@open-everywhere/core 0.1.0

package/agent/channels/runtime-rotation.ts

@@ -0,0 +1,224 @@
+// runtime-rotation — the PRE-DISPATCH self-heal for a standing seat that runs stale code. A standing seat is ONE eve workflow run, and a workflow run is PINNED to the deployment that created it (`deploymentAffinity`), so every later turn of that seat — and every worker it delegates — executes the MINTING deployment's bundle, however many times the instance has shipped since. An eve bump is the harder face of the same fact: the new runtime cannot read the old run's event log at all, and the strand reaches NO userland seam (channels/session-resume.ts holds the measurement), so the remedy cannot be reactive. The only place OE still holds the wake is each surface's `getOrCreateSession`.
+//
+// 🔴 THE MECHANISM IS A PER-SEAT COMPARISON, NOT A LIFETIME CLAIM (OPE-1821). Each seat's own
+// `channel_session` row records the (code fingerprint, domain fingerprint) pair it was last served
+// with. Every wake compares the RUNNING pair against the stored one and retires the generation when
+// they differ. What that buys, and why the claim it replaced could not:
+//   • A ROLLBACK ROTATES. `npm run rollback` moves the alias back to a deployment that already
+//     served, so its code fingerprint has been seen before. A claim asks "was this key ever used",
+//     and answers "yes" — no seat rotates and every seat keeps running the code the operator rolled
+//     back FROM. A comparison asks "is this different from what the seat last ran", and F1 ≠ F2 both
+//     ways, so the rollback retires exactly the seats the ship retired.
+//   • AN IDENTICAL REDEPLOY ROTATES NOTHING. The deployment id is no longer in the identity at all,
+//     so a redeploy of the same tree, or an env change, costs no seat its working memory.
+//   • ONE DOMAIN'S CHANGE TOUCHES ONE DOMAIN'S SEATS. The code fingerprint excludes the per-domain
+//     declarations and the domain fingerprint carries them, so a config edit rotates the seats it
+//     actually changed.
+//   • NO GLOBAL VALUE IS DERIVED FROM THE STORE. Nothing here reads one org-wide value out of rows
+//     many deployments write, so no seat's verdict depends on what another seat's wake wrote.
+//
+// 🔴 WHAT THIS DOES NOT SURVIVE, AND THE GATE IT LEANS ON. Two bundles serving ONE instance write
+// ONE seat's row and alternate on it. That state is real: after a rollback the alias serves
+// deployment A while the CRON REGISTRATION still points at deployment B, because a Vercel cron is
+// registered against a deployment id and an alias move does not re-point it
+// (scripts/deploy/lib.ts `checkCronDeploymentId`, measured: one project froze on a stale deployment
+// for 22 days across ~50 production deploys). A human wake through A then finds B's fingerprint and
+// rotates; the next cron fire through B finds A's and rotates again; the seat loses its working
+// memory on every message for as long as the split lasts. The per-deployment claim this replaced
+// bounded that to one rotation per bundle.
+// 🔴 NOTHING CLOSES THIS AUTOMATICALLY, AND THE DETECTOR DOES NOT RUN ON THE PATH THAT OPENS IT.
+// `checkCronDeploymentId` reaches production through `runCronCheck`, whose ONE caller is
+// `scripts/deploy/verify.ts` — that is `npm run deploy:verify`, which an operator runs AFTER a
+// deploy. `scripts/deploy/rollback.ts`, the command that CREATES the split, never calls it. And
+// `runCronCheck` returns `{ ran: false, ok: true }` — a warning, not a failure — when there is no
+// Vercel API token, no resolvable project, or a non-200 from the API, so on a machine without
+// `OE_VERCEL_API_TOKEN` it reports green having checked nothing. So an operator who rolls back must
+// run a fresh `vercel deploy --prod` on their own initiative; the split otherwise stands until
+// someone happens to deploy. An identity that CONVERGES under two
+// writers needs a design choice this mechanism does not hold — it is tracked on OPE-1829, because
+// the obvious convergent shape (rotate only onto a NEWER build) gives up "a rollback rotates", which
+// is the whole of OPE-1821.
+//
+// The comparison and the write are ONE conditional statement in the store
+// (`stampChannelSessionRuntime`), so two concurrent wakes on one stale seat retire its generation
+// ONCE. A read-then-write here could not give that.
+
+import { appendAudit } from "../audit/audit.js";
+import { domainFingerprintForSeat } from "./domain-fingerprint.js";
+import { getOperationalStore } from "../operational/provider.js";
+import type { OperationalStore } from "../operational/store.js";
+import { RUNTIME_CODE_FINGERPRINT_SOURCE } from "./runtime-code-fingerprint.generated.js";
+
+/**
+ * The eve build this bundle was compiled against — one half of the running code fingerprint.
+ * Keep it EQUAL to the `eve` version the package.json files pin: `lint:eve-patch` fails the tree when they disagree. Never replace it with a runtime read of `eve/package.json`, which is not resolvable in the hosted bundle.
+ */
+export const EVE_RUNTIME_VERSION = "0.54.3";
+
+/**
+ * The deployment this bundle is serving under. It is NOT part of any rotation identity any more — a
+ * deployment id moves on a redeploy of identical code and moves BACK on a rollback, so it answers
+ * the wrong question. It stays as a FACT on the audit row, which is where an operator reading an
+ * incident asks "which deployment was serving when this seat rotated".
+ * `VERCEL_DEPLOYMENT_ID` is a Vercel-injected platform fact (scripts/env-read-allowlist.ts), read
+ * ONCE at module load, the same posture `agent/agent.ts`'s `readDeploymentSha()` takes for
+ * `VERCEL_GIT_COMMIT_SHA`. It is infra, not config, so the "all config lives in Git" rule is untouched.
+ * Off Vercel (`eve dev`, a test) the var is unset and this reads `local`.
+ */
+export const RUNTIME_DEPLOYMENT_ID: string = (process.env.VERCEL_DEPLOYMENT_ID ?? "").trim() || "local";
+
+// A hosted function with no deployment id no longer breaks rotation — the identity does not read
+// it — but it DOES blind the audit row, which is the only record of which deployment retired a
+// generation. `VERCEL` is set on every Vercel runtime, so the combination is a platform fault worth
+// one line in the log. A warning and not a throw: refusing the wake would cost the conversation
+// more than an under-labelled audit row does.
+if (RUNTIME_DEPLOYMENT_ID === "local" && (process.env.VERCEL ?? "").trim().length > 0) {
+  console.warn(
+    "[open-everywhere:runtime-rotation] VERCEL is set but VERCEL_DEPLOYMENT_ID is empty — every rotation audit row will name the deployment `local`",
+  );
+}
+
+/**
+ * The fingerprint of the code this bundle IS, prefixed by the eve build. The hash covers every
+ * tracked `.ts` under the runtime roots except the per-domain declarations, the materialised eve
+ * slot tree and the tests, plus `roster.config.ts`, `roster.lock.json` and `agent/instructions.md`
+ * (packages/core/scripts/runtime-code-fingerprint-generate.ts states each exclusion and why).
+ * It is not a hash of everything a deploy can change: a dependency bump in a `package.json` moves no
+ * fingerprint, and neither does a change under `docs/`.
+ * 🔴 THE EVE VERSION IS IN IT BECAUSE AN EVE BUMP IS THE HARDER STRANDING. The new runtime cannot
+ * read the old run's event log at all, and `EVE_RUNTIME_VERSION` is a hand-maintained constant that
+ * a pure source hash would otherwise cover only by accident — the version lives in package.json
+ * files, which are not under the hashed roots.
+ */
+export const RUNTIME_CODE_FINGERPRINT = `${EVE_RUNTIME_VERSION}:${RUNTIME_CODE_FINGERPRINT_SOURCE}`;
+
+/** The durable audit action for "OE retired a standing seat's generation because the code under it
+ *  changed". Actions-only log: one row per retirement, and it is the ONE record that a generation's
+ *  context was dropped on purpose rather than lost. */
+export const RUNTIME_ROTATION_AUDIT_ACTION = "session.runtime_rotation";
+
+/** No acting human — the deploy is the actor — so a synthetic, low-cardinality service identity,
+ *  the same posture routines/fire-audit.ts and channels/session-park.ts take. */
+export const RUNTIME_ROTATION_PRINCIPAL = "oe:deploy";
+
+/** The injectable edges. A caller that drives the seat against its own store must drive the
+ *  comparison against the SAME one, or the heal reads a different table than the seat lives in.
+ *  The two fingerprints are injectable so a test can express a ship, a rollback and a one-domain
+ *  edit as plain values, without a second module instance or a mutated environment. */
+export interface RuntimeRotationDeps {
+  readonly store?: Pick<OperationalStore, "stampChannelSessionRuntime">;
+  /** Live default: {@link RUNTIME_CODE_FINGERPRINT}. */
+  readonly codeFingerprint?: string;
+  /** Live default: {@link domainFingerprintForSeat} over the scope's grain. */
+  readonly domainFingerprint?: string;
+}
+
+export interface RuntimeRotationScope {
+  readonly org: string;
+  /** The `channel_session` row this seat's generation lives in (unified-supervisor.ts
+   *  `unifiedDomainSessionKey` / `dmWindowRegistryKey`, or a per-container surface key). It is the
+   *  row the pair is compared against, so the comparison is per-seat by construction. */
+  readonly registryKey: string;
+  /** The woken channel's fully-qualified `platform/workspace/surface` key — the audit row's
+   *  partition. The registry key is often synthetic (`oe-domain::<windowId>`) and cannot supply it. */
+  readonly surfaceKey: string;
+  /**
+   * 🔴 The domain this SEAT is grained by (`SupervisorGrain.domainName`), present exactly when the
+   * registry key is the synthetic domain key. It is what the domain half of the fingerprint is
+   * resolved from, and it must be a property of the SEAT and not of the wake: one window row serves
+   * many surfaces (a Discord thread and its parent channel, every channel of a cross-surface
+   * domain), so resolving from `surfaceKey` would give one row two fingerprints and the two wakes
+   * would rotate each other's generation away on every message.
+   * ABSENT on a per-container seat, where the registry key IS the surface key and resolving from the
+   * surface is the same thing; and on a DM seat, whose `oe-dm/` pseudo-domain no config declares.
+   */
+  readonly domainName?: string;
+  readonly atIso: string;
+}
+
+/**
+ * Does this seat run stale code? TRUE means the pair on the seat's row differs from the running pair AND this wake won the swap, so the caller MUST rotate before it delivers.
+ * Fail-soft to FALSE on any store error, and on a domain declaration this process cannot read: neither proves the code changed, and treating either as "rotate" would retire a healthy generation on a store blip, every wake, until it cleared.
+ * A row that carries NO pair is ADOPTED rather than rotated (store.ts ChannelSessionRuntimeStamp): rotating on absence would retire the seat's first generation on its second wake, and absence proves nothing about the code that generation runs. Absence means the row was written BEFORE these columns existed — {@link stampMintedRuntime} stamps every row this build mints, so a fresh mint is never NULL.
+ */
+export async function claimRuntimeRotation(scope: RuntimeRotationScope, deps: RuntimeRotationDeps = {}): Promise<boolean> {
+  const codeFingerprint = deps.codeFingerprint ?? RUNTIME_CODE_FINGERPRINT;
+  const domainFingerprint = deps.domainFingerprint ?? domainFingerprintForSeat(scope.domainName, scope.surfaceKey);
+  if (domainFingerprint === undefined) return false; // the config could not be read — domain-fingerprint.ts warned
+
+  const store = deps.store ?? getOperationalStore();
+  let stamp;
+  try {
+    stamp = await store.stampChannelSessionRuntime(scope.org, scope.registryKey, codeFingerprint, domainFingerprint);
+  } catch (err) {
+    console.warn(`[open-everywhere:runtime-rotation] comparison failed for ${scope.registryKey}: ${String(err)} — resuming the current generation`);
+    return false;
+  }
+  if (stamp.outcome !== "rotate") return false;
+
+  // WHICH half moved, for the operator reading the row. Both halves can move at once: a deploy that
+  // ships code AND edits one domain's declaration retires that domain's seats with `changed: "both"`.
+  const codeChanged = stamp.previousCodeFingerprint !== codeFingerprint;
+  const domainChanged = stamp.previousDomainFingerprint !== domainFingerprint;
+  const changed = codeChanged && domainChanged ? "both" : codeChanged ? "code" : "domain";
+
+  // `platform/workspace/surface`, the split every audit-writing core module makes locally.
+  // An odd key degrades to empty segments rather than dropping the row: an under-labelled row still says a generation was retired.
+  const [platform = "", workspace = "", ...rest] = scope.surfaceKey.split("/");
+  await appendAudit({
+    org: scope.org,
+    platform,
+    workspace,
+    surface: rest.join("/"),
+    principalId: RUNTIME_ROTATION_PRINCIPAL,
+    action: RUNTIME_ROTATION_AUDIT_ACTION,
+    detail: {
+      registryKey: scope.registryKey,
+      changed,
+      codeFingerprint,
+      domainFingerprint,
+      previousCodeFingerprint: stamp.previousCodeFingerprint,
+      previousDomainFingerprint: stamp.previousDomainFingerprint,
+      eveVersion: EVE_RUNTIME_VERSION,
+      deploymentId: RUNTIME_DEPLOYMENT_ID,
+      note:
+        "the code under this seat, or its domain's declaration, differs from what the seat was last served with, so the seat was still running the code it was minted under (and OE cannot prove the session is resumable across an eve bump) — " +
+        "the generation was retired and this wake goes to a fresh one. The retired generation's in-context state " +
+        "(working memory) is gone; the recorded conversation tail and durable memory are not.",
+    },
+  }).catch(() => undefined);
+
+  return true;
+}
+
+/**
+ * Stamp the running pair onto a row THIS build just minted, so the seat's next wake compares
+ * against the code that generation actually runs.
+ *
+ * 🔴 WITHOUT THIS THE FEATURE HAS A HOLE, and it is the stranding OPE-1751/OPE-1821 exist to close.
+ * `rotateChannelSession` leaves the pair out of its INSERT column list, so a minted row starts NULL.
+ * A seat minted on deployment A, woken next through deployment B, would read NULL, take the
+ * ADOPTED arm, write B's pair and rotate NOTHING — while its workflow run is still pinned to A's
+ * bundle. Every later wake then reads `current`, so the seat runs A's code until some LATER ship
+ * happens to move the pair again. If the ship it missed was the eve bump, that next wake is
+ * delivered into a session the new runtime cannot read, and no wake ever rotates it back.
+ *
+ * Call it on the MINT arm only — the rotate arm keeps the pair the pre-dispatch stamp just wrote.
+ * It is a no-op (`current`) if called on a row that already carries this pair, so a caller that
+ * cannot cheaply tell the two arms apart may call it on both.
+ *
+ * NOT atomic with the mint, deliberately: a crash between the two leaves the row NULL, which is
+ * exactly today's behaviour and rotates nothing — the fail-soft direction every other edge here
+ * takes. The pair is never compared against, only written, so the outcome is discarded.
+ */
+export async function stampMintedRuntime(scope: RuntimeRotationScope, deps: RuntimeRotationDeps = {}): Promise<void> {
+  const codeFingerprint = deps.codeFingerprint ?? RUNTIME_CODE_FINGERPRINT;
+  const domainFingerprint = deps.domainFingerprint ?? domainFingerprintForSeat(scope.domainName, scope.surfaceKey);
+  if (domainFingerprint === undefined) return; // the config could not be read — leave the row NULL rather than stamp a half-pair
+  const store = deps.store ?? getOperationalStore();
+  try {
+    await store.stampChannelSessionRuntime(scope.org, scope.registryKey, codeFingerprint, domainFingerprint);
+  } catch (err) {
+    console.warn(`[open-everywhere:runtime-rotation] mint stamp failed for ${scope.registryKey}: ${String(err)} — the seat adopts on its next wake`);
+  }
+}

package/agent/channels/seat-admission.ts

@@ -0,0 +1,103 @@
+// seat-admission — WHAT ENTERS a standing seat's context, as a NAMED FUNCTION the domain selects (OPE-1695 (a)). A seat now stands in every channel the bot is in, so the question "which messages does this seat get to see" stopped being answerable by a flag: it is a per-domain POLICY, and this module holds the deterministic code each policy name resolves to.
+// 🔴 A NAME SELECTS CODE, NOT A MODE. `Domain.admission` names one function in {@link SEAT_ADMISSION_FUNCTIONS}; the function decides per message. A deployment that wants a policy this registry has no name for adds the function HERE, in typed code, by PR — the same rule that keeps a roster out of env (AGENTS.md § security). Config load refuses an unknown name fail-loud, so a typo is never a silent widening.
+// SCOPE — ENTRY, NEVER THE WAKE. Admission decides which messages are RENDERED into a wake the seat is already taking, and decides nothing about whether the seat wakes at all: that is the ambient flag's job (the host chattiness switch, OPE-1695 (c)) plus addressing. Keeping the two apart is what lets a room be addressed-only and still hand its seat the full room context on the wakes it does take.
+
+import type { WakeMessageSender, WakeTrust } from "./wake-envelope.js";
+import type { ContextLine } from "./context-render.js";
+
+/**
+ * One candidate message, in the least-common-denominator vocabulary every surface already normalizes into ({@link NormalizedMessage} in channels/backscroll-window.ts, {@link WakeMessageInput} in channels/wake-envelope.ts).
+ * It carries only what a policy may judge on: WHO wrote it (`sender`), what the trust plane resolved for that author (`trust`), and WHERE in the container it sits (`type`). Deliberately NOT the text — an admission function that read the body would be a classifier, and the ruling asks for deterministic code.
+ */
+export interface SeatAdmissionCandidate {
+  /** Who wrote it, in the envelope's own vocabulary ({@link WakeMessageSender}): `human` = a person,
+   *  `self` = this bot's own prior post, `agent` = another OE session, `system` = a harness line,
+   *  `bot` = an ATTRIBUTABLE foreign bot. A surface's normalized fetch shape emits the first, second
+   *  and last of those; the other two reach a policy only through an already-rendered feed. */
+  readonly sender: WakeMessageSender;
+  /** The tier the trust plane resolved for this author (identity/wake-trust.ts). A machine author
+   *  resolves `relay`; an unvouched or unidentifiable person resolves `unauth`. */
+  readonly trust: WakeTrust;
+  /** `channel` = a top-level message, `thread` = a reply inside a thread. */
+  readonly type: "channel" | "thread";
+  /** The raw platform author id, where the surface's normalized read carries one — the same field
+   *  {@link NormalizedMessage.authorId} holds, so the fetch shape passes through unchanged.
+   *  🔴 NO REGISTERED POLICY READS IT, and none may: a policy that judged an identity would stop
+   *  being goldenable from its name. It is here for the ONE caller-side wrapper that does judge an
+   *  identity — the e2e driver carve-out in channels/seat-catch-up.ts — which is config-scoped,
+   *  surface-scoped (workspace-scoped too on Slack) and declared, rather than a policy. Absent for the seat's own posts, and absent
+   *  wherever a surface cannot attribute an author. */
+  readonly authorId?: string;
+}
+
+/** A deterministic admission policy: does this message enter the seat's context? Pure — no I/O, no
+ *  config read, no clock — so every policy is goldenable from its name alone. */
+export type SeatAdmissionFn = (candidate: SeatAdmissionCandidate) => boolean;
+
+/** The policy name a domain that declares none resolves to. WIDE by ruling (Tommy, 2026-09-11):
+ *  a seat that misses the room's own conversation is worse than a seat that reads all of it. */
+export const DEFAULT_ADMISSION = "wide";
+
+/**
+ * The registered admission policies, by name. Each is stated as "what enters", never as "what is refused", because the row a deployer reads in the settings reference is the ENTRY rule.
+ *  • `wide` — DEFAULT. Every person's message at any trust tier, the seat's own prior posts, another OE session's relay and the harness's own lines. A foreign bot does NOT enter: a bot's traffic is usually its own machine chatter, and a domain that wants it says so by name.
+ *  • `wide-with-bots` — `wide`, plus an ATTRIBUTABLE foreign bot at the `relay` tier. This is the "bot messages admitted under a trust tier" arm of the ruling: the tier is the floor, so a bot an adapter could not attribute is dropped one layer earlier and never reaches a policy, and an attributed one can arrive as nothing but `relay`.
+ *  • `members-only` — people the trust plane POSITIVELY vouched (`principal` / `peer`), plus the machine authors the deployment itself produced (`self`, `agent`, `system`). A guest, a Slack Connect stranger or any unresolvable person (`unauth`) stays out, and so does every foreign bot. For a room that holds external participants and a seat that must not read their words.
+ * 🔴 FROZEN AT MODULE LOAD, and not a registration seam. The config-load validation reads these names, and a register populated by a separate boot import would race that read — the exact failure the vouch register documents (memory/domain.ts assertWindowSourcesVouched).
+ */
+export const SEAT_ADMISSION_FUNCTIONS: ReadonlyMap<string, SeatAdmissionFn> = new Map<string, SeatAdmissionFn>([
+  ["wide", (c) => c.sender !== "bot"],
+  ["wide-with-bots", (c) => c.sender !== "bot" || c.trust === "relay"],
+  ["members-only", (c) => (c.sender !== "bot" && c.sender !== "human") || (c.sender === "human" && (c.trust === "principal" || c.trust === "peer"))],
+]);
+
+/** Every registered policy name, in declaration order — for a config refusal that lists the legal
+ *  values, and for the generated settings row. */
+export function admissionFunctionNames(): readonly string[] {
+  return [...SEAT_ADMISSION_FUNCTIONS.keys()];
+}
+
+/** Is `name` a registered policy? The config-load validation's predicate (memory/domain.ts
+ *  assertDomainsValid), so an unknown name fails LOUD at load rather than silently at a wake. */
+export function isAdmissionFunctionName(name: unknown): name is string {
+  return typeof name === "string" && SEAT_ADMISSION_FUNCTIONS.has(name);
+}
+
+/**
+ * The policy function for a name. FAIL-SOFT TO THE DEFAULT, deliberately, and it is not a second gate: config load already refused every unknown name, so reaching the fallback means the config was registered by a path that skipped validation (a test double, a library embed). Widening to `wide` there matches what a domain that declared nothing gets, which is the pre-feature behaviour — a fail-closed "admit nothing" would instead blind a live seat on a config edge.
+ */
+export function admissionFunction(name: string | undefined): SeatAdmissionFn {
+  return (name !== undefined ? SEAT_ADMISSION_FUNCTIONS.get(name) : undefined) ?? SEAT_ADMISSION_FUNCTIONS.get(DEFAULT_ADMISSION)!;
+}
+
+/**
+ * Apply a policy to a catch-up window, keeping order. The ONE application site's shape: filter, then let the caller cap — never the reverse, or a refused bot's bytes would eat a person's message out of the cap.
+ * Pure and generic over anything that carries the candidate fields, so both the normalized fetch shape and the rendered wake shape pass through it unchanged.
+ */
+export function admitToSeat<T extends SeatAdmissionCandidate>(messages: readonly T[], admit: SeatAdmissionFn): T[] {
+  return messages.filter((m) => admit(m));
+}
+
+/**
+ * Map one RENDERED context line ({@link ContextLine}, the shape every surface's name-drop hydration produces) onto the admission vocabulary. The ONE mapping, here rather than per bundle, so a second surface's hydration TAKES this seam instead of growing a copy (OPE-1742).
+ * 🔴 FOUR SURFACES TAKE IT (OPE-1800): Slack's name-drop hydration (slack-events.ts, `deps.seatRoute` present), BOTH of Discord's hydration roads (discord-gateway.ts `admitDiscordSeatLines`), and the GitHub and Linear supervisor wakes, whose slot holds one host-composed issue-title line (github-supervisor.ts / linear-supervisor.ts). Teams and Notion fill the slot on no road, so neither has a gap.
+ * 🔴 THE SEAT DECIDES, NEVER THE ROAD. `admission` is the STANDING SEAT's entry policy by declaration, so the question is only "does this room have a seat" — `grainUsesUnifiedWindow` on the room's own grain, the predicate Slack resolves `seated` from. A wake that falls through to a native per-channel road because its seat STOOD DOWN (on Discord, an unvouched guild) is a seat stood down, not an unseated room: access/window-routing.ts names that state `native-degraded` and audits it. Reading it as "no seat" would give one domain TWO admission answers, chosen by a runtime vouch.
+ * 🔴 A ROOM WITH NO SEAT AT ALL IS OUTSIDE THIS — `window.topology` unarmed, or no seat domain reaches it. Its native wake keeps the whole hydration, which is the only context such a wake carries, and `wide` would strip its attributable-bot lines. The withhold transform is a SEPARATE mechanism and still does not reach Discord's slot (access/external-policy.ts `withholdWakeBodies`).
+ * 🔴 TWO FAIL-CLOSED CHOICES, and each one is what decides whether `members-only` holds:
+ *  • `senderType: "unknown"` maps to a `human` at `unauth`, NEVER to `system`. A line the surface could not attribute is a person it could not vouch; `system` means a harness line OE itself wrote, and every policy admits those. The same posture the Slack fetch's own visibility gate takes (slack-wake-backscroll.ts isBackscrollVisible drops an unattributable sender).
+ *  • an UNGRADED line (`trust` absent — legal, because a surface's regrade step is a caller-side addition) floors PER SENDER, the same fail-closed default backscroll-window.ts {@link fetchedBackscroll} applies when no resolver is wired: a person floors at `unauth`, a machine author at `relay`. So a caller that admits BEFORE it grades refuses every human line rather than admitting one it never checked — and a `wide-with-bots` domain still gets the attributable bots it asked for, since a surface's regrade grades people and never machine authors.
+ * `type` comes from the CALLER, because a ContextLine carries no container position: the hydration's thread leg reads `thread`, its channel leg `channel`.
+ */
+function contextLineAdmission(line: ContextLine, type: "channel" | "thread"): SeatAdmissionCandidate {
+  const sender: WakeMessageSender = line.senderType === "agent" ? "self" : line.senderType === "bot" ? "bot" : "human";
+  const trust: WakeTrust = line.trust ?? (sender === "human" ? "unauth" : "relay");
+  return { sender, trust, type, ...(line.senderId ? { authorId: line.senderId } : {}) };
+}
+
+/**
+ * Apply a policy to a name-drop hydration's rendered lines, keeping order — the {@link admitToSeat} of the CONTEXT-LINE slot, and the only policed way into it.
+ * 🔴 GRADE FIRST, THEN ADMIT, THEN CAP — the order backscroll-window.ts {@link fetchedBackscroll} already fixes for the bootstrap and catch-up reads. The policy judges the RESOLVED trust tier, so a caller that has a per-author regrade must run it before this call; {@link contextLineAdmission} floors an ungraded PERSON at `unauth` rather than guessing upward, and an ungraded machine author at its own `relay` tier.
+ */
+export function admitContextLines(lines: readonly ContextLine[], admit: SeatAdmissionFn, type: "channel" | "thread"): ContextLine[] {
+  return lines.filter((l) => admit(contextLineAdmission(l, type)));
+}