Split message scanning into its own sensor (per-observation lane selection)

[aaronsb]

Follow-up from the ADR-136 message-lane refactor (PR #138, code review).

Problem

The message lane is selected per sensor in tools/attend/src/cmd/run/tick.rs via slot.name() == "peers". But the peers sensor emits two kinds of observation from one poll():

• authored messages (read_signals) — message lane, correctly;
• peer-presence events (discover_peers diff: peer started/exited, status, context-pressure) — these are EVENT-lane per ADR-136's own classification.

Because the partition is per-sensor, peer-presence events currently ride the message lane: they bypass the action-potential refractory, ride the permissive 3s governor, and record no engagement (so the neuron-decay model never builds for them).

Impact

No message loss. Only the noise-control for peer-presence is relaxed — peer churn/flapping surfaces more readily than the event lane intends. Also brittle: a future second message-bearing sensor inherits no lane.

Fix

Choose the lane per observation, not per sensor. Cleanest approach: split message scanning (read_signals + its message state: seen-set, cold-start baseline, digest) into its own Sensor (e.g. messages), leaving peers as the presence/event sensor. This removes the name() == "peers" discriminator and is the natural seam for a future external-chat (Slack) event sensor.

Documented at the tick.rs partition and ADR-136 Consequences. Refs ADR-136 (Decision 1).

[aaronsb]

The bug, as a state machine

Adding a visual record so the leak is easy to read. The clean conceptual model now lives in the docs (docs/explanation/attend-messaging/07-the-lane-gate.md, id 01.008.E) — deliberately bug-free. This issue is where the as-built gap is tracked.

As-built — the gate is keyed on sensor name

tools/attend/src/cmd/run/tick.rs:228 and the partition at :266:

stateDiagram-v2
    state "peers sensor — one poll()" as Peers
    [*] --> Peers
    Peers --> Authored : read_signals() · @Name / #group / #open
    Peers --> Presence : discover_peers() diff · peer started/exited, status, ctx%
    Authored --> Gate
    Presence --> Gate
    state "LANE GATE — slot.name() == 'peers' ?" as Gate
    Gate --> MessageLane : true (it IS the peers sensor)
    MessageLane --> A1 : authored · CORRECT
    MessageLane --> P1 : presence · LEAK
    A1 : durable delivery ✅
    P1 : skips refractory + neuron-decay ❌ (should be event lane)

Loading

Because the gate only sees the sensor's name, it can't tell the peers sensor's two kinds of output apart — both authored messages and peer-presence events ride the message lane. No message loss; only presence noise-control is relaxed (presence churn surfaces more readily than the event lane intends).

Target — gate on what the observation is

stateDiagram-v2
    [*] --> Gate
    state "LANE GATE — authored to communicate?" as Gate
    Gate --> MessageLane : yes · @Name / #group / #open / human
    Gate --> EventLane : no · git · process · **peer-presence** · future Slack-event sensor
    MessageLane --> [*] : durable · dedup · digest
    EventLane --> [*] : salience · refractory · governor · may drop

Loading

The fix (this issue): split message scanning into its own messages sensor so the lane is a property of the observation, not the emitting sensor. Two payoffs:

1. peer-presence finally gets the event lane (closes the leak, matches the 07-the-lane-gate model), and
2. any future authored source (external chat / Slack) gets the message lane automatically — it doesn't have to be named peers to be durable.

The name() == \"peers\" discriminator disappears entirely. Refs ADR-136 Decision 1.