@open-everywhere/core 0.1.0

package/agent/channels/reply-post.ts

@@ -0,0 +1,502 @@
+// reply-post — the cross-surface post spine for the `reply` tool. Posting is decoupled from turn-completion: a reply posts mid-turn and returns the message id, and each post is recorded in the own-post ledger as it leaves, which is the fence `edit_reply` later checks. An edit adds no message to the room, so this spine stays the only way a NEW message gets there.
+// THE TARGET COMES FROM THE SESSION'S OWN BINDING, resolved from the per-delivery auth attributes and NEVER from model input, so `reply` can only post into the conversation it was woken for. Which surfaces can post mid-turn is the capability manifest's own answer — uniform verbs, honest availability — so a surface with no arm never sees the tool at all rather than one that throws when called. The per-provider posting lives in the post-arms registry, so this spine holds no vendor imports of its own.
+
+import { attestedFireCreatorId, authPrincipalId, bindFrom, currentTurnId, type BindableContext } from "../identity/binding.js";
+import { capabilitiesForPlatform } from "../identity/capabilities.js";
+import { appendAudit } from "../audit/audit.js";
+import { swallowRoomPost } from "./egress-spoof.js";
+import { postArm } from "./post-arms.js";
+import { outboundKey, postOnce } from "../operational/post-once.js";
+import { withReplierPrefix, truncateMemoryCitationPaths, type ReplierLabel } from "./turn-delivery.js";
+import { recordOwnPost } from "./own-post-ledger.js";
+import { resolvePartition } from "../memory/partition.js";
+import type { EditLocus } from "./reply-edit.js";
+import { platformFailureClass, platformFailureStatus, type PlatformFailureClass } from "./platform-failure.js";
+import { recordPostTail } from "./session-tail-record.js";
+import { markWakeRefusedThisTurn } from "./reply-signal.js";
+import { applyReplyProvenance, auditReplyProvenance } from "./reply-provenance.js";
+import { auditWithheldMemoryClaim, guardMemoryClaims } from "./memory-claim-guard.js";
+import { auditWithheldApprovalClaim, guardApprovalClaims } from "./approval-claim-guard.js";
+import { auditWithheldRequestClaim, guardRequestClaims } from "./request-claim-guard.js";
+
+export type { ReplierLabel };
+
+/**
+ * The resolved place a reply posts — a discriminated union over the surfaces with a wired mid-turn post primitive.
+ * Every field is resolved from the SESSION BINDING, never from model input.
+ */
+export type ReplyTarget =
+  | { readonly platform: "slack"; readonly channelId: string; readonly threadTs?: string }
+  | { readonly platform: "discord"; readonly channelId: string }
+  // `pageId` / `workspaceId` are CONTEXT, never the post target (the post target is the discussion).
+  // They exist so the Notion arm can resolve WHICH integration serves this page — a domain that
+  // binds its own Notion credential replies under it (OPE-467, channels/notion-credentials.ts).
+  | {
+      readonly platform: "notion";
+      readonly discussionId: string;
+      readonly pageId?: string;
+      readonly workspaceId?: string;
+      /** The Notion integration the DELIVERY that woke this turn was verified under (OPE-467),
+       *  carried on the binding target so the reply posts under the credential that fetched.
+       *  Absent ⇒ the arm falls back to the replied-to page's domain binding. */
+      readonly credentialId?: string;
+    }
+  | { readonly platform: "teams"; readonly serviceUrl: string; readonly conversationId: string; readonly replyToActivityId?: string }
+  // Linear has TWO honest post routes, and a session picks by what it actually holds: a NATIVE @mention session posts a `response` onto its agent session, while an AMBIENT container-supervisor turn holds no agent session and posts a workspace-token comment into the trigger's own thread. Both are real replies into the same issue.
+  // `organizationId` is the WORKSPACE the wake came from: an access token is workspace-scoped, so the arm resolves the credential for THIS organization. Absent means the unchanged primary chain, which is what a single-workspace deployment always gets.
+  | { readonly platform: "linear"; readonly agentSessionId: string; readonly organizationId?: string }
+  | { readonly platform: "linear"; readonly issueId: string; readonly parentId?: string; readonly organizationId?: string }
+  // GitHub posts an issue/PR-timeline comment under a short-lived, repo-scoped `issues:write`
+  // installation token the arm mints itself (OPE-811). `installationId` rides the delivery auth when
+  // the webhook carried one; absent, the arm resolves it from the owner→installation map.
+  | { readonly platform: "github"; readonly owner: string; readonly repo: string; readonly issueNumber: number; readonly installationId?: number };
+
+/**
+ * Resolve the reply target from a tool ctx, or null when this surface cannot host `reply`, or the post anchor cannot be resolved.
+ * The dynamic gate already hides the tool where the surface cannot post; this is the execute-time belt-and-braces, and what makes the decision unit-testable.
+ */
+export function resolveReplyTarget(ctx: BindableContext): ReplyTarget | null {
+  // THE PLATFORM COMES FROM THE BINDING, NOT FROM `ctx.channel`: a TOOL-EXECUTE context carries no channel object at all, so a channel-derived platform answered `undefined` on every call and this returned null before it ever read the binding — the per-surface `reply` then threw on every native session.
+  // `bindFrom` is the read that already owns the identity-less case, and the read the TARGET below already used, so this is ONE binding for both halves rather than a second, structurally-empty channel. Fail-closed is unchanged: a context the binding cannot place registers no manifest and no arm, so this still returns null.
+  const binding = bindFrom(ctx);
+  const platform = binding.platform;
+  if (!capabilitiesForPlatform(platform).midTurnPost) return null;
+  // No mid-turn post arm for this platform ⇒ an honest "can't post here" (belt-and-braces: the
+  // midTurnPost gate above already filters these, matching the old switch's `default: return null`).
+  const arm = postArm(platform);
+  if (!arm?.resolveTarget) return null;
+  const t = binding.target;
+  // Every locus below comes from the binding's post-back target — the per-delivery auth the surface stowed, NEVER a tool argument — so `reply` can only post into the conversation it was woken for.
+  // The narrowers treat an absent or blank value as unresolved, which yields an honest "cannot post here" rather than a post to the wrong place. The spine owns the binding read; the arm turns these narrowed fields into its own target shape.
+  const str = (k: string): string | undefined => (typeof t?.[k] === "string" && (t[k] as string).length > 0 ? (t[k] as string) : undefined);
+  const num = (k: string): number | undefined => (typeof t?.[k] === "number" ? (t[k] as number) : undefined);
+  return arm.resolveTarget({ str, num, threadTs: binding.threadTs, ctx });
+}
+
+/**
+ * The partition and provenance a reply CHOKE POINT stamps onto its canonical `reply.post` row. The caller supplies it and the choke point OWNS writing the row, so there is exactly ONE row per byte-leaving post no matter which route initiated it.
+ * Taint-clean: only ids, counts and routes reach the detail — never message text.
+ */
+export interface ReplyAudit {
+  readonly org: string;
+  /**
+   * The turn's PARTITION platform. {@link replyAuditFor} reads it from the turn's own binding, so a reply carries the REAL surface even on a windowed seat. NO product path stamps `"unified"` here: the one struct that did was the addressed-prose bridge's, and that route is deleted (OPE-1982).
+   * What it still files is this plane's HOST-VERDICT rows — `reply.refused`, `reply.forced`, `reply.edit.refused` — which are told no surface because nothing landed. The `"unified"` value stays LOAD-BEARING as a FLOOR rather than as a live case: `channels/reply-provenance.ts` reads that exact value as the sentinel for "these labels name the WINDOW, not a room", which is what would stop a surface-proved connector read being named in the footer of a reply posted under window labels. Never widen it to a surface name.
+   * 🔴 IT IS NOT THE `platform` COLUMN ON `reply.post`. That column names the SURFACE the reply landed on — see {@link auditReplyPost}.
+   */
+  readonly platform: string;
+  readonly workspace: string;
+  readonly surface?: string;
+  /**
+   * WHO this reply answers — the acting principal of the DELIVERY that drove the turn. Every route fills it, each from the one place its own lifecycle still holds that delivery.
+   * ABSENT means the delivery authenticated nobody: never a guess, and never another turn's principal.
+   */
+  readonly principalId?: string;
+  /**
+   * The ATTESTED CREATOR of a routine or webhook fire, when this reply answers one and the fire names a creator — NEVER the reply's author, which stays {@link principalId}.
+   * It is carried so the audit trail names the human who owns the automation without a join to the routine row. Absent on an ordinary human turn or a creator-less row: genuinely nobody to name, never a guess. The `reply`/`edit_reply` tools fill it through {@link replyAuditFor}, which is now the ONLY door that writes this row (OPE-2006) — so a fire that owes an answer names its creator exactly when it answers through the tool, and a fire that ends in closing prose posts nothing to name it on.
+   */
+  readonly creatorId?: string;
+  readonly sessionId?: string;
+  readonly wakeId?: string;
+  /**
+   * THIS turn's id. It is written to no row: it is what lets {@link auditReplyRefused} record the refusal on the TURN as well as in the log, so the unified window's dropped-prose branch can see at turn end that the host already refused this wake — which is what names the withholding on the drop row and suppresses the one corrective redrive.
+   * Carrying it here, rather than at each refusal site, keeps ONE choke point, so a future refusal that writes the row cannot forget to record the decision. Absent on a sessionless context, where the record degrades to empty and the drop reads as an ordinary one.
+   */
+  readonly turnId?: string;
+  /**
+   * WHICH DOOR CARRIED THIS ROW. ONE value since OPE-2006: the `reply`/`edit_reply` TOOL is the only way a seat's words leave a session, on every surface and every seat shape.
+   * 🔴 IT STAYS A FIELD RATHER THAN A CONSTANT, and the reason is the row and not this type. `detail.route` is written on `reply.post`, `reply.post.failed`, `reply.refused` and `reply.forced`, and an operator reading a row from before the terminal route was deleted sees `"terminal"` there. A field keeps the column meaning the same thing across that boundary; folding it away would make the old rows read as a column that no longer exists.
+   * The former second value was `"terminal"` — a chat surface's `message.completed` handler posting the model's ending text through `postTerminalProse`. That plane is deleted: a turn's closing prose is now DROPPED and audited (`channels/closing-prose-drop.ts`).
+   */
+  readonly route: "tool";
+}
+
+/**
+ * Build the reply plane's audit struct from a live tool ctx — the who and where a tool call holds. The choke point then OWNS writing the row, so there is exactly one row per event whichever verb initiated it.
+ * Shared by `reply` and `edit_reply`, so the two cannot drift into different attribution: an edit is audited with the same partition, principal, session and wake as the reply it corrects.
+ *
+ * 🔴 IT STAMPS THE FIRE'S ATTESTED CREATOR (OPE-1982). This route did not, and did not need to while the single-window prose bridge stamped it for a windowed routine fire. That bridge is deleted, so a fire on a unified window now answers through THIS door or through none — and leaving the field off here would have deleted the creator from every such row, making the human who owns the automation reachable only by a join to the routine row. It is read off the SAME ctx the principal is, it is `undefined` on an ordinary human turn, on a webhook fire and on a creator-less routine, and it never becomes the reply's author, which stays {@link principalId}.
+ */
+export function replyAuditFor(ctx: BindableContext, route: ReplyAudit["route"], wakeId?: string): ReplyAudit {
+  const p = resolvePartition(ctx);
+  const sessionId = (ctx as { session?: { id?: string } }).session?.id;
+  const turnId = currentTurnId(ctx);
+  const creatorId = attestedFireCreatorId(ctx);
+  return {
+    org: p.org,
+    platform: p.platform,
+    workspace: p.workspace,
+    surface: p.surface,
+    // 🔴 ON AN ATTESTED FIRE, THE DELIVERY'S OWN AUTH PRINCIPAL; EVERYWHERE ELSE, THE BINDING'S
+    // (OPE-1982). The two reads disagree on a fire: the binding resolves the attested CREATOR,
+    // because that is whose standing the turn acts with, while the actor a fired turn SPEAKS AS is
+    // the schedule principal (`eve:app`) — the invariant {@link attestedFireCreatorId}'s own
+    // docstring states, and the one the native chat terminal arms hold by snapshotting it at
+    // `turn.started`. The deleted prose bridge read `authPrincipalId` for exactly that reason; with
+    // that route gone this door is the only one a windowed fire's reply takes, so the derivation had
+    // to come with it or a fire's post would name a human as its author.
+    // 🔴 IT IS GATED ON THE CREATOR STAMP, AND THAT GATE IS THE POINT. `bindFrom` deliberately does
+    // not take the live auth verbatim on several ctx shapes — Slack collapses eve's composite
+    // `slack:<team>:<user>` AuthKey to the raw user id on a post-approval resume step
+    // (`slack-identity.ts` `rawSlackPrincipal`), and a subagent child's bind reads its dispatch
+    // snapshot rather than the live slot. Preferring the auth slot on every reply would write a
+    // SECOND spelling of the same person into `who`, which is hashed, so every principal-filtered
+    // query and every join to the rest of that turn's rows would split. A ctx with no creator stamp
+    // therefore keeps exactly the read it had before this ticket.
+    principalId: creatorId !== undefined ? (authPrincipalId(ctx) ?? bindFrom(ctx).principalId) : bindFrom(ctx).principalId,
+    ...(creatorId ? { creatorId } : {}),
+    ...(sessionId ? { sessionId } : {}),
+    ...(wakeId ? { wakeId } : {}),
+    ...(turnId ? { turnId } : {}),
+    route,
+  };
+}
+
+/**
+ * Does this reply body carry an ANSWER at all, or is it a stub a reader gets nothing out of? PURE, and the ONE test the unified window's DROP ROW (`channels/unified.ts`) and the e2e content gates share, so a turn the log calls answer-less and a turn a gate grades as answer-less are the same turn.
+ *
+ * 🔴 IT GATES NO DELIVERY, AND THAT IS WORTH SAYING OUT LOUD. It once decided whether the addressed-prose bridge would post; that route is deleted (OPE-1982), so the one in-product reader left LABELS the drop row — `reason: "no-substance"` — and the e2e gates ask the same question from the other side. It is not on the `reply` TOOL route either: a model that calls `reply("...")` still posts it and still spends the wake, because there the model chose to post and is still choosing what to say, so a host refusal reaches it and can steer it. A floor at the choke point would be refusing a call the model could have made honestly, which is a different ticket's argument to make. It lives HERE, beside the choke point, because it is a reply-plane rule and the next route to need it should find it without re-deriving it.
+ *
+ * 🔴 IT IS NOT A LENGTH TEST, AND IT MUST NEVER BECOME ONE. A correct answer here is routinely three characters — `144`, `81`, `no` — so a floor on `chars` strikes the shortest RIGHT answers this deployment gives. S11's own note records the same finding from the gate side: the interim it had to step past ran 194 characters, and a bar wide enough to catch it swallows real short answers too.
+ * The test is instead the weakest one that still separates the two: a body carries substance when at least one LETTER OR DIGIT survives once emoji shortcodes are stripped. `144` passes; `...`, `…`, `👍` and `:+1:` do not.
+ *
+ * WHY THE DISTINCTION EARNS A FIELD (OPE-1911): a turn that trailed off on `...` and a turn that wrote a real answer nobody received are different failures, and the canonical rows carry `chars` rather than whether anything was said. Measured on ship #216, J-ENGAGED-slack: a three-character closing text reached the room and every reader downstream graded it as the answer.
+ *
+ * 🔴 DELIBERATELY NOT A POINTER TEST. "Answered in the comments." is a pointer rather than an answer, and this predicate calls it substantive, because the host cannot grade whether prose answers a question without reading the question — the same line {@link guardMemoryClaims} holds about a durability claim. What separates a pointer from the answer is the turn's own `done` intent, which only the `reply` tool carries.
+ */
+export function replyCarriesSubstance(body: string): boolean {
+  // Emoji SHORTCODES first (`:+1:`, `:white_check_mark:`), whose letters would otherwise read as
+  // content; then any Unicode letter or digit, which is what a reader can actually read.
+  return /[\p{L}\p{N}]/u.test(body.replace(/:[a-z0-9_+-]+:/gi, " "));
+}
+
+/**
+ * Write the ONE canonical `reply.post` row at the choke point — best-effort, never throws, and never fails the post; a no-op when the caller passed no audit struct.
+ * The detail is taint-clean, and the `reply.post` action NAME is load-bearing — the eval scorers join on it — so it never changes.
+ *
+ * 🔴 THE `platform` COLUMN NAMES THE SURFACE THE REPLY LANDED ON, never the route that carried it (OPE-1745). It is the `platform` ARGUMENT — the surface the arm posted to — and NOT {@link ReplyAudit.platform}, which is the turn's partition.
+ * The two agree on the one route this plane carries, `tool`. The rule is stated rather than assumed because a struct whose labels name a WINDOW makes them disagree, and such a reply then drops out of every operator query and gate that filters `reply.post` by platform. Measured on deploy #201, when the deleted bridge route was one: a Linear reply rowed as `platform: "unified"` with `detail.platform: "linear"`, and the e2e driver's `actions=reply.post&platform=linear` gate saw nothing for 60 s while the row sat there.
+ * NOTHING IS LOST: `detail.route` still says how the reply was posted. The column answers "where did it land", the detail answers "which door did it take".
+ */
+export async function auditReplyPost(audit: ReplyAudit | undefined, id: string, platform: string, chars: number): Promise<void> {
+  if (!audit) return;
+  await appendAudit({
+    org: audit.org,
+    platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: "reply.post",
+    detail: {
+      id,
+      platform,
+      chars,
+      route: audit.route,
+      ...(audit.creatorId ? { creatorId: audit.creatorId } : {}),
+      ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * Ceiling on the model-authored wake string that reaches an audit `detail`. The input has no upper bound of its own, and the refusal row is the ONE place a rejected — that is, possibly attacker-suggested — value gets durably written.
+ * The answerable-reply fence already refuses anything over this length outright, so nothing legitimate is ever cut here.
+ */
+const REFUSED_WAKE_MAX = 200;
+
+/**
+ * `detail.reason` on a `reply.post.failed` row — the host cleared the post and the PLATFORM rejected
+ * it. ONE greppable string, the post-side twin of `reply.edit.refused`'s `platform-error`.
+ */
+const POST_PLATFORM_ERROR_REASON = "platform-error";
+
+/**
+ * Write the `reply.post.failed` row — a post that reached the transport and did not land. It has its OWN action because `reply.post` is the row the eval scorers join on to count DELIVERED messages, so a failure must never appear in it, and `reply.refused` is the host-verdict detective row, whose count would stop meaning what it means.
+ * `detail.failure` is the CLASS the spine acted on, which lets an operator count a definitive refusal apart from an ambiguous one; `detail.status` is the platform's HTTP status when the arm attached one — a number, never a response body. Best-effort and taint-clean, like every row on this path.
+ * 🔴 Its `platform` COLUMN names the SURFACE the post failed on, for the same reason and from the same argument as {@link auditReplyPost}'s: "how many replies failed to reach Linear" is a platform-filtered count, and a failure filed under a window label rather than the surface drops out of it.
+ */
+async function auditReplyPostFailed(
+  audit: ReplyAudit | undefined,
+  platform: string,
+  failure: PlatformFailureClass,
+  status?: number,
+): Promise<void> {
+  if (!audit) return;
+  await appendAudit({
+    org: audit.org,
+    platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: "reply.post.failed",
+    detail: {
+      reason: POST_PLATFORM_ERROR_REASON,
+      platform,
+      failure,
+      route: audit.route,
+      ...(status !== undefined ? { status } : {}),
+      ...(audit.wakeId ? { wakeId: audit.wakeId.slice(0, REFUSED_WAKE_MAX) } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * What BOTH post choke points do with a thrown dispatch: classify it, write the one `reply.post.failed` row, and hand the class back. The caller re-throws the ORIGINAL error, so the model still reads the arm's own token-free copy.
+ * It is one function for the reason {@link recordLandedPost} is: the per-surface spine and the unified spine drifted before, and a third choke point must get this or nothing.
+ */
+export async function notePostFailure(audit: ReplyAudit | undefined, err: unknown, platform: string): Promise<void> {
+  await auditReplyPostFailed(audit, platform, platformFailureClass(err), platformFailureStatus(err));
+}
+
+/**
+ * Should a failed post give its dedupe claim back? THE DEFINITIVE CASE MUST RELEASE: the claim is mark-then-run, so a post that threw already holds its key, and the model's most likely retry is the SAME text — without a release that retry is answered with the dedupe sentinel, `reply` reports posted, and the wake is marked ANSWERED for a message nobody ever received.
+ * THE AMBIGUOUS CASE MUST NOT: the post may already be in the room, and the claim is the only thing stopping an identical retry from saying it twice. The turn stays OPEN either way, since no mark lands, so the class decides only whether an identical retry inside the window reaches the platform.
+ */
+export const releasePostKeyOnFailure = (err: unknown): boolean => platformFailureClass(err) === "definitive";
+
+/**
+ * Write a `reply.refused` row — the DETECTIVE half of the wake-decoy bound, and a deliberate carve-out from the actions-only posture: the SYMPTOM of this failure is the ABSENCE of rows, so a refused reply is otherwise indistinguishable from a turn that judged silence warranted. It also turns "the blast radius is bounded to availability" from reasoning into evidence an operator can count.
+ * IT ALSO RECORDS THE DECISION ON THE TURN, not only in the log. A refusal leaves the reply tool having posted nothing, which is the exact state the unified window's dropped-prose branch reads, so without this mark the log cannot say the host withheld that answer and the corrective redrive would nudge the model back towards the call the host had just refused. This is the ONE choke point every refusal row goes through, so recording here is what makes a future refusal site unable to forget. It never throws, and runs BEFORE the row.
+ */
+export async function auditReplyRefused(audit: ReplyAudit | undefined, reason: string): Promise<void> {
+  if (!audit) return;
+  markWakeRefusedThisTurn(audit.turnId, audit.wakeId, reason);
+  await appendAudit({
+    org: audit.org,
+    platform: audit.platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: "reply.refused",
+    detail: {
+      reason,
+      route: audit.route,
+      ...(audit.wakeId ? { wakeId: audit.wakeId.slice(0, REFUSED_WAKE_MAX) } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * Write a `reply.forced` row — the model OVERRODE a host verdict on the reply path and posted anyway.
+ * It has its own action rather than a flag on the post row next door, because an override is a different EVENT: it is the one place the reply path lets the model decide against the host, so an operator must be able to COUNT it without joining and filtering the whole post stream. It pairs with `reply.refused`, and the post still writes its own `reply.post` row beside it, never instead of it.
+ */
+export async function auditReplyForced(audit: ReplyAudit | undefined, reason: string): Promise<void> {
+  if (!audit) return;
+  await appendAudit({
+    org: audit.org,
+    platform: audit.platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: "reply.forced",
+    detail: {
+      reason,
+      route: audit.route,
+      ...(audit.wakeId ? { wakeId: audit.wakeId.slice(0, REFUSED_WAKE_MAX) } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * The (channel, threadTs) pair a reply's DEDUPE key hashes on — it mirrors {@link ReplyTarget}'s discriminated union field for field.
+ * Used only to build the idempotency key below; never a post target itself.
+ */
+function replyDedupeLocus(target: ReplyTarget): { channel: string; threadTs?: string } {
+  switch (target.platform) {
+    case "slack":
+      return { channel: target.channelId, threadTs: target.threadTs };
+    case "discord":
+      return { channel: target.channelId };
+    case "notion":
+      return { channel: target.discussionId };
+    case "teams":
+      return { channel: `${target.serviceUrl}::${target.conversationId}`, threadTs: target.replyToActivityId };
+    case "linear":
+      // Two Linear routes, two dedupe loci (OPE-811): the agent-session route keys on the session,
+      // the ambient route on the issue + the thread root it replies under. Never collapse them —
+      // an ambient repost and a mention repost are different posts into different places.
+      return "agentSessionId" in target ? { channel: target.agentSessionId } : { channel: target.issueId, threadTs: target.parentId };
+    case "github":
+      return { channel: `${target.owner}/${target.repo}`, threadTs: `#${target.issueNumber}` };
+    default:
+      // A platform outside the typed union — a test fake or an out-of-tree arm registered via
+      // registerPostArm. The registry seam deliberately accepts those, so the key builder must be
+      // total: dedupe keys on the whole serialized target instead of crashing the post.
+      return { channel: JSON.stringify(target) };
+  }
+}
+
+/**
+ * Sentinel `id` the choke points return when a byte-identical repost was suppressed within the dedupe window — never a real platform message id, so a caller must not treat it as one to query.
+ * The genuine post's own `reply.post` row is the durable record; a suppressed repost writes NO second row, because no second post actually happened.
+ */
+export const REPLY_DEDUPE_SKIPPED_ID = "deduped:reply";
+
+/**
+ * WHAT EVERY LANDED REPLY OWES, in one place — called by BOTH choke points from inside their dedupe run, right after the platform returned the message id. It is ONE function because two call sites DRIFTED before: a standing seat on a cross-surface window replies through the other choke point, so every post it made was recorded nowhere and the next generation inherited a tail of questions with no answers. A third choke point can now only get both or neither.
+ * The two records answer different questions about the same post: the LEDGER says "this message is ours, and here is how to edit it", and the RING says "this is what was said here", which the next generation inherits. Both are best-effort and neither throws, and a `null` edit locus skips only the ledger write, because the two are independent facts.
+ */
+export async function recordLandedPost(input: {
+  readonly org: string | undefined;
+  readonly editLocus: EditLocus | null;
+  readonly messageId: string;
+  readonly body: string;
+  readonly platform: string;
+  /** The wake this post ANSWERED, where the choke point holds one (OPE-905). Both callers read it
+   *  off the same `ReplyAudit` they already pass `org` from. */
+  readonly wake?: string | undefined;
+}): Promise<void> {
+  if (input.editLocus) await recordOwnPost(input.org, input.editLocus, input.messageId);
+  // `messageId` THREADS THROUGH: a post row without it can never be found by a later confirmed `edit_reply`, which is the whole precondition the ring-rewrite rests on.
+  // `wake` threads through the same way, and 🔴 the cost of losing it is now the WHOLE gate, not a softer verdict (OPE-1528): a row without it is one the should-be-edit policy cannot tell apart from an answer to a different question, so it is never a fold target at all.
+  await recordPostTail({
+    text: input.body,
+    at: new Date().toISOString(),
+    platform: input.platform,
+    id: input.messageId,
+    ...(input.wake ? { wake: input.wake } : {}),
+  });
+}
+
+/**
+ * Post a NEW message into the session's conversation and return its id — the audit and output anchor. This NOTIFIES: it is a real reply, and it throws an honest, token-free error if the post did not land, so the model reads the failure and can call again. There is NO fallback to the turn's closing text (OPE-2006): that text is dropped on every seat, so a post that did not land is an answer that did not leave.
+ * THE CHOKE POINT: the single canonical `reply.post` row is written HERE, immediately after the platform returns the id — audit where the bytes leave — and it lands even under the egress spoof, because the eval targets score from the row. It is also IDEMPOTENT across a step re-run or a genuine double call, keyed on the target and the text: two distinct tool invocations with the same wake and the same bytes are something nothing upstream of this seam could catch.
+ */
+/**
+ * `replier` marks THIS reply as a worker or delegated turn's, and is present only for a task-grain session. A surface that can vary its per-message display name passes it straight through to its arm, unchanged.
+ * Every other surface gets the shared bracket prefix baked into the posted BODY ONCE, here at the choke point, before dedupe-keying and dispatch — so the prefix is part of the idempotency key too, and a worker reply and a supervisor reply with the same underlying text are correctly different posts.
+ */
+export async function postReply(target: ReplyTarget, text: string, audit?: ReplyAudit, replier?: ReplierLabel): Promise<string> {
+  // OPE-916: truncate any memory citation down to its silo-relative path BEFORE the replier
+  // prefix / dedupe key / audit chars are computed, so every downstream reader (the dispatched
+  // arm, the audit row, the dedupe hash) sees the same, member-safe text.
+  // OPE-1608: the connector footer joins it here for the same reason — one place where the bytes a
+  // room will see are settled. It is BYTE-EXACTLY the model's text on every turn that read no
+  // connector, which is every turn OPE-1516's silence is about.
+  const claimGuard = guardMemoryClaims(truncateMemoryCitationPaths(text), audit);
+  // OPE-1876: and the no-approval claim, on the same body, at the same choke point — a door that
+  // struck one and posted the other would read as a rendering glitch.
+  const approvalGuard = guardApprovalClaims(claimGuard.body, audit);
+  // OPE-2022: and the propose claim, on the same body, at the same choke point. A seat may not say
+  // it submitted a request the host never saw the propose plane make.
+  const requestGuard = guardRequestClaims(approvalGuard.body, audit);
+  const provenance = applyReplyProvenance(requestGuard.body, audit);
+  const clean = provenance.body;
+  const arm = postArm(target.platform);
+  const nativeReplier = arm?.displayNameCapable ? replier : undefined;
+  const body = replier && !arm?.displayNameCapable ? withReplierPrefix(clean, replier) : clean;
+  const locus = replyDedupeLocus(target);
+  // stableId = wakeId: the incident this wrap closes was a double post WITHIN one wake; two
+  // legitimate replies with identical bytes on DIFFERENT wakes (templated refusals are routinely
+  // byte-identical) must never collide, even inside the short TTL.
+  const key = outboundKey({
+    surface: target.platform,
+    channel: locus.channel,
+    threadTs: locus.threadTs,
+    action: "reply.dispatch",
+    stableId: audit?.wakeId,
+    payload: body,
+  });
+  const id = await postOnce({
+    org: audit?.org,
+    key,
+    run: async () => {
+      let realId: string;
+      try {
+        realId = await dispatchReply(target, body, nativeReplier);
+      } catch (err) {
+        // OPE-821 — the failed post leaves ONE row carrying its CLASS, then the original error
+        // re-throws untouched so the model reads the arm's own copy. See `notePostFailure`.
+        await notePostFailure(audit, err, target.platform);
+        throw err;
+      }
+      await auditReplyPost(audit, realId, target.platform, body.length);
+      // OPE-1608 STORE-FIRST: the row records the FULL source list, including what the reach rule
+      // withheld from this room, so "what did this reply draw on" stays answerable after the render
+      // changes. A turn that read nothing writes no row.
+      await auditReplyProvenance(audit, realId, target.platform, provenance.reads, provenance.shown);
+      await auditWithheldMemoryClaim(audit, target.platform, claimGuard.withheld);
+      await auditWithheldApprovalClaim(audit, target.platform, approvalGuard.withheld, approvalGuard.cause);
+      await auditWithheldRequestClaim(audit, target.platform, requestGuard.withheld);
+      await recordLandedPost({
+        org: audit?.org,
+        editLocus: replyEditLocus(target),
+        messageId: realId,
+        body,
+        platform: target.platform,
+        wake: audit?.wakeId,
+      });
+      return realId;
+    },
+    // A DEFINITIVE failure gives the dedupe claim back, so an identical retry really posts; an
+    // AMBIGUOUS one keeps it, so an identical retry cannot double-post. See its own note.
+    releaseKeyOnFailure: releasePostKeyOnFailure,
+    skipped: () => REPLY_DEDUPE_SKIPPED_ID,
+  });
+  return id ?? REPLY_DEDUPE_SKIPPED_ID;
+}
+
+/**
+ * Post a HOST-AUTHORED notice — never a `reply.post` row, by construction. It is {@link postReply} with the audit parameter REMOVED FROM THE SIGNATURE, not merely omitted at the call site.
+ * Exporting the bare function to a provider bundle would hand every provider channel a way to post a MODEL's actual answer with no row, silently breaking the "one canonical `reply.post` per byte-leaving post" invariant and the eval scorers' join on that action. A caller that cannot pass an audit struct cannot make that mistake.
+ */
+export async function postHostNotice(target: ReplyTarget, text: string): Promise<string> {
+  return await postReply(target, text);
+}
+
+/**
+ * The {@link EditLocus} for a resolved per-surface {@link ReplyTarget} — the host-resolved half of `edit_reply`'s address, and the key the own-post ledger records under.
+ * Deliberately NOT {@link replyDedupeLocus}, though both read the same union: that one builds a DEDUPE key, so it may composite fields freely, while an edit locus is an ADDRESS an arm dispatches on. PURE, and the ONE definition both the ledger write and the edit read use, so a message can only be edited at the address it was posted to. `null` for a surface with no editable address.
+ */
+export function replyEditLocus(target: ReplyTarget): EditLocus | null {
+  switch (target.platform) {
+    case "slack":
+      // chat.update addresses (channel, ts) — the thread anchor is not part of it.
+      return { platform: "slack", channelId: target.channelId };
+    case "discord":
+      // A Discord thread IS its own channel id, so this is already the message's own channel.
+      return { platform: "discord", channelId: target.channelId };
+    case "teams":
+      return { platform: "teams", channelId: target.conversationId, serviceUrl: target.serviceUrl };
+    case "github":
+      // OPE-862: the composite "owner/repo" string github-post-arm.ts's editMessage parses back
+      // apart — the SAME shape replyDedupeLocus already builds for this platform's dedupe key, so
+      // this is not a new address grammar, just a second reader of one already in use.
+      return { platform: "github", channelId: `${target.owner}/${target.repo}` };
+    case "linear":
+      // ONLY the AMBIENT route has an editable address: a created comment is a real `Comment`, so an update mutation can rewrite it.
+      // A MENTION reply posts an Agent Activity instead, and the live schema has no mutation that updates one at all — a PLATFORM LIMIT, not a not-yet, so this branch returns `null` on purpose.
+      return "agentSessionId" in target
+        ? null
+        : { platform: "linear", channelId: target.issueId, ...(target.organizationId ? { organizationId: target.organizationId } : {}) };
+    case "notion":
+      // The address is the SAME `<workspace>/<page>` conversation key the surface's own message-ops module composes, inlined here rather than imported, because this file holds no vendor imports.
+      // Those two fields are CONTEXT-only on the target, so a target minted before they were stamped, or a row with neither, has no credential to resolve — `null`, the same "no editable address" every other case already handles.
+      return target.workspaceId && target.pageId
+        ? { platform: "notion", channelId: `${target.workspaceId}/${target.pageId}` }
+        : null;
+    default:
+      // THE POST-ARM REGISTRY IS OPEN AND THIS SWITCH IS NOT, so a new surface takes TWO edits: an `editMessage` member on its arm, and a case here saying what its address looks like.
+      // Registering only the arm leaves the verb permanently refused rather than broken — the honest direction, but a silent one, so it is stated here rather than discovered.
+      return null;
+  }
+}
+
+async function dispatchReply(target: ReplyTarget, text: string, replier?: ReplierLabel): Promise<string> {
+  // LOCAL EVAL SPOOF — the shared exit, which owns the flag read, the Vercel refusal and the swallow log for every room post this host makes.
+  // It stays SPINE-level, before the registry lookup, so no arm can ever be reached with real credentials on a spoofed run.
+  const swallowed = swallowRoomPost(`a ${target.platform} reply (${text.length}c)`, target.platform);
+  if (swallowed !== undefined) return swallowed;
+  // Dispatch by platform key through the post-arms registry; every wired surface's mid-turn post primitive lives in its own per-provider arm.
+  // An unregistered platform, or one with no mid-turn arm, fails LOUD rather than silently mis-posting.
+  const arm = postArm(target.platform);
+  if (!arm?.dispatchReply) {
+    throw new Error(`reply couldn't post — no mid-turn post arm registered for "${target.platform}".`);
+  }
+  return arm.dispatchReply(target, text, replier);
+}