@open-everywhere/core 0.1.0

package/agent/channels/question-bridge.ts

@@ -0,0 +1,594 @@
+// question-bridge — what makes `ask_question` a real affordance on the unified channel instead of a hole the turn falls into. It owns BOTH halves: the outbound post that shows the room a question, through the same route the `reply` tool uses, and the durable row, keyed by WINDOW TOKEN, that lets the room's next message come back as a real answer routed to the session that asked. ONE row per window token and CONSUME-ONCE, and the row is written ONLY when the question was actually POSTED — a dropped question must never eat the room's next message.
+// TWO OUTCOMES, BOTH AUDITED — bridged or dropped, never neither — because the defect's signature was an absence of rows. THE QUESTION TEXT IS NEVER AUDITED: it is model-authored on a turn whose whole purpose is often to relay attacker-derived content back to a human, so the rows carry ids, enums and counts only and the text goes to the ROOM and nowhere else. No `reply.post` row is written either: a question is not an answer, and the eval scorers join on that action name to decide whether a wake was answered.
+
+import { appendAudit, type AuditInput } from "../audit/audit.js";
+import { isSessionLimitContinuationRequest } from "./session-park.js";
+import { WAKE_TARGET_TTL_MS, unifiedThreadRef, type UnifiedWakeOrigin } from "./unified-window.js";
+import { dmAnchorSurfaceForToken } from "./window-key.js";
+
+/** A non-park input request was shown to the room. */
+export const QUESTION_BRIDGED_AUDIT_ACTION = "turn.question_bridged";
+/** A non-park input request could NOT be shown to the room. */
+export const QUESTION_DROPPED_AUDIT_ACTION = "turn.question_dropped";
+
+/** Posted when a request carries no usable prompt text. HOST-authored: a question with nothing to
+ *  read is still a parked turn, and a human seeing this can unpark it with any message — which is
+ *  strictly better than the room hearing nothing at all. */
+export const EMPTY_QUESTION_FALLBACK = "I asked a question but supplied no text — reply with anything and I'll carry on.";
+
+/**
+ * eve's framework-owned kind for a TOOL APPROVAL (`shared/input.js` `inputRequestKindSchema`, whose
+ * three values are `question` / `session-limit` / `tool-approval`).
+ *
+ * 🔴 WHY THIS KIND NEEDS ITS OWN HANDLING, AND WHY IT IS A DEFECT THAT IT DID NOT HAVE ANY
+ * (OPE-1056). This bridge was built for `ask_question`, where eve's implicit rule is "the next
+ * message is the answer" and a bare string is a complete response. An APPROVAL is not answered that
+ * way. eve resolves one in `harness/input-request-resolution.js` `resolveApprovalOutcome`, which
+ * reads `response.optionId` and NOTHING else: `approve` approves, `cancel`/`deny` denies, and every
+ * other value — INCLUDING AN ABSENT ONE — answers `{approved: false, status: "invalid"}`. The
+ * answer leg sent `{requestId, text}` with no `optionId` (channels/unified.ts), so a human replying
+ * "Approve" to a bridged connector-write approval denied the write and could never approve it. That
+ * is the measured half of why `S-EVE-CARD` finds no settled approval on the live drive.
+ */
+export const APPROVAL_REQUEST_KIND = "tool-approval";
+
+/**
+ * One option eve offered on an input request.
+ *
+ * PROVENANCE DIFFERS BY KIND, and the redaction rules below turn on it: on a `tool-approval` BOTH
+ * fields are eve-minted constants (`harness/input-extraction.js` mints
+ * `[{id:"approve",label:"Approve"},{id:"cancel",label:"Cancel"}]`), so an id is as safe to audit and
+ * store as any other framework enum. On an `ask_question` both are MODEL-AUTHORED and neither may be
+ * audited or stored — see the header's redaction rule, which is unchanged.
+ */
+export interface BridgeOption {
+  /** eve's stable option id. `""` when the request carried none — a label with no id can be shown to
+   *  the room but can never resolve an approval, so it is never stored as one. */
+  readonly id: string;
+  /** The user-facing label. Rendered into the surface post. */
+  readonly label: string;
+}
+
+/** One bridgeable input request, reduced to what the bridge needs. Text fields are for the ROOM;
+ *  everything the audit row may carry is an id, an eve-owned enum or a count. */
+export interface BridgeableQuestion {
+  /** eve's request id — the tool CALL id for a model-anchored request (harness/input-extraction.js
+   *  `requestId: r.callId`), so eve-minted, never model prose. Safe to audit. */
+  readonly requestId: string;
+  /** The tool the request is ABOUT — `ask_question` for a question, and the tool awaiting approval
+   *  (`notion__notion-create-pages`, …) for a `tool-approval`. eve reads it off the tool call, so it
+   *  is a mounted tool's own name and never model prose: safe to audit. */
+  readonly toolName: string;
+  /** eve's framework-owned source enum (`question` / `tool-approval`; `session-limit` is excluded by
+   *  construction — that is the park). `"unknown"` when a future eve stops carrying it. */
+  readonly kind: string;
+  /** MODEL-AUTHORED. Rendered into the surface post; NEVER audited. */
+  readonly prompt: string;
+  /** The options eve offered. Their LABELS are rendered into the surface post and only their COUNT
+   *  is audited. Their IDS are read only on an approval, where they are eve-minted — see
+   *  {@link BridgeOption}. */
+  readonly options: readonly BridgeOption[];
+}
+
+/**
+ * The FIRST non-park request in an `input.requested` batch, or `undefined` when the batch is eve's session-limit park, which another module owns, or carries nothing recognisable.
+ * FIRST, not all: eve parks the whole batch on one prompt and resumes it with one answer, so posting every request would ask the room several questions it can only answer once. A request with an EMPTY prompt is still returned — it is still a parked turn, and the renderer substitutes a host-authored fallback; dropping it here would recreate the exact silence this module exists to remove.
+ */
+export function detectBridgeableInputRequest(requests: unknown): BridgeableQuestion | undefined {
+  if (!Array.isArray(requests)) return undefined;
+  for (const r of requests as readonly unknown[]) {
+    if (r === null || typeof r !== "object") continue;
+    if (isSessionLimitContinuationRequest(r)) continue;
+    const req = r as { requestId?: unknown; kind?: unknown; prompt?: unknown; options?: unknown; action?: { toolName?: unknown } };
+    const options: BridgeOption[] = [];
+    if (Array.isArray(req.options)) {
+      for (const o of req.options as readonly unknown[]) {
+        const opt = o as { id?: unknown; label?: unknown } | null;
+        const label = opt?.label;
+        // The LABEL is what admits an option — a labelled option is showable, and that is what this
+        // loop has always decided. The id rides along because an APPROVAL cannot be answered without
+        // it (see {@link APPROVAL_REQUEST_KIND}); an option with no id degrades to `""`, which
+        // {@link approvalOptionIds} then drops rather than storing an unusable key.
+        if (typeof label === "string" && label.length > 0) options.push({ id: typeof opt?.id === "string" ? opt.id : "", label });
+      }
+    }
+    return {
+      requestId: typeof req.requestId === "string" ? req.requestId : "",
+      toolName: typeof req.action?.toolName === "string" ? req.action.toolName : "unknown",
+      kind: typeof req.kind === "string" ? req.kind : "unknown",
+      prompt: typeof req.prompt === "string" ? req.prompt : "",
+      options,
+    };
+  }
+  return undefined;
+}
+
+/**
+ * The message the room sees: the question, then its options as a plain list — a surface-agnostic rendering, because the post arms take one string and nothing here may assume a vendor's block format ({@link PostArm} carries no blocks member, so this bridge cannot post an interactive card on any surface).
+ * ON AN `ask_question` the human answers by replying normally and eve consumes that next message as the answer, so no option id travels back. 🔴 ON AN APPROVAL IT DOES, and the line above used to say it never did: eve settles an approval on `optionId` alone, so the reply has to be MATCHED to an option before it is delivered ({@link resolveApprovalOptionId}), and a reply that matches none leaves the turn parked.
+ */
+export function renderQuestionForSurface(question: BridgeableQuestion, opts?: RenderQuestionOptions): string {
+  const head = question.prompt.trim().length > 0 ? question.prompt.trim() : EMPTY_QUESTION_FALLBACK;
+  if (question.options.length === 0) return head;
+  const list = question.options.map((o) => `• ${o.label}`).join("\n");
+  // AN APPROVAL SAYS HOW TO ANSWER IT; A QUESTION DOES NOT NEED TO. For an `ask_question` every
+  // reply is an answer, so the options are a suggestion and a hint would be noise. For an approval
+  // only a reply that NAMES an option resolves it — anything else leaves the turn parked (see
+  // {@link resolveApprovalOptionId}) — so a room shown the bare list would not know that.
+  //
+  // 🔴 THE HINT IS TRUE ONLY WHERE THE CALLER'S RETURN LEG MATCHES OPTIONS, which is why it is
+  // opt-in and not derived from the kind alone (cold review, 2026-09-11). This renderer is shared:
+  // `packages/providers/notion/agent/channels/notion.ts` posts it too, and that surface's return leg
+  // stores no option ids and responds with `text` only — so printing the line there would promise a
+  // protection the code does not provide, and a Notion reader who followed it would DENY the write
+  // and consume the row. A surface earns the line by carrying {@link approvalOptionIds} into its
+  // durable row and {@link resolveApprovalOptionId} into its answer route.
+  //
+  // A SECOND DEPENDENCY, stated rather than assumed: the line tells the room to reply with one of
+  // the LABELS it just printed, while {@link resolveApprovalOptionId} compares against the option
+  // IDS. That is only true because eve's approval labels lowercase to its ids
+  // (`harness/input-extraction.js` mints `Approve`/`approve` and `Cancel`/`cancel`). An eve that
+  // labelled the same option `Approve this write` would make the printed word unmatchable while this
+  // line still promised it worked — so whoever sees that drift fixes the matcher, not this comment.
+  const hint = opts?.answerByOption === true && question.kind === APPROVAL_REQUEST_KIND ? `\n\n${APPROVAL_ANSWER_HINT}` : "";
+  return `${head}\n\n${list}${hint}`;
+}
+
+/** Per-surface rendering choices. Absent ⇒ the plain render every caller had before OPE-1056. */
+export interface RenderQuestionOptions {
+  /** This caller's return leg really does match a reply to an option id — see the hint paragraph in
+   *  {@link renderQuestionForSurface}. Only `channels/unified.ts` sets it today. */
+  readonly answerByOption?: boolean;
+}
+
+/** HOST-authored coaching line under a bridged APPROVAL's option list. See
+ *  {@link renderQuestionForSurface} for the two conditions that make it true. */
+export const APPROVAL_ANSWER_HINT = "Reply with one of those words to answer — anything else leaves this waiting.";
+
+/**
+ * The option ids an APPROVAL can be answered with, or an empty list for every other kind.
+ *
+ * EMPTY FOR AN `ask_question`, DELIBERATELY: its option ids are model-authored, nothing downstream
+ * needs them (a question takes free text), and returning them would put model prose into the durable
+ * row that {@link OutstandingQuestion} promises holds ids only. An id-less option is dropped for the
+ * same reason the loop above keeps it as `""` — it cannot resolve anything.
+ */
+export function approvalOptionIds(question: BridgeableQuestion): readonly string[] {
+  if (question.kind !== APPROVAL_REQUEST_KIND) return [];
+  return question.options.map((o) => o.id).filter((id) => id.length > 0);
+}
+
+/** Words a room may answer an approval with, beside the option ids themselves. HOST-authored and
+ *  deliberately SMALL: the fail direction of an unmatched reply is a question that waits (safe),
+ *  while a loose match on the approve side runs a governed op nobody meant to allow.
+ *  🔴 EVERY WORD HERE NAMES APPROVAL, and a bare conversational acknowledgement does NOT (cold
+ *  review, 2026-09-11). `ok` and `okay` were in this set and are the reason it is stated as a rule:
+ *  a seat parked in a group DM or a channel hears "ok" addressed to somebody else all day, and any
+ *  one of them would have executed the governed write. `yes` stays — it is an answer to a question,
+ *  not an ack — and it is the weakest member; do not add to this set without the same test. */
+const APPROVE_WORDS: ReadonlySet<string> = new Set(["approve", "approved", "allow", "yes"]);
+/** The deny half of the vocabulary above. It may be broader than the approve half, because a wrong
+ *  deny costs a re-ask and a wrong approve costs an unintended write. */
+const DENY_WORDS: ReadonlySet<string> = new Set(["cancel", "deny", "denied", "reject", "rejected", "no", "stop", "decline"]);
+
+/**
+ * The option id a room's reply names, or `undefined` when it names none.
+ *
+ * 🔴 THE WHOLE MESSAGE MUST BE THE ANSWER, never a word found inside one. "no, that is the wrong
+ * page — use the other one" is a correction, not a deny, and matching a substring there would settle
+ * a governed approval off prose that was steering it. So the reply is trimmed, lowercased and
+ * stripped of surrounding punctuation, and then compared WHOLE.
+ * The comparison is against `optionIds` FIRST — eve labels its approval options `Approve`/`Cancel`,
+ * which lowercase to the ids exactly, so the labels need no separate table and no model-authored text
+ * has to be stored to match them. The small synonym vocabulary above is the second arm, and it can
+ * only ever select an id the request ACTUALLY OFFERED: a request with no `cancel`/`deny` option
+ * cannot be denied by the word "no".
+ */
+export function resolveApprovalOptionId(text: string, optionIds: readonly string[]): string | undefined {
+  const word = text.trim().toLowerCase().replace(/^[^\p{L}\p{N}]+/u, "").replace(/[^\p{L}\p{N}]+$/u, "");
+  if (word.length === 0) return undefined;
+  const offered = optionIds.filter((id) => id.length > 0);
+  const exact = offered.find((id) => id.toLowerCase() === word);
+  if (exact !== undefined) return exact;
+  const family = APPROVE_WORDS.has(word) ? APPROVE_WORDS : DENY_WORDS.has(word) ? DENY_WORDS : undefined;
+  if (family === undefined) return undefined;
+  return offered.find((id) => family.has(id.toLowerCase()));
+}
+
+/** Why a question never reached the room. Both are the SAME visible failure (silence) and must stay
+ *  distinguishable in the log: one is a missing/expired map row, the other a live surface error. */
+export type QuestionDropReason = "unresolved-origin" | "post-failed";
+
+export type QuestionBridgeOutcome =
+  /**
+   * `origin` is the resolved wake origin the question was POSTED to.
+   * The caller needs it to record which room may answer, and returning it here keeps that key the SAME origin the post really used, rather than a second resolution that could disagree with it.
+   */
+  | { readonly status: "bridged"; readonly platform: string; readonly id: string; readonly origin: UnifiedWakeOrigin }
+  | { readonly status: "dropped"; readonly reason: QuestionDropReason };
+
+/** The partition + identity a bridged question is recorded against — exactly what the channel's
+ *  event handler already holds. */
+export interface QuestionBridgeScope {
+  readonly org: string;
+  /** Partition platform for the row: `"unified"` from the unified channel, matching every other row
+   *  that channel writes. The ORIGIN platform (where the question actually landed) rides `detail`. */
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  readonly sessionId?: string;
+  readonly wakeId?: string;
+}
+
+export interface QuestionBridgeDeps {
+  /** Resolve THIS turn's wake origin — the caller closes over `currentWakeId` + the durable
+   *  wakeId→origin map, i.e. the identical resolution the `reply` tool performs. Returns null when
+   *  the wake has no stamp or its map row is gone. Must not throw (the caller swallows). */
+  readonly resolveOrigin: () => Promise<UnifiedWakeOrigin | null>;
+  /** Post the rendered question. Live default is `postUnifiedReply(origin, text)` — with NO audit
+   *  struct, so no `reply.post` row is written (see the header). */
+  readonly post: (origin: UnifiedWakeOrigin, text: string) => Promise<string>;
+  readonly audit?: (entry: AuditInput) => Promise<void>;
+}
+
+/** Ceiling on a post-arm error string reaching the audit detail: enough of the arm's message to name
+ *  the failing surface and reason, never a response body. */
+const ERROR_MAX = 300;
+
+/**
+ * The platform-prefixed CONTAINER the question was posted into, or `undefined` when the origin has
+ * no derivable one.
+ *
+ * TOTAL BY CONSTRUCTION, because this feeds an AUDIT ROW and the row must be written whatever
+ * happens: `unifiedThreadRef` throws on a variant it cannot key, and a throw here would lose the
+ * whole row rather than one field. The caller in channels/unified.ts guards the identical call the
+ * same way for the routing key — same derivation, same posture, so the room recorded and the room
+ * allowed to answer cannot come from two different rules.
+ */
+function containerKeyOf(origin: UnifiedWakeOrigin): string | undefined {
+  try {
+    const key = unifiedThreadRef(origin).channelKey;
+    return key.length > 0 ? key : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Show ONE detected question to the room and record which way it went. BEST-EFFORT, in the house posture: this runs inside a channel event handler on a turn eve has ALREADY parked, so nothing here throws and a failure becomes a dropped row while the turn stays parked. What it must never do is return without a row.
+ * The wake is deliberately NOT marked answered: a question is not an answer, and the wake still owes the room a reply once the human unparks the turn.
+ */
+export async function bridgeQuestionToSurface(
+  scope: QuestionBridgeScope,
+  question: BridgeableQuestion,
+  deps: QuestionBridgeDeps,
+): Promise<QuestionBridgeOutcome> {
+  const audit = deps.audit ?? appendAudit;
+  // `answerByOption` is earned HERE, in this module, not asserted by a caller: the same file holds
+  // the durable row that carries {@link approvalOptionIds} and the {@link resolveInboundAnswerRouting}
+  // that matches a reply against them, and this bridge is the unified window's alone (the Notion
+  // surface calls {@link renderQuestionForSurface} directly and has no such return leg). Keeping the
+  // flag beside the two halves it depends on is what stops the hint outliving them.
+  const text = renderQuestionForSurface(question, { answerByOption: true });
+  // Ids/enums/counts only — never `prompt`, never an option LABEL (see the header's redaction rule).
+  const base = {
+    requestId: question.requestId,
+    toolName: question.toolName,
+    kind: question.kind,
+    chars: text.length,
+    options: question.options.length,
+    ...(scope.wakeId ? { wakeId: scope.wakeId } : {}),
+    ...(scope.sessionId ? { sessionId: scope.sessionId } : {}),
+  };
+  const row = (action: string, detail: Record<string, unknown>): Promise<void> =>
+    audit({ org: scope.org, platform: scope.platform, workspace: scope.workspace, surface: scope.surface, action, detail }).catch(() => undefined);
+
+  let origin: UnifiedWakeOrigin | null = null;
+  try {
+    origin = await deps.resolveOrigin();
+  } catch {
+    origin = null; // an origin lookup that threw is an origin we do not have — same outcome, one row.
+  }
+  if (!origin) {
+    await row(QUESTION_DROPPED_AUDIT_ACTION, { ...base, reason: "unresolved-origin" satisfies QuestionDropReason });
+    return { status: "dropped", reason: "unresolved-origin" };
+  }
+  try {
+    const id = await deps.post(origin, text);
+    // WHICH ROOM SAW IT (OPE-1231). The row named the platform and the message id but never the
+    // ROOM, so the audit trail could not answer "where was this shown?" — and for a request raised
+    // inside a DELEGATED WORKER that is the whole security question: `connectors.dmOnly` admits a
+    // worker spawned from a DM, and the containment argument for a connector card rests on the card
+    // being in one person's own room. The platform-prefixed CONTAINER key is the same grain
+    // {@link OutstandingQuestion.containerKey} routes an answer on, so the room that was SHOWN the
+    // question and the room allowed to ANSWER it are recorded at one grain and can be compared.
+    // Still ids only: a container id, never a member list and never the prompt.
+    const containerKey = containerKeyOf(origin);
+    await row(QUESTION_BRIDGED_AUDIT_ACTION, { ...base, platform: origin.platform, id, ...(containerKey ? { containerKey } : {}) });
+    return { status: "bridged", platform: origin.platform, id, origin };
+  } catch (err) {
+    await row(QUESTION_DROPPED_AUDIT_ACTION, {
+      ...base,
+      reason: "post-failed" satisfies QuestionDropReason,
+      platform: origin.platform,
+      error: (err instanceof Error ? err.message : String(err)).slice(0, ERROR_MAX),
+    });
+    return { status: "dropped", reason: "post-failed" };
+  }
+}
+
+/** A room message was delivered to the window as an ANSWER, not as an ordinary wake. */
+export const QUESTION_ANSWERED_AUDIT_ACTION = "input_response.routed";
+/** An answer that could not be delivered — eve refused the `respond`, so the message was delivered
+ *  as an ordinary wake instead and the question stays open. NEVER a silent fall-through. */
+export const QUESTION_ANSWER_DROPPED_AUDIT_ACTION = "input_response.dropped";
+
+/** Key prefix for the outstanding-question row. Its own namespace, so it can never collide with the
+ *  task-wake plane's `oe-task-wake:` rows or the taint plane's rows in the same slice. */
+const BRIDGED_QUESTION_PREFIX = "oe-question-bridge:";
+
+/** Same 6h bound as the wake-target map: the row and the wakeId→origin row are written by the same
+ *  handler and are meaningless apart, so one outliving the other buys nothing. */
+const BRIDGED_QUESTION_TTL_MS = WAKE_TARGET_TTL_MS;
+
+/** The store key for one window token's outstanding question. The token is unique within the org. */
+export function bridgedQuestionKey(bareToken: string): string {
+  return `${BRIDGED_QUESTION_PREFIX}${bareToken}`;
+}
+
+/**
+ * One question the room has been shown and has not yet answered.
+ * IDS ONLY. The prompt text is NEVER stored, for the same reason it is never audited: it is model-authored on a turn whose whole purpose is often to relay attacker-derived content. The room holds the text; this row holds the address.
+ */
+export interface OutstandingQuestion {
+  /** The PARENT-VISIBLE request id — the exact string eve's proxy map is keyed on, so it is the only
+   *  value that can route an answer. For a task child eve namespaces it `<taskId>:<childCallId>`
+   *  (`createTaskInputRequestId`); for the window's own question it is the tool call id. */
+  readonly requestId: string;
+  /**
+   * THE ROOM THE QUESTION WAS POSTED INTO — the platform-prefixed CONTAINER id. Load-bearing for ROUTING, not diagnosis: the row is keyed by WINDOW TOKEN, and a cross-surface window is ONE token for a whole domain across every room and surface, so the token alone cannot say where the question is showing. Without this field a message in any other room is consumed as the answer, the person who sent it is never heard, and the worker resumes on text from a conversation that never saw its question.
+   * CONTAINER, NOT THREAD, and that grain is deliberate: an addressed mention posts the question THREADED under itself, so the human's reply arrives with a thread id the original top-level wake never had, and a thread-level comparison would refuse the one answer this feature exists to accept.
+   */
+  readonly containerKey?: string;
+  /** The wake the question was raised on, for the audit join. Absent on a wake with no stamp. */
+  readonly wakeId?: string;
+  /** The owning background task, DERIVED from `requestId` — audit and diagnosis only. Routing never
+   *  reads it: eve routes on the request id alone. Absent when the id is not task-namespaced. */
+  readonly taskId?: string;
+  /**
+   * THE OPTION IDS THAT SETTLE THIS REQUEST — present ONLY for an APPROVAL, and the field that makes
+   * a bridged approval answerable at all. eve resolves an approval on `response.optionId` alone, so
+   * the answer leg has to know which ids the parked request offered; the room's reply carries a word,
+   * not an id. Absent ⇒ the request is an `ask_question` and its answer is free text, exactly as
+   * before ({@link resolveInboundAnswerRouting} branches on the absence, never on a kind string).
+   * IDS ONLY, and the header's redaction rule is untouched: {@link approvalOptionIds} returns these
+   * for the approval kind alone, where they are eve-minted constants rather than model prose.
+   */
+  readonly optionIds?: readonly string[];
+  readonly at: string;
+}
+
+/** The three-method slice of `OperationalStore` this leg needs (injected for deterministic tests;
+ *  live callers pass `getOperationalStore()`). */
+export interface BridgedQuestionStore {
+  putTaskResult(org: string, key: string, resultJson: string, at: string, ttlMs: number): Promise<void>;
+  getTaskResult(org: string, key: string): Promise<string | null>;
+  deleteTaskResult(org: string, key: string): Promise<boolean>;
+}
+
+/**
+ * The task that owns a parent-visible request id, or `undefined` when the id is not task-namespaced — a window's OWN question carries a bare tool-call id and yields `undefined`.
+ * DERIVED, NOT AUTHORITATIVE: nothing routes on this, and it exists so an operator reading the audit trail can join an answer to the worker it unblocked. If eve changes the namespacing it degrades to `undefined` and the leg still works.
+ */
+export function taskIdOfBridgedRequestId(requestId: string): string | undefined {
+  const cut = requestId.indexOf(":");
+  if (cut <= 0) return undefined;
+  const head = requestId.slice(0, cut);
+  return head.startsWith("task_") ? head : undefined;
+}
+
+/**
+ * Record that this window is now parked on a question the room can see.
+ * It never throws — the caller runs inside a channel event handler on an ALREADY-PARKED turn, and a store blip must not break the event dispatch on top of it. The return says whether the row was written, so the caller can log the difference between "the room can answer this" and "it cannot".
+ */
+export async function rememberBridgedQuestion(
+  store: BridgedQuestionStore,
+  org: string,
+  bareToken: string,
+  input: {
+    readonly requestId: string;
+    readonly containerKey?: string;
+    readonly wakeId?: string;
+    readonly at?: string;
+    /** {@link approvalOptionIds} of the request being remembered — empty for every non-approval, and
+     *  an empty list is stored as ABSENT so a question's row is byte-identical to what it was. */
+    readonly optionIds?: readonly string[];
+  },
+): Promise<boolean> {
+  try {
+    if (bareToken.length === 0 || input.requestId.length === 0) return false;
+    const at = input.at ?? new Date().toISOString();
+    const taskId = taskIdOfBridgedRequestId(input.requestId);
+    const optionIds = (input.optionIds ?? []).filter((id) => id.length > 0);
+    const row: OutstandingQuestion = {
+      requestId: input.requestId,
+      ...(input.containerKey !== undefined && input.containerKey.length > 0 ? { containerKey: input.containerKey } : {}),
+      ...(input.wakeId !== undefined && input.wakeId.length > 0 ? { wakeId: input.wakeId } : {}),
+      ...(taskId !== undefined ? { taskId } : {}),
+      ...(optionIds.length > 0 ? { optionIds } : {}),
+      at,
+    };
+    await store.putTaskResult(org, bridgedQuestionKey(bareToken), JSON.stringify(row), at, BRIDGED_QUESTION_TTL_MS);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Read one window's outstanding question back, or `undefined` for an absent, malformed or
+ *  unreadable row. FAIL-SOFT TO "NO QUESTION": the fallback is an ordinary wake, which is what every
+ *  message did before this leg existed. */
+export async function readBridgedQuestion(store: BridgedQuestionStore, org: string, bareToken: string): Promise<OutstandingQuestion | undefined> {
+  try {
+    if (bareToken.length === 0) return undefined;
+    const raw = await store.getTaskResult(org, bridgedQuestionKey(bareToken));
+    if (raw === null) return undefined;
+    const parsed = JSON.parse(raw) as Partial<OutstandingQuestion> | null;
+    const requestId = parsed?.requestId;
+    if (typeof requestId !== "string" || requestId.length === 0) return undefined;
+    // A row written before this field existed, or by a build that stored a malformed one, reads back
+    // with NO option ids — which routes exactly as it did then (free text, no optionId). The read is
+    // element-wise for the same reason every other field here is typed on the way out: the row is
+    // JSON off a store, not a value this process just built.
+    const optionIds = Array.isArray(parsed?.optionIds)
+      ? (parsed.optionIds as readonly unknown[]).filter((id): id is string => typeof id === "string" && id.length > 0)
+      : [];
+    return {
+      requestId,
+      ...(typeof parsed?.containerKey === "string" && parsed.containerKey.length > 0 ? { containerKey: parsed.containerKey } : {}),
+      ...(typeof parsed?.wakeId === "string" && parsed.wakeId.length > 0 ? { wakeId: parsed.wakeId } : {}),
+      ...(typeof parsed?.taskId === "string" && parsed.taskId.length > 0 ? { taskId: parsed.taskId } : {}),
+      ...(optionIds.length > 0 ? { optionIds } : {}),
+      at: typeof parsed?.at === "string" ? parsed.at : "",
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Drop one window's outstanding question. It is called on an ANSWER — consume-once, so the message AFTER the answer is an ordinary wake — and on a CANCELLED parent turn, where eve wipes the whole proxy map, so the request id can no longer route and a later `respond` would swallow the room's message instead of waking the seat.
+ * An expired or unreadable row is handled by TTL, not here. It never throws, and returns whether a row was actually removed.
+ */
+export async function forgetBridgedQuestion(store: BridgedQuestionStore, org: string, bareToken: string): Promise<boolean> {
+  try {
+    if (bareToken.length === 0) return false;
+    return await store.deleteTaskResult(org, bridgedQuestionKey(bareToken));
+  } catch {
+    return false;
+  }
+}
+
+/** The wake-map slice {@link settleAnsweredWake} writes — one method, so a test drives it with the real store or a small fake. */
+export interface AnsweredWakeStore {
+  markUnifiedWakeAnswered(org: string, wakeId: string, at: string, turnId?: string): Promise<void>;
+}
+
+/**
+ * THE ANSWER LEG SETTLES ITS OWN WAKE (OPE-2116). `receive` registers every inbound wake as PENDING before it
+ * decides where the wake goes. When the wake is delivered to a worker as an answer, the seat never gets it,
+ * so the row must not stay pending: the reply freshness gate (reply-freshness.ts) counts a pending inbound
+ * row as "already queued for you" and refuses the seat's reply with that false promise.
+ * This reuses the ordinary answered mark. No turn id rides it, because no seat turn answered the wake, so
+ * the answerable-reply fence also refuses a seat reply addressed to it. Never throws: the answer is
+ * already delivered, and a store failure here must not make the caller re-send it as a wake.
+ */
+export async function settleAnsweredWake(store: AnsweredWakeStore, org: string, wakeId: string, at: string = new Date().toISOString()): Promise<boolean> {
+  try {
+    if (wakeId.length === 0) return false;
+    await store.markUnifiedWakeAnswered(org, wakeId, at);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** What an inbound room message is: an ANSWER to the window's outstanding question, or an ordinary
+ *  WAKE. `reason` names why a wake stayed a wake, so a leg that never fires is diagnosable. */
+export type InboundAnswerRouting =
+  | {
+      readonly kind: "answer";
+      readonly requestId: string;
+      readonly floor: string;
+      readonly wakeId?: string;
+      readonly taskId?: string;
+      /** The eve option id this reply selected — present only for an APPROVAL, and the field eve's
+       *  `resolveApprovalOutcome` reads. Absent for an `ask_question`, whose answer is the text. */
+      readonly optionId?: string;
+    }
+  | { readonly kind: "wake"; readonly reason: "internal-dispatch" | "no-question" | "addressed-mention" | "foreign-room" | "refused" | "unmatched-option" };
+
+/**
+ * Does this inbound wake ADDRESS THE SEAT by an @-mention (OPE-2116, Tommy's ruling 2026-09-24)? True when the surface stamped the wake `direct-mention`, the wake is not a follow-up, and the window is NOT a DM.
+ * 🔴 TWO WAKES CARRY THE STAMP WITHOUT AN @-MENTION, and both are addressed by construction, so the stamp says nothing there about whether the person is answering. A DM: every DM surface stamps `direct-mention` on every DM wake. The DM test is the window token's DM pseudo-domain ({@link dmAnchorSurfaceForToken}), the same seam the dispatch gates use; a group DM rides the same seat. A FOLLOW-UP (`UnifiedWindowWake.followUp`): a Linear `prompted` reply in the app's agent session that names no app mention. Without these exclusions neither could answer its own worker's question.
+ */
+export function isAddressedMentionWake(window: { readonly addressing?: string; readonly followUp?: true }, bareToken: string): boolean {
+  return window.addressing === "direct-mention" && window.followUp !== true && dmAnchorSurfaceForToken(bareToken) === undefined;
+}
+
+/** Injected edges of {@link resolveInboundAnswerRouting} — the store read and the admission floor,
+ *  so the whole decision is drivable with no store and no platform. */
+export interface InboundAnswerDeps {
+  readonly read: () => Promise<OutstandingQuestion | undefined>;
+  /** The OPE-574 admission (approvals/input-response-floor.ts `admitInputResponse`), narrowed to the
+   *  two facts this decision needs. It writes its own `input_response.denied` row on a refusal. */
+  readonly admit: () => Promise<{ readonly ok: true; readonly floor: string } | { readonly ok: false }>;
+}
+
+/**
+ * Decide whether one inbound room message answers the window's outstanding question. THE FLOOR IS THE SAME ONE THE WIDGET PATH RUNS: a room message resolving a worker's question is the same act as a click on that question's widget over a different transport, and anything else would make the transport the control. A REFUSAL IS NOT A DROP — the message still reaches the seat as an ordinary wake and the row is LEFT IN PLACE, so the question stays open for someone who may answer. An INTERNAL DISPATCH is never an answer: it is host-authored with no human behind it.
+ * AN @-MENTION NEVER ANSWERS: it is the seat's wake, and only an unaddressed reply answers (see {@link isAddressedMentionWake}).
+ * ONLY THE ROOM THE QUESTION IS SHOWING IN MAY ANSWER IT. The row is keyed by window token, which cannot say WHERE, so this compares the inbound wake's CONTAINER against the container the question was posted into. FAIL-SOFT in the one safe direction: a mismatch, an absent stored container and an unreadable inbound container all answer `foreign-room`, an ordinary wake with the row left in place — the cost is a question that waits longer, never a silently swallowed message.
+ */
+export async function resolveInboundAnswerRouting(
+  input: {
+    readonly internalDispatch: boolean;
+    /** `unifiedThreadRef(origin).channelKey` for the INBOUND wake, or `undefined` where the caller
+     *  could not derive one. `undefined` never answers — see the fail-soft note above. */
+    readonly containerKey?: string;
+    /** WHAT THE PERSON TYPED — the trigger message BODY, never the rendered wake the caller was
+     *  handed (`channels/wake-envelope.ts` `triggerMessageBody`; see the caller's own note in
+     *  `channels/unified.ts`). Read ONLY to select an approval's option id; a question's answer is
+     *  the delivery itself and this decision never inspects it.
+     *  Absent ⇒ the caller could not name one author's words — a non-text delivery, or a COALESCED
+     *  one carrying several envelopes. That selects no option and settles no approval, which is the
+     *  fail-closed direction: an approval must never be decided by text somebody else wrote. */
+    readonly text?: string;
+    /** The trigger @-mentions the agent outside a DM — {@link isAddressedMentionWake}. */
+    readonly addressedMention?: boolean;
+  },
+  deps: InboundAnswerDeps,
+): Promise<InboundAnswerRouting> {
+  if (input.internalDispatch) return { kind: "wake", reason: "internal-dispatch" };
+  const outstanding = await deps.read();
+  if (outstanding === undefined) return { kind: "wake", reason: "no-question" };
+  // 🔴 AN @-MENTION IS THE SEAT'S WAKE, NEVER A WORKER'S ANSWER (OPE-2116). A person who names the
+  // agent is addressing the seat, and a new ask in the question's room was swallowed as the worker's
+  // answer while the seat never heard it. It runs BEFORE the room comparison and the admission: it
+  // spends no admission call and writes no refusal row. The row is LEFT IN PLACE, so a plain reply
+  // can still answer — for an ask_question and an approval alike.
+  if (input.addressedMention === true) return { kind: "wake", reason: "addressed-mention" };
+  // The room comparison runs BEFORE the admission: a message from another room is not this
+  // question's business at all, so it must not spend an admission call or write a refusal row
+  // against a person who was never answering anything.
+  const asked = outstanding.containerKey;
+  const here = input.containerKey;
+  if (asked === undefined || asked.length === 0 || here === undefined || here.length === 0 || asked !== here) {
+    return { kind: "wake", reason: "foreign-room" };
+  }
+  // 🔴 AN APPROVAL IS ONLY ANSWERED BY A REPLY THAT NAMES AN OPTION, and this runs BEFORE the
+  // admission for the same reason the room comparison does: a message that settles nothing is not
+  // this question's business, so it must not spend an admission call or write a refusal row against
+  // a person who was not answering. An unmatched reply LEAVES THE ROW IN PLACE and falls through to
+  // an ordinary wake, so the room can try again — the module's standing "a refusal is not a drop"
+  // posture. The alternative is what shipped before: the reply went to eve as bare text, eve read no
+  // `optionId`, and `resolveApprovalOutcome` answered `invalid`, which DENIES the tool call and
+  // consumes the row. An off-topic message could therefore deny a governed connector write, and no
+  // reply at all could approve one.
+  const optionIds = outstanding.optionIds;
+  let optionId: string | undefined;
+  if (optionIds !== undefined && optionIds.length > 0) {
+    optionId = resolveApprovalOptionId(input.text ?? "", optionIds);
+    if (optionId === undefined) return { kind: "wake", reason: "unmatched-option" };
+  }
+  const verdict = await deps.admit();
+  if (!verdict.ok) return { kind: "wake", reason: "refused" };
+  return {
+    kind: "answer",
+    requestId: outstanding.requestId,
+    floor: verdict.floor,
+    ...(outstanding.wakeId !== undefined ? { wakeId: outstanding.wakeId } : {}),
+    ...(outstanding.taskId !== undefined ? { taskId: outstanding.taskId } : {}),
+    ...(optionId !== undefined ? { optionId } : {}),
+  };
+}