@animalabs/agent-framework 0.21.1 → 0.22.0

package/dist/src/framework.js

@@ -1,3 +1,4 @@
+import { ToolPresentation, presentationTools, isPresentationTool, renderCatalogue } from "./tool-presentation.js";
 import { dirname, join } from 'node:path';
 import { INLINE_WITHHELD_TEXT, classifyBlock, isInlineContradiction, referenceRegistry, referenceStubOrNull } from './mcpl/references.js';
 import { ReferenceFetcher, DEFAULT_FETCH_MAX_BYTES, EAGER_FETCH_TIMEOUT_MS } from './mcpl/reference-fetcher.js';
@@ -8,26 +9,29 @@ import { ContextManager, PassthroughStrategy, WindowedPassthroughStrategy, OverB
 import { SUBCONSCIOUS_TOOLS, SUBCONSCIOUS_TOOL_NAMES } from './tune-out/tools.js';
 import { TuneOutCoordinator, TUNE_OUT_DEFAULTS } from './tune-out/coordinator.js';
 import { ProcessQueueImpl } from './queue.js';
+import { DEFAULT_SHUTDOWN_TIMEOUT_MS, validateShutdownTimeout, shutdownErrorMessage } from './shutdown.js';
 import { REFUSAL_REACTIONS, REFUSAL_REACTION_FALLBACK } from './refusal-reactions.js';
 import { Agent } from './agent.js';
-import { ModuleRegistry, isStateExistsError } from './module-registry.js';
+import { ModuleRegistry, checkedToolResult, isStateExistsError, storableToolResult, thrownResult } from './module-registry.js';
 import { McplServerRegistry } from './mcpl/server-registry.js';
 import { FeatureSetManager } from './mcpl/feature-set-manager.js';
 import { computeGrant, CapabilityGrant, expandAdvertisementShorthand } from './mcpl/capability-grant.js';
 import { maskNegotiatedCapabilities } from './mcpl/capability-mask.js';
 import { HookOrchestrator } from './mcpl/hook-orchestrator.js';
 import { ToolLifecycleEmitter, parseToolObserveParams } from './mcpl/tool-lifecycle.js';
+import { checkToolPattern, describeUnmatchedPattern } from './mcpl/tool-pattern-check.js';
 import { BUILTIN_TOOL_CLASSES, normalizeClassTable, parseDeclaredClasses, resolveToolClass } from './mcpl/tool-classes.js';
 import { PushHandler, convertBlock as convertPushBlock } from './mcpl/push-handler.js';
 import { PushCoalescer, CoalesceError, PUSH_COALESCING_SUPPORT, validateCoalesceMember, validateCoalescedContent, coalescingSubjectKey, } from './mcpl/push-coalescer.js';
+import { isSilentHeartbeatMarker, isVisiblyEmptyContent } from './mcpl/visible-content.js';
 import { parseProsePrefix, parseHybridProsePrefix } from './mcpl/prose-grammar.js';
 import { ProseStreamRouter } from './mcpl/prose-stream-router.js';
 import { detectKnownToolWrapperProse } from './tool-wrapper-prose-guard.js';
 import { InferenceRouter } from './mcpl/inference-router.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
-import { ConversationRouter } from './mcpl/conversation-router.js';
+import { ConversationRouter, CONVERSATION_ROUTING_DEPRECATION_NOTICE } from './mcpl/conversation-router.js';
 import { safeSlice } from './safe-slice.js';
-import { toolResultDataToHistoryString, truncateForHistory, DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS, } from './tool-result-history.js';
+import { nonErrorResultText, toolResultDataToHistoryString, truncateForHistory, DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS, } from './tool-result-history.js';
 import { TOOL_IMAGE_REF_RE, ToolImageLedger, formatPreservedImageSlots, parseImagePlaceholders, sha256Hex, splitPreservingImageSlots, } from './tool-image-ledger.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { PyRunner, buildInjectedTools, formatLimit } from './code-execution/py-runner.js';
@@ -306,6 +310,43 @@ const bySeq = (a, b) => a.seq - b.seq;
 function withDeferredWriteId(metadata, id) {
     return { ...(metadata ?? {}), deferredWriteId: id };
 }
+/**
+ * A prose block's envelopes, as explicit mode routes them: every line whose
+ * text, after its leading whitespace, is `>>` and then a non-space opens a
+ * new envelope (first live use: Tilde 2026-07-24, one block carrying a
+ * letter to #tilde-mythos AND a `>>#tilde` aside; the single-envelope
+ * parser delivered the aside literally into the first destination — exactly
+ * the leak class this mode exists to kill). Text before the first `>>` is
+ * its own unprefixed envelope. A quoted `>> arrow` (space after) stays body
+ * text. Blank envelopes are dropped, and an envelope's whitespace before its
+ * `>>` is trimmed.
+ */
+function splitExplicitEnvelopes(rawText) {
+    const envelopes = [];
+    let current = [];
+    for (const line of rawText.split('\n')) {
+        if (/^>>\S/.test(line.trimStart()) && current.length > 0) {
+            envelopes.push(current.join('\n'));
+            current = [];
+        }
+        current.push(line);
+    }
+    if (current.length > 0)
+        envelopes.push(current.join('\n'));
+    return envelopes.filter((envelope) => envelope.trim()).map((envelope) => envelope.replace(/^\s+(?=>>)/, ''));
+}
+/**
+ * Whether a stream resumes its logical turn rather than starting one: a budget
+ * restart, or a tool-result-guard retry. Such a stream keeps the turn's
+ * routing state (the sticky destination, the turn's destination) and queues
+ * its deliveries behind the turn's earlier ones.
+ */
+function resumesLogicalTurn(reason) {
+    return reason === 'context_budget_restart' || reason === 'tool_result_guard_retry';
+}
+function freshTurnRouting() {
+    return { destination: null, hybridHold: false, logical: { continuation: false, deliveries: [], suppressed: 0 } };
+}
 function isTurnContinuation(reason) {
     return reason === 'context_budget_restart' || reason === 'tool_results_ready'
         || reason === 'tool_result_guard_retry';
@@ -463,6 +504,10 @@ class DefaultErrorPolicy {
 }
 /** Default sync interval in milliseconds */
 const DEFAULT_SYNC_INTERVAL_MS = 1000;
+/** Total time one withheld batch may spend awaiting workspace writes.
+ *  At the deadline its unfinished write is named as such, and later
+ *  originals stay in the audit. This bound applies to withheld spills. */
+const WITHHELD_SPILL_DEADLINE_MS = 30_000;
 /** Poll pending context-strategy maintenance independently of user activity. */
 const DEFAULT_MAINTENANCE_INTERVAL_MS = 5000;
 /** Bound one pass so a large backlog yields to inference and other agents. */
@@ -513,9 +558,90 @@ function extractGateFields(event) {
 function truncateReason(reason, max = 160) {
     return reason.length <= max ? reason : reason.slice(0, max) + '…';
 }
+/** The most of a thrown value's or a tool error's text that reaches a log line or a server's error answer. */
+const THROWN_TEXT_LIMIT = 500;
+/**
+ * What a thrown value says, safely and briefly: an Error's message, or any
+ * other value, as a string. Every inspection and coercion of the value is
+ * inside the try, so reading it can't throw: a revoked Proxy (whose
+ * instanceof throws), a hostile getter, an Error whose message isn't a
+ * string, or a value with no string form reads as text or as unreadable.
+ * The text is bounded, since a provider or handler error can carry a whole
+ * request body.
+ */
+function thrownText(error) {
+    let text;
+    try {
+        text = String(error instanceof Error ? error.message : error);
+    }
+    catch {
+        text = '(a value that could not be read)';
+    }
+    return text.length <= THROWN_TEXT_LIMIT ? text : `${text.slice(0, THROWN_TEXT_LIMIT)}… (${text.length} characters)`;
+}
+/**
+ * A failed handler's reason, never throwing: an Error's message, else "the
+ * handler failed" and what it threw (nothing, for `undefined`). Telling an
+ * Error apart is itself guarded, since instanceof throws on a revoked Proxy.
+ */
+function handlerFailureText(error) {
+    let isError = false;
+    try {
+        isError = error instanceof Error;
+    }
+    catch {
+        // Not an Error that can be read; thrownText says so.
+    }
+    if (isError)
+        return thrownText(error);
+    return error === undefined ? 'the handler failed' : `the handler failed: ${thrownText(error)}`;
+}
+/**
+ * Wrap a server request's responder so the request is answered at most once,
+ * and a later failure can tell whether the handler already answered.
+ * - An answer counts once the responder returns. One that throws, such as a
+ *   result the transport can't serialize, leaves the request unanswered, so
+ *   the listener's failure answer still goes out. This assumes a responder
+ *   that throws has sent nothing, which holds for the connection's own: they
+ *   serialize before they write, and their transports' writes don't throw
+ *   after writing.
+ * - A second answer is refused and logged: a handler that answered and then
+ *   threw isn't answered again, and a handler that answers after the
+ *   listener answered its failure doesn't send a second response.
+ * - Only the methods the responder has are wrapped, so a handler that checks
+ *   for `respondError` still finds a responder without one.
+ */
+function answerOnce(responder, method, serverId) {
+    if (!responder)
+        return { responder: undefined, answered: () => false };
+    let done = false;
+    const once = (kind, send) => (...args) => {
+        if (done) {
+            console.error(`[mcpl] ${method} from ${serverId}: a second answer (${kind}) was refused; the request was already answered`);
+            return;
+        }
+        send(...args);
+        done = true;
+    };
+    const wrapped = { ...responder };
+    if (responder.respond)
+        wrapped.respond = once('respond', (result) => responder.respond(result));
+    if (responder.respondError) {
+        wrapped.respondError = once('respondError', (code, message, data) => responder.respondError(code, message, data));
+    }
+    return { responder: wrapped, answered: () => done };
+}
 export class AgentFramework {
+    toolPresentations = new Map();
+    presentationPreviews = new WeakMap();
+    getRequestToolPresentation(request) {
+        return this.presentationPreviews.get(request) ?? null;
+    }
     store;
     ownsStore;
+    stopPromise = null;
+    stopCompleted = false;
+    ownedStoreClosed = false;
     membrane;
     queue;
     agents = new Map();
@@ -563,6 +689,8 @@ export class AgentFramework {
     providerAccelerationJitterMs = PROVIDER_ACCELERATION_JITTER_MS;
     providerHoldHook;
     providerAdmissionClosed = false;
+    /** Invalidates framework turns still assembling when stop begins. */
+    lifecycleGeneration = 0;
     /** Last time we reported stale (busy-requeued) inference requests, per agent. */
     staleWarnAt = new Map();
     /** Per-agent last inference activity (epoch ms), for /healthz + doctor tooling. */
@@ -596,26 +724,6 @@ export class AgentFramework {
      *  keeps unrelated channels from moving the pin. Cleared at every fresh
      *  turn's start; budget restarts keep it. */
     turnEngagedChannels = new Map();
-    /** Channels this turn's PLAIN PROSE was actually delivered to, in delivery
-     *  order (deduped at render). Feeds the `[delivered]` receipt appended at
-     *  logical turn end: explicit sends receipt themselves via their
-     *  tool_result, but auto-routed prose previously vanished into the router
-     *  with no in-window record — the agent could never see where its own
-     *  words landed (2026-07-31 misroute series; antra: minimal receipts).
-     *  Cleared at every fresh turn's start; budget restarts keep it (same
-     *  logical turn, receipt covers the whole turn). */
-    turnProseDeliveries = new Map();
-    /** Count of plain-prose segments SUPPRESSED this turn by sticky
-     *  explicit-send silencing. The suppression rule itself is untouched
-     *  (antra, 2026-07-31: visibility is enough) — but it must never be a
-     *  silent black hole: Mythos multiplexed two threads in one round (prose
-     *  for the lane + explicit send for another channel, textbook per the
-     *  routing doc), the silencing ate the prose reply, and his own record
-     *  ("scene delivered to #mythos via plain speech — routing confirmed")
-     *  believed it delivered. The receipt now reports suppression, so the
-     *  author sees the segment's fate one turn later. Cleared each fresh
-     *  turn; budget restarts keep it. */
-    turnProseSuppressed = new Map();
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
      *  not a reaction or a system marker) into the live stream. Tells
      *  driveStream to clear sticky explicit-send suppression before handling
@@ -629,14 +737,43 @@ export class AgentFramework {
     // ---- Explicit prose routing (docs/explicit-prose-routing.md) ----------
     /** Latest bounced (undelivered) prose per agent — the `{{unsent}}` source. */
     proseClipboards = new Map();
-    /** Sticky per-TURN delivery target set by the turn's first `>>` prefix.
-     *  Cleared at every non-restart turn start; survives context restarts. */
-    proseTargetPins = new Map();
-    /** Hybrid router is fail-closed after a malformed/unresolved envelope until a new valid target. */
-    proseHybridSuppressed = new Set();
-    /** Agents whose current turn requested `!` continuation — re-woken when the
-     *  turn completes instead of pausing until the next external event. */
-    proseContinuations = new Set();
+    /**
+     * Each agent's routing state for its current turn (TurnRouting): the
+     * sticky destination, the turn's destination for a resumed stream,
+     * hybrid's hold, a `!` continuation and receipt tallies. A fresh turn starts a new object
+     * instead of clearing the old one, and a stream that resumes the turn
+     * (resumesLogicalTurn) keeps it. A queued delivery holds the object of the
+     * turn that queued it, so prose a turn leaves queued when it ends (a
+     * skip_reply ends it before its posts have run) still follows that turn's
+     * destination, and its late writes can't reach the next turn.
+     */
+    turnRouting = new Map();
+    /**
+     * The latest link of each agent's chain of queued prose deliveries. Every
+     * stream queues its own behind it, a fresh turn's included, so the agent's
+     * posts go out in the order they were written, across streams and turns.
+     */
+    proseSpeechChains = new Map();
+    /**
+     * Each agent's open logical turn (LogicalTurn). It stays open from the
+     * fresh start that opens it until the turn settles (settleAgent: it
+     * completes, a tool ends it, or it fails or is abandoned), and every fresh
+     * start that routes prose while it is open continues it: a framework
+     * retry, the start that consumes tool results the non-streaming fallback
+     * left (whichever wake the scheduler starts it with), the later compile a
+     * provider-capacity hold defers a turn to. A silent start neither
+     * continues nor opens one. A stream that ends without settling needs to do
+     * nothing to carry its turn. Settling only detaches the turn from future
+     * starts: the settling stream keeps its own object, which its remaining
+     * deliveries, its receipt and its ` !` check go on using (a completion
+     * settles before it awaits its chain and writes its receipt). So every
+     * logical end must close inheritance once, before the next fresh start:
+     * a turn left open would hand its object, late writes and all, to an
+     * unrelated turn. A tool-ended turn settles before the next turn can
+     * start. Only the stream that holds the open turn closes it; disposal
+     * drops it, and stop() clears every agent's.
+     */
+    openLogical = new Map();
     /** Consecutive bounce-wakes per agent; capped so an agent that keeps
      *  emitting unprefixed prose can't wake-loop (notices still append). */
     proseBounceStreaks = new Map();
@@ -842,10 +979,16 @@ export class AgentFramework {
     codeExecutionConfig = null;
     codeExecutionRunners = new Map();
     scriptToolWaiters = new Map();
-    /** Agents whose running script hit an endTurn-carrying inner result —
-     *  deferred and applied to the final code_execution result instead of
-     *  cancelling the stream mid-script (which would wedge the turn). */
-    scriptDeferredEndTurn = new Set();
+    /** Per agent, the foreground script now running. An endTurn-carrying inner
+     *  result marks the script that made the call, and is applied to that
+     *  script's code_execution result instead of cancelling the stream
+     *  mid-script (which would wedge the turn). A stopped script's late result
+     *  marks only that script, never the agent's next one. */
+    scriptDeferredEndTurn = new Map();
+    /** RFC-007: per agent, the origin of the foreground script its runner is
+     *  executing, handed to that script's inner calls (scripts run one at a
+     *  time per runner). Background runners capture theirs in the closure. */
+    foregroundScriptOrigins = new Map();
     /** Background (daemon) scripts: model-authored watchers that outlive their
      *  spawning turn. Each gets a DEDICATED PyRunner; wake_agent() injects a
      *  provenance envelope + payload and requests inference. Keyed by script id. */
@@ -876,6 +1019,16 @@ export class AgentFramework {
     /** Namespaced tool name → the server whose tools/list produced it. Prefixes
      *  can nest (`foo`, `foo--bar`), so a prefix match alone can name two. */
     mcplToolServers = new Map();
+    /** Servers whose tools/list answered in the latest refresh. */
+    mcplListedServers = new Set();
+    /** Zero-match tool-pattern diagnostics (checkToolPatterns): set at the end
+     *  of create(), when the tool universe is first complete. */
+    toolPatternChecksArmed = false;
+    /** Patterns already reported as matching nothing — each is reported once. */
+    toolPatternsReported = new Set();
+    /** Every (prefix → serverId) ever configured. A removed or restarting
+     *  server's patterns stay undecided rather than reported mid-restart. */
+    toolPatternKnownPrefixes = new Map();
     /** Maps serverId → McplServerConfig for prefix lookup. */
     mcplServerConfigs = new Map();
     /** Host capabilities advertised during the MCP handshake — stored so servers
@@ -1066,6 +1219,8 @@ export class AgentFramework {
         // Create agents
         for (const agentConfig of config.agents) {
             await framework.createAgent(agentConfig);
+            if (agentConfig.toolPresentation)
+                framework.toolPresentations.set(agentConfig.name, new ToolPresentation(agentConfig.toolPresentation));
         }
         // The subconscious resident (issue #77) registers after the residents so
         // it can never become primary; it is excluded from every broadcast
@@ -1080,6 +1235,17 @@ export class AgentFramework {
         for (const module of config.modules) {
             await framework.addModule(module);
         }
+        for (const [agentName, presentation] of framework.toolPresentations) {
+            const workspace = framework.getWorkspaceModule();
+            if (!workspace)
+                throw new Error('Tool presentation requires workspace');
+            const agent = framework.agents.get(agentName);
+            for (const name of ['workspace--read', 'set_tool_visibility', 'set_tool_description']) {
+                if (!agent.canUseTool(name))
+                    throw new Error(`Tool presentation recovery requires ${name}`);
+            }
+            workspace.registerGeneratedTextFile(presentation.config.cataloguePath, () => renderCatalogue(framework.inspectToolPresentation(agentName)), agentName);
+        }
         // Initialize per-channel conversation routing (if configured)
         if (config.conversations) {
             if (!framework.agents.has(config.conversations.templateAgent)) {
@@ -1087,6 +1253,9 @@ export class AgentFramework {
                     `is not a configured agent`);
             }
             framework.conversationRouter = new ConversationRouter(config.conversations);
+            // Deprecated feature (agent-framework#235): still wired exactly as
+            // before, but named once per framework instance on stderr.
+            console.warn(`[deprecated] ${CONVERSATION_ROUTING_DEPRECATION_NOTICE}`);
             // Generation counters persist across restarts — reusing generation 1's
             // agent name after a restart would reopen (and re-seed) the previous
             // engagement's Chronicle namespace.
@@ -1122,15 +1291,41 @@ export class AgentFramework {
                     framework.pendingRequests.push({
                         agentName, reason, source, timestamp: Date.now(),
                         // gate-requested wakes carry where/who (EventGate wakeProvenance)
-                        // as TELEMETRY fields — the host's stamp reads them; the turn's
-                        // speech locus (channelId / addressed) is deliberately NOT set
-                        // here, so a batched wake routes exactly as it did before.
+                        // as TELEMETRY fields — the host's stamp reads them.
                         ...(provenance?.channelId ? { wakeChannelId: provenance.channelId } : {}),
                         ...(provenance?.counterparty ? { counterparty: provenance.counterparty } : {}),
                         ...(provenance?.at ? { wakeAt: provenance.at } : {}),
+                        // A batch that contains an ADDRESSED message (mention / reply /
+                        // DM) routes like the direct path does: the reply goes to that
+                        // message's channel. Without it the turn froze on the
+                        // process-global most-recent-inbound channel, which an ambient
+                        // message elsewhere could retarget between the DM's arrival and
+                        // the debounce firing (2026-09-30). Ambient-only batches set no
+                        // locus and keep the legacy fallback.
+                        //
+                        // The wake is broadcast to every agent, conversation forks
+                        // included, and a fork speaks only in its home channel: the
+                        // route applies to a fork only when it IS that home, and never to
+                        // another agent when a fork owns that channel. Otherwise a fork
+                        // bound elsewhere would show typing where it isn't replying.
+                        ...(provenance?.routeChannelId && framework.mayTakeGateRoute(agentName, provenance.routeChannelId)
+                            ? { channelId: provenance.routeChannelId, addressed: true }
+                            : {}),
                     });
                 },
                 getAgentNames: () => [...framework.agents.keys()].filter((n) => n !== framework.subconsciousAgentName),
+                // Push events reach the gate with the adapter's raw channel id; map
+                // them to the registered composite id the same way ingestion does
+                // (handleMcplPushEvent registers that channel on arrival, before any
+                // debounce can fire).
+                resolveRouteChannel: (info) => {
+                    if (info.eventType === 'mcpl:channel-incoming')
+                        return info.channelId || undefined;
+                    if (info.eventType === 'mcpl:push-event') {
+                        return framework.derivePushEventChannel(info.metadata)?.channelId;
+                    }
+                    return undefined;
+                },
             });
         }
         // Liveness watchdog: fail hard if the main thread wedges (opt-in).
@@ -1284,6 +1479,11 @@ export class AgentFramework {
         catch {
             // SIGUSR2 not available on this platform — non-fatal.
         }
+        // Modules, agents, MCPL servers and the tune-out tool are all in place:
+        // the first point at which "matches no tool" can be judged. Later tool
+        // refreshes re-check patterns still undecided.
+        framework.toolPatternChecksArmed = true;
+        framework.checkToolPatterns();
         return framework;
     }
     /**
@@ -1293,8 +1493,13 @@ export class AgentFramework {
         if (this.running) {
             return;
         }
+        this.resetCompletedStop();
         this.running = true;
         this.providerAdmissionClosed = false;
+        // A new lifecycle: a turn compiled before an earlier stop() never drives,
+        // and withheld spills, closed for the generation a stop ended, are open
+        // for this one.
+        this.lifecycleGeneration++;
         this.loopPromise = this.runLoop();
         // Start periodic sync timer (if enabled)
         if (this.syncIntervalMs > 0) {
@@ -1318,9 +1523,41 @@ export class AgentFramework {
         }
     }
     /**
-     * Stop the event loop.
+     * Stop the event loop. Failed module/MCPL cleanup can be retried with its
+     * original context; storage stays open until that cleanup succeeds.
+     * @param teardownTimeoutMs Optional module/MCPL wait budget. Omit to wait
+     * until cleanup settles, as required by existing module/child contracts. This
+     * does not bound earlier stream or event-loop quiescence, or cancel cleanup.
      */
-    async stop() {
+    stop(teardownTimeoutMs = DEFAULT_SHUTDOWN_TIMEOUT_MS) {
+        try {
+            validateShutdownTimeout(teardownTimeoutMs);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        if (this.stopPromise)
+            return this.stopPromise;
+        const attempt = this.stopOwned(teardownTimeoutMs);
+        this.stopPromise = attempt;
+        void attempt.then(() => { this.stopCompleted = true; }, () => { });
+        // Failed cleanup can be retried while its original store is open. A
+        // terminal storage failure after successful close must remain a failure.
+        void attempt.catch(() => {
+            if (!this.ownedStoreClosed && this.stopPromise === attempt)
+                this.stopPromise = null;
+        });
+        return attempt;
+    }
+    resetCompletedStop() {
+        if (this.ownedStoreClosed)
+            throw new Error('Cannot start a new lifecycle: owned store is closed');
+        if (this.stopCompleted) {
+            this.stopPromise = null;
+            this.stopCompleted = false;
+        }
+    }
+    async stopOwned(teardownTimeoutMs) {
         this.pushCoalescer?.suspend();
         this.flushCoalescingSnapshot();
         this.running = false;
@@ -1328,6 +1565,10 @@ export class AgentFramework {
         // store is still open, rather than leaving them to a reboot replay.
         this.ackDeferredWrites();
         this.providerAdmissionClosed = true;
+        this.lifecycleGeneration++;
+        // The generation this stop ends; withheld spills close for it alone, so a
+        // start() made before this stop finishes reopens them for its own.
+        const stoppingGeneration = this.lifecycleGeneration;
         this.queue.close();
         this.tuneOutCoordinator?.stop();
         // Kill running code_execution scripts before cancelling streams: a
@@ -1353,6 +1594,10 @@ export class AgentFramework {
         this.toolImageLedgers.clear();
         // A stopped host must never hang behind its own cooldown.
         this.cancelProviderAdmission();
+        // An open logical turn doesn't survive a stop: a start after a restart
+        // on this instance opens a new one rather than carrying its ` !` and
+        // receipt tallies across (openLogical).
+        this.openLogical.clear();
         // Cancel all active streams
         for (const agent of this.agents.values()) {
             if (agent.state.status === 'streaming' ||
@@ -1384,20 +1629,46 @@ export class AgentFramework {
         // Dispose EventGate (clear debounce timers)
         this.eventGate?.dispose();
         this.livenessWatchdog?.stop();
+        // A stopping stream's batch settles as withheld, and its stub names where
+        // the original went: let those writes finish while the workspace is up.
+        // Tracked here rather than per agent, since an ephemeral run or a closed
+        // fork leaves the agent map while its annotation can still be running.
+        while (this.guardAnnotations.size > 0)
+            await Promise.all([...this.guardAnnotations]);
+        // An annotation that starts after this point, such as one from a direct
+        // Agent API call stop doesn't cancel, starts no write to the stopping
+        // workspace: its stub names the audit record. A write that was past its
+        // deadline isn't waited for here, but the workspace's own stop waits for
+        // the mount turn it holds, bounded only by teardownTimeoutMs.
+        this.guardSpillsClosedFor = stoppingGeneration;
         // Stop modules and MCPL servers in parallel
-        const shutdownPromises = [this.moduleRegistry.stopAll()];
+        const shutdownPromises = [this.moduleRegistry.stopAll(teardownTimeoutMs)];
         if (this.mcplServerRegistry) {
-            shutdownPromises.push(this.mcplServerRegistry.closeAll());
-        }
-        await Promise.all(shutdownPromises);
+            shutdownPromises.push(this.mcplServerRegistry.closeAll(teardownTimeoutMs));
+        }
+        // Timed-out or failed teardown retains its context and may still write.
+        // Sync available state best-effort, but leave its store open for a retry.
+        const shutdownErrors = [];
+        for (const result of await Promise.allSettled(shutdownPromises)) {
+            if (result.status === 'rejected')
+                shutdownErrors.push(result.reason);
+        }
+        const teardownSucceeded = shutdownErrors.length === 0;
+        // Those later annotations write nothing, so they finish at once; let them
+        // record and edit their stubs before the store closes.
+        while (this.guardAnnotations.size > 0)
+            await Promise.all([...this.guardAnnotations]);
         // Streams may queue storage repairs while being cancelled above. Retry
-        // after their teardown, while the store is still open, before final sync.
-        for (const agent of this.agents.values()) {
+        // after their teardown, while the store is still open, before final sync:
+        // every live agent's guard, and every other guard that isn't idle, whose
+        // ephemeral run or closed fork has left the agent map.
+        for (const [guard, name] of this.guardsWithStorageWork()) {
             try {
-                agent.toolResultGuard.flushUnrecorded();
+                guard.flushUnrecorded();
             }
             catch (error) {
-                console.error(`[tool-result-guard] agent=${agent.name} could not finish queued storage work at stop:`, error);
+                console.error(`[tool-result-guard] agent=${name} could not finish queued storage work at stop:`, error);
+                shutdownErrors.push(error);
             }
         }
         // Final sync before closing
@@ -1406,10 +1677,24 @@ export class AgentFramework {
         }
         catch (error) {
             console.error('Final sync error:', error);
+            shutdownErrors.push(error);
         }
-        if (this.ownsStore) {
-            this.store.close();
+        if (this.ownsStore && teardownSucceeded) {
+            try {
+                this.store.close();
+                this.ownedStoreClosed = true;
+            }
+            catch (error) {
+                // Chronicle may consume the handle before close's internal sync
+                // throws. A consumed handle cannot retry the original operation.
+                this.ownedStoreClosed = this.store.isClosed();
+                shutdownErrors.push(error);
+            }
         }
+        if (shutdownErrors.length === 1)
+            throw shutdownErrors[0];
+        if (shutdownErrors.length > 1)
+            throw new AggregateError(shutdownErrors, `Framework shutdown failed: ${shutdownErrors.map(shutdownErrorMessage).join('; ')}`);
     }
     /**
      * Advance queued ContextManager work without requiring a new message.
@@ -1660,6 +1945,19 @@ export class AgentFramework {
         });
     }
     async runQueuedMaintenance() {
+        // A guard whose agent has left the map gets no activation to retry its
+        // queue; retry it here. It leaves busyGuards once nothing of it is left.
+        const live = new Set([...this.agents.values()].map((agent) => agent.toolResultGuard));
+        for (const [guard, name] of this.busyGuards) {
+            if (live.has(guard))
+                continue;
+            try {
+                guard.flushUnrecorded();
+            }
+            catch (error) {
+                console.error(`[tool-result-guard] agent=${name} storage retry failed during maintenance:`, error);
+            }
+        }
         const queued = [...this.agents.values()].flatMap((agent) => {
             try {
                 agent.toolResultGuard.flushUnrecorded();
@@ -1668,7 +1966,7 @@ export class AgentFramework {
                 console.error(`[tool-result-guard] agent=${agent.name} storage retry failed during maintenance:`, error);
             }
             const cm = agent.getContextManager();
-            const tools = this.getToolsForAgent(agent.name).filter((tool) => agent.canUseTool(tool.name));
+            const tools = this.compressionToolsForAgent(agent.name);
             cm.setToolDefinitions(tools);
             if (this.providerGateBlocked(agent.name))
                 return [];
@@ -1747,10 +2045,69 @@ export class AgentFramework {
             ? progress
             : undefined;
     }
+    /**
+     * A server's request or notification the host couldn't handle, answered
+     * with a JSON-RPC error when it is a request (a notification has no one to
+     * answer, and is logged), rather than thrown out of the connection's
+     * listener, where it was an unhandled rejection and the server's request
+     * waited for its timeout.
+     * - `refused`: the listener turned it away before its handler ran; the
+     *   host is stopping, and none of it was taken. Answered -32000, "the host
+     *   is stopping", the code the push coalescer already gives a stopping
+     *   host: the server can send it again to the host's next run.
+     * - `failed`: the handler threw, whatever it threw, `undefined` included.
+     *   While the host stops (its queue closed), that's answered -32000 too,
+     *   with the handler's own message after the stop wording; on a live host
+     *   it's a fault, answered -32603 with the handler's message. The handler
+     *   may have admitted part of the request first (an earlier message of a
+     *   batch), so nothing here claims that none of it was taken.
+     * A request the handler already answered before it threw isn't answered
+     * again: the failure is logged.
+     */
+    refuseServerItem(method, serverId, answer, outcome) {
+        // Optional chaining: prototype-built harnesses leave the queue unset.
+        const stopping = outcome.kind === 'refused' || !!this.queue?.isClosed;
+        const what = outcome.kind === 'refused' ? '' : handlerFailureText(outcome.error);
+        const reason = outcome.kind === 'refused'
+            ? 'the host is stopping'
+            : stopping
+                ? `the host stopped while handling this request (${what})`
+                : what;
+        if (outcome.kind === 'failed' && answer.answered()) {
+            console.error(`[mcpl] ${method} from ${serverId} failed after it was answered: ${reason}`);
+            return;
+        }
+        console.error(outcome.kind === 'refused'
+            ? `[mcpl] ${method} from ${serverId} refused: ${reason}`
+            : `[mcpl] ${method} from ${serverId} failed: ${reason} (part of it may already have been admitted)`);
+        try {
+            answer.responder?.respondError?.(stopping ? -32000 : -32603, reason);
+        }
+        catch {
+            // The connection is going too; there is no one left to tell.
+        }
+    }
     /**
      * Push a process event to the queue.
+     *
+     * After stop() the queue is closed and this throws, so a direct caller
+     * learns the framework is stopped — except for a tool's result. A call
+     * still running at stop() completes later, into a callback with nothing
+     * to catch the throw (an unhandled rejection), and nothing could take its
+     * result anyway: the queue that would carry it to its stream is closed,
+     * stop() is ending the streams, and the tool has already run. That
+     * result is dropped, and the drop is logged.
      */
     pushEvent(event) {
+        if (event.type === 'tool-result' && this.queue?.isClosed) {
+            // What an operator reconciling a dropped result needs (the resident
+            // may run the tool again): which tool, and whether it succeeded.
+            const outcome = event.result.success && !event.result.isError
+                ? 'succeeded'
+                : `failed${event.result.error ? `: ${thrownText(event.result.error)}` : ''}`;
+            console.error(`[framework] ${event.agentName}: result of tool call ${event.callId} (${event.toolName ? `${event.toolName}, ` : ''}${event.moduleName}) arrived after stop — dropped; the tool ${outcome}`);
+            return;
+        }
         this.queue.push(event);
         this.emitTrace({ type: 'process:received', processEvent: event });
     }
@@ -1790,6 +2147,7 @@ export class AgentFramework {
      * Add a module at runtime.
      */
     async addModule(module) {
+        this.resetCompletedStop();
         await this.moduleRegistry.addModule(module);
         this.emitTrace({ type: 'module:added', moduleName: module.name });
     }
@@ -1901,7 +2259,15 @@ export class AgentFramework {
                     return null;
                 const path = `${mount}/refs/${fileName}`;
                 const res = await workspace.writeBinary(path, data, mimeType);
-                return res.success ? path : null;
+                if (res.success)
+                    return path;
+                // Stored, with its disk copy failed: the workspace's tools read it
+                // from the tree, so the reference is fetched to that path.
+                if (res.data?.inChronicle === true) {
+                    console.error(`[refs] ${path} is in the workspace's Chronicle tree, but the rest of its write failed: ${res.error ?? 'unknown error'}`);
+                    return path;
+                }
+                return null;
             });
         }
         return this.referenceFetcherInstance;
@@ -2071,12 +2437,68 @@ export class AgentFramework {
             reset: (name) => set(name, undefined),
         };
     }
-    restoreToolResultGuardSetting(agent) {
+    /** Every guard's annotation still running, for stop() (agent-framework #277). */
+    guardAnnotations = new Set();
+    /** Each guard that isn't idle, by agent name, as the guard reports it. An
+     *  ephemeral run or a closed fork leaves the agent map with an annotation
+     *  maybe still running, or a stub edit, acceptance edit or audit write
+     *  queued, which maintenance and stop then retry (agent-framework #277). A
+     *  guard is here from the moment it has work left until the moment it has
+     *  none, however that comes about. */
+    busyGuards = new Map();
+    /** Withheld originals' writes still under way past their deadline: while
+     *  any is, the workspace isn't answering and no other withheld original's
+     *  write is started. Several can be, when writes of different agents'
+     *  batches stalled together. */
+    stalledSpills = new Set();
+    /** Withheld spills skipped since the current stall began. */
+    stallSkips = 0;
+    /** See WITHHELD_SPILL_DEADLINE_MS; an instance field so tests can shorten it. */
+    withheldSpillDeadlineMs = WITHHELD_SPILL_DEADLINE_MS;
+    /** The lifecycle generation whose stop() has let the running annotations
+     *  finish: a withheld original is then no longer written to a workspace
+     *  that is stopping, and its stub names the audit record. A start() after
+     *  that stop() has finished has a generation of its own, so the spill gate
+     *  is open again for an instance kept with a store it doesn't own and that
+     *  is still open (start() doesn't restore stopped modules or MCPL
+     *  connections, and refuses an owned store that stop() closed). A start()
+     *  made while a stop() is still draining isn't a supported order. */
+    guardSpillsClosedFor = null;
+    /** A new agent's guard: its persisted setting, the tool-results spill its
+     *  withheld originals are written to, and the set stop() waits on
+     *  (agent-framework #277). */
+    adoptToolResultGuard(agent) {
         const enabled = this.store.getStateJson(FRAMEWORK_STATE_ID)?.toolResultGuards?.[agent.name];
         if (enabled !== undefined && typeof enabled !== 'boolean') {
             throw new Error(`Invalid persisted tool_result_guard for ${agent.name}: expected a boolean`);
         }
         agent.toolResultGuard.setOverride(enabled);
+        const guard = agent.toolResultGuard;
+        guard.setHost({
+            spill: (label, text, branch, deadline) => this.spillWithheld(label, text, branch, deadline),
+            deadline: () => Date.now() + this.withheldSpillDeadlineMs,
+            track: (annotation) => {
+                this.guardAnnotations.add(annotation);
+                void annotation.finally(() => this.guardAnnotations.delete(annotation));
+            },
+            idle: (idle) => {
+                if (idle)
+                    this.busyGuards.delete(guard);
+                else
+                    this.busyGuards.set(guard, agent.name);
+            },
+        });
+    }
+    /** Each guard that may have queued storage work, once, by agent name: the
+     *  live agents' and every other that isn't idle. */
+    guardsWithStorageWork() {
+        const guards = new Map();
+        for (const agent of this.agents.values())
+            guards.set(agent.toolResultGuard, agent.name);
+        for (const [guard, name] of this.busyGuards)
+            if (!guards.has(guard))
+                guards.set(guard, name);
+        return guards;
     }
     buildThinkTool(policy) {
         return {
@@ -2146,7 +2568,7 @@ export class AgentFramework {
                 : t);
             return [...SUBCONSCIOUS_TOOLS, ...basics];
         }
-        return this.getAllTools().map((tool) => {
+        return [...this.getAllTools(), ...(this.toolPresentations.has(agentName) ? presentationTools(this.toolPresentations.get(agentName).config.cataloguePath) : [])].map((tool) => {
             if (tool.name === 'think') {
                 return this.buildThinkTool(snapshot?.sameRoundThinkTextPolicy
                     ?? this.getAgentRuntimeSettings(agentName).sameRoundThinkTextPolicy);
@@ -2154,6 +2576,54 @@ export class AgentFramework {
             return tool;
         });
     }
+    /** Available is independent of presentation visibility; execution callers keep this surface. */
+    availableToolsForPresentation(agentName, snapshot) {
+        const agent = this.agents.get(agentName);
+        if (!agent)
+            throw new Error(`Unknown agent: ${agentName}`);
+        const tools = this.getToolsForAgent(agentName, snapshot).filter(t => agent.canUseTool(t.name));
+        if (agent.proseRouting === 'explicit' && agent.canUseTool(PROSE_HELP_TOOL.name))
+            tools.push(PROSE_HELP_TOOL);
+        return tools;
+    }
+    inspectToolPresentation(agentName, snapshot) {
+        const presentation = this.toolPresentations.get(agentName);
+        if (!presentation)
+            return null;
+        const tools = this.availableToolsForPresentation(agentName, snapshot);
+        const sources = new Map();
+        for (const tool of this.moduleRegistry.getAllTools()) {
+            sources.set(tool.name, `Module: ${tool.name.split('--')[0]}`);
+        }
+        // Use registered server prefixes, not a guess from a conventional mcpl-- name.
+        for (const tool of tools) {
+            for (const config of this.mcplServerConfigs.values()) {
+                if (tool.name.startsWith((config.toolPrefix ?? `mcpl--${config.id}`) + '--')) {
+                    sources.set(tool.name, `MCPL server: ${config.id}`);
+                    break;
+                }
+            }
+            if (!sources.has(tool.name))
+                sources.set(tool.name, 'Framework');
+        }
+        return presentation.resolve(tools, sources);
+    }
+    advertisedToolsForAgent(agentName, snapshot) {
+        return this.inspectToolPresentation(agentName, snapshot)?.advertised
+            ?? this.availableToolsForPresentation(agentName, snapshot);
+    }
+    /** Compression can revisit calls to hidden tools; never apply visibility here. */
+    compressionToolsForAgent(agentName, snapshot) {
+        return this.inspectToolPresentation(agentName, snapshot)?.available
+            ?? this.availableToolsForPresentation(agentName, snapshot);
+    }
+    editToolPresentation(agentName, call) {
+        const presentation = this.toolPresentations.get(agentName);
+        const agent = this.agents.get(agentName);
+        if (!presentation || !agent?.canUseTool(call.name))
+            return { success: false, isError: true, error: 'Tool presentation is not enabled for this caller' };
+        return presentation.edit(call.name, call.input, this.availableToolsForPresentation(agentName));
+    }
     /**
      * The tools one agent is shown at inference: its surface (the subconscious
      * has its own), less what its permissions deny, plus — for explicit-mode
@@ -2162,10 +2632,7 @@ export class AgentFramework {
      * listing both use this, so the listing cannot drift from the model's view.
      */
     agentToolSurface(agent, snapshot) {
-        const tools = this.getToolsForAgent(agent.name, snapshot).filter((t) => agent.canUseTool(t.name));
-        if (agent.proseRouting === 'explicit')
-            tools.push(PROSE_HELP_TOOL);
-        return tools;
+        return this.advertisedToolsForAgent(agent.name, snapshot);
     }
     getAgentRuntimeSettings(agentName) {
         const agent = this.agents.get(agentName);
@@ -2926,7 +3393,13 @@ export class AgentFramework {
         if (!agent) {
             throw new Error(`Agent not found: ${agentName}`);
         }
-        const tools = this.getToolsForAgent(agentName).filter((t) => agent.canUseTool(t.name));
+        const presentation = this.inspectToolPresentation(agentName);
+        const tools = presentation?.advertised ?? this.availableToolsForPresentation(agentName);
+        const capture = (request) => {
+            if (presentation)
+                this.presentationPreviews.set(request, presentation);
+            return request;
+        };
         // An explicit budget compiles against a HYPOTHETICAL window instead of the
         // agent's live one. That also suppresses transition-settling in
         // compileWithInjections (which only settles when no budget is passed), so
@@ -2934,7 +3407,7 @@ export class AgentFramework {
         // Default: no dynamic injection gathering → fully transparent (no
         // inference, no Chronicle writes, no external RPC). Opt in explicitly.
         if (!opts?.injections) {
-            return agent.buildActivationRequest(tools, undefined, opts?.budget);
+            return capture(await agent.buildActivationRequest(tools, undefined, opts?.budget, presentation?.available ?? tools));
         }
         // Full-fidelity path: mirrors startAgentStream's injection gathering.
         // NOT transparent — see the doc comment above.
@@ -2964,7 +3437,7 @@ export class AgentFramework {
                 console.error('beforeInference hook error (preview):', error);
             }
         }
-        return agent.buildActivationRequest(tools, injections, opts?.budget);
+        return capture(await agent.buildActivationRequest(tools, injections, opts?.budget, presentation?.available ?? tools));
     }
     /**
      * Non-committing preview of the FOLD PLAN at a hypothetical budget and/or
@@ -3341,7 +3814,7 @@ export class AgentFramework {
                 debugLogContext: !!process.env.DEBUG_CONTEXT,
             });
             const agent = new Agent(config, contextManager, this.membrane);
-            this.restoreToolResultGuardSetting(agent);
+            this.adoptToolResultGuard(agent);
             agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
             this.ephemeralCandidates.set(agent, contextManager);
             const cleanup = () => {
@@ -3393,10 +3866,20 @@ export class AgentFramework {
         run.toolCallsCount += count;
         run.lastActivity = Date.now();
     }
-    /** Settle an active ephemeral run (no-op for resident agents). The tool-call
-     *  count comes from the run's own counter — the single source of truth,
-     *  which unlike a per-stream local survives budget restarts. */
-    settleAgent(agentName, outcome) {
+    /** A logical turn's end, for every agent: it closes the agent's open
+     *  logical turn when it is the settling stream's own (openLogical), and
+     *  settles an active ephemeral run. The run's tool-call count comes from
+     *  its own counter — the single source of truth, which unlike a
+     *  per-stream local survives budget restarts. */
+    settleAgent(agentName, outcome, 
+    /** The settling stream's logical turn, when that stream still owns the
+     *  agent: it ends here, so the agent's next fresh start opens a new one.
+     *  A settle from a stream a newer one replaced closes nothing. */
+    closes) {
+        // This identity check is the only guard against a stale settle closing
+        // a newer turn (no test reaches one); keep it when editing call sites.
+        if (closes && this.openLogical.get(agentName) === closes)
+            this.openLogical.delete(agentName);
         const run = this.ephemeralRuns.get(agentName);
         if (!run)
             return;
@@ -3525,6 +4008,9 @@ export class AgentFramework {
                 // generation mismatch and leave any future owner untouched.
                 this.activeStreams.delete(agent.name);
                 this.pendingAssistantBlocks.delete(agent.name);
+                this.turnRouting.delete(agent.name);
+                this.proseSpeechChains.delete(agent.name);
+                this.openLogical.delete(agent.name);
                 // The late stream finalizer intentionally refuses name-keyed cleanup once
                 // deregistered, so disposal must release EventGate liveness itself.
                 this.eventGate?.onInferenceEnded(agent.name);
@@ -5361,7 +5847,7 @@ export class AgentFramework {
             viewFilter: (message) => !message.metadata?.tuneOut,
         });
         const agent = new Agent(config, contextManager, this.membrane);
-        this.restoreToolResultGuardSetting(agent);
+        this.adoptToolResultGuard(agent);
         agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
         this.sharedSlotAgents.add(agent);
         const restoredSettings = this.readAgentRuntimeSettings(config.name);
@@ -5431,7 +5917,7 @@ export class AgentFramework {
             allowedTools: [...SUBCONSCIOUS_TOOL_NAMES, 'think', 'skip_reply', 'end_turn'],
         };
         const agent = new Agent(agentConfig, contextManager, this.membrane);
-        this.restoreToolResultGuardSetting(agent);
+        this.adoptToolResultGuard(agent);
         agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
         this.sharedSlotAgents.add(agent); // reads the shared slot through its merged view
         this.agents.set(name, agent);
@@ -5496,6 +5982,10 @@ export class AgentFramework {
             const scriptWaiter = this.scriptToolWaiters.get(event.callId);
             if (scriptWaiter) {
                 this.scriptToolWaiters.delete(event.callId);
+                // RFC-007: the inner call's terminal. Also reached when the script
+                // was killed while the call ran: the result reaches no one, but the
+                // call did finish.
+                this.toolLifecycleEmitter?.onResult(event.agentName, event.callId, event.result);
                 scriptWaiter(event.result);
                 return;
             }
@@ -5522,6 +6012,38 @@ export class AgentFramework {
                     result: event.result,
                 });
             }
+            // The round's last pending result: let modules catch up with what the
+            // batch's tools did (the workspace scans `on-agent-action` mounts) before
+            // anything continues the turn. Bounded and fail-open; the agent may be
+            // reset or cancelled meanwhile, so its state is checked again after.
+            if (agent && agent.state.status === 'waiting_for_tools'
+                && agent.state.pending.size === 1 && agent.state.pending.has(event.callId)) {
+                // The call this result answers, as this round holds it: a new round
+                // that reuses the call's id holds a new entry for it.
+                const owed = agent.state.pending.get(event.callId);
+                const failures = await this.moduleRegistry.notifyToolBatchComplete(event.agentName);
+                for (const failure of failures) {
+                    this.emitTrace({ type: 'module:batch_hook_failed', agentName: event.agentName, module: failure.module, error: failure.error });
+                }
+                // The turn may have been reset, cancelled or replaced while the hook
+                // ran, even back to waiting on a new batch, whose calls may reuse this
+                // one's id: this result is still owed only if this agent still waits
+                // on this round's call.
+                const after = agent.state;
+                if (this.agents.get(event.agentName) !== agent
+                    || after.status !== 'waiting_for_tools' || after.pending.get(event.callId) !== owed) {
+                    console.warn(`[framework] Dropping tool-result for agent '${event.agentName}' (callId=${event.callId}): ` +
+                        `its turn changed while modules caught up with the batch (status '${after.status}').`);
+                    this.emitTrace({
+                        type: 'tool:result_dropped',
+                        agentName: event.agentName,
+                        callId: event.callId,
+                        agentStatus: agent.state.status,
+                        result: event.result,
+                    });
+                    return;
+                }
+            }
             if (agent && agent.state.status === 'waiting_for_tools') {
                 agent.provideToolResult(event.callId, event.result);
                 // Check if agent is now ready (state may have changed after provideToolResult)
@@ -5530,8 +6052,9 @@ export class AgentFramework {
                 if (currentState.status === 'ready') {
                     // Flush pending assistant blocks (tool_use + preamble text) to context
                     const pendingBlocks = this.pendingAssistantBlocks.get(agent.name);
+                    const turnRowMetadata = this.silentTurnRowMetadata(agent.name);
                     if (pendingBlocks) {
-                        agent.addAssistantResponse(pendingBlocks);
+                        agent.addAssistantResponse(pendingBlocks, turnRowMetadata);
                         this.pendingAssistantBlocks.delete(agent.name);
                     }
                     // Effective inline cap: agent_settings override → durable config →
@@ -5545,7 +6068,7 @@ export class AgentFramework {
                     // divergence breaks the compile prefix).
                     const { blocks: toolResultContent, spilled } = await this.buildStoredToolResultContent(agent.name, currentState.toolResults, maxChars);
                     const membraneResults = currentState.toolResults.map(tc => this.toMembraneToolResult(tc.id, tc.result, maxChars, spilled.get(tc.id)));
-                    agent.toolResultGuard.storeResults(toolResultContent, membraneResults, currentState.toolResults);
+                    agent.toolResultGuard.storeResults(toolResultContent, membraneResults, currentState.toolResults, turnRowMetadata);
                     // Flush any messages that were deferred while this turn was in
                     // flight. Route to the PRIMARY agent — deferred messages are
                     // framework-level (module messages, push events, subagent return
@@ -5730,7 +6253,7 @@ export class AgentFramework {
                         // agent must be wakeable the moment it goes idle. (Idempotent;
                         // driveStream's finally is the backstop.)
                         this.eventGate?.onInferenceEnded(agent.name);
-                        this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' });
+                        this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' }, this.turnRouting.get(agent.name)?.logical);
                         this.emitTrace({ type: 'inference:turn_ended', agentName: agent.name });
                     }
                     else if (overBudget || overPhysical) {
@@ -5772,6 +6295,7 @@ export class AgentFramework {
                             timestamp: Date.now(),
                             suppressProse: this.activeTurnTriggers.get(agent.name)?.suppressProse,
                             ephemeralSystemPrompt: this.activeTurnTriggers.get(agent.name)?.ephemeralSystemPrompt,
+                            silentHeartbeat: this.activeTurnTriggers.get(agent.name)?.silentHeartbeat,
                         });
                     }
                     else if (currentState.stream) {
@@ -5788,7 +6312,8 @@ export class AgentFramework {
                         });
                     }
                     else {
-                        // Non-streaming fallback: schedule re-inference
+                        // Non-streaming fallback: schedule re-inference, which continues
+                        // this stream's logical turn (openLogical).
                         this.pendingRequests.push({
                             agentName: agent.name,
                             reason: 'tool_results_ready',
@@ -5910,6 +6435,16 @@ export class AgentFramework {
      * This replaces the old MCPLModule.onProcess() message conversion.
      */
     async handleMcplChannelIncoming(event) {
+        // Same backstop as the push lane: no row, no wake, no fork spawned for a
+        // message with nothing visible in it.
+        if (isVisiblyEmptyContent(event.content)) {
+            console.error(`[channel-incoming-dropped] server=${event.serverId} channel=${event.channelId} messageId=${event.messageId} reason=empty-content`);
+            this.emitTrace({
+                type: 'mcpl:empty-content-dropped', lane: 'channel', serverId: event.serverId,
+                channelId: event.channelId, messageId: event.messageId, ...(event.eventId ? { eventId: event.eventId } : {}),
+            });
+            return undefined;
+        }
         const metadata = {
             ...event.metadata,
             ...(event.eventId ? { eventId: event.eventId } : {}),
@@ -6154,7 +6689,10 @@ export class AgentFramework {
             // seeding again would stack another template copy on top of it.
             const { messages: existing } = await contextManager.compile();
             if (existing.length === 0) {
-                const { messages: compiled } = await template.getContextManager().compile();
+                // The copy is the fork's own, and the template's annotation edits only
+                // the template's message: seed only once each of the template's
+                // annotations has finished.
+                const { messages: compiled } = await template.toolResultGuard.afterAnnotations(() => template.getContextManager().compile());
                 for (const msg of compiled) {
                     const participant = msg.participant === template.name ? name : msg.participant;
                     contextManager.addMessage(participant, msg.content);
@@ -6162,7 +6700,7 @@ export class AgentFramework {
             }
             const config = { ...templateConfig, name, strategy: undefined };
             const agent = new Agent(config, contextManager, this.membrane);
-            this.restoreToolResultGuardSetting(agent);
+            this.adoptToolResultGuard(agent);
             agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
             this.agents.set(name, agent);
             this.agentConfigs.set(name, config);
@@ -6198,6 +6736,9 @@ export class AgentFramework {
         const channelId = this.conversationAgentHomes.get(agentName);
         const agent = this.agents.get(agentName);
         this.agents.delete(agentName);
+        this.turnRouting.delete(agentName);
+        this.proseSpeechChains.delete(agentName);
+        this.openLogical.delete(agentName);
         this.toolImageLedgers.delete(agentName);
         this.agentConfigs.delete(agentName);
         this.conversationAgentHomes.delete(agentName);
@@ -6511,7 +7052,7 @@ export class AgentFramework {
             }
             if (typeof message.timestamp !== 'string')
                 throw new CoalesceError('timestamp', 'timestamp is required');
-            validateCoalescedContent(message.content);
+            validateCoalescedContent(message.content, undefined, { allowEmpty: message.coalesce.retract === true });
             const c = message.coalesce;
             const result = await this.pushCoalescer.accept({
                 serverId,
@@ -6540,7 +7081,11 @@ export class AgentFramework {
                 throw new CoalesceError('eventId', 'eventId is required');
             if (typeof params.timestamp !== 'string')
                 throw new CoalesceError('timestamp', 'timestamp is required');
-            validateCoalescedContent(params.payload?.content);
+            validateCoalescedContent(params.payload?.content, undefined, {
+                allowEmpty: params.coalesce.retract === true || isSilentHeartbeatMarker({
+                    serverId, featureSet: params.featureSet, origin: params.origin, content: params.payload?.content,
+                }),
+            });
             const c = params.coalesce;
             if (c.channelId)
                 this.assertChannelScopedPush(serverId, c.channelId);
@@ -6720,6 +7265,7 @@ export class AgentFramework {
                 counterparty: authorId ? `${occ.serverId}:user:${authorId}` : undefined,
                 addressed: isAddressedMessage(occ.tags, origin),
                 coalescingSubject: subject,
+                coalescingBatch: true,
             });
         }
     }
@@ -6848,6 +7394,16 @@ export class AgentFramework {
      * Convert an MCPL push event to a context message.
      */
     handleMcplPushEvent(event) {
+        // Backstop for the MCPL boundary's empty-content rejection, covering
+        // events that never crossed it (module-emitted, coalescer deliveries):
+        // content with nothing visible stores no row and queues no wake — the
+        // model would wake to `[Continue]` or an older message re-presented as
+        // the newest, a wake with no visible cause.
+        if (isVisiblyEmptyContent(event.content) && !isSilentHeartbeatMarker(event)) {
+            console.error(`[push-event-dropped] server=${event.serverId} eventId=${event.eventId} reason=empty-content`);
+            this.emitTrace({ type: 'mcpl:empty-content-dropped', lane: 'push', serverId: event.serverId, eventId: event.eventId });
+            return undefined;
+        }
         const triggerChannel = this.derivePushEventChannel(event.origin);
         if (triggerChannel && this.channelRegistry) {
             this.channelRegistry.ensureChannelRegistered(event.serverId, triggerChannel.channelId, triggerChannel.label, triggerChannel.metadata);
@@ -6893,11 +7449,7 @@ export class AgentFramework {
         // Accept the no-message path only for the heartbeat feature's own exact
         // marker with an empty payload — arbitrary MCPL servers cannot hide
         // content merely by setting `origin.silent`.
-        const silentHeartbeat = event.serverId === 'heartbeat' &&
-            event.featureSet === 'heartbeat' &&
-            event.origin?.source === 'heartbeat' &&
-            event.origin?.silent === true &&
-            content.length === 0;
+        const silentHeartbeat = isSilentHeartbeatMarker({ ...event, content });
         const placement = { agent: '' };
         if (!silentHeartbeat) {
             const id = this.addMessage('user', content, metadata, { placement, bypassDeferralFor: event.assemblingFor });
@@ -6925,6 +7477,7 @@ export class AgentFramework {
                         suppressProse: true,
                         ephemeralSystemPrompt: '[silent heartbeat] Scheduled private self-check. Review pending matters privately. ' +
                             'Do not narrate or publish plain prose; use an explicit send tool only if you deliberately choose to contact someone.',
+                        silentHeartbeat: { eventId: event.eventId, serverId: event.serverId },
                     } : {}),
                     ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
                 });
@@ -6932,6 +7485,22 @@ export class AgentFramework {
         }
         return placement.agent ? placement : undefined;
     }
+    /**
+     * Whether a batched gate wake's addressed route may become `agentName`'s
+     * speech locus. The gate broadcasts to every agent, conversation forks
+     * included. A fork speaks only in its home channel, and a channel bound to
+     * a fork is that fork's conversation, so no other agent takes it.
+     */
+    mayTakeGateRoute(agentName, routeChannelId) {
+        const home = this.conversationAgentHomes.get(agentName);
+        if (home !== undefined)
+            return home === routeChannelId;
+        for (const boundChannel of this.conversationAgentHomes.values()) {
+            if (boundChannel === routeChannelId)
+                return false;
+        }
+        return true;
+    }
     /**
      * Derive the MCPL composite channel id (the outbound routing locus) for a
      * push event from its server-defined `origin`, if it carries one.
@@ -7180,21 +7749,34 @@ export class AgentFramework {
             // and counterparty must come from the same message, or a batch of
             // "ambient from A, then addressed from B" would report B's channel
             // with A's author (review finding on the provenance change).
+            //
+            // "Most recent" is by the EVENT's time (wakeAt, else the request's own
+            // timestamp), not queue order. A gate wake is queued when its debounce
+            // flushes, which can be long after its event: an addressed message
+            // held in the gate while the agent was busy lands BEHIND a newer
+            // addressed message's direct wake, and queue order would hand the turn
+            // to the older one. Ties keep the later-queued request, as before.
+            const eventAt = (r) => r.wakeAt ?? r.timestamp;
             let ambientReq;
             let addressedReq;
             for (const r of requests) {
                 if (!r.channelId)
                     continue;
-                ambientReq = r;
-                if (r.addressed)
+                if (!ambientReq || eventAt(r) >= eventAt(ambientReq))
+                    ambientReq = r;
+                if (r.addressed && (!addressedReq || eventAt(r) >= eventAt(addressedReq)))
                     addressedReq = r;
             }
             const channelReq = addressedReq ?? ambientReq;
-            // Telemetry provenance (who/where woke the agent): from the routing
-            // winner when it carries one; else from the most recent request that
-            // does (gate wakes name a counterparty without setting a locus),
-            // ordered by the event's own time (wakeAt) rather than flush order.
-            let provReq = channelReq?.counterparty || channelReq?.wakeChannelId ? channelReq : undefined;
+            // Telemetry provenance (who/where woke the agent). An ADDRESSED winner
+            // is its own provenance, even when it names no author (a push event
+            // can route without an author id): borrowing another request's author
+            // would credit the turn to someone who did not address the agent.
+            // Otherwise from the routing winner when it carries one; else from the
+            // most recent request that does (ambient gate wakes name a counterparty
+            // without setting a locus), ordered by the event's own time.
+            let provReq = addressedReq
+                ?? (channelReq?.counterparty || channelReq?.wakeChannelId ? channelReq : undefined);
             if (!provReq) {
                 for (const r of requests) {
                     if (!r.counterparty && !r.wakeChannelId)
@@ -7206,10 +7788,19 @@ export class AgentFramework {
             // A silent tick never suppresses a genuine coalesced wake. If any
             // ordinary request shares this batch, the ordinary turn semantics win.
             const silentOnly = requests.every((r) => r.suppressProse === true);
+            // RFC-006 §5: when every cause is a deferred batch, the turn's content
+            // exists only once assembly renders it. Recorded for the whole batch
+            // (not inherited from requests[0]), so a requeued trigger stays honest.
+            const batchOnly = !budgetRestart && requests.every((r) => r.coalescingBatch === true && !!r.coalescingSubject);
             await this.startAgentStream(agent, {
                 ...trigger,
+                coalescingBatch: batchOnly || undefined,
+                coalescingBatchSubjects: batchOnly
+                    ? [...new Set(requests.flatMap((r) => r.coalescingBatchSubjects ?? [r.coalescingSubject]))]
+                    : undefined,
                 suppressProse: silentOnly ? trigger?.suppressProse : undefined,
                 ephemeralSystemPrompt: silentOnly ? trigger?.ephemeralSystemPrompt : undefined,
+                silentHeartbeat: silentOnly ? trigger?.silentHeartbeat : undefined,
                 channelId: channelReq?.channelId,
                 addressed: addressedReq !== undefined,
                 // A context-budget restart continues the same logical turn: it keeps
@@ -7222,22 +7813,33 @@ export class AgentFramework {
             });
         }
     }
-    /** Record prose segments suppressed by explicit-send silencing. */
-    recordProseSuppression(agentName, count) {
+    /**
+     * Metadata for rows the agent's current turn stores: a silent heartbeat
+     * tick stamps each of them (assistant responses, tool_result rows) so they
+     * stay identifiable after the turn — request builds key the tick separator
+     * on it, and a later retention policy can find or collapse them. The stamp
+     * names the agent: residents share one message slot and a broadcast tick
+     * reaches each of them with the same eventId. Undefined for ordinary
+     * turns, whose rows are stored exactly as before.
+     */
+    silentTurnRowMetadata(agentName) {
+        const tick = this.activeTurnTriggers.get(agentName)?.silentHeartbeat;
+        const stamp = tick
+            ? { eventId: tick.eventId, serverId: tick.serverId, agentName }
+            : undefined;
+        return stamp ? { silentHeartbeat: stamp } : undefined;
+    }
+    /** Record plain-prose segments this turn suppressed. */
+    recordProseSuppression(routing, count) {
         if (count <= 0)
             return;
-        this.turnProseSuppressed.set(agentName, (this.turnProseSuppressed.get(agentName) ?? 0) + count);
+        routing.logical.suppressed += count;
     }
     /** Record a successful plain-prose delivery for this turn's receipt. */
-    recordProseDelivery(agentName, outcome) {
+    recordProseDelivery(routing, outcome) {
         if (!outcome?.delivered)
             return;
-        let list = this.turnProseDeliveries.get(agentName);
-        if (!list) {
-            list = [];
-            this.turnProseDeliveries.set(agentName, list);
-        }
-        list.push(outcome.channelId);
+        routing.logical.deliveries.push(outcome.channelId);
     }
     /**
      * Append the turn's `[delivered]` receipt: one compact system message
@@ -7252,13 +7854,13 @@ export class AgentFramework {
      * delivered nothing. Failures are already marked separately
      * ([discord-send-failed]); this is the success half.
      */
-    appendProseDeliveryReceipt(agent) {
-        const list = this.turnProseDeliveries.get(agent.name);
-        const suppressed = this.turnProseSuppressed.get(agent.name) ?? 0;
-        if ((!list || list.length === 0) && suppressed === 0)
+    appendProseDeliveryReceipt(agent, routing) {
+        const list = routing.logical.deliveries;
+        const suppressed = routing.logical.suppressed;
+        if (list.length === 0 && suppressed === 0)
             return;
-        this.turnProseDeliveries.delete(agent.name);
-        this.turnProseSuppressed.delete(agent.name);
+        routing.logical.deliveries = [];
+        routing.logical.suppressed = 0;
         const seen = new Set();
         const shown = [];
         for (const id of list ?? []) {
@@ -7367,6 +7969,46 @@ export class AgentFramework {
             console.error('recordChannelAutoOpenNotice failed:', err);
         }
     }
+    /**
+     * A `!` continuation the turn asked for (`>>#x !`, `>>>#x !`): start another
+     * turn now instead of pausing until the next external event. It reads the
+     * logical turn of the stream that asked (shared with a retry or a
+     * re-inference that continues it), once its deliveries have run, when the
+     * turn completes or a tool ends it. A stream that ends in an error asks for
+     * none itself, but a framework retry that follows it carries the request;
+     * a turn abandoned by a quiesce asks for none.
+     */
+    requestProseContinuation(agent, routing) {
+        // The flag may be shared with an earlier stream of the same logical
+        // turn (LogicalTurn); its deliveries are on the agent's chain ahead of
+        // this stream's, so by the time this check runs, they have run.
+        if (!routing.logical.continuation)
+            return;
+        routing.logical.continuation = false;
+        // An explicit turn's check can run after its stream has returned. A
+        // stopped framework, or an agent no longer registered under its name (a
+        // disposed fork or ephemeral run), takes no new turn from it.
+        if (this.providerAdmissionClosed || this.agents.get(agent.name) !== agent) {
+            console.error(`[prose] ${agent.name}: '!' continuation dropped — ${this.providerAdmissionClosed ? 'the framework is stopping' : 'the agent is no longer registered'}`);
+            return;
+        }
+        console.error(`[prose] ${agent.name}: '!' continuation — requesting immediate next turn`);
+        this.pendingRequests.push({
+            agentName: agent.name,
+            reason: 'prose-continuation',
+            source: 'framework',
+            timestamp: Date.now(),
+        });
+    }
+    /** The agent's routing state for its current turn, made when it has none. */
+    routingOf(agentName) {
+        let routing = this.turnRouting.get(agentName);
+        if (!routing) {
+            routing = freshTurnRouting();
+            this.turnRouting.set(agentName, routing);
+        }
+        return routing;
+    }
     /**
      * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md).
      * Every prose segment of an `explicit`-mode agent flows through here:
@@ -7375,36 +8017,58 @@ export class AgentFramework {
      * nothing is ever sent to a destination the model did not name (directly
      * or via the turn's sticky target).
      */
-    async deliverProse(agent, rawText) {
-        // Multi-envelope: a single prose block may address SEVERAL destinations —
-        // every line beginning with `>>` opens a new envelope, routed
-        // independently (first live use: Tilde 2026-07-24, one block carrying a
-        // letter to #tilde-mythos AND a `>>#tilde` aside; the single-envelope
-        // parser delivered the aside literally into the first destination —
-        // exactly the leak class this mode exists to kill). Text before the
-        // first `>>` is its own unprefixed envelope (sticky/bounce as usual).
-        const lines = rawText.split('\n');
-        const envelopes = [];
-        let current = [];
-        for (const line of lines) {
-            // Only a REAL prefix line opens an envelope: `>>` immediately followed
-            // by a target token. A quoted `>> arrow` (space after) stays body text.
-            if (/^>>\S/.test(line.trimStart()) && current.length > 0) {
-                envelopes.push(current.join('\n'));
-                current = [];
+    async deliverProse(agent, rawText, round) {
+        // The direct entry delivers under the live turn's routing.
+        await this.deliverAdmittedProse(agent, this.admitProse(rawText), {
+            keepPrivate: round?.keepPrivate,
+            routing: this.routingOf(agent.name),
+        });
+    }
+    /**
+     * Explicit prose's envelopes, each `>>` target resolved now, once. A live
+     * round is admitted at its boundary: its turn's destination is decided from
+     * these resolutions (roundDestination), and its queued delivery posts to
+     * them, however the registry's names change before it runs.
+     */
+    admitProse(rawText) {
+        return splitExplicitEnvelopes(rawText).map((text) => {
+            const parsed = parseProsePrefix(text);
+            if (parsed.kind !== 'target')
+                return { text };
+            try {
+                return { text, resolved: this.channelRegistry.resolveProseTarget(parsed.target) };
             }
-            current.push(line);
+            catch (err) {
+                // Admission runs in the stream's event loop, so a resolver that
+                // throws makes the envelope bounce rather than stop the round.
+                return { text, resolved: { error: `the destination couldn't be resolved: ${err instanceof Error ? err.message : String(err)}` } };
+            }
+        });
+    }
+    async deliverAdmittedProse(agent, envelopes, round) {
+        // Multi-envelope: a single prose block may address SEVERAL destinations,
+        // each envelope routed independently (sticky/bounce as usual).
+        for (const envelope of envelopes) {
+            await this.deliverProseEnvelope(agent, envelope, round);
         }
-        if (current.length > 0)
-            envelopes.push(current.join('\n'));
+    }
+    /**
+     * Where a delivered round leaves its turn's sticky destination, as the
+     * explicit gateway sets it once the round's envelopes run: each `>>`
+     * envelope whose target resolved becomes the destination. One that didn't
+     * resolve bounces and leaves it, as do `>>skip_reply` and unprefixed text.
+     */
+    roundDestination(current, envelopes) {
+        let destination = current;
         for (const envelope of envelopes) {
-            if (!envelope.trim())
-                continue;
-            await this.deliverProseEnvelope(agent, envelope.replace(/^\s+(?=>>)/, ''));
+            if (envelope.resolved && 'channelId' in envelope.resolved)
+                destination = envelope.resolved.channelId;
         }
+        return destination;
     }
     /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
-    async deliverHybridProse(agent, rawText, locus, allowLocus) {
+    async deliverHybridProse(agent, rawText, locus, allowLocus, turnRouting) {
+        const routing = turnRouting;
         const lines = rawText.split('\n');
         const envelopes = [];
         let current = [];
@@ -7424,18 +8088,18 @@ export class AgentFramework {
             const attempted = normalized.startsWith('>>>');
             const parsed = parseHybridProsePrefix(normalized);
             if (parsed.continueTurn)
-                this.proseContinuations.add(agent.name);
+                routing.logical.continuation = true;
             if (parsed.kind === 'private') {
-                this.proseTargetPins.delete(agent.name);
-                this.proseHybridSuppressed.add(agent.name);
+                delete routing.pin;
+                routing.hybridHold = true;
                 console.error(`[prose] ${agent.name}: >>>skip_reply — ${parsed.body.length} chars kept in context (not sent)`);
                 continue;
             }
             if (parsed.kind === 'target') {
                 const resolved = this.channelRegistry.resolveProseTarget(parsed.target);
                 if ('error' in resolved) {
-                    this.proseTargetPins.delete(agent.name);
-                    this.proseHybridSuppressed.add(agent.name);
+                    delete routing.pin;
+                    routing.hybridHold = true;
                     this.bounceProse(agent, parsed.body, resolved.error, resolved.candidates, '>>>');
                     continue;
                 }
@@ -7443,63 +8107,67 @@ export class AgentFramework {
                 const usedClipboard = body.includes('{{unsent}}');
                 if (usedClipboard)
                     body = body.replaceAll('{{unsent}}', this.proseClipboards.get(agent.name) ?? '');
-                this.proseTargetPins.set(agent.name, resolved.channelId);
-                this.proseHybridSuppressed.delete(agent.name);
+                routing.pin = resolved.channelId;
+                routing.hybridHold = false;
                 if (!body.trim()) {
                     console.error(`[prose] ${agent.name}: >>>${parsed.target} established target; empty body — nothing sent yet`);
                     continue;
                 }
                 try {
                     const outcome = await this.channelRegistry.routeSpeech(agent.name, body, resolved.channelId);
-                    this.recordProseDelivery(agent.name, outcome);
+                    this.recordProseDelivery(routing, outcome);
                     if (outcome?.delivered) {
                         this.proseBounceStreaks.delete(agent.name);
                         if (usedClipboard)
                             this.proseClipboards.delete(agent.name);
                     }
                     else {
-                        this.proseTargetPins.delete(agent.name);
-                        this.proseHybridSuppressed.add(agent.name);
+                        delete routing.pin;
+                        routing.hybridHold = true;
                         this.bounceProse(agent, parsed.body, `delivery to ${resolved.channelId} was not confirmed`, undefined, '>>>');
                     }
                 }
                 catch (err) {
-                    this.proseTargetPins.delete(agent.name);
-                    this.proseHybridSuppressed.add(agent.name);
+                    delete routing.pin;
+                    routing.hybridHold = true;
                     this.bounceProse(agent, parsed.body, `delivery to ${resolved.channelId} failed: ${err instanceof Error ? err.message : String(err)}`, undefined, '>>>');
                 }
                 continue;
             }
             if (attempted) {
-                this.proseTargetPins.delete(agent.name);
-                this.proseHybridSuppressed.add(agent.name);
+                delete routing.pin;
+                routing.hybridHold = true;
                 this.bounceProse(agent, normalized, 'malformed >>> routing envelope: destination is missing', undefined, '>>>');
                 continue;
             }
-            if (this.proseHybridSuppressed.has(agent.name)) {
-                this.recordProseSuppression(agent.name, 1);
+            if (routing.hybridHold) {
+                this.recordProseSuppression(routing, 1);
                 continue;
             }
-            const sticky = this.proseTargetPins.get(agent.name);
+            const sticky = routing.pin;
             if (!allowLocus && !sticky) {
-                this.recordProseSuppression(agent.name, 1);
+                this.recordProseSuppression(routing, 1);
                 continue;
             }
             const target = sticky ?? locus;
             try {
                 const outcome = await this.channelRegistry.routeSpeech(agent.name, envelope, target);
-                this.recordProseDelivery(agent.name, outcome);
+                this.recordProseDelivery(routing, outcome);
             }
             catch (err) {
                 console.error('hybrid locus delivery failed:', err);
             }
         }
     }
-    async deliverProseEnvelope(agent, rawText) {
+    async deliverProseEnvelope(agent, envelope, round) {
         const name = agent.name;
+        const routing = round.routing;
+        const rawText = envelope.text;
         const parsed = parseProsePrefix(rawText);
-        if (parsed.continueTurn)
-            this.proseContinuations.add(name);
+        // A private round (one that called skip_reply) asks for no publication
+        // or continuation, even when delivery runs after that turn has ended.
+        if (parsed.continueTurn && !round.keepPrivate)
+            routing.logical.continuation = true;
         if (parsed.kind === 'private') {
             // The text already lives in the assistant message (window/chronicle);
             // "delivery" is deliberately a no-op. Consumes the retained text if the
@@ -7509,21 +8177,34 @@ export class AgentFramework {
             console.error(`[prose] ${name}: >>skip_reply — ${parsed.body.length} chars kept in context (not sent)`);
             return;
         }
+        if (round.keepPrivate) {
+            // skip_reply's promise: "Any plain text you wrote this turn stays
+            // private and is NOT posted". Every envelope of the round stays in the
+            // context, as a >>skip_reply envelope does: it isn't sent, doesn't
+            // bounce to the clipboard and doesn't move the destination.
+            console.error(`[prose] ${name}: ${parsed.kind === 'target' ? `>>${parsed.target}` : 'unprefixed'} — ` +
+                `${parsed.body.length} chars kept in context (skip_reply round)`);
+            return;
+        }
         let targetChannel;
         let body;
         if (parsed.kind === 'target') {
-            const res = this.channelRegistry.resolveProseTarget(parsed.target);
+            // Resolved once, when the round was admitted (admitProse), never again
+            // here after the wait: a `>>` envelope without its resolution is a bug.
+            const res = envelope.resolved;
+            if (!res)
+                throw new Error(`[prose] ${name}: a >> envelope reached delivery without the target admitted with it`);
             if ('error' in res) {
                 this.bounceProse(agent, parsed.body, res.error, res.candidates);
                 return;
             }
             targetChannel = res.channelId;
             // Sticky within the turn: later unprefixed segments follow this target.
-            this.proseTargetPins.set(name, targetChannel);
+            routing.pin = targetChannel;
             body = parsed.body;
         }
         else {
-            const sticky = this.proseTargetPins.get(name);
+            const sticky = routing.pin;
             if (!sticky) {
                 this.bounceProse(agent, rawText, 'no destination prefix and no destination set yet this turn');
                 return;
@@ -7737,8 +8418,8 @@ export class AgentFramework {
      * driveStream (whose finally then owns clearing it).
      */
     async beginAgentTurn(agent, trigger, attempt, turnToken, ownsProviderGate) {
-        const continuingTurn = trigger?.reason === 'context_budget_restart'
-            || trigger?.reason === 'tool_result_guard_retry';
+        const lifecycle = this.lifecycleGeneration;
+        const continuingTurn = resumesLogicalTurn(trigger?.reason);
         const turnProseRouting = trigger?.suppressProse ? 'disabled' : agent.proseRouting;
         // Flush messages deferred during the PREVIOUS turn — before the
         // checkpoint, the locus announcement, and the compile — so a turn started
@@ -7779,14 +8460,47 @@ export class AgentFramework {
         // boundary — after the deferred flush (same window: turn alive, compile
         // not yet run) and before the checkpoint (they are the turn's inputs).
         // Not on a context-budget restart: that continues the same logical turn.
+        let assembly;
         if (attempt === 0 && !continuingTurn && this.pushCoalescer?.pendingBatches()) {
             try {
-                await this.pushCoalescer.assemble(agent.name);
+                assembly = await this.pushCoalescer.assemble(agent.name);
             }
             catch (err) {
                 console.error(`[coalescing] assembly for ${agent.name} failed:`, err);
             }
         }
+        // A turn whose only causes were deferred batches, all of which rendered
+        // nothing (empty or blank render, §5.2; cancelled; revoked), has nothing
+        // new to show: running it would wake the model to `[Continue]` or an
+        // older message, an uncaused wake. Stop before the checkpoint, locus,
+        // typing and compile. Any batch this assembly materialized keeps the
+        // turn, including one that was not among its causes (a batch whose wake
+        // the freeze withdrew, or one that never qualified for a wake). A cause
+        // this assembly did not settle (rendered elsewhere, not yet frozen) keeps
+        // the turn, as before.
+        const batchSubjects = trigger?.coalescingBatchSubjects;
+        if (assembly && batchSubjects?.length && assembly.materialized.size === 0
+            && batchSubjects.every((s) => assembly.settled.has(s))) {
+            console.error(`[coalescing] ${agent.name}: deferred render produced nothing; turn not started (no wake cause left)`);
+            this.emitTrace({ type: 'mcpl:coalescing', kind: 'turn-withdrawn', agentName: agent.name, subjects: batchSubjects });
+            // Release the turn and land anything deferred while assembly awaited
+            // the render, as a torn-down turn would.
+            if (this.activeTurnTokens.get(agent.name) === turnToken) {
+                this.activeTurnTokens.delete(agent.name);
+                this.activeTurnTriggers.delete(agent.name);
+            }
+            if (!this.activeTurnTokens.has(agent.name)
+                && this.deferredMessages.length > 0 && this.pendingAssistantBlocks.size === 0) {
+                for (const msg of this.drainDeferredFor(agent.name)) {
+                    this.addMessage(msg.participant, msg.content, msg.metadata, {
+                        deferredWriteId: msg.id,
+                        ...(msg.forAgent ? { forAgent: msg.forAgent } : {}),
+                    });
+                }
+                this.ackDeferredWrites();
+            }
+            return false;
+        }
         // Record turn checkpoint before inference (only on first attempt, not retries)
         if (attempt === 0 && trigger?.reason !== 'tool_result_guard_retry') {
             this.recordTurnCheckpoint(agent.name);
@@ -7841,21 +8555,32 @@ export class AgentFramework {
                 // A framework retry is a new physical stream in the same logical turn.
                 this.logicalTurnToolCalls.set(agent, { turnToken, count: previousLogicalToolState?.count ?? 0 });
             }
-            // Fresh turn: forget the previous turn's explicit-send engagements and
-            // prose deliveries — both are strictly turn-scoped (a restart continues
-            // the same logical turn and keeps them).
+            // Fresh turn: forget the previous turn's explicit-send engagements.
+            // A restart continues the same logical turn and keeps them.
             this.turnEngagedChannels.delete(agent.name);
-            this.turnProseDeliveries.delete(agent.name);
-            this.turnProseSuppressed.delete(agent.name);
-            this.proseHybridSuppressed.delete(agent.name);
-            if (turnProseRouting === 'hybrid')
-                this.proseTargetPins.delete(agent.name);
+            // A new routing state for the new turn, in every mode: the sticky
+            // destination, the turn's destination, hybrid's hold and the receipt
+            // tallies start empty. The previous turn's object isn't cleared: prose
+            // it left queued still reads and writes its own.
+            const fresh = freshTurnRouting();
+            // A start while the agent's logical turn is open continues it: it
+            // shares the earlier stream's ` !` and receipt tallies, which a
+            // delivery still queued there can write after this stream begins
+            // (openLogical). Otherwise this start opens one. A silent start does
+            // neither: it routes no prose, so it keeps a logical turn of its own,
+            // and an open turn waits for the next start that routes prose.
+            if (!trigger?.suppressProse) {
+                const open = this.openLogical.get(agent.name);
+                if (open)
+                    fresh.logical = open;
+                else
+                    this.openLogical.set(agent.name, fresh.logical);
+            }
+            this.turnRouting.set(agent.name, fresh);
             if (turnProseRouting === 'explicit' || turnProseRouting === 'disabled') {
                 // Explicit and disabled prose routing have no inferred locus.
                 // Explicit mode uses a turn-scoped `>>` target; disabled mode has no
                 // prose target at all. Neither mode freezes or announces a locus.
-                this.proseTargetPins.delete(agent.name);
-                this.proseContinuations.delete(agent.name);
                 this.midTurnInputSignals.delete(agent.name);
                 this.turnLocusPins.delete(agent.name);
             }
@@ -7875,9 +8600,17 @@ export class AgentFramework {
         // opened/pinned a channel mid-turn.
         if (trigger?.suppressProse) {
             this.turnLocusPins.delete(agent.name);
-            this.proseTargetPins.delete(agent.name);
-            this.proseContinuations.delete(agent.name);
-        }
+            // Silent: no routing state. A continuing silent start keeps its turn's
+            // logical turn; a fresh one keeps the one of its own it was given.
+            const silent = freshTurnRouting();
+            const logical = this.turnRouting.get(agent.name)?.logical;
+            if (logical)
+                silent.logical = logical;
+            this.turnRouting.set(agent.name, silent);
+        }
+        // This start's own logical turn: a failure before its stream exists
+        // settles it, and no other start's.
+        const startLogical = this.turnRouting.get(agent.name)?.logical;
         this.touchEphemeralRun(agent.name, true);
         this.emitTrace({
             type: 'inference:started',
@@ -7909,7 +8642,11 @@ export class AgentFramework {
             this.channelRegistry?.startTyping(earlyTypingChannel);
         try {
             const requestSnapshot = this.captureInferenceToolSnapshot(agent);
-            const tools = this.agentToolSurface(agent, requestSnapshot);
+            // Capture both surfaces together before context hooks can refresh tools.
+            const presentation = this.inspectToolPresentation(agent.name, requestSnapshot);
+            const compressionTools = presentation?.available
+                ?? structuredClone(this.availableToolsForPresentation(agent.name, requestSnapshot));
+            const tools = presentation?.advertised ?? compressionTools;
             // Gather context from modules (pull-based) and MCPL hooks (push-based)
             // Both produce ContextInjection[] that get merged before inference.
             let injections;
@@ -7948,9 +8685,10 @@ export class AgentFramework {
                 };
                 injections = injections ? [...injections, silentInjection] : [silentInjection];
             }
-            // An ephemeral watchdog may dispose this Agent while hooks/compile await.
-            // Do not create a provider stream after its generation lost ownership.
-            if (this.agents.get(agent.name) !== agent) {
+            // An ephemeral watchdog may dispose this Agent while hooks/compile await,
+            // and stop() may close provider admission. Do not create a provider
+            // stream after its generation lost ownership, or once admission closed.
+            if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed) {
                 this.channelRegistry?.stopTyping();
                 this.eventGate?.onInferenceEnded(agent.name);
                 return false;
@@ -7965,10 +8703,27 @@ export class AgentFramework {
                     injections = injections ? [...injections, dispositionInjection] : [dispositionInjection];
                 }
             }
-            const { stream, request: compiledRequest, takeKvSubmission, drainKvSubmissionIds, } = await agent.startStreamWithInjections(tools, injections);
-            if (this.agents.get(agent.name) !== agent) {
+            const { stream, request: compiledRequest, takeKvSubmission, drainKvSubmissionIds, } = await agent.startStreamWithInjections(tools, injections, undefined, compressionTools, {
+                silentHeartbeat: trigger?.silentHeartbeat,
+            });
+            // The compile can wait for annotations (each batch has one spill
+            // deadline), so check ownership, admission, and the lifecycle again.
+            // A stop followed by start must not revive this earlier turn.
+            // Membrane's yielding stream starts its request when it is first
+            // iterated, so cancelling it here, before driveStream, sends nothing.
+            if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed || lifecycle !== this.lifecycleGeneration) {
+                console.error(`[turn] ${agent.name}: a turn compiled while ${this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
+                    : this.providerAdmissionClosed ? 'the framework was stopping'
+                        : 'the framework was stopped and started again'} is dropped before it sends anything`);
                 stream.cancel();
                 agent.cancelStream();
+                if (this.agents.get(agent.name) === agent) {
+                    // The compile took the agent's stream id, so a frame that started
+                    // this one (a guard or budget restart) no longer owns the entries
+                    // it left, and its teardown leaves them to this frame.
+                    this.activeStreams.delete(agent.name);
+                    this.pendingAssistantBlocks.delete(agent.name);
+                }
                 this.channelRegistry?.stopTyping();
                 this.eventGate?.onInferenceEnded(agent.name);
                 return false;
@@ -8019,7 +8774,7 @@ export class AgentFramework {
                     stopReason: 'exhausted',
                     speech: '',
                     error: err.message,
-                });
+                }, startLogical);
                 this.emitTrace({
                     type: 'inference:exhausted',
                     agentName: agent.name,
@@ -8071,6 +8826,9 @@ export class AgentFramework {
         // from the map here: the turn-alive busy check in processInferenceRequests
         // means no successor turn can have replaced it while we compiled.
         const myTurnToken = this.activeTurnTokens.get(agent.name);
+        // The turn-alive guard also keeps this turn's routing current at entry.
+        // Retain it for queued deliveries and receipts after a tool ends the turn.
+        const streamRouting = this.routingOf(agent.name);
         let hadToolCalls = false;
         let generationLost = false;
         // ---- Present-while-acting turn state ---------------------------------
@@ -8089,14 +8847,27 @@ export class AgentFramework {
         // awaits the chain before routing trailing prose, so in-channel ordering
         // is preserved end-to-end. Each link catches its own error: one failed
         // post must not silence the rest of the turn.
-        let turnSpeechChain = Promise.resolve();
+        //
+        // Every stream queues its deliveries behind the agent's latest link, so
+        // the agent's posts go out in the order they were written, across a
+        // turn's streams (a budget restart, a tool-result-guard retry) and across
+        // turns. A turn that a tool ends (skip_reply) settles before its queued
+        // prose has posted; that prose keeps its own turn's routing state
+        // (turnRouting), and the next turn's posts wait behind it.
+        const resumesTurn = resumesLogicalTurn(trigger?.reason);
+        let turnSpeechChain = this.proseSpeechChains.get(agent.name) ?? Promise.resolve();
+        this.proseSpeechChains.set(agent.name, turnSpeechChain);
+        const chainSpeech = (link, failure) => {
+            turnSpeechChain = turnSpeechChain.then(link).catch((err) => console.error(failure, err));
+            // A stream another has replaced doesn't move the turn's latest link.
+            if (agent.streamId === myStreamId)
+                this.proseSpeechChains.set(agent.name, turnSpeechChain);
+        };
         const enqueueSpeech = (text, locus) => {
-            turnSpeechChain = turnSpeechChain
-                .then(async () => {
+            chainSpeech(async () => {
                 const outcome = await this.channelRegistry.routeSpeech(agent.name, text, locus);
-                this.recordProseDelivery(agent.name, outcome);
-            })
-                .catch((err) => console.error('mid-turn speech routing failed:', err));
+                this.recordProseDelivery(streamRouting, outcome);
+            }, 'mid-turn speech routing failed:');
         };
         // Sticky explicit-send suppression: prose after send_message stays quiet
         // to prevent a redundant "sent it" postscript. Fresh injected input
@@ -8169,7 +8940,16 @@ export class AgentFramework {
             !agent.toolWrapperProseGuard
             ? new ProseStreamRouter({
                 mode: turnProseRouting === 'explicit' ? 'explicit' : turnProseRouting === 'hybrid' ? 'hybrid' : 'locus',
-                initialTarget: typingChannel,
+                // Explicit text has no destination until a `>>` prefix names one,
+                // so a fresh turn's stream starts suppressed. One that resumes the
+                // turn (a tool-result-guard retry, a budget restart) starts at the
+                // destination the turn's delivered rounds have set: a private
+                // round's prefixes don't count, and the gateway's queued
+                // deliveries needn't have run. The trigger channel is only where
+                // explicit mode's typing indicator shows.
+                initialTarget: turnProseRouting === 'explicit'
+                    ? (resumesTurn ? streamRouting.destination : null)
+                    : typingChannel,
                 resolve: (spec) => {
                     const r = this.channelRegistry.resolveProseTarget(spec);
                     return 'channelId' in r ? r.channelId : null;
@@ -8188,6 +8968,8 @@ export class AgentFramework {
         // other trace consumers voice it). Hold both; release in order on a clean
         // round (tool-calls / non-guard completion), discard on a guard refusal.
         let guardHeld = [];
+        // The text block the stream's last text came from, within this round.
+        let lastTextBlock;
         const releaseGuardHeld = () => {
             const held = guardHeld;
             guardHeld = [];
@@ -8231,7 +9013,18 @@ export class AgentFramework {
                             // turn's prose is bound for, without re-deriving routing.
                             channelId: typingChannel ?? undefined,
                         };
-                        const text = event.meta.type === 'text' ? event.content : undefined;
+                        // Delivery joins a round's text blocks with a newline
+                        // (splitProseSegments), so a later block starts a new line for
+                        // the stream too.
+                        let text = event.meta.type === 'text' ? event.content : undefined;
+                        if (text !== undefined) {
+                            const block = event.meta.blockIndex;
+                            if (block !== undefined) {
+                                if (lastTextBlock !== undefined && block !== lastTextBlock)
+                                    text = '\n' + text;
+                                lastTextBlock = block;
+                            }
+                        }
                         if (agent.toolResultGuard.hasSubmittedPending || agent.toolResultGuard.recovering) {
                             guardHeld.push({ trace, text });
                         }
@@ -8263,6 +9056,12 @@ export class AgentFramework {
                         outgoingIndex = 0;
                         discardGuardHeld();
                         proseStream?.reset();
+                        lastTextBlock = undefined;
+                        // Explicit mode's retried attempt starts where the turn's
+                        // delivered rounds have set the destination, not at the stream's
+                        // seed: rounds this stream delivered before the refusal stand.
+                        if (turnProseRouting === 'explicit')
+                            proseStream?.retarget(streamRouting.destination);
                         this.emitTrace({
                             type: 'inference:tokens',
                             agentName: agent.name,
@@ -8290,6 +9089,11 @@ export class AgentFramework {
                         // preceding results before storing/dispatching this new round.
                         agent.toolResultGuard.accept();
                         releaseGuardHeld();
+                        // The round's text ends here: delivery parses each round's text
+                        // on its own, so the next round's text starts a new line.
+                        if (proseStream)
+                            emitOutgoing(proseStream.endSegment());
+                        lastTextBlock = undefined;
                         adoptInjectedRound();
                         hadToolCalls = true;
                         this.recordLogicalTurnToolCalls(agent, myTurnToken ?? -1, event.calls.length);
@@ -8388,39 +9192,58 @@ export class AgentFramework {
                                 if (roundSegments.length > 0) {
                                     if (turnProseRouting === 'disabled') {
                                         console.error(`[routing] ${agent.name}: mid-turn prose NOT routed (proseRouting=disabled)`);
-                                        this.recordProseSuppression(agent.name, roundSegments.length);
+                                        this.recordProseSuppression(streamRouting, roundSegments.length);
                                     }
                                     else if (turnProseRouting === 'hybrid') {
                                         if (turnSilenced) {
-                                            this.recordProseSuppression(agent.name, roundSegments.length);
+                                            this.recordProseSuppression(streamRouting, roundSegments.length);
                                         }
                                         else if (!hasSameRoundPrivateThink) {
                                             const locus = resolveTurnLocus();
+                                            // Queued under this turn's routing, whenever it posts.
+                                            const routing = streamRouting;
                                             for (const seg of roundSegments) {
-                                                turnSpeechChain = turnSpeechChain
-                                                    .then(() => this.deliverHybridProse(agent, seg, locus, true))
-                                                    .catch((err) => console.error('mid-turn hybrid prose delivery failed:', err));
+                                                chainSpeech(() => this.deliverHybridProse(agent, seg, locus, true, routing), 'mid-turn hybrid prose delivery failed:');
                                             }
                                         }
                                     }
                                     else if (turnProseRouting === 'explicit') {
-                                        // Explicit mode: every segment through the prose gateway.
-                                        // Silencing does not apply — unprefixed prose bounces and
-                                        // prefixed prose is deliberate; think-privacy still holds.
+                                        // Explicit mode: the segments go through the prose
+                                        // gateway, unless a private think in the round holds them
+                                        // back. Send silencing does not apply: unprefixed prose
+                                        // bounces, and prefixed prose is deliberate. skip_reply
+                                        // does: its round's envelopes all stay in the context
+                                        // (deliverProseEnvelope's keepPrivate), as the tool
+                                        // promises, and skip_reply then ends the turn at this
+                                        // round's tool results.
                                         if (!hasSameRoundPrivateThink) {
-                                            console.error(`[prose] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> ${roundSegments.length} segment(s) via prose gateway`);
-                                            for (const seg of roundSegments) {
-                                                turnSpeechChain = turnSpeechChain
-                                                    .then(() => this.deliverProse(agent, seg))
-                                                    .catch((err) => console.error('mid-turn prose delivery failed:', err));
+                                            const keepPrivate = roundToolNames.some((n) => bareToolName(n) === 'skip_reply');
+                                            // The round is admitted now: its targets are resolved
+                                            // once, for the turn's destination and for its queued
+                                            // delivery alike.
+                                            const admitted = roundSegments.map((seg) => this.admitProse(seg));
+                                            // Queued under this turn's routing, whenever it posts.
+                                            const routing = streamRouting;
+                                            if (!keepPrivate) {
+                                                routing.destination = this.roundDestination(routing.destination, admitted.flat());
+                                            }
+                                            console.error(`[prose] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> ${roundSegments.length} segment(s) via prose gateway${keepPrivate ? ', kept private (skip_reply)' : ''}`);
+                                            for (const envelopes of admitted) {
+                                                chainSpeech(() => this.deliverAdmittedProse(agent, envelopes, { keepPrivate, routing }), 'mid-turn prose delivery failed:');
                                             }
                                         }
+                                        // The stream's next round starts where delivery sends
+                                        // unprefixed text: the turn's destination. The stream
+                                        // followed this round's prefixes as it was written, but a
+                                        // private round's, a >>skip_reply envelope's or a target
+                                        // that didn't resolve leave the destination as it was.
+                                        proseStream?.retarget(streamRouting.destination);
                                     }
                                     else if (turnSilenced) {
                                         console.error(`[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (turn silenced)`);
                                         // Visible in the turn-end receipt — silencing must never
                                         // be a silent black hole (n=8: the flying-scene reply).
-                                        this.recordProseSuppression(agent.name, roundSegments.length);
+                                        this.recordProseSuppression(streamRouting, roundSegments.length);
                                     }
                                     else if (hasSameRoundPrivateThink) {
                                         console.error(`[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (same_round_think_text_policy=private)`);
@@ -8458,6 +9281,8 @@ export class AgentFramework {
                             // persisted as assistant speech, including a terminal refusal
                             // after the single recovery retry.
                             proseStream?.reset();
+                            if (turnProseRouting === 'explicit')
+                                proseStream?.retarget(streamRouting.destination);
                             if (withheld) {
                                 const usage = response.details?.usage ?? response.usage;
                                 const tokenUsage = usage ? {
@@ -8539,7 +9364,7 @@ export class AgentFramework {
                             // Flush pending assistant blocks
                             const pending = this.pendingAssistantBlocks.get(agent.name);
                             if (pending) {
-                                agent.addAssistantResponse(pending);
+                                agent.addAssistantResponse(pending, this.silentTurnRowMetadata(agent.name));
                                 this.pendingAssistantBlocks.delete(agent.name);
                             }
                             // Store tool results — same bounded spill policy as the
@@ -8549,7 +9374,7 @@ export class AgentFramework {
                             if (readyState.status === 'ready') {
                                 const cap = this.resolveToolResultInlineCap(agent).cap;
                                 const { blocks: toolResultContent, spilled } = await this.buildStoredToolResultContent(agent.name, readyState.toolResults, cap);
-                                agent.toolResultGuard.storeResults(toolResultContent, readyState.toolResults.map((tc) => this.toMembraneToolResult(tc.id, tc.result, cap, spilled.get(tc.id))), readyState.toolResults);
+                                agent.toolResultGuard.storeResults(toolResultContent, readyState.toolResults.map((tc) => this.toMembraneToolResult(tc.id, tc.result, cap, spilled.get(tc.id))), readyState.toolResults, this.silentTurnRowMetadata(agent.name));
                                 // The response is already complete: this batch is never
                                 // submitted in this turn, so it cannot be refused. Admit it.
                                 agent.toolResultGuard.settleTurnEnded();
@@ -8585,16 +9410,17 @@ export class AgentFramework {
                                 system: true,
                                 kind: 'tool-wrapper-prose-contained',
                                 toolName: guardedWrapperTool,
+                                ...this.silentTurnRowMetadata(agent.name),
                             });
                             console.error(`[tool-boundary] ${agent.name}: contained whole-response prose wrapper for registered tool ${guardedWrapperTool}; no tool called`);
                         }
                         else if (lastToolIdx >= 0) {
                             if (terminalContent.length > 0) {
-                                agent.addAssistantResponse(terminalContent);
+                                agent.addAssistantResponse(terminalContent, this.silentTurnRowMetadata(agent.name));
                             }
                         }
                         else {
-                            agent.addAssistantResponse(terminalContent);
+                            agent.addAssistantResponse(terminalContent, this.silentTurnRowMetadata(agent.name));
                         }
                         // Bind the cooldown receipt to this fresh, successful request —
                         // never to the frozen request that received the 429.
@@ -8616,6 +9442,19 @@ export class AgentFramework {
                             : response.content.filter(isTextBlock);
                         const speechContent = hadToolCalls ? [] : allText;
                         const thoughts = hadToolCalls ? allText : [];
+                        // Explicit text is admitted as its round ends, before anything
+                        // below waits (a module's speech callback, the turn's earlier
+                        // deliveries): its targets resolve now, as a live round's do.
+                        const finalSpeechText = speechContent.map((b) => b.text).join('\n').trim();
+                        const finalSegments = hadToolCalls && allText.length > 0
+                            ? splitProseSegments(liveProseRouting ? terminalContent : response.content)
+                            : [];
+                        const admitFinal = turnProseRouting === 'explicit' && !!this.channelRegistry;
+                        // The final text is delivered under this turn's routing, as its
+                        // queued rounds are.
+                        const finalRouting = streamRouting;
+                        const admittedSpeech = admitFinal && finalSpeechText ? this.admitProse(finalSpeechText) : null;
+                        const admittedSegments = admitFinal ? finalSegments.map((seg) => this.admitProse(seg)) : [];
                         const du = response.details?.usage;
                         const tokenUsage = du
                             ? {
@@ -8649,7 +9488,7 @@ export class AgentFramework {
                                     .filter((block) => block.type === 'text')
                                     .map((block) => block.text)
                                     .join('\n'),
-                        });
+                        }, streamRouting.logical);
                         this.emitTrace({
                             type: 'inference:completed',
                             agentName: agent.name,
@@ -8799,14 +9638,16 @@ export class AgentFramework {
                         // they are never routed here — which is precisely how the `think`
                         // tool (and any explicit send tool) yields a silent turn.
                         if (speechContent.length > 0 && this.channelRegistry) {
-                            const speechText = speechContent
-                                .map((b) => b.text)
-                                .join('\n')
-                                .trim();
+                            const speechText = finalSpeechText;
                             if (speechText) {
+                                // After the agent's earlier deliveries: every stream's chain
+                                // starts from the agent's latest link, so this waits for the
+                                // turn's earlier rounds and for an earlier turn's posts still
+                                // queued.
+                                await turnSpeechChain;
                                 if (turnProseRouting === 'disabled') {
                                     console.error(`[routing] ${agent.name}: text-only prose NOT routed (proseRouting=disabled)`);
-                                    this.recordProseSuppression(agent.name, 1);
+                                    this.recordProseSuppression(streamRouting, 1);
                                 }
                                 else if (turnSilenced && turnProseRouting !== 'explicit') {
                                     // Only reachable on a guard recovery that carried the
@@ -8814,13 +9655,13 @@ export class AgentFramework {
                                     // (a fresh text-only turn starts unsilenced). Explicit
                                     // mode is exempt, as mid-turn.
                                     console.error(`[routing] ${agent.name}: text-only prose NOT routed (turn silenced)`);
-                                    this.recordProseSuppression(agent.name, 1);
+                                    this.recordProseSuppression(streamRouting, 1);
                                 }
                                 else if (turnProseRouting === 'hybrid') {
                                     const locus = resolveTurnLocus();
                                     console.error(`[prose] ${agent.name}: text-only turn -> hybrid prose gateway`);
                                     try {
-                                        await this.deliverHybridProse(agent, speechText, locus, true);
+                                        await this.deliverHybridProse(agent, speechText, locus, true, finalRouting);
                                     }
                                     catch (err) {
                                         console.error('text-only hybrid prose delivery failed:', err);
@@ -8829,7 +9670,7 @@ export class AgentFramework {
                                 else if (turnProseRouting === 'explicit') {
                                     console.error(`[prose] ${agent.name}: text-only turn -> prose gateway`);
                                     try {
-                                        await this.deliverProse(agent, speechText);
+                                        await this.deliverAdmittedProse(agent, admittedSpeech, { routing: finalRouting });
                                     }
                                     catch (err) {
                                         console.error('text-only prose delivery failed:', err);
@@ -8846,7 +9687,7 @@ export class AgentFramework {
                                     console.error(`[routing] ${agent.name}: text-only turn -> routing speech -> ${locus ?? '(none)'}`);
                                     try {
                                         const outcome = await this.channelRegistry.routeSpeech(agent.name, speechText, locus);
-                                        this.recordProseDelivery(agent.name, outcome);
+                                        this.recordProseDelivery(streamRouting, outcome);
                                     }
                                     catch (err) {
                                         console.error('speech routing failed:', err);
@@ -8876,7 +9717,7 @@ export class AgentFramework {
                             const silenced = liveProseRouting
                                 ? turnSilenced
                                 : turnSilenced || toolNames.some(isSilencingTool);
-                            const segments = splitProseSegments(liveProseRouting ? terminalContent : response.content);
+                            const segments = finalSegments;
                             // Preserve in-channel ordering: everything enqueued live must
                             // land before the trailing prose. Awaited even when silenced —
                             // the chain may still be flushing earlier rounds' posts.
@@ -8884,18 +9725,18 @@ export class AgentFramework {
                             if (turnProseRouting === 'disabled') {
                                 if (segments.length > 0) {
                                     console.error(`[routing] ${agent.name}: tool-call trailing prose NOT routed (proseRouting=disabled)`);
-                                    this.recordProseSuppression(agent.name, segments.length);
+                                    this.recordProseSuppression(streamRouting, segments.length);
                                 }
                             }
                             else if (turnProseRouting === 'hybrid') {
                                 if (silenced && segments.length > 0) {
-                                    this.recordProseSuppression(agent.name, segments.length);
+                                    this.recordProseSuppression(streamRouting, segments.length);
                                 }
                                 else if (segments.length > 0) {
                                     const locus = resolveTurnLocus();
                                     for (const seg of segments) {
                                         try {
-                                            await this.deliverHybridProse(agent, seg, locus, true);
+                                            await this.deliverHybridProse(agent, seg, locus, true, finalRouting);
                                         }
                                         catch (err) {
                                             console.error('trailing hybrid prose delivery failed:', err);
@@ -8906,9 +9747,9 @@ export class AgentFramework {
                             else if (turnProseRouting === 'explicit') {
                                 if (segments.length > 0) {
                                     console.error(`[prose] ${agent.name}: tool-call turn [${toolNames.join(', ')}] -> ${segments.length} trailing segment(s) via prose gateway`);
-                                    for (const seg of segments) {
+                                    for (const envelopes of admittedSegments) {
                                         try {
-                                            await this.deliverProse(agent, seg);
+                                            await this.deliverAdmittedProse(agent, envelopes, { routing: finalRouting });
                                         }
                                         catch (err) {
                                             console.error('trailing prose delivery failed:', err);
@@ -8920,7 +9761,7 @@ export class AgentFramework {
                                 console.error(`[routing] ${agent.name}: tool-call turn [${toolNames.join(', ') || 'none'}] -> trailing prose NOT routed ` +
                                     `(${silenced ? 'silencing tool / explicit send' : 'no trailing prose'})`);
                                 if (silenced && segments.length > 0) {
-                                    this.recordProseSuppression(agent.name, segments.length);
+                                    this.recordProseSuppression(streamRouting, segments.length);
                                 }
                             }
                             else {
@@ -8937,7 +9778,7 @@ export class AgentFramework {
                                 for (const seg of segments) {
                                     try {
                                         const outcome = await this.channelRegistry.routeSpeech(agent.name, seg, locus);
-                                        this.recordProseDelivery(agent.name, outcome);
+                                        this.recordProseDelivery(streamRouting, outcome);
                                     }
                                     catch (err) {
                                         console.error('speech routing failed:', err);
@@ -8949,27 +9790,20 @@ export class AgentFramework {
                         // BEFORE dispatchSpeech. Locus routing is speech dispatch and
                         // doesn't depend on the status field, so it correctly runs after.
                         // Logical turn end (normal completion): drop the `[delivered]`
-                        // receipt. All deliveries are settled — the live chain was
-                        // awaited before trailing dispatch, and trailing/text-only
-                        // segments were awaited in-loop. Locus mode only; explicit-mode
-                        // envelopes acknowledge themselves through the prose gateway.
+                        // receipt, once every delivery has settled. The text-only and
+                        // trailing paths awaited the chain when there was final text; a
+                        // turn whose last response is empty awaits it here, so the
+                        // receipt and the continuation see its last rounds' deliveries.
+                        // Locus and hybrid mode; explicit-mode envelopes acknowledge
+                        // themselves through the prose gateway.
+                        await turnSpeechChain;
                         if (!trigger?.suppressProse && turnProseRouting !== 'explicit') {
-                            this.appendProseDeliveryReceipt(agent);
+                            this.appendProseDeliveryReceipt(agent, streamRouting);
                         }
-                        // Explicit-prose `!` continuation: a prose segment this turn asked
-                        // to keep going (`>>#x !` / `>>private !`) — start another turn
-                        // now instead of pausing until the next external event. This gives
-                        // prose the same continuation ability tool rounds have (wanted for
+                        // A `!` continuation this turn asked for. This gives prose the
+                        // same continuation ability tool rounds have (wanted for
                         // robotics-style loops where an end-of-turn pause is harmful).
-                        if (this.proseContinuations.delete(agent.name)) {
-                            console.error(`[prose] ${agent.name}: '!' continuation — requesting immediate next turn`);
-                            this.pendingRequests.push({
-                                agentName: agent.name,
-                                reason: 'prose-continuation',
-                                source: 'framework',
-                                timestamp: Date.now(),
-                            });
-                        }
+                        this.requestProseContinuation(agent, finalRouting);
                         break;
                     }
                     case 'error': {
@@ -9016,7 +9850,7 @@ export class AgentFramework {
                                     stopReason: 'exhausted',
                                     speech: '',
                                     error: 'Turn abandoned by operator quiesce',
-                                });
+                                }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting.logical : undefined);
                                 this.emitTrace({
                                     type: 'inference:aborted',
                                     agentName: agent.name,
@@ -9045,7 +9879,7 @@ export class AgentFramework {
                                 stopReason: 'exhausted',
                                 speech: '',
                                 error: err.message,
-                            });
+                            }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting.logical : undefined);
                             this.emitTrace({
                                 type: 'inference:exhausted',
                                 agentName: agent.name,
@@ -9100,7 +9934,7 @@ export class AgentFramework {
                                             stopReason: 'exhausted',
                                             speech: '',
                                             error: 'Turn abandoned by operator quiesce',
-                                        });
+                                        }, streamRouting.logical);
                                     }
                                     this.emitTrace({
                                         type: 'inference:aborted',
@@ -9113,13 +9947,23 @@ export class AgentFramework {
                                 // endTurn IS a logical turn end — earlier rounds may have
                                 // live-routed prose (narrate → skip_reply is a real shape),
                                 // so settle the delivery chain and drop the receipt. A
-                                // budget restart continues the same logical turn: the
-                                // deliveries map persists (cleared only at fresh turn
-                                // start) and the continuation stream's end writes ONE
-                                // receipt for the whole turn.
+                                // budget restart keeps the same turn's routing and tallies;
+                                // the continuation stream's end writes one receipt for it.
                                 if (cancelKind === 'turn_ended' && !trigger?.suppressProse && turnProseRouting !== 'explicit') {
                                     await turnSpeechChain;
-                                    this.appendProseDeliveryReceipt(agent);
+                                    this.appendProseDeliveryReceipt(agent, streamRouting);
+                                }
+                                // A `!` an earlier round asked for still starts its
+                                // continuation when a tool ends the turn, once the turn's
+                                // deliveries have run. Explicit mode doesn't hold the turn
+                                // for them, so it checks at the end of its chain.
+                                if (cancelKind === 'turn_ended') {
+                                    if (turnProseRouting === 'explicit') {
+                                        void turnSpeechChain.then(() => this.requestProseContinuation(agent, streamRouting));
+                                    }
+                                    else {
+                                        this.requestProseContinuation(agent, streamRouting);
+                                    }
                                 }
                                 return;
                             }
@@ -9135,7 +9979,7 @@ export class AgentFramework {
                                 stopReason: 'exhausted',
                                 speech: '',
                                 error: `Stream aborted: ${reason}`,
-                            });
+                            }, streamRouting.logical);
                             this.emitTrace({
                                 type: 'inference:exhausted',
                                 agentName: agent.name,
@@ -9268,7 +10112,7 @@ export class AgentFramework {
                 stopReason: 'exhausted',
                 speech: '',
                 error: err.message,
-            });
+            }, streamRouting.logical);
             this.emitTrace({
                 type: 'inference:exhausted',
                 agentName: agent.name,
@@ -9516,13 +10360,15 @@ export class AgentFramework {
         let ownedToEnd = false;
         try {
             const started = Date.now();
-            const result = await this.executeToolCall({
-                id: toolUseId,
-                name: toolName,
-                input,
-                callerAgentName: agentName,
-            });
+            const call = { id: toolUseId, name: toolName, input, callerAgentName: agentName };
+            const returned = await this.executeToolCall(call);
             const durationMs = Date.now() - started;
+            // The pair is stored as a model's call would be, so the result stored,
+            // traced and logged is its checked form. The caller gets the tool's
+            // own result back, as an in-process caller does, unless nothing
+            // usable could be stored: then it gets the error result stored.
+            const checked = checkedToolResult(call, returned);
+            const result = checked.result;
             // Store the pair through the same shapes the ordinary path uses. Build
             // the result blocks BEFORE storing the tool_use: the spill path awaits.
             // A message arriving during either await is deferred by the turn
@@ -9560,7 +10406,7 @@ export class AgentFramework {
             });
             console.log(`[puppet] ${agentName}: ${toolName} → ${result.isError ? 'ERROR' : 'ok'} ` +
                 `in ${durationMs}ms (${toolUseId})${ownedToEnd ? '' : ' — deferred behind a live turn'}`);
-            return { toolUseId, result };
+            return { toolUseId, result: checked.usable ? returned : result };
         }
         finally {
             if (this.activeTurnTokens.get(agentName) === turnToken)
@@ -9585,6 +10431,8 @@ export class AgentFramework {
         }
     }
     async executeToolCallFrom(call, origin) {
+        if (isPresentationTool(call.name))
+            return this.editToolPresentation(call.callerAgentName ?? '__ephemeral__', call);
         // Client-side programmatic tool calling for promise-based callers
         // (SubagentModule ephemerals). Keyed by callerAgentName so each ephemeral
         // gets its own interpreter state.
@@ -9620,9 +10468,10 @@ export class AgentFramework {
         // ephemerals, ModuleContext.callTool) reach utilities the same way the
         // model does.
         if (call.name === 'utils') {
-            return this.handleUtilsToolCall(call.callerAgentName ?? '__ephemeral__', call);
+            return this.handleUtilsToolCall(call.callerAgentName ?? '__ephemeral__', call, { inProcess: true });
         }
-        // Module tools
+        // Module tools. The caller uses the result in process, so it gets the
+        // module's own result, as the module returned it.
         return this.moduleRegistry.handleToolCall(call);
     }
     async executeMcplToolCall(call, config) {
@@ -9700,6 +10549,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'code_execution',
                 result,
@@ -9717,6 +10567,11 @@ export class AgentFramework {
      * results reach the running script and never the model context.
      */
     async runCodeExecution(agentName, call) {
+        // RFC-007: what the script's own tool calls are attributed to. Read
+        // before the first await: it is only known while this call is being
+        // dispatched. Undefined off the model dispatch path (ephemeral callers),
+        // whose code_execution call is not reported either.
+        const origin = this.toolLifecycleEmitter?.scriptOrigin(agentName, call.id);
         const input = (call.input ?? {});
         // Management surface: the agent's own daemon fleet is inspectable and
         // killable through the same tool that spawns it.
@@ -9779,16 +10634,34 @@ export class AgentFramework {
             : this.getAllTools(); // ephemeral agents: full surface, matching executeToolCall
         const injected = buildInjectedTools(surface.map((t) => t.name).filter((name) => name !== CODE_EXECUTION_TOOL_NAME));
         if (input.background === true) {
-            const started = this.startBackgroundScript(agentName, input.code, injected, timeLimitMs);
+            const started = this.startBackgroundScript(agentName, input.code, injected, timeLimitMs, origin);
             if (capNote && started.success && started.data && typeof started.data === 'object') {
                 started.data.time_limit_note = capNote;
             }
             return started;
         }
         const runner = this.getOrCreateScriptRunner(agentName);
-        this.scriptDeferredEndTurn.delete(agentName);
-        const exec = await runner.exec(input.code, injected, undefined, timeLimitMs !== undefined ? { deadlineMs: timeLimitMs } : undefined);
-        const endTurn = this.scriptDeferredEndTurn.delete(agentName);
+        // A busy runner refuses this exec; the running script keeps its mark and
+        // its origin.
+        const ownsRunner = !runner.busy;
+        const script = { endTurn: false };
+        if (ownsRunner)
+            this.scriptDeferredEndTurn.set(agentName, script);
+        const ownsOrigin = origin !== undefined && ownsRunner;
+        if (ownsOrigin)
+            this.foregroundScriptOrigins.set(agentName, origin);
+        let exec;
+        try {
+            exec = await runner.exec(input.code, injected, undefined, timeLimitMs !== undefined ? { deadlineMs: timeLimitMs } : undefined);
+        }
+        finally {
+            if (this.scriptDeferredEndTurn.get(agentName) === script)
+                this.scriptDeferredEndTurn.delete(agentName);
+            if (ownsOrigin && this.foregroundScriptOrigins.get(agentName) === origin) {
+                this.foregroundScriptOrigins.delete(agentName);
+            }
+        }
+        const endTurn = script.endTurn;
         return {
             success: true,
             data: {
@@ -9812,7 +10685,7 @@ export class AgentFramework {
      * limitation is stated in the tool description so agents can calibrate
      * how much to rely on an armed wake.
      */
-    startBackgroundScript(agentName, code, injected, timeLimitMs) {
+    startBackgroundScript(agentName, code, injected, timeLimitMs, origin) {
         // v1: primary-agent-only. A conversation fork's or ephemeral's daemon
         // would outlive its owner and its wake would land in the primary
         // conversation anyway — refuse loudly instead of surprising anyone.
@@ -9858,7 +10731,7 @@ export class AgentFramework {
             scriptTimeoutMs: cfg?.scriptTimeoutMs,
             idleReclaimMs: 0, // dedicated runner; lifetime is the exec deadline
             label: `${agentName}:${scriptId}`,
-            onToolCall: (toolName, args) => this.handleScriptToolCall(agentName, toolName, args),
+            onToolCall: (toolName, args) => this.handleScriptToolCall(agentName, toolName, args, origin),
         });
         const record = {
             id: scriptId,
@@ -10047,7 +10920,7 @@ export class AgentFramework {
             // stays reachable by provenance after the bytes leave the wire.
             const raw = tc.result.isError
                 ? tc.result.error ?? 'Unknown error'
-                : toolResultDataToHistoryString(tc.result.data, undefined, {
+                : nonErrorResultText(tc.result, undefined, {
                     imageRef: (blockIndex, image) => ledger.retain({
                         toolCallId: tc.id,
                         toolName: tc.name,
@@ -10069,6 +10942,134 @@ export class AgentFramework {
         }));
         return { blocks, spilled };
     }
+    /** Where a tool result labelled `label` is written: `<first writable
+     *  mount>/tool-results/<label>.txt`, or null when there is no writable
+     *  workspace. */
+    toolResultFilePlace(label) {
+        const workspace = this.getWorkspaceModule();
+        const mountName = workspace ? this.firstWritableMountName(workspace) : null;
+        if (!workspace || !mountName)
+            return null;
+        const safeLabel = label.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80);
+        return { workspace, path: `${mountName}/tool-results/${safeLabel}.txt`, safeLabel };
+    }
+    /**
+     * A withheld original uses the remaining time in its batch's deadline.
+     * A write still under way at that deadline is reported as unfinished and
+     * goes on; the guard stops waiting for it, though stop() still waits for
+     * the workspace's turn it holds (bounded only by a teardown timeout). From
+     * then until every
+     * overdue write settles, new withheld spills are workspace_unanswered.
+     * Writes from other batches can start before the first deadline fires.
+     * An exhausted batch starts no more writes even if none is overdue.
+     * The inline cap's spills use writeToolResultFile without this deadline.
+     */
+    async spillWithheld(label, text, branch, deadline = Date.now() + this.withheldSpillDeadlineMs) {
+        // A batch with no finite deadline (a host whose deadline() threw) gets
+        // this write's own, rather than a timer Node would cut to 1 ms.
+        if (!Number.isFinite(deadline))
+            deadline = Date.now() + this.withheldSpillDeadlineMs;
+        if (this.guardSpillsClosedFor === this.lifecycleGeneration)
+            return null;
+        const place = this.toolResultFilePlace(label);
+        if (!place)
+            return null;
+        if (this.stalledSpills.size > 0) {
+            // Said once per stall, with the count when it clears, so a stalled
+            // workspace doesn't write a line for every result it can't take.
+            if (this.stallSkips++ === 0) {
+                console.error(`[spill] withheld originals are skipped as workspace_unanswered while ${this.stalledSpills.size} write(s) past their deadline are under way (first: ${place.path})`);
+            }
+            return { skipped: 'workspace_unanswered' };
+        }
+        const remaining = deadline - Date.now();
+        // The guard says once per batch that it used its deadline.
+        if (remaining <= 0)
+            return { skipped: 'batch_deadline' };
+        const write = this.writeToolResultFile(label, text, branch);
+        let timer;
+        const late = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                // Marked as the deadline passes, before anything else runs, so no
+                // spill that starts after it finds the workspace answering.
+                const stalled = write.then(() => { }, () => { }).finally(() => {
+                    this.stalledSpills.delete(stalled);
+                    if (this.stalledSpills.size === 0 && this.stallSkips > 0) {
+                        console.error(`[spill] the workspace answered again; ${this.stallSkips} withheld original(s) were skipped as workspace_unanswered meanwhile`);
+                        this.stallSkips = 0;
+                    }
+                });
+                this.stalledSpills.add(stalled);
+                console.error(`[spill] ${place.path} still being written at the withheld batch deadline`);
+                resolve('late');
+            }, remaining);
+            timer.unref?.();
+        });
+        try {
+            const written = await Promise.race([write, late]);
+            if (written !== 'late') {
+                if (!written)
+                    return null;
+                if (written.branchLeft)
+                    return { skipped: 'branch_changed' };
+                return { path: written.path, ...(written.error !== undefined ? { error: written.error } : {}) };
+            }
+            return { path: place.path, unfinished: true };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * Write one tool result's text to its tool-results file (see
+     * toolResultFilePlace): the one place both the inline cap's spill and the
+     * guard's withheld originals go. null when there is no writable workspace.
+     * A failed write is reported, traced and logged here, never thrown. With a
+     * branch, the file lands on that branch or isn't written (see writeBinary).
+     */
+    async writeToolResultFile(label, content, branch) {
+        const place = this.toolResultFilePlace(label);
+        if (!place)
+            return null;
+        const { workspace, path, safeLabel } = place;
+        let failure;
+        try {
+            const result = await workspace.writeBinary(path, Buffer.from(content, 'utf8'), 'text/plain', { branch });
+            if (result.success)
+                return { path };
+            // The file is in the workspace's Chronicle tree, where its tools read
+            // it, and the rest of the write failed (its copy on disk, or something
+            // after the entry was set): it is written for every reader the stub or
+            // the truncation note sends there. The workspace emits
+            // workspace:materialize-failed only for a refused push, so the failure
+            // is traced here too.
+            if (result.data?.inChronicle === true) {
+                const error = (result.error ?? 'the rest of the write failed').slice(0, 200);
+                this.emitTrace({ type: 'tool:spill_failed', label: safeLabel, path, contentLength: content.length, error });
+                console.error(`[spill] ${path} is in the workspace's Chronicle tree, but the rest of its write failed: ${error}`);
+                return { path };
+            }
+            // Declined, not failed: the store left the branch the file is for, so
+            // it isn't written anywhere, as the caller asked.
+            if (result.data?.branchLeft === true) {
+                return { path, error: result.error ?? 'the workspace had left the branch this file is for', branchLeft: true };
+            }
+            failure = result.error ?? 'write refused';
+        }
+        catch (err) {
+            failure = err instanceof Error ? err.message : String(err);
+        }
+        failure = failure.slice(0, 200);
+        this.emitTrace({
+            type: 'tool:spill_failed',
+            label: safeLabel,
+            path,
+            contentLength: content.length,
+            error: failure,
+        });
+        console.error(`[spill] workspace write failed for ${path} (${content.length} chars): ${failure}`);
+        return { path, error: failure };
+    }
     async spillOrTruncate(content, cap, label) {
         if (!cap || content.length <= cap)
             return { text: content, filePath: null };
@@ -10079,51 +11080,32 @@ export class AgentFramework {
         // slots at or past the cut, re-appended after the notice.
         const { head, tail } = splitPreservingImageSlots(content, cap);
         const kept = formatPreservedImageSlots(tail);
-        const workspace = this.getWorkspaceModule();
-        const mountName = workspace ? this.firstWritableMountName(workspace) : null;
-        if (workspace && mountName) {
-            const safeLabel = label.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80);
-            const path = `${mountName}/tool-results/${safeLabel}.txt`;
-            let failure;
-            try {
-                const result = await workspace.writeBinary(path, Buffer.from(content, 'utf8'), 'text/plain');
-                if (result.success) {
-                    // JSON serialization can expand each read-back code unit to six
-                    // chars (\\u0000). Leave room for the page's metadata and a possible
-                    // extra code unit at a surrogate-pair boundary.
-                    const pageOverhead = JSON.stringify(path).length + 256;
-                    const readLimit = Math.max(1, Math.min(2000, Math.floor((cap - pageOverhead) / 6) - 1));
-                    return {
-                        text: head
-                            + `\n\n[truncated — showing ${head.length} of ${content.length} chars; full content: workspace file ${path}`
-                            + `. Page with workspace--read ${JSON.stringify({ path, offsetChars: 0, limitChars: readLimit })}; `
-                            + 'use nextOffsetChars as offsetChars until null, keeping limitChars. Or raise the inline cap via '
-                            + 'agent_settings update tool_result_inline_max_chars.]'
-                            + kept,
-                        filePath: path,
-                    };
-                }
-                failure = result.error ?? 'write refused';
-            }
-            catch (err) {
-                failure = err instanceof Error ? err.message : String(err);
-            }
+        const written = await this.writeToolResultFile(label, content);
+        if (written && written.error === undefined) {
+            const path = written.path;
+            // JSON serialization can expand each read-back code unit to six
+            // chars (\\u0000). Leave room for the page's metadata and a possible
+            // extra code unit at a surrogate-pair boundary.
+            const pageOverhead = JSON.stringify(path).length + 256;
+            const readLimit = Math.max(1, Math.min(2000, Math.floor((cap - pageOverhead) / 6) - 1));
+            return {
+                text: head
+                    + `\n\n[truncated — showing ${head.length} of ${content.length} chars; full content: workspace file ${path}`
+                    + `. Page with workspace--read ${JSON.stringify({ path, offsetChars: 0, limitChars: readLimit })}; `
+                    + 'use nextOffsetChars as offsetChars until null, keeping limitChars. Or raise the inline cap via '
+                    + 'agent_settings update tool_result_inline_max_chars.]'
+                    + kept,
+                filePath: path,
+            };
+        }
+        if (written) {
             // A workspace was there and the write FAILED — say that, loudly and
             // distinctly. Telling the agent "no writable workspace" would teach
             // them their residence lacks a capability it actually has.
-            failure = failure.slice(0, 200);
-            this.emitTrace({
-                type: 'tool:spill_failed',
-                label: safeLabel,
-                path,
-                contentLength: content.length,
-                error: failure,
-            });
-            console.error(`[spill] workspace write failed for ${path} (${content.length} chars): ${failure}`);
             return {
                 text: head
-                    + `\n\n[truncated — showing ${head.length} of ${content.length} chars; spill to workspace file ${path} FAILED`
-                    + ` (${failure}); content over the cap was not retained]`
+                    + `\n\n[truncated — showing ${head.length} of ${content.length} chars; spill to workspace file ${written.path} FAILED`
+                    + ` (${written.error}); content over the cap was not retained]`
                     + kept,
                 filePath: null,
             };
@@ -10145,7 +11127,8 @@ export class AgentFramework {
                 scriptTimeoutMs: cfg?.scriptTimeoutMs,
                 idleReclaimMs: cfg?.idleReclaimMs,
                 label: agentName,
-                onToolCall: (toolName, args) => this.handleScriptToolCall(agentName, toolName, args),
+                // The script that made the call is the one running when it arrives.
+                onToolCall: (toolName, args) => this.handleScriptToolCall(agentName, toolName, args, this.foregroundScriptOrigins.get(agentName), this.scriptDeferredEndTurn.get(agentName)),
             });
             this.codeExecutionRunners.set(agentName, runner);
         }
@@ -10160,22 +11143,24 @@ export class AgentFramework {
      * placeholders): programmatic tool results are text-only by contract, and
      * a script variable holding megabytes of base64 helps nobody.
      */
-    async handleScriptToolCall(agentName, toolName, args) {
+    async handleScriptToolCall(agentName, toolName, args, origin, 
+    /** The foreground script that made the call; none for a background script. */
+    script) {
         if (toolName === CODE_EXECUTION_TOOL_NAME) {
             return 'Error: code_execution cannot be called from within a script';
         }
-        const result = await this.dispatchScriptToolCall(agentName, toolName, args);
-        if (result.endTurn) {
+        const result = await this.dispatchScriptToolCall(agentName, toolName, args, origin);
+        if (result.endTurn && script) {
             // Deferred: applied to the final code_execution result (see
             // scriptDeferredEndTurn) — ending the turn mid-script would cancel the
             // stream while the script still runs and wedge the tool round.
-            this.scriptDeferredEndTurn.add(agentName);
+            script.endTurn = true;
         }
         if (result.isError) {
             return `Error: ${result.error ?? 'tool call failed'}`;
         }
-        if (result.data === undefined)
-            return '';
+        if (result.data === undefined || result.data === null)
+            return nonErrorResultText(result, 5_000_000);
         // RFC-005 "eagerly lazy": a script receiving a result is the strongest
         // available signal that the bytes are wanted (scripts process, they do
         // not browse) — materialize every referenced payload now, so the stub
@@ -10203,8 +11188,12 @@ export class AgentFramework {
      * resolve with its result. The waiter intercept in handleProcessEvent
      * (keyed by the pytc- call ID) routes the tool-result event here instead
      * of into the agent's pending tool round.
+     *
+     * RFC-007: with an `origin`, observers see the call as they see a model
+     * call (register, dispatch with its refusal sites, open; the terminal at
+     * the waiter intercept), under the inner tool's own name and class.
      */
-    dispatchScriptToolCall(agentName, toolName, args) {
+    dispatchScriptToolCall(agentName, toolName, args, origin) {
         return new Promise((resolve) => {
             const callId = `pytc-${randomUUID()}`;
             // Host-side leak guard: the python runtime already raises TimeoutError
@@ -10213,6 +11202,9 @@ export class AgentFramework {
             const safetyMs = (this.codeExecutionConfig?.toolCallTimeoutMs ?? 270_000) + 30_000;
             const safety = setTimeout(() => {
                 if (this.scriptToolWaiters.delete(callId)) {
+                    // RFC-007: no result reached the host — the call failed.
+                    this.toolLifecycleEmitter?.markDispatchFailure(agentName, callId);
+                    this.toolLifecycleEmitter?.onResult(agentName, callId, undefined);
                     resolve({
                         success: false,
                         error: `tool '${toolName}' produced no result within ${Math.round(safetyMs / 1000)}s`,
@@ -10225,16 +11217,31 @@ export class AgentFramework {
                 clearTimeout(safety);
                 resolve(result);
             });
+            const call = { id: callId, name: toolName, input: args };
+            if (origin)
+                this.toolLifecycleEmitter?.registerScriptCall(agentName, origin, call);
             try {
-                this.dispatchToolCall(agentName, { id: callId, name: toolName, input: args });
+                this.dispatchToolCall(agentName, call);
             }
             catch (error) {
+                // Dispatch threw. Not a refusal (refusal sites call refuse() and
+                // answer): the tool may have done work first (sleep sets the gate,
+                // then formats its reply), so the call started and the host got no
+                // result — `failed`, as for a dispatch that rejects.
+                if (origin) {
+                    this.toolLifecycleEmitter?.open(agentName, callId);
+                    this.toolLifecycleEmitter?.markDispatchFailure(agentName, callId);
+                    this.toolLifecycleEmitter?.onResult(agentName, callId, undefined);
+                }
                 if (this.scriptToolWaiters.delete(callId)) {
                     clearTimeout(safety);
                     const err = error instanceof Error ? error : new Error(String(error));
                     resolve({ success: false, error: err.message, isError: true });
                 }
+                return;
             }
+            if (origin)
+                this.toolLifecycleEmitter?.open(agentName, callId);
         });
     }
     /** Abort a running script when the agent's turn dies underneath it. */
@@ -10565,6 +11572,11 @@ export class AgentFramework {
     dispatchToolCall(agentName, call) {
         // Enrich call with caller identity so modules can resolve the calling agent
         const enrichedCall = { ...call, callerAgentName: agentName };
+        if (isPresentationTool(call.name)) {
+            const result = this.editToolPresentation(agentName, enrichedCall);
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tool-presentation', result });
+            return;
+        }
         // Route MCPL tool calls to the appropriate server via prefix map
         const mcplMatch = this.resolveMcplTool(enrichedCall.name);
         if (mcplMatch && this.mcplServerRegistry) {
@@ -10612,10 +11624,16 @@ export class AgentFramework {
             SUBCONSCIOUS_TOOL_NAMES.includes(enrichedCall.name)) {
             void this.tuneOutCoordinator
                 .handleSubconsciousTool(enrichedCall.name, enrichedCall.input)
+                // A rejection is answered with a failed result, as a framework tool's
+                // dispatch failure is (dispatchUtilsToolCall), never left unhandled.
+                .catch((err) => ({ success: false, error: thrownText(err), isError: true }))
                 .then((result) => {
-                this.queue.push({
+                // Through pushEvent, like every other tool's result, so one that
+                // arrives after stop() is dropped rather than rejected unhandled.
+                this.pushEvent({
                     type: 'tool-result',
                     callId: enrichedCall.id,
+                    toolName: enrichedCall.name,
                     agentName,
                     moduleName: 'tune-out',
                     result,
@@ -10681,6 +11699,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: enrichedCall.id,
+                toolName: enrichedCall.name,
                 agentName,
                 moduleName: 'framework',
                 result: { success: true, data: PROSE_ROUTING_HELP },
@@ -10710,7 +11729,7 @@ export class AgentFramework {
         });
         const startTime = Date.now();
         this.moduleRegistry
-            .handleToolCall(call)
+            .storableToolCall({ ...call, callerAgentName: agentName })
             .then((result) => {
             const durationMs = Date.now() - startTime;
             this.emitTrace({
@@ -10723,6 +11742,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName,
                 result,
@@ -10743,6 +11763,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName,
                 result: {
@@ -11267,7 +12288,7 @@ export class AgentFramework {
      */
     async initializeMcpl(serverConfigs, inferenceRouting) {
         this.mcplServerRegistry = new McplServerRegistry();
-        this.featureSetManager = new FeatureSetManager();
+        this.featureSetManager = new FeatureSetManager((event) => this.emitTrace(event));
         this.hookOrchestrator = new HookOrchestrator(this.mcplServerRegistry, this.featureSetManager);
         this.toolLifecycleEmitter = new ToolLifecycleEmitter({
             observers: () => this.mcplServerRegistry?.getAllServers() ?? [],
@@ -11782,6 +12803,18 @@ export class AgentFramework {
      *  coalescing. */
     manifestRefreshState = new Map();
     static MANIFEST_FETCH_FLOOR_MS = 5_000;
+    /**
+     * The `mcpl:policy-refused` fields from a refusal receipt, as the host
+     * acts on them: the receipt is server-supplied, so `fallback` is the
+     * branch actually taken (anything but `close` is treated as `mcp-only`)
+     * and a non-string `reason` is dropped.
+     */
+    static policyRefusalFields(receipt) {
+        return {
+            fallback: receipt.fallback === 'close' ? 'close' : 'mcp-only',
+            reason: typeof receipt.reason === 'string' ? receipt.reason : null,
+        };
+    }
     /**
      * §17.5 host processing: fetch the complete manifest, validate exactly as
      * at initialize, diff, apply §6.7 consequences (removals eagerly even
@@ -11885,6 +12918,12 @@ export class AgentFramework {
                 if (receipt && receipt.accepted === false) {
                     const fallback = receipt.fallback ?? 'mcp-only';
                     console.error(`[mcpl] ${connection.id} refused post-manifest policy — fallback: ${fallback}`);
+                    this.emitTrace({
+                        type: 'mcpl:policy-refused',
+                        serverId: connection.id,
+                        phase: 'manifest-change',
+                        ...AgentFramework.policyRefusalFields(receipt),
+                    });
                     if (fallback === 'close') {
                         await connection.close();
                         return;
@@ -11982,6 +13021,12 @@ export class AgentFramework {
             if (receipt && receipt.accepted === false) {
                 const fallback = receipt.fallback ?? 'mcp-only';
                 console.error(`[mcpl] ${config.id} refused initial policy (${receipt.reason ?? 'no reason'}) — fallback: ${fallback}`);
+                this.emitTrace({
+                    type: 'mcpl:policy-refused',
+                    serverId: config.id,
+                    phase: 'initial',
+                    ...AgentFramework.policyRefusalFields(receipt),
+                });
                 if (fallback === 'close') {
                     await connection.close();
                     return;
@@ -12160,39 +13205,88 @@ export class AgentFramework {
         // framework; the ScopeManager and config `scopes` wiring went with it.
         // Handle push events (Step 6)
         connection.on('push-event', async (params, responder) => {
-            const barrier = this.discordAwarenessBarrier;
-            if (barrier)
-                await barrier.promise;
-            await this.pushHandler?.handlePushEvent(connection.id, params, responder);
+            const answer = answerOnce(responder, 'push/event', connection.id);
+            try {
+                const barrier = this.discordAwarenessBarrier;
+                if (barrier)
+                    await barrier.promise;
+                // Checked here, after the barrier and before anything records the
+                // push as accepted: a stopped host refuses it.
+                if (this.queue?.isClosed) {
+                    this.refuseServerItem('push/event', connection.id, answer, { kind: 'refused' });
+                    return;
+                }
+                await this.pushHandler?.handlePushEvent(connection.id, params, answer.responder);
+            }
+            catch (error) {
+                this.refuseServerItem('push/event', connection.id, answer, { kind: 'failed', error });
+            }
         });
         // Handle server-initiated inference requests (Step 6)
         connection.on('inference-request', async (params, responder) => {
             // RFC-006 §5.3 / SPEC §10.7: no inference from inside a render.
             if (this.pushCoalescer?.isRendering(connection.id)) {
-                responder?.respondError(-32600, 'Cannot request inference while push/render is in progress');
+                try {
+                    responder?.respondError(-32600, 'Cannot request inference while push/render is in progress');
+                }
+                catch {
+                    // The connection is going; there is no one left to tell.
+                }
                 return;
             }
             if (this.inferenceRouter && responder) {
-                const barrier = this.discordAwarenessBarrier;
-                if (barrier)
-                    await barrier.promise;
-                await this.inferenceRouter.handleInferenceRequest(connection.id, params, {
-                    respond: responder.respond,
-                    respondError: responder.respondError,
-                    requestId: responder.id,
-                });
+                const answer = answerOnce(responder, 'inference/request', connection.id);
+                try {
+                    const barrier = this.discordAwarenessBarrier;
+                    if (barrier)
+                        await barrier.promise;
+                    // A stopping host starts no inference for a server: refused, like a
+                    // push, before the router runs.
+                    if (this.queue?.isClosed) {
+                        this.refuseServerItem('inference/request', connection.id, answer, { kind: 'refused' });
+                        return;
+                    }
+                    await this.inferenceRouter.handleInferenceRequest(connection.id, params, {
+                        respond: answer.responder.respond,
+                        respondError: answer.responder.respondError,
+                        requestId: responder.id,
+                    });
+                }
+                catch (error) {
+                    this.refuseServerItem('inference/request', connection.id, answer, { kind: 'failed', error });
+                }
             }
         });
         // Handle channel registration (Step 7)
         connection.on('channels-register', async (params, responder) => {
-            await this.channelRegistry?.handleRegister(connection.id, params, responder);
+            const answer = answerOnce(responder, 'channels/register', connection.id);
+            try {
+                if (this.queue?.isClosed) {
+                    this.refuseServerItem('channels/register', connection.id, answer, { kind: 'refused' });
+                    return;
+                }
+                await this.channelRegistry?.handleRegister(connection.id, params, answer.responder);
+            }
+            catch (error) {
+                this.refuseServerItem('channels/register', connection.id, answer, { kind: 'failed', error });
+            }
         });
         // Handle channel changes (Step 7) — §14.5 dual-mode: the responder is
         // present for the Request form and carries itemized added-descriptor
         // results; absent for Notifications, where rejection is itemwise
         // filtering plus a diagnostic trace.
         connection.on('channels-changed', async (params, responder) => {
-            await this.channelRegistry?.handleChanged(connection.id, params, responder);
+            const answer = answerOnce(responder, 'channels/changed', connection.id);
+            try {
+                if (this.queue?.isClosed) {
+                    this.refuseServerItem('channels/changed', connection.id, answer, { kind: 'refused' });
+                    return;
+                }
+                await this.channelRegistry?.handleChanged(connection.id, params, answer.responder);
+            }
+            catch (error) {
+                this.refuseServerItem('channels/changed', connection.id, answer, { kind: 'failed', error });
+            }
         });
         // §6.6/§12: requests that previously had no handler and hung forever
         // (AUDIT-001 item 4). The connection-level grant gate has already run.
@@ -12235,25 +13329,41 @@ export class AgentFramework {
         });
         // Handle incoming channel messages (Step 7)
         connection.on('channels-incoming', async (params, responder) => {
-            const barrier = this.discordAwarenessBarrier;
-            if (barrier)
-                await barrier.promise;
-            await this.channelRegistry?.handleIncoming(connection.id, params, responder);
+            const answer = answerOnce(responder, 'channels/incoming', connection.id);
+            try {
+                const barrier = this.discordAwarenessBarrier;
+                if (barrier)
+                    await barrier.promise;
+                if (this.queue?.isClosed) {
+                    this.refuseServerItem('channels/incoming', connection.id, answer, { kind: 'refused' });
+                    return;
+                }
+                await this.channelRegistry?.handleIncoming(connection.id, params, answer.responder);
+            }
+            catch (error) {
+                this.refuseServerItem('channels/incoming', connection.id, answer, { kind: 'failed', error });
+            }
         });
         // Handle host-level admin commands from a surface (e.g. Discord /undo)
         connection.on('host-command', async (params, responder) => {
             if (!responder)
                 return;
+            const answer = answerOnce(responder, 'host/command', connection.id);
             try {
                 const barrier = this.discordAwarenessBarrier;
                 if (barrier)
                     await barrier.promise;
+                // A stopping host runs no host command: refused like the requests
+                // above, before its handler runs.
+                if (this.queue?.isClosed) {
+                    this.refuseServerItem('host/command', connection.id, answer, { kind: 'refused' });
+                    return;
+                }
                 const result = await this.handleHostCommand(connection.id, params ?? {});
-                responder.respond(result);
+                answer.responder.respond(result);
             }
             catch (error) {
-                const err = error instanceof Error ? error : new Error(String(error));
-                responder.respondError(-32603, err.message);
+                this.refuseServerItem('host/command', connection.id, answer, { kind: 'failed', error });
             }
         });
         // Handle dynamic tool list changes (notifications/tools/list_changed)
@@ -12399,11 +13509,13 @@ export class AgentFramework {
         const toolFeatureSets = new Map();
         const toolClasses = new Map();
         const toolServers = new Map();
+        const listedServers = new Set();
         for (const server of this.mcplServerRegistry.getAllServers()) {
             const config = this.mcplServerConfigs.get(server.id);
             const prefix = config?.toolPrefix ?? `mcpl--${server.id}`;
             try {
                 const result = await server.sendToolsList();
+                listedServers.add(server.id);
                 for (const tool of result.tools) {
                     if (!isToolAllowed(tool.name, config))
                         continue;
@@ -12433,13 +13545,106 @@ export class AgentFramework {
                 }
             }
             catch {
-                // Server may not support tools/list — skip silently
+                // Server may not support tools/list — skip silently. A live server
+                // whose handshake advertised no MCP `tools` has, in effect, listed
+                // nothing; count it as listed so tool-pattern checks do not wait on
+                // it forever. (A server that advertised tools but failed to list
+                // them stays unknown.)
+                if (server.isConnected && !server.mcpToolsAdvertised)
+                    listedServers.add(server.id);
             }
         }
         this.mcplTools = tools;
         this.mcplToolFeatureSets = toolFeatureSets;
         this.mcplToolClasses = toolClasses;
         this.mcplToolServers = toolServers;
+        this.mcplListedServers = listedServers;
+        if (this.toolPatternChecksArmed)
+            this.checkToolPatterns();
+    }
+    /**
+     * Report operator tool-name patterns that match no model-facing tool:
+     * `toolClassOverrides` keys and each server's `toolLifecycle.observe.tools`
+     * / `toolLifecycle.inputs.tools`. These match `<toolPrefix>--<tool>`, and
+     * the default prefix is `mcpl--<serverId>`, so a pattern written against
+     * the bare server id is valid config that silently does nothing.
+     *
+     * Each pattern is reported at most once (console line + a
+     * `mcpl:tool-pattern-unmatched` trace). A pattern that could still name
+     * tools of a server whose listing is not in (not connected yet,
+     * reconnecting, restarting) stays undecided until that listing arrives.
+     * Diagnostic only: never throws into the refresh that called it.
+     */
+    checkToolPatterns() {
+        try {
+            const entries = [];
+            for (const [pattern] of this.toolClassOverrides ?? []) {
+                entries.push({ setting: 'toolClassOverrides', pattern });
+            }
+            const configs = [...(this.mcplServerConfigs?.values() ?? [])];
+            for (const config of configs) {
+                const lifecycle = config.toolLifecycle;
+                for (const key of ['observe', 'inputs']) {
+                    const tools = lifecycle?.[key]?.tools;
+                    if (!Array.isArray(tools))
+                        continue;
+                    for (const pattern of tools) {
+                        if (typeof pattern === 'string') {
+                            entries.push({ setting: `toolLifecycle.${key}.tools`, serverId: config.id, pattern });
+                        }
+                    }
+                }
+            }
+            const reported = (this.toolPatternsReported ??= new Set());
+            const keyOf = (e) => `${e.serverId ?? ''}\u0000${e.setting}\u0000${e.pattern}`;
+            const pending = entries.filter((e) => !reported.has(keyOf(e)));
+            if (pending.length === 0)
+                return;
+            const known = (this.toolPatternKnownPrefixes ??= new Map());
+            for (const c of configs)
+                known.set(c.toolPrefix ?? `mcpl--${c.id}`, c.id);
+            const servers = [...known].map(([prefix, id]) => {
+                const current = this.mcplServerConfigs?.get(id);
+                return {
+                    id,
+                    prefix,
+                    listed: !!current
+                        && (current.toolPrefix ?? `mcpl--${id}`) === prefix
+                        && (this.mcplListedServers?.has(id) ?? false),
+                };
+            });
+            const names = this.modelFacingToolNames();
+            for (const entry of pending) {
+                const verdict = checkToolPattern(entry.pattern, names, servers);
+                if (verdict.kind !== 'unmatched')
+                    continue;
+                reported.add(keyOf(entry));
+                const where = entry.serverId ? `${entry.serverId}: ${entry.setting}` : entry.setting;
+                console.error(describeUnmatchedPattern(where, entry.pattern, verdict));
+                this.emitTrace({
+                    type: 'mcpl:tool-pattern-unmatched',
+                    setting: entry.setting,
+                    ...(entry.serverId ? { serverId: entry.serverId } : {}),
+                    pattern: entry.pattern,
+                    ...(verdict.suggestion ? { suggestion: verdict.suggestion } : {}),
+                    hint: verdict.hint,
+                });
+            }
+        }
+        catch (error) {
+            console.error('[mcpl] tool pattern check failed:', error instanceof Error ? error.message : error);
+        }
+    }
+    /** Every tool name the framework offers to anyone: the shared board plus
+     *  each agent's own surface, before presentation visibility (a hidden tool
+     *  is still callable, so classes and lifecycle still apply to it). */
+    modelFacingToolNames() {
+        const names = new Set(this.getAllTools().map((t) => t.name));
+        for (const agent of this.agents.values()) {
+            for (const tool of this.availableToolsForPresentation(agent.name))
+                names.add(tool.name);
+        }
+        return names;
     }
     /**
      * Handle a tools/list_changed notification with collapse logic.
@@ -12502,6 +13707,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: `mcpl:${serverId}`,
                 result: { success: false, error: `MCPL server not found: ${serverId}`, isError: true },
@@ -12515,6 +13721,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: `mcpl:${serverId}`,
                 result: {
@@ -12652,6 +13859,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: `mcpl:${serverId}`,
                 result: {
@@ -12670,6 +13878,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: `mcpl:${serverId}`,
                 result: { success: false, error: err.message, isError: true },
@@ -12700,6 +13909,7 @@ export class AgentFramework {
                 this.pushEvent({
                     type: 'tool-result',
                     callId: call.id,
+                    toolName: call.name,
                     agentName,
                     moduleName: 'channels',
                     result: { success: false, error, isError: true },
@@ -12763,6 +13973,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'channels',
                 result,
@@ -12775,6 +13986,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'channels',
                 result: { success: false, error: err.message, isError: true },
@@ -12795,7 +14007,7 @@ export class AgentFramework {
                 module: 'gate', tool: call.name, callId: call.id, durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'gate', result });
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
         };
         try {
             if (call.name === 'wake_remove_rule') {
@@ -12953,9 +14165,10 @@ export class AgentFramework {
                 }
                 : { success: false, error: r.error, isError: false };
         }
-        this.queue.push({
+        this.pushEvent({
             type: 'tool-result',
             callId: call.id,
+            toolName: call.name,
             agentName,
             moduleName: 'tune-out',
             result,
@@ -12967,7 +14180,7 @@ export class AgentFramework {
         const input = (call.input ?? {});
         const finish = (result) => {
             this.emitTrace({ type: 'tool:completed', module: 'gate', tool: call.name, callId: call.id, durationMs: 0 });
-            this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'gate', result });
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
         };
         if (call.name === 'wake') {
             const was = gate.clearSleep();
@@ -12997,7 +14210,7 @@ export class AgentFramework {
             else if (agent?.proseRouting === 'explicit') {
                 // Explicit mode: announce to the turn's sticky prose target if the
                 // model has set one; otherwise stay quiet — never guess a channel.
-                const target = this.proseTargetPins.get(agentName);
+                const target = this.turnRouting.get(agentName)?.pin;
                 if (target) {
                     this.channelRegistry.routeSpeech(agentName, text, target).catch((err) => {
                         console.error('[sleep] announce failed:', err instanceof Error ? err.message : err);
@@ -13067,7 +14280,7 @@ export class AgentFramework {
                 ...(result.isError ? { error: result.error } : {}),
             });
             this.pushEvent({
-                type: 'tool-result', callId: call.id, agentName, moduleName: 'workspace',
+                type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace',
                 result: { ...result, isError: result.isError ?? false },
             });
         })();
@@ -13083,7 +14296,7 @@ export class AgentFramework {
                 durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'workspace', result });
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace', result });
         };
         void (async () => {
             try {
@@ -13106,7 +14319,11 @@ export class AgentFramework {
                 if (typeof workspace.handleToolCall === 'function' &&
                     typeof workspace.getTools === 'function' &&
                     workspace.getTools().some((tool) => tool.name === 'read_image')) {
-                    const result = await workspace.handleToolCall({ ...call, name: 'read_image' });
+                    // The workspace module's own handler, called directly: its result
+                    // gets the same check a module's result gets in the registry. The
+                    // agent's name is for the check's log line, not the handler.
+                    const moduleCall = { ...call, name: 'read_image' };
+                    const result = storableToolResult({ ...moduleCall, callerAgentName: agentName }, await workspace.handleToolCall(moduleCall));
                     if (result.success && Array.isArray(result.data)) {
                         const image = result.data.find((block) => typeof block === 'object' && block !== null &&
                             block.type === 'image' &&
@@ -13144,11 +14361,7 @@ export class AgentFramework {
                 });
             }
             catch (error) {
-                finish({
-                    success: false,
-                    error: error instanceof Error ? error.message : String(error),
-                    isError: true,
-                });
+                finish(thrownResult(error));
             }
         })();
     }
@@ -13212,7 +14425,7 @@ export class AgentFramework {
                 durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'workspace', result });
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace', result });
         };
         void (async () => {
             try {
@@ -13453,20 +14666,35 @@ export class AgentFramework {
                 for (const image of found) {
                     const destination = pathFor(image.rangeOffset);
                     const bytes = Buffer.from(image.data, 'base64');
-                    const result = await workspace.writeBinary(destination, bytes, image.mediaType);
-                    if (!result.success) {
-                        finish({
-                            success: false,
-                            error: `save_recent_image: failed writing "${destination}": ${result.error}` +
-                                (savedFiles.length > 0
-                                    ? ` (already saved: ${savedFiles.map((f) => f.path).join(', ')})`
-                                    : ''),
-                            isError: true,
-                        });
+                    const failed = (why) => finish({
+                        success: false,
+                        error: `save_recent_image: failed writing "${destination}": ${why instanceof Error ? why.message : String(why)}` +
+                            (savedFiles.length > 0
+                                ? ` (already saved: ${savedFiles.map((f) => f.path).join(', ')})`
+                                : ''),
+                        isError: true,
+                    });
+                    let result;
+                    try {
+                        result = await workspace.writeBinary(destination, bytes, image.mediaType);
+                    }
+                    catch (error) {
+                        // Thrown before its tree entry was set; the images before it
+                        // are saved, and the failure says so, as a returned one does.
+                        failed(error);
+                        return;
+                    }
+                    const inChronicle = result.data?.inChronicle === true;
+                    if (!result.success && !inChronicle) {
+                        failed(result.error);
                         return;
                     }
                     savedFiles.push({
                         ...result.data,
+                        path: destination,
+                        size: bytes.byteLength,
+                        mimeType: image.mediaType,
+                        ...(!result.success ? { diskCopyError: result.error ?? 'disk copy failed' } : {}),
                         imageIndex: index + image.rangeOffset,
                         ...image.receipt,
                     });
@@ -13494,7 +14722,7 @@ export class AgentFramework {
      *  (Module.getUtilities). Shared by the model-facing dispatcher and the
      *  programmatic path (executeToolCall), so code_execution scripts and
      *  ephemerals reach utilities too. */
-    async handleUtilsToolCall(agentName, call) {
+    async handleUtilsToolCall(agentName, call, options = {}) {
         const input = (call.input ?? {});
         const utilities = this.moduleRegistry.getAllUtilities();
         const available = () => utilities.length ? utilities.map((u) => u.name).join(', ') : '(none registered)';
@@ -13528,13 +14756,12 @@ export class AgentFramework {
                     };
                 }
                 // Same dispatch as a first-class tool call — the module cannot tell
-                // which surface the call came through.
-                return this.moduleRegistry.handleToolCall({
-                    id: call.id,
-                    name: def.name,
-                    input: args,
-                    callerAgentName: agentName,
-                });
+                // which surface the call came through. An in-process caller gets the
+                // module's own result; the model's path takes its checked form.
+                const utilityCall = { id: call.id, name: def.name, input: args, callerAgentName: agentName };
+                return options.inProcess
+                    ? this.moduleRegistry.handleToolCall(utilityCall)
+                    : this.moduleRegistry.storableToolCall(utilityCall);
             }
             default:
                 return { success: false, isError: true, error: 'action must be "list", "describe", or "run"' };
@@ -13559,6 +14786,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'framework',
                 result,
@@ -13729,6 +14957,7 @@ export class AgentFramework {
         this.pushEvent({
             type: 'tool-result',
             callId: call.id,
+            toolName: call.name,
             agentName,
             moduleName: 'agent',
             result,
@@ -13769,7 +14998,7 @@ export class AgentFramework {
             this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             result = { success: false, error: err.message, isError: true };
         }
-        this.pushEvent({ type: 'tool-result', callId: call.id, agentName, moduleName: 'gate', result });
+        this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
     }
     dispatchGateToolCall(agentName, call) {
         this.emitTrace({ type: 'tool:started', module: 'gate', tool: call.name, callId: call.id, input: call.input });
@@ -13781,6 +15010,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'gate',
                 result,
@@ -13793,6 +15023,7 @@ export class AgentFramework {
             this.pushEvent({
                 type: 'tool-result',
                 callId: call.id,
+                toolName: call.name,
                 agentName,
                 moduleName: 'gate',
                 result: { success: false, error: err.message, isError: true },