omp-onlyne 0.1.0 → 0.2.0

package/src/decider.ts

@@ -8,6 +8,7 @@ import {
 	type Action,
 	type DeliveryPlan,
 	type Entry,
+	type JoinedThread,
 	type Json,
 	type MessageRef,
 	type MsgInput,
@@ -19,6 +20,7 @@ import {
 	OnlyneError,
 } from "@onlyne/lib";
 import { getLocale } from "@onlyne/node-host/i18n";
+import { isTrustThread } from "./handshake.ts";
 import type { ContextRecord, OnlyneConfig } from "./types.ts";
 import { canAnswer, type ContextRegistry } from "./store.ts";
 import { text } from "./decider-text.ts";
@@ -31,14 +33,14 @@ interface ChoiceQuestion {
 	criteria: Record<string, string>;
 }
 
-type Questions = Record<string, ChoiceQuestion>;
+export type Questions = Record<string, ChoiceQuestion>;
 
 interface ChoiceAnswer {
 	type?: string;
 	choice?: string;
 }
 
-type Answers = Record<string, ChoiceAnswer | undefined>;
+export type Answers = Record<string, ChoiceAnswer | undefined>;
 
 /** A decision input that either carries its records or states why it has none. */
 type Source<T> = { available: true; value: T } | { available: false; reason: string };
@@ -106,6 +108,73 @@ export function currentDecision(): DecisionScope | undefined {
 	return decisionScope.getStore();
 }
 
+/**
+ * The thread a send continues: the most recently opened open thread this node owns whose members
+ * already include the addressee. Derived from local records alone (RFC 0016 §5), so it costs no
+ * judgement. A node may hold several open threads with one peer; the newest is the conversation
+ * still in use, and a caller that wants a fresh topic names one or plans `execution: new`.
+ *
+ * Only a thread holding this node and the addressee continues: a thread with a third member is a
+ * group conversation, and folding a private message into it would put a body in front of every
+ * member. A group is addressed by naming it, which is why `meta.thread` wins over this lookup.
+ */
+export async function reuseThread(deps: DeciderDeps, to: NodeId): Promise<ThreadRef | undefined> {
+	const self = deps.config.node.id;
+	const threads = await deps.listThreads();
+	const candidates = threads
+		.filter(thread => thread.thread_ref.owner === self && thread.state === "open")
+		.sort((left, right) => right.created_at.localeCompare(left.created_at));
+	for (const thread of candidates) {
+		let members: NodeId[];
+		try {
+			members = await deps.threadMembers(thread.thread_ref);
+		} catch (error) {
+			// An unreadable member list is a reason to try the next thread, not to open a new one
+			// silently, so it is reported and skipped.
+			deps.log?.("onlyne.thread.members_unreadable", { thread: threadKey(thread.thread_ref), error: message(error) });
+			continue;
+		}
+		if (members.includes(to) && members.every(member => member === self || member === to)) return thread.thread_ref;
+	}
+	return undefined;
+}
+
+/**
+ * Every peer this node can name, from both sources that know one.
+ *
+ * A trust row is identity: the peer exists whether or not anyone answered a probe recently. A
+ * discovery record is an address, and a live one wins over the address a statement declared.
+ * Callers that ask "who is this" and callers that ask "who may receive this" must not diverge,
+ * or the same peer resolves for `meta.to` and vanishes from the target question — the shape of
+ * the reported `No discovered node is named …` failure.
+ */
+export async function knownPeers(deps: DeciderDeps): Promise<PeerRecord[]> {
+	const byId = new Map<NodeId, PeerRecord>();
+	let readable = false;
+	let failure = "";
+	try {
+		for (const row of await deps.listTrust()) {
+			readable = true;
+			if (row.phase === "revoked") continue;
+			byId.set(row.node_id, { node_id: row.node_id, base_url: row.base_url ?? "", instance_id: "trust", last_seen: "" });
+		}
+	} catch (error) {
+		failure = message(error);
+		deps.log?.("onlyne.judge.trust_unreadable", { error: failure });
+	}
+	try {
+		for (const peer of await deps.listPeers()) {
+			readable = true;
+			byId.set(peer.node_id, peer);
+		}
+	} catch (error) {
+		failure = message(error);
+		deps.log?.("onlyne.judge.peers_unreadable", { error: failure });
+	}
+	if (!readable) throw new OnlyneError("unavailable", text("reason.discovery_unreadable", { error: failure }));
+	return [...byId.values()].filter(peer => peer.node_id !== deps.config.node.id);
+}
+
 export interface DeciderDeps {
 	config: OnlyneConfig;
 	/** Registry id of this node's main session; children are bound under it. */
@@ -113,12 +182,22 @@ export interface DeciderDeps {
 	contexts: ContextRegistry;
 	log?(message: string, fields: Record<string, unknown>): void;
 	listThreads(): Promise<Thread[]>;
+	/** The threads this node was invited into; they live on their owner, never here. */
+	listJoinedThreads(): Promise<JoinedThread[]>;
 	listMessages(thread: ThreadRef, cursor?: string): Promise<Page<Entry>>;
+	/** The peers one thread already lists as members; a send reuses the thread a peer belongs to. */
+	threadMembers(thread: ThreadRef): Promise<NodeId[]>;
 	/** Peers from the library's live discovery records, never a static configuration. */
 	listPeers(): Promise<PeerRecord[]>;
+	/** Every trust row this node holds, in any phase. Identity outlives a discovery record. */
+	listTrust(): Promise<Array<{ node_id: NodeId; phase: string; base_url?: string }>>;
+	/** The inbound records this node holds; O-2A's candidate set reads the entries from them. */
+	listInbox(): Promise<Array<{ context?: string; attention: { entry?: Entry; disposition?: string } }>>;
 	/** Contexts the target node publishes for `execution: existing`. */
 	listReceiverContexts(nodeId: NodeId): Promise<ReceiverContext[]>;
 	resourceQuery?(meta: Record<string, Json>): Promise<ResourceReadQuery>;
+	/** Test seam: answers the judge's questions without a model. Production never sets it. */
+	judge?: (state: Row, questions: Questions) => Promise<Answers>;
 }
 
 const TODO_ENTRY = "mouriya.omp.todo-more";
@@ -139,6 +218,8 @@ const INBOUND_CONTEXT_CAP = 3;
 /** Threads and entries a target question scans for recent unanswered inbound messages. */
 const RECENT_INBOUND_THREADS = 3;
 const RECENT_INBOUND_PER_THREAD = 3;
+/** The O-2A candidate list is capped; the judge reads one line per candidate. */
+const REPLY_CANDIDATES = 5;
 /** Newest branch rows that may reach the trigger derivation; older work is history, not decision material. */
 const HISTORY_ROWS = 40;
 /** One row's text cap: a pasted terminal dump must not crowd out the rest of the state. */
@@ -185,8 +266,9 @@ export class JudgeDecider {
 	async decide(scope: DecisionScope): Promise<Action> {
 		const explicit = await this.#explicit(scope);
 		if (explicit !== undefined) {
-			await this.#guard(scope, explicit);
-			return explicit;
+			const filled = await this.#threaded(explicit);
+			await this.#guard(scope, filled);
+			return filled;
 		}
 
 		// A subagent classifies exactly as the main session does and `#guard` decides what may run.
@@ -204,9 +286,27 @@ export class JudgeDecider {
 					: intent === "manage_domain"
 						? await this.#domainAction(scope, meta)
 						: await this.#resourceAction(meta);
-		await this.#guard(scope, action);
-		this.deps.log?.("onlyne.judge.action", { direction: "outbound", ...actionFacts(action) });
-		return action;
+		const filled = await this.#threaded(action);
+		await this.#guard(scope, filled);
+		this.deps.log?.("onlyne.judge.action", { direction: "outbound", ...actionFacts(filled) });
+		return filled;
+	}
+
+	/**
+	 * The thread a send belongs to, decided once for every path that produces one.
+	 *
+	 * A reply lands on the thread that holds its original (the client resolves it), and a plan
+	 * that says `new` opens a topic. Otherwise the message continues the conversation this node
+	 * already has with its addressee: leaving it unnamed makes the client open a thread per
+	 * message, and asking the model for an alias it cannot know is the mistake the design already
+	 * recorded. This is a lookup over local records, not a judgement (RFC 0016 §5), so it sits
+	 * after both the explicit and the judged paths rather than inside either.
+	 */
+	async #threaded(action: Action): Promise<Action> {
+		if (action.kind !== "send" || action.thread !== undefined) return action;
+		if (action.in_reply_to !== undefined || action.execution === "new") return action;
+		const thread = await reuseThread(this.deps, action.to);
+		return thread === undefined ? action : { ...action, thread };
 	}
 
 	/** Node O-1: one question, five options, no lists of peers, threads, or history. */
@@ -244,8 +344,15 @@ export class JudgeDecider {
 
 	/** Nodes O-2A / O-3A / O-3A-Ctx for a send, reply or followup. */
 	async #communicate(scope: DecisionScope, meta: Record<string, Json>): Promise<Action> {
-		const reply = await this.#reply(meta);
+		let reply = await this.#reply(meta);
 		const explicitRelation = relation(meta);
+		if (reply === undefined && explicitRelation === undefined) {
+			// Node O-2A: no reference and no relation. The judge still answers one question —
+			// whether this call answers one of the inbound messages this context can see — and
+			// the plugin copies the exact ref from the record it names. Candidates are evidence
+			// for the question only: recency or being the sole pending message never binds one.
+			reply = await this.#originalQuestion(scope);
+		}
 		const lockedRelation = reply !== undefined
 			? explicitRelation ?? await this.#relationQuestion(scope, meta)
 			: undefined;
@@ -296,6 +403,102 @@ export class JudgeDecider {
 		};
 	}
 
+	/**
+	 * Node O-2A: the original this call answers. The judge chooses among the inbound records
+	 * this context can see and nobody has answered yet, plus `new_message`; the plugin copies
+	 * the exact MessageRef and the owner-attested reply authority from the record it names, so
+	 * no message id ever travels from the model to the wire.
+	 */
+	async #originalQuestion(scope: DecisionScope): Promise<{ ref: MessageRef; authority: NodeId; thread_ref?: ThreadRef } | undefined> {
+		const candidates = await this.#replyCandidates(scope);
+		if (candidates.length === 0) return undefined;
+		const started = Date.now();
+		const keyOf = (index: number): string => `answer_${index + 1}`;
+		const criteria: Record<string, string> = { new_message: text("judge.original.new") };
+		const facts = candidates.map((entry, index) => {
+			criteria[keyOf(index)] = text("judge.original.candidate", {
+				from: entry.message.sender, kind: entry.message.delivery_kind,
+				thread: threadKey(entry.thread_ref), seq: entry.seq, body: boundText(entry.message.msg),
+			});
+			return { key: keyOf(index), from: entry.message.sender, kind: entry.message.delivery_kind, thread: threadKey(entry.thread_ref), seq: entry.seq };
+		});
+		const answers = await this.#judge(
+			scope.ctx,
+			{ focus: this.#focus(scope), trigger: this.#trigger(scope.ctx), candidates: facts },
+			{ original: { type: "choice", instructions: text("judge.original.instructions"), criteria } },
+			scope.signal,
+		);
+		this.#record("outbound.o2a_original", scope.input, answers, Date.now() - started);
+		const picked = choice(answers, "original");
+		if (picked === undefined || picked === "new_message") return undefined;
+		const entry = candidates[Number(picked.slice("answer_".length)) - 1];
+		if (entry === undefined) {
+			throw new OnlyneError("decision_unavailable", text("error.reply_relation"));
+		}
+		return {
+			ref: { sender: entry.message.sender, id: entry.message.id },
+			authority: entry.reply_authority,
+			thread_ref: entry.thread_ref,
+		};
+	}
+
+	/**
+	 * The inbound records this call can see and nobody has answered: rows delivered to this
+	 * session's context (the main session also sees rows no context claimed), minus the host's
+	 * handshake bookkeeping, minus entries a local reply already references. This set is what
+	 * O-2A offers the judge; it is never an answer by itself (RFC 0016 §7).
+	 */
+	async #replyCandidates(scope: DecisionScope): Promise<Entry[]> {
+		if (scope.readOnly === true) return [];
+		try {
+			const here = await this.#decisionContext(scope.ctx);
+			if (here === undefined) return [];
+			const rows = await this.deps.listInbox();
+			const candidates: Entry[] = [];
+			for (const row of rows) {
+				const entry = row.attention.entry;
+				if (entry === undefined || row.attention.disposition === "expired") continue;
+				if (entry.message.sender === this.deps.config.node.id) continue;
+				if (isTrustThread(this.deps.config.node.id, entry.thread_ref)) continue;
+				const deliveredHere = here.main
+					? row.context === undefined || row.context === "main"
+					: row.context === here.alias;
+				if (!deliveredHere) continue;
+				if (await this.#answered(entry)) continue;
+				candidates.push(entry);
+				if (candidates.length >= REPLY_CANDIDATES) break;
+			}
+			return candidates;
+		} catch (error) {
+			// A failed read narrows the question, not the decision: the call proceeds as a new message.
+			this.deps.log?.("onlyne.judge.hint_unavailable", { what: "reply_candidates", error: message(error) });
+			return [];
+		}
+	}
+
+	/** The context this session answers in: the main session, or a registered subagent context. */
+	async #decisionContext(ctx: ExtensionContext): Promise<{ alias?: string; main: boolean } | undefined> {
+		if (ctx.agent.id === this.deps.mainAgentId) return { main: true };
+		const record = (await this.deps.contexts.list()).find(row => row.agent_id === ctx.agent.id);
+		return record === undefined ? undefined : { alias: record.alias, main: false };
+	}
+
+	/** Whether this node already answered the entry in the thread that holds it. */
+	async #answered(entry: Entry): Promise<boolean> {
+		let cursor: string | undefined;
+		for (let page = 0; page < MAX_TAIL_PAGES; page++) {
+			const result = await this.deps.listMessages(entry.thread_ref, cursor);
+			for (const row of result.items) {
+				const ref = row.message.meta?.in_reply_to;
+				if (row.message.sender === this.deps.config.node.id && ref !== undefined
+					&& ref.sender === entry.message.sender && ref.id === entry.message.id) return true;
+			}
+			cursor = result.next_cursor ?? undefined;
+			if (cursor === undefined) return false;
+		}
+		return false;
+	}
+
 	/** Node O-2A question 1: the reply/followup/new relation, asked only when meta left it open. */
 	async #relationQuestion(scope: DecisionScope, meta: Record<string, Json>): Promise<"reply" | "followup"> {
 		const started = Date.now();
@@ -324,19 +527,18 @@ export class JudgeDecider {
 
 	/** Node O-2A question 2: the delivery target among live peers, asked only when meta.to is absent. */
 	async #targetQuestion(scope: DecisionScope, meta: Record<string, Json>): Promise<NodeId> {
-		const peers = await this.#peers();
-		if (!peers.available) {
-			throw new OnlyneError("unavailable", text("error.target_unresolved", { reason: peers.reason }));
-		}
-		// One discovered peer is the answer; none means the caller must name a target.
-		if (peers.value.length === 0) throw new OnlyneError("not_found", text("error.no_receiver"));
-		if (peers.value.length === 1) return peers.value[0]!.node_id;
+		// The same set `#peerId` resolves against: a peer this node holds a trust row with is a
+		// candidate even when discovery has nothing fresh to say about its address.
+		const peers = await knownPeers(this.deps);
+		// One known peer is the answer; none means the caller must name a target.
+		if (peers.length === 0) throw new OnlyneError("not_found", text("error.no_receiver"));
+		if (peers.length === 1) return peers[0]!.node_id;
 		const started = Date.now();
 		const answers = await this.#judge(
 			scope.ctx,
 			{
 				focus: { ...this.#focus(scope), meta_to: meta.to ?? null },
-				candidate_peers: peers.value.map(peer => ({
+				candidate_peers: peers.map(peer => ({
 					node_id: peer.node_id,
 					alias: lastSegment(peer.node_id),
 					last_seen: peer.last_seen,
@@ -347,15 +549,20 @@ export class JudgeDecider {
 				target: {
 					type: "choice",
 					instructions: text("judge.target.instructions"),
-					criteria: Object.fromEntries(peers.value.map(peer => [
-						peer.node_id,
-						text("judge.target.peer", {
-							node: peer.node_id,
-							base_url: peer.base_url,
-							instance: peer.instance_id,
-							last_seen: peer.last_seen,
-						}),
-					])),
+					criteria: {
+						// The abstain exit: an unnamed recipient must surface as ambiguous_target,
+						// never as a low-confidence random pick among peers.
+						none: text("judge.target.none"),
+						...Object.fromEntries(peers.map(peer => [
+							peer.node_id,
+							text("judge.target.peer", {
+								node: peer.node_id,
+								base_url: peer.base_url,
+								instance: peer.instance_id,
+								last_seen: peer.last_seen,
+							}),
+						])),
+					},
 				},
 			},
 			scope.signal,
@@ -365,7 +572,7 @@ export class JudgeDecider {
 		if (chosen === undefined || chosen === "none") {
 			throw new OnlyneError("ambiguous_target", text("error.delivery_target"));
 		}
-		if (!peers.value.some(peer => peer.node_id === chosen)) {
+		if (!peers.some(peer => peer.node_id === chosen)) {
 			throw new OnlyneError("decision_unavailable", text("error.target_not_published", { chosen }));
 		}
 		return chosen;
@@ -503,10 +710,11 @@ export class JudgeDecider {
 		if (typeof value !== "string" || value.length === 0) {
 			throw new OnlyneError("invalid_request", text("error.thread_reference_shape"));
 		}
-		const matches = (await this.deps.listThreads()).filter(thread => thread.thread_ref.id === value || thread.title === value);
+		const matches = (await this.#namedThreads()).filter(thread => thread.ref.id === value || thread.title === value);
 		if (matches.length > 1) throw new OnlyneError("ambiguous_target", text("error.ambiguous_local_thread", { value }));
-		if (matches.length === 1) return matches[0]!.thread_ref;
-		const slash = value.indexOf("/");
+		if (matches.length === 1) return matches[0]!.ref;
+		// The same slash grammar as #threadByAlias; a bare id names a thread the addressee hosts.
+		const slash = value.lastIndexOf("/");
 		if (slash > 0 && slash < value.length - 1) {
 			return { owner: value.slice(0, slash), id: value.slice(slash + 1) };
 		}
@@ -833,6 +1041,7 @@ export class JudgeDecider {
 				throw new OnlyneError("decision_unavailable", text("error.state_budget", { chars, cap: STATE_BUDGET_CHARS }));
 			}
 			if (dropped.length > 0) this.deps.log?.("onlyne.judge.trimmed", { dropped, chars });
+			if (this.deps.judge !== undefined) return await this.deps.judge(fitted as Row, questions);
 			const settings = (await Settings.current) ?? (await Settings.loadReadOnly({ cwd: scope.cwd }));
 			const judge = resolveJudge({
 				settings,
@@ -1247,17 +1456,31 @@ export class JudgeDecider {
 	}
 
 	async #threadByAlias(alias: string): Promise<ThreadRef> {
-		const threads = await this.deps.listThreads();
-		const matches = threads.filter(thread => thread.thread_ref.id === alias || thread.title === alias);
-		if (matches.length === 1) return matches[0]!.thread_ref;
+		const matches = (await this.#namedThreads()).filter(thread => thread.ref.id === alias || thread.title === alias);
+		if (matches.length === 1) return matches[0]!.ref;
 		if (matches.length > 1) throw new OnlyneError("ambiguous_target", text("error.ambiguous_thread", { alias }));
-		if (alias.includes("/")) {
-			const [owner, id] = alias.split("/", 2);
-			if (owner !== undefined && id !== undefined && owner.length > 0 && id.length > 0) return { owner, id };
+		// One slash grammar for every textual thread reference: the owner is the part before the
+		// LAST slash, which is safe for urn owners and for ids that never carry a slash.
+		const slash = alias.lastIndexOf("/");
+		if (slash > 0 && slash < alias.length - 1) {
+			return { owner: alias.slice(0, slash), id: alias.slice(slash + 1) };
 		}
 		throw new OnlyneError("not_found", text("error.thread_not_found", { alias }));
 	}
 
+	/**
+	 * Every thread this node can name by id or title: the ones it hosts, plus the ones it was
+	 * invited into. A joined thread lives on its owner, so naming it here is a reference, never
+	 * a claim that this node holds the thread record.
+	 */
+	async #namedThreads(): Promise<Array<{ ref: ThreadRef; title: string | undefined }>> {
+		const [owned, joined] = await Promise.all([this.deps.listThreads(), this.deps.listJoinedThreads()]);
+		return [
+			...owned.map(thread => ({ ref: thread.thread_ref, title: thread.title as string | undefined })),
+			...joined.map(thread => ({ ref: thread.thread_ref, title: thread.title })),
+		];
+	}
+
 	async #target(meta: Record<string, Json> | undefined): Promise<NodeId | undefined> {
 		if (meta === undefined) return undefined;
 		const value = meta.to;
@@ -1270,15 +1493,22 @@ export class JudgeDecider {
 	}
 
 	/**
-	 * Resolve an explicit target against live discovery. A bare alias is accepted
-	 * only when exactly one known node's last URN segment names it.
+	 * RFC 0018 §3.1: the node a mechanical `op` names, resolved against the same peer set a send
+	 * resolves `meta.to` from, so a name that addresses a peer once addresses it everywhere.
+	 */
+	async peerId(alias: string): Promise<NodeId> {
+		return this.#peerId(alias);
+	}
+
+	/**
+	 * Resolve an explicit target to a node id. Identity comes from the trust table and the
+	 * discovery catalog, never from liveness: a peer whose exchange is done is still that peer
+	 * when its discovery record goes stale or is deleted. Whether we can reach it is a delivery
+	 * question, reported as `unavailable` by the transport, not a reason to claim no such node
+	 * exists. A bare alias is accepted only when exactly one known node's last segment names it.
 	 */
 	async #peerId(alias: string): Promise<NodeId> {
-		const peers = await this.#peers();
-		if (!peers.available) {
-			throw new OnlyneError("unavailable", text("error.target_unresolved", { reason: peers.reason }));
-		}
-		const ids = [this.deps.config.node.id, ...peers.value.map(peer => peer.node_id)];
+		const ids = await this.#knownIds();
 		if (alias === "self") return this.deps.config.node.id;
 		if (ids.includes(alias)) return alias;
 		const matches = ids.filter(id => lastSegment(id) === alias);
@@ -1289,6 +1519,23 @@ export class JudgeDecider {
 		throw new OnlyneError("not_found", text("error.alias_not_found", { alias }));
 	}
 
+	/**
+	 * Every node this one can name: itself, each peer it holds a live trust row with, and each
+	 * peer discovery currently reports. The trust rows come first because they are the ones that
+	 * survive a peer moving, restarting or dropping out of the catalog for a refresh window.
+	 */
+	async #knownIds(): Promise<NodeId[]> {
+		const ids = new Set<NodeId>([this.deps.config.node.id]);
+		try {
+			for (const peer of await knownPeers(this.deps)) ids.add(peer.node_id);
+		} catch (error) {
+			// Both sources failing leaves only this node; an alias then resolves to `not_found`,
+			// which is the honest answer when nothing can be read at all.
+			this.deps.log?.("onlyne.judge.peers_unreadable", { error: message(error) });
+		}
+		return [...ids];
+	}
+
 	async #mentions(meta: Record<string, Json> | undefined): Promise<string[] | undefined> {
 		if (meta === undefined) return undefined;
 		const value = meta.mentions;
@@ -1320,11 +1567,22 @@ export class JudgeDecider {
 		const id = stringField(record, "id");
 		if (sender !== undefined && id !== undefined) {
 			// The authority is an identity, not the caller's spelling: `caerulea` and
-			// `urn:onlyne:agent:caerulea` name the same node, and the delivery target is always
-			// resolved. Comparing a raw string against a resolved id produced two contradictory
-			// errors in a row (cyanea report 1, problem 1).
+			// `urn:onlyne:agent:caerulea` name the same node, so both the ref and the authority
+			// carry the resolved id and every later comparison is like-for-like. Comparing a raw
+			// string against a resolved one produced two contradictory errors in a row
+			// (cyanea report 1, problem 1).
 			const authority = await this.#peerId(sender).catch(() => sender);
-			return { ref: { sender, id }, authority };
+			// A reference the node can prove wrong is refused here, before the ref reaches the
+			// wire and dies in the peer's not_found: an id that names a different sender locally
+			// is a definite error, and the error names the message the id really belongs to.
+			const elsewhere = (await this.deps.listInbox()).find(row =>
+				row.attention.entry !== undefined && row.attention.entry.message.id === id
+				&& row.attention.entry.message.sender !== authority);
+			if (elsewhere !== undefined) {
+				const actual = elsewhere.attention.entry!.message.sender;
+				throw new OnlyneError("invalid_request", text("error.reply_reference_conflict", { named: sender, actual }));
+			}
+			return { ref: { sender: authority, id }, authority };
 		}
 		const threadAlias = stringField(record, "thread");
 		const seq = seqField(record, "seq");
@@ -1484,14 +1742,6 @@ export class JudgeDecider {
 	}
 
 
-	async #peers(): Promise<Source<PeerRecord[]>> {
-		try {
-			return ok(await this.deps.listPeers());
-		} catch (error) {
-			return none(text("reason.discovery_unreadable", { error: message(error) }));
-		}
-	}
-
 	async #receiverContexts(nodeId: NodeId): Promise<Source<ReceiverContext[]>> {
 		try {
 			return ok(await this.deps.listReceiverContexts(nodeId));
@@ -1663,7 +1913,8 @@ function pageSize(meta: Record<string, Json>): number | undefined {
 
 function attention(meta: Record<string, Json>): "inbox" | "thread" {
 	const value = meta.attention;
-	if (value === undefined) return "thread";
+	// RFC 0005 §1: reads default to the attention list; `thread` is the switch that widens one.
+	if (value === undefined) return "inbox";
 	if (value === "inbox" || value === "thread") return value;
 	throw new OnlyneError("invalid_request", text("error.attention"));
 }