@open-everywhere/core 0.1.0

package/agent/channels/reply-provenance.ts

@@ -0,0 +1,804 @@
+// REPLY PROVENANCE (OPE-1608) — WHICH CONNECTORS A TURN READ TO PRODUCE THIS REPLY.
+//
+// A reply that read three Notion pages, a Linear issue and a GitHub pull request used to carry no
+// trace of that to the reader. Memory citations were the only provenance a room ever saw
+// (`turn-delivery.ts` truncateMemoryCitationPaths), and they say nothing about the connector plane.
+// This module adds the second half: the connectors the turn READ, recorded as a durable row and
+// rendered as a compact footer at the same reply choke points the citation render already runs at.
+//
+// 🔴 THE SOURCE IS THE HOST'S OBSERVATION, NEVER THE MODEL'S SELF-REPORT. Every entry originates at
+// `hooks/connector-audit.ts`, from eve's `action.result` event — the same seam that writes the
+// `connector.op` audit row, on the same call, for the same op. Three doors reach the ledger from
+// there and none weakens that: `channels/read-reach.ts` for a first-party read tool, which records
+// what the HOST itself fetched; the same module's BORROW door, which records what a lent,
+// credential-granted tool fetched, from the mount's own execute; and
+// `channels/delegated-provenance.ts` at a delegation SETTLE, which moves entries a WORKER's own copy
+// of this seam observed into the seat's turn. A model cannot add an entry, cannot remove one, and
+// cannot make one say something the op did not do. That is the point: a model asked to list its own
+// sources may not know them and may invent them, and a fabricated source list is worse than none
+// because it reads as a receipt.
+//
+// The ledger being unforgeable is only half of it, because a model can still TYPE a footer-shaped
+// line. So the marker is RESERVED: `stripForgedFooter` strikes any line of the model's own text that
+// opens with it, on every reply, including the replies this module adds nothing to. Without that
+// strip the guarantee above would hold of the ledger and of nothing a reader can see.
+//
+// READ VERBS ONLY. A write announces itself through its own flow — a created page, a posted comment
+// — so only the `read` op tier reaches this ledger. A failed op does not reach it either: nothing
+// was read, so nothing was drawn on.
+//
+// ── 🔴 NO FOOTER IS NOT "NOTHING WAS READ". READ THIS BEFORE CITING THE ABSENCE ─────────────────
+// The footer is a POSITIVE signal only. Its absence means this ledger holds nothing for this turn,
+// and two routes reach a source without ever filling it. Neither is a defect; each is a boundary this
+// module cannot see past, and an operator who reads a bare reply as "consulted nothing" is wrong.
+//
+//   1. A CROSS-TURN edit. The ledger is turn-stamped, so an `edit_reply` on a LATER turn reads empty
+//      and re-renders without the footer the original post earned.
+//   2. A terminal reply whose channel STATE names no conversation. Every terminal-prose route that
+//      resolves a partition carries its turn id since OPE-1639, but the unidentifiable-state
+//      fallback posts through eve's raw primitive instead of this spine (channels/slack.ts), so it
+//      renders no footer and writes no row. It is the degenerate case, not a route a seat chooses.
+//
+// 🔴 A BORROWED READ IS NO LONGER ONE OF THEM (OPE-2018). A credential-grant call arrives as
+// `grant__<owner>_<connector>__<tool>`, and `hooks/connector-audit.ts` still returns on that reserved
+// namespace before either write — the connection segment of such a name is the literal string "grant"
+// and names no system. The MOUNT records the read instead, through `channels/read-reach.ts`'s borrow
+// door, with the grant row's own connection name and its PINNED target. Provenance therefore follows
+// the fetch: a reply built on a lent tool's bytes names the target that tool actually read, so a
+// misattribution in the model's prose is contradicted by a host-written line in the same message. The
+// grant plane's `grant.*` rows are unchanged and still carry both principals.
+//
+// 🔴 A DELEGATED READ IS NO LONGER A BOUNDARY IN GENERAL, AND IT IS THE ONE THAT MATTERS MOST
+// (OPE-1849). Every conversational seat is worker-only for the connector ops, so the ordinary shape
+// of a connector answer IS a delegated read — and a bare list would then describe the common case as
+// a boundary. `channels/delegated-provenance.ts` carries a worker's reads onto the delegating seat's
+// turn at the settle, so a delegated read fills THIS ledger and renders THIS footer. A missing footer
+// after a delegation is a DEFECT wherever the taint plane is on. It stays a bound in three narrower
+// places that module states in full: a `taint.mode: "off"` deployment, which writes none of the
+// dispatch rows the carriage joins through; a seat that answers on a LATER turn than the settlement;
+// and a settlement whose wake proof names another conversation, which is withheld on purpose.
+//
+// The direction is deliberate and it is one direction: this module UNDER-reports. It can fail to
+// name a source the turn really read; it can never name one the turn did not.
+//
+// ── THE REACH RULE, AND WHY IT IS THIS STRICT ───────────────────────────────────────────────────
+// Naming a source is a DISCLOSURE. "We read the acquisition planning page" tells a room that such a
+// page exists, which is a fact the room may not be entitled to even when the connector read was
+// itself legitimate. So a source is named only where the host can PROVE the reply lands in the room
+// the read was scoped to, and every other source is counted by kind alone ("in another domain").
+//
+// THE PROOF IS PER POSTURE, AND THE SEAT THAT MADE THE READ CHOOSES IT (OPE-1713). Each read carries
+// exactly ONE proof, stamped by `hooks/connector-audit.ts` at the moment the op ran, where the host
+// knows which seat it is on. A reply then applies the proof the READ carries — never the other one —
+// so a read recorded under the stronger proof can never be waved through by the weaker.
+//
+//   • PER-SURFACE SEAT — the proof is the partition SURFACE, and it is exact: the seat holds one
+//     conversation, the read and the reply resolve the same partition inside one turn, so equal
+//     surfaces mean the same room. Such a delivery carries no wake id at all (OPE-1601).
+//   • UNIFIED SEAT — the proof is the WAKE, and the surface key is deliberately NOT recorded. A
+//     unified window holds SEVERAL conversations in one turn and every one of them resolves the SAME
+//     partition off the coalesced delivery's auth stamps, so a read made for conversation A and a
+//     reply posted into conversation B compare EQUAL on the surface. Measured on base `e3626f17`,
+//     before this rule: a unified `reply` answering wake B named a read made under wake A. The wake
+//     recorded on the read is compared against the wake the reply ANSWERS — the tool's fenced `wake`
+//     argument, which since OPE-1982 is the only way a unified reply names a conversation at all.
+//     🔴 AND ONE CONVERSATION CAN HOLD TWO WAKE IDS, SO A READ MAY CARRY TWO (OPE-1869). At a
+//     delegation settlement `installTaskWake` mints the task its own wake and the turn adopts it, so
+//     the carried reads are stamped with THAT id — while the seat replies under the stamp the turn
+//     was DELIVERED with. Comparing only the first named nothing: ship #213 filed six
+//     `reply.provenance` rows, every one `named: 0` beside a settlement that had carried the reads.
+//     So {@link ConnectorRead.alsoWakeId} holds the second address and the rule below accepts
+//     EITHER. Only `channels/delegated-provenance.ts` sets it, only at that settlement, and only
+//     after `delegatedSecondAddress` reads both wake rows back and proves they resolve to the SAME
+//     conversation — an unprovable stamp is withheld, so OPE-1713 stays closed. A seat-turn read
+//     carries one address and is unchanged.
+//
+// The wake a read is stamped with is `addressedWakeThisTurn(turnId) ?? currentWakeId(ctx)` — the same
+// expression and the same ruling OPE-601 settled for the dispatch edge: the wake a turn ADDRESSES is
+// a statement the turn made, where the delivery a merge kept last is an accident. A read the host
+// can place under neither proof is counted by kind on every reply, which is the fail-closed floor.
+// 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THE PREFERENCE AND ITS RESIDUAL ARE BOTH STILL
+// LIVE (OPE-2042). eve batches adjacent queued deliveries only when their full auth contexts match,
+// and OE stamps a fresh per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying
+// deliveries on one unified window never compare equal; only the caller-less task COMPLETION COHORT
+// still folds, and it carries no `auth` at all. That closes ONE road. A turn still holds MORE THAN
+// ONE conversation without any merge: the reply fence's same-conversation and pending arms admit a
+// sibling wake, and a turn woken by an INTERNAL wake answers a conversation whose envelope is in the
+// seat's shared context — the measured 2026-08-15 case. So the residual below is REACHABLE, and is
+// stated rather than papered over for that reason.
+// `scripts/coalesced-delivery-merge-assumption-test.ts` pins the MERGE road alone.
+//
+// 🔴 THE RESIDUAL, IN BOTH ORDERINGS, STATED RATHER THAN PAPERED OVER. It exists only on a turn that
+// holds MORE THAN ONE conversation, and on such a turn it is open for the whole turn — the two
+// orderings between them leave no window where the stamp is proven:
+//
+//   • BEFORE the turn addresses anything, a read for conversation B is stamped with `currentWakeId`,
+//     which is the delivery a merge kept LAST. Answer that conversation and B's read is named there.
+//   • AFTER the turn addresses wake A, `addressedWakeThisTurn` is FIXED — first addressed wins, and
+//     it never moves again (access/dispatch-origin-signal.ts). So every later read is stamped A
+//     whichever conversation it served, and a second post to A, or an `edit_reply` on A — which
+//     re-derives the footer from the live ledger — names it into A's room.
+//
+// It is the mirror of OPE-601's own accepted residual, which states both orderings for the same
+// mechanism, and it is bounded the same way: both conversations sit inside ONE operator-vouched
+// window, and the room already learns "1 in another domain" without it. It shrinks to NOTHING on a
+// single-wake turn, which is the ordinary shape. Closing it needs a host count of the wakes one
+// delivery coalesced, which nothing records today.
+//
+// 🔴 WHAT THE RESIDUAL MAY DISCLOSE, RESTATED (OPE-2018). It was the connection NAME alone — never a
+// record, never an op argument. An AUTHORED read is unchanged and still discloses the name alone
+// there, because rule (ii) is decided against the turn's own arrival stamp. A BORROWED read may now
+// carry its record across it, and the grant is what bounds that: the sibling conversations of a
+// standing grant's window are rooms of the domain its owner tapped, so the pinned target's label
+// lands only where that owner already lends the credential. An op argument still reaches no reader.
+//
+// ── NAMING A RECORD — THE NARROW YES, AND THE TWO PROOFS IT TAKES (OPE-1714) ────────────────────
+// OPE-1713 ruled the footer names the CONNECTION alone, because a record title tells a room that
+// such a record exists. Tommy reopened exactly one door on 2026-09-11: the footer MAY name a record,
+// on the same one line, when BOTH of these hold — and it stays the connection-only line otherwise.
+//
+//   (i)  THE REPLY LANDS IN THE ROOM THE READ WAS SCOPED TO. That is the reach rule above, unchanged
+//        and applied per reply. A read this room may not even be told about can never be named by it.
+//   (ii) THE RECORD'S ID ALREADY APPEARED IN THAT ROOM. Decided at the READ, in `channels/read-reach.ts`,
+//        against the host's own wake stamps: the record is the one the turn ARRIVED on — the Linear
+//        issue the comment sits on, the Notion page the comment sits in. A room whose own subject is
+//        that record already holds its id, so naming it discloses nothing the room did not have.
+//
+// The example the header opens with is the case this still refuses: "the acquisition planning page"
+// is a page the room never named, so (ii) fails and the footer says `notion` and no more.
+//
+// 🔴 A BORROWED READ ANSWERS (ii) FROM THE GRANT ROW (OPE-2018). Its record is the target the grant
+// PINS, named by the label the REQUESTER wrote when they asked and the owner approved on their card.
+// Nothing is inferred from a wake stamp, because the grant itself answers the question: a row is
+// spendable only in the session it was minted for, or in the domain its owner tapped, so every room
+// the record can reach is a room whose seat may spend that grant. `channels/read-reach.ts`
+// `noteBorrowedRecordRead` carries the whole argument — including why the grant-use notice is a
+// SECOND disclosure rather than the premise. A grant that does not pin its tool's target, and a row
+// with no recoverable label, both carry no record at all.
+//
+// THE LINE STAYS ONE LIGHT LINE, and the record names are what pays for that. They ride INSIDE the
+// existing line as `notion (Q3 planning)`, never a second line, never a block, never a card; and when
+// the line passes {@link MAX_FOOTER_CHARS} they are the first — and the only — thing dropped.
+//
+// A CONNECTOR OP NAMES NO RECORD. eve's `action.result` hands the hook untyped JSON from a remote MCP
+// server, so naming the record it read would mean guessing at keys in third-party content, which is a
+// heuristic where this module needs a host observation. The two authored tools (`read_notion_page`,
+// `read_linear_issue`) know what they read because they fetched it, and they reach the ledger through
+// the door in `channels/read-reach.ts` — NOT by widening `isConnectorOpTool`, whose `vendor__op`
+// contract the approver chain and the taint column rely on. A BORROWED read names a record for the
+// opposite reason: its target was decided by the GRANT ROW before the call, so the host knows it
+// without reading one vendor byte.
+//
+// FAIL-SOFT, ALWAYS. Outside an eve context every function no-ops or answers "nothing read", which
+// degrades to the pre-OPE-1608 behaviour — a reply with no footer, never a failed reply. Provenance
+// is a courtesy to the reader; it is never worth losing the answer over.
+
+import { defineState } from "eve/context";
+import { appendAudit } from "../audit/audit.js";
+import type { ReplyAudit } from "./reply-post.js";
+
+/** WHICH proof a recorded read may be named by, stamped where the read happened.
+ *
+ *  🔴 IT IS EXPLICIT RATHER THAN INFERRED FROM WHICH FIELD IS SET, and that is the fence. A reply
+ *  cannot tell a unified seat from a per-surface one by itself — on the unified `reply` route the
+ *  partition resolves to the ORIGIN surface, so the reply's own fields look per-surface — so if the
+ *  surface branch were the default, ANY entry carrying a surface key would be named on a unified
+ *  reply whose partition matched, which is always. `defineState` is serialized into the session
+ *  context, so an entry written by an EARLIER DEPLOYMENT can be read back by this one; such an entry
+ *  carries no recognised proof, reads as `"none"`, and is counted by kind on every reply. */
+export type ConnectorReadProof = "surface" | "wake" | "none";
+
+/** WHICH RECORD a read pulled, as an ID AND A KIND — never its title (OPE-1714).
+ *
+ *  🔴 THE LEDGER'S "IDS AND VERBS ONLY" CONTRACT IS WHY THIS CARRIES NO NAME. A record title is the
+ *  op's OUTPUT, and the ledger is serialized into the session context, so a title stored here would
+ *  outlive the turn that read it and be readable back by a later deployment. The durable
+ *  `reply.provenance` row carries less again — connection and op names plus counts, and no record at
+ *  all — which is what keeps that row's own "ids and verbs only" contract exactly as it was. The
+ *  footer still shows a name: {@link rememberRecordName} keeps it in PROCESS MEMORY for this turn
+ *  alone, and the render resolves it there. An entry whose name has gone (a resumed session, another
+ *  process) renders as the connection name alone, which is the under-reporting direction this module
+ *  keeps everywhere else.
+ *
+ *  🔴 AN ENTRY CARRIES A RECORD ONLY WHERE THE HOST PROVED THE ROOM IS ENTITLED TO ITS NAME. That is
+ *  the second half of the disclosure rule (`channels/read-reach.ts` decides it, at the moment of the
+ *  read); the first half is the reach rule below, applied per reply. Both must hold for a name to
+ *  reach a reader. An AUTHORED read proves the room already holds the id, off the host's own wake
+ *  stamps. A BORROWED read proves it off the grant row instead: the name is the pinned target the
+ *  grant plane already discloses into that room on every call (OPE-2018). */
+export interface ConnectorReadRecord {
+  /** The record's kind — `notion-page`, `linear-issue`, `credential-grant`. A closed set owned by
+   *  `channels/read-reach.ts`, which is the only writer. */
+  readonly kind: string;
+  /** The record's id. An ID, in a ledger of ids: it is what the render keys a display name by, and
+   *  what a reader of the durable row can join back to the system it came from. */
+  readonly id: string;
+}
+
+/** One connector READ this turn made, as the `action.result` seam saw it. IDS AND VERBS ONLY — never
+ *  an op argument and never the op's output, the same contract the `connector.op` audit row keeps. */
+export interface ConnectorRead {
+  /** Which of the two keys below may name this read — see {@link ConnectorReadProof}. `"none"` means
+   *  the host could not place the read, and it is then counted by kind on every reply. */
+  readonly proof: ConnectorReadProof;
+  /** The connection the op ran under — the operator-chosen connector name (`notion`, `linear`),
+   *  which is the display name too. Never a credential id and never a record id. */
+  readonly connection: string;
+  /** The op verb (`get_page`, `list_issues`). Recorded for the durable row; the footer never shows
+   *  it, because a reader wants to know WHICH system was consulted, not which endpoint. */
+  readonly op: string;
+  /** `platform/workspace/surface` — the partition's SURFACE KEY, never the bare surface id. The reach
+   *  rule's whole input FOR A READ MADE ON A PER-SURFACE SEAT, and the reason it is the key: a bare
+   *  id (`C1`) is unique only inside one workspace on one platform, so comparing bare ids would call
+   *  two unrelated rooms the same room. NEVER set for a read made on a UNIFIED seat, where it would
+   *  name the delivery eve happened to keep rather than the conversation the read served — see the
+   *  module header. Absent means the host could not place the read, which counts as another domain. */
+  readonly surfaceKey?: string;
+  /** The wake THE TURN WAS WORKING FOR when the op ran — the reach rule's whole input for a read made
+   *  on a UNIFIED seat, where the surface proves nothing. Never set on a per-surface seat, which
+   *  carries no wake id at all (OPE-1601). Set means this read is provable ONLY by the wake: a reply
+   *  that answers another wake counts it by kind, and so does one that answers no wake. */
+  readonly wakeId?: string;
+  /** A SECOND wake id, in the SAME conversation, that may also name this read (OPE-1869).
+   *  🔴 IT EXISTS FOR ONE SHAPE ONLY: a delegated read carried onto a seat's turn at the settlement.
+   *  `installTaskWake` mints the task its OWN wake and the turn adopts it, so `hooks/spawn-taint.ts`
+   *  can prove the carriage only against that minted id ({@link wakeId}). The seat then REPLIES under
+   *  the wake the turn was delivered with — the stamp `installTaskWake` records as `inheritedWakeId`
+   *  — so the two ends named two different ids for one conversation and the reach rule below matched
+   *  neither. Ship #213 measured the whole of that: every `reply.provenance` row carried `named: 0`
+   *  with a non-zero `withheld`, on six replies whose reads the settle had already carried
+   *  (`delegation.provenance_carried … reads:4 found:4 outcome:"carried"`).
+   *  🔴 IT WIDENS NOTHING. The writer sets it only where the turn ADOPTED this task's own wake, which
+   *  is what makes the inherited stamp this same turn's own address rather than a sibling
+   *  conversation's — the OPE-1713 disclosure the `wakeProvable` guard closes. Absent is the ordinary
+   *  case: a seat-turn read has one address and sets only {@link wakeId}. */
+  readonly alsoWakeId?: string;
+  /** WHICH RECORD this read pulled — see {@link ConnectorReadRecord}. Set only by the two doors in
+   *  `channels/read-reach.ts`, and only where that module proved the room is entitled to the name:
+   *  the authored-tool door where the room ALREADY HOLDS this id, the borrow door where the name is
+   *  the grant's pinned target. A connector-op read never sets it: the `action.result` seam hands the
+   *  hook untyped vendor JSON, so the host cannot name the record such an op read without guessing
+   *  at keys in third-party content. Absent is the ordinary case and renders the connection alone. */
+  readonly record?: ConnectorReadRecord;
+}
+
+/** What the slot holds, all of it scoped to ONE eve turn.
+ *
+ *  `turn` — the turn id `reads` belongs to. A record stamped for turn A is never read for turn B, so
+ *  yesterday's sources can never be footed onto today's reply and no reset hook is needed (the same
+ *  discipline `access/pending-delegation-signal.ts` keeps, for the same `defineState`-is-durable
+ *  reason).
+ *
+ *  `reads` — the distinct connector reads this turn made. */
+interface ReplyProvenanceState {
+  readonly turn?: string;
+  readonly reads?: readonly ConnectorRead[];
+}
+
+const slot = defineState<ReplyProvenanceState>("open-everywhere.reply-provenance", () => ({}));
+
+/** How many distinct reads one turn records. A research turn reads a handful of systems; the cap only
+ *  stops a looping turn from growing the serialized container without bound. Past the cap the ledger
+ *  stops recording, so the footer UNDERSTATES rather than growing — the safe direction for a claim
+ *  about sources, and the reason the durable row carries the same truncated list the footer does. */
+const MAX_READS = 32;
+
+/** How many connectors the footer names before it stops listing. A footer is a courtesy line, not a
+ *  bibliography, and a reply trailing twenty connector names is noise. Past this the remainder is
+ *  counted, never dropped silently. */
+const MAX_NAMED = 6;
+
+/** How long the whole footer LINE may be before the record names come off it.
+ *
+ *  🔴 THE FOOTER IS ONE LIGHT LINE, AND THIS IS WHAT KEEPS IT ONE (Tommy, 2026-09-11). A connection
+ *  name is a short host-chosen word; a record title is arbitrary prose somebody typed into a page
+ *  header, and six of them turn a courtesy line into a paragraph a cross-surface UI cannot hide. So
+ *  the line has a budget, and {@link renderProvenanceFooter} spends it on the connection names FIRST.
+ *  The budget never drops a connection name, an overflow count or an other-domain count — a record
+ *  name is the first and the only thing it takes off. */
+const MAX_FOOTER_CHARS = 160;
+
+/** How much of one record title the footer will ever carry. Past this the title is not clipped, it is
+ *  DROPPED by the budget above — a half-title reads as a rendering fault, where an absent one reads
+ *  as the connection-only footer every other reply carries. */
+const MAX_RECORD_NAME_CHARS = 120;
+
+/** How many record names this PROCESS keeps at once, across every session warm on it. Small — each
+ *  value is at most {@link MAX_RECORD_NAME_CHARS} — and bounded for the same reason as
+ *  {@link MAX_READS}: a looping turn must not grow a container without end. Past it the oldest entry
+ *  goes, and a reply whose name has been evicted renders the connection alone. */
+const MAX_RECORD_NAMES = 256;
+
+/** THE RECORD DISPLAY NAMES — THIS TURN, THIS PROCESS, AND NOWHERE ELSE (OPE-1714).
+ *
+ *  🔴 IT IS A PLAIN MAP RATHER THAN A `defineState` SLOT, DELIBERATELY. Everything in the slot is
+ *  serialized into the session context and can be read back by a later deployment; the ledger's
+ *  "ids and verbs only" contract exists to keep op OUTPUT out of exactly that. A record title is op
+ *  output. Holding it here means it lives for the turn that read it and dies with the process — the
+ *  render resolves it, the durable row never sees it, and a resumed session finds nothing and falls
+ *  back to the connection name alone. */
+const recordNames = new Map<string, string>();
+
+/** The key one record's display name is held under, or `undefined` when the host cannot build one —
+ *  which stores no name and resolves none, so the footer says the connection alone.
+ *
+ *  🔴 THE SESSION ID IS PART OF THE KEY, AND IT IS LOAD-BEARING (OPE-423). The ledger above is a
+ *  `defineState` slot scoped to ONE eve session, so a bare turn id identifies a turn inside it. This
+ *  map is PROCESS-GLOBAL — every session warm on the instance shares it — and eve mints `turn.id` as
+ *  `turn_<sequence>`, so two sessions' first turns are both `turn_0`. Keyed on the turn alone, one
+ *  workspace's issue title would sit under another workspace's identifier and be footed into the
+ *  wrong room. `identity/binding.ts`'s `currentSessionId` doc states the same trap for the step
+ *  boundary. The TURN is in the key too, so yesterday's title can never be footed onto today's reply;
+ *  and the `kind`, because two systems can mint the same id string and they are not one record. */
+function recordNameKey(sessionId: string | undefined, turnId: string | undefined, kind: string, id: string): string | undefined {
+  if (sessionId === undefined || sessionId.length === 0) return undefined;
+  if (turnId === undefined || turnId.length === 0) return undefined;
+  if (kind.length === 0 || id.length === 0) return undefined;
+  return `${sessionId}::${turnId}::${kind}::${id}`;
+}
+
+/** The op tier that counts as READING. Written as a constant so the hook and this module cannot
+ *  disagree about which verbs produce provenance (`access/connector-op-gating.ts` owns the tiering). */
+export const PROVENANCE_READ_TIER = "read" as const;
+
+/** The audit action one landed reply writes to record what it drew on. STORE FIRST is the ruling
+ *  (Tommy, 2026-09-08): the render is a first cut that is expected to change, and the row is the
+ *  durable part, so the row carries the FULL list while the footer carries the reach-safe view. */
+export const REPLY_PROVENANCE_ACTION = "reply.provenance";
+
+/** Read the durable value defensively — a resumed session can hand back anything a previous
+ *  deployment wrote. Anything unrecognised reads as "no record", which is "no footer". */
+/** Read one entry's record reference defensively, on the same terms as everything else in
+ *  {@link readState}: anything this deployment does not recognise reads as "no record", which renders
+ *  the connection name alone. */
+function readRecord(v: unknown): ConnectorReadRecord | undefined {
+  if (typeof v !== "object" || v === null) return undefined;
+  const raw = v as { kind?: unknown; id?: unknown };
+  if (typeof raw.kind !== "string" || raw.kind.length === 0) return undefined;
+  if (typeof raw.id !== "string" || raw.id.length === 0) return undefined;
+  return { kind: raw.kind, id: raw.id };
+}
+
+function readState(v: unknown): ReplyProvenanceState {
+  if (v === null || typeof v !== "object") return {};
+  const s = v as { turn?: unknown; reads?: unknown };
+  if (typeof s.turn !== "string" || s.turn.length === 0) return {};
+  const reads = Array.isArray(s.reads)
+    ? s.reads.flatMap((r): ConnectorRead[] => {
+        if (typeof r !== "object" || r === null) return [];
+        const raw = r as { connection?: unknown; op?: unknown; surfaceKey?: unknown; wakeId?: unknown; alsoWakeId?: unknown; proof?: unknown; record?: unknown };
+        if (typeof raw.connection !== "string" || raw.connection.length === 0) return [];
+        if (typeof raw.op !== "string" || raw.op.length === 0) return [];
+        const record = readRecord(raw.record);
+        return [
+          {
+            ...(record !== undefined ? { record } : {}),
+            // FAIL CLOSED on anything this deployment does not recognise, including an entry written
+            // before the discriminator existed: `"none"` is counted by kind and never named.
+            proof: raw.proof === "surface" || raw.proof === "wake" ? raw.proof : "none",
+            connection: raw.connection,
+            op: raw.op,
+            ...(typeof raw.surfaceKey === "string" && raw.surfaceKey.length > 0 ? { surfaceKey: raw.surfaceKey } : {}),
+            ...(typeof raw.wakeId === "string" && raw.wakeId.length > 0 ? { wakeId: raw.wakeId } : {}),
+            // 🔴 THE SECOND ADDRESS SURVIVES THE ROUND TRIP, OR THE WHOLE CARRIAGE IS POINTLESS
+            // (OPE-1869). This reader rebuilds every entry field by field, so a field it does not
+            // copy is a field the reply never sees — the settle would stamp the second address and
+            // the reach rule would find it gone. Read on the same fail-closed terms as `wakeId`, and
+            // only BESIDE one: alone it would name nothing, because the wake arm needs the first id
+            // to have been recorded at all.
+            ...(typeof raw.wakeId === "string" && raw.wakeId.length > 0 && typeof raw.alsoWakeId === "string" && raw.alsoWakeId.length > 0 ? { alsoWakeId: raw.alsoWakeId } : {}),
+          },
+        ];
+      })
+    : [];
+  return { turn: s.turn, reads };
+}
+
+/**
+ * Record that THIS turn READ something through a connector.
+ *
+ * Called from `hooks/connector-audit.ts` beside the `connector.op` row it already writes, for a
+ * `read`-tier op that did not error. Deduplicated on the whole entry, so a turn that pages a list
+ * twenty times contributes one source rather than twenty. No-op without a turn id.
+ */
+export function noteConnectorRead(turnId: string | undefined, read: ConnectorRead): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (read.connection.length === 0 || read.op.length === 0) return;
+  const entry: ConnectorRead = {
+    proof: read.proof,
+    connection: read.connection,
+    op: read.op,
+    ...(read.surfaceKey !== undefined && read.surfaceKey.length > 0 ? { surfaceKey: read.surfaceKey } : {}),
+    ...(read.wakeId !== undefined && read.wakeId.length > 0 ? { wakeId: read.wakeId } : {}),
+    // Kept only beside a wake proof it actually widens: an entry with no `wakeId` is not named by the
+    // wake arm at all, so a second wake id on it could only ever be dead weight in the durable row.
+    ...(read.proof === "wake" && read.wakeId !== undefined && read.wakeId.length > 0 && read.alsoWakeId !== undefined && read.alsoWakeId.length > 0 && read.alsoWakeId !== read.wakeId
+      ? { alsoWakeId: read.alsoWakeId }
+      : {}),
+    ...(read.record !== undefined && read.record.kind.length > 0 && read.record.id.length > 0 ? { record: { kind: read.record.kind, id: read.record.id } } : {}),
+  };
+  // Deduplicated on the WHOLE entry, the proof and the wake included: the same op run under two of a
+  // coalesced turn's wakes is two reachable sources, and folding them would name one room's read in
+  // the other. The RECORD is part of the identity too: two pages read on one connection are two
+  // reads, and folding them would lose the first record's name behind the second's entry.
+  const same = (a: ConnectorRead, b: ConnectorRead): boolean =>
+    a.connection === b.connection &&
+    a.op === b.op &&
+    a.proof === b.proof &&
+    a.surfaceKey === b.surfaceKey &&
+    a.wakeId === b.wakeId &&
+    // The SECOND address is part of the entry, so it is part of the key (OPE-1869) — "the WHOLE
+    // entry" above is only true while this line exists. Two entries alike but for it are two
+    // differently-reachable sources, and folding them would make which one survives depend on
+    // arrival order.
+    a.alsoWakeId === b.alsoWakeId &&
+    a.record?.kind === b.record?.kind &&
+    a.record?.id === b.record?.id;
+  try {
+    slot.update((cur) => {
+      const state = readState(cur);
+      if (state.turn !== turnId) return { turn: turnId, reads: [entry] };
+      const reads = state.reads ?? [];
+      if (reads.length >= MAX_READS || reads.some((r) => same(r, entry))) return state;
+      return { turn: turnId, reads: [...reads, entry] };
+    });
+  } catch {
+    /* no eve context — nothing to record, and never a reason to disturb the turn */
+  }
+}
+
+/**
+ * Flatten a record title into something that can only ever be PART OF ONE LINE.
+ *
+ * 🔴 THE TITLE IS UNTRUSTED EXTERNAL CONTENT, AND THIS IS THE FENCE. Anyone who can name a Notion
+ * page or a Linear issue chooses these bytes, and they are about to be written into a reply body by
+ * the HOST, under the host's own reserved marker. A title carrying a newline would split the footer
+ * into two lines, and the second line — attacker-chosen text, with no marker on it — would read as
+ * part of the answer and would survive {@link stripForgedFooter} on an `edit_reply` round trip,
+ * accumulating one copy per edit. So every control and format character becomes a space and every
+ * run of whitespace collapses to one: the result cannot contain a line break, and the footer stays
+ * the one line the ruling requires.
+ *
+ * Answers `undefined` for a title that is empty once flattened — a nameless record renders as its
+ * connection alone.
+ */
+function flattenRecordName(raw: string | undefined): string | undefined {
+  if (typeof raw !== "string") return undefined;
+  const flat = raw
+    .replace(/\p{C}/gu, " ")
+    // 🔴 AND THE FOOTER'S OWN GRAMMAR GOES WITH THE NEWLINE. The line is `prefix` plus items joined
+    // by ", ", with a record rendered as `connection (title)`. A title is untrusted, so a title
+    // reading `Q3, workday-hr, 2 more` would put two source names and an overflow count inside the
+    // host's vouched line, and an unbalanced `)` would close the parenthetical and continue as
+    // host-voiced prose. Both forge exactly what `stripForgedFooter` exists to stop, so the three
+    // characters that carry the grammar become spaces.
+    .replace(/[(),]/gu, " ")
+    .replace(/\s+/gu, " ")
+    .trim();
+  // A title that still carries the reserved marker is DROPPED rather than shown: nothing legitimate
+  // needs it, and the connection-only line is always a safe render.
+  if (flat.includes(PROVENANCE_FOOTER_PREFIX)) return undefined;
+  // Cut by CODE POINT, never by UTF-16 unit: `slice` can split an astral character in half and leave
+  // a lone surrogate in a message body.
+  return flat.length === 0 ? undefined : Array.from(flat).slice(0, MAX_RECORD_NAME_CHARS).join("");
+}
+
+/**
+ * Remember one record's DISPLAY NAME for the length of this turn, in this process.
+ *
+ * Called by the authored-tool door (`channels/read-reach.ts`) beside the ledger entry it writes, and
+ * only for a record the room is entitled to see. The name never reaches the ledger, the session
+ * context or the durable row — see {@link recordNames} for why that is the whole point.
+ */
+export function rememberRecordName(
+  sessionId: string | undefined,
+  turnId: string | undefined,
+  kind: string,
+  id: string,
+  name: string | undefined,
+): void {
+  const key = recordNameKey(sessionId, turnId, kind, id);
+  if (key === undefined) return;
+  const flat = flattenRecordName(name);
+  if (flat === undefined) return;
+  // BOUNDED BY OLDEST-OUT, not by clearing on a turn change. Several sessions interleave across an
+  // `await` on one instance, and a clear-on-change map would evict a live turn's name the moment
+  // another session read something — the reply would then lose a name it had earned. A `Map`
+  // iterates in insertion order, so the oldest entry is the one that goes.
+  recordNames.delete(key);
+  if (recordNames.size >= MAX_RECORD_NAMES) {
+    const oldest = recordNames.keys().next();
+    if (oldest.done !== true) recordNames.delete(oldest.value);
+  }
+  recordNames.set(key, flat);
+}
+
+/** The display name for one recorded record, or `undefined` when this process does not hold one —
+ *  a resumed session, another process, a reply the host cannot place in a session, a title that
+ *  flattened to nothing, or a turn that has since moved on. Every one of those renders the
+ *  connection name alone. */
+function recordDisplayName(
+  sessionId: string | undefined,
+  turnId: string | undefined,
+  record: ConnectorReadRecord | undefined,
+): string | undefined {
+  if (record === undefined) return undefined;
+  const key = recordNameKey(sessionId, turnId, record.kind, record.id);
+  return key === undefined ? undefined : recordNames.get(key);
+}
+
+/**
+ * Every connector read THIS turn recorded, or an empty list.
+ *
+ * Answers empty for an unreadable turn id, for a record stamped for another turn, for a turn that
+ * read nothing, and whenever the eve context is unavailable — all of which render no footer, the
+ * fail-soft direction.
+ */
+export function connectorReadsThisTurn(turnId: string | undefined): readonly ConnectorRead[] {
+  if (turnId === undefined || turnId.length === 0) return [];
+  let state: ReplyProvenanceState;
+  try {
+    state = readState(slot.get());
+  } catch {
+    return [];
+  }
+  if (state.turn !== turnId) return [];
+  return state.reads ?? [];
+}
+
+/** The reach-safe view of a turn's reads, from the point of view of ONE reply.
+ *
+ *  `named` — distinct connection names the reply's own room is entitled to see, in first-read order.
+ *  `otherDomains` — how many distinct connections were read that this room cannot be shown, named by
+ *  kind alone. It is a COUNT, not a list: the count discloses that the turn consulted something
+ *  else, which is honest, while the name would disclose what. */
+export interface ReplyProvenance {
+  readonly named: readonly string[];
+  readonly otherDomains: number;
+  /** The RECORD NAME this room may see beside a named connection, keyed by that connection name — at
+   *  most one per connection, the first such read of the turn. Present only where BOTH halves of the
+   *  disclosure rule held: the room already holds the record's id (proved at the read, see
+   *  `channels/read-reach.ts`) and this reply lands in the room the read was scoped to (the reach
+   *  rule, applied here). Empty is the ordinary case, and it renders today's connection-only line. */
+  readonly records?: Readonly<Record<string, string>>;
+}
+
+/**
+ * Apply the reach rule to this turn's reads for a reply going out under `audit`.
+ *
+ * Returns `undefined` when the turn read nothing — the "off when a turn read nothing" condition,
+ * expressed as an absent value so no caller can render an empty footer by accident.
+ *
+ * A source is NAMED only where the proof the READ carries holds against this reply — its surface for
+ * a read made on a per-surface seat, its wake for one made on a unified seat. See the module header
+ * for why the surface proves nothing on a unified seat.
+ */
+function provenanceForReply(
+  reads: readonly ConnectorRead[],
+  audit: Pick<ReplyAudit, "platform" | "workspace" | "surface" | "wakeId"> | undefined,
+  sessionId: string | undefined,
+  turnId: string | undefined,
+): ReplyProvenance | undefined {
+  if (reads.length === 0) return undefined;
+  // The reply's two room keys — one per proof. EACH READ NAMES WHICH ONE APPLIES, in its own `proof`
+  // field, because the recording end already decided that: `hooks/connector-audit.ts` stamps a
+  // per-surface read `"surface"` and a unified read `"wake"`. So a unified read can never be waved
+  // through by a surface comparison, whatever the reply's own fields happen to say, and a read
+  // carrying neither proof (`"none"`) is named by nothing.
+  //
+  // `roomKey` is rebuilt from the three fields the audit struct already carries — the same
+  // `platform/workspace/surface` shape `resolvePartition` hands the hook, so the two ends compare
+  // like for like. It is `undefined` on a reply the host could not place, and on any struct whose
+  // labels name the WINDOW rather than a room — the `platform: "unified"` sentinel just above.
+  //
+  // `wakeKey` is the wake this reply ANSWERS: the `reply` tool's fenced `wake` argument.
+  // `undefined` means a reply that names no conversation, which proves nothing and names nothing.
+  const wakeKey = audit?.wakeId !== undefined && audit.wakeId.length > 0 ? audit.wakeId : undefined;
+  const roomKey =
+    audit === undefined || audit.platform === "unified" || audit.surface === undefined || audit.surface.length === 0
+      ? undefined
+      : `${audit.platform}/${audit.workspace}/${audit.surface}`;
+  const named: string[] = [];
+  const other = new Set<string>();
+  // THE RECORD NAMES, AND WHY THEY ARE GATHERED HERE AND NOWHERE EARLIER (OPE-1714). A record name
+  // needs BOTH halves of the disclosure rule, and only this loop holds both: the entry carries a
+  // record ONLY where the read end proved the room already holds that id, and `visible` is the reach
+  // rule saying this reply lands in that same room. One name per connection — the FIRST such read of
+  // the turn — because the line is a courtesy, not a bibliography, and a second title on one
+  // connection is the noise the ruling forbids.
+  const records: Record<string, string> = {};
+  for (const r of reads) {
+    const visible =
+      r.proof === "wake"
+        ? // EITHER address of ONE conversation names the read (OPE-1869). `alsoWakeId` is set only by
+          // the delegation settle, and only where the turn adopted this task's own minted wake, so
+          // the second id is that same turn's own delivery stamp — the id this reply answers under.
+          // A read with no `alsoWakeId` is unchanged, which is every seat-turn read.
+          wakeKey !== undefined && (r.wakeId === wakeKey || r.alsoWakeId === wakeKey)
+        : r.proof === "surface"
+          ? roomKey !== undefined && r.surfaceKey === roomKey
+          : false;
+    if (visible) {
+      if (!named.includes(r.connection)) named.push(r.connection);
+      if (records[r.connection] === undefined) {
+        const name = recordDisplayName(sessionId, turnId, r.record);
+        if (name !== undefined) records[r.connection] = name;
+      }
+    } else if (!named.includes(r.connection)) {
+      other.add(r.connection);
+    }
+  }
+  // A connection read BOTH in this room and elsewhere is already named, so it must not also be
+  // counted as another domain — the name is out either way, and double-counting would tell the room
+  // there was a source that does not exist.
+  for (const n of named) other.delete(n);
+  return { named, otherDomains: other.size, ...(Object.keys(records).length > 0 ? { records } : {}) };
+}
+
+/** The footer's leading marker — and, because {@link stripForgedFooter} strikes it out of the model's
+ *  own text, the string that RESERVES this line shape for the host. One constant so the render and
+ *  the strip can never disagree about what the marker is. */
+export const PROVENANCE_FOOTER_PREFIX = "Sources read this turn:";
+
+/**
+ * Strike every line of the model's text that opens with {@link PROVENANCE_FOOTER_PREFIX}.
+ *
+ * 🔴 WITHOUT THIS THE WHOLE GUARANTEE IS DECORATIVE. Nothing else stops a model ending its answer
+ * with `Sources read this turn: notion, workday-hr` on a turn that read nothing at all. The host
+ * would correctly add no footer, the room would read a fabricated receipt in the exact shape of a
+ * host-recorded one, and the reader has no way to tell them apart — which is worse than having no
+ * footer, because the shape is what earns the trust.
+ *
+ * So the marker is RESERVED, the same way `truncateMemoryCitationPaths` reserves the memory mount:
+ * both rewrite the model's own bytes at the choke point, and both do it because the model cannot be
+ * asked to remember. It runs on EVERY reply, including one that adds no footer — a turn that read
+ * nothing is exactly the turn a forged line does the most damage on.
+ *
+ * It also makes the render IDEMPOTENT, which the edit door needs: a model that echoes a previously
+ * posted body back into `edit_reply` gets one footer, not two.
+ *
+ * 🔴 IT TOLERATES MARKDOWN DECORATION, and it has to. A model writes `**Sources read this turn:** …`
+ * or `> Sources read this turn: …` as readily as the bare line, and every one of those renders in a
+ * room as the same receipt. A strip anchored on the bare marker alone would leave the forgeries that
+ * LOOK MOST like a host line — the bolded one most of all — so the leading run of whitespace and
+ * `* _ > - #` is skipped before the marker is matched.
+ *
+ * Conservative past that point: only a line whose first CONTENT is the marker is struck. A sentence
+ * mentioning the phrase mid-line, a quotation of one inside a code block, and every other byte pass
+ * through untouched.
+ */
+function stripForgedFooter(text: string): string {
+  if (!text.includes(PROVENANCE_FOOTER_PREFIX)) return text;
+  const forged = (line: string): boolean => line.replace(/^[\s*_>\-#]+/, "").startsWith(PROVENANCE_FOOTER_PREFIX);
+  return text
+    .split("\n")
+    .filter((line) => !forged(line))
+    .join("\n")
+    .trimEnd();
+}
+
+/**
+ * Render the footer, or `undefined` when there is nothing a reader may be told.
+ *
+ * Compact by design and deliberately plain text: it runs on Slack, Discord, Teams, Notion, Linear
+ * and GitHub alike, and the one markup every one of those renders the same way is none.
+ */
+function renderProvenanceFooter(p: ReplyProvenance | undefined): string | undefined {
+  if (p === undefined) return undefined;
+  const listed = p.named.slice(0, MAX_NAMED);
+  const overflow = p.named.length - listed.length;
+  // The two remainders are separate sentences of the same claim and must not be merged: an overflow
+  // is a source this room MAY see that the line had no room for, while another domain is a source it
+  // may NOT see at all. Collapsing them into one number would misstate which.
+  const tail: string[] = [];
+  if (overflow > 0) tail.push(`${overflow} more`);
+  if (p.otherDomains > 0) tail.push(`${p.otherDomains} in another domain`);
+  if (listed.length === 0 && tail.length === 0) return undefined;
+  const line = (items: readonly string[]): string => `${PROVENANCE_FOOTER_PREFIX} ${[...items, ...tail].join(", ")}`;
+  const items = listed.map((c) => {
+    const record = p.records?.[c];
+    return record === undefined ? c : `${c} (${record})`;
+  });
+  // 🔴 THE RECORD NAMES COME OFF FIRST, AND THEY ARE THE ONLY THING THAT COMES OFF. Drop from the
+  // LAST decorated name backward until the line fits its budget: the connection names, the overflow
+  // count and the other-domain count are the claim about SOURCES and survive every time, while a
+  // record name is the extra the ruling made droppable. A line still over budget once every record
+  // name is gone is today's connection-only line, which is never worse than before this fold.
+  for (let i = items.length - 1; i >= 0 && line(items).length > MAX_FOOTER_CHARS; i--) items[i] = listed[i]!;
+  return line(items);
+}
+
+/**
+ * Append the footer to a reply body, or return the body untouched.
+ *
+ * 🔴 UNTOUCHED IS THE COMMON CASE AND IT IS BYTE-EXACT. A turn that read no connector, and whose text
+ * carries no forged marker, gets its text back identical — which is what keeps the OPE-1516 silence
+ * intact for every reply this feature has nothing to say about
+ * (`packages/core/scripts/reply-delegation-pending-test.ts` §10).
+ *
+ * The one text this DOES rewrite with no footer to add is a forged one; see {@link stripForgedFooter}
+ * for why a read-nothing turn is exactly where that matters.
+ */
+function withProvenanceFooter(text: string, p: ReplyProvenance | undefined): string {
+  const body = stripForgedFooter(text);
+  const footer = renderProvenanceFooter(p);
+  return footer === undefined ? body : `${body}\n\n${footer}`;
+}
+
+/**
+ * Write the durable provenance row for ONE landed reply — best-effort, never throws, never fails the
+ * reply, and a no-op when the turn read nothing.
+ *
+ * THE ROW CARRIES THE FULL LIST, the footer carries the reach-safe view, and the row records how many
+ * sources the footer withheld. That asymmetry is the point: the row is an internal record answering
+ * "what did this reply actually draw on", and an answer that had already dropped the redacted sources
+ * could not answer it. The row is readable with `readAudit({ action: "reply.provenance" })`.
+ *
+ * 🔴 Its `platform` COLUMN names the SURFACE the reply landed on — the `platform` ARGUMENT, not
+ * `audit.platform` — so it files beside the `reply.post` row it describes rather than under the
+ * route that carried it. See `channels/reply-post.ts` `auditReplyPost` for the measurement.
+ * `audit.platform` stays the turn's partition, and {@link provenanceForReply} still reads its
+ * `"unified"` value as the sentinel for "these labels name the window, not a room".
+ */
+export async function auditReplyProvenance(
+  audit: ReplyAudit | undefined,
+  messageId: string,
+  platform: string,
+  reads: readonly ConnectorRead[],
+  shown: ReplyProvenance | undefined,
+): Promise<void> {
+  if (!audit || reads.length === 0) return;
+  const connections = [...new Set(reads.map((r) => r.connection))];
+  await appendAudit({
+    org: audit.org,
+    platform,
+    workspace: audit.workspace,
+    surface: audit.surface,
+    principalId: audit.principalId,
+    action: REPLY_PROVENANCE_ACTION,
+    detail: {
+      id: messageId,
+      platform,
+      connections,
+      ops: [...new Set(reads.map((r) => `${r.connection}/${r.op}`))],
+      reads: reads.length,
+      named: shown?.named.length ?? 0,
+      // How many connections the reach rule withheld from THIS room. A row with `named: 0` and a
+      // non-zero `withheld` is exactly what an operator asking "why does my footer name nothing"
+      // needs to see: the turn read those systems and this room could not be shown them — on a
+      // wake-addressed reply, because they were read under a different wake.
+      withheld: connections.length - (shown?.named.length ?? 0),
+      ...(audit.wakeId ? { wakeId: audit.wakeId } : {}),
+      ...(audit.sessionId ? { sessionId: audit.sessionId } : {}),
+    },
+  }).catch(() => undefined);
+}
+
+/**
+ * The whole per-reply step, in one call both choke points make: read this turn's sources, apply the
+ * reach rule, and hand back the body to post plus the view to audit.
+ *
+ * ONE function because two choke points DRIFTED before over exactly this kind of shared step (see
+ * `recordLandedPost`): a post that footed its sources and an edit that silently stripped them would
+ * make the footer look like a rendering glitch rather than a record.
+ */
+export function applyReplyProvenance(
+  text: string,
+  audit: ReplyAudit | undefined,
+): {
+  /** The text to post: the model's text with any forged marker struck and the footer appended. What
+   *  a choke point that posts the body WHOLE uses. */
+  readonly body: string;
+  /** The same text with the forged marker struck but NO footer appended, plus the {@link footer} to
+   *  add. A choke point that SPLITS the body to a message cap needs these two apart: appending
+   *  before the split lets the cap cut the footer in half across two messages, so it appends to the
+   *  last chunk instead. */
+  readonly bare: string;
+  readonly footer: string | undefined;
+  readonly reads: readonly ConnectorRead[];
+  readonly shown: ReplyProvenance | undefined;
+} {
+  const reads = connectorReadsThisTurn(audit?.turnId);
+  const shown = provenanceForReply(reads, audit, audit?.sessionId, audit?.turnId);
+  return { body: withProvenanceFooter(text, shown), bare: withProvenanceFooter(text, undefined), footer: renderProvenanceFooter(shown), reads, shown };
+}