feat: cross-conversation context for a seat, and collapse private asides - #2247

A seat took its turn holding one conversation: the desk in front of it.
An agent seated on two desks, or holding its own direct line, answered on
one of them knowing nothing of the others — and re-seeded rather than
remembered, because `SharingState` is a single conversation and a single
watermark.

This gives every speaker its *other* conversations in its prompt: each
desk it also sits on, and its own direct line, each already projected for
it. Four constraints shape it, and each is load-bearing:

**Projected as the speaker, never as the operator.** `Viewer::Agent`, so
an aside it is not in arrives elided here exactly as it would at home.
Passing `Viewer::Operator` would hand a seat every private row in the
company.

**Out of the fold.** `step` still folds only the deliberating
conversation, so a row from elsewhere can be quoted and can never move an
option towards a decision. Information crosses a boundary; support does
not — the same bargain an aside strikes and a referral's answer strikes.

**The deliberating desk is excluded from the load.** It comes from
`project_for`, not from this. Loading it in full would re-insert the peer
rows a blind round withheld while quorum kept counting as though
independence held: the appearance of it with none of the property, which
is worse than not having it.

**Per conversation, never merged.** Two desks number their rows
independently, so a merged `[7]` would name two different messages.

`company_desks` is split out of `desk_federation` because that gates on
the home desk's referral opt-in, and whether a seat may *ask* another
desk a question is not the same permission as whether it can already
*read* a desk it sits on. Unset renders nothing, including no read of the
direct line, so every caller that existed before is byte-identical.

Add coverage for the finance company switching behavior to verify it works as expected.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

A seat writes its move and may add one `!aside @peer` line beneath it.
The host journals that line as its own row carrying an `audience`, and
the projection had no way to tell it from an ordinary reply — so it
reached the operator's transcript verbatim, `!aside @refunds` and all,
addressed to a room it was never addressed to.

Two defects in one row, and they need different fixes.

**The grammar leaked.** `MOVE_KINDS` deliberately omits `aside` — a
marker the fold discards is not a move anybody made — so `line_kind`
returns `None` and `readable_moves` leaves the head in the body. The
strip lives here instead, and takes every leading `@name` rather than the
first, since a desk may raise `max_members`.

**The row read as the room's own voice.** Aside rows are now lifted out
of the transcript and hung on the nearest preceding desk-visible row *by
the same author* — the move they rode under. By author rather than
adjacency: two seats asiding in one round would otherwise cross. An
orphan — no move above it, a page that begins mid-exchange — is kept as
an ordinary row, matching the rule the referral fold already states one
function below: a line in the wrong shape beats a line nobody can read.

The console renders it as `ReferralConversation`'s sibling, collapsed,
`aside @Refunds · 1 message`, dashed where a referral's border is solid.

**The collapse is tidiness, not access control**, and that is the one
thing not to copy from the referral. A referral's rows are dropped
host-side, so expanding is the only way to read them at all. An aside is
withheld from *agents* outside it and never from a person —
`Audience::admits` admits every operator unconditionally, because privacy
here is a deliberation device and not a security boundary. Expanding
reveals nothing the reader was not already entitled to.

`an_aside_reaches_the_operator_as_a_collapsed_conversation` covers the
seam: a real episode writes an aside, and the operator gets it folded.
Both halves were already tested — that asides are journaled with an
audience, and that the fold groups such rows — and neither noticed that
nothing joined them, which is exactly where the leak lived.

Two bundle changes, both made to exercise the aside path end to end.

**Asides on all three desks.** `AsidePolicy::DEFAULT` permits nothing —
deliberately, because the mechanism does not get the benefit of the
doubt — so a desk that wants one says so. Bounds are left at their
defaults: a pair (`max_members = 1`, excluding the author), two rows (a
question and an answer), and `must_surface`, which makes a pair deposit
one desk-visible line before opening another. Widening them would turn an
aside into what the spec calls a second desk with no quorum and no
record.

**`triage` joins `returns`.** Nine read tools and no mutating one, so it
is a checker rather than a third competing remedy. On two seats an aside
was the whole room minus one, and the elision stub had no reader to be a
stub for; with three, an outsider exists and the collapse means
something. `tau2-sim.py` moves in step because `--check` asserts desk
membership exactly.

Measured, and worth recording honestly: this did not make asides
frequent. Across seven runs of task 0 exactly one seat wrote an aside,
unbidden, and it was the narrow case the mechanism is for — a seat that
could swap items but held no refund tool asking the seat that did. Every
deliberate attempt failed, including a seat writing a dictated line that
was then discarded because addressing one agent is a responder turn and
not an episode. Rooms coordinate tool boundaries in the open, which is
what `must_surface` and the prompt both push them towards.

Add unit coverage for escaping an onboarding gate that becomes stuck, ensuring users can continue navigating when the gate cannot complete.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Every seat's hand-off block carried two defects that failed silently.

**The mention form was wrong.** The block said `@returns`, and a desk is
addressed as `@#returns` — the `@#` form resolves to a desk and cannot be
shadowed by a teammate who happens to share the name. A bare mention
resolves to nothing and reaches nobody, so the hand-off was dropped with
no error and the work never happened.

**Two seats named their own desk.** `exchanges` and `refunds` sit on
`returns` and were told to write `@returns`, copied from the `order_ops`
seats without changing the target. That is a self-desk referral, and
`delegates_to` authorises only `order_ops` in any case, so both were
refused — silently — and no case ever crossed from returns to order
operations.

**The block also misdescribed what a referral is.** It promised the far
desk's seats would deliberate the question between them and return what
the room settled on. A referral is at most one turn: one teammate on that
desk answers, and what comes back is one colleague's reading, on the
record, for the asker to weigh. It is information and not a vote — it
supports nothing here until a seat spends a line acting on it.

`triage` now routes on order status and nothing else: `@#order_ops` for
pending, `@#returns` for delivered.

The README's credential example gains the `models` map. The paragraph
directly beneath it already warned that an omitted `models` becomes an
empty map that shadows the bundle's own table, leaving the next turn
asking the provider for a model nobody chose — and the example above it
omitted exactly that.

The working indicator could name whoever the first live frame named, and
nothing else. A receipt is client state: a reload throws it away, and the
re-armed indicator had nothing left to say but a bare "Working…".

The host now records who it expects to answer on the open-turn row, and
serves it, so the reload leg has a name to show. It is optimistic exactly
as the host's own row is — the brain may still pick a different seat, and
the first frame of the resumed turn overwrites it. Absent from a host
that does not record it, which reads as it did before.

`mergeOpenTurns` folds a re-arm onto an existing row by spreading it, so
the key is omitted rather than set to `undefined` when the host named
nobody: a present-but-undefined key would erase a name the POST leg had
already put there, where an absent one leaves it standing.

Two tests cover it — that the indicator names the teammate, and that the
reload leg keeps the name the live leg found.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Brings the inference managed-provider read-back fix, the Chargebee migration
pitch on Finance -> Invoicing, and the durable onboarding-gate dismissal onto
PR tinyhumansai#2247's cross-conversation-context branch, so both can be worked on together.

No file is touched by both sides.

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Introduce a built-in agent session for the harness so agent runs can be
driven through the standard built-in interface.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Switched the agent session to the shared GENERAL_DESK constant and the EventSeq::new constructor instead of local equivalents, and widened operator_label to pub(super) so it can be reused. No behaviour change.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add the agent_session module to the built-in harness so its watermark and
channel identity cue block are available to callers.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

…aring

The agent now keeps one continuous session across every chat it serves,
receiving only the rows it has not yet seen, each cued with its origin
channel, rather than clearing its history and re-seeding whenever the
chat changes. Audience narrowing still applies, so private exchanges the
agent is not party to remain out of reach, but channel isolation is
deliberately dropped so the agent can carry context between

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add a session field to CompanyAgent holding the agent session state, initialized at each construction site. The watermark is kept beside bound_chat rather than inside it so it survives a channel switch instead of being cleared and reseeded per chat.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

ChatSeedRequest now exposes session_delta, which walks the journal for rows
the agent has not yet been handed across every channel it can read, returning
None when the company record is unreadable so the caller leaves the session
untouched. render_cues no longer takes an unused agent_id.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Inbound turns now carry their session cue block ahead of the message text,
matching the reference implementation where inbound is a cued turn rather
than a synthesised tool result. The text is borrowed when no cues are
present, so ordinary same-channel replies pay nothing for the change.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Expose desk_post, desk_dm, desk_close and desk_read as tool calls whose names, argument shapes and descriptions come from tinyhivemind::speech. The module stays off unless the manifest enables [speech].

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The test agent builder now initializes an AgentSessionState so the
constructed agent matches the current struct shape.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Speech tools now declare PermissionLevel::None instead of Safe, since
speaking has no effect outside the company and the approval bridge
classifies by tool name anyway; a turn that must ask permission to answer
cannot answer. Peer validation in DmTool also now uses
resolve_teammate_key so only genuinely unknown teammates are reported.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Add a `[speech]` section to the company manifest with an `enabled` flag that
registers the desk speech tools on every agent's belt. The setting lives at the
company level rather than per desk because speech is a property of an agent's
continuous session, which spans every desk it sits on. It defaults to off and
never silences an agent, since return text is still journaled when no speech
tool is called.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Agents whose manifest sets `[speech] enabled` now get the speech belt
registered alongside their other tools, gated on an event log being
available since the tools are themselves the append. Without an event
log the return-text path is kept, matching the fallback for an uncalled
tool.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

build_agent now takes a speech_enabled bool instead of reading the
manifest's speech block itself, so the caller resolves the flag once and
the builder keeps a single source of truth. This follows the same
precedent as is_orchestrator, which already arrives pre-decided.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The agent constructor now receives the company's speech.enabled setting, which was previously not forwarded from the manifest. This ensures agents are built with the correct speech configuration instead of relying on a default.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The episode metadata fields were inadvertently dropped during a previous refactor, causing downstream consumers to lose access to episode-level information. This change restores the metadata struct and its associated accessor methods, ensuring the episode API remains backward compatible.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Reformat the `collides_with_desk` boolean expression to break the chained iterator calls across multiple lines, improving code readability without changing any behaviour.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Introduce a built-in agent session for the harness so sessions can be
driven directly from the runtime. This provides the foundation for
running agent interactions without an external driver.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The speech tool output capture was previously removed, which broke the ability to verify spoken responses in tests. This change restores the capture mechanism so that speech output can be properly asserted against expected values.

Auto-committed-on: macbook
Co-authored-by: Medulla <medulla@tinyhumans.ai>

A bare direct-line target is only safe when it cannot also name a declared desk, since `addresses_desk` accepts either spelling and querying the bare id for an unrelated desk with the same id/name would leak that desk's rows into the agent's prompt. The change adds a safety check that omits the bare target when a collision exists, relying on the prefixed spelling used elsewhere for DMs written after the guard.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The closing brace of the `credential_slug` function was misaligned, causing a formatting inconsistency. This change corrects the indentation to match the surrounding code style.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Update the locked version of the syn crate from 3.0.3 to 3.0.4 across three dependency entries in Cargo.lock, reflecting a patch-level dependency resolution change.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The inference e2e test was previously removed, but it is now restored to ensure the inference flow remains covered by end-to-end testing.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The test file for the managed inference round trip has been deleted. This test was redundant as the same behavior is already covered by the end-to-end test in `inference.spec.ts`, which validates the round trip against a real host. Removing this duplicate unit test reduces maintenance overhead while preserving coverage of the managed route behavior.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

The inference declaration now includes the selected provider kind alongside the normalized provider name, preserving the original provider selection for cases where normalization changes the value. This ensures downstream consumers can distinguish between the normalized and originally selected providers.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>