@animalabs/agent-framework 0.19.0 → 0.20.0

package/dist/src/framework.js

@@ -16,7 +16,10 @@ import { FeatureSetManager } from './mcpl/feature-set-manager.js';
 import { computeGrant, CapabilityGrant, expandAdvertisementShorthand } from './mcpl/capability-grant.js';
 import { maskNegotiatedCapabilities } from './mcpl/capability-mask.js';
 import { HookOrchestrator } from './mcpl/hook-orchestrator.js';
-import { PushHandler } from './mcpl/push-handler.js';
+import { ToolLifecycleEmitter, parseToolObserveParams } from './mcpl/tool-lifecycle.js';
+import { BUILTIN_TOOL_CLASSES, normalizeClassTable, parseDeclaredClasses, resolveToolClass } from './mcpl/tool-classes.js';
+import { PushHandler, convertBlock as convertPushBlock } from './mcpl/push-handler.js';
+import { PushCoalescer, CoalesceError, PUSH_COALESCING_SUPPORT, validateCoalesceMember, validateCoalescedContent, coalescingSubjectKey, } from './mcpl/push-coalescer.js';
 import { parseProsePrefix, parseHybridProsePrefix } from './mcpl/prose-grammar.js';
 import { ProseStreamRouter } from './mcpl/prose-stream-router.js';
 import { detectKnownToolWrapperProse } from './tool-wrapper-prose-guard.js';
@@ -26,9 +29,9 @@ import { ConversationRouter } from './mcpl/conversation-router.js';
 import { safeSlice } from './safe-slice.js';
 import { toolResultDataToHistoryString, truncateForHistory, DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS, } from './tool-result-history.js';
 import { TOOL_IMAGE_REF_RE, ToolImageLedger, formatPreservedImageSlots, parseImagePlaceholders, sha256Hex, splitPreservingImageSlots, } from './tool-image-ledger.js';
-import { randomUUID } from 'node:crypto';
-import { PyRunner, buildInjectedTools } from './code-execution/py-runner.js';
-import { buildCodeExecutionToolDefinition, CODE_EXECUTION_TOOL_NAME, } from './code-execution/tool-definition.js';
+import { randomUUID, createHash } from 'node:crypto';
+import { PyRunner, buildInjectedTools, formatLimit } from './code-execution/py-runner.js';
+import { buildCodeExecutionToolDefinition, CODE_EXECUTION_TOOL_NAME, scriptTimeLimits, validateCodeExecutionConfig, } from './code-execution/tool-definition.js';
 import { splitProseSegments } from './prose-segments.js';
 import { cumulativeDelta } from './usage-accounting.js';
 import { stampThinkingTokenEstimates } from './thinking-token-stamp.js';
@@ -289,6 +292,10 @@ import { OperatorActionError, OperatorLog, capIds, defaultOperatorLogPath, } fro
 const FRAMEWORK_STATE_ID = 'framework/state';
 /** Snapshot slot mirroring context writes deferred while quiesced (#122). */
 const DEFERRED_WRITES_ID = 'framework/deferred-writes';
+/** RFC-006 coalescing bookkeeping: receipts (retry window) + subject history. */
+const COALESCING_STATE_ID = 'mcpl/coalescing';
+/** Receipts written since the last snapshot flush (bridges the throttle window). */
+const COALESCING_RECENT_ID = 'mcpl/coalescing-recent';
 /** Above this serialized size the deferred-write mirror is skipped (kept in
  *  memory only) rather than rewriting a multi-MB snapshot per deferral. */
 const DEFERRED_WRITES_PERSIST_CAP_BYTES = 4 * 1024 * 1024;
@@ -300,7 +307,8 @@ function withDeferredWriteId(metadata, id) {
     return { ...(metadata ?? {}), deferredWriteId: id };
 }
 function isTurnContinuation(reason) {
-    return reason === 'context_budget_restart' || reason === 'tool_results_ready';
+    return reason === 'context_budget_restart' || reason === 'tool_results_ready'
+        || reason === 'tool_result_guard_retry';
 }
 const CONVERSATION_ROUTER_STATE_ID = 'framework/conversation-router';
 const INFERENCE_LOG_ID = 'framework/inference-log';
@@ -782,7 +790,33 @@ export class AgentFramework {
     mcplServerRegistry = null;
     featureSetManager = null;
     hookOrchestrator = null;
+    /** MCPL RFC-007: `tools/lifecycle` to observing servers. Created with the
+     *  MCPL subsystem; inert (no tracking) while no connection holds
+     *  `toolLifecycle.observe`. */
+    toolLifecycleEmitter = null;
+    /** MCPL RFC-008 class sources, normalized: operator overrides, then host
+     *  knowledge (embedding host's table ahead of the built-in one). */
+    toolClassOverrides = [];
+    hostToolClasses = normalizeClassTable(BUILTIN_TOOL_CLASSES, 'BUILTIN_TOOL_CLASSES');
     pushHandler = null;
+    /** RFC-006 coalescing (see mcpl/push-coalescer.ts for the design). */
+    pushCoalescer = null;
+    /** Both lanes are admitted in arrival order: a create, edit and delete of
+     *  one subject must not overtake one another while routing awaits. */
+    coalescingAdmission = Promise.resolve();
+    coalescingSaveTimer = null;
+    coalescingSnapshotDirty = null;
+    coalescingRecentReceipts = [];
+    /**
+     * Agents that read the residents' shared un-namespaced message slot: every
+     * ordinary resident (their context managers are not isolated) and the
+     * subconscious (isolated, but merging that slot read-only). A message in
+     * that slot is unread only if NONE of them has compiled past it. Forks and
+     * ephemeral agents have isolated slots and are their own only readers.
+     */
+    sharedSlotAgents = new Set();
+    /** Group commit: one fsync per event-loop turn, shared by every waiter. */
+    coalescingCommit = null;
     inferenceRouter = null;
     channelRegistry = null;
     checkpointManager = null;
@@ -833,10 +867,15 @@ export class AgentFramework {
     mcplTools = [];
     /** Namespaced tool name → stateful feature-set attribution from tools/list. */
     mcplToolFeatureSets = new Map();
+    /** Namespaced tool name → the server's RFC-008 `_meta["mcpl/class"]`. */
+    mcplToolClasses = new Map();
     mcplToolRefreshInFlight = false;
     mcplToolRefreshPending = false;
     /** Maps tool prefix → serverId for dispatch routing. */
     mcplPrefixMap = new Map();
+    /** Namespaced tool name → the server whose tools/list produced it. Prefixes
+     *  can nest (`foo`, `foo--bar`), so a prefix match alone can name two. */
+    mcplToolServers = new Map();
     /** Maps serverId → McplServerConfig for prefix lookup. */
     mcplServerConfigs = new Map();
     /** Host capabilities advertised during the MCP handshake — stored so servers
@@ -869,6 +908,8 @@ export class AgentFramework {
     eventGate = null;
     // Session-level token usage tracking (always-on)
     usageTracker;
+    /** Explicit-send suppression carried into a tool-result-guard retry. */
+    guardRetryTurnSilenced = new Map();
     /** Presentation-only wall-clock zone; persistence remains UTC/epoch. */
     timeZone;
     constructor(store, ownsStore, membrane, inferencePolicy, errorPolicy, syncIntervalMs, maintenanceIntervalMs, processLoggingPersist, processLoggingBroadcast, timeZone, discordAwarenessOutbox, discordAwarenessEmoji, discordAwarenessDeadlineMs, operatorLog = new OperatorLog(undefined)) {
@@ -912,6 +953,9 @@ export class AgentFramework {
      * Create and start the framework.
      */
     static async create(config) {
+        // Before anything opens or starts: a refused config must leave nothing behind.
+        if (config.codeExecution?.enabled)
+            validateCodeExecutionConfig(config.codeExecution);
         // Create or use existing store
         let store;
         let ownsStore;
@@ -939,6 +983,14 @@ export class AgentFramework {
         catch {
             // Already registered
         }
+        for (const id of [COALESCING_STATE_ID, COALESCING_RECENT_ID]) {
+            try {
+                store.registerState({ id, strategy: 'snapshot' });
+            }
+            catch {
+                // Already registered
+            }
+        }
         try {
             store.registerState({
                 id: INFERENCE_LOG_ID,
@@ -1099,6 +1151,11 @@ export class AgentFramework {
         // Client-side programmatic tool calling (code_execution). Config is only
         // retained when enabled — everything downstream gates on the field.
         framework.codeExecutionConfig = config.codeExecution?.enabled ? config.codeExecution : null;
+        framework.toolClassOverrides = normalizeClassTable(config.toolClassOverrides, 'toolClassOverrides');
+        framework.hostToolClasses = [
+            ...normalizeClassTable(config.hostToolClasses, 'hostToolClasses'),
+            ...normalizeClassTable(BUILTIN_TOOL_CLASSES, 'BUILTIN_TOOL_CLASSES'),
+        ];
         if (config.toolResultInlineMaxChars !== undefined) {
             const cap = config.toolResultInlineMaxChars;
             if (!Number.isFinite(cap) || cap < 1000) {
@@ -1264,6 +1321,8 @@ export class AgentFramework {
      * Stop the event loop.
      */
     async stop() {
+        this.pushCoalescer?.suspend();
+        this.flushCoalescingSnapshot();
         this.running = false;
         // Flushed-but-unsynced deferred writes: sync and ack now, while the
         // store is still open, rather than leaving them to a reboot replay.
@@ -1331,6 +1390,16 @@ export class AgentFramework {
             shutdownPromises.push(this.mcplServerRegistry.closeAll());
         }
         await Promise.all(shutdownPromises);
+        // Streams may queue storage repairs while being cancelled above. Retry
+        // after their teardown, while the store is still open, before final sync.
+        for (const agent of this.agents.values()) {
+            try {
+                agent.toolResultGuard.flushUnrecorded();
+            }
+            catch (error) {
+                console.error(`[tool-result-guard] agent=${agent.name} could not finish queued storage work at stop:`, error);
+            }
+        }
         // Final sync before closing
         try {
             this.store.sync();
@@ -1592,6 +1661,12 @@ export class AgentFramework {
     }
     async runQueuedMaintenance() {
         const queued = [...this.agents.values()].flatMap((agent) => {
+            try {
+                agent.toolResultGuard.flushUnrecorded();
+            }
+            catch (error) {
+                console.error(`[tool-result-guard] agent=${agent.name} storage retry failed during maintenance:`, error);
+            }
             const cm = agent.getContextManager();
             const tools = this.getToolsForAgent(agent.name).filter((tool) => agent.canUseTool(tool.name));
             cm.setToolDefinitions(tools);
@@ -1884,6 +1959,11 @@ export class AgentFramework {
             ext.keys.forEach((k) => taken.add(k));
             result.set('_framework', ext);
         }
+        {
+            const ext = this.toolResultGuardSettingsExtension();
+            ext.keys.forEach((key) => taken.add(key));
+            result.set('_toolResultGuard', ext);
+        }
         for (const module of this.moduleRegistry.getAllModules()) {
             const ext = module.getAgentSettingsExtension?.();
             if (!ext)
@@ -1948,6 +2028,56 @@ export class AgentFramework {
             sameRoundThinkTextPolicy: agent.getEffectiveSameRoundThinkTextPolicy(),
         };
     }
+    toolResultGuardSettingsExtension() {
+        const get = (name) => {
+            const guard = this.agents.get(name)?.toolResultGuard;
+            return {
+                tool_result_guard: guard?.enabled ?? false,
+                tool_result_guard_source: guard?.settingOverride !== undefined ? 'runtime_override' : 'recipe_default',
+            };
+        };
+        const set = (name, enabled) => {
+            const agent = this.agents.get(name);
+            if (!agent)
+                throw new Error(`Unknown agent: ${name}`);
+            const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+            const state = (data && typeof data === 'object' ? data : {});
+            const values = { ...(state.toolResultGuards ?? {}) };
+            if (enabled === undefined)
+                delete values[name];
+            else
+                values[name] = enabled;
+            state.toolResultGuards = values;
+            this.store.setStateJson(FRAMEWORK_STATE_ID, state);
+            agent.toolResultGuard.setOverride(enabled);
+            return get(name);
+        };
+        return {
+            properties: {
+                tool_result_guard: {
+                    type: 'boolean',
+                    description: 'Enable the tool result guard. It can withhold a batch of tool output and retry inference once. ' +
+                        'Tools are not re-executed. Persists across turns and restarts until explicitly changed. ' +
+                        'Disabling affects future results only; previously withheld results stay withheld.',
+                },
+            },
+            keys: ['tool_result_guard'],
+            get,
+            update: (name, patch) => {
+                if (typeof patch.tool_result_guard !== 'boolean')
+                    throw new Error('tool_result_guard must be a boolean');
+                return set(name, patch.tool_result_guard);
+            },
+            reset: (name) => set(name, undefined),
+        };
+    }
+    restoreToolResultGuardSetting(agent) {
+        const enabled = this.store.getStateJson(FRAMEWORK_STATE_ID)?.toolResultGuards?.[agent.name];
+        if (enabled !== undefined && typeof enabled !== 'boolean') {
+            throw new Error(`Invalid persisted tool_result_guard for ${agent.name}: expected a boolean`);
+        }
+        agent.toolResultGuard.setOverride(enabled);
+    }
     buildThinkTool(policy) {
         return {
             name: 'think',
@@ -2024,6 +2154,19 @@ export class AgentFramework {
             return tool;
         });
     }
+    /**
+     * The tools one agent is shown at inference: its surface (the subconscious
+     * has its own), less what its permissions deny, plus — for explicit-mode
+     * agents — the on-demand routing reference (teach-by-bounce: the grammar
+     * is never injected, only served when asked). Inference and the RFC-008
+     * listing both use this, so the listing cannot drift from the model's view.
+     */
+    agentToolSurface(agent, snapshot) {
+        const tools = this.getToolsForAgent(agent.name, snapshot).filter((t) => agent.canUseTool(t.name));
+        if (agent.proseRouting === 'explicit')
+            tools.push(PROSE_HELP_TOOL);
+        return tools;
+    }
     getAgentRuntimeSettings(agentName) {
         const agent = this.agents.get(agentName);
         if (!agent)
@@ -3198,6 +3341,8 @@ export class AgentFramework {
                 debugLogContext: !!process.env.DEBUG_CONTEXT,
             });
             const agent = new Agent(config, contextManager, this.membrane);
+            this.restoreToolResultGuardSetting(agent);
+            agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
             this.ephemeralCandidates.set(agent, contextManager);
             const cleanup = () => {
                 // Don't close the store — it's shared. Just release the CM.
@@ -5216,6 +5361,9 @@ export class AgentFramework {
             viewFilter: (message) => !message.metadata?.tuneOut,
         });
         const agent = new Agent(config, contextManager, this.membrane);
+        this.restoreToolResultGuardSetting(agent);
+        agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
+        this.sharedSlotAgents.add(agent);
         const restoredSettings = this.readAgentRuntimeSettings(config.name);
         if (restoredSettings) {
             agent.restoreRuntimeSettings(this.validatePersistedAgentRuntimeSettings(config.name, restoredSettings));
@@ -5283,6 +5431,9 @@ export class AgentFramework {
             allowedTools: [...SUBCONSCIOUS_TOOL_NAMES, 'think', 'skip_reply', 'end_turn'],
         };
         const agent = new Agent(agentConfig, contextManager, this.membrane);
+        this.restoreToolResultGuardSetting(agent);
+        agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
+        this.sharedSlotAgents.add(agent); // reads the shared slot through its merged view
         this.agents.set(name, agent);
         this.agentConfigs.set(name, agentConfig);
         this.subconsciousAgentName = name;
@@ -5348,6 +5499,9 @@ export class AgentFramework {
                 scriptWaiter(event.result);
                 return;
             }
+            // RFC-007: the call's terminal (completed / failed) — the result
+            // itself is never sent, only whether it was an error.
+            this.toolLifecycleEmitter?.onResult(event.agentName, event.callId, event.result);
             const agent = this.agents.get(event.agentName);
             if (agent) {
                 this.touchEphemeralRun(event.agentName, true);
@@ -5390,7 +5544,8 @@ export class AgentFramework {
                     // byte-matched (the window stores what the membrane sends;
                     // divergence breaks the compile prefix).
                     const { blocks: toolResultContent, spilled } = await this.buildStoredToolResultContent(agent.name, currentState.toolResults, maxChars);
-                    agent.getContextManager().addMessage('user', toolResultContent);
+                    const membraneResults = currentState.toolResults.map(tc => this.toMembraneToolResult(tc.id, tc.result, maxChars, spilled.get(tc.id)));
+                    agent.toolResultGuard.storeResults(toolResultContent, membraneResults, currentState.toolResults);
                     // Flush any messages that were deferred while this turn was in
                     // flight. Route to the PRIMARY agent — deferred messages are
                     // framework-level (module messages, push events, subagent return
@@ -5562,6 +5717,9 @@ export class AgentFramework {
                     }
                     if (shouldEndTurn) {
                         // endTurn: messages already stored above, cancel stream, reset to idle.
+                        // The batch is never submitted, so nothing can refuse it: admit
+                        // it now instead of leaving it pending across the idle gap.
+                        agent.toolResultGuard.settleTurnEnded();
                         if (currentState.stream) {
                             this.frameworkCancelledStreams.set(`${agent.name}:${agent.streamId}`, 'turn_ended');
                             currentState.stream.cancel();
@@ -5612,6 +5770,8 @@ export class AgentFramework {
                             reason: 'context_budget_restart',
                             source: 'framework',
                             timestamp: Date.now(),
+                            suppressProse: this.activeTurnTriggers.get(agent.name)?.suppressProse,
+                            ephemeralSystemPrompt: this.activeTurnTriggers.get(agent.name)?.ephemeralSystemPrompt,
                         });
                     }
                     else if (currentState.stream) {
@@ -5619,8 +5779,7 @@ export class AgentFramework {
                         // Mid-turn messages collected above ride along as injected user
                         // messages (membrane ≥0.5.72) — appended after the tool_result
                         // envelope so the next round of THIS turn hears them.
-                        const membraneResults = currentState.toolResults.map(tc => this.toMembraneToolResult(tc.id, tc.result, maxChars, spilled.get(tc.id)));
-                        currentState.stream.provideToolResults(membraneResults, midTurnInjections.length > 0 ? { injectedMessages: midTurnInjections } : undefined);
+                        currentState.stream.provideToolResults(agent.toolResultGuard.submissionResults(membraneResults), midTurnInjections.length > 0 ? { injectedMessages: midTurnInjections } : undefined);
                         agent.setStreaming(currentState.stream);
                         this.emitTrace({
                             type: 'inference:stream_resumed',
@@ -5649,6 +5808,16 @@ export class AgentFramework {
         else if (event.type === 'mcpl:push-event') {
             this.handleMcplPushEvent(event);
         }
+        await this.dispatchProcessEventToModules(event, startTime);
+    }
+    /**
+     * The module half of handleProcessEvent: every module's onProcess, their
+     * responses, the tool-call dispatch, the completion trace and the process
+     * log. Shared with RFC-006 coalesced deliveries, which bypass the queue
+     * (the coalescer needs the placement synchronously) but must still reach
+     * modules exactly like the ordinary deliveries do.
+     */
+    async dispatchProcessEventToModules(event, startTime = Date.now()) {
         // Dispatch to all modules, tracking responses with module names
         const responses = [];
         for (const module of this.moduleRegistry.getAllModules()) {
@@ -5743,6 +5912,8 @@ export class AgentFramework {
     async handleMcplChannelIncoming(event) {
         const metadata = {
             ...event.metadata,
+            ...(event.eventId ? { eventId: event.eventId } : {}),
+            ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
             channelId: event.channelId,
             messageId: event.messageId,
             author: event.author,
@@ -5756,9 +5927,34 @@ export class AgentFramework {
         // Per-channel conversation routing: messages go to the channel's fork
         // agent (spawned from the template on first qualifying message), never
         // to the primary conversation.
-        if (this.conversationRouter) {
-            await this.routeConversationIncoming(event, metadata);
-            return;
+        // RFC-006 §3.2: a replacement or deletion notice follows the delivery it
+        // corrects — into the agent that holds (or read) the prior occurrence,
+        // never a context fresh routing would pick. Gone agent → delivered nowhere.
+        if (event.deliverTo) {
+            const target = this.agents.get(event.deliverTo);
+            if (!target)
+                return undefined;
+            if (this.conversationRouter && this.conversationAgentHomes.has(target.name)) {
+                metadata.triggered = event.triggerInference ?? false;
+                const id = target.getContextManager().addMessage('user', event.content, metadata);
+                this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:channel-incoming' });
+                if (event.triggerInference) {
+                    this.pendingRequests.push({
+                        agentName: target.name, reason: 'mcpl:channel-incoming', source: event.serverId, timestamp: Date.now(),
+                        channelId: event.channelId,
+                        counterparty: event.author?.id ? `${event.serverId}:user:${event.author.id}` : undefined,
+                        addressed: isAddressedMessage(event.tags, event.metadata),
+                        ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
+                    });
+                }
+                return { agent: target.name, messageId: id };
+            }
+            if (this.conversationRouter)
+                return undefined; // the trunk never holds channel traffic
+            event = { ...event, targetAgents: [target.name] };
+        }
+        else if (this.conversationRouter) {
+            return this.routeConversationIncoming(event, metadata);
         }
         // Addressed-while-closed invitation — parity with the push-event path
         // (channels.publish surfaces like portal-mcpl deliver mentions here).
@@ -5796,7 +5992,8 @@ export class AgentFramework {
         if (divert) {
             metadata.tuneOut = { epochId: divert.epochId };
         }
-        const id = this.addMessage('user', incomingContent, metadata);
+        const placement = { agent: '' };
+        const id = this.addMessage('user', incomingContent, metadata, { placement, bypassDeferralFor: event.assemblingFor });
         this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:channel-incoming' });
         if (event.triggerInference && !divert) {
             const addressed = isAddressedMessage(event.tags, event.metadata);
@@ -5822,9 +6019,11 @@ export class AgentFramework {
                     // Addressed messages outrank ambient chatter when a batched wake
                     // picks the turn's frozen speech locus.
                     addressed,
+                    ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
                 });
             }
         }
+        return placement.agent ? placement : undefined;
     }
     /**
      * Route an incoming channel message through the ConversationRouter:
@@ -5905,8 +6104,10 @@ export class AgentFramework {
                 channelId: event.channelId,
                 counterparty: event.author?.id ? `${event.serverId}:user:${event.author.id}` : undefined,
                 addressed: isAddressedMessage(event.tags, event.metadata),
+                ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
             });
         }
+        return { agent: agent.name, messageId: id };
     }
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
@@ -5955,6 +6156,8 @@ export class AgentFramework {
             }
             const config = { ...templateConfig, name, strategy: undefined };
             const agent = new Agent(config, contextManager, this.membrane);
+            this.restoreToolResultGuardSetting(agent);
+            agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
             this.agents.set(name, agent);
             this.agentConfigs.set(name, config);
             this.conversationAgentHomes.set(name, channelId);
@@ -6112,6 +6315,19 @@ export class AgentFramework {
         const label = opts.channelLabel ?? descriptor?.label;
         const channelLabel = label ? `#${label}` : `"${opts.channelId}"`;
         const place = opts.guildName ? `${channelLabel} in "${opts.guildName}"` : channelLabel;
+        // The label is for reading; the prefix must be ONE token that resolves back
+        // here, on this server (a DM label "DM: alice" quoted verbatim parses as
+        // target "#DM:"). A registry that can name targets is authoritative: no safe
+        // token means no prefix option. A stand-in without proseTargetFor gets a
+        // whitespace-free guess, never a label with spaces.
+        const namer = this.channelRegistry;
+        const target = typeof namer.proseTargetFor === 'function'
+            ? namer.proseTargetFor(opts.channelId, opts.serverId)
+            : [label ? `#${label}` : undefined, opts.channelId].find((t) => !!t && !/\s/.test(t));
+        const replyOption = target
+            ? `1. Reply without joining — write your reply this turn prefixed with ">>${target}"; it will be delivered there. ` +
+                `Note: follow-ups to your reply will NOT reach you unless they @-mention you or use the reply feature on your message.\n`
+            : `1. Reply without joining isn't available here: no single-word target reaches this channel unambiguously. Join it (option 2) to reply.\n`;
         const missedCount = opts.missedMessages ?? 0;
         const missedNote = missedCount > 0
             ? `While closed, ${missedCount} message${missedCount === 1 ? '' : 's'}` +
@@ -6125,8 +6341,7 @@ export class AgentFramework {
                 `a reply to one of your messages) reach you from it; the rest of its traffic is invisible to you. ` +
                 missedNote +
                 `Your options:\n` +
-                `1. Reply without joining — write your reply this turn prefixed with ">>${channelLabel}"; it will be delivered there. ` +
-                `Note: follow-ups to your reply will NOT reach you unless they @-mention you or use the reply feature on your message.\n` +
+                replyOption +
                 `2. Join the channel — call channel_open with channelId "${opts.channelId}" and serverId "${opts.serverId}"` +
                 (maxBackscroll > 0
                     ? `; to also read recent history, add backscroll (a number up to ${maxBackscroll}) and beforeMessageId "${opts.messageId}".\n`
@@ -6145,6 +6360,484 @@ export class AgentFramework {
             },
         };
     }
+    // ==========================================================================
+    // RFC-006 event coalescing (see mcpl/push-coalescer.ts for the design)
+    // ==========================================================================
+    /**
+     * RFC-006 §3.2 binding identity: the configured server id bound to its
+     * endpoint/command. Survives reconnects to the same peer; changes when the
+     * id is reassigned to another endpoint (restartMcplServer with a new config).
+     */
+    coalescingBinding(serverId) {
+        const config = this.mcplServerConfigs.get(serverId);
+        return createHash('sha256').update(JSON.stringify([serverId, config?.url ?? null, config?.command ?? null, config?.args ?? null])).digest('hex').slice(0, 16);
+    }
+    initializePushCoalescer() {
+        const coalescer = new PushCoalescer({
+            isUnread: (p) => this.isUnreadPlacement(p),
+            remove: (p) => this.removePlacement(p),
+            deliver: (occ, materialized, assemblingFor) => this.deliverCoalesced(occ, materialized, assemblingFor),
+            wakeForBatch: (occ) => this.wakeForCoalescedBatch(occ),
+            cancelWake: (subject) => this.cancelCoalescedWakes(subject),
+            authorized: (occ) => this.coalescedAuthorized(occ),
+            audience: (occ) => this.coalescedAudience(occ),
+            render: (occ, params) => {
+                const server = this.mcplServerRegistry?.getServer(occ.serverId);
+                if (!server?.isConnected)
+                    throw new Error('server disconnected');
+                return server.sendPushRender(params);
+            },
+            audit: (record) => this.emitTrace({ type: 'mcpl:coalescing', ...record }),
+            save: (snapshot) => this.scheduleCoalescingSnapshot(snapshot),
+            recordReceipt: (record) => {
+                // Written now, not at the throttled flush: an acknowledged acceptance
+                // must not lose its receipt, the subject's birth, or (deferred) the
+                // accepted work itself to a crash. A failure here fails the acceptance.
+                this.coalescingRecentReceipts.push(record);
+                this.store.setStateJson(COALESCING_RECENT_ID, this.coalescingRecentReceipts);
+            },
+            wasPublished: (subject, eventId) => {
+                // Boot-time only: the occurrence's durable delivery identity
+                // (subject + eventId in message metadata) in any agent's context.
+                for (const agent of this.agents.values()) {
+                    try {
+                        if (agent.getContextManager().getAllMessages().some((m) => m.metadata?.coalescingSubject === subject && m.metadata?.eventId === eventId))
+                            return true;
+                    }
+                    catch { /* a context that cannot be read cannot prove publication */ }
+                }
+                return false;
+            },
+            commit: () => this.commitCoalescingDurable(),
+            saveNow: (snapshot) => {
+                if (this.coalescingSaveTimer) {
+                    clearTimeout(this.coalescingSaveTimer);
+                    this.coalescingSaveTimer = null;
+                }
+                this.coalescingSnapshotDirty = null;
+                this.store.setStateJson(COALESCING_STATE_ID, snapshot);
+                this.coalescingRecentReceipts = [];
+                this.store.setStateJson(COALESCING_RECENT_ID, []);
+            },
+        });
+        try {
+            coalescer.restore(this.store.getStateJson(COALESCING_STATE_ID));
+            const recent = this.store.getStateJson(COALESCING_RECENT_ID);
+            if (Array.isArray(recent)) {
+                coalescer.restoreReceipts(recent);
+                // Until the next snapshot flush checkpoints the recovered state, these
+                // records are its only durable form: keep them in the writable buffer
+                // so the next acceptance appends to them instead of replacing them.
+                this.coalescingRecentReceipts = recent;
+            }
+        }
+        catch (err) {
+            console.error('[coalescing] could not restore coalescing state; starting with unknown history:', err);
+        }
+        this.pushCoalescer = coalescer;
+        // Batches restored from a snapshot still owe the agent a wake (§14 v41).
+        for (const occ of coalescer.pendingBatchOccurrences())
+            void this.wakeForCoalescedBatch(occ);
+    }
+    /**
+     * Durability barrier for coalescing (RFC-006 §3.1/§3.2): everything
+     * written so far is fsynced before the caller proceeds. Group-committed —
+     * all acceptances that arrive in one event-loop turn share one
+     * `store.sync()` — so throughput is bounded by fsync rate per batch, not
+     * per message.
+     */
+    commitCoalescingDurable() {
+        if (!this.coalescingCommit) {
+            this.coalescingCommit = new Promise((resolve, reject) => {
+                setImmediate(() => {
+                    this.coalescingCommit = null;
+                    try {
+                        this.store.sync();
+                        resolve();
+                    }
+                    catch (err) {
+                        reject(err);
+                    }
+                });
+            });
+        }
+        return this.coalescingCommit;
+    }
+    scheduleCoalescingSnapshot(snapshot) {
+        this.coalescingSnapshotDirty = snapshot;
+        if (this.coalescingSaveTimer)
+            return;
+        const timer = setTimeout(() => this.flushCoalescingSnapshot(), 2_000);
+        timer.unref?.();
+        this.coalescingSaveTimer = timer;
+    }
+    flushCoalescingSnapshot() {
+        if (this.coalescingSaveTimer) {
+            clearTimeout(this.coalescingSaveTimer);
+            this.coalescingSaveTimer = null;
+        }
+        const snapshot = this.coalescingSnapshotDirty;
+        this.coalescingSnapshotDirty = null;
+        if (!snapshot)
+            return;
+        try {
+            this.store.setStateJson(COALESCING_STATE_ID, snapshot());
+            this.coalescingRecentReceipts = [];
+            this.store.setStateJson(COALESCING_RECENT_ID, []);
+        }
+        catch (err) {
+            console.error('[coalescing] could not persist coalescing state:', err);
+        }
+    }
+    /** Serialize both lanes' admissions: create, edit and delete of one subject stay ordered. */
+    admitCoalesced(work) {
+        const run = this.coalescingAdmission.then(work, work);
+        this.coalescingAdmission = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    handleCoalescedIncoming(serverId, message, event) {
+        return this.admitCoalesced(async () => {
+            if (!this.pushCoalescer)
+                throw new CoalesceError('coalesce', 'coalescing unavailable', -32000);
+            validateCoalesceMember(message.coalesce, 'channel');
+            if (typeof message.eventId !== 'string' || !message.eventId) {
+                throw new CoalesceError('eventId', 'eventId is required with coalesce');
+            }
+            if (typeof message.timestamp !== 'string')
+                throw new CoalesceError('timestamp', 'timestamp is required');
+            validateCoalescedContent(message.content);
+            const c = message.coalesce;
+            const result = await this.pushCoalescer.accept({
+                serverId,
+                binding: this.coalescingBinding(serverId),
+                scope: { kind: 'channel', id: message.channelId },
+                key: c.key,
+                eventId: message.eventId,
+                timestamp: message.timestamp,
+                retract: !!c.retract,
+                deferred: false,
+                initial: !!c.initial,
+                tags: event.tags,
+                content: message.content,
+                identity: { messageId: message.messageId, author: message.author, threadId: message.threadId },
+                event: { lane: 'channel', event: { ...event, eventId: message.eventId } },
+            });
+            return { messageId: message.messageId, accepted: true, coalesce: result.coalesce };
+        });
+    }
+    handleCoalescedPush(serverId, params, event) {
+        return this.admitCoalesced(async () => {
+            if (!this.pushCoalescer)
+                throw new CoalesceError('coalesce', 'coalescing unavailable', -32000);
+            validateCoalesceMember(params.coalesce, 'push');
+            if (typeof params.eventId !== 'string' || !params.eventId)
+                throw new CoalesceError('eventId', 'eventId is required');
+            if (typeof params.timestamp !== 'string')
+                throw new CoalesceError('timestamp', 'timestamp is required');
+            validateCoalescedContent(params.payload?.content);
+            const c = params.coalesce;
+            if (c.channelId)
+                this.assertChannelScopedPush(serverId, c.channelId);
+            const origin = params.origin ?? {};
+            const str = (v) => (typeof v === 'string' && v ? v : undefined);
+            return this.pushCoalescer.accept({
+                serverId,
+                binding: this.coalescingBinding(serverId),
+                featureSet: params.featureSet,
+                scope: c.channelId ? { kind: 'channel', id: c.channelId } : { kind: 'featureSet', id: params.featureSet },
+                key: c.key,
+                eventId: params.eventId,
+                timestamp: params.timestamp,
+                retract: !!c.retract,
+                deferred: !!c.deferred,
+                initial: !!c.initial,
+                data: c.data,
+                tags: event.tags,
+                content: params.payload.content,
+                ...(c.channelId ? {
+                    identity: {
+                        ...(str(origin.messageId) ? { messageId: str(origin.messageId) } : {}),
+                        ...(str(origin.threadId) ? { threadId: str(origin.threadId) } : {}),
+                        ...(str(origin.authorId) ? { author: { id: str(origin.authorId), name: str(origin.authorName) ?? str(origin.authorId) } } : {}),
+                    },
+                } : {}),
+                event: { lane: 'push', event },
+            });
+        });
+    }
+    /** §3.2: a channel-scoped push needs what a channels/incoming message needs. */
+    assertChannelScopedPush(serverId, channelId) {
+        const server = this.mcplServerRegistry?.getServer(serverId);
+        if (!server?.policyEstablished || !server.grant.has('channels.incoming')) {
+            throw new CoalesceError('coalesce.channelId', 'Channel not permitted', -32017);
+        }
+        if (!this.channelRegistry?.isDeclaredChannel(serverId, channelId)) {
+            throw new CoalesceError('coalesce.channelId', 'Unknown channel', -32023);
+        }
+    }
+    coalescedAuthorized(occ) {
+        const server = this.mcplServerRegistry?.getServer(occ.serverId);
+        if (!server?.isConnected || !server.policyEstablished)
+            return false;
+        // §3.2: work admitted under another binding (the id since reassigned to a
+        // different endpoint) never acquires the replacement peer's authority —
+        // and its private notice data is never sent to that peer.
+        if (occ.binding !== this.coalescingBinding(occ.serverId))
+            return false;
+        if (occ.event.lane === 'push') {
+            if (!server.grant.has('pushEvents'))
+                return false;
+            try {
+                this.featureSetManager?.validateInbound(occ.serverId, occ.event.event.featureSet);
+            }
+            catch {
+                return false;
+            }
+        }
+        if (occ.scope.kind === 'channel' || occ.event.lane === 'channel') {
+            // §3.2 / §5.4 rule 4: the channel's CURRENT authority, whichever lane.
+            if (!server.grant.has('channels.incoming'))
+                return false;
+            if (occ.event.lane === 'push')
+                return this.channelRegistry?.isDeclaredChannel(occ.serverId, occ.scope.id) ?? false;
+            return !!this.channelRegistry?.getDescriptor(occ.scope.id);
+        }
+        return true;
+    }
+    async coalescedAudience(occ) {
+        if (occ.deliverTo)
+            return this.agents.has(occ.deliverTo) ? [occ.deliverTo] : [];
+        const explicit = occ.event.event.targetAgents;
+        if (explicit)
+            return explicit.filter((n) => this.agents.has(n));
+        if (occ.scope.kind === 'channel' && this.conversationRouter) {
+            const router = this.conversationRouter;
+            const bound = router.getBinding(occ.scope.id)?.agentName;
+            if (bound)
+                return this.agents.has(bound) ? [bound] : [];
+            // No fork yet: the same bind decision an incoming message would get. A
+            // batch that qualifies spawns its fork now so it has someone to wake.
+            const metadata = (occ.event.lane === 'channel' ? occ.event.event.metadata : occ.event.event.origin) ?? {};
+            const decision = router.route({
+                channelId: occ.scope.id,
+                mentioned: metadata.mentioned === true,
+                kind: ConversationRouter.classifyChannel(this.channelRegistry?.getDescriptor(occ.scope.id), metadata),
+            });
+            if (decision.kind !== 'spawn')
+                return decision.kind === 'unbound' ? [] : (this.agents.has(decision.agentName) ? [decision.agentName] : []);
+            try {
+                await this.createConversationAgent(decision.agentName, occ.scope.id);
+                router.bind(occ.scope.id, decision.agentName, decision.generation);
+                this.persistConversationRouterState();
+                return [decision.agentName];
+            }
+            catch (err) {
+                console.error(`[coalescing] could not spawn a conversation agent for ${occ.scope.id}:`, err);
+                return [];
+            }
+        }
+        return [...this.agents.keys()].filter((n) => !this.conversationAgentHomes.has(n) && n !== this.subconsciousAgentName);
+    }
+    /** Deliver through the lane's ordinary path; report where it landed. */
+    async deliverCoalesced(occ, materialized, assemblingFor) {
+        const coalescingSubject = coalescingSubjectKey(occ.serverId, occ.binding, occ.scope, occ.key);
+        const narrowing = occ.deliverTo ? { deliverTo: occ.deliverTo } : {};
+        if (occ.event.lane === 'channel') {
+            const event = { ...occ.event.event, coalescingSubject, ...narrowing, ...(assemblingFor ? { assemblingFor } : {}) };
+            const placement = await this.handleMcplChannelIncoming(event);
+            await this.dispatchProcessEventToModules(event);
+            return placement;
+        }
+        if (occ.scope.kind === 'channel') {
+            // §3.2: a channel-scoped push addresses the channel's subject namespace,
+            // so it is delivered as a message OF that channel — same routing
+            // (conversation forks, tune-out, closed-channel invitation), same reply
+            // locus, and the subject's stable platform identity (§3.1, vector 43).
+            const push = occ.event.event;
+            const identity = { ...this.pushCoalescer?.identity(coalescingSubject), ...occ.identity };
+            const origin = push.origin ?? {};
+            const str = (v) => (typeof v === 'string' && v ? v : undefined);
+            const event = {
+                type: 'mcpl:channel-incoming',
+                serverId: occ.serverId,
+                channelId: occ.scope.id,
+                messageId: identity.messageId ?? str(origin.messageId) ?? occ.eventId,
+                threadId: identity.threadId ?? str(origin.threadId),
+                author: identity.author ?? { id: str(origin.authorId) ?? '', name: str(origin.authorName) ?? str(origin.authorId) ?? 'Someone' },
+                content: materialized ? materialized.map(convertPushBlock) : push.content,
+                timestamp: occ.timestamp,
+                metadata: origin,
+                tags: push.tags,
+                triggerInference: assemblingFor ? false : push.triggerInference,
+                targetAgents: push.targetAgents,
+                coalescingSubject,
+                eventId: occ.eventId,
+                ...narrowing,
+                ...(assemblingFor ? { assemblingFor } : {}),
+            };
+            const placement = await this.handleMcplChannelIncoming(event);
+            await this.dispatchProcessEventToModules(event);
+            return placement;
+        }
+        const event = {
+            ...occ.event.event,
+            eventId: occ.eventId,
+            timestamp: occ.timestamp,
+            ...(materialized ? { content: materialized.map(convertPushBlock) } : {}),
+            coalescingSubject,
+            // §5.2: the materialized occurrence is consumed by the request being
+            // assembled; the wake that started it is not repeated.
+            ...(assemblingFor ? { assemblingFor, triggerInference: false } : {}),
+            ...(occ.deliverTo ? { targetAgents: [occ.deliverTo] } : {}),
+        };
+        const placement = this.handleMcplPushEvent(event);
+        await this.dispatchProcessEventToModules(event);
+        return placement;
+    }
+    async wakeForCoalescedBatch(occ) {
+        const subject = coalescingSubjectKey(occ.serverId, occ.binding, occ.scope, occ.key);
+        this.cancelCoalescedWakes(subject);
+        if (occ.event.lane !== 'push' || !occ.event.event.triggerInference)
+            return;
+        const origin = occ.event.event.origin;
+        // The wake carries the batch's channel so the turn freezes its reply
+        // locus there (the materialized delivery at assembly wakes nobody).
+        const channelId = occ.scope.kind === 'channel' ? occ.scope.id : this.derivePushEventChannel(origin)?.channelId;
+        const authorId = occ.identity?.author?.id ?? (typeof origin?.authorId === 'string' ? origin.authorId : undefined);
+        for (const agentName of await this.coalescedAudience(occ)) {
+            this.pendingRequests.push({
+                agentName,
+                reason: 'mcpl:push-event',
+                source: occ.serverId,
+                timestamp: Date.now(),
+                channelId,
+                counterparty: authorId ? `${occ.serverId}:user:${authorId}` : undefined,
+                addressed: isAddressedMessage(occ.tags, origin),
+                coalescingSubject: subject,
+            });
+        }
+    }
+    /** Withdraw unstarted wakes whose sole cause is this subject (§4.2). */
+    cancelCoalescedWakes(subject) {
+        this.pendingRequests = this.pendingRequests.filter((r) => r.coalescingSubject !== subject);
+        for (const cooldown of this.providerAccelerationCooldowns.values()) {
+            cooldown.heldRequests = cooldown.heldRequests.filter((r) => r.coalescingSubject !== subject);
+        }
+    }
+    /**
+     * A placement in the deferred queue is upgraded in place once the flush has
+     * stored it: the stored copy carries `metadata.deferredWriteId`, found by
+     * scanning the unread tail (above the watermark) — never below it.
+     */
+    resolvePlacement(p) {
+        if (!p.deferredId || this.deferredMessages.some((m) => m.id === p.deferredId))
+            return;
+        const agent = this.agents.get(p.agent);
+        if (!agent)
+            return;
+        const cm = agent.getContextManager();
+        const watermark = agent.getConsumedWatermark();
+        const floor = watermark && watermark.branch === cm.currentBranch().name ? watermark.sequence : Number.POSITIVE_INFINITY;
+        const all = cm.getAllMessages();
+        for (let i = all.length - 1; i >= 0 && all[i].sequence > floor; i--) {
+            if (all[i].metadata?.deferredWriteId === p.deferredId) {
+                p.messageId = all[i].id;
+                delete p.deferredId;
+                return;
+            }
+        }
+    }
+    isUnreadPlacement(p) {
+        this.resolvePlacement(p);
+        if (p.deferredId)
+            return this.deferredMessages.some((m) => m.id === p.deferredId);
+        if (!p.messageId)
+            return false;
+        const agent = this.agents.get(p.agent);
+        return !!agent && this.isUnreadStoredMessage(agent, p.messageId);
+    }
+    /**
+     * Unread = stored, above the agent's consumed watermark on the current
+     * branch, not a body-group shard (immutable), and not folded into any
+     * summary (compression is consumption, §3.3). Conservative on every doubt.
+     */
+    isUnreadStoredMessage(agent, messageId) {
+        const cm = agent.getContextManager();
+        let message;
+        try {
+            message = cm.getMessage(messageId);
+        }
+        catch {
+            return false;
+        }
+        if (!message || message.bodyGroupId)
+            return false;
+        // Every agent that can read this message must not have compiled past it.
+        // Residents share one message slot, so a message one of them read is
+        // history for all of them (the never-rewrite rule is about the message,
+        // not the agent that happened to be asked). A tune-out-diverted message
+        // never enters a resident's compiled view; only the subconscious reads
+        // it through its merged view — no subconscious, nobody reads it.
+        let readers;
+        if (message.metadata?.tuneOut) {
+            const subconscious = this.subconsciousAgentName ? this.agents.get(this.subconsciousAgentName) : undefined;
+            if (!subconscious)
+                return true;
+            readers = [subconscious];
+        }
+        else {
+            readers = this.sharedSlotAgents.has(agent)
+                ? [...this.sharedSlotAgents].filter((a) => this.agents.get(a.name) === a)
+                : [agent];
+        }
+        const branch = cm.currentBranch().name;
+        const ts = message.timestamp instanceof Date ? message.timestamp.getTime() : Number(message.timestamp);
+        for (const reader of readers) {
+            const watermark = reader.getConsumedWatermark();
+            if (!watermark || watermark.branch !== branch || message.sequence <= watermark.sequence)
+                return false;
+            // Compression is consumption (§3.3): folded into any reader's summary.
+            try {
+                const rcm = reader.getContextManager();
+                const strategy = rcm.getStrategy();
+                for (const summary of rcm.getSummariesInRange({ fromMs: ts, toMs: ts })) {
+                    const entry = strategy.getSummary?.(summary.id);
+                    if (!entry || (entry.sourceLevel ?? 0) > 0 || entry.sourceIds?.includes(messageId))
+                        return false;
+                }
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    }
+    removePlacement(p) {
+        this.resolvePlacement(p);
+        if (p.deferredId) {
+            const before = this.deferredMessages.length;
+            this.deferredMessages = this.deferredMessages.filter((m) => m.id !== p.deferredId);
+            if (this.deferredMessages.length === before)
+                return false;
+            if (this.quiesced || this.deferredWritesPersisted)
+                this.persistDeferredWrites();
+            return true;
+        }
+        if (!p.messageId)
+            return false;
+        const agent = this.agents.get(p.agent);
+        if (!agent)
+            return false;
+        try {
+            agent.getContextManager().removeMessage(p.messageId);
+            this.emitTrace({ type: 'message:removed', messageId: p.messageId, source: 'mcpl:coalescing' });
+            return true;
+        }
+        catch (err) {
+            console.error(`[coalescing] could not remove unread message ${p.messageId} for ${agent.name}:`, err);
+            return false;
+        }
+    }
     /**
      * Convert an MCPL push event to a context message.
      */
@@ -6160,6 +6853,7 @@ export class AgentFramework {
             eventId: event.eventId,
             triggered: event.triggerInference ?? false,
             ...(event.tags ? { tags: event.tags } : {}),
+            ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
         };
         // `origin.channelId` is the server-internal raw id (a bare Discord
         // snowflake) — unroutable as a locus and unresolvable by the agent. Store
@@ -6189,8 +6883,23 @@ export class AgentFramework {
                 Object.assign(metadata, invitation.metadataPatch);
             }
         }
-        const id = this.addMessage('user', content, metadata);
-        this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:push-event' });
+        // Silent heartbeat ticks are control-plane wakes, not autobiography.
+        // Accept the no-message path only for the heartbeat feature's own exact
+        // marker with an empty payload — arbitrary MCPL servers cannot hide
+        // content merely by setting `origin.silent`.
+        const silentHeartbeat = event.serverId === 'heartbeat' &&
+            event.featureSet === 'heartbeat' &&
+            event.origin?.source === 'heartbeat' &&
+            event.origin?.silent === true &&
+            content.length === 0;
+        const placement = { agent: '' };
+        if (!silentHeartbeat) {
+            const id = this.addMessage('user', content, metadata, { placement, bypassDeferralFor: event.assemblingFor });
+            this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:push-event' });
+        }
+        else {
+            console.error(`[heartbeat] ${event.serverId}: accepted silent scheduled wake ${event.eventId}`);
+        }
         if (event.triggerInference) {
             // Default broadcast excludes conversation forks (channel-driven).
             const targetAgents = event.targetAgents
@@ -6206,9 +6915,16 @@ export class AgentFramework {
                     // they must outrank ambient chatter in a batched wake's locus
                     // selection just like their channels/incoming counterparts.
                     addressed: isAddressedMessage(event.tags, event.origin),
+                    ...(silentHeartbeat ? {
+                        suppressProse: true,
+                        ephemeralSystemPrompt: '[silent heartbeat] Scheduled private self-check. Review pending matters privately. ' +
+                            'Do not narrate or publish plain prose; use an explicit send tool only if you deliberately choose to contact someone.',
+                    } : {}),
+                    ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
                 });
             }
         }
+        return placement.agent ? placement : undefined;
     }
     /**
      * Derive the MCPL composite channel id (the outbound routing locus) for a
@@ -6353,7 +7069,9 @@ export class AgentFramework {
                 // route the resumed turn into the wrong channel.
                 const newestByKey = new Map();
                 for (const request of parked) {
-                    const key = `${request.reason}|${request.addressed ? 'a' : 'n'}`;
+                    // A coalesced wake is withdrawable by its subject (RFC-006 §4.2); it
+                    // must not absorb an unrelated wake that would vanish with it.
+                    const key = `${request.reason}|${request.addressed ? 'a' : 'n'}|${request.coalescingSubject ?? ''}`;
                     const prev = newestByKey.get(key);
                     if (!prev || request.timestamp >= prev.timestamp) {
                         newestByKey.set(key, request);
@@ -6479,8 +7197,13 @@ export class AgentFramework {
                         provReq = r;
                 }
             }
+            // A silent tick never suppresses a genuine coalesced wake. If any
+            // ordinary request shares this batch, the ordinary turn semantics win.
+            const silentOnly = requests.every((r) => r.suppressProse === true);
             await this.startAgentStream(agent, {
                 ...trigger,
+                suppressProse: silentOnly ? trigger?.suppressProse : undefined,
+                ephemeralSystemPrompt: silentOnly ? trigger?.ephemeralSystemPrompt : undefined,
                 channelId: channelReq?.channelId,
                 addressed: addressedReq !== undefined,
                 // A context-budget restart continues the same logical turn: it keeps
@@ -7008,6 +7731,9 @@ export class AgentFramework {
      * driveStream (whose finally then owns clearing it).
      */
     async beginAgentTurn(agent, trigger, attempt, turnToken, ownsProviderGate) {
+        const continuingTurn = trigger?.reason === 'context_budget_restart'
+            || trigger?.reason === 'tool_result_guard_retry';
+        const turnProseRouting = trigger?.suppressProse ? 'disabled' : agent.proseRouting;
         // Flush messages deferred during the PREVIOUS turn — before the
         // checkpoint, the locus announcement, and the compile — so a turn started
         // by a queued wake actually CONTAINS the message that woke it. (2026-07-31
@@ -7023,7 +7749,7 @@ export class AgentFramework {
         // Before recordTurnCheckpoint: these are the turn's inputs, not its
         // products — undoing the turn must not destroy them.
         if (attempt === 0 &&
-            trigger?.reason !== 'context_budget_restart' &&
+            !continuingTurn &&
             this.deferredMessages.length > 0) {
             {
                 const deferred = this.drainDeferredFor(agent.name);
@@ -7043,8 +7769,20 @@ export class AgentFramework {
                 this.ackDeferredWrites();
             }
         }
+        // RFC-006 §5: deferred batches for this agent render now, at the assembly
+        // boundary — after the deferred flush (same window: turn alive, compile
+        // not yet run) and before the checkpoint (they are the turn's inputs).
+        // Not on a context-budget restart: that continues the same logical turn.
+        if (attempt === 0 && !continuingTurn && this.pushCoalescer?.pendingBatches()) {
+            try {
+                await this.pushCoalescer.assemble(agent.name);
+            }
+            catch (err) {
+                console.error(`[coalescing] assembly for ${agent.name} failed:`, err);
+            }
+        }
         // Record turn checkpoint before inference (only on first attempt, not retries)
-        if (attempt === 0) {
+        if (attempt === 0 && trigger?.reason !== 'tool_result_guard_retry') {
             this.recordTurnCheckpoint(agent.name);
             this.redoStacks.delete(agent.name); // new work invalidates redo
         }
@@ -7061,7 +7799,7 @@ export class AgentFramework {
         // after the restart fell through to the hours-old defaultPublishChannel.
         // Keep the turn's trigger channel across restarts; only real new turns
         // reset it.
-        if (trigger?.reason !== 'context_budget_restart') {
+        if (!continuingTurn) {
             if (trigger?.channelId) {
                 this.activeTriggerChannels.set(agent.name, trigger.channelId);
             }
@@ -7081,11 +7819,11 @@ export class AgentFramework {
         // BEFORE this turn compiles, so the agent always knows where its voice
         // goes (announce-on-change only — no per-turn chatter, append-only for
         // KV stability).
-        if (trigger?.reason === 'context_budget_restart') {
+        if (continuingTurn) {
             const previousLogicalToolState = this.logicalTurnToolCalls.get(agent);
             this.logicalTurnToolCalls.set(agent, { turnToken, count: previousLogicalToolState?.count ?? 0 });
         }
-        if (trigger?.reason !== 'context_budget_restart') {
+        if (!continuingTurn) {
             if (attempt === 0)
                 this.maybePrimeProseMode(agent);
             const previousLogicalToolState = this.logicalTurnToolCalls.get(agent);
@@ -7104,9 +7842,9 @@ export class AgentFramework {
             this.turnProseDeliveries.delete(agent.name);
             this.turnProseSuppressed.delete(agent.name);
             this.proseHybridSuppressed.delete(agent.name);
-            if (agent.proseRouting === 'hybrid')
+            if (turnProseRouting === 'hybrid')
                 this.proseTargetPins.delete(agent.name);
-            if (agent.proseRouting === 'explicit' || agent.proseRouting === 'disabled') {
+            if (turnProseRouting === 'explicit' || turnProseRouting === 'disabled') {
                 // Explicit and disabled prose routing have no inferred locus.
                 // Explicit mode uses a turn-scoped `>>` target; disabled mode has no
                 // prose target at all. Neither mode freezes or announces a locus.
@@ -7126,6 +7864,14 @@ export class AgentFramework {
                     this.announceLocusIfChanged(agent.name, locus);
             }
         }
+        // A context-budget restart normally preserves the turn locus, but a
+        // silent control-plane wake must remain locusless even if an explicit tool
+        // opened/pinned a channel mid-turn.
+        if (trigger?.suppressProse) {
+            this.turnLocusPins.delete(agent.name);
+            this.proseTargetPins.delete(agent.name);
+            this.proseContinuations.delete(agent.name);
+        }
         this.touchEphemeralRun(agent.name, true);
         this.emitTrace({
             type: 'inference:started',
@@ -7133,10 +7879,11 @@ export class AgentFramework {
             // The turn-frozen locus was pinned just above (kept across a
             // context-budget restart, which skips the re-pin but re-emits this).
             channelId: this.turnLocusPins.get(agent.name),
+            ...(trigger?.suppressProse ? { silent: true } : {}),
         });
         // A budget restart continues the same logical inference window. The
         // predecessor keeps EventGate liveness until its successor terminates.
-        if (trigger?.reason !== 'context_budget_restart') {
+        if (!continuingTurn) {
             this.eventGate?.onInferenceStarted(agent.name);
         }
         this.lastInferenceAt.set(agent.name, { ...this.lastInferenceAt.get(agent.name), startedAt: Date.now() });
@@ -7149,19 +7896,14 @@ export class AgentFramework {
         // Same channel choice as driveStream's own startTyping (which stays, is
         // idempotent per channel, and owns the 7s refresh); the catch below stops
         // it on the no-driveStream failure paths (e.g. a compile refusal).
-        const earlyTypingChannel = agent.proseRouting === 'explicit'
+        const earlyTypingChannel = turnProseRouting === 'explicit'
             ? trigger?.channelId ?? null
             : this.turnLocusPins.get(agent.name) ?? null;
         if (earlyTypingChannel)
             this.channelRegistry?.startTyping(earlyTypingChannel);
         try {
             const requestSnapshot = this.captureInferenceToolSnapshot(agent);
-            const allTools = this.getToolsForAgent(agent.name, requestSnapshot);
-            const tools = allTools.filter((t) => agent.canUseTool(t.name));
-            // Explicit-mode agents get the on-demand routing reference (teach-by-
-            // bounce: the grammar is never injected, only served when asked).
-            if (agent.proseRouting === 'explicit')
-                tools.push(PROSE_HELP_TOOL);
+            const tools = this.agentToolSurface(agent, requestSnapshot);
             // Gather context from modules (pull-based) and MCPL hooks (push-based)
             // Both produce ContextInjection[] that get merged before inference.
             let injections;
@@ -7192,6 +7934,14 @@ export class AgentFramework {
                     console.error('beforeInference hook error:', error);
                 }
             }
+            if (trigger?.ephemeralSystemPrompt) {
+                const silentInjection = {
+                    namespace: 'framework:silent-heartbeat',
+                    position: 'system',
+                    content: [{ type: 'text', text: trigger.ephemeralSystemPrompt }],
+                };
+                injections = injections ? [...injections, silentInjection] : [silentInjection];
+            }
             // An ephemeral watchdog may dispose this Agent while hooks/compile await.
             // Do not create a provider stream after its generation lost ownership.
             if (this.agents.get(agent.name) !== agent) {
@@ -7291,6 +8041,7 @@ export class AgentFramework {
         }
     }
     async driveStream(agent, stream, requestSnapshot, trigger, attempt = 0, compiledRequest, ownsProviderGate = false, takeKvSubmission, drainKvSubmissionIds, knownToolNames = new Set()) {
+        const turnProseRouting = trigger?.suppressProse ? 'disabled' : agent.proseRouting;
         const startTime = Date.now();
         const requestId = `${agent.name}-${startTime}-${Math.random().toString(36).slice(2, 8)}`;
         const myStreamId = agent.streamId;
@@ -7344,7 +8095,10 @@ export class AgentFramework {
         // Sticky explicit-send suppression: prose after send_message stays quiet
         // to prevent a redundant "sent it" postscript. Fresh injected input
         // clears it, because the following prose is a reply to a new message.
-        let turnSilenced = false;
+        let turnSilenced = trigger?.suppressProse === true
+            || (trigger?.reason === 'tool_result_guard_retry'
+                && this.guardRetryTurnSilenced.get(agent.name) === true);
+        this.guardRetryTurnSilenced.delete(agent.name);
         // Live routing is only trusted when the membrane provides verbatim
         // round-scoped blocks (roundContent, native tool mode, membrane ≥0.5.64).
         // The fallback `preamble` is CUMULATIVE in XML mode (assistant prefill +
@@ -7364,9 +8118,9 @@ export class AgentFramework {
         //     this doesn't violate never-guess: it says "attending to what you
         //     sent here", which is true regardless of where the reply goes.
         //     Heartbeat/no-trigger explicit turns show no indicator.
-        const typingChannel = agent.proseRouting === 'disabled'
+        const typingChannel = turnProseRouting === 'disabled'
             ? null
-            : agent.proseRouting === 'explicit'
+            : turnProseRouting === 'explicit'
                 ? trigger?.channelId ?? null
                 : resolveTurnLocus();
         if (typingChannel)
@@ -7383,6 +8137,9 @@ export class AgentFramework {
         // id makes the discarded attempt's chunk buffer orphaned (never
         // finalized) instead of being appended to — see the 'retrying' case.
         let outgoingInferenceId = newOutgoingInferenceId();
+        // RFC-007: every inference id THIS stream mints, so the stream's end
+        // aborts only its own open tool calls — never a successor's.
+        const lifecycleInferenceIds = new Set([outgoingInferenceId]);
         let outgoingIndex = 0;
         // §10.5 inference/lifecycle: `started` now, exactly one terminal in the
         // finally below (the one block every exit path shares). Which terminal
@@ -7402,10 +8159,10 @@ export class AgentFramework {
         // turns until completion: otherwise speculative outgoing chunks could
         // expose the wrapper before the fail-closed classifier runs.
         const proseStream = this.channelRegistry &&
-            agent.proseRouting !== 'disabled' &&
+            turnProseRouting !== 'disabled' &&
             !agent.toolWrapperProseGuard
             ? new ProseStreamRouter({
-                mode: agent.proseRouting === 'explicit' ? 'explicit' : agent.proseRouting === 'hybrid' ? 'hybrid' : 'locus',
+                mode: turnProseRouting === 'explicit' ? 'explicit' : turnProseRouting === 'hybrid' ? 'hybrid' : 'locus',
                 initialTarget: typingChannel,
                 resolve: (spec) => {
                     const r = this.channelRegistry.resolveProseTarget(spec);
@@ -7418,6 +8175,23 @@ export class AgentFramework {
                 this.channelRegistry.sendOutgoingChunk(rd.channelId, agent.name, outgoingInferenceId, outgoingIndex++, rd.delta);
             }
         };
+        // Tool-result-guard publication boundary. While a SUBMITTED batch is
+        // pending (or a guard recovery is running), a refusal can still abandon
+        // this physical round, so its streamed text must not reach any surface
+        // yet — neither the prose router nor the inference:tokens trace (TTS and
+        // other trace consumers voice it). Hold both; release in order on a clean
+        // round (tool-calls / non-guard completion), discard on a guard refusal.
+        let guardHeld = [];
+        const releaseGuardHeld = () => {
+            const held = guardHeld;
+            guardHeld = [];
+            for (const item of held) {
+                this.emitTrace(item.trace);
+                if (proseStream && item.text !== undefined)
+                    emitOutgoing(proseStream.feed(item.text));
+            }
+        };
+        const discardGuardHeld = () => { guardHeld = []; };
         const adoptInjectedRound = () => {
             if (!this.midTurnInputSignals.has(agent.name))
                 return;
@@ -7425,7 +8199,7 @@ export class AgentFramework {
             // A new conversational message, not merely a tool result, means any
             // earlier explicit delivery has completed its conversational job.
             // Routing is NOT touched: the turn locus stays frozen.
-            turnSilenced = false;
+            turnSilenced = trigger?.suppressProse === true;
         };
         try {
             for await (const event of stream) {
@@ -7439,8 +8213,8 @@ export class AgentFramework {
                 }
                 this.touchEphemeralRun(agent.name, true);
                 switch (event.type) {
-                    case 'tokens':
-                        this.emitTrace({
+                    case 'tokens': {
+                        const trace = {
                             type: 'inference:tokens',
                             agentName: agent.name,
                             content: event.content,
@@ -7450,11 +8224,18 @@ export class AgentFramework {
                             // lets trace consumers tag every chunk with the channel this
                             // turn's prose is bound for, without re-deriving routing.
                             channelId: typingChannel ?? undefined,
-                        });
-                        if (proseStream && event.meta.type === 'text') {
-                            emitOutgoing(proseStream.feed(event.content));
+                        };
+                        const text = event.meta.type === 'text' ? event.content : undefined;
+                        if (agent.toolResultGuard.hasSubmittedPending || agent.toolResultGuard.recovering) {
+                            guardHeld.push({ trace, text });
+                        }
+                        else {
+                            this.emitTrace(trace);
+                            if (proseStream && text !== undefined)
+                                emitOutgoing(proseStream.feed(text));
                         }
                         break;
+                    }
                     case 'retrying': {
                         // Membrane is re-issuing after a content-policy refusal. Per the
                         // RetryingEvent contract we must DISCARD everything this call has
@@ -7472,7 +8253,9 @@ export class AgentFramework {
                             (event.category ? ` category=${event.category}` : '') +
                             ' — discarding the refused attempt');
                         outgoingInferenceId = newOutgoingInferenceId();
+                        lifecycleInferenceIds.add(outgoingInferenceId);
                         outgoingIndex = 0;
+                        discardGuardHeld();
                         proseStream?.reset();
                         this.emitTrace({
                             type: 'inference:tokens',
@@ -7497,6 +8280,10 @@ export class AgentFramework {
                         break;
                     }
                     case 'tool-calls': {
+                        // A tool-call response is a clean physical round: admit its
+                        // preceding results before storing/dispatching this new round.
+                        agent.toolResultGuard.accept();
+                        releaseGuardHeld();
                         adoptInjectedRound();
                         hadToolCalls = true;
                         this.recordLogicalTurnToolCalls(agent, myTurnToken ?? -1, event.calls.length);
@@ -7562,7 +8349,14 @@ export class AgentFramework {
                         // So all calls here have valid input — {} is legitimate for parameterless tools.
                         agent.enterWaitingForTools(event.calls, stream);
                         for (const call of event.calls) {
+                            // RFC-007: register at the one dispatch point for model-issued
+                            // calls, keyed by (agent, call id) with this inference's id;
+                            // `started` goes out once dispatch returns. Refusal sites inside
+                            // dispatch run synchronously and call refuse() first, so a call
+                            // the host refuses produces no events.
+                            this.toolLifecycleEmitter?.register(agent.name, outgoingInferenceId, call);
                             this.dispatchToolCall(agent.name, call);
+                            this.toolLifecycleEmitter?.open(agent.name, call.id);
                         }
                         // Speak-while-acting: route THIS round's prose to the locus NOW
                         // instead of batching every segment to the end of the turn. Long
@@ -7586,11 +8380,11 @@ export class AgentFramework {
                                 liveProseRouting = true;
                                 const roundSegments = splitProseSegments(assistantBlocks);
                                 if (roundSegments.length > 0) {
-                                    if (agent.proseRouting === 'disabled') {
+                                    if (turnProseRouting === 'disabled') {
                                         console.error(`[routing] ${agent.name}: mid-turn prose NOT routed (proseRouting=disabled)`);
                                         this.recordProseSuppression(agent.name, roundSegments.length);
                                     }
-                                    else if (agent.proseRouting === 'hybrid') {
+                                    else if (turnProseRouting === 'hybrid') {
                                         if (turnSilenced) {
                                             this.recordProseSuppression(agent.name, roundSegments.length);
                                         }
@@ -7603,7 +8397,7 @@ export class AgentFramework {
                                             }
                                         }
                                     }
-                                    else if (agent.proseRouting === 'explicit') {
+                                    else if (turnProseRouting === 'explicit') {
                                         // Explicit mode: every segment through the prose gateway.
                                         // Silencing does not apply — unprefixed prose bounces and
                                         // prefixed prose is deliberate; think-privacy still holds.
@@ -7641,7 +8435,87 @@ export class AgentFramework {
                     case 'complete': {
                         adoptInjectedRound();
                         const durationMs = Date.now() - startTime;
-                        const response = event.response;
+                        let response = event.response;
+                        const guardCategory = response.raw?.response?.stop_details?.category ?? 'unknown';
+                        // A staged batch the strategy omitted from the request cannot
+                        // have caused this refusal: settle it and fall through to the
+                        // ordinary refusal handling (rewind/reaction) below.
+                        if (response.stopReason === 'refusal')
+                            agent.toolResultGuard.settleUnsubmitted(guardCategory);
+                        const guardRefusal = response.stopReason === 'refusal'
+                            && (agent.toolResultGuard.hasSubmittedPending || agent.toolResultGuard.recovering);
+                        if (guardRefusal) {
+                            discardGuardHeld();
+                            const category = guardCategory;
+                            const withheld = agent.toolResultGuard.withhold(category);
+                            // Nothing from the abandoned physical attempt is published or
+                            // persisted as assistant speech, including a terminal refusal
+                            // after the single recovery retry.
+                            proseStream?.reset();
+                            if (withheld) {
+                                const usage = response.details?.usage ?? response.usage;
+                                const tokenUsage = usage ? {
+                                    input: usage.inputTokens, output: usage.outputTokens,
+                                    cacheCreation: usage.cacheCreationTokens, cacheRead: usage.cacheReadTokens,
+                                } : undefined;
+                                this.noteRefusal(agent.name, category, tokenUsage);
+                                // The abandoned stream was billed (membrane usage here is
+                                // cumulative across this physical tool loop): count it before
+                                // the retry opens a fresh stream with its own usage.
+                                const abandonedUsage = response.details?.usage;
+                                if (abandonedUsage) {
+                                    this.usageTracker.onInferenceCompleted(agent.name, {
+                                        inputTokens: abandonedUsage.inputTokens,
+                                        outputTokens: abandonedUsage.outputTokens,
+                                        cacheCreationTokens: abandonedUsage.cacheCreationTokens,
+                                        cacheReadTokens: abandonedUsage.cacheReadTokens,
+                                    }, abandonedUsage.estimatedCost
+                                        ? { total: abandonedUsage.estimatedCost.total, currency: abandonedUsage.estimatedCost.currency }
+                                        : undefined);
+                                    this.persistUsageState();
+                                }
+                                this.logInference({
+                                    timestamp: startTime, agentName: agent.name, requestId,
+                                    success: false, error: 'Tool output withheld by the guard',
+                                    request: compiledRequest ?? {}, response, durationMs, tokenUsage, stopReason: 'refusal',
+                                });
+                                console.error(`[tool-result-guard] agent=${agent.name} withheld ${withheld.length} result(s); retrying inference`);
+                                this.emitTrace({
+                                    type: 'inference:stream_restarted', agentName: agent.name,
+                                    reason: 'tool_result_guard', inputTokens: agent.lastStreamInputTokens,
+                                    budget: agent.maxStreamTokens,
+                                });
+                                await turnSpeechChain;
+                                if (this.agents.get(agent.name) !== agent || agent.streamId !== myStreamId) {
+                                    generationLost = true;
+                                    lifecyclePhase = 'aborted';
+                                    return;
+                                }
+                                agent.reset();
+                                preserveEventGateForSuccessor = true;
+                                lifecyclePhase = 'aborted';
+                                // Carry same-turn explicit-send suppression into the retry:
+                                // a text-only recovery after a successful send must not post
+                                // a postscript to a message already delivered.
+                                if (turnSilenced)
+                                    this.guardRetryTurnSilenced.set(agent.name, true);
+                                // Restart inference inside this logical turn. No tool is
+                                // executed again and no settle/checkpoint/locus reset occurs.
+                                await this.startAgentStream(agent, {
+                                    ...trigger, agentName: agent.name, reason: 'tool_result_guard_retry',
+                                    source: trigger?.source ?? 'framework', timestamp: Date.now(),
+                                }, attempt);
+                                return;
+                            }
+                            const lastResult = response.content.reduce((last, block, index) => block.type === 'tool_result' ? index : last, -1);
+                            response = { ...response, content: response.content.slice(0, lastResult + 1), rawAssistantText: '' };
+                            agent.toolResultGuard.recovering = false;
+                        }
+                        else if (response.stopReason !== 'refusal') {
+                            agent.toolResultGuard.accept();
+                        }
+                        if (!guardRefusal)
+                            releaseGuardHeld();
                         // If the agent is still waiting_for_tools when 'complete' fires
                         // (shouldn't happen after incomplete-tool-call fix, but guard anyway),
                         // flush pending blocks + inject error results for any remaining pending tools.
@@ -7667,8 +8541,12 @@ export class AgentFramework {
                             // one door a giant blob still walks through).
                             const readyState = agent.state;
                             if (readyState.status === 'ready') {
-                                const { blocks: toolResultContent } = await this.buildStoredToolResultContent(agent.name, readyState.toolResults, this.resolveToolResultInlineCap(agent).cap);
-                                agent.getContextManager().addMessage('user', toolResultContent);
+                                const cap = this.resolveToolResultInlineCap(agent).cap;
+                                const { blocks: toolResultContent, spilled } = await this.buildStoredToolResultContent(agent.name, readyState.toolResults, cap);
+                                agent.toolResultGuard.storeResults(toolResultContent, readyState.toolResults.map((tc) => this.toMembraneToolResult(tc.id, tc.result, cap, spilled.get(tc.id))), readyState.toolResults);
+                                // The response is already complete: this batch is never
+                                // submitted in this turn, so it cannot be refused. Admit it.
+                                agent.toolResultGuard.settleTurnEnded();
                             }
                         }
                         // Add assistant response to context.
@@ -7855,7 +8733,7 @@ export class AgentFramework {
                                         `(remaining ${forced.remaining})`);
                                 }, () => this.finishUnstick(agent.name, false, category));
                             }
-                            else if (rh?.autoRewind) {
+                            else if (rh?.autoRewind && !guardRefusal) {
                                 const cap = Math.max(1, rh.maxRewinds ?? 3);
                                 const used = this.refusalRewinds.get(agent.name) ?? 0;
                                 doRewind(used < cap, (count) => {
@@ -7894,7 +8772,7 @@ export class AgentFramework {
                             this.refusalStreak.delete(agent.name);
                         }
                         // Dispatch speech (and thoughts if any)
-                        if (speechContent.length > 0 || thoughts.length > 0) {
+                        if (!trigger?.suppressProse && (speechContent.length > 0 || thoughts.length > 0)) {
                             const speechContext = {
                                 turnComplete: true,
                                 trigger: trigger ?? {
@@ -7920,11 +8798,19 @@ export class AgentFramework {
                                 .join('\n')
                                 .trim();
                             if (speechText) {
-                                if (agent.proseRouting === 'disabled') {
+                                if (turnProseRouting === 'disabled') {
                                     console.error(`[routing] ${agent.name}: text-only prose NOT routed (proseRouting=disabled)`);
                                     this.recordProseSuppression(agent.name, 1);
                                 }
-                                else if (agent.proseRouting === 'hybrid') {
+                                else if (turnSilenced && turnProseRouting !== 'explicit') {
+                                    // Only reachable on a guard recovery that carried the
+                                    // same-turn send suppression, or a suppressProse trigger
+                                    // (a fresh text-only turn starts unsilenced). Explicit
+                                    // mode is exempt, as mid-turn.
+                                    console.error(`[routing] ${agent.name}: text-only prose NOT routed (turn silenced)`);
+                                    this.recordProseSuppression(agent.name, 1);
+                                }
+                                else if (turnProseRouting === 'hybrid') {
                                     const locus = resolveTurnLocus();
                                     console.error(`[prose] ${agent.name}: text-only turn -> hybrid prose gateway`);
                                     try {
@@ -7934,7 +8820,7 @@ export class AgentFramework {
                                         console.error('text-only hybrid prose delivery failed:', err);
                                     }
                                 }
-                                else if (agent.proseRouting === 'explicit') {
+                                else if (turnProseRouting === 'explicit') {
                                     console.error(`[prose] ${agent.name}: text-only turn -> prose gateway`);
                                     try {
                                         await this.deliverProse(agent, speechText);
@@ -7989,13 +8875,13 @@ export class AgentFramework {
                             // land before the trailing prose. Awaited even when silenced —
                             // the chain may still be flushing earlier rounds' posts.
                             await turnSpeechChain;
-                            if (agent.proseRouting === 'disabled') {
+                            if (turnProseRouting === 'disabled') {
                                 if (segments.length > 0) {
                                     console.error(`[routing] ${agent.name}: tool-call trailing prose NOT routed (proseRouting=disabled)`);
                                     this.recordProseSuppression(agent.name, segments.length);
                                 }
                             }
-                            else if (agent.proseRouting === 'hybrid') {
+                            else if (turnProseRouting === 'hybrid') {
                                 if (silenced && segments.length > 0) {
                                     this.recordProseSuppression(agent.name, segments.length);
                                 }
@@ -8011,7 +8897,7 @@ export class AgentFramework {
                                     }
                                 }
                             }
-                            else if (agent.proseRouting === 'explicit') {
+                            else if (turnProseRouting === 'explicit') {
                                 if (segments.length > 0) {
                                     console.error(`[prose] ${agent.name}: tool-call turn [${toolNames.join(', ')}] -> ${segments.length} trailing segment(s) via prose gateway`);
                                     for (const seg of segments) {
@@ -8061,7 +8947,7 @@ export class AgentFramework {
                         // awaited before trailing dispatch, and trailing/text-only
                         // segments were awaited in-loop. Locus mode only; explicit-mode
                         // envelopes acknowledge themselves through the prose gateway.
-                        if (agent.proseRouting !== 'explicit') {
+                        if (!trigger?.suppressProse && turnProseRouting !== 'explicit') {
                             this.appendProseDeliveryReceipt(agent);
                         }
                         // Explicit-prose `!` continuation: a prose segment this turn asked
@@ -8225,7 +9111,7 @@ export class AgentFramework {
                                 // deliveries map persists (cleared only at fresh turn
                                 // start) and the continuation stream's end writes ONE
                                 // receipt for the whole turn.
-                                if (cancelKind === 'turn_ended' && agent.proseRouting !== 'explicit') {
+                                if (cancelKind === 'turn_ended' && !trigger?.suppressProse && turnProseRouting !== 'explicit') {
                                     await turnSpeechChain;
                                     this.appendProseDeliveryReceipt(agent);
                                 }
@@ -8430,6 +9316,13 @@ export class AgentFramework {
             // completed; catch → failed; framework-cancel → aborted). A host
             // crash emits nothing — that is the documented best-effort limit, and
             // why consumers keep their safety timeout.
+            //
+            // RFC-007 §7.3: a tool call still open when its turn's stream ends was
+            // cancelled before a result — its terminal is `aborted`. (A normal turn
+            // has none: the stream waits for every result before continuing.)
+            // Scoped to this stream's own inference ids: a budget-restart successor
+            // may already be running for the same agent.
+            this.toolLifecycleEmitter?.abortOpen(agent.name, lifecycleInferenceIds);
             this.hookOrchestrator?.emitLifecycle({
                 inferenceId: outgoingInferenceId,
                 conversationId: agent.name,
@@ -8444,6 +9337,23 @@ export class AgentFramework {
             // (typing still stops, compression still runs — matching the observed
             // wedge). onInferenceEnded is idempotent, so a redundant call is safe.
             if (ownsPhysicalStream && !preserveEventGateForSuccessor) {
+                // A frame that ends without handing off to a successor (abort,
+                // exhausted errors) must not leave its batch pending: a later turn
+                // would resubmit the originals and claim its own refusal. Successor
+                // frames (error-policy retry, budget/guard restart) bump streamId or
+                // set preserveEventGateForSuccessor and keep the batch.
+                if (agent.streamId === myStreamId && agent.toolResultGuard.hasPending) {
+                    // abandon() clears the batch before its audit append, so a failed
+                    // write cannot re-arm it; it must not abort the rest of teardown
+                    // (gate release, turn token, provider admission) either.
+                    try {
+                        agent.toolResultGuard.abandon('aborted');
+                    }
+                    catch (error) {
+                        console.error(`[tool-result-guard] agent=${agent.name} failed to record aborted batch:`, error);
+                    }
+                }
+                agent.toolResultGuard.recovering = false;
                 this.eventGate?.onInferenceEnded(agent.name);
             }
             if (!generationLost && ownsPhysicalStream) {
@@ -8756,6 +9666,7 @@ export class AgentFramework {
         const startTime = Date.now();
         this.runCodeExecution(agentName, call)
             .catch((error) => {
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             // runCodeExecution is designed not to reject; this is the last-resort
             // guard so a bug here can never strand the agent in waiting_for_tools.
             const err = error instanceof Error ? error : new Error(String(error));
@@ -8845,21 +9756,41 @@ export class AgentFramework {
                 isError: true,
             };
         }
+        // A per-call time limit, capped by the deployment's ceiling (the result says when it was capped).
+        if (input.time_limit_ms !== undefined && (typeof input.time_limit_ms !== 'number' || !Number.isFinite(input.time_limit_ms) || input.time_limit_ms < 1000)) {
+            return { success: false, error: '`time_limit_ms` must be a number of milliseconds, at least 1000', isError: true };
+        }
+        const limits = scriptTimeLimits(this.codeExecutionConfig ?? undefined);
+        const ceilingMs = input.background === true ? limits.backgroundMaxMs : limits.maxMs;
+        const requestedMs = input.time_limit_ms === undefined ? undefined : Math.floor(input.time_limit_ms);
+        const timeLimitMs = requestedMs === undefined ? undefined : Math.min(requestedMs, ceilingMs);
+        const capNote = requestedMs !== undefined && requestedMs > ceilingMs
+            ? `time_limit_ms ${requestedMs} was capped at ${ceilingMs}, this deployment's maximum`
+            : undefined;
         const agent = this.agents.get(agentName);
         const surface = agent
             ? this.getToolsForAgent(agentName).filter((t) => agent.canUseTool(t.name))
             : this.getAllTools(); // ephemeral agents: full surface, matching executeToolCall
         const injected = buildInjectedTools(surface.map((t) => t.name).filter((name) => name !== CODE_EXECUTION_TOOL_NAME));
         if (input.background === true) {
-            return this.startBackgroundScript(agentName, input.code, injected);
+            const started = this.startBackgroundScript(agentName, input.code, injected, timeLimitMs);
+            if (capNote && started.success && started.data && typeof started.data === 'object') {
+                started.data.time_limit_note = capNote;
+            }
+            return started;
         }
         const runner = this.getOrCreateScriptRunner(agentName);
         this.scriptDeferredEndTurn.delete(agentName);
-        const exec = await runner.exec(input.code, injected);
+        const exec = await runner.exec(input.code, injected, undefined, timeLimitMs !== undefined ? { deadlineMs: timeLimitMs } : undefined);
         const endTurn = this.scriptDeferredEndTurn.delete(agentName);
         return {
             success: true,
-            data: { stdout: exec.stdout, stderr: exec.stderr, return_code: exec.returnCode },
+            data: {
+                stdout: exec.stdout,
+                stderr: exec.stderr,
+                return_code: exec.returnCode,
+                ...(capNote ? { time_limit_note: capNote } : {}),
+            },
             isError: false,
             ...(endTurn ? { endTurn: true } : {}),
         };
@@ -8875,7 +9806,7 @@ export class AgentFramework {
      * limitation is stated in the tool description so agents can calibrate
      * how much to rely on an armed wake.
      */
-    startBackgroundScript(agentName, code, injected) {
+    startBackgroundScript(agentName, code, injected, timeLimitMs) {
         // v1: primary-agent-only. A conversation fork's or ephemeral's daemon
         // would outlive its owner and its wake would land in the primary
         // conversation anyway — refuse loudly instead of surprising anyone.
@@ -8899,7 +9830,8 @@ export class AgentFramework {
             };
         }
         const scriptId = `bg-${++this.backgroundScriptCounter}`;
-        const lifetimeMs = cfg?.backgroundMaxLifetimeMs ?? 86_400_000;
+        // The agent's time_limit_ms (already capped) shortens the lifetime; it never extends it.
+        const lifetimeMs = timeLimitMs ?? cfg?.backgroundMaxLifetimeMs ?? 86_400_000;
         // Journal: a file under the agent's first read-write workspace mount so
         // their existing read/grep/shell tools work on it. Python appends
         // directly to the materialized path; watch-mode mounts sync it back to
@@ -8960,6 +9892,7 @@ export class AgentFramework {
                 script_id: scriptId,
                 log: logPath ?? 'no writable workspace mount — output is not retrievable; only wake_agent() reaches you',
                 lifetime_hours: Math.round(lifetimeMs / 3_600_000 * 10) / 10,
+                lifetime: formatLimit(lifetimeMs), // exact for short limits, which lifetime_hours rounds to 0
                 note: 'The script dies if the host process restarts. Manage with code_execution {"action": "list"|"cancel"}.',
             },
         };
@@ -9532,17 +10465,96 @@ export class AgentFramework {
         // Append one record per event — same rationale as logInference.
         this.store.appendToStateJson(PROCESS_LOG_ID, entryToStore);
     }
+    /** Forget one server's RFC-008 class declarations (see the close handler). */
+    dropMcplToolClasses(serverId) {
+        // Tolerate partially-constructed frameworks (tests build them with
+        // Object.create): nothing cached means nothing to forget.
+        if (!this.mcplToolClasses?.size)
+            return;
+        const prefix = this.mcplServerConfigs?.get(serverId)?.toolPrefix ?? `mcpl--${serverId}`;
+        for (const name of [...this.mcplToolClasses.keys()]) {
+            if (name.startsWith(`${prefix}--`))
+                this.mcplToolClasses.delete(name);
+        }
+    }
     /**
-     * Find the MCPL server for a tool call by checking against the prefix map.
-     * Returns [serverId, prefix] if found, null otherwise.
+     * RFC-007/RFC-008: what tools/lifecycle says about a model-facing tool —
+     * its effective class, and for MCPL tools the providing connection and
+     * the server's own tool name. Host knowledge (built-in table, embedding
+     * host's table) applies only to tools the host implements; an MCPL tool's
+     * class comes from an operator override or its server's declaration.
+     */
+    describeToolForLifecycle(tool) {
+        const mcpl = this.resolveMcplTool(tool);
+        const { classes } = this.effectiveToolClass(tool, mcpl !== null);
+        if (mcpl)
+            return { class: classes, serverId: mcpl[0], serverTool: tool.slice(mcpl[1].length + 2) };
+        return { class: classes };
+    }
+    /**
+     * RFC-008 §5.1: a tool's effective class and the source that decided it.
+     * Operator overrides first; then host knowledge, for tools the host
+     * implements (never for MCPL tools); then an MCPL tool's own declaration.
+     * Tolerates partially-constructed frameworks (tests use Object.create).
+     */
+    effectiveToolClass(tool, isMcpl) {
+        return resolveToolClass(tool, isMcpl ? this.mcplToolClasses?.get(tool) : undefined, {
+            overrides: this.toolClassOverrides ?? [],
+            host: isMcpl ? [] : (this.hostToolClasses ?? []),
+        });
+    }
+    /**
+     * RFC-008 §6: tools with their effective class and where that class came
+     * from (`override`, `host`, `server`, or `none` for an unclassed tool,
+     * which policy treats as most restrictive). For operators: a surprising
+     * class should be visible before it matters.
+     *
+     * With `agentName`, exactly the tools that agent is shown. Without, every
+     * tool the framework offers to anyone: the shared board plus each agent's
+     * own (the subconscious's surface, `prose_help`), each listed once.
+     */
+    listToolClasses(agentName) {
+        let tools;
+        if (agentName !== undefined) {
+            const agent = this.agents.get(agentName);
+            if (!agent)
+                throw new Error(`Unknown agent: ${agentName}`);
+            tools = this.agentToolSurface(agent);
+        }
+        else {
+            tools = [this.getAllTools(), ...[...this.agents.values()].map((a) => this.agentToolSurface(a))].flat();
+        }
+        const seen = new Set();
+        const listed = [];
+        for (const t of tools) {
+            if (seen.has(t.name))
+                continue;
+            seen.add(t.name);
+            const mcpl = this.resolveMcplTool(t.name);
+            const { classes, source } = this.effectiveToolClass(t.name, mcpl !== null);
+            listed.push({ tool: t.name, class: classes, source, ...(mcpl ? { serverId: mcpl[0] } : {}) });
+        }
+        return listed;
+    }
+    /**
+     * Find the MCPL server for a tool: [serverId, prefix], or null.
+     * Prefixes can nest (`foo` and `foo--bar`), so `foo--bar--x` can match
+     * both. The server whose tools/list produced the name decides; a name no
+     * live server listed (stale, or invented by the model) goes to the longest
+     * matching prefix. Never prefix-map insertion order.
      */
     resolveMcplTool(toolName) {
-        for (const [prefix, serverId] of this.mcplPrefixMap) {
-            if (toolName.startsWith(prefix + '--')) {
+        const listedBy = this.mcplToolServers?.get(toolName);
+        let best = null;
+        for (const [prefix, serverId] of this.mcplPrefixMap ?? []) {
+            if (!toolName.startsWith(prefix + '--'))
+                continue;
+            if (serverId === listedBy)
                 return [serverId, prefix];
-            }
+            if (!best || prefix.length > best[1].length)
+                best = [serverId, prefix];
         }
-        return null;
+        return best;
     }
     dispatchToolCall(agentName, call) {
         // Enrich call with caller identity so modules can resolve the calling agent
@@ -9712,6 +10724,8 @@ export class AgentFramework {
         })
             .catch((error) => {
             const err = error instanceof Error ? error : new Error(String(error));
+            // RFC-007: the module threw — the host could not obtain a result.
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             this.emitTrace({
                 type: 'tool:failed',
                 module: moduleName,
@@ -9777,6 +10791,7 @@ export class AgentFramework {
             ? this.pendingAssistantBlocks.has(agent.name)
             : this.pendingAssistantBlocks.size > 0;
         if (!hasToolResult &&
+            opts?.bypassDeferralFor !== agent.name &&
             (this.quiesced ||
                 midToolCycle ||
                 this.activeTurnTokens.has(agent.name) ||
@@ -9793,9 +10808,18 @@ export class AgentFramework {
             this.deferredMessages.push({ id, seq: seq ?? ++this.deferredSeq, participant, content, metadata, forAgent: opts?.forAgent });
             if (this.quiesced || this.deferredWritesPersisted)
                 this.persistDeferredWrites();
+            if (opts?.placement) {
+                opts.placement.agent = agent.name;
+                opts.placement.deferredId = id;
+            }
             return ''; // Deferred — flushed at the target's next boundary
         }
-        return agent.getContextManager().addMessage(participant, content, opts?.deferredWriteId ? withDeferredWriteId(metadata, opts.deferredWriteId) : metadata);
+        const stored = agent.getContextManager().addMessage(participant, content, opts?.deferredWriteId ? withDeferredWriteId(metadata, opts.deferredWriteId) : metadata);
+        if (opts?.placement) {
+            opts.placement.agent = agent.name;
+            opts.placement.messageId = stored;
+        }
+        return stored;
     }
     /**
      * Splice out the deferred messages addressed to `agentName` (explicitly
@@ -10239,6 +11263,11 @@ export class AgentFramework {
         this.mcplServerRegistry = new McplServerRegistry();
         this.featureSetManager = new FeatureSetManager();
         this.hookOrchestrator = new HookOrchestrator(this.mcplServerRegistry, this.featureSetManager);
+        this.toolLifecycleEmitter = new ToolLifecycleEmitter({
+            observers: () => this.mcplServerRegistry?.getAllServers() ?? [],
+            configFor: (serverId) => this.mcplServerConfigs.get(serverId)?.toolLifecycle,
+            describe: (tool) => this.describeToolForLifecycle(tool),
+        });
         // Build prefix map and store configs for tool routing
         for (const config of serverConfigs) {
             const prefix = config.toolPrefix ?? `mcpl--${config.id}`;
@@ -10250,7 +11279,8 @@ export class AgentFramework {
         const triggerFilter = serverConfigs.find(c => c.shouldTriggerInference)?.shouldTriggerInference
             ?? (this.eventGate ? this.eventGate.asShouldTriggerCallback() : undefined);
         // Push events handler (Step 6)
-        this.pushHandler = new PushHandler(this.featureSetManager, (event) => this.pushEvent(event), (event) => this.emitTrace(event), triggerFilter);
+        this.initializePushCoalescer();
+        this.pushHandler = new PushHandler(this.featureSetManager, (event) => this.pushEvent(event), (event) => this.emitTrace(event), triggerFilter, (serverId, params, event) => this.handleCoalescedPush(serverId, params, event));
         // Server-initiated inference router (Step 6)
         this.inferenceRouter = new InferenceRouter(this.membrane, this.hookOrchestrator, this.featureSetManager, inferenceRouting ?? null, (event) => this.emitTrace(event), (serverId, params) => {
             const server = this.mcplServerRegistry.getServer(serverId);
@@ -10261,6 +11291,7 @@ export class AgentFramework {
         // Channel registry (Step 7)
         this.channelRegistry = new ChannelRegistry(this.mcplServerRegistry, this.featureSetManager, (event) => this.pushEvent(event), (event) => this.emitTrace(event), {
             store: this.store,
+            handleCoalescedIncoming: (serverId, message, event) => this.handleCoalescedIncoming(serverId, message, event),
             sendTypingFn: (serverId, channelId, metadata, op) => {
                 const server = this.mcplServerRegistry.getServer(serverId);
                 if (server) {
@@ -10329,11 +11360,17 @@ export class AgentFramework {
         // implemented for years — are declared (AUDIT-001/issue #76 item 12).
         this.mcplHostCapabilities = {
             version: '0.5',
+            // RFC-006 (mcpl PR #5, revision 7): both lanes, deferred rendering,
+            // channel-scoped pushes, one-hour retry window.
+            eventCoalescing: { ...PUSH_COALESCING_SUPPORT },
             pushEvents: true,
             contextHooks: {
                 beforeInference: true,
             },
             inferenceLifecycle: true,
+            // RFC-007: tools/lifecycle (metadata, and requested argument fields
+            // under their own grant) plus the tools/observe filter.
+            toolLifecycle: { observe: true, inputs: true },
             // modelInfo is NOT advertised: §12.2's result requires all four of
             // {id, vendor, contextWindow, capabilities} and the host has no
             // truthful source for contextWindow/capabilities (grep: none exists).
@@ -11066,17 +12103,28 @@ export class AgentFramework {
             const prefix = config.toolPrefix ?? `mcpl--${id}`;
             const connection = this.mcplServerRegistry?.getServer(id) ?? null;
             const connected = connection?.isConnected ?? false;
+            // Attribute through the dispatch resolver: a bare prefix match would
+            // also count a nested prefix's tools (`foo` vs `foo--bar`) as ours.
+            const ownTools = (this.mcplTools ?? []).flatMap((t) => {
+                const hit = this.resolveMcplTool(t.name);
+                return hit && hit[0] === id ? [{ tool: t.name, serverTool: t.name.slice(hit[1].length + 2) }] : [];
+            });
             result.push({
                 id,
                 connected,
                 retrying: !connected && (connection?.willReconnect ?? false),
                 toolPrefix: prefix,
-                toolCount: this.mcplTools.filter(t => t.name.startsWith(`${prefix}--`)).length,
+                toolCount: ownTools.length,
                 policyEstablished: connection?.policyEstablished ?? false,
                 effectiveGrant: connection?.grant.effectiveList() ?? [],
                 maskedCapabilities: [...(connection?.droppedCapabilities ?? [])].sort(),
                 deniedCapabilities: [...(connection?.grant.deniedPaths ?? [])].sort(),
                 allowHostCommands: config.allowHostCommands === true,
+                toolObserveFilter: connection?.toolObserveFilter ?? null,
+                toolClasses: ownTools.map(({ tool, serverTool }) => {
+                    const { classes, source } = this.effectiveToolClass(tool, true);
+                    return { tool, serverTool, class: classes, source };
+                }),
                 manifestState: connection
                     ? { ...connection.manifestState }
                     : { lastValidatedRevision: null, lastFetchedAt: null, lastNegotiatedAt: null },
@@ -11109,10 +12157,15 @@ export class AgentFramework {
             const barrier = this.discordAwarenessBarrier;
             if (barrier)
                 await barrier.promise;
-            this.pushHandler?.handlePushEvent(connection.id, params, responder);
+            await this.pushHandler?.handlePushEvent(connection.id, params, responder);
         });
         // Handle server-initiated inference requests (Step 6)
         connection.on('inference-request', async (params, responder) => {
+            // RFC-006 §5.3 / SPEC §10.7: no inference from inside a render.
+            if (this.pushCoalescer?.isRendering(connection.id)) {
+                responder?.respondError(-32600, 'Cannot request inference while push/render is in progress');
+                return;
+            }
             if (this.inferenceRouter && responder) {
                 const barrier = this.discordAwarenessBarrier;
                 if (barrier)
@@ -11150,6 +12203,21 @@ export class AgentFramework {
                 channels: this.channelRegistry?.descriptorsForServer(connection.id) ?? [],
             });
         });
+        // RFC-007 §6: the server's filter over tools/lifecycle. Admission already
+        // required toolLifecycle.observe (-32002 otherwise). Validation failures
+        // leave the previous filter in force (§6.6).
+        connection.on('tools-observe', (params, responder) => {
+            const parsed = parseToolObserveParams(params);
+            if (!parsed.ok) {
+                if (responder?.respondError)
+                    responder.respondError(-32602, parsed.message, parsed.data);
+                else
+                    console.error(`[mcpl] ${connection.id}: tools/observe rejected — ${parsed.message}`);
+                return;
+            }
+            connection.toolObserveFilter = parsed.rules;
+            responder?.respond({});
+        });
         connection.on('model-info', (_params, responder) => {
             // §12.2 requires ALL FOUR of {id, vendor, contextWindow, capabilities}
             // in the DIRECT result shape, and numeric contextWindow cannot express
@@ -11164,7 +12232,7 @@ export class AgentFramework {
             const barrier = this.discordAwarenessBarrier;
             if (barrier)
                 await barrier.promise;
-            this.channelRegistry?.handleIncoming(connection.id, params, responder);
+            await this.channelRegistry?.handleIncoming(connection.id, params, responder);
         });
         // Handle host-level admin commands from a surface (e.g. Discord /undo)
         connection.on('host-command', async (params, responder) => {
@@ -11300,6 +12368,10 @@ export class AgentFramework {
         // disconnectMcplServer, which deletes the trees explicitly.
         connection.on('close', (code, signal) => {
             this.featureSetManager?.removeServer(connection.id);
+            // RFC-008: a closed provider's class hints are stale — on reconnect it
+            // may class its tools differently. Until the next tools/list its tools
+            // are unclassed, the restrictive answer (RFC-007 §4.3).
+            this.dropMcplToolClasses(connection.id);
             this.emitTrace({
                 type: 'mcpl:server-closed',
                 serverId: connection.id,
@@ -11319,6 +12391,8 @@ export class AgentFramework {
             return;
         const tools = [];
         const toolFeatureSets = new Map();
+        const toolClasses = new Map();
+        const toolServers = new Map();
         for (const server of this.mcplServerRegistry.getAllServers()) {
             const config = this.mcplServerConfigs.get(server.id);
             const prefix = config?.toolPrefix ?? `mcpl--${server.id}`;
@@ -11328,7 +12402,13 @@ export class AgentFramework {
                     if (!isToolAllowed(tool.name, config))
                         continue;
                     const namespacedName = `${prefix}--${tool.name}`;
+                    toolServers.set(namespacedName, server.id);
                     const attributedTool = tool;
+                    // RFC-008: the server's class hint for this tool. Never shown to
+                    // the model (the definition below is unchanged by it).
+                    const declaredClasses = parseDeclaredClasses(attributedTool._meta, namespacedName);
+                    if (declaredClasses)
+                        toolClasses.set(namespacedName, declaredClasses);
                     const featureSet = typeof attributedTool.featureSet === 'string'
                         ? attributedTool.featureSet
                         : typeof attributedTool._meta?.featureSet === 'string'
@@ -11352,6 +12432,8 @@ export class AgentFramework {
         }
         this.mcplTools = tools;
         this.mcplToolFeatureSets = toolFeatureSets;
+        this.mcplToolClasses = toolClasses;
+        this.mcplToolServers = toolServers;
     }
     /**
      * Handle a tools/list_changed notification with collapse logic.
@@ -11409,6 +12491,8 @@ export class AgentFramework {
         const toolName = call.name.slice(prefix.length + 2); // strip "{prefix}--"
         const server = this.mcplServerRegistry.getServer(serverId);
         if (!server) {
+            // RFC-007: refused before executing — no lifecycle events.
+            this.toolLifecycleEmitter?.refuse(agentName, call.id);
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
@@ -11420,6 +12504,7 @@ export class AgentFramework {
         }
         const config = this.mcplServerConfigs.get(serverId);
         if (!isToolAllowed(toolName, config)) {
+            this.toolLifecycleEmitter?.refuse(agentName, call.id);
             this.emitTrace({ type: 'tool:failed', module: `mcpl:${serverId}`, tool: toolName, callId: call.id, error: 'denied by tool policy' });
             this.pushEvent({
                 type: 'tool-result',
@@ -11574,6 +12659,8 @@ export class AgentFramework {
             .catch((error) => {
             const err = error instanceof Error ? error : new Error(String(error));
             this.emitTrace({ type: 'tool:failed', module: `mcpl:${serverId}`, tool: toolName, callId: call.id, error: err.message, stack: err.stack });
+            // RFC-007: transport error, closed connection or timeout — no result.
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
@@ -11598,6 +12685,8 @@ export class AgentFramework {
         const home = this.conversationAgentHomes.get(agentName);
         if (home) {
             const reject = (error) => {
+                // RFC-007: the guard refuses before the tool runs — no lifecycle events.
+                this.toolLifecycleEmitter?.refuse(agentName, call.id);
                 this.emitTrace({
                     type: 'tool:failed', module: 'channels', tool: call.name, callId: call.id,
                     error: `conversation agent ${agentName}: ${error}`,
@@ -11676,6 +12765,7 @@ export class AgentFramework {
             .catch((error) => {
             const err = error instanceof Error ? error : new Error(String(error));
             this.emitTrace({ type: 'tool:failed', module: 'channels', tool: call.name, callId: call.id, error: err.message });
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
@@ -11894,7 +12984,8 @@ export class AgentFramework {
         if (announce && this.channelRegistry) {
             const text = input.message ?? `💤 Going quiet for ${human}. I'll still see messages, but won't respond until I wake.`;
             const agent = this.agents.get(agentName);
-            if (agent?.proseRouting === 'disabled') {
+            const silentTurn = this.activeTurnTriggers.get(agentName)?.suppressProse === true;
+            if (silentTurn || agent?.proseRouting === 'disabled') {
                 console.error(`[sleep] ${agentName}: proseRouting=disabled — sleep announcement not posted`);
             }
             else if (agent?.proseRouting === 'explicit') {
@@ -12669,6 +13760,7 @@ export class AgentFramework {
         catch (error) {
             const err = error instanceof Error ? error : new Error(String(error));
             this.emitTrace({ type: 'tool:failed', module: 'gate', tool: call.name, callId: call.id, error: err.message });
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             result = { success: false, error: err.message, isError: true };
         }
         this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'gate', result });
@@ -12691,6 +13783,7 @@ export class AgentFramework {
             .catch((error) => {
             const err = error instanceof Error ? error : new Error(String(error));
             this.emitTrace({ type: 'tool:failed', module: 'gate', tool: call.name, callId: call.id, error: err.message });
+            this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,