tenant.openagents/omega

Show a provider handoff in the thread the owner reads (#96)

Show a provider handoff in the thread the owner reads (#96) FA-07 gate 5 has been red on every candidate through 0.2.0-rc17, and the red is in the host, not the engine. omega-effectd moves a Full Auto run between provider lanes and emits a note naming both, addressed to the target thread. The host method it calls answered unavailable("Agent threads do not expose an owner-visible system-note authority.") That refusal is typed and honest — an improvement on rc11's silent `() => {}` — and it is still rc11's defect where it counts: a run that changed which model was spending the owner's budget left nothing in the transcript the owner reads. An independent reviewer bound the string to the shipped bytes of rc15 and rc16; it is in rc17 too. The refusal was accurate about the code. AgentThreadEntry had six variants and every one was something a model or a user said, so a host-authored disclosure had nowhere to be. This adds the seam: - AgentThreadEntry::SystemNote, carrying an engine-supplied id and plain text, and AcpThread::push_system_note, idempotent on that id. A retry after a response the engine never saw must not double the disclosure, and must not rewrite one the owner has already read, so the id wins over the newer text. - ThreadView::render_system_note, drawn unconditionally as a captioned rule — the shape the thread already uses for "Subagent Output". No collapse, no toggle, no hover: the gate is owner visibility, and anything the owner has to click to see is a disclosure the rc11 handoff would also have passed. The text is a SharedString drawn as a Label, never parsed as Markdown, so nothing a provider emits can style one of these lines or pass itself off as one. - append_system_note resolves the thread named by threadRef and appends there. A handoff is addressed to the target thread; filing it against the nearest thread would put the disclosure where the owner stopped reading. OMEGA-DELTA-0045 records it, with three separable checks because each half alone is passable and useless: a variant nothing renders discloses nothing, a renderer nothing dispatches to discloses nothing, and a host method returning {"appended": true} without writing anything is a refusal that lies rather than one that is honest. The delta also states the cost this accepts — a variant added to crates/acp_thread is a real rebase surface, unlike OMEGA-DELTA-0021, which kept its record out of that crate behind an extension trait. An extension trait cannot add an enum variant, and a side table keyed by entry index would not survive reordering, would miss the Markdown export, and would put the disclosure somewhere other than where the transcript is read. Falsified, each edit probed in the file before its test ran: removing the render dispatch while leaving the renderer defined failed the render check; restoring the refusal string failed the host check; dropping the id key failed both the source check and the behavioural test, on the "must not append again" assertion. This is the source half. Every candidate through rc17 carries the refusal in its shipped bytes; the packaged half needs the next one. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>