@vellumai/assistant 0.9.1-staging.1 → 0.10.0-staging.2

package/src/runtime/routes/inbound-stages/guardian-reply-intercept.ts

@@ -16,7 +16,10 @@ import {
 } from "../../../memory/canonical-guardian-store.js";
 import { getLogger } from "../../../util/logger.js";
 import { deliverChannelReply } from "../../gateway-client.js";
-import { routeGuardianReply } from "../../guardian-reply-router.js";
+import {
+  type GuardianPendingScope,
+  routeGuardianReply,
+} from "../../guardian-reply-router.js";
 import type { ApprovalConversationGenerator } from "../../http-types.js";
 
 const log = getLogger("runtime-http");
@@ -30,6 +33,12 @@ export interface GuardianReplyInterceptParams {
   trimmedContent: string;
   hasCallbackData: boolean;
   callbackData: string | undefined;
+  /**
+   * For emoji-reaction decisions: the channel-native id (Slack `ts`) of the
+   * message the reaction was attached to. Threaded to the router so it can
+   * recover the target request from the reacted card's delivery record.
+   */
+  reactedMessageTs?: string;
   rawSenderId: string | undefined;
   canonicalSenderId: string | null;
   canonicalAssistantId: string;
@@ -65,6 +74,7 @@ export async function handleGuardianReplyIntercept(
     trimmedContent,
     hasCallbackData,
     callbackData,
+    reactedMessageTs,
     rawSenderId,
     canonicalSenderId,
     canonicalAssistantId,
@@ -102,43 +112,51 @@ export async function handleGuardianReplyIntercept(
   // based pending requests so that requests without delivery rows (e.g.
   // tool_approval requests created inline) are not silently excluded.
   //
-  // On Slack, when no delivery-scoped results exist for the current
-  // chat, pass [] (empty array) instead of undefined. This prevents the
-  // router's identity-based fallback from intercepting unrelated
+  // On Slack, when no delivery-scoped results exist for the current chat,
+  // use `{ mode: "blocked" }` rather than identity-fallback. This prevents
+  // the router's identity-based fallback from intercepting unrelated
   // messages in other channels/threads — a cross-chat hijacking vector
   // unique to Slack where a single guardian is active in many threaded
   // contexts. Explicit callbacks (apr:<id>:<action>) and request codes
   // still work cross-chat because they carry specific request
-  // identifiers and bypass the pendingRequests list.
+  // identifiers and bypass the pending-request scope.
   //
-  // Non-Slack channels (Telegram, WhatsApp) keep undefined so the
+  // Non-Slack channels (Telegram, WhatsApp) leave the scope unset so the
   // identity-based fallback stays active. On those channels, delivery
   // rows are created asynchronously (fire-and-forget .then()) so the
   // guardian can reply before the row is persisted. Cross-chat
   // contamination is unlikely there because each chat is a distinct
   // conversation with no thread concept.
-  const deliveryScopedPendingRequests =
-    listPendingCanonicalGuardianRequestsByDestinationChat(
-      sourceChannel,
-      conversationExternalId,
-    );
-  let pendingRequestIds: string[] | undefined;
-  if (deliveryScopedPendingRequests.length > 0) {
-    const deliveryIds = new Set(deliveryScopedPendingRequests.map((r) => r.id));
-    // Also include identity-based pending requests so we don't hide them
-    const identityId = canonicalSenderId ?? rawSenderId!;
-    const identityPending = listCanonicalGuardianRequests({
-      status: "pending",
-      guardianExternalUserId: identityId,
-    });
-    for (const r of identityPending) {
-      deliveryIds.add(r.id);
+  // Reactions address one specific request by the reacted card's message id,
+  // so they bypass the pending-request list scoping that the text/NL paths
+  // need — the router's reaction branch resolves the target directly.
+  const isReaction = callbackData?.startsWith("reaction:") === true;
+  let pendingScope: GuardianPendingScope | undefined;
+  if (!isReaction) {
+    const deliveryScopedPendingRequests =
+      listPendingCanonicalGuardianRequestsByDestinationChat(
+        sourceChannel,
+        conversationExternalId,
+      );
+    if (deliveryScopedPendingRequests.length > 0) {
+      const deliveryIds = new Set(
+        deliveryScopedPendingRequests.map((r) => r.id),
+      );
+      // Also include identity-based pending requests so we don't hide them
+      const identityId = canonicalSenderId ?? rawSenderId!;
+      const identityPending = listCanonicalGuardianRequests({
+        status: "pending",
+        guardianExternalUserId: identityId,
+      });
+      for (const r of identityPending) {
+        deliveryIds.add(r.id);
+      }
+      pendingScope = { mode: "scoped", requestIds: [...deliveryIds] };
+    } else if (sourceChannel === "slack") {
+      // Block identity-based fallback on Slack to prevent cross-chat
+      // NL/free-text interception. See comment above for rationale.
+      pendingScope = { mode: "blocked" };
     }
-    pendingRequestIds = [...deliveryIds];
-  } else if (sourceChannel === "slack") {
-    // Block identity-based fallback on Slack to prevent cross-chat
-    // NL/free-text interception. See comment above for rationale.
-    pendingRequestIds = [];
   }
 
   const routerResult = await routeGuardianReply({
@@ -152,7 +170,8 @@ export async function handleGuardianReplyIntercept(
     },
     conversationId,
     callbackData,
-    pendingRequestIds,
+    reactedMessageTs,
+    pendingScope,
     approvalConversationGenerator,
     channelDeliveryContext: {
       replyCallbackUrl,

package/src/runtime/routes/inbound-stages/reaction-intercept.ts

@@ -0,0 +1,358 @@
+/**
+ * Slack reaction intercept stage.
+ *
+ * Reactions are passive channel signals — not messages, and not access
+ * attempts. They are dispatched here *before* the message pipeline (ACL,
+ * admission floor, disk-pressure block, conversation binding) so that:
+ *
+ *   - a 👍 never triggers an ingress access challenge / verification handshake
+ *     or an access-request notification (LUM-2489),
+ *   - a stranger's reaction creates no conversation, binding, or transcript
+ *     row — it is dropped as channel noise,
+ *   - a known contact's reaction is recorded as an inline transcript signal,
+ *   - a guardian's reaction on an approval card is routed through the canonical
+ *     guardian decision pipeline (the same path as buttons and text replies).
+ *
+ * Reactions never drive an agent turn.
+ */
+import type { SourceMetadata } from "@vellumai/gateway-client";
+
+import type { ChannelId, InterfaceId } from "../../../channels/types.js";
+import { getDiskPressureStatus } from "../../../daemon/disk-pressure-guard.js";
+import { classifyDiskPressureTurnPolicy } from "../../../daemon/disk-pressure-policy.js";
+import { addMessage } from "../../../memory/conversation-crud.js";
+import {
+  clearPayload,
+  linkMessage,
+  recordInbound,
+} from "../../../memory/delivery-crud.js";
+import { markProcessed } from "../../../memory/delivery-status.js";
+import { upsertBinding } from "../../../memory/external-conversation-store.js";
+import {
+  type SlackMessageMetadata,
+  writeSlackMetadata,
+} from "../../../messaging/providers/slack/message-metadata.js";
+import { getLogger } from "../../../util/logger.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../../assistant-scope.js";
+import type { ApprovalConversationGenerator } from "../../http-types.js";
+import { resolveTrustContext } from "../../trust-context-resolver.js";
+import { handleGuardianReplyIntercept } from "./guardian-reply-intercept.js";
+
+const log = getLogger("runtime-http");
+
+/**
+ * Detect a Slack reaction event by inspecting the inbound payload's
+ * `callbackData` prefix. The gateway encodes reactions as a unified
+ * `SlackInboundEvent` with `callbackData` of the form `reaction:<emoji>`
+ * (added) or `reaction_removed:<emoji>` (removed) — see
+ * `gateway/src/slack/normalize.ts`. This helper centralizes that convention
+ * so the daemon can route reactions to this dedicated stage instead of the
+ * agent-response pipeline.
+ */
+export function isSlackReactionEvent(body: {
+  sourceChannel?: string;
+  callbackData?: string;
+}): boolean {
+  if (body.sourceChannel !== "slack") return false;
+  const cb = body.callbackData;
+  if (typeof cb !== "string") return false;
+  return cb.startsWith("reaction:") || cb.startsWith("reaction_removed:");
+}
+
+/**
+ * Parse a reaction `callbackData` string into its op (added/removed) and
+ * emoji name. Returns `null` when the input is not a reaction prefix or
+ * when the emoji portion is empty.
+ */
+export function parseSlackReactionCallbackData(
+  callbackData: string,
+): { op: "added" | "removed"; emoji: string } | null {
+  let op: "added" | "removed";
+  let emoji: string;
+  if (callbackData.startsWith("reaction_removed:")) {
+    op = "removed";
+    emoji = callbackData.slice("reaction_removed:".length);
+  } else if (callbackData.startsWith("reaction:")) {
+    op = "added";
+    emoji = callbackData.slice("reaction:".length);
+  } else {
+    return null;
+  }
+  if (emoji.length === 0) return null;
+  return { op, emoji };
+}
+
+export interface ReactionInterceptParams {
+  /** The reaction callbackData (`reaction:<emoji>` / `reaction_removed:<emoji>`). */
+  callbackData: string;
+  sourceChannel: ChannelId;
+  sourceInterface: InterfaceId | undefined;
+  conversationExternalId: string;
+  externalMessageId: string;
+  canonicalAssistantId: string;
+  rawSenderId: string | undefined;
+  canonicalSenderId: string | null;
+  actorDisplayName: string | undefined;
+  actorUsername: string | undefined;
+  replyCallbackUrl: string | undefined;
+  sourceMetadata: SourceMetadata | undefined;
+  /** Slack channel display name, for the conversation binding. */
+  slackChannelName: string | null;
+  approvalConversationGenerator: ApprovalConversationGenerator | undefined;
+}
+
+/**
+ * Handle a Slack reaction event end to end. Always consumes the event (the
+ * caller dispatches here only for `isSlackReactionEvent`), returning the
+ * response the top-level handler should short-circuit with.
+ */
+export async function handleSlackReactionIntercept(
+  params: ReactionInterceptParams,
+): Promise<Record<string, unknown>> {
+  const {
+    callbackData,
+    sourceChannel,
+    sourceInterface,
+    conversationExternalId,
+    externalMessageId,
+    canonicalAssistantId,
+    rawSenderId,
+    canonicalSenderId,
+    actorDisplayName,
+    actorUsername,
+    replyCallbackUrl,
+    sourceMetadata,
+    slackChannelName,
+    approvalConversationGenerator,
+  } = params;
+
+  // Classify the reactor. No timezone enrichment — reactions never drive an
+  // agent turn, so only the trust class / guardian principal matter.
+  const trustCtx = resolveTrustContext({
+    assistantId: canonicalAssistantId,
+    sourceChannel,
+    conversationExternalId,
+    actorExternalId: rawSenderId,
+    actorUsername,
+    actorDisplayName,
+  });
+
+  // Drop strangers before any write. `unknown` covers no contact record and
+  // blocked/revoked contacts — a reaction from them is channel noise. Dropping
+  // here (before recordInbound/upsertBinding) means no empty conversation or
+  // binding is created on their behalf.
+  if (trustCtx.trustClass === "unknown") {
+    log.debug(
+      { sourceChannel, conversationExternalId },
+      "Dropping reaction from unknown actor",
+    );
+    return { accepted: true, reaction: "dropped_unknown_actor" };
+  }
+
+  const reactedMessageTs =
+    typeof sourceMetadata?.messageId === "string"
+      ? sourceMetadata.messageId
+      : undefined;
+  const threadTs =
+    typeof sourceMetadata?.threadId === "string" &&
+    sourceMetadata.threadId.trim().length > 0
+      ? sourceMetadata.threadId.trim()
+      : undefined;
+
+  // Record for dedup + conversation resolution (known contacts only — strangers
+  // were dropped above).
+  const result = recordInbound(
+    sourceChannel,
+    conversationExternalId,
+    externalMessageId,
+    {
+      sourceMessageId: reactedMessageTs,
+      assistantId: canonicalAssistantId,
+      sourceThreadId: threadTs,
+    },
+  );
+
+  // Respect disk-pressure cleanup so reactions don't bypass storage
+  // protection. Guardians resolve to `allow-cleanup-mode` (not `block`), so a
+  // guardian's approval-by-reaction still flows.
+  const diskPressure = classifyDiskPressureTurnPolicy(getDiskPressureStatus(), {
+    sourceChannel,
+    sourceInterface,
+    trustContext: {
+      sourceChannel: trustCtx.sourceChannel,
+      trustClass: trustCtx.trustClass,
+    },
+  });
+  if (diskPressure.action === "block") {
+    // Block silently: a reaction is a passive signal, so the message
+    // pipeline's "storage is low, try again" notice is meaningless for an
+    // emoji — there is nothing to retry. Mark the event processed and stop
+    // before binding/persistence.
+    if (!result.duplicate) {
+      clearPayload(result.eventId);
+      markProcessed(result.eventId);
+    }
+    return {
+      accepted: true,
+      duplicate: result.duplicate,
+      eventId: result.eventId,
+      diskPressure: "blocked",
+      reason: diskPressure.reason,
+    };
+  }
+
+  // Maintain the conversation binding, matching the message pipeline. Scoped to
+  // the daemon's own assistant so assistant-scoped legacy routes don't clobber
+  // each other's binding metadata.
+  if (canonicalAssistantId === DAEMON_INTERNAL_ASSISTANT_ID) {
+    upsertBinding({
+      conversationId: result.conversationId,
+      sourceChannel,
+      externalChatId: conversationExternalId,
+      externalChatName: slackChannelName,
+      externalThreadId: threadTs ?? null,
+      externalUserId: canonicalSenderId ?? rawSenderId ?? null,
+      displayName: actorDisplayName ?? null,
+      username: actorUsername ?? null,
+    });
+  }
+
+  // Guardian approval-by-reaction → canonical decision pipeline, exactly like
+  // buttons and text replies. Only `reaction:` (added) expresses intent;
+  // `reaction_removed:` never does. `handleGuardianReplyIntercept` self-gates
+  // on `trustClass === "guardian"`, so a contact's reaction returns no response
+  // and falls through to persistence.
+  const isReactionAdded = callbackData.startsWith("reaction:");
+  if (isReactionAdded && replyCallbackUrl && !result.duplicate) {
+    const reactionIntercept = await handleGuardianReplyIntercept({
+      isDuplicate: result.duplicate,
+      trimmedContent: "",
+      hasCallbackData: true,
+      callbackData,
+      reactedMessageTs,
+      rawSenderId,
+      canonicalSenderId,
+      canonicalAssistantId,
+      sourceChannel,
+      conversationExternalId,
+      conversationId: result.conversationId,
+      eventId: result.eventId,
+      replyCallbackUrl,
+      trustClass: trustCtx.trustClass,
+      guardianPrincipalId: trustCtx.guardianPrincipalId,
+      approvalConversationGenerator,
+    });
+    // Consumed as a guardian decision (applied, or a surfaced failure delivered
+    // as an ephemeral reply). Short-circuit so we do not also persist a
+    // transcript row.
+    if (reactionIntercept.response) {
+      return reactionIntercept.response;
+    }
+  }
+
+  // Record the reaction as an inline transcript signal. Requires the reacted
+  // message ts to anchor the rendering.
+  if (!reactedMessageTs) {
+    log.debug(
+      { conversationId: result.conversationId, eventId: result.eventId },
+      "Skipping reaction persistence: missing sourceMetadata.messageId",
+    );
+    return {
+      accepted: result.accepted,
+      duplicate: result.duplicate,
+      eventId: result.eventId,
+    };
+  }
+
+  try {
+    await persistSlackReactionAsMessage({
+      conversationId: result.conversationId,
+      conversationExternalId,
+      eventId: result.eventId,
+      callbackData,
+      actorDisplayName,
+      threadTs,
+      reactedMessageTs,
+      duplicate: result.duplicate,
+    });
+  } catch (err) {
+    log.error(
+      { err, conversationId: result.conversationId, eventId: result.eventId },
+      "Failed to persist Slack reaction event",
+    );
+  }
+
+  return {
+    accepted: result.accepted,
+    duplicate: result.duplicate,
+    eventId: result.eventId,
+  };
+}
+
+/**
+ * Persist a Slack reaction event as a `messages` row with a `slackMeta`
+ * envelope so the renderer can surface it inline in the chronological
+ * transcript. Reactions do not trigger an agent response — the row is written
+ * and the inbound event is linked, but the agent loop is not dispatched.
+ *
+ * The caller is expected to have run `recordInbound` already so that
+ * deduplication and conversation resolution have happened. Duplicate inbound
+ * events are skipped here to keep persistence idempotent.
+ */
+async function persistSlackReactionAsMessage(params: {
+  conversationId: string;
+  conversationExternalId: string;
+  eventId: string;
+  callbackData: string;
+  actorDisplayName?: string;
+  threadTs?: string;
+  reactedMessageTs: string;
+  duplicate: boolean;
+}): Promise<void> {
+  if (params.duplicate) return;
+
+  const parsed = parseSlackReactionCallbackData(params.callbackData);
+  if (!parsed) {
+    log.debug(
+      {
+        conversationId: params.conversationId,
+        callbackData: params.callbackData,
+      },
+      "Skipping reaction persistence: unparseable callbackData",
+    );
+    return;
+  }
+
+  const slackMeta: SlackMessageMetadata = {
+    source: "slack",
+    channelId: params.conversationExternalId,
+    channelTs: params.reactedMessageTs,
+    eventKind: "reaction",
+    ...(params.threadTs ? { threadTs: params.threadTs } : {}),
+    ...(params.actorDisplayName
+      ? { displayName: params.actorDisplayName }
+      : {}),
+    reaction: {
+      emoji: parsed.emoji,
+      targetChannelTs: params.reactedMessageTs,
+      op: parsed.op,
+      ...(params.actorDisplayName
+        ? { actorDisplayName: params.actorDisplayName }
+        : {}),
+    },
+  };
+
+  // Sentinel content — Slack transcript renderers read `slackMeta` to format
+  // the reaction line; the literal text is never displayed to the model.
+  const persisted = await addMessage(
+    params.conversationId,
+    "user",
+    "[reaction]",
+    {
+      metadata: { slackMeta: writeSlackMetadata(slackMeta) },
+      skipIndexing: true,
+    },
+  );
+  linkMessage(params.eventId, persisted.id);
+  markProcessed(params.eventId);
+}

package/src/runtime/routes/index.ts

@@ -90,6 +90,7 @@ import { ROUTES as INTERNAL_TWILIO_ROUTES } from "./internal-twilio-routes.js";
 import { ROUTES as LLM_CALL_SITES_ROUTES } from "./llm-call-sites-routes.js";
 import { ROUTES as LOG_EXPORT_ROUTES } from "./log-export-routes.js";
 import { ROUTES as MCP_AUTH_ROUTES } from "./mcp-auth-routes.js";
+import { ROUTES as MEMORY_EVAL_ROUTES } from "./memory-eval-routes.js";
 import { ROUTES as MEMORY_ITEM_ROUTES } from "./memory-item-routes.js";
 import { ROUTES as MEMORY_V2_ROUTES } from "./memory-v2-routes.js";
 import { ROUTES as MEMORY_V3_ROUTES } from "./memory-v3-routes.js";
@@ -222,6 +223,7 @@ export const ROUTES: RouteDefinition[] = [
   ...INTERNAL_TWILIO_ROUTES,
   ...LOG_EXPORT_ROUTES,
   ...LLM_CALL_SITES_ROUTES,
+  ...MEMORY_EVAL_ROUTES,
   ...MEMORY_ITEM_ROUTES,
   ...MEMORY_V2_ROUTES,
   ...MEMORY_V3_ROUTES,

package/src/runtime/routes/integrations/slack/__tests__/channel.test.ts

@@ -28,6 +28,7 @@ let mockSetConfigResult: SlackChannelConfigResult = {
   hasAppToken: false,
   hasUserToken: false,
   connected: false,
+  threadMode: "mention_only",
 };
 
 mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
@@ -37,6 +38,7 @@ mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
     hasAppToken: z.boolean(),
     hasUserToken: z.boolean(),
     connected: z.boolean(),
+    threadMode: z.enum(["mention_only", "mention_then_thread"]),
     teamId: z.string().optional(),
     teamName: z.string().optional(),
     teamUrl: z.string().optional(),
@@ -45,6 +47,7 @@ mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
     error: z.string().optional(),
     warning: z.string().optional(),
   }),
+  SlackThreadMode: z.enum(["mention_only", "mention_then_thread"]),
   setSlackChannelConfig: async (
     botToken?: string,
     appToken?: string,
@@ -59,6 +62,7 @@ mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
     hasAppToken: false,
     hasUserToken: false,
     connected: false,
+    threadMode: "mention_only",
   }),
   clearSlackChannelConfig: async (): Promise<SlackChannelConfigResult> => ({
     success: true,
@@ -66,7 +70,9 @@ mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
     hasAppToken: false,
     hasUserToken: false,
     connected: false,
+    threadMode: "mention_only",
   }),
+  patchSlackChannelConfig: () => {},
 }));
 
 import { BadRequestError } from "../../../errors.js";
@@ -81,6 +87,7 @@ describe("POST /v1/integrations/slack/channel/config", () => {
       hasAppToken: false,
       hasUserToken: false,
       connected: false,
+      threadMode: "mention_only",
     };
   });
 
@@ -129,6 +136,7 @@ describe("POST /v1/integrations/slack/channel/config", () => {
       hasAppToken: false,
       hasUserToken: false,
       connected: false,
+      threadMode: "mention_only",
       error: 'Invalid user token: must start with "xoxp-"',
     };
 

package/src/runtime/routes/integrations/slack/channel.ts

@@ -3,6 +3,7 @@
  *
  * GET    /v1/integrations/slack/channel/config        — get current config status
  * POST   /v1/integrations/slack/channel/config        — validate and store credentials
+ * PATCH  /v1/integrations/slack/channel/config        — update channel settings
  * DELETE /v1/integrations/slack/channel/config        — clear credentials
  */
 
@@ -11,8 +12,10 @@ import { z } from "zod";
 import {
   clearSlackChannelConfig,
   getSlackChannelConfig,
+  patchSlackChannelConfig,
   setSlackChannelConfig,
   SlackChannelConfigResultSchema,
+  SlackThreadMode,
 } from "../../../../daemon/handlers/config-slack-channel.js";
 import { ACTOR_PRINCIPALS } from "../../../auth/route-policy.js";
 import { BadRequestError } from "../../errors.js";
@@ -43,6 +46,20 @@ export async function handleSetSlackChannelConfig({
   return result;
 }
 
+async function handlePatchSlackChannelConfig({ body = {} }: RouteHandlerArgs) {
+  const { threadMode } = body as { threadMode?: string };
+  if (threadMode !== undefined) {
+    const parsed = SlackThreadMode.safeParse(threadMode);
+    if (!parsed.success) {
+      throw new BadRequestError(
+        "threadMode must be 'mention_only' or 'mention_then_thread'",
+      );
+    }
+    patchSlackChannelConfig(parsed.data);
+  }
+  return getSlackChannelConfig();
+}
+
 async function handleClearSlackChannelConfig() {
   return clearSlackChannelConfig();
 }
@@ -84,6 +101,25 @@ export const ROUTES: RouteDefinition[] = [
     }),
     responseBody: SlackChannelConfigResultSchema,
   },
+  {
+    operationId: "integrations_slack_channel_config_patch",
+    endpoint: "integrations/slack/channel/config",
+    method: "PATCH",
+    policy: {
+      requiredScopes: ["settings.write"],
+      allowedPrincipalTypes: ACTOR_PRINCIPALS,
+    },
+    summary: "Update Slack channel settings",
+    description: "Update Slack channel behavior settings (e.g. thread mode).",
+    tags: ["integrations"],
+    handler: handlePatchSlackChannelConfig,
+    requestBody: z.object({
+      threadMode: SlackThreadMode.describe(
+        "Controls whether the bot follows threads after an initial @mention",
+      ).optional(),
+    }),
+    responseBody: SlackChannelConfigResultSchema,
+  },
   {
     operationId: "integrations_slack_channel_config_delete",
     endpoint: "integrations/slack/channel/config",

package/src/runtime/routes/internal-telemetry-routes.ts

@@ -53,7 +53,7 @@ function handleRecordAuthFallback({ body }: RouteHandlerArgs) {
 
   const recorded = recordAuthFallbackCounts(window_start, window_end, mapped);
   if (recorded === 0) {
-    // collectUsageData disabled — counts dropped to honor the opt-out.
+    // share_analytics consent off — counts dropped to honor the opt-out.
     return { skipped: true };
   }
   log.debug({ recorded }, "Recorded auth-fallback counts");