer and the
+  // one place holding BOTH slots — the envelope siblings and the hydration — so `hydrationSlices` is
+  // applied once, in core. Dropping the envelope's own copies first is what lets the cap spend its whole
+  // budget on the older conversation the envelope never carried; capping first rendered a shallow block.
+  // It is idempotent, so a surface that already resolved its own slices (Slack's name-drop road, which
+  // needs the join half) renders byte-identically.
+  //
+  // 🔴 IT REACHES A SURFACE ONLY IF THAT SURFACE FILLS THIS SLOT, and that is a per-surface fact, not a
+  // property of this function. A road that renders its own block and hands the wake a STRING bypasses
+  // the ordering entirely — Discord's window road did, until OPE-1749 moved it onto `contextLines`.
+  // `scripts/standing-seat-test.ts` bans a provider from rendering its own block, with an allow-list of
+  // the NATIVE roads that carry no envelope siblings and so have no order to get wrong. TWO SURFACES
+  // ALSO TAKE THE ROAD AND MATCH NOTHING: on GitHub and Linear a context line's `ts` is an issue label
+  // (`#123`, `OPE-1`) that no sibling id ever equals, so the de-duplication drops nothing there and the
+  // slice is the cap alone — the same block those surfaces rendered before.
+  if (nw.contextLines && nw.contextLines.length > 0) {
+    // A `direct` wake renders the body VERBATIM and emits no envelope at all, so its `backscroll`
+    // renders NOWHERE — de-duplicating against it would drop a line to make room for a copy that was
+    // never shown. No builder sets both today; the guard makes that structural rather than a
+    // convention the next DM-seat builder could break.
+    const envelope = nw.addressing === "direct" ? [] : (nw.backscroll ?? []);
+    const lines = hydrationSlices(nw.contextLines, envelope).rendered;
+    const rendered = renderContext(lines, nw.contextSource ?? "", { readMoreHint: nw.readMoreHint });
+    if (rendered) return { message, context: [rendered] };
+  }
+  return { message };
+}

package/agent/channels/oe-oauth-callback.ts

@@ -0,0 +1,13 @@
+// Deployment mount for `GET /oauth/v1/callback`; the behaviour lives in connections/oe-oauth-callback.ts.
+// The completer resolves per request, so the route fails closed (404) whenever the own-rolled OAuth adapter is not registered.
+
+import { defineChannel, GET } from "eve/channels";
+import {
+  OE_OAUTH_CALLBACK_PATH,
+  handleOeOauthCallback,
+  resolveOeOauthCallbackCompleter,
+} from "../connections/oe-oauth-callback.js";
+
+export default defineChannel({
+  routes: [GET(OE_OAUTH_CALLBACK_PATH, async (req) => handleOeOauthCallback(req, resolveOeOauthCallbackCompleter()))],
+});

package/agent/channels/own-post-ledger.ts

@@ -0,0 +1,76 @@
+// own-post-ledger — the record of WHICH platform messages this deployment's own reply spines posted, and so the ONE fence that lets `edit_reply` touch a message at all. A platform refusal is a backstop, not the control: it cannot say which of the bot's messages this is.
+// The model authors one field, the message id; the locus is host-resolved. FAIL-CLOSED, the inverse of operational/post-once.ts — an unreadable store, a missing org or any thrown error answers `false`, which is a refusal and never a permission.
+
+import { createHash } from "node:crypto";
+import { getOperationalStore } from "../operational/provider.js";
+
+/** Namespace prefix — keeps own-post keys from colliding with inbound event ids or `outbound:` keys. */
+const OWN_POST_KEY_PREFIX = "ownpost:";
+
+/**
+ * How long after posting a message stays editable: long enough for a working session in which a posted list or summary needs updating, short enough that the verb stays about a RECENT post.
+ * The `event_dedupe` housekeeping sweep bounds the row regardless, so raising this past that ceiling would buy nothing.
+ */
+export const OWN_POST_TTL_MS = 6 * 60 * 60_000;
+
+/**
+ * WHERE a message this deployment posted lives. Every field is host-resolved — from the session binding or the frozen wake origin — and never from model input.
+ * `channelId` is the conversation the message sits in: a Slack channel id, a Discord channel id (a Discord thread IS its own channel), a Teams conversation id.
+ */
+export interface OwnPostLocus {
+  readonly platform: string;
+  readonly channelId: string;
+}
+
+/** The injectable store seams (tests script them; the live path reads the operational store). */
+export interface OwnPostLedgerDeps {
+  readonly markEventSeen?: (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+  readonly hasEventSeen?: (org: string, key: string, atIso: string, ttlMs: number) => Promise<boolean>;
+  readonly now?: () => number;
+}
+
+/**
+ * The `event_dedupe` key for one posted message, hashed over (platform, channel, message id) so the key is opaque and fixed-length whatever a platform's id grammar is.
+ * The platform tag stays human-legible outside the digest, matching `outboundKey`'s convention.
+ */
+export function ownPostKey(locus: OwnPostLocus, messageId: string): string {
+  const digest = createHash("sha256").update([locus.platform, locus.channelId, messageId].join(" ")).digest("hex");
+  return `${OWN_POST_KEY_PREFIX}${locus.platform}:${digest}`;
+}
+
+/**
+ * Record that THIS deployment posted `messageId` at `locus` — called at the reply CHOKE POINTS beside the canonical `reply.post` audit row, so the ledger and the audit trail record the same event in the same place.
+ * Best-effort and never throws. A blank org, a blank message id or the dedupe sentinel records nothing, and a lost row only means this message cannot be edited later — the fail-closed direction.
+ */
+export async function recordOwnPost(org: string | undefined, locus: OwnPostLocus, messageId: string, deps: OwnPostLedgerDeps = {}): Promise<void> {
+  if (!org || !messageId || !locus.channelId) return;
+  if (!isRecordableMessageId(messageId)) return;
+  const mark = deps.markEventSeen ?? ((o, k, at, ttl) => getOperationalStore().markEventSeen(o, k, at, ttl));
+  const at = new Date((deps.now ?? Date.now)()).toISOString();
+  await mark(org, ownPostKey(locus, messageId), at, OWN_POST_TTL_MS).catch(() => undefined);
+}
+
+/**
+ * Is `messageId` at `locus` a message THIS deployment's reply spine posted, inside the edit window?
+ * Fail-closed on every unknown — no org, no message id, a store error all answer `false` — and channels/reply-edit.ts turns that `false` into an audited refusal rather than a quiet one.
+ */
+export async function isOwnPost(org: string | undefined, locus: OwnPostLocus, messageId: string, deps: OwnPostLedgerDeps = {}): Promise<boolean> {
+  if (!org || !messageId || !locus.channelId) return false;
+  const has = deps.hasEventSeen ?? ((o, k, at, ttl) => getOperationalStore().hasEventSeen(o, k, at, ttl));
+  const at = new Date((deps.now ?? Date.now)()).toISOString();
+  try {
+    return await has(org, ownPostKey(locus, messageId), at, OWN_POST_TTL_MS);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The dedupe sentinel the reply spines return for a suppressed repost — never a real platform id, so it must never enter the ledger.
+ * Duplicated as a literal rather than imported, to keep this module free of a cycle back into the reply spines; channels/reply-post.ts owns the exported constant and a test pins the two equal.
+ */
+const DEDUPE_SENTINEL = "deduped:reply";
+
+function isRecordableMessageId(messageId: string): boolean {
+  return messageId !== DEDUPE_SENTINEL;
+}