@open-everywhere/core 0.1.0

package/agent/channels/reply-signal.ts

@@ -0,0 +1,723 @@
+// reply-signal — the reply tool's per-session signals, one `defineState` slot each: §POSTED, how many times the tool posted this turn; §DONE, the wakes it answered with `done:true`; §DECLINED, the wakes it declined with `no_reply`; §STOPPED, whether the one post a stored stand-down still allows has been spent; §STOOD-DOWN, that this turn called `stand_down` and still owes its acknowledgement; §REPLIED, every wake it called `reply` on whether or not it marked one done; §REFUSED, the host refusals it drew, per wake; §FORCED, how many times it overrode each discouraged-duplicate verdict; and §ARM, the delivery arm this seat reads. A session-scoped `defineState` slot is the seam between a tool's execute() and the code that reads it later, and every access is fail-soft.
+// Every mark is TURN-ID KEYED and compared on read, so a stale mark is self-invalidating with no consuming call required, and a turn whose own terminal call never ran cannot poison a later turn's read. On the replied mark an unknown turn id is fail-CLOSED — it reads `false` — because a wrongly-TRUE read suppresses the corrective redrive and loses an answer, while a wrongly-false read costs at most a duplicate.
+
+import { defineState } from "eve/context";
+import { END_TURN_WITH_SENTINEL_INSTRUCTION } from "./normalized-wake.js";
+
+/** The turn id the §POSTED mark was set under, and HOW MANY posts it has counted. A plain object,
+ *  not a bare boolean — the turn id is what makes a stale mark self-invalidating (see the header).
+ *  🔴 `posts` IS A COUNT, NOT A FLAG (OPE-1596). Every reader that only asks "did this turn post at
+ *  all" reads `posts >= 1`, which a boolean answered just as well. The count exists for the ONE
+ *  reader that asks a question a boolean cannot answer: §STOOD-DOWN's order test, which needs to
+ *  tell a post made BEFORE the stand-down from one made after it. A boolean already set stays set,
+ *  so the later post is invisible to it — see §STOOD-DOWN for what that cost. */
+interface RepliedThisTurn {
+  readonly turnId: string;
+  readonly posts: number;
+}
+
+const slot = defineState<RepliedThisTurn | null>("open-everywhere.replied-this-turn", () => null);
+
+/** Mark that the `reply` tool successfully posted THIS turn. No-op without a turn id — an
+ *  unidentifiable turn can carry no mark for a later turn to be compared against, matching
+ *  {@link markWakeDoneThisTurn}'s own contract below.
+ *  Counts UP within one turn and restarts at 1 for any other turn id. The restart is DEFENSIVE, not
+ *  the guarantee: {@link postsThisTurn} compares the turn id on every read, so a previous turn's
+ *  total is already invisible to this turn's order test without it. */
+export function markRepliedThisTurn(turnId: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  try {
+    slot.update((prev) => ({ turnId, posts: prev !== null && prev.turnId === turnId ? prev.posts + 1 : 1 }));
+  } catch {
+    /* no session context here — nothing to signal, never blocks the reply tool */
+  }
+}
+
+/**
+ * Read-and-reset: did the reply tool family post THIS turn? It always clears the slot, so a stale mark can never answer a third turn's read either.
+ * `false` whenever `turnId` is unidentifiable or does not match the turn the mark was set under — never trust a mark this turn cannot prove is its own.
+ */
+export function consumeRepliedThisTurn(turnId: string | undefined): boolean {
+  try {
+    const cur = slot.get();
+    const was = turnId !== undefined && turnId.length > 0 && cur !== null && cur.turnId === turnId;
+    slot.update(() => null);
+    return was;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * PEEK without consuming: HOW MANY times has the reply tool family posted THIS turn? For a mid-turn
+ * reader that must not disturb the read-and-reset contract `message.completed` owns — the same split
+ * `peekNoReplyThisTurn` (channels/no-reply-signal.ts) makes for the silence signal.
+ * `0` whenever `turnId` is unidentifiable, does not match the turn the mark was set under, or the
+ * read throws — "this turn has posted nothing I can prove", which is the same direction the boolean
+ * this replaced read (see §STOOD-DOWN for what each caller does with an unprovable answer).
+ */
+function postsThisTurn(turnId: string | undefined): number {
+  if (turnId === undefined || turnId.length === 0) return 0;
+  try {
+    const cur = slot.get();
+    return cur !== null && cur.turnId === turnId ? cur.posts : 0;
+  } catch {
+    return 0;
+  }
+}
+
+// §DONE — the wakes THIS turn has already answered with `done:true`. The durable answered mark has teeth on a LATER turn, but none inside the turn that set it, because a multi-part answer is legitimate. So `done` was a flag the model could not feel, and a re-post habit inside one turn became a visible duplicate in the room; this slot lets the reply tool refuse its own later call in the SAME turn against the SAME wake.
+// `done:false` records nothing, so a deliberate multi-part answer keeps working. The turn id is the key rather than a reset call, so the record self-invalidates at the turn boundary and no reader has to clear it. FAIL-OPEN: no context, no turn id, or any throw leaves the guard off and the reply posts — the worst case must stay a duplicate reply, never a lost answer.
+
+/** The wakes one turn has answered with `done:true`. A plain array, not a Set — the container is
+ *  serialized between steps, so the value has to survive JSON. */
+interface DoneWakes {
+  readonly turnId: string;
+  readonly wakes: readonly string[];
+}
+
+const doneSlot = defineState<DoneWakes | null>("open-everywhere.reply-done-wakes", () => null);
+
+/** How many wakes one turn tracks. A coalesced turn answers a handful; the cap only stops an
+ *  adversarial or looping turn from growing the serialized container without bound. Past the cap
+ *  the guard stops recording (fail-open), it never starts refusing. */
+const MAX_DONE_WAKES = 32;
+
+/** Record that THIS turn answered `wake` with `done:true`. No-op without a turn id. */
+export function markWakeDoneThisTurn(turnId: string | undefined, wake: string): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (typeof wake !== "string" || wake.length === 0) return;
+  try {
+    doneSlot.update((prev) => {
+      const wakes = prev !== null && prev.turnId === turnId ? prev.wakes : [];
+      if (wakes.includes(wake) || wakes.length >= MAX_DONE_WAKES) return { turnId, wakes };
+      return { turnId, wakes: [...wakes, wake] };
+    });
+  } catch {
+    /* no session context here — the guard degrades to OFF, exactly as the header says */
+  }
+}
+
+/** The audit reason a reply refused by {@link isWakeDoneThisTurn} carries (tools/reply.ts), so a
+ *  same-turn re-post habit is countable apart from a cross-turn answered wake. */
+export const WAKE_DONE_REFUSAL_REASON = "answered-this-turn";
+
+/** The audit reason a FORCED same-turn re-post carries, on its own `reply.forced` row. Its own
+ *  string, never a fold or freshness reason: the pair (refusals, overrides) only says whether the
+ *  steer works if each policy's overrides are countable apart from every other policy's. */
+export const WAKE_DONE_FORCED_AUDIT_REASON = "answered-this-turn-forced";
+
+/** Did THIS turn already answer `wake` with `done:true`? False whenever the answer is unknown. */
+export function isWakeDoneThisTurn(turnId: string | undefined, wake: string): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = doneSlot.get();
+    return cur !== null && cur.turnId === turnId && cur.wakes.includes(wake);
+  } catch {
+    return false;
+  }
+}
+
+// §DONE-VALVE — the same-turn `done` teeth DISCOURAGE a second answer, they do not block one
+// (OPE-1452, and Tommy's ruling of 2026-09-03: "we should never be hard-blocking this, it's okay for
+// the model to double-post, just discouraged"). OPE-568 built this arm as a hard refusal, which the
+// ruling then contradicted: the two other gates that judge a DUPLICATE POST — staleness and
+// should-be-edit — refuse at most ONCE and honour `force`, and this one refused every time and read
+// no flag.
+//
+// 🔴 THAT IS A CLAIM ABOUT SAME-TURN DUPLICATE-POST GATES, AND ABOUT NOTHING ELSE. Do not read it as
+// a count of the refusals on this path, and do not read "no hard blocks remain" out of it. Several
+// refusals still throw every time and read no `force`, and only ONE of them judges a second message
+// at all:
+//   • the wake fence's `mismatch` and `expired` arms, and `task-wake-unread` — the model named a
+//     wake it does not hold, one whose row aged out, or the turn holds no address at all;
+//   • `declined-this-turn` (below) — a reply to a wake this turn answered with silence;
+//   • `delegation-pending` (access/pending-delegation-signal.ts) — a `done:true` that would close a
+//     wake the turn's own running worker still owes.
+// The ruling reaches none of those. A missing address, a contradiction and an answer the turn does
+// not have yet are not matters of style, so there is nothing there to discourage instead of refuse.
+// The one that IS about a repeat answer is the fence's `answered` arm (channels/unified-window.ts),
+// and it is about one an EARLIER turn gave. It stays a wall for its own reason: it refuses on the
+// answered mark of a row it resolved, and the conversation re-opens by itself on the next message
+// there, under a new wake id.
+//
+// THE VALVE IS THE ONE reply-fold.ts AND reply-freshness.ts ALREADY USE: refuse once per turn per
+// WAKE, then stand aside. It is keyed on the wake rather than the room because that is what §DONE
+// itself is keyed on — a sibling wake in a coalesced turn is a different answer to a different
+// conversation, and its own first repeat deserves its own steer.
+//
+// 🔴 THE VALVE IS SHUT WHERE A SECOND POST CANNOT LAND. The reply tool reads
+// `terminalPostClosesConversation` (channels/unified-reply.ts) first and keeps the old WALL on the
+// one route where the first `done:true` post ended the conversation — a Linear mention, whose
+// `response` Agent Activity ends its agent session (OPE-869). Inviting a re-send there would trade a
+// bounded refusal for a platform error the model cannot read its way out of. That check needs the
+// ORIGIN, which is why the arm now sits below the authority fence rather than above it.
+//
+// WHY REFUSING ONCE IS ENOUGH. The refusal has already told the model everything this guard knows:
+// the wake is answered, nothing was posted, and `done:false` is the route for a planned multi-part
+// answer. A model that reads that and still wants a second message is making a judgement the host
+// cannot second-guess. Refusing forever made those messages unsayable, which is what the ruling
+// forbids; refusing once costs one step.
+//
+// SAME FAIL-OPEN CONTRACT as every sibling set: no context, no turn id, no wake or any throw leaves
+// the record empty. Note the direction that failure takes HERE — an unwritable record means the
+// guard keeps refusing rather than going quiet, which is the same direction reply-fold.ts's guard
+// fails in, and it can never lose an answer because the refusal itself names the way past it.
+
+/** The wakes this turn has already spent its one same-turn `done` refusal on. Same JSON-survivable
+ *  shape as {@link DoneWakes} — the container is serialized between steps. */
+interface DoneRefusedWakes {
+  readonly turnId: string;
+  readonly wakes: readonly string[];
+}
+
+const doneRefusedSlot = defineState<DoneRefusedWakes | null>("open-everywhere.reply-done-refused-wakes", () => null);
+
+/** Record that the same-turn `done` teeth ALREADY refused a reply to `wake` in this turn. No-op
+ *  without a turn id or a wake id, and same cap as §DONE: past it the record stops growing, so the
+ *  guard keeps refusing rather than silently going quiet. */
+export function markDoneRefusedThisTurn(turnId: string | undefined, wake: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (typeof wake !== "string" || wake.length === 0) return;
+  try {
+    doneRefusedSlot.update((prev) => {
+      const wakes = prev !== null && prev.turnId === turnId ? prev.wakes : [];
+      if (wakes.includes(wake) || wakes.length >= MAX_DONE_WAKES) return { turnId, wakes };
+      return { turnId, wakes: [...wakes, wake] };
+    });
+  } catch {
+    /* no session context here — the guard degrades to "refuse", exactly as the header says */
+  }
+}
+
+/** Did the same-turn `done` teeth ALREADY refuse a reply to `wake` in this turn? False whenever the
+ *  answer is unknown, which leaves the guard armed — the fail direction here is "refuse once", never
+ *  "never refuse". */
+export function wasDoneRefusedThisTurn(turnId: string | undefined, wake: string): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = doneRefusedSlot.get();
+    return cur !== null && cur.turnId === turnId && cur.wakes.includes(wake);
+  } catch {
+    return false;
+  }
+}
+
+// §VALVE — THE ONE SENTENCE EVERY DISCOURAGED-DUPLICATE REFUSAL ENDS WITH.
+//
+// Two refusals on the reply path say the SAME thing to the model: your last message already said
+// this, a second one is a poor move, and here is how to send it anyway. The should-be-edit policy
+// (channels/reply-fold.ts) and the same-turn `done` teeth above are those two. One word, one
+// meaning — so they say it in ONE set of words, from here, rather than in two copies that drift.
+//
+// 🔴 IT NAMES THE VALVE AS DISCOURAGED, NEVER AS AN INVITATION. The copy OPE-1422 replaced ended
+// "Re-send this same call to post it as a new message anyway" — a plain instruction, which is what a
+// model reads it as. So the sentence that opens the valve also states its COST: the room reads a
+// near-duplicate, and an override is recorded.
+//
+// The freshness gate (channels/reply-freshness.ts) deliberately does NOT share this sentence. Its
+// cost is a different one — an answer that ignores the newest messages, not a near-duplicate — and
+// one word, one meaning cuts both ways: the same words must not be made to cover two costs.
+
+// 🔴 THE SENTENCE PROMISES `force`, AND DESCRIBES A BARE RE-SEND AS A STEP RATHER THAN AN ARRIVAL
+// (OPE-1469). "Send this same call again … and it posts" is exact for the should-be-edit refusal,
+// which is the LAST gate before the post choke point. It is NOT exact for the same-turn `done` teeth,
+// which sit earlier in `tools/reply.ts`: on a standing chat seat (Slack, Discord, Teams) a
+// `done:true` post leaves the seat's own message as the newest row in that room's ring, answering
+// that same wake, on an editable platform, inside the ledger TTL — so call 2 draws
+// `answered-this-turn`, call 3 reaches the fold gate and draws `should-be-edit`, and call 4 posts.
+// TWO refusals, where the copy named the cost of one.
+//
+// Nothing is blocked either way — `force: true` passes both gates in ONE call, and each gate refuses
+// at most once — so Tommy's ruling of 2026-09-03 is untouched. What changes is only the promise. A
+// gate can honestly promise what IT will do; it cannot promise what the gates after it will do, and
+// the old sentence did. So the shared branch now says this check will not refuse the same call
+// twice, and names `force: true` as the route that posts in one step.
+//
+// 🔴 THE PER-SURFACE BRANCH IS UNCHANGED, and narrowing the fix to the branch that is actually wrong
+// is the point. That branch is used at one site only — the per-surface fold refusal — where the fold
+// gate IS the last check before the post choke point and no `done` teeth run at all (that variant
+// holds no wake). "Send this same call again and it posts" is exact there, and weakening true copy to
+// match a sibling's defect would trade one inaccuracy for another.
+
+/**
+ * The valve sentence. `canForce` is false on a variant that has NO `force` input (the per-surface
+ * `reply`), where naming the flag would teach a verb the caller does not hold.
+ *
+ * 🔴 THE TWO BRANCHES PROMISE DIFFERENT THINGS BECAUSE THEY SIT IN DIFFERENT PLACES (OPE-1469). The
+ * `canForce: false` branch is used at ONE site — the per-surface fold refusal — and that gate is the
+ * last thing between the call and the post, so "send this same call again and it posts" is exact
+ * there and stays. The `canForce: true` branch is used at TWO, and only one of them is last, so it
+ * promises what THIS check will do and nothing about the checks after it.
+ */
+export function secondMessageValve(canForce: boolean): string {
+  return canForce
+    ? "A second message is DISCOURAGED, not blocked: pass `force: true` and it posts, or send this same call again — this check will not refuse it twice, though a later one still can. It costs the room a near-duplicate to read, and the override is recorded."
+    : "A second message is DISCOURAGED, not blocked: send this same call again and it posts. It costs the room a near-duplicate to read.";
+}
+
+// §DECLINED — the wakes THIS turn declined with `no_reply`. eve treats a step with no tool call and no text as a FAILURE and reissues the call with a nudge to answer now, so a turn that correctly chose silence gets nudged into replying to the very wake it just declined.
+// This is the DETERMINISTIC half of two controls; the tool's own result note is the other, and that is only as good as the model. Refusing is safe because declining a wake and then answering it is a contradiction inside one turn, and a legitimate multi-wake turn replies before it declines. Same FAIL-OPEN contract as §DONE.
+
+/** The wakes one turn declined with `no_reply`. Same JSON-survivable shape as {@link DoneWakes}. */
+interface DeclinedWakes {
+  readonly turnId: string;
+  readonly wakes: readonly string[];
+}
+
+const declinedSlot = defineState<DeclinedWakes | null>("open-everywhere.reply-declined-wakes", () => null);
+
+/** Record that THIS turn declined `wake` with `no_reply`. No-op without a turn id or a wake id. */
+export function markWakeDeclinedThisTurn(turnId: string | undefined, wake: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (typeof wake !== "string" || wake.length === 0) return;
+  try {
+    declinedSlot.update((prev) => {
+      const wakes = prev !== null && prev.turnId === turnId ? prev.wakes : [];
+      if (wakes.includes(wake) || wakes.length >= MAX_DONE_WAKES) return { turnId, wakes };
+      return { turnId, wakes: [...wakes, wake] };
+    });
+  } catch {
+    /* no session context here — the guard degrades to OFF, exactly as the header says */
+  }
+}
+
+/** The audit reason a reply refused by {@link isWakeDeclinedThisTurn} carries, so a nudge-driven
+ *  over-reply is countable apart from every other refusal shape. */
+export const WAKE_DECLINED_REFUSAL_REASON = "declined-this-turn";
+
+/** What the model reads when the guard refuses. It states the contradiction and names the ONE way
+ *  out — end the turn — because the message the model just read told it to answer now. */
+export function wakeDeclinedRefusalMessage(): string {
+  return (
+    "You already called `no_reply` for this wake in this turn, so it is closed and nothing was posted. " +
+    `${END_TURN_WITH_SENTINEL_INSTRUCTION} ` +
+    "Disregard any notice saying an empty reply was not delivered — silence is this turn's answer."
+  );
+}
+
+/** Did THIS turn already DECLINE `wake` with `no_reply`? False whenever the answer is unknown. */
+export function isWakeDeclinedThisTurn(turnId: string | undefined, wake: string): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = declinedSlot.get();
+    return cur !== null && cur.turnId === turnId && cur.wakes.includes(wake);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Every wake THIS turn declined with `no_reply`, NON-CONSUMING: the accounting audit reads the whole set once at turn end, and a read-and-reset here would race the refusal checks above, which must keep seeing every declined wake for the rest of the turn.
+ * Empty whenever the answer is unknown — never a guess.
+ */
+export function declinedWakesThisTurn(turnId: string | undefined): readonly string[] {
+  if (turnId === undefined || turnId.length === 0) return [];
+  try {
+    const cur = declinedSlot.get();
+    return cur !== null && cur.turnId === turnId ? cur.wakes : [];
+  } catch {
+    return [];
+  }
+}
+
+// §STOPPED — the ONE post a stored stand-down still allows in ANY turn that posts into the stopped conversation (OPE-1520). A stand-down writes the durable `stopped` flag into the engagement registry (`tools/stand_down.ts`), and until now only the WAKE GATES read it: the flag suppressed the next turn and said nothing to the turn that was already running. Measured live on 2026-09-07 — Tommy replied `stop`, the seat acknowledged the stand-down, and then posted the same answer SIX more times inside that same turn.
+// SO THE REPLY PATH RE-READS THE STORED FLAG PER POST, and this slot is what stops the fix from eating the acknowledgement. `stand_down` asks the model for a one-line acknowledgement and then the end of the turn, so IN THE TURN THAT STOOD DOWN the first post after the flag lands is the REQUESTED one. 🔴 IN A LATER TURN IT IS AN ORDINARY POST: the flag is durable and the registry anchor on Discord and Teams is the channel or conversation id, so a stood-down conversation woken by a routine fire or a worker completion post gets one post and then the refusal, in a turn that owed no acknowledgement and called no `stand_down` (OPE-1522). Either post spends the valve, and the refusal copy therefore says "posted", never "acknowledged" (`stoppedRefusalText`, tools/reply.ts). 🔴 It does NOT follow that every seat acknowledges with `reply`: since OPE-1580 the tool names one route per delivery arm, and on the two arms whose closing text POSTS the acknowledgement never reaches this valve at all (see §STOOD-DOWN below, and tools/stand_down.ts). It is allowed, and it spends the valve; every post after it is refused with {@link REPLY_STOPPED_REFUSAL_REASON} and ends the turn (`model/turn-closeout.ts`).
+// FAIL-OPEN like every sibling set, and here that means the guard ALLOWS: no context, no turn id or any throw reads as "not yet spent", so an unwritable slot costs a duplicate rather than the acknowledgement a human asked for. The refusal itself is what bounds the runaway, and it cannot fire twice in a turn because the turn ends on the first one.
+
+/** Whether the ONE post a stored stand-down allows has been spent THIS turn. Turn-id keyed
+ *  like every sibling set, so it self-invalidates at the turn boundary with no reset call. */
+interface StoppedAckSpent {
+  readonly turnId: string;
+  readonly spent: true;
+}
+
+const stoppedAckSlot = defineState<StoppedAckSpent | null>("open-everywhere.reply-stopped-ack", () => null);
+
+/** The audit reason a reply refused by the stored stand-down carries, so a post into a conversation
+ *  the agent was asked to leave is countable apart from every other refusal shape. */
+export const REPLY_STOPPED_REFUSAL_REASON = "stopped";
+
+/** Record that THIS turn has spent the ONE post a stored stand-down allows. 🔴 ANY successful post
+ *  into a conversation the read SAW as stopped spends it, not only an acknowledgement of the stop:
+ *  `tools/reply.ts` calls this after every such post that lands. The `Ack` in the name predates that
+ *  reading (OPE-1522), and copy built on it asserted an acknowledgement had gone out in turns where
+ *  none was ever owed. The read itself FAILS OPEN, so a post that really did follow the stand-down
+ *  can still land with no mark — which is why §STOOD-DOWN keeps its §POSTED disjunct.
+ *  No-op without a turn id — an unidentifiable turn can carry no mark, and the guard then stays open. */
+export function markStoppedAckThisTurn(turnId: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  try {
+    stoppedAckSlot.update(() => ({ turnId, spent: true }));
+  } catch {
+    /* no session context here — the guard degrades to ALLOW, exactly as the header says */
+  }
+}
+
+/** Has THIS turn already spent the one post a stored stand-down allows? `false` whenever the answer
+ *  is unknown, which lets one more post through — the fail direction here is "allow one more", never
+ *  "silence the ask the human made". */
+export function wasStoppedAckSpentThisTurn(turnId: string | undefined): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = stoppedAckSlot.get();
+    return cur !== null && cur.turnId === turnId;
+  } catch {
+    return false;
+  }
+}
+
+// §STOOD-DOWN — THIS TURN CALLED `stand_down` AND STILL OWES THE ONE-LINE ACKNOWLEDGEMENT (OPE-1580). Measured on ship #180, three drives of three: the seat marked the engagement row, then called `no_reply`, which accepted it unconditionally and answered "Turn reply requirement satisfied". That answer closed the reply obligation `stand_down` had just asked the model to discharge, so the acknowledgement the person asked for never posted and the harness closed the turn on `no-reply-redundant`.
+// 🔴 AND THE SILENCE REACHES PAST THE TOOL CALL: `finalMessageActionForTurn` (channels/turn-delivery.ts) returns `silent` on any turn whose no-reply signal is set, whatever the model wrote after it. So on a seat whose closing text POSTS, the `no_reply` call is what suppressed the acknowledgement the model then wrote.
+// SO `no_reply` READS THIS MARK AND REFUSES while the acknowledgement is still owed (tools/no_reply.ts). It is one refusal asking for ONE acknowledgement — deliberately NOT a post cap, and deliberately NOT a turn-ending latch: the whole point is that the turn stays open long enough for the acknowledgement to leave it, so this branch never carries {@link END_TURN_WITH_SENTINEL_INSTRUCTION} and never calls `noteTurnCloseoutRefusal`.
+// WHAT COUNTS AS DISCHARGED, AND ORDER IS PART OF IT: §STOPPED's spent mark (a `reply` that posted while the stored stop was ALREADY set, so it can only be a post that followed the stand-down — the wake-addressed and reply-only route), or a §POSTED post that landed AFTER the stand-down ran. On a `dual-mode` or `closing-text` seat the acknowledgement is the turn's FINAL TEXT, which no tool call records at all; that turn simply never reaches `no_reply`, and one that does gets told to write the text instead.
+// 🔴 THE ORDER TEST IS THE WHOLE GUARD ON A COALESCED TURN. An order-blind §POSTED read lets an EARLIER post discharge a debt it predates: "here is what I found … also, stop following this thread" is answered with a `reply`, then stood down, and the acknowledgement written as final text is dropped by the very `no_reply` that read that first post as the acknowledgement. So the stand-down SNAPSHOTS §POSTED and the test compares against that snapshot.
+// 🔴 IT SNAPSHOTS THE COUNT, NOT A BOOLEAN (OPE-1596). §POSTED was a flag, so "already posted" was a state the stand-down could observe but never see LEAVE: a turn that had posted before the stand-down read as owing for the rest of the turn, whatever it posted afterwards. The count makes "a post landed since" answerable on every turn, which is the question this section was always asking — the flag was a lossy stand-in for it. The order guard is unchanged in substance: a post that PRECEDED the stand-down still discharges nothing, because it moved the count before the snapshot was taken.
+// The §POSTED disjunct is not removable: `standDownState` (tools/reply.ts) fails open on an unreadable store, so a post that really did follow the stand-down can land with NO spent mark. Its cost is bounded the safe way round — a §POSTED read this code cannot prove keeps asking for the acknowledgement rather than closing the debt, and a turn is never trapped by that, because ending with text and no tool call is always available.
+// FAIL-OFF, unlike §STOPPED's fail-open: no context, no turn id or any throw reads as "nothing owed", so an unwritable slot leaves `no_reply` exactly as it behaved before this section existed. A refusal this code cannot justify would block the one verb a turn has left to end cleanly.
+// 🔴 §POSTED IS GATED ON THE DELIVERY ARM, AND THAT GATE IS WHAT MAKES IT SAFE. It is address-blind by construction — it asks WHEN a post landed, never WHERE it went — because reading the address here would mean re-deriving the stored stop's registry key at a second site, the exact shape `standDownState` (tools/reply.ts) refuses for OPE-1520's reason: two sites deriving one key drift. Address-blindness is only tolerable where a `reply` is the acknowledgement's REAL route, so this disjunct answers on the two prose-DROPPED arms alone (`wake-addressed`, `reply-only`), through {@link replyCarriesTheAcknowledgement}.
+// 🔴 ON A `dual-mode` OR `closing-text` SEAT IT NEVER DISCHARGES, and the reason is mechanical rather than cautious: there the acknowledgement is the turn's FINAL TEXT, which no tool call records at all, so a §POSTED post is by definition some OTHER message and can never be the thing that was owed. An ungated read there is a LOST ANSWER, not a wasted step: the `no_reply` it admits records silence, `finalMessageActionForTurn` (channels/turn-delivery.ts) then renders the whole turn silent, and the acknowledgement the model writes as final text is dropped — OPE-1580's exact failure, reachable on a coalesced turn that replied into one conversation, stood down on another, and replied into the first again. Such a turn is not trapped by the refusal: ending with text and no tool call is available at every step, and on these two arms that text IS the delivery.
+// So the two signals divide the work: §STOPPED is address-keyed and discharges on any arm, and §POSTED is the floor under it on the arms where `reply` delivers. What must never happen is the guard trapping a turn — this section can only ask, and a turn that cannot satisfy the ask still has to be able to end.
+
+/**
+ * Does a `reply` DELIVER this seat's stand-down acknowledgement? True on the two arms whose
+ * turn-final prose the host drops, so `reply` is the only route the acknowledgement has; false on
+ * the two arms that POST that prose, where the acknowledgement is the final text and no tool call
+ * records it. {@link standDownAckSentence} (instructions/seat-prompt.ts) names the same split — one
+ * word, one meaning, so a seat is never told one route and measured against another.
+ *
+ * 🔴 FAIL to the PROSE-POSTING answer, exactly as `standDownAckRoute` does. An unstamped session, an
+ * unrecognised arm name and any throw all read `false`, which keeps the debt STANDING rather than
+ * closing it on a signal this code cannot justify. The direction matters: closing it wrongly on a
+ * seat whose acknowledgement is the final text is what drops that text (`finalMessageActionForTurn`,
+ * channels/turn-delivery.ts), which is the OPE-1580 loss itself. Keeping it wrongly costs a refusal,
+ * and ending the turn with text and no tool call is available at every step.
+ */
+function replyCarriesTheAcknowledgement(): boolean {
+  try {
+    const arm = peekDeliveryArm();
+    return arm === "wake-addressed" || arm === "reply-only";
+  } catch {
+    return false;
+  }
+}
+
+/** Whether THIS turn called `stand_down`, and HOW MANY posts it had already made when it did.
+ *  Turn-id keyed like every sibling set, so it self-invalidates at the turn boundary with no reset
+ *  call. `postsBefore` is the order test — see the section header for why an order-blind read
+ *  hands the debt to a post that predates it, and why the snapshot is a count. */
+interface StoodDownThisTurn {
+  readonly turnId: string;
+  readonly stoodDown: true;
+  readonly postsBefore: number;
+}
+
+const stoodDownSlot = defineState<StoodDownThisTurn | null>("open-everywhere.stood-down-this-turn", () => null);
+
+/** The audit action a `no_reply` refused by the owed acknowledgement carries, so a lost
+ *  acknowledgement is countable apart from the redundant arm's repeated
+ *  silence — the two say different things about what the model was trying to do. */
+export const NO_REPLY_AFTER_STAND_DOWN_ACTION = "reply.no_reply_after_stand_down";
+
+/** Record that THIS turn called `stand_down`, with the §POSTED snapshot the order test reads. No-op
+ *  without a turn id — an unidentifiable turn can carry no mark, and the guard then stays OFF (see
+ *  the section header). */
+export function markStoodDownThisTurn(turnId: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  try {
+    // Read BEFORE the write, and read it here rather than at refusal time: this is the only moment
+    // that can tell a post which PRECEDED the stand-down from one that answered it.
+    const postsBefore = postsThisTurn(turnId);
+    stoodDownSlot.update(() => ({ turnId, stoodDown: true, postsBefore }));
+  } catch {
+    /* no session context here — the guard degrades to OFF, exactly as the header says */
+  }
+}
+
+/** Did THIS turn call `stand_down`? `false` whenever the answer is unknown. */
+export function wasStoodDownThisTurn(turnId: string | undefined): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  try {
+    const cur = stoodDownSlot.get();
+    return cur !== null && cur.turnId === turnId;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Does THIS turn still owe its stand-down acknowledgement? True only when the turn stood down and
+ * nothing has left it SINCE — see the section header for the two discharge signals and for why the
+ * §POSTED one is order-tested. `false` whenever the answer is unknown.
+ */
+export function standDownAckOwedThisTurn(turnId: string | undefined): boolean {
+  if (turnId === undefined || turnId.length === 0) return false;
+  let mark: StoodDownThisTurn | null;
+  try {
+    mark = stoodDownSlot.get();
+  } catch {
+    return false;
+  }
+  if (mark === null || mark.turnId !== turnId) return false;
+  if (wasStoppedAckSpentThisTurn(turnId)) return false;
+  // 🔴 §POSTED ONLY ANSWERS ON AN ARM WHERE A `reply` CAN BE THE ACKNOWLEDGEMENT. On a
+  // prose-POSTING arm it never can, so a post there discharges nothing — see the section header.
+  if (!replyCarriesTheAcknowledgement()) return true;
+  // A §POSTED post discharges the debt ONLY if it landed after the stand-down, which is exactly a
+  // count above the snapshot. `postsThisTurn` answers 0 on an unreadable slot, and 0 is never above
+  // a snapshot, so an unreadable §POSTED leaves the debt standing and §STOPPED's spent mark above
+  // stays the way out — the same direction the boolean read before it.
+  return postsThisTurn(turnId) <= mark.postsBefore;
+}
+
+/**
+ * What the model reads when the owed acknowledgement refuses a `no_reply`. It states what happened,
+ * names the ONE thing to do instead, and stops there.
+ *
+ * 🔴 `ackRoute` IS THE ARM-CORRECT SENTENCE, PASSED IN, and there is no default. The defect this
+ * refusal exists to fix was a tool note that named a delivery route the seat does not have, so this
+ * copy may never guess one: the caller reads the arm ({@link peekDeliveryArm} below) and renders the
+ * sentence (instructions/seat-prompt.ts `standDownAckSentence`).
+ */
+export function standDownAckOwedMessage(ackRoute: string): string {
+  return (
+    "You stood down in this turn, so this turn still owes the one-line acknowledgement the person asked for — " +
+    "silence was NOT recorded and nothing was posted. A `no_reply` turn is delivered as silence whatever " +
+    "you write after it, which is how this acknowledgement gets lost. " +
+    `${ackRoute} ` +
+    "Call `no_reply` only once that acknowledgement has gone out."
+  );
+}
+
+// §FORCED — HOW MANY TIMES THIS TURN OVERRODE EACH DISCOURAGED-DUPLICATE VERDICT (OPE-1659).
+//
+// ── THE FAILURE THIS EXISTS FOR ──────────────────────────────────────────────────────────────────
+// Three gates on the reply path judge a duplicate post and honour `force: true`: the same-turn `done`
+// teeth above, the should-be-edit policy (channels/reply-fold.ts) and the freshness gate
+// (channels/reply-freshness.ts). Each REFUSES at most once per turn, and each records that refusal so
+// it stands aside afterwards. None of them recorded the OVERRIDE. So a turn that passed `force: true`
+// re-ran every verdict on every call, wrote a fresh `reply.forced` row each time, and read back the
+// same success note it read on call one — the host had nothing left to say and no way to notice it
+// was repeating itself.
+//
+// Measured live on 2026-09-09, deploy #190, seat session `wrun_41M2348BK10GV434C4857HRP4K`: ONE wake
+// (`d09aff00-…`) drew 100 `answered-this-turn-forced` and 101 `should-be-edit-forced` rows against 40
+// `reply.post` rows in 15 minutes. The room got the same answer 40 times. Nothing on the host ended
+// it — the loop stopped only when the session hit its 30,000,000-token limit and parked
+// (`session.token_limit_park`, 13:49:47Z).
+//
+// ── WHAT THIS SECTION IS ─────────────────────────────────────────────────────────────────────────
+// A per-turn COUNT of overrides, keyed exactly the way each gate keys its own refusal record — the
+// `done` teeth and the freshness gate per WAKE, the should-be-edit policy per ROOM — so one word
+// means one thing across a policy's refusal and its override. Each gate calls
+// {@link noteForcedOverrideThisTurn} on its force branch and reads the answer:
+//   • count 1 — the FIRST override of that verdict in this turn. The gate writes its `reply.forced`
+//     row, exactly as before. One row per verdict kind per turn is what makes the pair
+//     (refusals, overrides) countable, which is the whole reason those rows exist.
+//   • count 2 and above — the same gate, the same turn, again. No further row: the trail already
+//     says this turn overrode this verdict, and repeating the row only buries it.
+//
+// 🔴 IT BLOCKS NOTHING, AND IT MUST NOT. Tommy's ruling of 2026-09-03 stands (see §DONE-VALVE): a
+// second message is DISCOURAGED, never hard-blocked. Every call this section counts still POSTS. What
+// changes is what the host RECORDS and what it SAYS: past the limit the reply tool arms the turn's
+// closeout latch (model/turn-closeout.ts) so the turn ends on the NEXT model round-trip, and its
+// success note names `edit_reply` and `no_reply` instead of repeating a promise the override has just
+// disproved. The message that was already written still lands; the SPIN is what ends.
+//
+// 🔴 THE COUNT IS PER (VERDICT, KEY), NOT PER TURN, and the difference is what an operator counts. The
+// key is each gate's own — the WAKE for the `done` teeth and the freshness gate, the ROOM for the
+// should-be-edit policy — so a COALESCED turn that answers three wakes and forces each writes THREE
+// `answered-this-turn-forced` rows, not one. "One row per verdict per turn" is the wrong reading;
+// "one row per verdict per wake (per room, for should-be-edit) per turn" is the rule.
+//
+// FAIL-SOFT LIKE EVERY SIBLING, and the direction is deliberate: no context, no turn id, an unwritable
+// slot or any throw all answer `1`. That is the pre-OPE-1659 behaviour — the row is written and the
+// latch stays unarmed — so a signal this code cannot prove can never end a turn. The consequence is
+// worth stating: in that degraded state the per-turn bound on rows does NOT hold, because every call
+// looks like a first override. The cap is the one unknown that does NOT take this exit — see
+// {@link noteForcedOverrideThisTurn} for why a full record evicts rather than going quiet.
+
+/** The overrides one turn has recorded, per (verdict reason, key). A plain array of pairs, not a Map:
+ *  the container is serialized between steps, so the value has to survive JSON. */
+interface ForcedOverrides {
+  readonly turnId: string;
+  readonly entries: readonly { readonly key: string; readonly count: number }[];
+}
+
+const forcedSlot = defineState<ForcedOverrides | null>("open-everywhere.reply-forced-overrides", () => null);
+
+/**
+ * How many overrides of ONE verdict kind a turn may record before the reply tool ends the turn.
+ * TWO, and the reasoning is the mirror of `model/turn-closeout.ts`'s "why the limit is one": the
+ * FIRST override is a judgement the host cannot second-guess — a time-critical alert, a hand-off note
+ * — and the ruling above says it must be possible. The SECOND is the same judgement about the same
+ * verdict in the same turn, which is the live trace's shape and never a new decision.
+ */
+export const FORCED_OVERRIDE_TURN_LIMIT = 2;
+
+/** The closeout reason the reply tool arms the latch with once a turn passes
+ *  {@link FORCED_OVERRIDE_TURN_LIMIT}. Its own string, never a refusal reason: nothing was refused,
+ *  and `turn.step_boundary`'s `detail.reason` must not say otherwise. */
+export const REPLY_FORCED_LOOP_REASON = "forced-override-repeat";
+
+/** The record's key for one gate's verdict: the audit reason it writes, plus whatever that gate keys
+ *  its own refusal record on. Two gates keying on the same wake still count apart, because the reason
+ *  is half the key. */
+function forcedKey(reason: string, on: string): string {
+  return `${reason}::${on}`;
+}
+
+/**
+ * Record one override of `reason` on `on` in THIS turn, and answer the running count — `1` for the
+ * first. The caller writes its `reply.forced` row only on `1`, and ends the turn at
+ * {@link FORCED_OVERRIDE_TURN_LIMIT}.
+ *
+ * `1` whenever the answer is unknown (no turn id, no key, a full record, any throw) — the fail-soft
+ * direction the section header states: the row is written and no turn is ended on a signal this code
+ * cannot prove.
+ */
+export function noteForcedOverrideThisTurn(turnId: string | undefined, reason: string, on: string | undefined): number {
+  if (turnId === undefined || turnId.length === 0) return 1;
+  if (typeof reason !== "string" || reason.length === 0) return 1;
+  if (typeof on !== "string" || on.length === 0) return 1;
+  const key = forcedKey(reason, on);
+  try {
+    let next = 1;
+    forcedSlot.update((prev) => {
+      const entries = prev !== null && prev.turnId === turnId ? prev.entries : [];
+      const found = entries.find((e) => e.key === key);
+      next = (found?.count ?? 0) + 1;
+      // 🔴 THE CAP EVICTS, IT DOES NOT STOP RECORDING. The sibling sets above stop growing at the cap
+      // and keep REFUSING, so their fail direction is safe. This one's is not: a record that stopped
+      // growing would answer `1` for every new key past the cap forever — a row on every call and a
+      // latch that never arms, which is the unbounded loop this section exists to end, restored at
+      // exactly the turn busy enough to need it. So the oldest entry is dropped instead. `entries` is
+      // append-ordered (the touched key is re-appended below), so index 0 is the least recently
+      // recorded.
+      // 🔴 SAY WHAT THE EVICTION BUYS, AND WHAT IT DOES NOT. A turn that REPEATS one key stays bounded
+      // at two overrides however many other keys it touches, because the repeat re-appends that key and
+      // keeps it out of the eviction window; an evicted key restarts at 1, which costs one extra row and
+      // one extra override before the latch arms. A turn CYCLING more than the cap's worth of distinct
+      // keys round-robin evicts each one before it comes round again, so every call answers 1, the rows
+      // repeat and this latch never arms. That turn is not unbounded — the step boundary's own soft and
+      // hard tiers (model/step-boundary.ts) are still behind it — but THIS arm is not its terminator.
+      const kept = entries.filter((e) => e.key !== key);
+      const room = kept.length >= MAX_DONE_WAKES ? kept.slice(kept.length - MAX_DONE_WAKES + 1) : kept;
+      return { turnId, entries: [...room, { key, count: next }] };
+    });
+    return next;
+  } catch {
+    return 1; // no session context — the gate behaves exactly as it did before this section existed
+  }
+}
+
+// §ARM — WHICH DELIVERY ARM THIS SEAT READS (OPE-1580). The arm answers "how do this seat's words leave a turn", and instructions/access.ts `resolveDeliveryArm` is the one place it is decided. A TOOL cannot decide it: a tool-execute context carries no `channel` object at all (identity/binding.ts `turnOriginPlatform` cites eve's own declaration), so the unified check that picks arm 1 reads `undefined` inside an `execute` and answers FALSE on every call — the shape that failed OPEN in OPE-729.
+// So the resolver STAMPS the arm where it resolves it, and a tool reads it back here. The value is SESSION-scoped rather than turn-keyed on purpose: the arm is byte-stable for the session's life (the token is fixed at mount and the manifest is a boot-time registry row), which is the same property that keeps it out of the prompt cache's way.
+// FAIL-SOFT TO NOTHING, never to a guess: an unstamped session answers `null` and the caller picks its own default. A seat that renders no persona at all (a plain native `@mention` seat) stamps nothing, and `dual-mode` — turn-final text posts and `reply` works — is what is true there.
+
+const armSlot = defineState<string | null>("open-everywhere.seat-delivery-arm", () => null);
+
+/** Record the delivery arm this seat reads. Called by instructions/access.ts when it resolves one. */
+export function markDeliveryArm(kind: string): void {
+  if (typeof kind !== "string" || kind.length === 0) return;
+  try {
+    armSlot.update(() => kind);
+  } catch {
+    /* no session context here — the arm simply stays unknown, and every reader has a default */
+  }
+}
+
+/** The delivery arm this seat reads, or `null` when this session never resolved one. */
+export function peekDeliveryArm(): string | null {
+  try {
+    return armSlot.get();
+  } catch {
+    return null;
+  }
+}
+
+// §REPLIED — every wake THIS turn called `reply` on, `done` or not. It is deliberately NOT §DONE, which records a wake only once it is marked `done:true`, so that set's own same-turn refusal never fires on a wake the model is still working.
+// That narrower scope is the wrong evidence for a different question: did this turn ACT on this wake at all? A hand-off note IS an action, so a diff consulting only §DONE would misreport a genuine multi-part answer as a dropped wake. Fail-soft like every sibling set — nothing downstream of this one gates a tool call, it only feeds a measurement row.
+
+interface RepliedWakes {
+  readonly turnId: string;
+  readonly wakes: readonly string[];
+}
+
+const repliedSlot = defineState<RepliedWakes | null>("open-everywhere.reply-replied-wakes", () => null);
+
+/** Record that THIS turn called `reply` on `wake` — regardless of `done`. No-op without a turn id
+ *  or a wake id, same cap as §DONE/§DECLINED (a looping turn stops growing the set, never starts
+ *  under-recording the wakes already captured). */
+export function markWakeRepliedThisTurn(turnId: string | undefined, wake: string | undefined): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (typeof wake !== "string" || wake.length === 0) return;
+  try {
+    repliedSlot.update((prev) => {
+      const wakes = prev !== null && prev.turnId === turnId ? prev.wakes : [];
+      if (wakes.includes(wake) || wakes.length >= MAX_DONE_WAKES) return { turnId, wakes };
+      return { turnId, wakes: [...wakes, wake] };
+    });
+  } catch {
+    /* no session context here — the set degrades to empty, exactly as the header says */
+  }
+}
+
+/** Every wake THIS turn called `reply` on, `done` or not. Non-consuming, for the same reason
+ *  {@link declinedWakesThisTurn} is: the accounting audit reads it once, at turn end, without
+ *  disturbing any other reader. Empty whenever the answer is unknown. */
+export function repliedWakesThisTurn(turnId: string | undefined): readonly string[] {
+  if (turnId === undefined || turnId.length === 0) return [];
+  try {
+    const cur = repliedSlot.get();
+    return cur !== null && cur.turnId === turnId ? cur.wakes : [];
+  } catch {
+    return [];
+  }
+}
+
+// §REFUSED — the host refusals THIS turn drew, per wake. Its reader is the unified window's dropped-prose branch (`channels/unified.ts`, `proseBlockingRefusal`): a refusal leaves the reply tool having posted nothing, which is the same state an ordinary silent turn leaves, so the record is what tells the two apart. It NAMES the withholding on the drop row (`reason: "refused:<reason>"`) and it SUPPRESSES the one corrective redrive, because nudging the model back towards a tool the host just refused is the host contradicting itself.
+// Per WAKE rather than turn-wide, because a refusal drawn on a coalesced SIBLING wake is a decision about a different room; and the REASON is carried rather than a boolean, because the address refusals say the model named a wake it does not hold, which is a different objection from "this text may not go in this room". FAIL-OPEN in every direction, the cap included: past it the record stops growing and the drop reads as an ordinary one, which is never worse than the behaviour this section replaced.
+
+/** The refusals one turn drew, per wake. Same JSON-survivable shape as {@link DoneWakes} — the
+ *  container is serialized between steps, so a Map or a Set would not survive. */
+interface RefusedWakes {
+  readonly turnId: string;
+  readonly entries: readonly { readonly wake: string; readonly reason: string }[];
+}
+
+const refusedSlot = defineState<RefusedWakes | null>("open-everywhere.reply-refused-wakes", () => null);
+
+/** Record that THIS turn drew refusal `reason` on `wake`. No-op without a turn id, a wake id or a
+ *  reason. Same cap as §DONE/§DECLINED, and a duplicate `(wake, reason)` pair is recorded once — a
+ *  turn that draws the same refusal twice cannot grow the serialized container. */
+export function markWakeRefusedThisTurn(turnId: string | undefined, wake: string | undefined, reason: string): void {
+  if (turnId === undefined || turnId.length === 0) return;
+  if (typeof wake !== "string" || wake.length === 0) return;
+  if (typeof reason !== "string" || reason.length === 0) return;
+  try {
+    refusedSlot.update((prev) => {
+      const entries = prev !== null && prev.turnId === turnId ? prev.entries : [];
+      if (entries.length >= MAX_DONE_WAKES) return { turnId, entries };
+      if (entries.some((e) => e.wake === wake && e.reason === reason)) return { turnId, entries };
+      return { turnId, entries: [...entries, { wake, reason }] };
+    });
+  } catch {
+    /* no session context here — the record degrades to empty, exactly as the header says */
+  }
+}
+
+/** Every refusal reason THIS turn drew on `wake`. Non-consuming, like §DECLINED/§REPLIED: the bridge
+ *  reads it at turn end and must not disturb the reply tool's own same-turn guards. Empty whenever
+ *  the answer is unknown — never a guess. */
+export function refusalsForWakeThisTurn(turnId: string | undefined, wake: string | undefined): readonly string[] {
+  if (turnId === undefined || turnId.length === 0) return [];
+  if (typeof wake !== "string" || wake.length === 0) return [];
+  try {
+    const cur = refusedSlot.get();
+    if (cur === null || cur.turnId !== turnId) return [];
+    return cur.entries.filter((e) => e.wake === wake).map((e) => e.reason);
+  } catch {
+    return [];
+  }
+}