feat(referents): a follow-up reaches the session it is about (#345)

[hugolytics]

Closes #345. Boundary agreed with #352; docs follow-up is #443.

The incident

On 2026-09-05 at 13:51 Hugo typed, top-level in #plan-sessions:

can you replan today so the gym is before dinner?

That channel's route was hardcoded to mean open a new session. It started a
fresh five-stage session for a day committed at 01:41 that morning, and
discarded the request text on the way in (ConfirmPlanningDay carries only the
date). The session store knew the day was committed — standing_for had been
answering that question for the nudger all morning. The door never asked.

What this adds

A catalog of the user's standing things, one judgement over it, and a
rung in route_slack_event that delivers a follow-up into the session it
concerns.

• src/fateforger/referents/ — a new package that imports no Slack. A provider
  answers standing(owner_user_id, as_of); the catalog names what comes back;
  the resolver picks one, or none, or says it cannot tell.
• The resolver returns a referent and never an action. Resolve-then-act is
  enforced by the return type, not by prose: no outcome has a field that can
  carry a decision. What the message does to the referent is the surface's own
  judgement, which is how PR timeboxing: asked ≠ started — a question to the Schedular is answered, never turned into a session (#316–#320) #328's asked-≠-started rule survives a new door.
• Timeboxing sessions are the first provider. The task marshal is intended as
  the second, against the same interface.

It is measured, not argued

Frozen fixtures built from real timeboxing_session_states rows, 8 draws per
case on the flash pin at reasoning: minimal, ~0.4s per call.

finding	measurement
One call over all candidates beats per-candidate scoring	per-candidate: 0/8 on most cases — a candidate judged alone has no contrast
One prompt sentence carries most of the quality	74/112 → 95/112
How the never-used fact is carried	prose 93, field 94, both 91 — all inside a ~2/112 noise floor
Whether it is carried at all	dropping the row: 88/112, and "cancel that session" collapses 8/8 → 2/8 onto the wrong day
The plan gist (titles with times)	28/56 → 53/56 on the two-parallel-sessions incident (#275)
The gist does not invent matches	four probes naming blocks in neither plan: 8/8 none with it, 0/8–6/8 without
Real ambiguity survives	"move the gym", where both plans have a gym: ambiguous 8/8

A content-free descriptor is not the cautious option — it fails both ways:
false none on a block that exists, false ambiguous on one that does not.

tests/evals/test_eval_referent_resolver.py gates at 152/168 draws (90.5%).
Read its docstring before touching RESOLVER_PROMPT: the probe-unanimity gate
is the instrument, not the rate — a deliberately broken prompt still scored
87–90% against the 85% floor.

The invariant, and what it cost

No door may create a session over a day the system could not see. A none
drawn from a partial catalog is not evidence that nothing stands.

That took four fix rounds, and each round's claim of completeness was falsified
by the next review. The root cause was not the routing code: the test harness
was lying. Its fakes wrote no session rows, so two of the four minting doors
were invisible to every test. Both fakes now write what production writes, and
sessions_created asserts on rows rather than on Slack messages.

The lesson that generalises: creation is decided by whether the session key is
already known, not by the message type. Guards written as
isinstance(msg, StartTimeboxing) were false — TimeboxingUserReply creates
too, and the harness backend creates via load_or_create without sending
either.

Four ways to be wrong, and none of them writes: a false none is caught by the
structural query contradicting the model; a false ambiguous asks; a wrong
confident referent is named in a label the user sees; a target that moved is
refused at press time.

Known gaps, named rather than hidden

• DM referents are unreachable. set_redirect addresses by channel+thread;
  a {channel}:dm key names no thread. The user is told, it is metered, and it
  never falls through into a creating door. Needs a key-addressed redirect.
• Three no-catalog doors. /timebox with no argument (ruled acceptable: an
  explicit command is not an inferred follow-up), a file_share with no comment
  (not an explicit request — parked, real, mints regardless of catalog
  state), and an explicit /ff-focus binding. The right fix for all three is a
  sentinel at load_or_create, not a fourth guard.
• During a real session-store outage every timeboxing turn is refused,
  including continuing a session that stands. Correct fail-closed behaviour;
  written into docs/setup/development.md so it does not read as a total outage
  to whoever is on call.
• The eval aborts on transport flakiness in roughly half of runs
  (asyncio.gather without return_exceptions). Not CI-gate-ready.

Compounding

docs/superpowers/notes/2026-09-referent-interface-strain.md records nine
places the interface strained to fit timeboxing, and six items judged not
interface strain. It is the input to the marshal's provider and to #160, and it
is the honest answer to the map's own test: does the second provider get
cheaper because the first exists?

Verification

3056 passed, 2 skipped, 1 xfailed; -m "not slow" → 3444 passed.
tests/unit/test_slack_timeboxing_routing.py is byte-identical to main
(blob 3db9b8a) — it encodes the resolver-order contract from #310 and was
never touched.

Every refusal has a test that fails when the refusal is removed, verified by
independent disable-and-restore runs rather than by the implementers' reports.

🤖 Generated with Claude Code