@open-everywhere/provider-notion 0.1.0

package/agent/channels/notion-supervisor.ts

@@ -0,0 +1,856 @@
+// The Notion ambient supervisor — the eve-FREE tested core that turns every comment on a
+// connected doc into a JUDGED wake to a standing per-doc supervisor session (the "agent lives in
+// the doc" UX, notion-ambient-surface-design.md). It is the first NON-Slack adopter of the
+// surface-general ambient-supervision pattern (surface-adapter-port.md §"Ambient supervision
+// everywhere"), so it is deliberately THIN and mirrors the Slack routeSupervisorEvent shape
+// (slack-events.ts) — GitHub/Linear copy this file next.
+//
+// WHAT'S REUSED WHOLESALE (zero Notion-specific logic in any of it):
+//   • renderWake + the channel-watch preamble (the judge) — normalized-wake.ts
+//   • shouldRotate — the pure rotation policy — slack-events.ts
+//   • the (org, surfaceKey) channel_session registry + the :oe-sup:g spend counter — via deps
+// WHAT'S NEW (this file): the supervisor token/sentinel carrying the :oe-sup:g infix, a pure
+// classifier (self / bot / unresolved-fail-closed / @mention / ambient), the NormalizedWake
+// builder, and the dispatch-core (session get-or-create → build → wake).
+//
+// The Notion doc-session is the container-session's ORCHESTRATION HALF ONLY (surface-adapter-port
+// §"container session"): a page-scoped standing session aware of all the doc's discussions,
+// holding page memory, that judges every comment and replies into the triggering discussion.
+// There is NO container-conversation half — a Notion doc has no top-level conversation to post to.
+
+import {
+  spreadVendorTs,
+  type VendorEventTime,
+  renderWake,
+  mkMessageTrigger,
+  shouldRotate,
+  mintWakeId,
+  singleWindowMentionPolicy,
+  matchesAgentName,
+  stampNonMemberChatAuth,
+  resolveExternalPolicy,
+  withholdsBody,
+  withholdWakeBodies,
+  ingestedAfterWithholding,
+  type ExternalPolicy,
+  type IngestedChatMessage,
+  type NormalizedWake,
+  type WakeEngagementTier,
+  type WakeMessageInput,
+  type WakeTrust,
+  type UnifiedWindowWake,
+  tailAuthorGrain,
+  type SessionTailWakeRow,
+  seatCatchUpSinceMs,
+  type SeatCatchUpRequest,
+  type SeatCatchUpResult,
+  engagedFollowUpContract,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { mentionsUser, richTextToPlainText, type NotionComment } from "./notion-api.js";
+import type { NotionOwnBotIds } from "./notion-bot-user.js";
+import type { OpenEverywhereNotionAuth } from "./notion-identity.js";
+import type { NotionDeliveryTrust } from "./notion-ancestry-trust.js";
+import type { NotionSessionState } from "./notion-webhook.js";
+import type { NotionVia } from "./notion-scope.js";
+// The §2.5 engagement writer (OPE-1501). A VALUE import, not a type — the dispatch core calls it as
+// the default for `NotionSupervisorDeps.markEngaged`. `notion-engagement.ts` imports only
+// `notion-identity.ts` and core, so this adds no cycle.
+import { markNotionEngaged, type NotionSeamFacts } from "./notion-engagement.js";
+
+/** The catch-up's REACHBACK FLOOR (hours): how far back a seat that has been quiet for a long time
+ *  reads. 7 days, the same floor every other surface uses. */
+const NOTION_CATCH_UP_REACHBACK_HOURS = 168;
+
+// --- supervisor token / sentinel (carry the :oe-sup:g infix — load-bearing) ----------
+//
+// hooks/spend.ts isSupervisorToken keys off the `:oe-sup:g` substring to (a) tag the usage-event
+// `kind="supervisor"` and (b) drive the per-generation cumulative-token rotation counter. Carry
+// the infix and the ENTIRE cost/rotation apparatus works for free (design §3.1). The sentinel
+// mirrors Slack's; the token puts the pageId in the channel-id slot, `notion:`-namespaced.
+
+/** The reserved pseudo-thread sentinel for a supervisor generation (mirrors Slack's). */
+export function notionSupervisorSentinel(generation: number): string {
+  return `oe-sup:g${generation}`;
+}
+
+/** The reserved continuation token for a page's supervisor session at a given generation:
+ *  `notion:<pageId>:oe-sup:g<generation>`. Contains the `:oe-sup:g` infix hooks/spend.ts keys on,
+ *  and is stable+explicit by construction (a custom-channel token eve never re-anchors — so,
+ *  UNLIKE Slack, no non-empty state.threadTs re-anchor sentinel is needed; design §3.1). */
+export function notionSupervisorToken(pageId: string, generation: number): string {
+  return `notion:${pageId}:${notionSupervisorSentinel(generation)}`;
+}
+
+// UNIFIED cross-surface dispatch (formerly TODO(unified-dispatch) — wired 2026-07-11), same shape
+// as the Slack reference wiring (channels/slack-events.ts liveSupervisorDeps): when the page's
+// domain has opted in (both gates on), the LIVE deps in notion.ts key the registry ROW + TOKEN by
+// `(org, domain)` via channels/unified-supervisor.ts supervisorGrainFor/supervisorTokenForGrain, so
+// a Notion comment dispatches into the domain's SHARED session, and this core stamps
+// `<channel platform="notion">` + the P5 disclosure on the judged wake (`unified` on the dispatch
+// input; a `direct` wake renders no envelope, so the stamp is judged-path-only by construction).
+// Gated → byte-identical off. The REPLY leg was per-wake already (createCommentReply targets the
+// turn.started snapshot's discussionId), and the unified path additionally passes the terminal
+// completion through the message-tool-only silence gate in notion.ts (Notion has a WORKING `reply`
+// tool on supervisor turns, so terminal prose is dropped there — the OpenClaw-steal hard gate).
+// See unified-supervisor.ts's cross-surface-reply header for the whole model + the eve
+// session-namespacing caveat.
+
+// --- the classifier (pure) -----------------------------------------------------------
+
+/** How a comment addresses the doc supervisor. `drop` = never wake (loop/bot guards); `direct` =
+ *  a structured bot @mention, the guaranteed-engage conversation-driver treatment; `channel-watch`
+ *  = judged by the standing supervisor (the ambient default — most comments). */
+export type NotionAddressing = "direct" | "channel-watch" | "drop";
+
+export interface NotionClassification {
+  readonly addressing: NotionAddressing;
+  readonly reason: string;
+}
+
+/**
+ * The Notion synthetic-mention (name-drop) convention. Notion CANNOT @mention an internal
+ * integration (notion-webhook.ts — the structured `mentionsUser` path is STRUCTURALLY DEAD for the
+ * agent), so a person addresses the doc agent by NAME instead: the deployment's configured names
+ * (OE_AGENT_NAME / OE_AGENT_SHORT_NAME, defaulting to the brand "open everywhere" / "oe" when unset)
+ * or the platform-resolved integration name (botName). This is the ONLY ambient-INDEPENDENT directed
+ * input Notion has, so — unlike Slack/GitHub/Linear, where a name-drop stays a judged input because a
+ * real @mention is available — here it is promoted to `direct`.
+ *
+ * The name set + word-boundary matcher live in core (identity/bot-name.ts matchesAgentName), which
+ * is ALSO what the addressed link-claim recogniser strips its leading token with (hooks/link-claim.ts)
+ * — one source of truth for "what does this agent answer to". Word-boundary matched (`\b`) so the
+ * short "oe" token never fires inside "Zoe"/"poet"/"does". A hit flows through the SAME seam a real
+ * @mention would: planNotionSingleWindow stamps `direct-mention`, which marks the wake as OWED a
+ * reply and tells the seat so. 🔴 THE STAMP DELIVERS NOTHING BY ITSELF (OPE-1982): the terminal-prose
+ * bridge it used to arm is deleted, so the reply lands via createCommentReply only when the seat
+ * calls `reply` — on its own turn, or on the ONE corrective re-drive a prose ending earns.
+ */
+export function notionNameDrop(text: string, botName?: string): boolean {
+  return matchesAgentName(text, botName);
+}
+
+/**
+ * Decide how the doc supervisor should treat one comment. The self-reply loop guard is HARDENED
+ * here (design §4.2), in cost order:
+ *  1. UNRESOLVED PRIMARY bot user id ⇒ DROP (fail closed) — self-identity is a precondition for the
+ *     loop guard; without it the agent would loop on its own replies (each createCommentReply fires a
+ *     fresh comment.created). This is the critical hardening over the old `if (botUserId && …)`.
+ *  2. SELF-authored ⇒ DROP — our own posted reply. The comparison is `created_by.id` against
+ *     {@link NotionOwnBotIds.all}: EVERY configured integration's bot user id, not only the one that
+ *     verified this delivery (OPE-1921). THAT IS THE WHOLE GUARD.
+ *     🔴 THE SET IS WHAT MAKES IT A GUARD ON A DEPLOYMENT RATHER THAN ON ONE INTEGRATION. Two
+ *     integrations can both see one page, so a reply integration A posted is delivered on B's
+ *     subscription too. Compared against B's id alone it matched nothing, read as a person and woke
+ *     a turn; A's subscription then saw B's answer. Each reply is a NEW comment id, so the OPE-1906
+ *     once-guard cannot bound that loop — only recognising our own words can.
+ *  3. UNIDENTIFIED AUTHOR (no `created_by.id`) ⇒ DROP (fail closed) — step 2 is the only check that
+ *     can recognise our own words, so a comment whose author id we cannot read defeats it.
+ *     🔴 WITHOUT THIS STEP THE GUARD FALLS BACK ON `created_by.type`, A FIELD NOTION MAY OMIT
+ *     (OPE-1857, notion-api.ts NotionComment): a comment's `created_by` is a PARTIAL user, so an
+ *     id-less author reached step 4 with nothing to test, read as a person, and woke a turn. That
+ *     is the same fail-closed posture step 1 takes for the other half of the comparison — an
+ *     identity we cannot establish never wakes the agent, in EITHER direction.
+ *  4. BOT/integration-authored (created_by.type present and not "person") ⇒ DROP — the Slack
+ *     authorIsBot analog, prevents bot-to-bot loops. A BACKSTOP for a foreign bot, never the
+ *     self-guard: an ABSENT `type` says nothing, and steps 2-3 have already answered "is it ours".
+ *  5. INCOMPLETE OWN-ID SET ⇒ DROP (fail closed, OPE-1921) — one configured integration's bot user
+ *     id did not resolve, so step 2 could not have recognised that integration's own reply. An
+ *     author Notion states is a `person` is still admitted; an author it says NOTHING about is
+ *     exactly the ambiguity the loop rides, so it drops.
+ *     🔴 IT COSTS AVAILABILITY AND THE TRADE IS DELIBERATE — see {@link NotionOwnBotIds.complete}.
+ *     A deployment that cannot resolve one integration's id is deaf to every comment Notion does not
+ *     mark `person`-authored until it can. 🔴 THAT IS NOT ONLY AMBIENT CHATTER: this step sits ABOVE
+ *     steps 6 and 7, so an addressed structured @mention, an addressed name-drop and an
+ *     `oe link <code>` identity claim all drop with it. Failing OPEN instead buys an unbounded reply
+ *     loop between two of our own integrations, which no once-guard can stop.
+ *  6. STRUCTURED bot @mention ⇒ direct (guaranteed engage). Structurally unreachable for an
+ *     internal integration today, but kept as the canonical addressed signal. Tested against the
+ *     PRIMARY id alone: a structured mention names ONE bot user, and answering a mention of a
+ *     sibling integration would put this integration in a conversation it was not addressed in.
+ *  7. NAME-DROP ⇒ direct ({@link notionNameDrop}). Notion's ONLY addressed path (no integration
+ *     @mention), so a brand/name hit is promoted to the owed-a-reply treatment, not left as a
+ *     judged input — this is the deliberate Notion-specific divergence from Slack/GitHub/Linear.
+ *  8. otherwise ⇒ channel-watch (judged by the standing doc supervisor).
+ *
+ * 🔴 THIS FUNCTION GUARDS ONE COMMENT, NOT ONE WAKE. It cannot tell a second delivery of the SAME
+ * comment from the first, because both carry identical bytes. The delivery once-guard is the other
+ * half of the loop defence and lives at the ingress
+ * (notion-engagement.ts `firstNotionDispatchOfComment`, called by notion-webhook.ts).
+ */
+export function classifyNotionComment(comment: NotionComment, own: NotionOwnBotIds, botName?: string): NotionClassification {
+  if (!own.primary) return { addressing: "drop", reason: "unresolved bot user id — fail-closed loop guard" };
+  const author = comment.created_by;
+  if (author?.id !== undefined && own.all.has(author.id)) {
+    // The two are named apart because they send an operator to different places: our own reply
+    // coming back is ordinary, and a SIBLING integration's reply arriving here is the OPE-1921
+    // delivery shape — the one that used to wake a turn.
+    const sibling = author.id !== own.primary;
+    return { addressing: "drop", reason: sibling ? "self-authored comment (a sibling integration of this deployment)" : "self-authored comment (our own reply)" };
+  }
+  if (!author?.id) return { addressing: "drop", reason: "unidentified author (no created_by.id) — fail-closed loop guard" };
+  if (author.type && author.type !== "person") return { addressing: "drop", reason: `bot/integration-authored (${author.type})` };
+  if (!own.complete && author.type !== "person") {
+    return { addressing: "drop", reason: "a configured integration's bot user id did not resolve, and this author is unattributable — fail-closed loop guard" };
+  }
+  if (mentionsUser(comment.rich_text, own.primary)) return { addressing: "direct", reason: "structured bot @mention" };
+  if (notionNameDrop(richTextToPlainText(comment.rich_text), botName)) {
+    return { addressing: "direct", reason: "bot name-drop (synthetic mention — Notion has no @mention for integrations)" };
+  }
+  return { addressing: "channel-watch", reason: "ambient comment — judged by the doc supervisor" };
+}
+
+// --- the single-window plan (pure) ----------------------------------------------------
+
+/** The host-frozen reply-target facts one comment.created delivery resolves (the webhook core's
+ *  dispatch fields) — everything {@link planNotionSingleWindow} needs to mint the wake origin. */
+export interface NotionSingleWindowTarget {
+  /** The trigger comment's inline discussion thread — createCommentReply's discussion_id target.
+   *  Empty ⇒ no freezable reply target ⇒ NO window (fail closed, never an unresolvable wake). */
+  readonly discussionId: string;
+  readonly pageId?: string;
+  readonly workspaceId?: string | null;
+  /** The Notion integration this delivery VERIFIED under (OPE-467) — frozen into the origin so the
+   *  unified reply posts under the credential that fetched the trigger comment. */
+  readonly credentialId?: string;
+  /** The first latency anchor (OPE-1716), recorded on the ingress row. A Notion delivery carries no
+   *  vendor clock this seam can read, so the caller passes its own FRONT-DOOR RECEIPT — which makes
+   *  the vendor→ingress segment a lower bound, and the row's `vendorTsSource` says so. */
+  readonly vendorTs?: VendorEventTime;
+}
+
+/**
+ * The ONE single-window decision for a Notion delivery (channels/unified-window.ts
+ * singleWindowMentionPolicy is the SHARED seam — the exact function the GitHub reference's
+ * native-suppression AND classifier consult, github.ts:261 / github-supervisor.ts:139): given
+ * the grain's `singleWindow`, whether the classified comment is a structured @mention
+ * (classifyNotionComment returned `direct`), and the PRIVACY FLOOR `privacyOk`, return the
+ * {@link UnifiedWindowWake} the dispatch should carry, or undefined for the byte-identical
+ * native path.
+ *
+ * `privacyOk` is the OPERATOR-VOUCH fact the caller resolves (notion.ts): identity/trust.ts
+ * isVouchedInternal on the page's workspaceKey/surfaceKey (or the OE_TRUST=internal blanket
+ * switch), fail-closed when unregistered. This is the SAME per-surface allowlist that gates
+ * Notion's shared MEMORY (notion-identity.ts / bindNotion), so a page is admitted to the shared
+ * cross-surface WINDOW exactly when the operator has vouched it internal — never inferred from a
+ * misleading API field (a Notion page's `public_url` is set ONLY by publish-to-web and is null
+ * for the common guest-shared vector, so it would admit an external guest's mention; the vouch
+ * register is the doctrine-correct floor — operator vouches, code enforces, no inference).
+ *
+ * Notion's mention signal lives in ONE webhook delivery (unlike Slack's dual-event), and its
+ * "native" handler IS this same supervisor dispatch — so suppress-native and divert are the SAME
+ * act here: a window-carrying wake is delivered through the unified channel instead of the notion
+ * channel's own send (notion.ts's wake dep), and both legs read THIS one verdict off the one
+ * parsed event — structurally never a double-handle, never a gap:
+ *   • @mention on a singleWindow, VOUCHED-internal page → the seam suppresses the native session
+ *     and stamps `addressing:"direct-mention"` (the terminal-prose delivery bridge's arm);
+ *   • ambient (channel-watch) comment on the same page → Leg A: the window WITHOUT the addressed
+ *     stamp (judged treatment in the shared window, prose stays hard-dropped);
+ *   • un-vouched page, or singleWindow off, or no discussion id → undefined (the native
+ *     per-doc/domain path, byte-identical — a mention there keeps today's `direct` wake).
+ */
+export function planNotionSingleWindow(
+  singleWindow: boolean,
+  isMention: boolean,
+  privacyOk: boolean,
+  target: NotionSingleWindowTarget,
+): UnifiedWindowWake | undefined {
+  const policy = singleWindowMentionPolicy(singleWindow, isMention, privacyOk);
+  // A mention diverts iff the seam suppresses the native session; an ambient comment diverts on
+  // the same `singleWindow && privacyOk` floor (Leg A — never a public/unknown page into the
+  // shared window). Both derive from the seam's one predicate.
+  const divert = isMention ? policy.suppressNative : singleWindow && privacyOk;
+  if (!divert) return undefined;
+  if (!target.discussionId) return undefined; // no frozen reply target ⇒ no window (fail closed)
+  return {
+    wakeId: mintWakeId(),
+    origin: {
+      platform: "notion",
+      discussionId: target.discussionId,
+      ...(target.pageId ? { pageId: target.pageId } : {}),
+      ...(target.workspaceId ? { workspaceId: target.workspaceId } : {}),
+      ...(target.credentialId ? { credentialId: target.credentialId } : {}),
+    },
+    // ADDRESSED @mention ⇒ the seam's stamp marks the wake as OWED a reply, so the envelope tells
+    // the seat it owes an answer through the `reply` tool. Ambient wakes omit it. It is not a delivery
+    // path: a turn that ends in prose is dropped and re-driven once, on every addressing (OPE-1982).
+    ...(policy.addressing !== undefined ? { addressing: policy.addressing } : {}),
+    ...spreadVendorTs(target.vendorTs),
+  };
+}
+
+// --- the wake builder (pure) ---------------------------------------------------------
+
+/** One comment reshaped for the wake — the trigger, or a discussion-sibling backscroll message.
+ *  `from` is resolved by the caller (self when the bot authored it, else human). */
+export interface NotionWakeMessage {
+  readonly from: "human" | "self";
+  readonly id: string;
+  readonly authorId?: string;
+  readonly sentAt: string;
+  readonly text: string;
+  /** Authenticated parent block of an inline comment. Absent for page-level discussions. */
+  readonly anchorId?: string;
+  /**
+   * Resolved per-message trust tier (identity/wake-trust.ts — the audit-wedge F3 assignment). The
+   * live dispatch (notion.ts) resolves it off the binding gate + admin rosters, for the trigger AND
+   * every discussion sibling.
+   *
+   * 🔴 REQUIRED, NOT OPTIONAL (OPE-596) — see LinearSupervisorWakeInput.trigger.trust. The trigger
+   * used to default to `principal` on the direct path and a sibling to `peer`, both fail-OPEN, and
+   * since OPE-577 the tier decides the `<untrusted_external_data>` fence. A caller that cannot
+   * resolve a tier states the fail-closed one itself: `relay` for a machine author, `unauth` for an
+   * unvouchable human.
+   */
+  readonly trust: WakeTrust;
+}
+
+/**
+ * The SAME message BEFORE any author tier is resolved — what notion-webhook.ts produces (OPE-596).
+ *
+ * The webhook core reads the comment payload; it holds no binding context, so it cannot answer "what
+ * standing does this author carry?". The ROUTE answers that, once, for the trigger and every
+ * sibling alike (notion.ts `trustOf`, fail-closed to `relay`). This type states that split instead
+ * of leaving it to a convention: an untiered message is NOT a {@link NotionWakeMessage} and the
+ * compiler will not let one reach {@link buildNotionSupervisorWake}. Before OPE-596 the same two
+ * shapes shared one type and the builder defaulted the missing tier UPWARD, so a route leg that
+ * forgot the stamp would have rendered a stranger's comment as a member's.
+ */
+export type NotionUntieredWakeMessage = Omit<NotionWakeMessage, "trust">;
+
+export interface NotionSupervisorWakeInput {
+  /** direct (guaranteed) or channel-watch (judged) — `drop` never reaches here. */
+  readonly addressing: Exclude<NotionAddressing, "drop">;
+  readonly pageId: string;
+  readonly discussionId: string;
+  readonly trigger: NotionWakeMessage;
+  /** The OTHER comments in the same discussion, oldest-first — envelope backscroll siblings.
+   *  Re-sent every wake (cheap at Notion volume) so the judge always has full thread context,
+   *  even mid-session (design §3.2). Ignored on the `direct` path (renderWake returns the body
+   *  verbatim there). */
+  readonly threadComments?: readonly NotionWakeMessage[];
+  /** The OUTGOING generation's recorded TAIL (OPE-794) — rendered BEFORE this wake's own thread
+   *  comments, so the envelope reads oldest-first across the rotation boundary. Only a FRESH
+   *  generation's first wake carries one. */
+  readonly tail?: readonly WakeMessageInput[];
+  /** This surface could not read its own page discussion since the seat's last wake (core
+   *  channels/seat-catch-up.ts). Rendered as a trusted `<system-note>`; unset ⇒ no note. */
+  readonly catchUpUnavailable?: string;
+  /** Engagement calibration for the judged preamble (memory/domain.ts engagementTierFor —
+   *  resolved by the caller; this core stays config-free). Unset ⇒ neutral ⇒ byte-identical. */
+  readonly engagementTier?: WakeEngagementTier;
+  // 🔴 NO `unified` (OPE-770). It existed to stamp `<channel platform>` and the P5 disclosure
+  // sentence, and both are gone: the render names no surface and the standing block states the
+  // cross-surface rule once per session. A notion wake is the same wake whether or not its session
+  // spans surfaces. The unified GRAIN decision is unaffected — it lives on the dispatch input.
+  /** Host-minted wake id (rendered `<wake wake-id=…>`) — SINGLE-WINDOW path only (channels/
+   *  unified-window.ts): the id the model echoes to `reply` so the host resolves this wake's
+   *  origin from the map. Unset ⇒ byte-identical (no attribute) — mirrors
+   *  GitHubSupervisorWakeInput.wakeId. */
+  readonly wakeId?: string;
+  /** SINGLE-WINDOW addressed @mention (mirrors GitHubSupervisorWakeInput.directMention): render
+   *  the wake as `direct-mention` — the full judged ENVELOPE (so the `wake-id` survives for the
+   *  reply tool, the ONLY reply route on the unified channel) with the ADDRESSED preamble instead
+   *  of the silence-biased watch one. Only meaningful alongside `addressing: "direct"` (the plan
+   *  only sets it for a real @mention); unset ⇒ today's render, byte-identical — a plain `direct`
+   *  wake stays the verbatim body. */
+  readonly directMention?: boolean;
+  /**
+   * This page carries an ENGAGED registry row — the seam's `deliver` verdict — so a JUDGED wake
+   * states `follow-up="thread-engaged"`, the envelope's own words for "you are already in this
+   * conversation and `stand_down` is how you leave" (instructions/access.ts's standing block).
+   *
+   * 🔴 THE ROW ALREADY SAYS IT AND THE ENVELOPE DID NOT (OPE-1711). `notionWakeAddressing` promotes
+   * the `notion.dispatched` row to `thread-follow` off this same verdict, so the deployment knows the
+   * page is enrolled and tells its audit trail — while the seat reads bare ambient activity. Ship
+   * #197 measured the cost of that gap on LINEAR, whose seam has the identical shape: a standing
+   * session declined an engaged follow-up as `user_requested_silence` on a stop asked in an earlier
+   * conversation. The fix is OPE-1673's, made on Slack and ported to both ticket surfaces.
+   *
+   * Like Slack's it does NOT touch `addressing`: `channel-watch` stays the honest silence bar for a
+   * standing session, and enrolment is a different fact from that bar. Unset/false ⇒ no attribute.
+   */
+  readonly threadEngaged?: boolean;
+}
+
+function toWakeSibling(m: NotionWakeMessage): WakeMessageInput {
+  return {
+    from: m.from,
+    author: m.authorId ?? (m.from === "self" ? "the doc agent" : "unknown"),
+    authorId: m.authorId,
+    id: m.id,
+    sentAt: m.sentAt,
+    trust: m.trust,
+    body: m.text,
+  };
+}
+
+/**
+ * Build the NormalizedWake for one doc-supervisor turn. platform "notion", containerNoun "doc",
+ * locus.channel = the page, locus.thread = the discussion, backscroll = the discussion's other
+ * comments as oldest-first envelope siblings, ending at the triggering comment. renderWake then
+ * emits the exact `{message, context}` shape every OE dispatch sends — the SAME renderer Slack
+ * uses, with NO platform branch. A `direct` wake carries no preamble/backscroll (the body is the
+ * driver, verbatim); a `channel-watch` wake gets the judged envelope + doc-noun preamble.
+ */
+export function buildNotionSupervisorWake(input: NotionSupervisorWakeInput): NormalizedWake {
+  // SINGLE-WINDOW addressed @mention: an ENVELOPED render (wake-id + backscroll survive — the
+  // reply tool needs the id) with the addressed preamble. Guarded on `direct` so the flag can
+  // never re-shape a channel-watch wake; unset ⇒ today's renders, byte-identical.
+  const directMention = input.directMention === true && input.addressing === "direct";
+  const judged = input.addressing === "channel-watch";
+  const enveloped = judged || directMention;
+  // The carried TAIL leads, then this wake's own thread comments — one oldest-first list that
+  // reads straight across the rotation boundary (OPE-794).
+  const backscroll = enveloped ? [...(input.tail ?? []), ...(input.threadComments ?? []).map(toWakeSibling)] : undefined;
+  return {
+    platform: "notion",
+    reason: input.addressing === "direct" ? "mention" : "channel-activity",
+    addressing: directMention ? "direct-mention" : input.addressing,
+    containerNoun: "doc",
+    // The ambient calibration dial — an addressed mention is owed an answer, so watch-only.
+    engagementTier: judged ? input.engagementTier : undefined,
+    // The ENROLMENT fact ({@link NotionSupervisorWakeInput.threadEngaged}), through the ONE shared
+    // helper every enveloped surface now calls (channels/engaged-wake.ts, OPE-1740). It keeps both
+    // exclusions this line used to spell out: an addressed comment is owed an answer whatever the
+    // page's enrolment says, and a `direct` wake carries no envelope to hang an attribute on.
+    followUp: engagedFollowUpContract({
+      addressing: directMention ? "direct-mention" : input.addressing,
+      threadEngaged: input.threadEngaged,
+    }),
+    // Single-window wake id — only the singleWindow dispatch passes it (byte-identical off).
+    wakeId: input.wakeId,
+    locus: {
+      channel: { id: input.pageId },
+      thread: { ts: input.discussionId },
+    },
+    backscroll,
+    ...(input.catchUpUnavailable !== undefined ? { catchUpUnavailable: input.catchUpUnavailable } : {}),
+    trigger: mkMessageTrigger({
+      from: input.trigger.from,
+      author: input.trigger.authorId ?? "unknown",
+      authorId: input.trigger.authorId,
+      id: input.trigger.id,
+      sentAt: input.trigger.sentAt,
+      // The caller's stated per-person tier — no default (OPE-596). Directness is the `mention`
+      // flag below, never a trust tier.
+      trust: input.trigger.trust,
+      mention: input.addressing === "direct",
+      body: input.trigger.text,
+    }),
+  };
+}
+
+// --- the dispatch core (session get-or-create → build → wake → terminal rotate) -------
+
+/** The live supervisor session pointer for a page, as the deps report it. `freshGeneration` is
+ *  true for a brand-new OR just-rotated generation — its first wake carries the carried tail. */
+export interface NotionSupervisorSession {
+  readonly token: string;
+  readonly generation: number;
+  readonly freshGeneration: boolean;
+  /** The OUTGOING generation's recorded tail, oldest-first — empty unless this is a fresh
+   *  generation's first wake (OPE-794). */
+  readonly tail: readonly WakeMessageInput[];
+  /** The session's PREVIOUS wake time (the stored lastWakeAt, read BEFORE touchSession advances it),
+   *  or null/absent when there is no prior delivered wake (a fresh/rotated generation). The cursor
+   *  the memory-delta push (deps.memoryDelta) diffs against; unset ⇒ no delta computed. */
+  readonly lastWakeAt?: string | null;
+}
+
+/** Deps for {@link handleNotionSupervisorDispatch} — mirror SupervisorRouteDeps (slack-events.ts),
+ *  injected so the core is unit-testable over a mock store + a capture `wake`. org is baked into
+ *  the live impl's closures (a deployment fact — notion.ts), so it never crosses this boundary. */
+export interface NotionSupervisorDeps {
+  /** Create-or-fetch the live supervisor session for this page's surfaceKey: mint generation 1 on
+   *  first sighting, rotate to generation+1 when {@link shouldRotate} says it aged out, else
+   *  return the current generation. */
+  readonly getOrCreateSession: (surfaceKey: string, pageId: string, atIso: string) => Promise<NotionSupervisorSession>;
+  /** Record one wake on the current generation (lastWakeAt/turnCount). Best-effort. */
+  readonly touchSession?: (surfaceKey: string, atIso: string) => Promise<void>;
+  /**
+   * THE SINCE-LAST-WAKE CATCH-UP, through the ONE shared path every surface takes
+   * (channels/seat-catch-up.ts `seatCatchUp`). Optional so older test doubles keep compiling
+   * (absent ⇒ no catch-up, the pre-OPE-1726 behaviour); fail-soft by construction.
+   */
+  readonly catchUp?: (req: SeatCatchUpRequest) => Promise<SeatCatchUpResult>;
+  /**
+   * THE §2.5 ENGAGEMENT MARK for an ADDRESSED wake (OPE-1501) — defaults to
+   * `channels/notion-engagement.ts`'s `markNotionEngaged`, which writes the live registry.
+   *
+   * 🔴 IT IS A DEP BECAUSE OF WHERE IT HAS TO RUN, not for testability alone. Notion is the one
+   * surface whose EXTERNAL-AUTHOR gate is not at the ingress: the webhook core dispatches, and the
+   * decision is made HERE, one step later. Marking at the ingress would let an author the operator
+   * excluded ENROL a page by naming the agent on it — no reply, but every later plain comment from
+   * anyone would then wake a turn — and would let that same suppressed name-drop CLEAR a
+   * stand-down, because `participating: true` lifts the `stopped` flag. So the mark sits below the
+   * suppression check, where the answer already exists, and this dep is how the webhook core's own
+   * test can drive it. Absent in a unit test ⇒ the live writer.
+   */
+  readonly markEngaged?: (d: NotionSupervisorDispatch) => Promise<void>;
+  /**
+   * Record this delivered wake onto the LIVE generation's TAIL ring (OPE-794). Injected because the
+   * entry has to be filed under an ORG and a registry key, and this core deliberately holds neither
+   * — the live wiring does. Absent (a unit test) ⇒ nothing is recorded and the dispatch is
+   * unchanged, which is the same posture `touchSession` takes.
+   */
+  readonly recordWake?: (entry: SessionTailWakeRow, token: string, surfaceKey: string) => Promise<void>;
+
+  /** Start/continue the supervisor session under its reserved token, posting the rendered wake.
+   *  `window` is present ONLY on the SINGLE-WINDOW path (the dispatch input carried it): the
+   *  wiring (notion.ts) then DIVERTS the wake through eve's cross-channel `receive` into the
+   *  synthetic `unified` channel instead of this channel's own send. Absent ⇒ byte-identical. */
+  readonly wake: (input: {
+    token: string;
+    auth: OpenEverywhereNotionAuth;
+    message: string;
+    context: readonly string[];
+    state: NotionSessionState;
+    window?: UnifiedWindowWake;
+  }) => Promise<void>;
+  /** Compute the "changed since your last wake" `<system-reminder>` PUSH (memory/wake-delta.ts):
+   *  given the session's previous wake time (`sinceIso`), this wake's time (`atIso`), and this
+   *  session's own key (`selfKey` = its continuation token, to exclude its own writes), return the
+   *  ready block or null. Injected so the pure dispatch stays testable; the live wiring (notion.ts)
+   *  sets it ONLY when armed (supervisor + unified org gate), so unset ⇒ byte-identical. */
+  readonly memoryDelta?: (sinceIso: string, atIso: string, selfKey?: string) => Promise<string | null>;
+  /** Clock seam (defaults to the real clock). */
+  readonly now?: () => string;
+}
+
+/** Everything notion-webhook hands the supervisor dispatch: the classification + the wake parts +
+ *  the identity/session facts. Built by the webhook core, consumed here. */
+export interface NotionSupervisorDispatch {
+  readonly surfaceKey: string;
+  /**
+   * The Notion channel credential this delivery runs under (OPE-467) — the integration whose
+   * secret verified the signature, else (dev hatch only) the page's domain binding. Selected ONCE, by the webhook core,
+   * and carried here so the route's own Notion calls (the spend gate's visible refusal comment)
+   * cannot re-derive a DIFFERENT one. Nothing in this module reads it; it exists so there is
+   * exactly one selection per delivery rather than two rules that agree by luck.
+   */
+  readonly credentialId: string;
+  /** direct | channel-watch — `drop` is filtered upstream (never dispatched). */
+  readonly addressing: Exclude<NotionAddressing, "drop">;
+  readonly pageId: string;
+  readonly discussionId: string;
+  readonly workspaceId: string | null;
+  readonly auth: OpenEverywhereNotionAuth;
+  readonly trigger: NotionWakeMessage;
+  readonly threadComments: readonly NotionWakeMessage[];
+  /** Engagement calibration tier for the judged preamble (resolved by the webhook core). */
+  readonly engagementTier?: WakeEngagementTier;
+  /**
+   * The EXTERNAL-PARTICIPANT POLICY for this page (OPE-507), RESOLVED BY THE CALLER — this core
+   * stays config-free, exactly as {@link NotionSupervisorDispatch.engagementTier} does. The live
+   * wiring (notion.ts) resolves it as `resolveExternalPolicy(externalPolicyOverrideFor(surfaceKey,
+   * domains))`, so the org default and the domain override are both applied before it arrives here.
+   *
+   * Unset ⇒ the ORG DEFAULT alone (`resolveExternalPolicy()`), which ships `taint` ⇒ byte-identical
+   * to before this field existed. Every pure/test caller therefore stays unchanged.
+   */
+  readonly externalPolicy?: ExternalPolicy;
+  /** UNIFIED cross-surface grain resolved by the route leg (supervisorGrainFor, fail-soft false) —
+   *  stamps the wake's platform address + P5 disclosure AND marks the session state `oeUnified`
+   *  (the message-tool-only gate's key in notion.ts). Unset ⇒ byte-identical per-doc path. */
+  readonly unified?: boolean;
+  /** SINGLE-WINDOW wake plumbing, minted by the route leg via {@link planNotionSingleWindow} when
+   *  the grain says `singleWindow` AND the page passed the privacy floor: the wakeId is rendered
+   *  into the envelope by this core; the whole object is passed through to deps.wake, whose
+   *  wiring registers the map entry and diverts into the unified channel. Unset ⇒ byte-identical. */
+  readonly window?: UnifiedWindowWake;
+  /**
+   * The ANCESTOR-TRUST verdict for this delivery's page (OPE-492), resolved ONCE by the webhook core
+   * and carried here for the ROUTE. Nothing in THIS module reads it. The route reads it twice:
+   *   • the AUDIT ROW records WHICH refusal happened (`database-boundary`, `hop-limit`, `cycle`,
+   *     `unresolvable`, `workspace-root`, `no-roots`) rather than only that the page was untrusted;
+   *   • the SINGLE-WINDOW PRIVACY FLOOR accepts `trusted: true` as an internal signal (OPE-540 —
+   *     notion.ts `notionSingleWindowPrivacyOk`), so the floor and the memory plane agree on one
+   *     page. The floor only READS this verdict; it never re-derives it, so it stays synchronous.
+   * The trust also travels on {@link NotionSupervisorDispatch.auth} as the `trust_root` attribute,
+   * which is what `bindNotion` binds.
+   *
+   * Unset on a caller that declares no roots — the resolver returns `no-roots` with no I/O, and the
+   * webhook core omits the field. Both readers must treat the absent field as NOT trusted.
+   */
+  readonly trust?: NotionDeliveryTrust;
+  /** SINGLE-WINDOW addressed @mention (the plan's window carries `addressing:"direct-mention"`):
+   *  render the wake as the addressed `direct-mention` variant (envelope kept, watch preamble
+   *  swapped for the addressed one). Unset ⇒ today's renders, byte-identical. */
+  readonly directMention?: boolean;
+  /**
+   * The §2.5 ENGAGEMENT SEAM is what admitted this delivery (OPE-1510): the page carries an
+   * engagement row, and this PLAIN comment is a follow-up on it. Resolved ONCE by the webhook core —
+   * the one place that reads the registry — and carried here for the ROUTE, exactly as {@link
+   * NotionSupervisorDispatch.trust} is.
+   *
+   * 🔴 IT DOES NOT CHANGE HOW THE WAKE IS JUDGED. `addressing` stays `channel-watch`, so the
+   * silence bar is untouched. The field has two readers, and both only STATE the enrolment:
+   *   • the route's `notion.dispatched` row says WHAT WOKE IT (`notionWakeAddressing`,
+   *     channels/notion-engagement.ts);
+   *   • the WAKE ENVELOPE says it to the seat as `follow-up="thread-engaged"` (OPE-1711 — it reaches
+   *     {@link NotionSupervisorWakeInput.threadEngaged}, whose 🔴 carries the measurement).
+   * One verdict feeds both, so the row and the envelope can never disagree. Unset ⇒ the row reports
+   * the classifier's own value and the envelope states no contract, byte-identical to before.
+   */
+  readonly engagedFollowUp?: boolean;
+  /**
+   * HOW THE OPERATOR'S OWN CONFIG HOLDS THIS PAGE (OPE-1510): `roster` — a domain lists the page by
+   * id; `container` — a domain reaches it by a CONTAINER entry, which is the whole workspace or
+   * a same-level page glob (memory/domain.ts); `none` — no domain holds it. Resolved
+   * ONCE by the webhook core, by the same `notionPageDomain` read its addressed door gates on
+   * (channels/notion-scope.ts), and carried here for the ROUTE exactly as {@link
+   * NotionSupervisorDispatch.engagedFollowUp} is.
+   *
+   * 🔴 NOTHING IN THIS MODULE READS IT. It only lets the route's `notion.dispatched` row record the
+   * DOMAIN ORIGIN beside what woke the delivery, so a name-drop admitted by a claim is
+   * distinguishable from one on a page an operator listed. Unset ⇒ the row reads `none`.
+   */
+  readonly domainVia?: NotionVia;
+}
+
+/**
+ * The dispatch AS THE WEBHOOK CORE BUILDS IT (OPE-596) — every field of {@link
+ * NotionSupervisorDispatch} except that its messages carry no author tier yet (see {@link
+ * NotionUntieredWakeMessage}). The route leg (notion.ts) stamps the tier on the trigger and on every
+ * sibling, and that stamp is what turns this into a {@link NotionSupervisorDispatch} the supervisor
+ * core will accept. The two types are what stop the stamp being an optional step.
+ */
+export interface NotionUntieredSupervisorDispatch extends Omit<NotionSupervisorDispatch, "trigger" | "threadComments"> {
+  readonly trigger: NotionUntieredWakeMessage;
+  readonly threadComments: readonly NotionUntieredWakeMessage[];
+}
+
+/**
+ * THE INGESTED SET for one Notion wake, graded for the non-member taint join (OPE-466 / OPE-516).
+ *
+ * 🔴 NOTION HAD NO AUTHOR LEG AT ALL BEFORE OPE-516, and it could not have had one. The join's
+ * `refuted` field is the SURFACE's positive refutation — Slack's `is_restricted`, Teams' Entra
+ * `userType: "guest"` — and Notion publishes NO membership fact about a comment author. So the
+ * question is answered from the operator's own AUTHOR-TRUST REGISTER instead
+ * (identity/author-trust.ts): on a workspace the operator has armed, an author they did not declare
+ * grades `external`. On an unarmed workspace the leg contributes nothing and this is a no-op.
+ *
+ * `refuted` is deliberately never set here. Leaving it absent is the honest statement — Notion has
+ * no verdict to give, and a hardcoded `false` would read as "we asked and it was fine".
+ *
+ * NOTION HAS NO GROUP CONCEPT, so no memberships are contributed and a Notion declaration is
+ * principal-keys-only. That is a platform fact, not a gap in this function.
+ *
+ * A `self` author (the bot's own prior comment) carries no `authorId` from the webhook core, and its
+ * resolved tier is the machine floor, so it can never reach the register leg — the join requires a
+ * positively-human tier.
+ *
+ * Pure and exported so the grading is testable without a store or a live wake.
+ */
+export function notionIngestedMessages(d: {
+  readonly workspaceId: string | null;
+  readonly trigger: NotionWakeMessage;
+  readonly threadComments: readonly NotionWakeMessage[];
+}): readonly IngestedChatMessage[] {
+  // No workspace id ⇒ no tenant key can be composed ⇒ no author question can be asked. Fail OPEN,
+  // matching every other carriage leg: an unnameable tenant is not evidence of anything.
+  const tenantKey = d.workspaceId ? `notion/${d.workspaceId}` : undefined;
+  const grade = (m: NotionWakeMessage): IngestedChatMessage => ({
+    ...(m.trust === undefined ? {} : { trust: m.trust }),
+    ...(tenantKey === undefined ? {} : { authorTrust: { tenantKey, ...(m.authorId === undefined ? {} : { authorId: m.authorId }) } }),
+  });
+  return [grade(d.trigger), ...d.threadComments.map(grade)];
+}
+
+/**
+ * THE EXTERNAL-AUTHOR DECISION for one Notion dispatch (OPE-507). Pure, exported so the three
+ * behaviours are testable without a store or a live wake.
+ *
+ * Notion's three answers, and why they are what they are:
+ *   • the TRIGGER's author is excluded ⇒ NO WAKE AT ALL (`suppressed`). That covers behaviour 2
+ *     (ambient never triggers on their comment) and behaviour 1 (their @mention is not acted on).
+ *   • a SIBLING's author is excluded ⇒ the wake proceeds and that sibling's body is WITHHELD
+ *     (behaviour 3): a permitted member's later comment still wakes the agent, and the excluded
+ *     author's earlier comment reaches the model as the arrived-marker.
+ *   • nothing is excluded, or the policy is `taint` ⇒ `withheldIds` is empty and every caller path
+ *     is byte-identical to before this existed.
+ *
+ * 🔴 NOTION POSTS NO PRIVATE NOTICE, AND THAT IS DELIBERATE. Behaviour 1 owes the excluded sender a
+ * PRIVATE notice, and Notion has no private channel back to a commenter — a comment reply lands in
+ * the shared discussion, where everyone reading the doc sees it. Announcing "I will not act on your
+ * message" into a shared doc is a disclosure, not a notice, so the Notion answer is to do nothing.
+ * The surfaces that HAVE a private channel (a Discord DM, a Slack DM) post the notice there.
+ */
+export function notionExternalAuthorDecision(d: {
+  readonly trigger: NotionWakeMessage;
+  readonly threadComments: readonly NotionWakeMessage[];
+  readonly ingested: readonly IngestedChatMessage[];
+  readonly policy: ExternalPolicy;
+}): { readonly suppressed: boolean; readonly withheldIds: ReadonlySet<string> } {
+  // `ingested` is built by notionIngestedMessages in EXACTLY this order — trigger first, then the
+  // siblings — so the index join below is the same pairing the taint carriage already relies on.
+  const ordered = [d.trigger, ...d.threadComments];
+  const withheldIds = new Set<string>();
+  let suppressed = false;
+  for (const [i, m] of ordered.entries()) {
+    const facts = d.ingested[i];
+    if (facts === undefined || !withholdsBody(facts, d.policy)) continue;
+    if (i === 0) suppressed = true;
+    else withheldIds.add(m.id);
+  }
+  return { suppressed, withheldIds };
+}
+
+/**
+ * Route one classified comment to the doc supervisor: get-or-create the session, build + render
+ * the wake for that generation, deliver it, and stash the triggering discussion on the session
+ * state so `message.completed` replies into the right thread.
+ *
+ * A DELIVERY failure (the send itself) propagates to the caller's catch. A session that dies at
+ * TURN time does not: nothing here observes it, so the trigger is lost SILENTLY, and no reactive
+ * arm can exist (OPE-174 removed the inert one; channels/session-resume.ts holds the measurement).
+ * The working remedy is PRE-DISPATCH — the live `getOrCreateSession` claims the OPE-599
+ * runtime-change rotation before this call and hands back a session the running eve build can read.
+ */
+/** The default {@link NotionSupervisorDeps.markEngaged}: the dispatch's own facts, in the seam's
+ *  vocabulary. One derivation, so the row this writes is the row `notion-engagement.ts` reads and
+ *  `stand_down` marks. */
+async function liveNotionEngagementMark(d: NotionSupervisorDispatch): Promise<void> {
+  const facts: NotionSeamFacts = {
+    workspaceId: d.workspaceId ?? undefined,
+    pageId: d.pageId,
+    ...(d.trigger.authorId ? { principalId: d.trigger.authorId } : {}),
+    ...(d.credentialId ? { credentialId: d.credentialId } : {}),
+  };
+  // The TRIGGER COMMENT's own id is the guard key: Notion redelivers a comment this route answered
+  // with a 500 (an uncaught throw below this mark), and a redelivered name-drop must not lift a
+  // stand-down made in between. See `markNotionEngaged`.
+  await markNotionEngaged(facts, d.trigger.id);
+}
+
+export async function handleNotionSupervisorDispatch(d: NotionSupervisorDispatch, deps: NotionSupervisorDeps): Promise<void> {
+  const atIso = deps.now ? deps.now() : new Date().toISOString();
+  // THE EXTERNAL-AUTHOR POLICY (OPE-507). Resolved once, ABOVE the session get-or-create: a
+  // suppressed wake must not mint a generation, touch a session or spend a rotation budget on a
+  // message the agent is not going to read. Absent policy ⇒ the org default ⇒ `taint` ⇒ this whole
+  // block is inert and every line below runs exactly as it did.
+  const policy = d.externalPolicy ?? resolveExternalPolicy();
+  const ingested = notionIngestedMessages(d);
+  const external = notionExternalAuthorDecision({ trigger: d.trigger, threadComments: d.threadComments, ingested, policy });
+  if (external.suppressed) return; // the trigger's author may not task the agent — no wake, no notice (see above)
+  // 🔴 THE §2.5 MARK (OPE-1501) — an ADDRESSED wake ENROLS the page, and this is the FIRST line at
+  // which that is safe: the external-author decision above is Notion's author gate, and it is made
+  // here rather than at the ingress. `participating: true` inside the writer is the re-invitation,
+  // so naming the agent again clears a previous stand-down — which is exactly why a suppressed
+  // author must never reach this line. Best-effort: the writer swallows a store failure, because
+  // engagement bookkeeping must never fail a turn.
+  if (d.addressing === "direct") await (deps.markEngaged ?? liveNotionEngagementMark)(d);
+  const session = await deps.getOrCreateSession(d.surfaceKey, d.pageId, atIso);
+  // `oeUnified` marks a session CREATED as the domain session (eve applies send-state at creation
+  // only, and a session's grain is fixed for its lifetime — the token shape can't change mid-gen),
+  // so notion.ts's message-tool-only gate keys on it. Absent on the per-doc path (byte-identical).
+  const state: NotionSessionState = {
+    discussionId: d.discussionId || null,
+    pageId: d.pageId || null,
+    workspaceId: d.workspaceId,
+    ...(d.unified ? { oeUnified: true } : {}),
+  };
+
+  // The "changed since your last wake" PUSH — computed ONCE from THIS session's cursor (its previous
+  // wake time), naming which shared-memory silos changed. Only when armed (deps.memoryDelta present)
+  // AND a prior wake exists (session.lastWakeAt); fail-soft (a delta failure never breaks the wake).
+  let memoryDelta: string | undefined;
+  if (deps.memoryDelta && session.lastWakeAt) {
+    try {
+      memoryDelta = (await deps.memoryDelta(session.lastWakeAt, atIso, session.token)) ?? undefined;
+    } catch {
+      memoryDelta = undefined;
+    }
+  }
+
+  const doWake = async (token: string, generation: number, tail: readonly WakeMessageInput[], catchUpUnavailable?: string) => {
+    const built: NormalizedWake = {
+      ...buildNotionSupervisorWake({
+        addressing: d.addressing,
+        pageId: d.pageId,
+        discussionId: d.discussionId,
+        trigger: d.trigger,
+        threadComments: d.threadComments,
+        engagementTier: d.engagementTier,
+        wakeId: d.window?.wakeId,
+        directMention: d.directMention,
+        threadEngaged: d.engagedFollowUp,
+        tail,
+        catchUpUnavailable,
+      }),
+      ...(memoryDelta ? { memoryDelta } : {}),
+    };
+    // BEHAVIOUR 3 (OPE-507) — an excluded author's SIBLING comment reaches the model as the
+    // arrived-marker, not as text. It runs HERE, before renderWake, so the bytes never enter the
+    // envelope, the untrusted wrap, or the rendered context. Returns `built` by reference when
+    // nothing is withheld, so every existing render golden is untouched.
+    const nw = withholdWakeBodies(built, (m) => external.withheldIds.has(m.id));
+    const { message, context } = renderWake(nw, deps.now);
+    // OPE-466 CARRIAGE — over the trigger AND every hydrated thread sibling. Notion re-sends the
+    // whole discussion on every wake, so a guest's earlier comment ENTERS the context on a wake it
+    // did not trigger; the leg keys on INGESTION, not on who spoke last, so those siblings count.
+    //
+    // 🔴 `ingestedAfterWithholding` IS WHY A WITHHELD BODY NEVER KEYS TAINT. A withheld sibling did
+    // not enter the context, so the join must not be told it did — marking on it would set the bit
+    // on every withheld wake and stop it discriminating. On `taint` the same array passes through by
+    // reference and the stamp is byte-identical.
+    const auth = stampNonMemberChatAuth(d.auth, ingestedAfterWithholding(ingested, policy), { surfaceKey: d.surfaceKey });
+    await deps.wake({ token, auth, message, context: context ?? [], state, window: d.window });
+  };
+
+  // A wake failure PROPAGATES to the caller's catch. (OPE-174 removed a terminal-session-death
+  // force-rotate branch here: it could never fire — a conversation-mode session PARKS at eve's
+  // token bound rather than failing, and a turn-time error cannot reject the awaited enqueue
+  // anyway. The reachable handler is core's agent/channels/session-park.ts.)
+  // 🔴 EVERY WAKE READS THE PAGE SINCE THE SEAT LAST LOOKED (OPE-1695 (b), brought to Notion by
+  // OPE-1726). A FRESH generation renders its carried tail, as it always did; an ONGOING generation
+  // reads the comments this discussion collected since its own `lastWakeAt`, through the ONE shared
+  // catch-up path — same bounds, same admission policy, same cap as Slack's. FAIL-SOFT: the shared
+  // path never throws, and an unregistered fetch comes back as the UNAVAILABLE note rather than as a
+  // silent empty context.
+  const catchUp =
+    session.freshGeneration || !deps.catchUp
+      ? undefined
+      : await deps.catchUp({
+          container: d.pageId,
+          ...(d.discussionId ? { threadRoot: d.discussionId } : {}),
+          ...(d.trigger.anchorId ? { threadAnchor: d.trigger.anchorId } : {}),
+          sinceMs: seatCatchUpSinceMs(session.lastWakeAt, Date.parse(atIso) || Date.now(), NOTION_CATCH_UP_REACHBACK_HOURS),
+          untilMs: Date.parse(d.trigger.sentAt) || Date.parse(atIso) || Date.now(),
+          excludeId: d.trigger.id,
+          channelKey: d.surfaceKey,
+        });
+  await doWake(session.token, session.generation, session.freshGeneration ? session.tail : (catchUp?.messages ?? []), catchUp?.unavailable);
+  if (deps.touchSession) await deps.touchSession(d.surfaceKey, atIso);
+  if (deps.recordWake) {
+    // AFTER the wake landed, and only the TRIGGER — never the backscroll rendered beside it. That is
+    // what stops a tail inheriting a tail (channels/session-tail.ts).
+    await deps.recordWake(
+      {
+        kind: "wake",
+        at: atIso,
+        from: d.trigger.from,
+        trust: d.trigger.trust,
+        // THE AUTHOR GRAIN (OPE-1747) — `notionIngestedMessages` builds `ingested` trigger-FIRST, the
+        // same index pairing `notionExternalAuthorDecision` already relies on, so `[0]` is this row's
+        // author. Notion has no membership verdict of its own, so the OPERATOR's register query is the
+        // whole refutation and it must ride the row. Resolved through the one core road, off the SAME
+        // local the taint join above reads.
+        ...tailAuthorGrain(ingested[0] ?? { trust: d.trigger.trust }),
+        author: d.trigger.authorId ?? "unknown",
+        ...(d.trigger.authorId ? { authorId: d.trigger.authorId } : {}),
+        id: d.trigger.id,
+        platform: "notion",
+        container: d.surfaceKey,
+        threadRoot: d.discussionId,
+        text: d.trigger.text,
+      },
+      session.token,
+      d.surfaceKey,
+    );
+  }
+}
+
+// Re-export shouldRotate so the live wiring (notion.ts) drives get-or-create/rotate with the SAME
+// pure policy Slack uses, without importing slack-events itself.
+export { shouldRotate };