tenant.openagents/omega

diff --git a/crates/omega_effectd/src/sarah_conversation.rs b/crates/omega_effectd/src/sarah_conversation.rs
index 1e605d7211..12d682653d 100644
--- a/crates/omega_effectd/src/sarah_conversation.rs
+++ b/crates/omega_effectd/src/sarah_conversation.rs
@@ -6735,7 +6735,7 @@ mod tests {
67356735         owner_public_key_hex: &str,
67366736         conversation_ref: &str,
67376737         text: &str,
6738-    ) -> nostr::Event {
6738+    ) -> (nostr::Event, String) {
67396739         let tags = conversation_tags(
67406740             conversation_ref,
67416741             owner_public_key_hex,
@@ -6746,13 +6746,18 @@ mod tests {
67466746             .tags(tags)
67476747             .build(sarah_keys.public_key());
67486748         rumor.ensure_id();
6749-        smol::block_on(EventBuilder::gift_wrap(
6749+        // The wrap id is not the record id. The host stores the rumor under its
6750+        // own id and projects that id to the device, so a harness that reports
6751+        // the wrap id is naming an identifier nothing downstream ever uses.
6752+        let rumor_id = rumor.id.expect("the rumor carries its id").to_hex();
6753+        let wrap = smol::block_on(EventBuilder::gift_wrap(
67506754             sarah_keys,
67516755             owner_public_key,
67526756             rumor,
67536757             [],
67546758         ))
6755-        .expect("gift wrap Sarah's message to the host")
6759+        .expect("gift wrap Sarah's message to the host");
6760+        (wrap, rumor_id)
67566761     }
67576762 
67586763     /// Publish, and survive a relay that closed an idle socket.
@@ -6949,10 +6954,20 @@ mod tests {
69496954             std::env::var("OMEGA_DEVICE_PROOF_AUTH_URL").unwrap_or_else(|_| relay_url.clone());
69506955         let host_keys = device_proof_keys("OMEGA_DEVICE_PROOF_HOST_SECRET");
69516956         let sarah_keys = device_proof_keys("OMEGA_DEVICE_PROOF_SARAH_SECRET");
6952-        let device_public_key_hex = std::env::var("OMEGA_DEVICE_PROOF_DEVICE_PUBKEY")
6953-            .expect("OMEGA_DEVICE_PROOF_DEVICE_PUBKEY must be the simulator's 64-hex device key")
6954-            .trim()
6955-            .to_string();
6957+        // Comma-separated, so one host can admit an iOS surface and an Android
6958+        // surface at the same time. omega#49 asks for a result on both, and a
6959+        // host that can only ever hold one grant proves the fan-out by
6960+        // assertion rather than by running it.
6961+        let device_public_key_hexes: Vec<String> = std::env::var("OMEGA_DEVICE_PROOF_DEVICE_PUBKEY")
6962+            .expect("OMEGA_DEVICE_PROOF_DEVICE_PUBKEY must be the surfaces' 64-hex device keys")
6963+            .split(',')
6964+            .map(|value| value.trim().to_string())
6965+            .filter(|value| !value.is_empty())
6966+            .collect();
6967+        assert!(
6968+            !device_public_key_hexes.is_empty(),
6969+            "OMEGA_DEVICE_PROOF_DEVICE_PUBKEY must name at least one device key"
6970+        );
69566971         let state_path = std::path::PathBuf::from(
69576972             std::env::var("OMEGA_DEVICE_PROOF_STATE")
69586973                 .expect("OMEGA_DEVICE_PROOF_STATE must be a durable state file path"),
@@ -6976,7 +6991,7 @@ mod tests {
69766991         config.identity.sarah_public_key_hex = sarah_public_key_hex.clone();
69776992         config.conversation_digest = owner_public_key_hex[..24].to_string();
69786993         config.relay_url = Some(relay_url.clone());
6979-        config.admitted_device_public_key_hexes = vec![device_public_key_hex.clone()];
6994+        config.admitted_device_public_key_hexes = device_public_key_hexes.clone();
69806995         config.approved_device_scopes = vec![
69816996             crate::Issue31PairingScope::ObserveIssue31,
69826997             crate::Issue31PairingScope::SendMessage,
@@ -6997,11 +7012,15 @@ mod tests {
69977012             sarah_relay.connect().expect("sarah connect");
69987013             Some(sarah_relay)
69997014         };
7015+        // The exact sources this run seeded, so the loop can say whether each
7016+        // one reached each device rather than leaving "the host admits it and
7017+        // never projects it" to be inferred from a device screenshot.
7018+        let mut seeded_sources: Vec<(&'static str, String)> = Vec::new();
70007019 
70017020         if seed {
70027021             let sarah_relay = sarah_publisher.as_mut().expect("sarah adapter");
70037022             let now = unix_now();
7004-            let greeting = sarah_conversation_wrap(
7023+            let (greeting, greeting_rumor_id) = sarah_conversation_wrap(
70057024                 &sarah_keys,
70067025                 &owner_public_key,
70077026                 &owner_public_key_hex,
@@ -7010,7 +7029,8 @@ mod tests {
70107029             );
70117030             device_proof_publish(sarah_relay, &auth_url, &sarah_keys, &greeting)
70127031                 .expect("publish the Sarah greeting");
7013-            eprintln!("device-proof: seeded Sarah message {}", greeting.id.to_hex());
7032+            eprintln!("device-proof: seeded Sarah message {greeting_rumor_id}");
7033+            seeded_sources.push(("greeting", greeting_rumor_id));
70147034 
70157035             // One encrypted engram, so "inspect memory" has a real source.
70167036             // An engram body is a JSON object with a `mem/…` slug and a value,
@@ -7043,6 +7063,7 @@ mod tests {
70437063             device_proof_publish(sarah_relay, &auth_url, &sarah_keys, &engram)
70447064                 .expect("publish the engram");
70457065             eprintln!("device-proof: seeded engram {}", engram.id.to_hex());
7066+            seeded_sources.push(("engram", engram.id.to_hex()));
70467067 
70477068             if quarantine {
70487069                 // Inside every record-level bound and outside the projection body
@@ -7113,7 +7134,9 @@ mod tests {
71137134 
71147135         eprintln!("device-proof: host  npub/hex {owner_public_key_hex}");
71157136         eprintln!("device-proof: sarah hex      {sarah_public_key_hex}");
7116-        eprintln!("device-proof: device hex     {device_public_key_hex}");
7137+        for device_public_key_hex in &device_public_key_hexes {
7138+            eprintln!("device-proof: device hex     {device_public_key_hex}");
7139+        }
71177140         eprintln!("device-proof: conversation   {conversation_ref}");
71187141         eprintln!("device-proof: relay          {relay_url}");
71197142 
@@ -7153,7 +7176,7 @@ mod tests {
71537176                     // which the host never subscribes to, so every reply it
71547177                     // reported sending was discarded in transit and the reply
71557178                     // arm of this proof had never once run.
7156-                    let reply = sarah_conversation_wrap(
7179+                    let (reply, _reply_rumor_id) = sarah_conversation_wrap(
71577180                         &sarah_keys,
71587181                         &owner_public_key,
71597182                         &owner_public_key_hex,
@@ -7202,6 +7225,31 @@ mod tests {
72027225                         eprintln!("device-proof: grant {} · {line}", projection.grant_ref);
72037226                         announced_grants.insert(projection.grant_ref.clone(), line);
72047227                     }
7228+                    // Whether each seeded source actually reached this grant.
7229+                    // "The host admits the engram and never projects it" was
7230+                    // read off a device surface; the host can state it directly.
7231+                    for (name, source_event_id) in &seeded_sources {
7232+                        let projected = host.source_was_projected(
7233+                            &projection.grant_ref,
7234+                            projection.generation,
7235+                            source_event_id,
7236+                        );
7237+                        if !projected {
7238+                            continue;
7239+                        }
7240+                        let key = format!("projected:{}:{name}", projection.grant_ref);
7241+                        if announced_grants
7242+                            .insert(key, source_event_id.clone())
7243+                            .as_ref()
7244+                            != Some(source_event_id)
7245+                        {
7246+                            eprintln!(
7247+                                "device-proof: PROJECTED {name} {} · {}",
7248+                                &source_event_id[..16],
7249+                                projection.grant_ref
7250+                            );
7251+                        }
7252+                    }
72057253                 }
72067254             }
72077255             if let Some(revoke_after) = revoke_after {