@animalabs/agent-framework 0.22.1 → 0.22.2

package/dist/src/framework.js

@@ -5,15 +5,17 @@ import { ReferenceFetcher, DEFAULT_FETCH_MAX_BYTES, EAGER_FETCH_TIMEOUT_MS } fro
 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { JsStore } from '@animalabs/chronicle';
 import { MembraneError } from '@animalabs/membrane';
-import { ContextManager, PassthroughStrategy, WindowedPassthroughStrategy, OverBudgetError, UncoveredDropError } from '@animalabs/context-manager';
+import { ContextManager, PassthroughStrategy, WindowedPassthroughStrategy, OverBudgetError, UncoveredDropError, stripUnpairedToolBlocks } from '@animalabs/context-manager';
 import { SUBCONSCIOUS_TOOLS, SUBCONSCIOUS_TOOL_NAMES } from './tune-out/tools.js';
 import { TuneOutCoordinator, TUNE_OUT_DEFAULTS } from './tune-out/coordinator.js';
+import { bodyGroupRun, bodyRangeIn, locateMessageIndex, locateMessageIndices, removeStoredMessage, removeStoredMessages, } from './stored-removal.js';
 import { ProcessQueueImpl } from './queue.js';
-import { DEFAULT_SHUTDOWN_TIMEOUT_MS, validateShutdownTimeout, shutdownErrorMessage } from './shutdown.js';
+import { DEFAULT_SHUTDOWN_TIMEOUT_MS, validateShutdownTimeout, shutdownErrorMessage, waitForShutdown, ShutdownTimeoutError } from './shutdown.js';
 import { REFUSAL_REACTIONS, REFUSAL_REACTION_FALLBACK, REFUSAL_REACTION_BASELINE } from './refusal-reactions.js';
 import { Agent } from './agent.js';
 import { ModuleRegistry, checkedToolResult, isStateExistsError, storableToolResult, thrownResult } from './module-registry.js';
 import { McplServerRegistry } from './mcpl/server-registry.js';
+import { logValue } from './mcpl/log-value.js';
 import { FeatureSetManager } from './mcpl/feature-set-manager.js';
 import { computeGrant, CapabilityGrant, expandAdvertisementShorthand } from './mcpl/capability-grant.js';
 import { maskNegotiatedCapabilities } from './mcpl/capability-mask.js';
@@ -291,6 +293,7 @@ import { CheckpointManager } from './mcpl/checkpoint-manager.js';
 import { isToolAllowed } from './mcpl/tool-policy.js';
 import { EventGate, formatShadowWarning } from './gate/event-gate.js';
 import { UsageTracker } from './usage/usage-tracker.js';
+import { stderrTailOf, withStderr } from './mcpl/server-connection.js';
 import { isWebSocketTransport } from './mcpl/transport.js';
 import { formatZonedDateTime, resolveTimeZone } from './timezone.js';
 import { DEFAULT_DISCORD_AWARENESS_EMOJI, DiscordAwarenessOutbox, defaultDiscordAwarenessOutboxPath, extractDiscordAwarenessRefs, } from './recovery/discord-awareness-outbox.js';
@@ -338,16 +341,20 @@ function splitExplicitEnvelopes(rawText) {
     return envelopes.filter((envelope) => envelope.trim()).map((envelope) => envelope.replace(/^\s+(?=>>)/, ''));
 }
 /**
- * Whether a stream resumes its logical turn rather than starting one: a budget
- * restart, or a tool-result-guard retry. Such a stream keeps the turn's
- * routing state (the sticky destination, the turn's destination) and queues
- * its deliveries behind the turn's earlier ones.
+ * Whether a stream resumes its turn's request rather than starting one: a
+ * budget restart, or a tool-result-guard retry. Such a start takes in no new
+ * input, and keeps the turn's locus, trigger channel and tool-call count. Its
+ * routing state is the logical turn's, as for every start that continues the
+ * turn (TurnRouting).
  */
 function resumesLogicalTurn(reason) {
     return reason === 'context_budget_restart' || reason === 'tool_result_guard_retry';
 }
 function freshTurnRouting() {
-    return { destination: null, hybridHold: false, logical: { continuation: false, deliveries: [], suppressed: 0 } };
+    return {
+        engaged: new Set(), destination: null, hybridHold: false,
+        continuation: false, deliveries: [], suppressed: 0, arrivals: [],
+    };
 }
 function isTurnContinuation(reason) {
     return reason === 'context_budget_restart' || reason === 'tool_results_ready'
@@ -383,6 +390,110 @@ function normalizeDiscordAwarenessDeadline(value) {
     }
     return Math.max(MIN_DISCORD_AWARENESS_DEADLINE_MS, Math.min(MAX_DISCORD_AWARENESS_DEADLINE_MS, Math.floor(value)));
 }
+/** Messages copied into another conversation (a fork's seed) without their
+ *  `thinking` and `redacted_thinking` blocks: a fork inherits the template's
+ *  conversation, not its reasoning. A signed block was minted under the
+ *  template's prefix, which the fork's doesn't promise to match; unsigned
+ *  reasoning (text-only providers, XML mode) goes by the same rule. On the
+ *  OpenAI Responses path a removed block also carried the reasoning item
+ *  (`rawItem`) the message's other items were paired with by id, so in a
+ *  message that lost its thinking those items lose their `rawItem` and render
+ *  from their fields, without ids; an opaque carrier (a text block whose raw
+ *  item isn't a `message`, such as a compaction) keeps it, since the raw item
+ *  is its whole content. An Anthropic or XML-mode message's thinking carries
+ *  no raw item, and its only raw items are such carriers (membrane keeps a
+ *  block it has no type for, such as a `server_tool_use`, that way), so it
+ *  loses only its thinking. A message with no content left, whether
+ *  the filter emptied it or it was already empty, is left out, since a
+ *  request can't carry an empty message; any other message without thinking
+ *  is kept as it was. */
+function withoutThinking(messages) {
+    const out = [];
+    for (const message of messages) {
+        const content = message.content.filter((b) => !isThinkingBlock(b));
+        if (content.length === 0)
+            continue;
+        out.push(content.length === message.content.length
+            ? message
+            : { ...message, content: content.map(releasePairedRawItem) });
+    }
+    return out;
+}
+function isThinkingBlock(block) {
+    return block.type === 'thinking' || block.type === 'redacted_thinking';
+}
+function rawItemOf(block) {
+    return block.rawItem;
+}
+/** A block without the provider-native item it was parsed from, unless that
+ *  item is the block's whole content: an opaque carrier, a text block whose
+ *  raw item isn't a `message` item (membrane keeps compaction and other items
+ *  it has no block for that way). */
+function releasePairedRawItem(block) {
+    const raw = rawItemOf(block);
+    if (raw === undefined)
+        return block;
+    const rawType = typeof raw === 'object' && raw !== null ? raw.type : undefined;
+    if (block.type === 'text' && rawType !== 'message')
+        return block;
+    const { rawItem: _released, ...rest } = block;
+    return rest;
+}
+/** One log line for a fork's seed that left something out, so an operator who
+ *  sees a fork answer differently from its template has something to check:
+ *  the template's thinking blocks, and the tool blocks the pairing pass
+ *  dropped (calls with no result in the seed, results whose call isn't in
+ *  it). `withoutReasoning` is the seed before that pass, `seed` after it. */
+function logSeedOmissions(fork, template, compiled, withoutReasoning, seed) {
+    const count = (messages, test) => messages.reduce((n, m) => n + m.content.filter(test).length, 0);
+    const thinking = count(compiled, isThinkingBlock);
+    const calls = count(withoutReasoning, (b) => b.type === 'tool_use') - count(seed, (b) => b.type === 'tool_use');
+    const results = count(withoutReasoning, (b) => b.type === 'tool_result') - count(seed, (b) => b.type === 'tool_result');
+    if (thinking + calls + results === 0)
+        return;
+    console.log(`[conversation] ${fork}: seeded from ${template} without ${thinking} thinking block(s), ` +
+        `${calls} unanswered tool call(s) and ${results} orphaned tool result(s)`);
+}
+/**
+ * A maintenance provider call withdrawn because a surgery holds the store, or
+ * because stop() has closed provider admission: either is the framework's own
+ * doing, and no failure. It sent nothing: it was refused at the provider
+ * gate, or woken there from its wait. For a call outside context-manager
+ * 0.14's compression fallback ladder, a merge's or a chunk's canonical call
+ * with its retries after a tool_use stop, context-manager counts no attempt.
+ * A merge keeps its queue entry, so the next tick after the hold, or after
+ * the next start, does it again. A chunk's compression has already left the
+ * queue: it logs "Failed to compress chunk (hierarchical)" with this error
+ * and records the call, and the chunk, still uncompressed, is queued again at
+ * that manager's next rebuild (its next initialization, message, sent compile
+ * or released hold). A call inside the ladder, after a chunk's canonical call
+ * was refused or cut short, is caught by the rung that made it and recorded
+ * as a provider error, since 0.14 rethrows only its own
+ * CompressionBranchDiscard there; once every rung has failed, the chunk's
+ * request family is quarantined, with its alert, and the tick returns.
+ */
+class MaintenanceWithdrawnError extends Error {
+    constructor(reason) {
+        super(`maintenance call withdrawn: ${reason}`);
+        this.name = 'MaintenanceWithdrawnError';
+    }
+}
+/**
+ * A runtime-settings preview's reason, from what stopped it: the strategy's
+ * known throws as the codes `RuntimeSettingsPreview.reason` documents, and
+ * anything else verbatim. Message matching is fragile by nature, so an
+ * unknown message surfaces as the reason rather than being swallowed.
+ */
+function previewStoppedReason(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes('requires reinitialization for the current branch generation'))
+        return 'branch_generation_changed';
+    if (message.includes('already running; previews must not overlap'))
+        return 'preview_in_flight';
+    if (message.includes('requires adaptiveResolution'))
+        return 'no_adaptive_resolution';
+    return message;
+}
 class DiscordAwarenessAccountingError extends Error {
     constructor(operation, cause) {
         const detail = cause instanceof Error ? cause.message : String(cause);
@@ -422,58 +533,32 @@ export class ResumeBlockedError extends Error {
     }
 }
 /**
- * Default inference policy - infer if any request exists for the agent.
+ * How `runEphemeralToCompletion` rejects when a retryable provider failure
+ * states a wait the run won't sleep: one longer than an ephemeral run sleeps
+ * in its turn (600 s), an infinite one, or one that is `NaN`. The run ends at
+ * once, without retrying inside the wait, and every other ending of the run
+ * rejects with a plain `Error`. `retryAfterMs` is the wait as the provider
+ * stated it, in milliseconds, so `Infinity` or `NaN` in those two cases: a
+ * host that schedules a rerun from it handles a value that isn't finite, and
+ * one past the 2,147,483,647 ms a timer can hold. The message says the same
+ * in words. A host can test `instanceof` or the `name`, which also holds for
+ * an error from another copy of this package.
  */
-class DefaultInferencePolicy {
-    shouldInfer(agentName, requests, _state) {
-        return requests.some((r) => r.agentName === agentName);
+export class ProviderWaitNotSleptError extends Error {
+    retryAfterMs;
+    constructor(message, retryAfterMs) {
+        super(message);
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'ProviderWaitNotSleptError';
     }
 }
-const SURGERY_SCAN_WINDOW = 500;
 /**
- * Slot index of `messageId` on the active branch, or -1. Scans from the tail
- * in blob-free windows: operator targets are almost always recent, and a
- * full `getAllMessages()` re-inflates every attachment on the branch.
+ * Default inference policy - infer if any request exists for the agent.
  */
-function locateMessageIndex(cm, messageId) {
-    const hit = locateMessageIndices(cm, new Set([messageId])).get(messageId);
-    return hit ? hit.index : -1;
-}
-/** Tail-first scan resolving many ids at once; stops as soon as all are found. */
-function locateMessageIndices(cm, ids) {
-    const found = new Map();
-    const total = cm.getMessageCount();
-    for (let end = total; end > 0 && found.size < ids.size; end -= SURGERY_SCAN_WINDOW) {
-        const start = Math.max(0, end - SURGERY_SCAN_WINDOW);
-        const { messages, startIndex } = cm.getMessageWindow(start, end - start, { resolveBlobs: false });
-        for (let i = messages.length - 1; i >= 0; i--) {
-            const id = String(messages[i].id);
-            if (ids.has(id) && !found.has(id)) {
-                found.set(id, {
-                    index: startIndex + i,
-                    ...(messages[i].bodyGroupId ? { bodyGroupId: messages[i].bodyGroupId } : {}),
-                });
-            }
-        }
+class DefaultInferencePolicy {
+    shouldInfer(agentName, requests, _state) {
+        return requests.some((r) => r.agentName === agentName);
     }
-    return found;
-}
-/**
- * Inclusive slot range of the body-group run containing `index` (the slot
- * itself when it is not sharded). Delegates to the store's own
- * `alignToBodyGroups` edge walk — one contiguity assumption, not two.
- */
-function bodyGroupRun(cm, index) {
-    const win = cm.getMessageWindow(index, 1, { alignToBodyGroups: true, resolveBlobs: false });
-    const from = win.startIndex;
-    const to = win.startIndex + win.messages.length - 1;
-    return {
-        from,
-        to,
-        fromId: String(win.messages[0].id),
-        toId: String(win.messages[win.messages.length - 1].id),
-        group: win.messages[0].bodyGroupId !== undefined,
-    };
 }
 function describeMarkers(m) {
     if (m.status === 'queued')
@@ -834,18 +919,19 @@ function boundFailureFields(record) {
  *
  * 400 and 422 are how a provider answers a request that fails its
  * validation, as a history it can't accept does, but other refusals come
- * back the same way, such as Anthropic's 400 for a credit balance that's too
- * low. A 413 is the request's size. When the newest exchange made it too
- * large, as an oversized attachment does, shedding that exchange may bring
- * the request back under the limit, and nothing else in the framework
- * recovers a 413; when the history as a whole is too large, the shed doesn't
- * help, and the breaker stops at its rewind cap. The 413 arm takes both
- * labels a 413 arrives under, invalid_request and context_length, because
- * membrane's label for a 413 differs by version and adapter. Other statuses
- * keep the history, since shed history can't be got back and the status
- * gives no sign that a shed would help: a 404 is a model or an endpoint that
- * doesn't exist, and 405, 409, 410 and 415 are about the HTTP request or the
- * resource, as a rule, rather than the conversation.
+ * back the same way, such as a refusal of the account that membrane doesn't
+ * recognize by its text. A 413 is the request's size. When the newest
+ * exchange made it too large, as an oversized attachment does, shedding that
+ * exchange may bring the request back under the limit, and nothing else in
+ * the framework recovers a 413; when the history as a whole is too large,
+ * the shed doesn't help, and the breaker stops at its rewind cap. The 413 arm
+ * takes both labels membranes have given a 413, invalid_request and
+ * context_length (see the notes below). Other statuses keep the history,
+ * since a shed takes the exchange out of the agent's context, which only an
+ * operator's undo brings back, and the status gives no sign that a shed
+ * would help: a 404 is a model or an endpoint that doesn't exist, and 405,
+ * 409, 410 and 415 are about the HTTP request or the resource, as a rule,
+ * rather than the conversation.
  *
  * The table test in test/inference-exhaustion-rewind.test.ts is this
  * predicate's contract. The notes below on which membrane version gives which
@@ -860,13 +946,24 @@ function boundFailureFields(record) {
  *   adapter files every status it doesn't list (404, 405, 409, 410, 413,
  *   415, 422 …) as invalid_request, so it alone produces an invalid_request
  *   at 413 or 422, and no 0.5.86 adapter produces a context_length at 413.
- * - From membrane #56 (merged, not yet in a release), one table serves every
- *   adapter. Auth codes and context overflow are checked on a 400 or 422
- *   first, a 404 is invalid_request, a 413 is context_length, and other 4xx
- *   are invalid_request. So a 413 still sheds, an Anthropic one included,
- *   while a context_length at 400 or 422, a token overflow, keeps the
- *   history. The 422 arm then also covers an OpenAI-compatible server, such
- *   as a FastAPI one, that answers a validation failure with 422.
+ * - From membrane 0.5.87 (membrane #56 and #107), this package's floor, every
+ *   adapter sends an HTTP failure through one status table
+ *   (errorFromProviderStatus). On a 400 or 422, auth codes and reasons and
+ *   the two account refusals it recognizes by their text (a balance too low,
+ *   usage limits reached) are auth, and a context overflow, by its code or
+ *   text, is context_length. A 401, 402 or 403 is auth, a 408 timeout, a 429
+ *   rate_limit, a 404 invalid_request and a 413 context_length; other 4xx
+ *   are invalid_request. So a 413 the table types sheds, an Anthropic one
+ *   included, while a context_length at 400 or 422, a token overflow, keeps
+ *   the history, and so does an account refusal, which is auth. An adapter
+ *   can type a failure before the table does, as Anthropic's does for a
+ *   gateway's aggregate error (server). A failure with no HTTP status takes
+ *   the status its provider code implies when the table knows the code, as
+ *   for Anthropic's mid-stream errors, and is otherwise typed from its
+ *   message, with no status. The 422 arm also covers an
+ *   OpenAI-compatible server, such as a FastAPI one, that answers a
+ *   validation failure with 422. The test of provider answers through the
+ *   table, beside the table test, pins how the two meet at the floor.
  *
  * An error with no status, from a membrane that reports none, keeps the rule
  * the breaker had before: the type alone.
@@ -960,6 +1057,10 @@ export class AgentFramework {
     stopPromise = null;
     stopCompleted = false;
     ownedStoreClosed = false;
+    /** An operator's operations in flight, and the config materializations they
+     * start. stop() waits until this set is empty before it tears down, unless
+     * its wait budget runs out. */
+    operatorOperations = new Set();
     membrane;
     queue;
     agents = new Map();
@@ -967,16 +1068,6 @@ export class AgentFramework {
     inferencePolicy;
     errorPolicy;
     pendingRequests = [];
-    /**
-     * Per-agent channel that triggered the agent's CURRENT inference turn, if any
-     * (item-3 redux). Read by the ChannelRegistry's `activeChannelResolver` to
-     * route a single-trunk agent's plain-text speech back to the channel it is
-     * answering, instead of the process-global most-recent-inbound locus that a
-     * concurrent message elsewhere can hijack. Set at turn start (or cleared for a
-     * heartbeat / no-trigger turn) in startAgentStream; overwritten by the next
-     * turn. Never read between turns (a given agent runs one turn at a time).
-     */
-    activeTriggerChannels = new Map();
     running = false;
     loopPromise = null;
     /** Quiesce/maintenance mode (issue #122). DELIBERATELY separate from
@@ -999,6 +1090,14 @@ export class AgentFramework {
     maintenanceRunId = 0;
     currentMaintenanceRun = null;
     maintenanceHistory = [];
+    /** Each agent's last reported maintenance failure, its whole text and when
+     *  it was alerted, until its maintenance goes without one
+     *  (reportMaintenanceFailure). */
+    maintenanceFailureReported = new Map();
+    /** Run records whose failure repeated one already reported, and whose report was suppressed. */
+    maintenanceRepeats = new WeakSet();
+    /** An operator's maintain (maintenanceTick) asked for the pass running or about to run: the run it records is kept in the history whatever it met. A pass with nothing to run records none. */
+    maintenancePassRequested = false;
     providerGates = new Map();
     providerAccelerationCooldowns = new Map();
     providerAccelerationRecoveries = new Map();
@@ -1020,32 +1119,6 @@ export class AgentFramework {
     processLoggingPersist;
     processLoggingBroadcast;
     activeStreams = new Map();
-    /** Per-agent output locus FROZEN for the CURRENT logical turn. Resolved
-     *  eagerly in startAgentStream (home → addressed trigger → global default)
-     *  and never moved until the next turn: mid-turn injected messages — ambient
-     *  chatter, reactions, system markers — must not hijack where the agent's
-     *  plain prose lands (2026-07-21 Cairn lounge misroute). Lives here — not in
-     *  driveStream locals — so the pin survives a context-budget stream restart,
-     *  which continues the same logical turn in a fresh driveStream. Cleared or
-     *  re-set at the start of every non-restart turn. Since 2026-07-31 the pin
-     *  is no longer fully frozen: an ADDRESSED conversational injection — or a
-     *  conversational follow-up in a channel the agent itself explicitly sent
-     *  into this turn (turnEngagedChannels) — re-pins it at the boundary (see
-     *  the addressed re-pin block in the tool-result handler). Ambient chatter
-     *  elsewhere, reactions, and system markers still cannot move it. */
-    turnLocusPins = new Map();
-    /** Channels the agent EXPLICITLY sent into during the CURRENT turn
-     *  (SEND_ENGAGEMENT_TOOLS, successful calls), per agent. Second re-pin
-     *  signal: a conversational reply in a channel the agent just engaged is
-     *  addressed by context even without a mention (2026-07-31 n=7: q's
-     *  #portables follow-up — no @mention — was answered in trailing prose
-     *  that followed the stale pin into repligate's DM). No author-kind
-     *  filter: agent-residents are full participants, and the bot flag
-     *  tracks nothing that matters (antra). Reactions/system markers are
-     *  excluded by isConversationalInjection; the engaged-this-turn scope
-     *  keeps unrelated channels from moving the pin. Cleared at every fresh
-     *  turn's start; budget restarts keep it. */
-    turnEngagedChannels = new Map();
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
      *  not a reaction or a system marker) into the live stream. Tells
      *  driveStream to clear sticky explicit-send suppression before handling
@@ -1060,12 +1133,13 @@ export class AgentFramework {
     /** Latest bounced (undelivered) prose per agent — the `{{unsent}}` source. */
     proseClipboards = new Map();
     /**
-     * Each agent's routing state for its current turn (TurnRouting): the
-     * sticky destination, the turn's destination for a resumed stream,
-     * hybrid's hold, a `!` continuation and receipt tallies. A fresh turn starts a new object
-     * instead of clearing the old one, and a stream that resumes the turn
-     * (resumesLogicalTurn) keeps it. A queued delivery holds the object of the
-     * turn that queued it, so prose a turn leaves queued when it ends (a
+     * Each agent's routing state for its current logical turn (TurnRouting):
+     * its trigger channel, locus and engaged channels, the sticky destination,
+     * the turn's destination, hybrid's hold, a ` !` continuation and receipt
+     * tallies. The start that opens a turn makes a
+     * new object instead of clearing the old one, and every later stream of
+     * the turn shares it (openLogical). A queued delivery holds the object of
+     * the turn that queued it, so prose a turn leaves queued when it ends (a
      * skip_reply ends it before its posts have run) still follows that turn's
      * destination, and its late writes can't reach the next turn.
      */
@@ -1077,23 +1151,25 @@ export class AgentFramework {
      */
     proseSpeechChains = new Map();
     /**
-     * Each agent's open logical turn (LogicalTurn). It stays open from the
-     * fresh start that opens it until the turn settles (settleAgent: it
-     * completes, a tool ends it, or it fails or is abandoned), and every fresh
-     * start that routes prose while it is open continues it: a framework
-     * retry, the start that consumes tool results the non-streaming fallback
-     * left (whichever wake the scheduler starts it with), the later compile a
-     * provider-capacity hold defers a turn to. A silent start neither
-     * continues nor opens one. A stream that ends without settling needs to do
-     * nothing to carry its turn. Settling only detaches the turn from future
-     * starts: the settling stream keeps its own object, which its remaining
-     * deliveries, its receipt and its ` !` check go on using (a completion
-     * settles before it awaits its chain and writes its receipt). So every
-     * logical end must close inheritance once, before the next fresh start:
-     * a turn left open would hand its object, late writes and all, to an
-     * unrelated turn. A tool-ended turn settles before the next turn can
-     * start. Only the stream that holds the open turn closes it; disposal
-     * drops it, and stop() clears every agent's.
+     * Each agent's open logical turn: its routing state and receipt tallies
+     * (TurnRouting). It stays open from the start that opens it until the
+     * turn settles (settleAgent: it completes, a tool ends it, or it fails or
+     * is abandoned), and every start that routes prose while it is open
+     * continues it with that object: a framework retry, the start that
+     * consumes tool results the non-streaming fallback left (whichever wake
+     * the scheduler starts it with), the later compile a provider-capacity
+     * hold defers a turn to. A silent start neither continues nor opens one,
+     * and leaves the open turn's object untouched (its own is the live routing
+     * while it runs: turnRouting). A stream that ends without
+     * settling needs to do nothing to carry its turn. Settling only detaches
+     * the turn from future starts: the settling stream keeps its own object,
+     * which its remaining deliveries, its receipt and its ` !` check go on
+     * using (a completion settles before it awaits its chain and writes its
+     * receipt). So every logical end must close inheritance once, before the
+     * next fresh start: a turn left open would hand its object, late writes
+     * and all, to an unrelated turn. A tool-ended turn settles before the
+     * next turn can start. Only the stream that holds the open turn closes
+     * it; disposal drops it, and stop() clears every agent's.
      */
     openLogical = new Map();
     /** Consecutive bounce-wakes per agent; capped so an agent that keeps
@@ -1156,6 +1232,8 @@ export class AgentFramework {
      *  tick counts in the success log stop meaning anything. One kick per agent
      *  at a time; cleared when the kick settles (success or failure). */
     overBudgetDrainInFlight = new Set();
+    /** The over-budget drain kicks running, which a branch move waits for as it waits for a maintenance pass. */
+    overBudgetDrains = new Set();
     /** Per-agent current rewind episode: the single consolidated marker's id and
      *  how many turns have been shed so far. One marker per episode, updated in
      *  place (see updateRewindMarker); cleared when the episode ends. */
@@ -1854,11 +1932,16 @@ export class AgentFramework {
         }
     }
     /**
-     * Stop the event loop. Failed module/MCPL cleanup can be retried with its
-     * original context; storage stays open until that cleanup succeeds.
-     * @param teardownTimeoutMs Optional module/MCPL wait budget. Omit to wait
-     * until cleanup settles, as required by existing module/child contracts. This
-     * does not bound earlier stream or event-loop quiescence, or cancel cleanup.
+     * Stop the event loop. After a failed or timed-out wait on operator, module
+     * or MCPL cleanup, storage stays open and stop() can be called again. A
+     * timed-out wait lets teardown go on while that work may still act on what
+     * is being torn down.
+     * @param teardownTimeoutMs Optional budget for each wait on cleanup: an
+     * operator's operations already running, then modules and MCPL together.
+     * Omit to wait until cleanup settles, as required by existing module/child
+     * contracts. This does not bound earlier stream, event-loop or maintenance
+     * quiescence (a maintenance pass or over-budget drain kick in flight), or
+     * cancel cleanup.
      */
     stop(teardownTimeoutMs = DEFAULT_SHUTDOWN_TIMEOUT_MS) {
         try {
@@ -1869,7 +1952,12 @@ export class AgentFramework {
         }
         if (this.stopPromise)
             return this.stopPromise;
-        const attempt = this.stopOwned(teardownTimeoutMs);
+        // Claim the attempt before any of its body runs: stopOwned's synchronous
+        // start can emit traces (the push coalescer's suspend() does), and a
+        // listener that calls stop() there must get this attempt, not start a
+        // second teardown beside it.
+        let settle;
+        const attempt = new Promise((resolve, reject) => { settle = { resolve, reject }; });
         this.stopPromise = attempt;
         void attempt.then(() => { this.stopCompleted = true; }, () => { });
         // Failed cleanup can be retried while its original store is open. A
@@ -1878,6 +1966,9 @@ export class AgentFramework {
             if (!this.ownedStoreClosed && this.stopPromise === attempt)
                 this.stopPromise = null;
         });
+        // The body still starts in this call, so its synchronous steps (closing
+        // the queue among them) happen before stop() returns.
+        this.stopOwned(teardownTimeoutMs).then(settle.resolve, settle.reject);
         return attempt;
     }
     resetCompletedStop() {
@@ -1888,6 +1979,59 @@ export class AgentFramework {
             this.stopCompleted = false;
         }
     }
+    /** Register before invoking the body, so the set holds the operation for
+     * its whole life: its synchronous trace callbacks can reenter stop(), and
+     * that stop() must find it. Invocation stays in this stack, preserving
+     * immediate mode changes; the returned promise carries its result to the
+     * caller. */
+    trackOperatorOperation(label, run) {
+        let resolve;
+        let reject;
+        const operation = new Promise((yes, no) => { resolve = yes; reject = no; });
+        const entry = { label, promise: operation.then(() => { }, () => { }) };
+        this.operatorOperations.add(entry);
+        void entry.promise.then(() => { this.operatorOperations.delete(entry); });
+        try {
+            resolve(run());
+        }
+        catch (error) {
+            reject(error);
+        }
+        return operation;
+    }
+    /** Whether stop() has begun: an attempt in flight (stopPromise is set before
+     * its body runs, which emits traces before the queue closes) or a closed
+     * queue (after a failed or completed stop()). The admission rule for every
+     * operator entry point, the host/command listener included. */
+    stopHasBegun() {
+        return !!this.stopPromise || !!this.queue?.isClosed;
+    }
+    refuseOperatorAfterStop(verb) {
+        if (this.stopHasBegun())
+            throw new Error(verb + ' refused: the framework is stopping');
+    }
+    /** Wait in rounds until the set is empty: admitted work can still start work
+     * of its own. All rounds share the caller's deadline rather than renewing
+     * its budget. */
+    async waitForOperatorOperations(timeoutMs) {
+        const deadline = timeoutMs === undefined ? undefined : performance.now() + timeoutMs;
+        while (this.operatorOperations.size > 0) {
+            const remaining = deadline === undefined ? undefined : Math.ceil(deadline - performance.now());
+            const timedOut = () => new ShutdownTimeoutError([...this.operatorOperations].map(({ label }) => label), timeoutMs, []);
+            if (remaining !== undefined && remaining < 1)
+                throw timedOut();
+            try {
+                await waitForShutdown([...this.operatorOperations], remaining);
+            }
+            catch (error) {
+                // Report the original budget and everything still pending, including
+                // child work added after this round's snapshot.
+                if (error instanceof ShutdownTimeoutError)
+                    throw timedOut();
+                throw error;
+            }
+        }
+    }
     async stopOwned(teardownTimeoutMs) {
         this.pushCoalescer?.suspend();
         this.flushCoalescingSnapshot();
@@ -1928,8 +2072,10 @@ export class AgentFramework {
         // A stopped host must never hang behind its own cooldown.
         this.cancelProviderAdmission();
         // An open logical turn doesn't survive a stop: a start after a restart
-        // on this instance opens a new one rather than carrying its ` !` and
-        // receipt tallies across (openLogical).
+        // on this instance opens a new one rather than continuing the old turn's
+        // routing (openLogical). A resume still continues its turn, with its
+        // routing state (turnRouting), since it carries that turn's own request
+        // on: beginAgentTurn opens the turn again for it.
         this.openLogical.clear();
         // Cancel all active streams
         for (const agent of this.agents.values()) {
@@ -1951,12 +2097,25 @@ export class AgentFramework {
             clearInterval(this.maintenanceTimer);
             this.maintenanceTimer = null;
         }
-        if (this.maintenancePass) {
-            await this.maintenancePass;
-        }
+        // The pass and any over-budget drain kick: a compression in flight lands
+        // before the store closes.
+        await this.settleMaintenancePass();
         if (this.loopPromise) {
             await this.loopPromise;
         }
+        // Admission closed when stop() began. What admitted operations start now,
+        // such as a surgery's config materialization, joins the set, so wait until
+        // the set is empty. This comes after the streams and the event loop, which
+        // a quiesce or a surgery may be waiting on. If the budget runs out,
+        // teardown goes on while the operation may still act on what it tears
+        // down, and the store stays open for another stop().
+        let operatorOperationsTimedOut;
+        try {
+            await this.waitForOperatorOperations(teardownTimeoutMs);
+        }
+        catch (error) {
+            operatorOperationsTimedOut = error;
+        }
         // Stop typing indicators
         this.channelRegistry?.stopAll();
         // Dispose EventGate (clear debounce timers)
@@ -1981,7 +2140,7 @@ export class AgentFramework {
         }
         // Timed-out or failed teardown retains its context and may still write.
         // Sync available state best-effort, but leave its store open for a retry.
-        const shutdownErrors = [];
+        const shutdownErrors = operatorOperationsTimedOut === undefined ? [] : [operatorOperationsTimedOut];
         for (const result of await Promise.allSettled(shutdownPromises)) {
             if (result.status === 'rejected')
                 shutdownErrors.push(result.reason);
@@ -2082,8 +2241,15 @@ export class AgentFramework {
     }
     async withAuxiliaryAdmission(agentName, run, model) {
         const gate = this.providerGate(agentName);
+        // A surgery's hold or a stop withdraws the call before a provider wait
+        // can refuse it: either is the framework's own doing, and no failure.
+        this.withdrawMaintenanceUnderSurgery();
+        this.withdrawMaintenanceWhenStopping(agentName);
         this.refuseHeldProviderModel(agentName, model);
-        if (this.providerGateBlocked(agentName)) {
+        // A parked call is woken when the gate opens, when stop() closes
+        // admission, or when a surgery takes the store; one woken while the gate
+        // is still closed parks again.
+        while (this.providerGateBlocked(agentName)) {
             gate.deferredAuxiliary++;
             try {
                 await new Promise((resolve) => gate.auxiliaryWaiters.push(resolve));
@@ -2091,10 +2257,12 @@ export class AgentFramework {
             finally {
                 gate.deferredAuxiliary = Math.max(0, gate.deferredAuxiliary - 1);
             }
+            if (this.providerAdmissionClosed)
+                break;
+            // A surgery that took the store while this call was parked withdraws it.
+            this.withdrawMaintenanceUnderSurgery();
         }
-        if (this.providerAdmissionClosed) {
-            throw new Error(`Provider admission closed while stopping (${agentName})`);
-        }
+        this.withdrawMaintenanceWhenStopping(agentName);
         // A wait recorded while this call was parked binds it too.
         this.refuseHeldProviderModel(agentName, model);
         gate.auxiliaryInFlight++;
@@ -2121,6 +2289,28 @@ export class AgentFramework {
                     resolve();
         }
     }
+    /**
+     * Maintenance makes no provider call while a surgery holds the store. The
+     * surgery waits for the maintenance work that is running before it moves
+     * the branch, so a call that parked at the gate would make it wait on
+     * whatever reopens the gate: the end of a cooldown, or the retry turn a
+     * cooldown queues, which the hold itself keeps from starting.
+     */
+    withdrawMaintenanceUnderSurgery() {
+        if (this.surgeryHold) {
+            throw new MaintenanceWithdrawnError(`a live ${this.surgeryHold.verb} for ${this.surgeryHold.agentName} holds the store`);
+        }
+    }
+    /**
+     * Nor once stop() has closed provider admission: a stop that catches a
+     * tick is the framework stopping on purpose, so the call is withdrawn, as
+     * under a surgery's hold, and no failure is reported for it.
+     */
+    withdrawMaintenanceWhenStopping(agentName) {
+        if (this.providerAdmissionClosed) {
+            throw new MaintenanceWithdrawnError(`provider admission closed while stopping (${agentName})`);
+        }
+    }
     auxiliaryMembraneFor(agentName) {
         return this.membraneAdmitting((run, model) => this.withAuxiliaryAdmission(agentName, run, model));
     }
@@ -2132,10 +2322,16 @@ export class AgentFramework {
      * as a resident's are, so they bind its auxiliary calls too: a held model
      * is refused without a call, and an auxiliary call's own stated wait is
      * recorded for it. (An ephemeral run records nothing, its name being
-     * single-use, so its context manager keeps the plain membrane.)
+     * single-use, so its context manager keeps the plain membrane.) Its
+     * compression is the background work a resident's is, whether a
+     * maintenance tick or a drain after a message starts it, so it is withdrawn
+     * as a resident's is: a call made while a surgery holds the store, or once
+     * stop() has closed provider admission, is withdrawn without being sent.
      */
     conversationAuxiliaryMembraneFor(agentName) {
         return this.membraneAdmitting(async (run, model) => {
+            this.withdrawMaintenanceUnderSurgery();
+            this.withdrawMaintenanceWhenStopping(agentName);
             this.refuseHeldProviderModel(agentName, model);
             try {
                 return await run();
@@ -2311,17 +2507,26 @@ export class AgentFramework {
         return undefined;
     }
     /** Why an ephemeral run ended instead of sleeping a provider's stated wait,
-     *  for its caller. */
+     *  for its caller: the text, and the wait itself, which its rejection
+     *  carries (ProviderWaitNotSleptError). */
     statedWaitNotSlept(error) {
-        const stated = isMembraneError(error) ? error.retryAfterMs : undefined;
+        // Called only after nonOwningProviderWait answered 'fail', which takes a
+        // numeric stated wait.
+        const stated = isMembraneError(error) && typeof error.retryAfterMs === 'number' ? error.retryAfterMs : Number.NaN;
         const cap = `${PROVIDER_ACCELERATION_MAX_COOLDOWN_MS / 1000} s`;
-        if (typeof stated !== 'number' || Number.isNaN(stated)) {
-            return `${error.message} (the provider's stated wait is not a number, and an ephemeral run sleeps only a ` +
-                `stated wait of ${cap} or less, so it ends now)`;
+        if (Number.isNaN(stated)) {
+            return {
+                error: `${error.message} (the provider's stated wait is not a number, and an ephemeral run sleeps only a ` +
+                    `stated wait of ${cap} or less, so it ends now)`,
+                statedWaitMs: Number.NaN,
+            };
         }
         const asked = Number.isFinite(stated) ? `${Math.ceil(stated / 1000)} s` : 'longer than can be represented';
-        return `${error.message} (the provider asked to wait ${asked}; an ephemeral run doesn't sleep a stated wait ` +
-            `longer than ${cap}, so it ends now)`;
+        return {
+            error: `${error.message} (the provider asked to wait ${asked}; an ephemeral run doesn't sleep a stated wait ` +
+                `longer than ${cap}, so it ends now)`,
+            statedWaitMs: stated,
+        };
     }
     /** When a hold's timer next fires: at its deadline, stepped past what one
      *  timer can hold. A hold with no deadline (a wait held until released, or
@@ -2627,7 +2832,28 @@ export class AgentFramework {
                 this.maintenancePass = null;
         });
     }
+    /** resume()'s refusal while a surgery holds the store. */
+    refuseResumeUnderSurgery() {
+        if (!this.surgeryHold)
+            return;
+        throw new OperatorActionError('agent-busy', `Cannot resume: a live ${this.surgeryHold.verb} for ${this.surgeryHold.agentName} holds the store — retry when it completes`);
+    }
+    /** Whether maintenance work is running: a pass, or an over-budget drain kick. */
+    maintenanceRunning() {
+        return this.maintenancePass !== null || this.overBudgetDrains.size > 0;
+    }
+    /** Wait for the maintenance work that is running, whatever its outcome. */
+    async settleMaintenancePass() {
+        await Promise.allSettled([...(this.maintenancePass ? [this.maintenancePass] : []), ...this.overBudgetDrains]);
+    }
     async runQueuedMaintenance() {
+        // A surgery holds the store while it switches or forks a branch. No pass
+        // starts while it's held (the timer's next pass after it runs as usual),
+        // and a running pass starts no new tick. The surgery waits for that pass
+        // to finish before it moves the branch, so no maintenance work overlaps
+        // the move, and a failure a pass meets is never the surgery's doing.
+        if (this.surgeryHold)
+            return;
         // A guard whose agent has left the map gets no activation to retry its
         // queue; retry it here. It leaves busyGuards once nothing of it is left.
         const live = new Set([...this.agents.values()].map((agent) => agent.toolResultGuard));
@@ -2641,6 +2867,10 @@ export class AgentFramework {
                 console.error(`[tool-result-guard] agent=${name} storage retry failed during maintenance:`, error);
             }
         }
+        for (const name of this.maintenanceFailureReported.keys()) {
+            if (!this.agents.has(name))
+                this.maintenanceFailureReported.delete(name);
+        }
         const queued = [...this.agents.values()].flatMap((agent) => {
             try {
                 agent.toolResultGuard.flushUnrecorded();
@@ -2648,28 +2878,53 @@ export class AgentFramework {
             catch (error) {
                 console.error(`[tool-result-guard] agent=${agent.name} storage retry failed during maintenance:`, error);
             }
-            const cm = agent.getContextManager();
-            const tools = this.compressionToolsForAgent(agent.name);
-            cm.setToolDefinitions(tools);
-            if (this.providerGateBlocked(agent.name))
-                return [];
-            if (cm.isReady())
+            // Whatever throws while one agent's maintenance is prepared is that
+            // agent's failure, reported for it alone, while the others run.
+            const failedAgent = (error) => {
+                const record = {
+                    agentName: agent.name,
+                    startedAt: Date.now(),
+                    ticks: 0,
+                    readyBefore: false,
+                };
+                record.finishedAt = record.startedAt;
+                this.reportMaintenanceFailure(agent.name, record, error instanceof Error ? String(error.message) : failureDescription(error));
+                return [{ agent, record, failed: true }];
+            };
+            let cm;
+            let state;
+            try {
+                cm = agent.getContextManager();
+                const tools = this.compressionToolsForAgent(agent.name);
+                cm.setToolDefinitions(tools);
+                if (this.providerGateBlocked(agent.name))
+                    return [];
+                state = this.contextReadiness(cm);
+            }
+            catch (error) {
+                return failedAgent(error);
+            }
+            if ('ready' in state && state.ready) {
+                this.maintenanceFailureReported.delete(agent.name);
                 return [];
-            const pending = cm.getPendingWork()?.description;
+            }
             const progress = this.contextProgress(cm);
             const record = {
                 agentName: agent.name,
                 startedAt: Date.now(),
                 ticks: 0,
                 readyBefore: false,
-                ...(pending ? { pendingBefore: pending } : {}),
+                ...('pending' in state && state.pending ? { pendingBefore: state.pending } : {}),
                 ...(progress ? { progressBefore: progress } : {}),
             };
-            return [{
-                    agent,
-                    cm,
-                    record,
-                }];
+            if ('error' in state) {
+                // Its readiness can't be read: that agent's failure, reported for it
+                // alone, while the others run.
+                record.finishedAt = Date.now();
+                this.reportMaintenanceFailure(agent.name, record, state.error);
+                return [{ agent, record, failed: true }];
+            }
+            return [{ agent, cm, record, failed: false }];
         });
         if (queued.length === 0)
             return;
@@ -2680,54 +2935,141 @@ export class AgentFramework {
         };
         this.currentMaintenanceRun = run;
         try {
-            await Promise.all(queued.map(async ({ agent, cm, record }) => {
+            const running = queued.filter((item) => !item.failed);
+            // Settled, not all: the pass ends only when every agent's work has.
+            const outcomes = await Promise.allSettled(running.map(async ({ agent, cm, record }) => {
+                // A tick whose provider call a surgery or stop() withdrew ends this
+                // agent's work for the pass, as the hold or the stop would have before
+                // its next tick: it is no failure, and what the failure reports
+                // remember stays as it is.
+                let withdrawn = false;
                 try {
-                    for (let i = 0; i < MAINTENANCE_TICKS_PER_PASS && this.running && !cm.isReady(); i++) {
+                    for (let i = 0; i < MAINTENANCE_TICKS_PER_PASS && this.running && !this.surgeryHold && !cm.isReady(); i++) {
                         await cm.tick();
                         record.ticks++;
                     }
                 }
                 catch (error) {
-                    const wholeError = error instanceof Error ? String(error.message) : failureDescription(error);
-                    record.error = boundFailureText(wholeError);
-                    console.error(`[context-maintenance] agent=${agent.name} failed:`, record.error);
-                    this.opsAlert('context-maintenance-failed', agent.name, wholeError, {
-                        data: {
-                            scope: 'agent',
-                            ...(record.pendingBefore ? { pending: record.pendingBefore } : {}),
-                            ...(record.progressBefore ? { progress: record.progressBefore } : {}),
-                        },
-                    });
+                    if (error instanceof MaintenanceWithdrawnError) {
+                        withdrawn = true;
+                        console.error(`[context-maintenance] agent=${agent.name} stopped: ${error.message}`);
+                    }
+                    else {
+                        this.reportMaintenanceFailure(agent.name, record, error instanceof Error ? String(error.message) : failureDescription(error));
+                    }
                 }
                 finally {
-                    const pending = cm.getPendingWork()?.description;
                     record.finishedAt = Date.now();
-                    record.readyAfter = cm.isReady();
-                    if (pending)
-                        record.pendingAfter = pending;
+                    const state = this.contextReadiness(cm);
+                    if ('error' in state) {
+                        // A run records an agent's first failure: a readiness refusal
+                        // after a tick that failed is read again by the next pass.
+                        if (record.error === undefined && !withdrawn)
+                            this.reportMaintenanceFailure(agent.name, record, state.error);
+                    }
+                    else {
+                        record.readyAfter = state.ready;
+                        if (state.pending)
+                            record.pendingAfter = state.pending;
+                        if (record.error === undefined && !withdrawn)
+                            this.maintenanceFailureReported.delete(agent.name);
+                    }
                     const progress = this.contextProgress(cm);
                     if (progress)
                         record.progressAfter = progress;
                 }
             }));
+            for (const outcome of outcomes) {
+                if (outcome.status === 'rejected') {
+                    console.error('[context-maintenance] reporting an agent\'s failure failed:', describeFailureWithFrames(outcome.reason));
+                }
+            }
         }
         finally {
             run.finishedAt = Date.now();
             run.agents.sort((a, b) => a.agentName.localeCompare(b.agentName));
             this.currentMaintenanceRun = null;
-            this.maintenanceHistory.unshift(run);
+            // A pass that only met failures already reported, and took no tick,
+            // adds nothing the history doesn't hold, and a lasting failure would
+            // otherwise fill it in minutes, pushing out the runs that did work. One
+            // an operator asked for is kept: it's the pass their maintain reports.
+            const requested = this.maintenancePassRequested;
+            this.maintenancePassRequested = false;
+            if (requested || !run.agents.every((record) => record.ticks === 0 && this.maintenanceRepeats.has(record)))
+                this.maintenanceHistory.unshift(run);
             if (this.maintenanceHistory.length > 50)
                 this.maintenanceHistory.length = 50;
         }
     }
+    /**
+     * One agent's maintenance failure: recorded on its run, bounded as every
+     * failure sink is (`record.error`), and logged and alerted for that agent
+     * with the whole text. A failure that lasts, such as a manager whose
+     * strategy failed to initialize, meets every pass, a few seconds apart. It
+     * is logged and alerted again only when its whole text changes, once
+     * opsAlert's cooldown for it has passed since the webhook last posted it
+     * (so the webhook, which posts a kind at most once per cooldown, hears a
+     * failure that lasts), or after a pass in which that agent's maintenance
+     * went without a failure (maintenanceFailureReported). A record whose
+     * failure isn't reported again is marked as a repeat, and a pass whose
+     * every record is a repeat that took no tick stays out of the history.
+     */
+    reportMaintenanceFailure(agentName, record, wholeError) {
+        record.error = boundFailureText(wholeError);
+        const reported = this.maintenanceFailureReported.get(agentName);
+        const now = Date.now();
+        if (reported && reported.text === wholeError) {
+            // The same failure again is alerted once the webhook's cooldown for it
+            // has passed, counted from the webhook's last post of it: a report of
+            // changed text that the webhook didn't post doesn't push the reminder
+            // back. With no webhook, it's counted from this failure's last report.
+            const since = this.opsAlertLastSent.get(`${agentName}:context-maintenance-failed`) ?? reported.at;
+            if (now - since < this.opsAlertCooldownMs) {
+                this.maintenanceRepeats.add(record);
+                return;
+            }
+        }
+        this.maintenanceFailureReported.set(agentName, { text: wholeError, at: now });
+        console.error(`[context-maintenance] agent=${agentName} failed:`, record.error);
+        this.opsAlert('context-maintenance-failed', agentName, wholeError, {
+            data: {
+                scope: 'agent',
+                ...(record.pendingBefore ? { pending: record.pendingBefore } : {}),
+                ...(record.progressBefore ? { progress: record.progressBefore } : {}),
+            },
+        });
+    }
+    /**
+     * An agent's context readiness, or the error that reading it threw. The
+     * context manager refuses while its strategy's initialization is pending
+     * or has failed (context-manager 0.14), and a strategy can refuse on its
+     * own, as the autobiographical one does after a store-level branch switch
+     * it hasn't reloaded for. Every such throw is that agent's failure.
+     */
+    contextReadiness(cm) {
+        try {
+            const ready = cm.isReady();
+            const pending = ready ? undefined : cm.getPendingWork()?.description;
+            return pending ? { ready, pending } : { ready };
+        }
+        catch (error) {
+            return { error: error instanceof Error ? String(error.message) : failureDescription(error) };
+        }
+    }
+    /** The strategy's progress snapshot, for diagnostics: one it can't give reads as none. */
     contextProgress(cm) {
-        const strategy = cm.getStrategy();
-        if (typeof strategy.getProgressSnapshot !== 'function')
+        try {
+            const strategy = cm.getStrategy();
+            if (typeof strategy.getProgressSnapshot !== 'function')
+                return undefined;
+            const progress = strategy.getProgressSnapshot();
+            return progress && typeof progress === 'object'
+                ? progress
+                : undefined;
+        }
+        catch {
             return undefined;
-        const progress = strategy.getProgressSnapshot();
-        return progress && typeof progress === 'object'
-            ? progress
-            : undefined;
+        }
     }
     /**
      * A server's request or notification the host couldn't handle, answered
@@ -3431,14 +3773,15 @@ export class AgentFramework {
                         `advance merges to go lower). Applying; the live compile budget is unchanged.`);
                 }
             }
-            else if (preview.reason) {
+            else if (preview.reason && agent.contextManagerAnswers()) {
+                // A manager that refuses its queries refuses the update below too.
                 console.warn(`[budget-preflight] preview unavailable for ${agentName} (${preview.reason}); ` +
                     `applying without preflight`);
             }
         }
         const result = agent.updateRuntimeSettings(patch);
         if (opts?.persist !== false) {
-            this.persistAgentRuntimeSettings(agentName, agent.getRuntimeSettingsOverrides());
+            this.persistAgentRuntimeSettings(agentName, this.persistedRuntimeSettingsOf(agent));
         }
         this.recordOperatorAction({
             kind: 'settings-update',
@@ -3455,7 +3798,7 @@ export class AgentFramework {
             throw new Error(`Unknown agent: ${agentName}`);
         const result = agent.resetRuntimeSettings(keys);
         if (opts?.persist !== false) {
-            this.persistAgentRuntimeSettings(agentName, agent.getRuntimeSettingsOverrides());
+            this.persistAgentRuntimeSettings(agentName, this.persistedRuntimeSettingsOf(agent));
         }
         this.recordOperatorAction({
             kind: 'settings-reset',
@@ -3471,7 +3814,7 @@ export class AgentFramework {
         if (!agent)
             throw new Error(`Unknown agent: ${agentName}`);
         const result = agent.cancelRuntimeSettingsTransition();
-        this.persistAgentRuntimeSettings(agentName, agent.getRuntimeSettingsOverrides());
+        this.persistAgentRuntimeSettings(agentName, this.persistedRuntimeSettingsOf(agent));
         this.recordOperatorAction({
             kind: 'settings-cancel-transition',
             agent: agentName,
@@ -3547,6 +3890,10 @@ export class AgentFramework {
      * inference-failure accounting.
      */
     async quiesce(opts) {
+        this.refuseOperatorAfterStop('quiesce');
+        return this.trackOperatorOperation('host:quiesce', () => this.runQuiesce(opts));
+    }
+    async runQuiesce(opts) {
         if (this.quiesced) {
             // Idempotent — EXCEPT abandon escalation: a first quiesce that timed
             // out undrained must be escalatable with a second quiesce({abandon})
@@ -3594,6 +3941,7 @@ export class AgentFramework {
         // latter becomes a turn the moment its auxiliary settles unless the
         // continuation's quiesce recheck requeues it — wait for that to happen).
         while (this.quiesced &&
+            !this.queue?.isClosed &&
             (this.activeTurnTokens.size > 0 || this.parkedAdmissionCount() > 0) &&
             Date.now() < deadline) {
             await new Promise((resolve) => setTimeout(resolve, 250));
@@ -3606,6 +3954,13 @@ export class AgentFramework {
             console.error('[host-mode] quiesce superseded by a concurrent resume during drain');
             return this.getHostModeStatus();
         }
+        // Stop cuts this drain short, including any requested abandon. It cancels
+        // streams and waits for the event loop; a token with no stream settles
+        // on its own. Return the status as it stands and keep the durable quiesce.
+        if (this.queue?.isClosed) {
+            console.error('[host-mode] quiesce stopped waiting for its drain: the framework is stopping');
+            return this.getHostModeStatus();
+        }
         let abandoned = false;
         let unabandonable = [];
         if (this.activeTurnTokens.size > 0 && opts?.abandon) {
@@ -3657,9 +4012,11 @@ export class AgentFramework {
                     `(status=${state?.status ?? 'unknown'}) — it must settle on its own`);
             }
         }
-        // Bounded grace for the cancelled streams' teardown to settle.
+        // Bounded grace for cancelled streams. Stop cancels streams too; a turn
+        // with no stream settles on its own. Report the abandon that already ran,
+        // even if stop cuts its grace short.
         const grace = Date.now() + 10_000;
-        while (this.quiesced && this.activeTurnTokens.size > 0 && Date.now() < grace) {
+        while (this.quiesced && !this.queue?.isClosed && this.activeTurnTokens.size > 0 && Date.now() < grace) {
             await new Promise((resolve) => setTimeout(resolve, 250));
         }
         // Only turns still alive after the grace are worth reporting.
@@ -3675,18 +4032,32 @@ export class AgentFramework {
      * strategy cannot preview would hold hosts hostage to a diagnostic.
      */
     async resume(opts) {
+        this.refuseOperatorAfterStop('resume');
+        return this.trackOperatorOperation('host:resume', () => this.runResume(opts));
+    }
+    async runResume(opts) {
         if (!this.quiesced)
             return this.getHostModeStatus();
+        // A surgery switches or forks the branch while it holds the store, and a
+        // manager whose initialization that left pending refuses its settings
+        // read: resume once it's done, as the other operator calls do. Checked
+        // again after the waits below, since a surgery can take the store while
+        // resume waits for a pass or a preview.
+        this.refuseResumeUnderSurgery();
         // The canonical operator flow is `maintain; resume`, and a timer-driven
         // pass may still be mid-flight: previewContext refuses to overlap one
         // ("already running"), which used to degrade the gate to "no opinion".
         // Wait for the pass first, then retry a few times for the case where a
         // fresh pass started in between.
-        if (this.maintenancePass) {
-            await this.maintenancePass.catch(() => { });
-        }
+        if (this.maintenanceRunning())
+            await this.settleMaintenancePass();
         const failing = [];
         for (const agentName of this.agents.keys()) {
+            // A preview that isn't available gives no verdict, and resume goes on
+            // for the others. That includes an agent whose context manager refuses
+            // its queries, as when its strategy failed to initialize: that manager
+            // refuses its compiles and writes until a switchBranch or setStrategy
+            // succeeds, so the agent can't run over budget, and maintenance reports it.
             let preview = this.previewAgentRuntimeSettings(agentName);
             for (let attempt = 0; attempt < 8 && !preview.available && preview.reason === 'preview_in_flight'; attempt++) {
                 await new Promise((resolve) => setTimeout(resolve, 250));
@@ -3702,6 +4073,13 @@ export class AgentFramework {
                     `(${preview.reason}) — proceeding without a verdict`);
             }
         }
+        this.refuseResumeUnderSurgery();
+        // stop() closes the queue first. If it has begun, before this call or
+        // during the waits above, leave the host quiesced, as it will boot,
+        // rather than reopen what stop() is closing.
+        if (this.queue?.isClosed) {
+            throw new Error('resume refused: the framework is stopping, so the host stays quiesced');
+        }
         if (failing.length > 0 && !opts?.force) {
             const detail = failing.map(({ agentName, preview }) => `${agentName}: folded floor ${preview.effective.finalTokens} > hard budget ` +
                 `${preview.effective.budgetTokens}` +
@@ -3749,9 +4127,10 @@ export class AgentFramework {
                     this.completeMcplDataPlaneGate(barrier);
                 }
                 catch (error) {
-                    // The host IS resumed — don't rethrow. failMcplDataPlaneGate
-                    // recycles the connections, and their reconnect flows re-run the
-                    // funnel with quiesced=false, self-healing the data planes.
+                    // The host has resumed, so report the failed barrier without undoing
+                    // that. While serving, failMcplDataPlaneGate recycles the
+                    // connections and their reconnect flows reopen the data planes;
+                    // while the host stops, it releases the barrier instead.
                     await this.failMcplDataPlaneGate(barrier, 'quiesce resume', error);
                 }
             }
@@ -3764,7 +4143,9 @@ export class AgentFramework {
             // mid-quiesce boots quiesced but with these queues empty (sources like
             // heartbeats re-deliver on their own cadence; one-shot wakes are lost).
             // Deferred context WRITES are persisted while quiesced and survive.
-            console.error(`[host-mode] resumed — ${releasedRequests} parked wake(s) released`);
+            console.error(this.queue?.isClosed
+                ? `[host-mode] resumed — ${releasedRequests} parked wake(s) won't run because the framework is stopping`
+                : `[host-mode] resumed — ${releasedRequests} parked wake(s) released`);
         }
         return this.getHostModeStatus();
     }
@@ -4057,26 +4438,38 @@ export class AgentFramework {
      * true in quiesce mode precisely so this machinery stays hot.
      */
     async maintenanceTick() {
+        // A pass already running is stop()'s to wait for; a new one isn't started.
+        this.refuseOperatorAfterStop('maintain');
         if (!this.running) {
-            // startQueuedMaintenance no-ops on a stopped/never-started framework —
-            // a bare snapshot would masquerade as a completed pass, so say so.
+            // startQueuedMaintenance no-ops on a framework that was never started
+            // (a stopping one is refused above): a bare snapshot would masquerade
+            // as a completed pass, so say so.
             console.warn('[host-mode] maintenanceTick: framework is not running — no pass executed');
             return { ...this.getContextMaintenanceSnapshot(), ran: false };
         }
+        if (this.surgeryHold) {
+            // No pass starts while a surgery holds the store (runQueuedMaintenance).
+            console.warn(`[host-mode] maintenanceTick: a ${this.surgeryHold.verb} for ${this.surgeryHold.agentName} holds the store — no pass executed`);
+            return { ...this.getContextMaintenanceSnapshot(), ran: false };
+        }
+        this.maintenancePassRequested = true;
         this.startQueuedMaintenance();
         await this.maintenancePass;
+        // A pass with nothing queued records no run, and the next pass wasn't asked for.
+        this.maintenancePassRequested = false;
         return { ...this.getContextMaintenanceSnapshot(), ran: true };
     }
     /** Counts-only context-maintenance diagnostics for authenticated debug UIs. */
     getContextMaintenanceSnapshot() {
         const agents = [...this.agents.values()].map((agent) => {
             const cm = agent.getContextManager();
-            const pending = cm.getPendingWork()?.description;
+            const state = this.contextReadiness(cm);
             const progress = this.contextProgress(cm);
             return {
                 agentName: agent.name,
-                ready: cm.isReady(),
-                ...(pending ? { pending } : {}),
+                ...('error' in state
+                    ? { ready: false, error: boundFailureText(state.error) }
+                    : { ready: state.ready, ...(state.pending ? { pending: state.pending } : {}) }),
                 ...(progress ? { progress } : {}),
             };
         });
@@ -4093,13 +4486,28 @@ export class AgentFramework {
      * were activated right now — WITHOUT running inference, opening a stream, or
      * mutating agent state. Intended for debug/preview tooling.
      *
-     * Transparency contract (default): the preview is side-effect-free and
-     * leaves no trace on the system. It does only read-only work —
-     * `ContextManager.compile` (which never triggers compression itself;
-     * compression runs in the background out-of-band), tool filtering, and
-     * system-prompt assembly — then delegates to `Agent.buildActivationRequest`.
-     * No tokens are spent, nothing is written to Chronicle, and no external
-     * MCPL server is contacted.
+     * What a preview commits (default): nothing of its own. It compiles as a
+     * dry run (`dryRun`), filters tools and assembles the system prompt, then
+     * delegates to `Agent.buildActivationRequest`. No tokens are spent, no
+     * external MCPL server is contacted, no fold resolution is persisted and
+     * none of the compression its fold plan calls for is queued; the consumed
+     * watermark and any prepared budget change are left alone; and once
+     * context-manager's thinking binding (context-manager#160, not yet
+     * released) ships, no stamps are committed and no compile awaits
+     * acceptance. In context-manager 0.14 its dry run leaves nothing else
+     * behind but the release of an expired compression hold, as any compile
+     * does (see `Agent.compileWithInjections`). The preview keeps in-memory
+     * bookkeeping of its own, such as handing the context manager the
+     * compression tool definitions, as every activation request does.
+     * Under the autobiographical strategy, a budget the context can't fit
+     * still throws, as for a committing compile: a dry run skips only
+     * context-manager's post-pick check, and an adaptive fold plan that
+     * doesn't fit then overruns at the middle's emission, with a refusal that
+     * names the tokens and the limit. Windowed passthrough's newest message
+     * alone is the one window that comes back larger than the budget. For a
+     * verdict instead of the refusal, `previewContextSettings` returns
+     * context-manager's own at a budget, with the agent's `maxTokens` reserved
+     * for the response.
      *
      * The trade-off is fidelity: the dynamically-gathered ContextInjection[]
      * (module `gatherContext` + MCPL `beforeInference` hooks) are NOT included
@@ -4126,13 +4534,13 @@ export class AgentFramework {
             return request;
         };
         // An explicit budget compiles against a HYPOTHETICAL window instead of the
-        // agent's live one. That also suppresses transition-settling in
-        // compileWithInjections (which only settles when no budget is passed), so
-        // previewing a smaller window cannot advance a converging descent.
-        // Default: no dynamic injection gathering → fully transparent (no
-        // inference, no Chronicle writes, no external RPC). Opt in explicitly.
+        // agent's live one. Every preview is a dry run, so none of them settles
+        // a converging descent or commits what a sent compile commits (see the
+        // doc comment above).
+        // Default: no dynamic injection gathering → no inference, no Chronicle
+        // writes of its own, no external RPC. Opt in explicitly.
         if (!opts?.injections) {
-            return capture(await agent.buildActivationRequest(tools, undefined, opts?.budget, presentation?.available ?? tools));
+            return capture(await agent.buildActivationRequest(tools, undefined, opts?.budget, presentation?.available ?? tools, { dryRun: true }));
         }
         // Full-fidelity path: mirrors startAgentStream's injection gathering.
         // NOT transparent — see the doc comment above.
@@ -4162,7 +4570,7 @@ export class AgentFramework {
                 console.error('beforeInference hook error (preview):', error);
             }
         }
-        return capture(await agent.buildActivationRequest(tools, injections, opts?.budget, presentation?.available ?? tools));
+        return capture(await agent.buildActivationRequest(tools, injections, opts?.budget, presentation?.available ?? tools, { dryRun: true }));
     }
     /**
      * Non-committing preview of the FOLD PLAN at a hypothetical budget and/or
@@ -4171,9 +4579,11 @@ export class AgentFramework {
      *
      * Unlike `previewActivation` (which renders a request), this returns the
      * picker's plan: resulting tokens, whether it fits, how many summaries would
-     * have to be produced first, and the per-chunk fold levels. Commits nothing:
-     * no resolution persistence, no compression enqueue, no transition
-     * bookkeeping — see `AutobiographicalStrategy.previewContext`.
+     * have to be produced first, and the per-chunk fold levels. It commits
+     * nothing: its select is a dry run, which in context-manager 0.14 leaves
+     * what a select leaves behind as the last committing compile left it —
+     * see `AutobiographicalStrategy.previewContext` and
+     * `Agent.compileWithInjections`.
      *
      * Returns null when the agent's strategy has no fold plan (non-adaptive).
      */
@@ -4181,6 +4591,9 @@ export class AgentFramework {
         const agent = this.agents.get(agentName);
         if (!agent)
             throw new Error(`Unknown agent: ${agentName}`);
+        return this.previewContextFor(agent, budgetTokens, overrides, opts);
+    }
+    previewContextFor(agent, budgetTokens, overrides, opts) {
         const cm = agent.getContextManager();
         if (typeof cm.previewContext !== 'function')
             return null;
@@ -4204,16 +4617,42 @@ export class AgentFramework {
      * the compile budget and rejected safe-by-construction paced descents.
      *
      * Never throws for preview-layer reasons: strategy without previewContext,
-     * preview overlap, stale branch generation, and the hierarchical (non-
-     * adaptive) path all come back as `{available: false, reason}`. Unknown
-     * agent still throws, matching the sibling accessors.
+     * preview overlap, stale branch generation, the hierarchical (non-
+     * adaptive) path, and a context manager that refuses its queries (its
+     * strategy's initialization pending or failed) all come back as
+     * `{available: false, reason}`. Unknown agent still throws, matching the
+     * sibling accessors, and so does a patch whose values the agent refuses,
+     * whatever its context manager's state. Whether the strategy takes live
+     * tail and pace settings is the manager's to say, so while it refuses, a
+     * patch that sets them gets no verdict either.
      */
     previewAgentRuntimeSettings(agentName, patch) {
         const agent = this.agents.get(agentName);
         if (!agent)
             throw new Error(`Unknown agent: ${agentName}`);
-        const plan = agent.planRuntimeSettings(patch);
-        const settings = agent.getRuntimeSettings();
+        return this.previewRuntimeSettingsFor(agent, patch);
+    }
+    /** previewAgentRuntimeSettings for an agent in hand: boot restore previews one not yet registered. */
+    previewRuntimeSettingsFor(agent, patch) {
+        // A patch whose values the agent refuses throws, whatever its context
+        // manager's state.
+        if (patch && Object.keys(patch).length > 0)
+            agent.checkRuntimeSettingsPatch(patch);
+        let plan;
+        let settings;
+        try {
+            plan = agent.planRuntimeSettings(patch);
+            settings = agent.getRuntimeSettings();
+        }
+        catch (error) {
+            // A manager that refuses its queries gives no verdict, as a preview
+            // that can't be computed gives none: the agent's own state still says
+            // its budget and the patch's path, and whatever stopped the preview is
+            // its reason. When the manager answers, anything else throws as before.
+            if (agent.contextManagerAnswers())
+                throw error;
+            return { available: false, reason: previewStoppedReason(error), ...agent.runtimeBudgetPath(patch) };
+        }
         const base = {
             available: false,
             path: plan.path,
@@ -4223,27 +4662,14 @@ export class AgentFramework {
         };
         const runPreview = (budgetTokens) => {
             try {
-                const result = this.previewContextSettings(agentName, budgetTokens, Object.keys(plan.overrides).length > 0 ? plan.overrides : undefined);
+                const result = this.previewContextFor(agent, budgetTokens, Object.keys(plan.overrides).length > 0 ? plan.overrides : undefined);
                 if (result === null || typeof result !== 'object') {
                     return { reason: 'no_preview_support' };
                 }
                 return { result: result };
             }
             catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
-                // Structured mapping of the strategy's known throw paths. Message
-                // matching is fragile by nature, so unknown messages surface verbatim
-                // as the reason rather than being swallowed or rethrown.
-                if (message.includes('requires reinitialization for the current branch generation')) {
-                    return { reason: 'branch_generation_changed' };
-                }
-                if (message.includes('already running; previews must not overlap')) {
-                    return { reason: 'preview_in_flight' };
-                }
-                if (message.includes('requires adaptiveResolution')) {
-                    return { reason: 'no_adaptive_resolution' };
-                }
-                return { reason: message };
+                return { reason: previewStoppedReason(error) };
             }
         };
         const effective = runPreview(plan.effectiveBudgetTokens);
@@ -4364,17 +4790,36 @@ export class AgentFramework {
             // Non-fatal — usage tracking is best-effort
         }
     }
+    /** An agent's persisted record, or null when it has none; throws when the store can't be read. */
     readAgentRuntimeSettings(agentName) {
-        try {
-            const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
-            const stored = data?.agentRuntimeSettings?.[agentName];
-            return stored ? { ...stored } : null;
-        }
-        catch {
-            return null;
-        }
+        const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+        const stored = data?.agentRuntimeSettings?.[agentName];
+        return stored ? { ...stored } : null;
     }
     validatePersistedAgentRuntimeSettings(agentName, overrides) {
+        // A malformed number is dropped, with a line that names the value's kind,
+        // never its content. It could never apply: a budget, tail or pace kept
+        // unapplied would be reported and written back as it is, and a marker
+        // that can't be read isn't trusted, so the budget restores paced.
+        const numbers = [
+            ['contextBudgetReachedTokens', 1],
+            ['contextBudgetTokens', 1],
+            ['tailTokens', 0],
+            ['transitionPaceTokens', 1],
+        ];
+        for (const [key, least] of numbers) {
+            const value = overrides[key];
+            if (value === undefined || (Number.isSafeInteger(value) && value >= least))
+                continue;
+            const kind = typeof value === 'number' ? `a number that isn't a ${least > 0 ? 'positive' : 'non-negative'} safe integer`
+                : value === null ? 'null'
+                    : Array.isArray(value) ? 'an array'
+                        : typeof value === 'object' ? 'an object'
+                            : `a ${typeof value}`;
+            console.error(`[agent-settings] ignoring an invalid persisted ${key} for agent "${agentName}": ${kind}`);
+            const { [key]: _ignored, ...rest } = overrides;
+            overrides = rest;
+        }
         if (overrides.sameRoundThinkTextPolicy !== undefined &&
             overrides.sameRoundThinkTextPolicy !== 'public' &&
             overrides.sameRoundThinkTextPolicy !== 'private') {
@@ -4420,6 +4865,142 @@ export class AgentFramework {
             state.toolResultInlineCaps = all;
         this.store.setStateJson(FRAMEWORK_STATE_ID, state);
     }
+    /**
+     * Apply an agent's persisted settings at boot, each on its own, the budget
+     * last. A persisted setting never stops the agent booting, except a
+     * think-text policy, which fails closed: an invalid one is refused before
+     * this (validatePersistedAgentRuntimeSettings), and a valid one always
+     * applies. A tail, pace or budget that can't be applied now (a tail or pace
+     * on a strategy without live settings, a budget no longer above maxTokens,
+     * a lower one restored paced on a strategy that can't prepare a smaller
+     * window) is kept set but unapplied (Agent.keepRuntimeSettings), so a later
+     * persisting write keeps it in the record.
+     *
+     * A budget below the recipe's restores as a paced descent from it, unless
+     * the record carries its marker (`contextBudgetReachedTokens`, written when
+     * a compile fit at it) and the preflight says it fits now: then it is
+     * applied at once. The preflight plans the stored context as the context
+     * manager will, with the restored tail and pace, so it sees what a restart
+     * can change there: a new maxTokens (the response reserve) or strategy
+     * configuration. It also sees a context that grew while the agent ran at
+     * another budget after the record was written, through a persist: false
+     * change. The system prompt, tools and injections are outside the context
+     * manager's budget, so they don't enter it (context-manager #162). If a
+     * compile at a budget applied at once this way is refused, the agent
+     * restores it paced then (armed by Agent.restoreRuntimeSettings, run in
+     * Agent.compileAtLiveBudgetNoting). A budget at or above the recipe's is
+     * applied at once with or without the marker, as an increase always is.
+     *
+     * When a marked budget isn't applied at once or a setting can't be
+     * applied, one line says why, what couldn't be applied, and the budget set
+     * beside the one compiles plan at.
+     */
+    restorePersistedRuntimeSettings(agentName, agent, overrides) {
+        const messageOf = (error) => (error instanceof Error ? error.message : String(error));
+        const { contextBudgetReachedTokens: reached, sameRoundThinkTextPolicy, ...settings } = overrides;
+        if (sameRoundThinkTextPolicy !== undefined)
+            agent.restoreRuntimeSettings({ sameRoundThinkTextPolicy });
+        const unapplied = [];
+        /** Restore one setting, or keep it set but unapplied; true if it applied. */
+        const restore = (part) => {
+            try {
+                agent.restoreRuntimeSettings(part);
+                return true;
+            }
+            catch (error) {
+                agent.keepRuntimeSettings(part);
+                unapplied.push(Object.entries(part).map(([key, value]) => `${key}=${value}`).join(', ') + ` (${messageOf(error)})`);
+                return false;
+            }
+        };
+        if (settings.tailTokens !== undefined)
+            restore({ tailTokens: settings.tailTokens });
+        if (settings.transitionPaceTokens !== undefined)
+            restore({ transitionPaceTokens: settings.transitionPaceTokens });
+        const budget = settings.contextBudgetTokens;
+        let atOnce;
+        let appliedAtOnce = false;
+        if (budget !== undefined && reached === budget) {
+            const patch = { contextBudgetTokens: budget, immediate: true };
+            let why;
+            try {
+                const preview = this.previewRuntimeSettingsFor(agent, patch);
+                if (!preview.available)
+                    why = `whether it fits now can't be checked (${preview.reason ?? 'no preview'})`;
+                else if (preview.effective?.fits !== true)
+                    why = `the folded floor renders ${preview.effective?.finalTokens} tokens against it now`;
+            }
+            catch (error) {
+                why = `whether it fits now can't be checked (${messageOf(error)})`;
+            }
+            if (why === undefined) {
+                try {
+                    agent.restoreRuntimeSettings(patch, { provenBudget: budget });
+                    appliedAtOnce = true;
+                }
+                catch (error) {
+                    why = `applying it at once failed (${messageOf(error)}), though the preflight says it fits now`;
+                }
+            }
+            if (why !== undefined)
+                atOnce = `its record says a compile fit at contextBudgetTokens=${budget}, but ${why}`;
+        }
+        const budgetKept = budget !== undefined && !appliedAtOnce && !restore({ contextBudgetTokens: budget });
+        if (atOnce === undefined && unapplied.length === 0)
+            return;
+        const now = agent.getRuntimeSettings();
+        const said = [];
+        if (atOnce !== undefined) {
+            said.push(budgetKept ? atOnce : `${atOnce}; restored it ${now.transition === 'stable' ? 'without that proof' : 'paced instead'}`);
+        }
+        if (unapplied.length > 0) {
+            said.push(`${unapplied.join(', ')} can't be applied now, so ${unapplied.length === 1 ? 'it stays' : 'they stay'} set but unapplied`);
+        }
+        console.error(`[agent-settings] ${agentName}: ${said.join('; ')}: contextBudgetTokens is ${now.contextBudgetTokens}, ` +
+            `and compiles plan at ${now.effectiveContextBudgetTokens}${now.transition === 'stable' ? '' : ` (${now.transition})`}`);
+    }
+    /**
+     * What persists for an agent: its overrides, and `contextBudgetReachedTokens`
+     * when the agent's proof stands for the overridden budget: a compile fit at
+     * it, or the boot applied it at once on the record's proof, and the live
+     * budget hasn't changed since (context-manager #162). A
+     * change of budget, immediate or not, carries none until a compile at it
+     * fits; arming or cancelling a descent leaves the proof as it was.
+     */
+    persistedRuntimeSettingsOf(agent) {
+        const overrides = agent.getRuntimeSettingsOverrides();
+        const proven = agent.getProvenContextBudgetTokens();
+        return overrides.contextBudgetTokens !== undefined && proven === overrides.contextBudgetTokens
+            ? { ...overrides, contextBudgetReachedTokens: proven }
+            : overrides;
+    }
+    /**
+     * A compile at the agent's live budget came out differently from the last
+     * (Agent.onContextBudgetCompiled). Keep the persisted record's
+     * `contextBudgetReachedTokens` true to it: written when a compile fits at
+     * the record's own budget, withdrawn when the context manager refuses that
+     * budget. Nothing else in the record changes, and a budget other than the
+     * record's (one applied with `persist: false`, or a descent's starting
+     * budget) writes nothing. A record that can't be read, or written, is
+     * logged, and the next compile at that budget tells it again.
+     */
+    recordCompiledContextBudget(agentName, budget, fit) {
+        try {
+            const persisted = this.readAgentRuntimeSettings(agentName);
+            if (!persisted || persisted.contextBudgetTokens !== budget)
+                return true;
+            if ((persisted.contextBudgetReachedTokens === budget) === fit)
+                return true;
+            const { contextBudgetReachedTokens: _previous, ...settings } = persisted;
+            this.persistAgentRuntimeSettings(agentName, fit ? { ...settings, contextBudgetReachedTokens: budget } : settings);
+            return true;
+        }
+        catch (error) {
+            // The next compile at this budget tells it again.
+            console.error(`[agent-settings] couldn't record ${agentName}'s compile at budget ${budget}:`, error);
+            return false;
+        }
+    }
     persistAgentRuntimeSettings(agentName, overrides) {
         const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
         const state = (data && typeof data === 'object' ? data : {});
@@ -4591,18 +5172,32 @@ export class AgentFramework {
         run.toolCallsCount += count;
         run.lastActivity = Date.now();
     }
+    /**
+     * A start dropped before its stream sends anything (its agent was replaced,
+     * or stop() closed admission or ended the lifecycle the start began in)
+     * ends the logical turn it was running. stop() ends every open turn
+     * (openLogical), but a fresh start that awaited its batches' assembly
+     * across a stop() reaches its routing after it and opens its turn. That
+     * turn would then stay open, and the agent's first start after a restart
+     * would continue the dropped turn's routing. The identity check leaves any
+     * other turn open.
+     */
+    endDroppedTurn(agentName, routing) {
+        if (this.openLogical.get(agentName) === routing)
+            this.openLogical.delete(agentName);
+    }
     /** A logical turn's end, for every agent: it closes the agent's open
      *  logical turn when it is the settling stream's own (openLogical), and
      *  settles an active ephemeral run. The run's tool-call count comes from
      *  its own counter — the single source of truth, which unlike a
      *  per-stream local survives budget restarts. */
     settleAgent(agentName, outcome, 
-    /** The settling stream's logical turn, when that stream still owns the
-     *  agent: it ends here, so the agent's next fresh start opens a new one.
-     *  A settle from a stream a newer one replaced closes nothing. */
+    /** The settling stream's logical turn (TurnRouting), when that stream
+     *  still owns the agent: it ends here, so the agent's next fresh start
+     *  opens a new one. A stream that no longer owns the agent passes none. */
     closes) {
-        // This identity check is the only guard against a stale settle closing
-        // a newer turn (no test reaches one); keep it when editing call sites.
+        // The identity check keeps a settle that carries an earlier turn's
+        // object from closing a newer turn; keep it when editing call sites.
         if (closes && this.openLogical.get(agentName) === closes)
             this.openLogical.delete(agentName);
         const run = this.ephemeralRuns.get(agentName);
@@ -4611,7 +5206,10 @@ export class AgentFramework {
         run.lastActivity = Date.now();
         if (outcome.stopReason === 'exhausted') {
             // The caller may log or relay the message, which can echo the whole request.
-            run.settle.reject(new Error(boundFailureText(outcome.error ?? 'Unknown error')));
+            const message = boundFailureText(outcome.error ?? 'Unknown error');
+            run.settle.reject(outcome.statedWaitMs === undefined
+                ? new Error(message)
+                : new ProviderWaitNotSleptError(message, outcome.statedWaitMs));
             return;
         }
         run.settle.resolve({
@@ -4626,6 +5224,9 @@ export class AgentFramework {
      * The agent is temporarily registered, inference is triggered, and the
      * framework drives the stream (emitting traces, logging, dispatching tools).
      * Returns the agent's speech output when it finishes (no more tool calls).
+     * Rejects with ProviderWaitNotSleptError when the run ends rather than sleep
+     * a retryable failure's stated wait, and with a plain Error for any other
+     * ending.
      *
      * The caller provides a pre-created agent + contextManager (from createEphemeralAgent).
      * The task message should already be in the context manager.
@@ -5150,7 +5751,7 @@ export class AgentFramework {
             const serverId = this.channelRegistry?.getChannelServerId(incoming.channelId);
             const server = serverId ? this.mcplServerRegistry?.getServer(serverId) : null;
             if (!server) {
-                console.error(`[inference-refusal] reaction skipped: no MCPL server for locus "${incoming.channelId}" (agent=${agentName})`);
+                console.error(`[inference-refusal] reaction skipped: no MCPL server for locus ${logValue(incoming.channelId)} (agent=${agentName})`);
                 return;
             }
             await server.sendToolsCall('add_reaction', {
@@ -5200,23 +5801,37 @@ export class AgentFramework {
         }
         if (idx < 0)
             return null;
+        // The newest message can be the last shard of a body (a document stored
+        // in shards). context-manager removes a shard only with the rest of its
+        // body, so the rewind takes the whole body.
+        const first = bodyRangeIn(all, idx).from;
+        const members = all.slice(first, idx + 1);
         const msg = all[idx];
         const md = (msg.metadata ?? {});
-        const content = Array.isArray(msg.content) ? msg.content : [];
+        const content = members.flatMap((m) => (Array.isArray(m.content) ? m.content : []));
         const toolBlocks = content.filter((b) => typeOf(b) === 'tool_result');
         const images = content.filter((b) => typeOf(b) === 'image').length;
         const textLen = content
             .filter((b) => typeOf(b) === 'text')
             .reduce((n, b) => n + String(b.text ?? '').length, 0);
-        // Determine the complete exchange to remove.
-        const removedIds = [msg.id];
+        // Determine the complete exchange to remove, newest first.
+        const removedIds = members.map((m) => m.id).reverse();
+        // Where the exchange starts: this body, or the tool_use turn paired with it.
+        let from = first;
         let kind;
         let descriptor;
         if (toolBlocks.length > 0) {
             kind = 'tool';
-            // Pair the tool_result with the tool_use assistant turn right before it.
-            if (idx - 1 >= 0 && hasBlock(all[idx - 1], 'tool_use')) {
-                removedIds.push(all[idx - 1].id);
+            // Pair the tool_result with the tool_use assistant turn right before
+            // it, the whole of it: a turn stored as a body carries its tool_use on
+            // its first shard, not its last.
+            if (first - 1 >= 0) {
+                const turn = bodyRangeIn(all, first - 1);
+                const turnMembers = all.slice(turn.from, turn.to + 1);
+                if (turnMembers.some((m) => hasBlock(m, 'tool_use'))) {
+                    from = turn.from;
+                    removedIds.push(...turnMembers.map((m) => m.id).reverse());
+                }
             }
             const sz = toolBlocks.reduce((n, b) => n + String(b.content ?? '').length, 0);
             descriptor = `a tool exchange (~${Math.max(1, Math.round(sz / 1024))}KB` +
@@ -5235,8 +5850,8 @@ export class AgentFramework {
         const discordRef = md.messageId && md.channelId
             ? { channelId: String(md.channelId), messageId: String(md.messageId) }
             : undefined;
-        for (const id of removedIds)
-            cm.removeMessage(id);
+        // One removal for the whole exchange, so it is never half applied.
+        removeStoredMessages(cm, all[from], msg);
         return { kind, descriptor, removedIds, discordRef };
     }
     /**
@@ -5408,7 +6023,11 @@ export class AgentFramework {
      *   stated retry-after, kept across restarts) for one `model` or all, as an
      *   explicit, recorded operator override.
      */
-    async handleHostCommand(serverId, params) {
+    handleHostCommand(serverId, params) {
+        return this.trackOperatorOperation(`host/command:${String(params.command)}`, () => this.runHostCommand(serverId, params));
+    }
+    /** handleHostCommand's work, run where stop() can wait for it. */
+    async runHostCommand(serverId, params) {
         if (params.command !== 'undo' &&
             params.command !== 'hide' &&
             params.command !== 'unstick' &&
@@ -5531,26 +6150,80 @@ export class AgentFramework {
             if (agent.state.status !== 'idle') {
                 return { ok: false, error: `Cannot hide while agent is ${agent.state.status}` };
             }
+            // A surgery switches or forks the branch while it holds the store, so
+            // a removal now would land on the branch it's leaving, or meet a
+            // manager mid-switch: refused as busy, as the other operator calls are.
+            if (this.surgeryHold) {
+                return {
+                    ok: false,
+                    error: `Cannot hide: a live ${this.surgeryHold.verb} for ${this.surgeryHold.agentName} holds the store — retry when it completes`,
+                };
+            }
             if (!params.fromMessageId) {
                 return { ok: false, error: 'hide: fromMessageId is required' };
             }
             const cm = agent.getContextManager();
             const all = cm.getAllMessages();
-            const byDiscordId = (did) => all.findIndex((m) => String(m.metadata?.messageId) === String(did));
-            // Collect Discord refs of every message in [lo, hi] that carries one,
+            // Only a message that carries a Discord id matches: a missing one
+            // would otherwise read as the text "undefined".
+            const discordIdOf = (m) => {
+                const id = m.metadata?.messageId;
+                return id === undefined || id === null || id === '' ? undefined : String(id);
+            };
+            const byDiscordId = (did) => all.findIndex((m) => discordIdOf(m) === String(did));
+            /** Runs in stored order, those that overlap or touch made one. */
+            const merged = (runs) => {
+                const out = [];
+                for (const { from, to } of [...runs].sort((a, b) => a.from - b.from)) {
+                    const last = out[out.length - 1];
+                    if (last && from <= last.to + 1)
+                        last.to = Math.max(last.to, to);
+                    else
+                        out.push({ from, to });
+                }
+                return out;
+            };
+            // A message stored as a body (a long one, in shards) goes whole, and so
+            // does every copy of it: a write cut short leaves a partial body before
+            // its retry, both carrying the Discord id.
+            const copiesOf = (did) => {
+                const runs = [];
+                all.forEach((m, i) => { if (discordIdOf(m) === String(did))
+                    runs.push(bodyRangeIn(all, i)); });
+                return runs;
+            };
+            // Collect Discord refs of every message in the runs that carries one,
             // so the surface can mark them. channelId here is whatever the ingest
             // path stored (raw id or "discord:guild:channel"); the surface
             // normalizes it.
-            const refsIn = (lo, hi) => {
+            // Each Discord message once, though every shard of a body carries it.
+            const refsIn = (runs) => {
                 const refs = [];
-                for (let i = lo; i <= hi; i++) {
-                    const md = all[i].metadata;
-                    if (md?.messageId && md?.channelId) {
+                const seen = new Set();
+                for (const { from, to } of runs) {
+                    for (let i = from; i <= to; i++) {
+                        const md = all[i].metadata;
+                        if (!md?.messageId || !md?.channelId)
+                            continue;
+                        const key = `${String(md.channelId)}\u0000${String(md.messageId)}`;
+                        if (seen.has(key))
+                            continue;
+                        seen.add(key);
                         refs.push({ channelId: String(md.channelId), messageId: String(md.messageId) });
                     }
                 }
                 return refs;
             };
+            // How many stored messages the runs hold, a body (a long message, in
+            // shards) counting once.
+            const messagesIn = (runs) => {
+                let count = 0;
+                for (const { from, to } of runs) {
+                    for (let i = from; i <= to; i = bodyRangeIn(all, i).to + 1)
+                        count++;
+                }
+                return count;
+            };
             const fromIdx = byDiscordId(params.fromMessageId);
             if (fromIdx < 0) {
                 return {
@@ -5564,11 +6237,24 @@ export class AgentFramework {
                     if (toIdx < 0) {
                         return { ok: false, error: `Message ${params.toMessageId} is not an addressable message in context.` };
                     }
-                    const [lo, hi] = fromIdx <= toIdx ? [fromIdx, toIdx] : [toIdx, fromIdx];
-                    const refs = refsIn(lo, hi);
-                    const rangeIds = all.slice(lo, hi + 1).map((m) => String(m.id));
-                    cm.removeMessages(all[lo].id, all[hi].id);
-                    console.error(`[host-command] hide agent=${agentName} range removed=${hi - lo + 1} ` +
+                    // What's between the two messages, after the earlier one began and
+                    // before the later one began: from the earlier one's first stored
+                    // copy through the later one's first, each whole. Each end is every
+                    // copy of it besides, as the single form takes, so a copy stored
+                    // outside that span (a write cut short and retried later) is taken
+                    // on its own, and nothing else stored after the later one began is
+                    // taken. Offline recovery's range is the same.
+                    const span = {
+                        from: bodyRangeIn(all, Math.min(fromIdx, toIdx)).from,
+                        to: bodyRangeIn(all, Math.max(fromIdx, toIdx)).to,
+                    };
+                    const runs = merged([span, ...copiesOf(params.fromMessageId), ...copiesOf(params.toMessageId)]);
+                    const refs = refsIn(runs);
+                    const hidden = messagesIn(runs);
+                    const rangeIds = runs.flatMap(({ from, to }) => all.slice(from, to + 1).map((m) => String(m.id)));
+                    for (const { from, to } of runs)
+                        removeStoredMessages(cm, all[from], all[to]);
+                    console.error(`[host-command] hide agent=${agentName} range removed=${hidden} ` +
                         `(${params.fromMessageId}..${params.toMessageId}) by=${params.requesterName ?? params.requesterId ?? 'unknown'} (server=${serverId})`);
                     const loggedRange = capIds(rangeIds);
                     this.recordOperatorAction({
@@ -5578,33 +6264,44 @@ export class AgentFramework {
                         params: { fromMessageId: params.fromMessageId, toMessageId: params.toMessageId },
                         result: {
                             branch: this.store.currentBranch().name,
-                            hidden: hi - lo + 1,
+                            hidden,
                             removedIds: loggedRange.ids,
                             ...(loggedRange.truncated ? { removedIdsTruncated: true } : {}),
                         },
                     });
                     return {
                         ok: true,
-                        hidden: hi - lo + 1,
+                        hidden,
                         hiddenRefs: refs,
                         lastVisible: await this.lastVisiblePreview(agentName),
                     };
                 }
-                const refs = refsIn(fromIdx, fromIdx);
-                const hiddenId = String(all[fromIdx].id);
-                cm.removeMessage(all[fromIdx].id);
-                console.error(`[host-command] hide agent=${agentName} removed=1 (${params.fromMessageId}) ` +
+                const runs = merged(copiesOf(params.fromMessageId));
+                const refs = refsIn(runs);
+                const hidden = messagesIn(runs);
+                const hiddenIds = runs.flatMap(({ from, to }) => all.slice(from, to + 1).map((m) => String(m.id)));
+                for (const { from, to } of runs)
+                    removeStoredMessages(cm, all[from], all[to]);
+                console.error(`[host-command] hide agent=${agentName} removed=${hidden} (${params.fromMessageId}) ` +
                     `by=${params.requesterName ?? params.requesterId ?? 'unknown'} (server=${serverId})`);
+                // Every shard of every copy goes, so the ids are bounded as the
+                // range form's are.
+                const loggedIds = capIds(hiddenIds);
                 this.recordOperatorAction({
                     kind: 'hide',
                     agent: agentName,
                     requester: hostCommandRequester(serverId, params),
                     params: { fromMessageId: params.fromMessageId },
-                    result: { branch: this.store.currentBranch().name, hidden: 1, removedIds: [hiddenId] },
+                    result: {
+                        branch: this.store.currentBranch().name,
+                        hidden,
+                        removedIds: loggedIds.ids,
+                        ...(loggedIds.truncated ? { removedIdsTruncated: true } : {}),
+                    },
                 });
                 return {
                     ok: true,
-                    hidden: 1,
+                    hidden,
                     hiddenRefs: refs,
                     lastVisible: await this.lastVisiblePreview(agentName),
                 };
@@ -5658,7 +6355,7 @@ export class AgentFramework {
         let undone = 0;
         try {
             for (let i = 0; i < requested; i++) {
-                const r = this.undoLastTurn(agentName, hostCommandRequester(serverId, params));
+                const r = this.runUndoLastTurn(agentName, hostCommandRequester(serverId, params));
                 if (!r.undone)
                     break;
                 undone++;
@@ -5669,7 +6366,7 @@ export class AgentFramework {
             // including any turns already undone before the failure.
             const msg = error instanceof Error ? error.message : String(error);
             if (undone === 0)
-                return { ok: false, error: msg };
+                return { ok: false, error: msg, ...(error instanceof OperatorActionError ? { code: error.code } : {}) };
             console.error(`[host-command] undo partially failed after ${undone}/${requested}: ${msg}`);
         }
         console.error(`[host-command] undo agent=${agentName} requested=${requested} undone=${undone}` +
@@ -5938,8 +6635,45 @@ export class AgentFramework {
         return result.entries;
     }
     // ==========================================================================
-    // Undo / Redo
+    // Branch switch, Undo / Redo
     // ==========================================================================
+    /**
+     * Switch the store to an existing branch, start the delivery of the
+     * Discord awareness marks the move changes (startDiscordAwarenessDelivery),
+     * and re-materialize the config mount from it. Resolves once the mount has
+     * run; if it fails, it rejects with the store already moved. The marks'
+     * delivery isn't awaited, and its failure doesn't fail the switch. The
+     * store has moved by the time the call returns, before its promise
+     * settles, and a refusal moves nothing. An operator's operation: refused
+     * once stop() has begun, and waited for by stop() while it runs.
+     *
+     * The branch moves under every agent sharing the store, so the switch
+     * reserves the store as a surgery does: every agent must be idle, or it is
+     * refused (OperatorActionError 'agent-busy'), and no turn starts until the
+     * switch is done.
+     */
+    async switchBranch(name) {
+        this.refuseOperatorAfterStop('switch branch');
+        const release = this.reserveStoreForSurgery('switch branch', 'every agent');
+        try {
+            // A maintenance tick already running finishes before the switch.
+            if (this.maintenanceRunning())
+                await this.settleMaintenancePass();
+            this.store.switchBranch(name);
+            // Reversible Discord awareness markers are part of the branch
+            // projection. Their delivery starts behind the data-plane gate, which
+            // goes up before the store is released, and the switch doesn't wait
+            // for Discord.
+            this.startDiscordAwarenessDelivery('branch switch');
+            const ws = this.moduleRegistry.getModule('workspace');
+            if (ws && 'materializeMount' in ws) {
+                await ws.materializeMount('_config');
+            }
+        }
+        finally {
+            release();
+        }
+    }
     /**
      * Undo the last inference turn for an agent.
      *
@@ -5951,6 +6685,12 @@ export class AgentFramework {
      * Returns the checkpoint that was undone, or null if nothing to undo.
      */
     undoLastTurn(agentName, requester) {
+        this.refuseOperatorAfterStop('undo');
+        return this.runUndoLastTurn(agentName, requester);
+    }
+    /** undoLastTurn's work, for a host/command undo already admitted: a stop()
+     *  begun by a trace of one of its turns doesn't refuse the next. */
+    runUndoLastTurn(agentName, requester) {
         const agent = this.agents.get(agentName);
         if (!agent) {
             throw new Error(`Unknown agent: ${agentName}`);
@@ -5958,6 +6698,10 @@ export class AgentFramework {
         if (agent.state.status !== 'idle') {
             throw new Error(`Cannot undo while agent is ${agent.state.status}`);
         }
+        // A surgery or a branch switch holds the store while it awaits its steps.
+        if (this.surgeryHold) {
+            throw new OperatorActionError('agent-busy', `Cannot undo: the store is under live ${this.surgeryHold.verb} for ${this.surgeryHold.agentName}`);
+        }
         const checkpoints = this.getTurnCheckpoints(agentName);
         if (checkpoints.length === 0) {
             return { undone: false };
@@ -5968,11 +6712,7 @@ export class AgentFramework {
         const undoBranchName = `undo/${agentName}/${checkpoint.turnIndex}-${Date.now()}`;
         this.store.createBranchAt(undoBranchName, currentBranch.name, checkpoint.sequenceBefore);
         this.store.switchBranch(undoBranchName);
-        // Materialize config files from the new branch (fire-and-forget; gate picks up via mtime)
-        const wsUndo = this.moduleRegistry.getModule('workspace');
-        if (wsUndo && 'materializeMount' in wsUndo) {
-            wsUndo.materializeMount('_config').catch(() => { });
-        }
+        this.materializeConfigMountAfterBranchSwitch();
         // Push onto redo stack
         let redoStack = this.redoStacks.get(agentName);
         if (!redoStack) {
@@ -6008,6 +6748,7 @@ export class AgentFramework {
      * Returns false if there's nothing to redo.
      */
     redo(agentName, requester) {
+        this.refuseOperatorAfterStop('redo');
         const agent = this.agents.get(agentName);
         if (!agent) {
             throw new Error(`Unknown agent: ${agentName}`);
@@ -6015,6 +6756,10 @@ export class AgentFramework {
         if (agent.state.status !== 'idle') {
             throw new Error(`Cannot redo while agent is ${agent.state.status}`);
         }
+        // A surgery or a branch switch holds the store while it awaits its steps.
+        if (this.surgeryHold) {
+            throw new OperatorActionError('agent-busy', `Cannot redo: the store is under live ${this.surgeryHold.verb} for ${this.surgeryHold.agentName}`);
+        }
         const redoStack = this.redoStacks.get(agentName);
         if (!redoStack || redoStack.length === 0) {
             return { redone: false };
@@ -6022,11 +6767,7 @@ export class AgentFramework {
         const { branchName, checkpoint } = redoStack.pop();
         const currentBranch = this.store.currentBranch();
         this.store.switchBranch(branchName);
-        // Materialize config files from the restored branch (fire-and-forget; gate picks up via mtime)
-        const wsRedo = this.moduleRegistry.getModule('workspace');
-        if (wsRedo && 'materializeMount' in wsRedo) {
-            wsRedo.materializeMount('_config').catch(() => { });
-        }
+        this.materializeConfigMountAfterBranchSwitch();
         // Restore the checkpoint
         const checkpoints = this.getTurnCheckpoints(agentName);
         checkpoints.push(checkpoint);
@@ -6138,11 +6879,22 @@ export class AgentFramework {
         // arrivals during the awaited switch (see surgeryHold).
         const hold = { verb, agentName, since: Date.now() };
         this.surgeryHold = hold;
+        // Maintenance calls parked at a provider gate wake, find the hold and are
+        // withdrawn, so the wait for running maintenance can't wait on them.
+        for (const gate of this.providerGates.values())
+            for (const resolve of gate.auxiliaryWaiters.splice(0))
+                resolve();
+        // stop() waits for the release (see stopOwned): a surgery admitted before
+        // stop() began finishes, flush included, before the store closes.
+        let settle;
+        void this.trackOperatorOperation(`surgery:${verb}`, () => new Promise((resolve) => { settle = resolve; }));
         let released = false;
         return () => {
             if (released)
                 return;
             released = true;
+            // The release runs to its end before stop() can go on.
+            settle();
             if (this.surgeryHold === hold)
                 this.surgeryHold = null;
             for (const [name, token] of reserved) {
@@ -6205,6 +6957,7 @@ export class AgentFramework {
      * agent must be idle; nothing is queued.
      */
     async rollbackToMessage(agentName, opts) {
+        this.refuseOperatorAfterStop('roll back');
         const logBase = {
             kind: 'rollback',
             agent: agentName,
@@ -6247,6 +7000,9 @@ export class AgentFramework {
             let branchName;
             let markers;
             try {
+                // A maintenance tick already running finishes before the switch.
+                if (this.maintenanceRunning())
+                    await this.settleMaintenancePass();
                 // Prepare the external side effect before switching Chronicle. If the
                 // process dies after the switch but before activate(), startup
                 // promotes this batch by matching targetBranch to the active branch.
@@ -6333,6 +7089,7 @@ export class AgentFramework {
      * entered if that matters.
      */
     async suppressMessages(agentName, opts) {
+        this.refuseOperatorAfterStop('suppress');
         const requestedIds = [...new Set(opts.messageIds.map(String))];
         const logBase = {
             kind: 'suppress',
@@ -6384,6 +7141,9 @@ export class AgentFramework {
             let createdBranch;
             let markers;
             try {
+                // A maintenance tick already running finishes before the fork.
+                if (this.maintenanceRunning())
+                    await this.settleMaintenancePass();
                 const markerBatch = this.discordAwarenessOutbox?.prepare({
                     agentName,
                     sourceBranch,
@@ -6539,9 +7299,9 @@ export class AgentFramework {
      * undo or redo) without the caller awaiting it. No operator response waits
      * for Discord to accept marks: the MCPL data-plane gate alone holds channel
      * traffic that arrives after it until they are attempted.
-     * `syncDiscordAwarenessMarkers` installs that gate synchronously, before
-     * its first await, so calling this while a surgery still holds the store
-     * puts the gate up before the store is released. With no drain running, the
+     * The sync's body installs that gate synchronously, before its first
+     * await, so calling this while a surgery still holds the store puts the
+     * gate up before the store is released. With no drain running, the
      * drain starts in the same synchronous run (the first reaction request can
      * be written before this returns); with one running, this generation's pass
      * follows it (drainForGeneration). Either way delivery continues
@@ -6552,10 +7312,20 @@ export class AgentFramework {
      * (queued when a surgery began, or arriving during its switch or fork): the
      * surgery's store reservation, which used to hold such a turn through the
      * drain, now ends once the gate is up. A failure is accounted by the gate
-     * itself: the current generation's failure recycles the connections, and a
-     * superseded one leaves that to the newer generation, whose own pass meets
-     * the same ledger. Here it is logged and raised as an ops alert, and the
-     * next sync, reconnect or start delivers what is still pending.
+     * itself: the current generation's failure recycles the connections (or,
+     * once the host is stopping, releases the gate instead), and a superseded
+     * one leaves that to the newer generation, whose own pass meets the same
+     * ledger. Here it is logged and raised as an ops alert, and the next sync,
+     * reconnect or start delivers what is still pending.
+     *
+     * Like a server's drain, the delivery runs apart from the operation that
+     * started it: it isn't an operator's operation, so stop() doesn't wait for
+     * it. A drain already running when stop() begins runs on while the
+     * connections close, and what it can't deliver stays pending in the
+     * durable outbox. Once stop() has begun, none is started, since there's
+     * no point opening a drain that the teardown is about to cut off: the
+     * marks stay pending, and the next start's barrier reconciles the outbox
+     * with the branch and delivers them.
      *
      * @param after What moved the branch, for the log and the alert
      *   ("rollback", "branch switch", "undo" …).
@@ -6565,20 +7335,25 @@ export class AgentFramework {
     startDiscordAwarenessDelivery(after, agentName = 'framework') {
         if (!this.discordAwarenessOutbox)
             return;
-        this.syncDiscordAwarenessMarkers().catch((error) => {
+        if (this.stopHasBegun()) {
+            console.error(`[discord-awareness] delivery after ${after} agent=${agentName} not started: ` +
+                'the framework is stopping; the next start delivers what is pending');
+            return;
+        }
+        this.runDiscordAwarenessSync().catch((error) => {
             const detail = error instanceof Error ? error.message : String(error);
             console.error(`[discord-awareness] delivery after ${after} agent=${agentName} failed: ${detail}`);
             this.opsAlert('discord-awareness-delivery', agentName, `Awareness mark delivery after ${after} failed: ${detail}`);
         });
     }
-    /** Re-materialize config files from the (new) active branch — fire and
-     *  forget; the gate picks changes up via mtime. Mirrors undoLastTurn. */
+    /** Start config file IO without holding the caller or a surgery's store
+     * reservation. The gate picks it up by mtime; stop() still waits for it. */
     materializeConfigMountAfterBranchSwitch() {
         const ws = this.moduleRegistry.getModule('workspace');
         if (ws && 'materializeMount' in ws) {
-            ws
-                .materializeMount('_config')
-                .catch(() => { });
+            void this.trackOperatorOperation('config:materialize', () => ws.materializeMount('_config')).catch((error) => {
+                console.error('[workspace] re-materializing the config mount after a branch switch failed:', error instanceof Error ? error.message : error);
+            });
         }
     }
     /**
@@ -6737,10 +7512,18 @@ export class AgentFramework {
         this.adoptToolResultGuard(agent);
         agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
         this.sharedSlotAgents.add(agent);
-        const restoredSettings = this.readAgentRuntimeSettings(config.name);
+        let restoredSettings = null;
+        try {
+            restoredSettings = this.readAgentRuntimeSettings(config.name);
+        }
+        catch (error) {
+            console.error(`[agent-settings] ${config.name}: its persisted settings can't be read ` +
+                `(${error instanceof Error ? error.message : String(error)}); it boots at the recipe's`);
+        }
         if (restoredSettings) {
-            agent.restoreRuntimeSettings(this.validatePersistedAgentRuntimeSettings(config.name, restoredSettings));
+            this.restorePersistedRuntimeSettings(config.name, agent, this.validatePersistedAgentRuntimeSettings(config.name, restoredSettings));
         }
+        agent.onContextBudgetCompiled((budget, fit) => this.recordCompiledContextBudget(config.name, budget, fit));
         this.agents.set(config.name, agent);
         this.agentConfigs.set(config.name, config);
         // First non-ephemeral agent becomes the primary for message routing
@@ -6979,11 +7762,17 @@ export class AgentFramework {
                     // queued, they flush at the target's own next boundary — with
                     // injection — or in driveStream's finally when its turn ends.
                     const midTurnInjections = [];
+                    // The injected messages' ids, for a boundary that leaves them to the
+                    // turn's next start as arrivals.
+                    const injectedIds = new Map();
                     {
                         const deferred = this.drainDeferredFor(agent.name);
                         if (deferred.length > 0) {
                             for (const msg of deferred) {
-                                agent.getContextManager().addMessage(msg.participant, msg.content, withDeferredWriteId(msg.metadata, msg.id));
+                                const id = agent.getContextManager().addMessage(msg.participant, msg.content, withDeferredWriteId(msg.metadata, msg.id));
+                                // Every other resident reads what this boundary stores; for its
+                                // own agent, the boundary weighs what it injects below.
+                                this.noteForOtherResidents(agent, msg.metadata, id);
                                 // Injection guards: tool blocks would corrupt the tool-cycle
                                 // structure the membrane enforces, and a message named as the
                                 // agent itself would render as an ASSISTANT turn on the wire
@@ -6991,11 +7780,13 @@ export class AgentFramework {
                                 // messages stay window-only — visible next turn.
                                 const hasToolBlocks = msg.content.some((b) => b.type === 'tool_use' || b.type === 'tool_result');
                                 if (!hasToolBlocks && msg.participant !== agent.name) {
-                                    midTurnInjections.push({
+                                    const injection = {
                                         participant: msg.participant,
                                         content: msg.content,
                                         ...(msg.metadata ? { metadata: msg.metadata } : {}),
-                                    });
+                                    };
+                                    midTurnInjections.push(injection);
+                                    injectedIds.set(injection, id);
                                 }
                             }
                         }
@@ -7033,13 +7824,18 @@ export class AgentFramework {
                     // under budget instead of dispatching a doomed request.
                     // Projection terms: prior round's real input + prior round's
                     // OUTPUT (the just-generated thinking/text/tool_use joins the next
-                    // round's input — omitting it is a systematic underestimate) +
-                    // blocks about to be appended + reserve for the next response.
+                    // round's input — omitting it is a systematic underestimate) + the
+                    // growth since that round, when calls after it reported no prompt
+                    // (lastStreamUnreportedTokens) + blocks about to be appended +
+                    // reserve for the next response. It runs once a call on this
+                    // stream has reported a prompt: before then there is no figure to
+                    // project from.
                     const projectedRealTokens = currentState.stream
                         && agent.physicalWindowTokens !== undefined
                         && agent.lastStreamRealInputTokens > 0
                         ? agent.lastStreamRealInputTokens
                             + agent.lastStreamOutputTokens
+                            + agent.lastStreamUnreportedTokens
                             + estimateAppendedRoundTokens(currentState.toolResults, spilled, midTurnInjections)
                             + agent.maxTokens
                         : 0;
@@ -7068,13 +7864,18 @@ export class AgentFramework {
                     // classifier-safe D-class from the 2026-07-24 ablation). It also
                     // updates lastAnnouncedLocus so the next turn's announce-on-change
                     // diffs against what the agent was actually last told.
-                    if ((agent.proseRouting === 'locus' || agent.proseRouting === 'hybrid') &&
-                        !shouldEndTurn && !overBudget && currentState.stream) {
+                    // The turn's own mode: a silent turn routes no prose, whatever the
+                    // agent's mode, so its boundary neither re-pins nor notes. The
+                    // trigger is this stream's: its start holds the agent's turn token
+                    // while the agent waits on this round's tools.
+                    const routesLocus = (agent.proseRouting === 'locus' || agent.proseRouting === 'hybrid')
+                        && !this.activeTurnTriggers.get(agent.name)?.suppressProse;
+                    if (routesLocus && !shouldEndTurn && !overBudget && currentState.stream) {
                         // Two signals qualify an injection to move the pin (n=6 + n=7):
                         //  - chat:addressed — someone explicitly spoke TO the agent
                         //    (mention / reply / DM);
                         //  - a conversational follow-up in a channel the agent itself
-                        //    explicitly sent into THIS turn (turnEngagedChannels) —
+                        //    explicitly sent into THIS turn (TurnRouting.engaged) —
                         //    conversation the agent just engaged continues without
                         //    re-mentioning it (2026-07-31: q's #portables reply, no @,
                         //    answered in prose that followed the stale pin into
@@ -7085,46 +7886,28 @@ export class AgentFramework {
                         //    Reactions and system markers are already excluded by
                         //    isConversationalInjection, and the engaged-this-turn scope
                         //    keeps unrelated channels from moving the pin.
-                        const engaged = this.turnEngagedChannels.get(agent.name);
-                        const lastQualifying = [...midTurnInjections].reverse().find((inj) => {
-                            const m = inj.metadata;
-                            if (!isConversationalInjection(inj.metadata))
-                                return false;
-                            if (typeof m?.channelId !== 'string')
-                                return false;
-                            const tags = m.tags;
-                            if (isAddressedMessage(tags, m))
-                                return true;
-                            return engaged?.has(m.channelId) === true;
-                        });
-                        const newLocus = lastQualifying?.metadata
-                            ?.channelId;
-                        if (newLocus && this.turnLocusPins.get(agent.name) !== newLocus) {
-                            const prevPin = this.turnLocusPins.get(agent.name) ?? null;
-                            this.turnLocusPins.set(agent.name, newLocus);
-                            this.lastAnnouncedLocus.set(agent.name, newLocus);
-                            const label = this.channelRegistry?.getDescriptor(newLocus)?.label;
-                            const shown = label && label !== newLocus
-                                ? `${label.startsWith('#') ? label : `#${label}`} (${newLocus})`
-                                : newLocus;
-                            const noticeContent = [{
-                                    type: 'text',
-                                    text: `[routing] The conversation moved to ${shown} — your plain ` +
-                                        'speech now lands there for the rest of this turn. Other ' +
-                                        'channels need an explicit send tool.',
-                                }];
-                            const noticeMeta = { system: true, kind: 'routing-notice' };
-                            try {
-                                const id = agent.getContextManager().addMessage('user', noticeContent, noticeMeta);
-                                this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
-                                midTurnInjections.push({ participant: 'user', content: noticeContent, metadata: noticeMeta });
-                                console.error(`[routing] ${agent.name}: mid-turn addressed re-pin ${prevPin ?? '(none)'} -> ${newLocus}`);
-                            }
-                            catch (err) {
-                                console.error('mid-turn locus re-pin: failed to record routing notice:', err);
-                            }
+                        // The last injection that qualifies wins (repinChannel).
+                        const routing = this.routingOf(agent.name);
+                        let newLocus;
+                        for (const inj of midTurnInjections)
+                            newLocus = this.repinChannel(inj.metadata, routing) ?? newLocus;
+                        if (newLocus) {
+                            // What this boundary just stored is newer than any arrival the
+                            // turn holds, so the arrivals can't move the locus back.
+                            routing.arrivals = [];
+                            const notice = this.repinTurnLocus(agent, routing, newLocus, 'mid-turn addressed');
+                            if (notice)
+                                midTurnInjections.push(notice);
                         }
                     }
+                    else if (routesLocus && !shouldEndTurn) {
+                        // A boundary that can't re-pin now (over budget, or no live
+                        // stream to tell) leaves its injections to the turn's next start,
+                        // as arrivals: a budget restart, or a re-inference on these tool
+                        // results.
+                        for (const inj of midTurnInjections)
+                            this.noteArrival(agent.name, inj.metadata, injectedIds.get(inj));
+                    }
                     if (shouldEndTurn) {
                         // endTurn: messages already stored above, cancel stream, reset to idle.
                         // The batch is never submitted, so nothing can refuse it: admit
@@ -7140,7 +7923,7 @@ export class AgentFramework {
                         // agent must be wakeable the moment it goes idle. (Idempotent;
                         // driveStream's finally is the backstop.)
                         this.eventGate?.onInferenceEnded(agent.name);
-                        this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' }, this.turnRouting.get(agent.name)?.logical);
+                        this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' }, this.turnRouting.get(agent.name));
                         this.emitTrace({ type: 'inference:turn_ended', agentName: agent.name });
                     }
                     else if (overBudget || overPhysical) {
@@ -7186,6 +7969,12 @@ export class AgentFramework {
                         });
                     }
                     else if (currentState.stream) {
+                        // What this round appends is in the next call's prompt. If that
+                        // call reports no prompt, the next boundary projects it from the
+                        // growth since the last call that did.
+                        if (agent.physicalWindowTokens !== undefined) {
+                            agent.lastStreamUnreportedTokens += estimateAppendedRoundTokens(currentState.toolResults, spilled, midTurnInjections);
+                        }
                         // Streaming path: convert results and resume the stream.
                         // Mid-turn messages collected above ride along as injected user
                         // messages (membrane ≥0.5.72) — appended after the tool_result
@@ -7325,7 +8114,7 @@ export class AgentFramework {
         // Same backstop as the push lane: no row, no wake, no fork spawned for a
         // message with nothing visible in it.
         if (isVisiblyEmptyContent(event.content)) {
-            console.error(`[channel-incoming-dropped] server=${event.serverId} channel=${event.channelId} messageId=${event.messageId} reason=empty-content`);
+            console.error(`[channel-incoming-dropped] server=${event.serverId} channel=${logValue(event.channelId)} messageId=${logValue(event.messageId)} reason=empty-content`);
             this.emitTrace({
                 type: 'mcpl:empty-content-dropped', lane: 'channel', serverId: event.serverId,
                 channelId: event.channelId, messageId: event.messageId, ...(event.eventId ? { eventId: event.eventId } : {}),
@@ -7490,7 +8279,7 @@ export class AgentFramework {
             }
             catch (error) {
                 const err = error instanceof Error ? error : new Error(String(error));
-                console.error(`Failed to spawn conversation agent for ${event.channelId}:`, err);
+                console.error(`Failed to spawn conversation agent for ${logValue(event.channelId)}:`, err);
                 this.emitTrace({
                     type: 'mcpl:conversation-spawn-failed',
                     channelId: event.channelId,
@@ -7540,9 +8329,10 @@ export class AgentFramework {
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
      * template agent: own ContextManager under `conversations/{name}`, seeded
-     * with a copy of the template's compiled context (the SubagentModule
-     * wholesale-copy pattern), registered in the event loop like any agent —
-     * but never primary.
+     * with the template's compiled context without its thinking or its unpaired
+     * tool blocks (the SubagentModule wholesale-copy pattern; see the seeding
+     * comment below), registered in the event loop like any agent — but never
+     * primary.
      */
     async createConversationAgent(name, channelId) {
         const router = this.conversationRouter;
@@ -7574,13 +8364,53 @@ export class AgentFramework {
             // persisted precisely so names aren't reused, but if this namespace has
             // history anyway (counter state lost, crash between spawn and persist),
             // seeding again would stack another template copy on top of it.
-            const { messages: existing } = await contextManager.compile();
+            //
+            // Both compiles are dry runs: neither is sent, and the template's runs
+            // while the template may be mid-stream, where a committing compile
+            // would commit fold resolutions and queue the compression its fold plan
+            // calls for (and, once context-manager's thinking binding ships, fence
+            // its stream's replies). In context-manager 0.14 a dry run leaves
+            // nothing else behind but the release of an expired compression hold
+            // (see Agent.compileWithInjections), so the template's request in
+            // flight keeps its calibration estimate.
+            // The template's compile runs at context-manager's default budget (none
+            // is passed), and a dry run still refuses a budget it can't fit: it
+            // skips only the post-pick check, and an adaptive fold plan that
+            // doesn't fit then overruns at the middle's emission. So a template
+            // whose fold plan doesn't fit that budget fails the spawn with
+            // context-manager's refusal, which names the tokens and the limit, as
+            // a committing compile failed it. Only a windowed-passthrough template
+            // whose newest message alone exceeds it seeds that message, larger than
+            // the budget. The fork's own compiles meet its window by its strategy's
+            // rule: passthrough, the fork's default, keeps the newest messages that
+            // fit; an adaptive strategy folds to fit or throws over_budget for the
+            // drain breaker.
+            // The seed leaves out the template's thinking (withoutThinking): a
+            // signed block verifies only while everything before it is what it was
+            // minted under, and a fork's system, tools and scoped injections don't
+            // promise that, while its own namespace holds no stamps that could
+            // vouch for the copies. On models that don't bind thinking to its
+            // prefix a copy would have been kept, so there the fork loses the
+            // template's reasoning.
+            // Then context-manager's stripUnpairedToolBlocks drops each call whose
+            // result isn't in the seed and each result whose call isn't, keeping
+            // the rest of their messages (a message left with nothing becomes its
+            // "[tool call omitted]" placeholder). A fork spawned while the template
+            // is between a round's call and its results (the coalescer can spawn
+            // one outside the event loop) would otherwise give the fork's first
+            // request an unanswered call: the passthrough strategies have no
+            // pairing pass, and an adaptive template's compile has been through its
+            // own.
+            const { messages: existing } = await contextManager.compile(undefined, undefined, { dryRun: true });
             if (existing.length === 0) {
                 // The copy is the fork's own, and the template's annotation edits only
                 // the template's message: seed only once each of the template's
                 // annotations has finished.
-                const { messages: compiled } = await template.toolResultGuard.afterAnnotations(() => template.getContextManager().compile());
-                for (const msg of compiled) {
+                const { messages: compiled } = await template.toolResultGuard.afterAnnotations(() => template.getContextManager().compile(undefined, undefined, { dryRun: true }));
+                const withoutReasoning = withoutThinking(compiled);
+                const seed = stripUnpairedToolBlocks(withoutReasoning);
+                logSeedOmissions(name, template.name, compiled, withoutReasoning, seed);
+                for (const msg of seed) {
                     const participant = msg.participant === template.name ? name : msg.participant;
                     contextManager.addMessage(participant, msg.content);
                 }
@@ -7833,7 +8663,19 @@ export class AgentFramework {
                     throw new Error('server disconnected');
                 return server.sendPushRender(params);
             },
-            audit: (record) => this.emitTrace({ type: 'mcpl:coalescing', ...record }),
+            audit: (record) => {
+                // A render result the host refused falls back to the occurrence's own
+                // content; say so on the host, with the server, the subject and the
+                // failing field, not only in the trace. The error is a field like the
+                // rest (logValue, spaces escaped), not a host-message tail: a server
+                // that answers push/render with an error chooses its message.
+                if (record.kind === 'render-failed') {
+                    console.error(`[push-render-failed] server=${logValue(record.serverId ?? '')} subject=${logValue(record.subject ?? '')} ` +
+                        `eventId=${logValue(record.eventId ?? '')}${record.field !== undefined ? ` field=${logValue(record.field)}` : ''}: ` +
+                        `${logValue(record.error ?? '')} (the occurrence's own content is delivered instead)`);
+                }
+                this.emitTrace({ type: 'mcpl:coalescing', ...record });
+            },
             save: (snapshot) => this.scheduleCoalescingSnapshot(snapshot),
             recordReceipt: (record) => {
                 // Written now, not at the throttled flush: an acknowledged acceptance
@@ -7951,7 +8793,7 @@ export class AgentFramework {
             }
             if (typeof message.timestamp !== 'string')
                 throw new CoalesceError('timestamp', 'timestamp is required');
-            validateCoalescedContent(message.content, undefined, { allowEmpty: message.coalesce.retract === true });
+            validateCoalescedContent(message.content, { allowEmpty: message.coalesce.retract === true });
             const c = message.coalesce;
             const result = await this.pushCoalescer.accept({
                 serverId,
@@ -7980,7 +8822,7 @@ export class AgentFramework {
                 throw new CoalesceError('eventId', 'eventId is required');
             if (typeof params.timestamp !== 'string')
                 throw new CoalesceError('timestamp', 'timestamp is required');
-            validateCoalescedContent(params.payload?.content, undefined, {
+            validateCoalescedContent(params.payload?.content, {
                 allowEmpty: params.coalesce.retract === true || isSilentHeartbeatMarker({
                     serverId, featureSet: params.featureSet, origin: params.origin, content: params.payload?.content,
                 }),
@@ -8082,7 +8924,7 @@ export class AgentFramework {
                 return [decision.agentName];
             }
             catch (err) {
-                console.error(`[coalescing] could not spawn a conversation agent for ${occ.scope.id}:`, err);
+                console.error(`[coalescing] could not spawn a conversation agent for ${logValue(occ.scope.id)}:`, err);
                 return [];
             }
         }
@@ -8280,7 +9122,7 @@ export class AgentFramework {
         if (!agent)
             return false;
         try {
-            agent.getContextManager().removeMessage(p.messageId);
+            removeStoredMessage(agent.getContextManager(), p.messageId);
             this.emitTrace({ type: 'message:removed', messageId: p.messageId, source: 'mcpl:coalescing' });
             return true;
         }
@@ -8299,7 +9141,7 @@ export class AgentFramework {
         // model would wake to `[Continue]` or an older message re-presented as
         // the newest, a wake with no visible cause.
         if (isVisiblyEmptyContent(event.content) && !isSilentHeartbeatMarker(event)) {
-            console.error(`[push-event-dropped] server=${event.serverId} eventId=${event.eventId} reason=empty-content`);
+            console.error(`[push-event-dropped] server=${event.serverId} eventId=${logValue(event.eventId ?? '')} reason=empty-content`);
             this.emitTrace({ type: 'mcpl:empty-content-dropped', lane: 'push', serverId: event.serverId, eventId: event.eventId });
             return undefined;
         }
@@ -8355,7 +9197,7 @@ export class AgentFramework {
             this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:push-event' });
         }
         else {
-            console.error(`[heartbeat] ${event.serverId}: accepted silent scheduled wake ${event.eventId}`);
+            console.error(`[heartbeat] ${event.serverId}: accepted silent scheduled wake ${logValue(event.eventId ?? '')}`);
         }
         if (event.triggerInference) {
             // Default broadcast excludes conversation forks (channel-driven).
@@ -8742,13 +9584,13 @@ export class AgentFramework {
     recordProseSuppression(routing, count) {
         if (count <= 0)
             return;
-        routing.logical.suppressed += count;
+        routing.suppressed += count;
     }
     /** Record a successful plain-prose delivery for this turn's receipt. */
     recordProseDelivery(routing, outcome) {
         if (!outcome?.delivered)
             return;
-        routing.logical.deliveries.push(outcome.channelId);
+        routing.deliveries.push(outcome.channelId);
     }
     /**
      * Append the turn's `[delivered]` receipt: one compact system message
@@ -8764,12 +9606,12 @@ export class AgentFramework {
      * ([discord-send-failed]); this is the success half.
      */
     appendProseDeliveryReceipt(agent, routing) {
-        const list = routing.logical.deliveries;
-        const suppressed = routing.logical.suppressed;
+        const list = routing.deliveries;
+        const suppressed = routing.suppressed;
         if (list.length === 0 && suppressed === 0)
             return;
-        routing.logical.deliveries = [];
-        routing.logical.suppressed = 0;
+        routing.deliveries = [];
+        routing.suppressed = 0;
         const seen = new Set();
         const shown = [];
         for (const id of list ?? []) {
@@ -8815,7 +9657,6 @@ export class AgentFramework {
                 this.lastAnnouncedLocus.set(agentName, locus);
             return;
         }
-        this.lastAnnouncedLocus.set(agentName, locus);
         const agent = this.agents.get(agentName);
         if (!agent)
             return;
@@ -8836,6 +9677,9 @@ export class AgentFramework {
         }
         try {
             const id = agent.getContextManager().addMessage('user', [{ type: 'text', text }], { system: true, kind: 'routing-notice' });
+            // The baseline is what the agent was told: it moves once the notice is
+            // stored, so a notice that fails is announced again at the next turn.
+            this.lastAnnouncedLocus.set(agentName, locus);
             this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
             console.error(`[routing] ${agentName}: locus ${prev ?? '(none)'} -> ${locus ?? '(none)'} (announced in window)`);
         }
@@ -8843,6 +9687,125 @@ export class AgentFramework {
             console.error('announceLocusIfChanged: failed to record routing notice:', err);
         }
     }
+    /**
+     * The channel a message moves its turn's locus to, by the addressed
+     * re-pin rule (2026-07-31, n=6 and n=7): a conversational message (not a
+     * reaction or a system marker) that addressed the agent, or that follows
+     * up in a channel the turn sent into (TurnRouting.engaged). Undefined for
+     * any other message. A tool boundary weighs the messages it injects by it,
+     * and noteArrival the ones no boundary of the turn weighs.
+     */
+    repinChannel(metadata, routing) {
+        if (!isConversationalInjection(metadata))
+            return undefined;
+        const m = metadata;
+        if (typeof m?.channelId !== 'string')
+            return undefined;
+        if (isAddressedMessage(m.tags, m))
+            return m.channelId;
+        return routing.engaged.has(m.channelId) ? m.channelId : undefined;
+    }
+    /**
+     * Weigh a message that no tool boundary of the agent's open logical turn
+     * will weigh: one that would re-pin the locus becomes one of the turn's
+     * arrivals (TurnRouting.arrivals). A message tune-out diverted
+     * (metadata.tuneOut) never enters a resident's compiled view, so the agent
+     * won't see it, and it moves nothing.
+     */
+    noteArrival(agentName, metadata, messageId) {
+        const open = this.openLogical.get(agentName);
+        if (!open)
+            return;
+        if (metadata?.tuneOut)
+            return;
+        const channelId = this.repinChannel(metadata, open);
+        if (channelId)
+            open.arrivals.push({ messageId, channelId });
+    }
+    /**
+     * Whether `agent`'s store is the residents' one message slot, which every
+     * ordinary resident reads (sharedSlotAgents). The subconscious reads that
+     * slot through a merged view, but its own store is isolated, as a fork's
+     * or an ephemeral agent's is.
+     */
+    isOrdinaryResident(agent) {
+        return this.sharedSlotAgents.has(agent) && agent.name !== this.subconsciousAgentName;
+    }
+    /**
+     * Weigh a message just stored in an ordinary resident's store for every
+     * other ordinary resident's open turn, running or not: residents read one
+     * message slot, and a tool boundary weighs only the messages drained for
+     * its own agent, so no boundary of another resident's turn weighs it.
+     */
+    noteForOtherResidents(agent, metadata, messageId) {
+        if (!this.isOrdinaryResident(agent))
+            return;
+        for (const reader of this.sharedSlotAgents) {
+            if (reader !== agent && this.agents.get(reader.name) === reader && this.isOrdinaryResident(reader)) {
+                this.noteArrival(reader.name, metadata, messageId);
+            }
+        }
+    }
+    /**
+     * The channel of the turn's newest arrival whose message is still in the
+     * agent's store (TurnRouting.arrivals). A message removed since it was
+     * stored, such as an unread coalesced message its server retracted, moves
+     * nothing, and an earlier one that remains still does. Compression keeps a
+     * message in the store; the last compile can't be the test, since an
+     * arrival between the turn's streams isn't in it yet.
+     */
+    remainingArrival(agent, routing) {
+        const cm = agent.getContextManager();
+        for (let i = routing.arrivals.length - 1; i >= 0; i--) {
+            const { messageId, channelId } = routing.arrivals[i];
+            // The store answers null for a message that isn't there. A store that
+            // can't be read throws here, as anywhere else in the start, rather
+            // than have its candidates read as withdrawn.
+            if (cm.getMessage(messageId))
+                return channelId;
+        }
+        return undefined;
+    }
+    /**
+     * Move a turn's locus to the channel its conversation moved to: an
+     * addressed message, or a follow-up in a channel the turn engaged (the
+     * addressed re-pin, repinChannel). Ambient chatter never moves it. Leaves
+     * a durable `[routing]` notice in the window and updates
+     * lastAnnouncedLocus once it's stored, so the next turn's announce-on-change
+     * diffs against what the agent was last told. Returns the notice as stored, for a live
+     * stream to inject with its boundary's other messages. Returns undefined
+     * when the locus is already there, and when the notice couldn't be
+     * stored. The locus has moved then too, but the announce baseline hasn't,
+     * so the agent's next turn announces where its speech lands.
+     */
+    repinTurnLocus(agent, routing, channelId, cause) {
+        if (routing.locus === channelId)
+            return undefined;
+        const prevPin = routing.locus ?? null;
+        routing.locus = channelId;
+        const label = this.channelRegistry?.getDescriptor(channelId)?.label;
+        const shown = label && label !== channelId
+            ? `${label.startsWith('#') ? label : `#${label}`} (${channelId})`
+            : channelId;
+        const content = [{
+                type: 'text',
+                text: `[routing] The conversation moved to ${shown} — your plain ` +
+                    'speech now lands there for the rest of this turn. Other ' +
+                    'channels need an explicit send tool.',
+            }];
+        const metadata = { system: true, kind: 'routing-notice' };
+        try {
+            const id = agent.getContextManager().addMessage('user', content, metadata);
+            this.lastAnnouncedLocus.set(agent.name, channelId);
+            this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
+            console.error(`[routing] ${agent.name}: ${cause} re-pin ${prevPin ?? '(none)'} -> ${channelId}`);
+            return { participant: 'user', content, metadata };
+        }
+        catch (err) {
+            console.error('turn locus re-pin: failed to record routing notice:', err);
+            return undefined;
+        }
+    }
     /**
      * Durable window notice for a channel the agent did not ask to open —
      * subscription-policy admission, or an open forced by the agent's own
@@ -8889,11 +9852,11 @@ export class AgentFramework {
      */
     requestProseContinuation(agent, routing) {
         // The flag may be shared with an earlier stream of the same logical
-        // turn (LogicalTurn); its deliveries are on the agent's chain ahead of
+        // turn (TurnRouting); its deliveries are on the agent's chain ahead of
         // this stream's, so by the time this check runs, they have run.
-        if (!routing.logical.continuation)
+        if (!routing.continuation)
             return;
-        routing.logical.continuation = false;
+        routing.continuation = false;
         // An explicit turn's check can run after its stream has returned. A
         // stopped framework, or an agent no longer registered under its name (a
         // disposed fork or ephemeral run), takes no new turn from it.
@@ -8997,7 +9960,7 @@ export class AgentFramework {
             const attempted = normalized.startsWith('>>>');
             const parsed = parseHybridProsePrefix(normalized);
             if (parsed.continueTurn)
-                routing.logical.continuation = true;
+                routing.continuation = true;
             if (parsed.kind === 'private') {
                 delete routing.pin;
                 routing.hybridHold = true;
@@ -9076,7 +10039,7 @@ export class AgentFramework {
         // A private round (one that called skip_reply) asks for no publication
         // or continuation, even when delivery runs after that turn has ended.
         if (parsed.continueTurn && !round.keepPrivate)
-            routing.logical.continuation = true;
+            routing.continuation = true;
         if (parsed.kind === 'private') {
             // The text already lives in the assistant message (window/chronicle);
             // "delivery" is deliberately a no-op. Consumes the retained text if the
@@ -9349,6 +10312,22 @@ export class AgentFramework {
         try {
             tokenHandedOff = await this.beginAgentTurn(agent, trigger, attempt, turnToken, ownsProviderGate);
         }
+        catch (error) {
+            // A throw outside the stream's own failure handling (the checkpoint,
+            // locus resolution, the typing indicator) drops this start's trigger,
+            // and nothing retries or holds it. The agent's open logical turn is the
+            // one this start was opening, continuing or resuming, so it ends here,
+            // as a terminal failure in beginAgentTurn's own catch ends its turn:
+            // the next start opens a turn of its own rather than continuing this
+            // one's routing, and an ephemeral run fails with the error rather than
+            // waiting out its watchdog. A silent start has no part in an open turn.
+            if (!trigger?.suppressProse) {
+                this.settleAgent(agent.name, {
+                    stopReason: 'exhausted', speech: '', error: error instanceof Error ? error.message : String(error),
+                }, this.openLogical.get(agent.name));
+            }
+            throw error;
+        }
         finally {
             if (!tokenHandedOff && this.activeTurnTokens.get(agent.name) === turnToken) {
                 this.activeTurnTokens.delete(agent.name);
@@ -9356,8 +10335,52 @@ export class AgentFramework {
             }
             if (!tokenHandedOff && ownsProviderGate)
                 this.releasePrimaryProviderGate(agent.name);
+            // A start that ends before its stream exists lands what was deferred
+            // during it, as a stream's teardown does. Left queued, those messages
+            // would land only at the agent's next start, after any stored meanwhile.
+            // Per message, as the turn-start flush does: one store failure must
+            // neither drop the messages behind it nor replace the start's own error.
+            if (!tokenHandedOff && !this.activeTurnTokens.has(agent.name)
+                && this.deferredMessages.length > 0 && this.pendingAssistantBlocks.size === 0) {
+                for (const msg of this.drainDeferredFor(agent.name)) {
+                    try {
+                        this.addMessage(msg.participant, msg.content, msg.metadata, {
+                            deferredWriteId: msg.id,
+                            ...(msg.forAgent ? { forAgent: msg.forAgent } : {}),
+                        });
+                    }
+                    catch (err) {
+                        console.error(`[deferred-flush] failed-start flush failed to store a message for ${agent.name} ` +
+                            `(participant=${msg.participant}, id=${msg.id}):`, err);
+                    }
+                }
+                this.ackDeferredWrites();
+            }
         }
     }
+    /**
+     * End a turn that beginAgentTurn drops before it sends anything. The turn
+     * emitted inference:started, and listeners that bracket a turn, such as a
+     * typing loop or an activity indicator, end it on a terminal event, so it
+     * gets inference:aborted with `reason`, and lastInference records its end
+     * as driveStream's would, when the record is still this turn's. Nothing of
+     * the kind when another turn of this agent's name holds the turn token (one
+     * begun after a stop and start, or by a replacement agent object): the
+     * event and the record carry only the name, so this frame's would end that
+     * newer turn instead.
+     */
+    abortDroppedTurn(agentName, turnToken, reason, startedAt) {
+        const owner = this.activeTurnTokens.get(agentName);
+        if (owner !== undefined && owner !== turnToken)
+            return;
+        const now = Date.now();
+        // Only this turn's own record ends: a name whose run was disposed meanwhile
+        // (runEphemeralToCompletion deletes its record) gets none back.
+        const last = this.lastInferenceAt.get(agentName);
+        if (last?.startedAt === startedAt)
+            this.lastInferenceAt.set(agentName, { ...last, endedAt: now });
+        this.emitTrace({ type: 'inference:aborted', agentName, reason, durationMs: now - startedAt });
+    }
     /**
      * Body of startAgentStream, split out so the caller's try/finally owns the
      * turn token unconditionally. Returns true iff the token was handed off to
@@ -9365,7 +10388,7 @@ export class AgentFramework {
      */
     async beginAgentTurn(agent, trigger, attempt, turnToken, ownsProviderGate) {
         const lifecycle = this.lifecycleGeneration;
-        const continuingTurn = resumesLogicalTurn(trigger?.reason);
+        const resumesTurn = resumesLogicalTurn(trigger?.reason);
         const turnProseRouting = trigger?.suppressProse ? 'disabled' : agent.proseRouting;
         // Flush messages deferred during the PREVIOUS turn — before the
         // checkpoint, the locus announcement, and the compile — so a turn started
@@ -9382,7 +10405,7 @@ export class AgentFramework {
         // Before recordTurnCheckpoint: these are the turn's inputs, not its
         // products — undoing the turn must not destroy them.
         if (attempt === 0 &&
-            !continuingTurn &&
+            !resumesTurn &&
             this.deferredMessages.length > 0) {
             {
                 const deferred = this.drainDeferredFor(agent.name);
@@ -9392,6 +10415,8 @@ export class AgentFramework {
                     // abort the turn or drop the messages behind it in the queue.
                     try {
                         const id = agent.getContextManager().addMessage(msg.participant, msg.content, withDeferredWriteId(msg.metadata, msg.id));
+                        this.noteArrival(agent.name, msg.metadata, id);
+                        this.noteForOtherResidents(agent, msg.metadata, id);
                         this.emitTrace({ type: 'message:added', messageId: id, source: 'deferred-flush:turn-start' });
                     }
                     catch (err) {
@@ -9407,7 +10432,7 @@ export class AgentFramework {
         // not yet run) and before the checkpoint (they are the turn's inputs).
         // Not on a context-budget restart: that continues the same logical turn.
         let assembly;
-        if (attempt === 0 && !continuingTurn && this.pushCoalescer?.pendingBatches()) {
+        if (attempt === 0 && !resumesTurn && this.pushCoalescer?.pendingBatches()) {
             try {
                 assembly = await this.pushCoalescer.assemble(agent.name);
             }
@@ -9452,44 +10477,61 @@ export class AgentFramework {
             this.recordTurnCheckpoint(agent.name);
             this.redoStacks.delete(agent.name); // new work invalidates redo
         }
-        // Establish this turn's outbound routing locus (item-3 redux). Set it to the
-        // triggering channel for a channel/DM-triggered turn; clear it otherwise so
-        // a heartbeat / no-trigger turn doesn't inherit a previous turn's channel and
-        // instead falls back to the global default. A given agent runs one turn at a
-        // time, so a set here is only read during THIS turn's routeSpeech /
-        // buildChannelContext; retries re-run with the same trigger, re-setting it.
-        // A context-budget restart continues the SAME logical turn in a fresh
-        // stream — its trigger carries no channelId, and deleting the trigger
-        // channel here mid-logical-turn is exactly the hole that sent Sol's DM
-        // reply to a stale guild channel (2026-07-22): any live locus resolution
-        // after the restart fell through to the hours-old defaultPublishChannel.
-        // Keep the turn's trigger channel across restarts; only real new turns
-        // reset it.
-        if (!continuingTurn) {
-            if (trigger?.channelId) {
-                this.activeTriggerChannels.set(agent.name, trigger.channelId);
+        // This start's routing: its logical turn's (TurnRouting), which holds
+        // everything the turn has decided about where its speech goes.
+        //  - A resume (a budget restart, a tool-result-guard retry) carries its
+        //    turn's request on and keeps the turn's object as it is, and the
+        //    turn stays, or after a stop() becomes again, the agent's open turn.
+        //  - A silent start routes no prose. It gets an object of its own, with
+        //    no locus, so it neither takes nor disturbs an open turn's. Its
+        //    object is the agent's live routing while it runs, and the open
+        //    turn's next start makes the turn's object live again. (No silent
+        //    start runs while a prose turn is open in production: a capacity
+        //    hold holds silent wakes with the turn's, and a re-inference's wake
+        //    is queued before its stream ends, so it batches with them.)
+        //  - Any other start continues the agent's open logical turn, if one is
+        //    open (openLogical): a framework retry, the start that consumes tool
+        //    results the non-streaming fallback left (whichever wake the
+        //    scheduler starts it with), the later compile a provider-capacity
+        //    hold defers a turn to. It takes the turn's object: the sticky
+        //    destination, the destination and the hold, the ` !` and receipt
+        //    tallies, the trigger channel, the locus with any re-pin, and the
+        //    engaged channels. A delivery still queued from an earlier stream
+        //    runs ahead of this one's on the agent's chain, so what it sets
+        //    applies to this stream's prose, in the order the turn wrote them.
+        //    With no turn open, the start opens one.
+        // A new object doesn't clear the previous turn's: prose that turn left
+        // queued still reads and writes its own.
+        let routing;
+        let opensTurn = false;
+        if (resumesTurn) {
+            routing = this.routingOf(agent.name);
+            // The turn a resume continues is open, unless a stop() ended every
+            // open turn since: it opens again, so its later starts continue it.
+            if (!trigger?.suppressProse && !this.openLogical.has(agent.name))
+                this.openLogical.set(agent.name, routing);
+        }
+        else if (trigger?.suppressProse) {
+            routing = freshTurnRouting();
+            opensTurn = true;
+        }
+        else {
+            const open = this.openLogical.get(agent.name);
+            if (open) {
+                routing = open;
             }
             else {
-                this.activeTriggerChannels.delete(agent.name);
-            }
-        }
-        // FREEZE this turn's outbound locus now (turn-frozen routing). Resolved
-        // once — home channel for forks, else the triggering channel, else the
-        // global default — and never moved for the rest of the turn: mid-turn
-        // injections must not redirect the agent's plain prose (ambient chatter /
-        // reactions hijacked it before, 2026-07-21). A context-budget restart
-        // continues the same logical turn, so it keeps the existing pin. The
-        // eager snapshot also protects heartbeat turns from a moving
-        // defaultPublishChannel mid-turn. If the effective locus differs from the
-        // last one announced, drop a durable `[routing]` notice into the window
-        // BEFORE this turn compiles, so the agent always knows where its voice
-        // goes (announce-on-change only — no per-turn chatter, append-only for
-        // KV stability).
-        if (continuingTurn) {
+                routing = freshTurnRouting();
+                this.openLogical.set(agent.name, routing);
+                opensTurn = true;
+            }
+        }
+        this.turnRouting.set(agent.name, routing);
+        if (resumesTurn) {
             const previousLogicalToolState = this.logicalTurnToolCalls.get(agent);
             this.logicalTurnToolCalls.set(agent, { turnToken, count: previousLogicalToolState?.count ?? 0 });
         }
-        if (!continuingTurn) {
+        else {
             if (attempt === 0)
                 this.maybePrimeProseMode(agent);
             const previousLogicalToolState = this.logicalTurnToolCalls.get(agent);
@@ -9501,77 +10543,65 @@ export class AgentFramework {
                 // A framework retry is a new physical stream in the same logical turn.
                 this.logicalTurnToolCalls.set(agent, { turnToken, count: previousLogicalToolState?.count ?? 0 });
             }
-            // Fresh turn: forget the previous turn's explicit-send engagements.
-            // A restart continues the same logical turn and keeps them.
-            this.turnEngagedChannels.delete(agent.name);
-            // A new routing state for the new turn, in every mode: the sticky
-            // destination, the turn's destination, hybrid's hold and the receipt
-            // tallies start empty. The previous turn's object isn't cleared: prose
-            // it left queued still reads and writes its own.
-            const fresh = freshTurnRouting();
-            // A start while the agent's logical turn is open continues it: it
-            // shares the earlier stream's ` !` and receipt tallies, which a
-            // delivery still queued there can write after this stream begins
-            // (openLogical). Otherwise this start opens one. A silent start does
-            // neither: it routes no prose, so it keeps a logical turn of its own,
-            // and an open turn waits for the next start that routes prose.
-            if (!trigger?.suppressProse) {
-                const open = this.openLogical.get(agent.name);
-                if (open)
-                    fresh.logical = open;
-                else
-                    this.openLogical.set(agent.name, fresh.logical);
-            }
-            this.turnRouting.set(agent.name, fresh);
-            if (turnProseRouting === 'explicit' || turnProseRouting === 'disabled') {
-                // Explicit and disabled prose routing have no inferred locus.
-                // Explicit mode uses a turn-scoped `>>` target; disabled mode has no
-                // prose target at all. Neither mode freezes or announces a locus.
-                this.midTurnInputSignals.delete(agent.name);
-                this.turnLocusPins.delete(agent.name);
-            }
-            else {
+            this.midTurnInputSignals.delete(agent.name);
+        }
+        if (opensTurn) {
+            // The turn's trigger channel (item-3 redux): the channel of a
+            // channel/DM-triggered turn, and none for a heartbeat / no-trigger
+            // turn, which falls back to the global default rather than inheriting
+            // a previous turn's channel.
+            routing.triggerChannel = trigger?.channelId;
+            // FREEZE the turn's outbound locus now (turn-frozen routing): the home
+            // channel for forks, else the trigger channel, else the global default.
+            // Mid-turn injections must not redirect the agent's plain prose
+            // (ambient chatter and reactions hijacked it before, 2026-07-21), and
+            // the eager snapshot protects heartbeat turns from a moving
+            // defaultPublishChannel. Explicit mode uses a turn-scoped `>>` target
+            // and disabled mode has no prose target, so neither freezes or
+            // announces a locus. If the effective locus differs from the last one
+            // announced, a durable `[routing]` notice goes into the window BEFORE
+            // this turn compiles, so the agent always knows where its voice goes
+            // (announce-on-change only — no per-turn chatter, append-only for KV
+            // stability).
+            if (turnProseRouting !== 'explicit' && turnProseRouting !== 'disabled') {
                 const locus = this.channelRegistry?.resolveLocus(agent.name) ?? null;
                 if (locus !== null)
-                    this.turnLocusPins.set(agent.name, locus);
-                else
-                    this.turnLocusPins.delete(agent.name);
-                this.midTurnInputSignals.delete(agent.name);
+                    routing.locus = locus;
                 if (attempt === 0)
                     this.announceLocusIfChanged(agent.name, locus);
             }
         }
-        // A context-budget restart normally preserves the turn locus, but a
-        // silent control-plane wake must remain locusless even if an explicit tool
-        // opened/pinned a channel mid-turn.
-        if (trigger?.suppressProse) {
-            this.turnLocusPins.delete(agent.name);
-            // Silent: no routing state. A continuing silent start keeps its turn's
-            // logical turn; a fresh one keeps the one of its own it was given.
-            const silent = freshTurnRouting();
-            const logical = this.turnRouting.get(agent.name)?.logical;
-            if (logical)
-                silent.logical = logical;
-            this.turnRouting.set(agent.name, silent);
-        }
-        // This start's own logical turn: a failure before its stream exists
-        // settles it, and no other start's.
-        const startLogical = this.turnRouting.get(agent.name)?.logical;
+        else {
+            // Every other start of the turn keeps its locus: a resume, or a start
+            // that continues the open turn. A message no tool boundary of the turn
+            // weighed can still move it, as it would have at a boundary
+            // (TurnRouting.arrivals).
+            // Only a turn that has a locus reads its arrivals' messages.
+            const arrival = turnProseRouting === 'locus' || turnProseRouting === 'hybrid'
+                ? this.remainingArrival(agent, routing)
+                : undefined;
+            routing.arrivals = [];
+            if (arrival)
+                this.repinTurnLocus(agent, routing, arrival, 'arrival');
+        }
+        // A silent start, or a disabled agent's, has no locus to show, whatever a
+        // channel_open in a silent turn left on its object.
+        const turnLocus = turnProseRouting === 'disabled' ? undefined : routing.locus;
         this.touchEphemeralRun(agent.name, true);
+        const turnStartedAt = Date.now();
         this.emitTrace({
             type: 'inference:started',
             agentName: agent.name,
-            // The turn-frozen locus was pinned just above (kept across a
-            // context-budget restart, which skips the re-pin but re-emits this).
-            channelId: this.turnLocusPins.get(agent.name),
+            // The turn's locus, kept across a start that continues the turn.
+            channelId: turnLocus,
             ...(trigger?.suppressProse ? { silent: true } : {}),
         });
         // A budget restart continues the same logical inference window. The
         // predecessor keeps EventGate liveness until its successor terminates.
-        if (!continuingTurn) {
+        if (!resumesTurn) {
             this.eventGate?.onInferenceStarted(agent.name);
         }
-        this.lastInferenceAt.set(agent.name, { ...this.lastInferenceAt.get(agent.name), startedAt: Date.now() });
+        this.lastInferenceAt.set(agent.name, { ...this.lastInferenceAt.get(agent.name), startedAt: turnStartedAt });
         // Typing indicator, started at TURN START. It says "attending", which is
         // true from the moment the turn is accepted — but it used to start inside
         // driveStream, i.e. only after module gatherContext + MCPL beforeInference
@@ -9583,7 +10613,7 @@ export class AgentFramework {
         // it on the no-driveStream failure paths (e.g. a compile refusal).
         const earlyTypingChannel = turnProseRouting === 'explicit'
             ? trigger?.channelId ?? null
-            : this.turnLocusPins.get(agent.name) ?? null;
+            : turnLocus ?? null;
         if (earlyTypingChannel)
             this.channelRegistry?.startTyping(earlyTypingChannel);
         try {
@@ -9635,8 +10665,13 @@ export class AgentFramework {
             // and stop() may close provider admission. Do not create a provider
             // stream after its generation lost ownership, or once admission closed.
             if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed) {
+                const why = this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed' : 'the framework was stopping';
+                const reason = `a turn assembled while ${why} is dropped before it sends anything`;
+                console.error(`[turn] ${agent.name}: ${reason}`);
+                this.endDroppedTurn(agent.name, routing);
                 this.channelRegistry?.stopTyping();
                 this.eventGate?.onInferenceEnded(agent.name);
+                this.abortDroppedTurn(agent.name, turnToken, reason, turnStartedAt);
                 return false;
             }
             // The subconscious's standing dispositions ride a fixed system-position
@@ -9658,9 +10693,11 @@ export class AgentFramework {
             // Membrane's yielding stream starts its request when it is first
             // iterated, so cancelling it here, before driveStream, sends nothing.
             if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed || lifecycle !== this.lifecycleGeneration) {
-                console.error(`[turn] ${agent.name}: a turn compiled while ${this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
+                const why = this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
                     : this.providerAdmissionClosed ? 'the framework was stopping'
-                        : 'the framework was stopped and started again'} is dropped before it sends anything`);
+                        : 'the framework was stopped and started again';
+                const reason = `a turn compiled while ${why} is dropped before it sends anything`;
+                console.error(`[turn] ${agent.name}: ${reason}`);
                 stream.cancel();
                 agent.cancelStream();
                 if (this.agents.get(agent.name) === agent) {
@@ -9670,8 +10707,10 @@ export class AgentFramework {
                     this.activeStreams.delete(agent.name);
                     this.pendingAssistantBlocks.delete(agent.name);
                 }
+                this.endDroppedTurn(agent.name, routing);
                 this.channelRegistry?.stopTyping();
                 this.eventGate?.onInferenceEnded(agent.name);
+                this.abortDroppedTurn(agent.name, turnToken, reason, turnStartedAt);
                 return false;
             }
             // A conversation agent takes no provider gate, so its own compression
@@ -9756,11 +10795,13 @@ export class AgentFramework {
                     this.activeTurnTokens.delete(agent.name);
                     this.activeTurnTriggers.delete(agent.name);
                 }
+                // This start's own logical turn: a failure before its stream exists
+                // settles it, and no other start's.
                 this.settleAgent(agent.name, {
                     stopReason: 'exhausted',
                     speech: '',
-                    error: statedWait === 'fail' ? this.statedWaitNotSlept(err) : err.message,
-                }, startLogical);
+                    ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
+                }, routing);
                 this.emitTrace({
                     type: 'inference:exhausted',
                     agentName: agent.name,
@@ -9796,8 +10837,9 @@ export class AgentFramework {
         const myStreamId = agent.streamId;
         // Membrane usage events are cumulative across the native/XML tool loop.
         // Keep the previous cumulative sample so consumers that operate at the
-        // physical provider-call boundary (estimator calibration and kv receipt
-        // acceptance) see this call only, not an ever-growing turn total.
+        // physical provider-call boundary (estimator calibration and the
+        // physical-window projection) see this call only, not an ever-growing
+        // turn total.
         let previousUsage = {
             inputTokens: 0,
             outputTokens: 0,
@@ -9820,14 +10862,14 @@ export class AgentFramework {
         let hadToolCalls = false;
         let generationLost = false;
         // ---- Present-while-acting turn state ---------------------------------
-        // Output locus for the WHOLE logical turn: frozen in startAgentStream
-        // (home → addressed trigger → global default) before this stream began,
-        // and never moved until the next turn. Mid-turn injections do not touch
-        // it — an ambient message or a reaction arriving at a tool boundary must
-        // not redirect the agent's task narration (2026-07-21 Cairn misroute).
-        // The pin lives in `turnLocusPins` so a context-budget restart (same
-        // logical turn, fresh driveStream) keeps it.
-        const resolveTurnLocus = () => this.turnLocusPins.get(agent.name) ?? null;
+        // Output locus for the WHOLE logical turn: frozen when the turn opened
+        // (home → addressed trigger → global default), and moved only by a
+        // re-pin (an addressed message, or a follow-up in a channel the turn
+        // engaged) or the agent's own channel_open. Ambient messages and
+        // reactions arriving at a tool boundary must not redirect the agent's
+        // task narration (2026-07-21 Cairn misroute). The locus lives in the
+        // turn's routing state, so every stream of the turn shares it.
+        const resolveTurnLocus = () => streamRouting.locus ?? null;
         // Ordered delivery chain for live-routed prose. Links are enqueued
         // WITHOUT awaiting in the stream-event loop — an awaited network post
         // here would stall consumption of the next round's events by
@@ -9838,11 +10880,13 @@ export class AgentFramework {
         //
         // Every stream queues its deliveries behind the agent's latest link, so
         // the agent's posts go out in the order they were written, across a
-        // turn's streams (a budget restart, a tool-result-guard retry) and across
-        // turns. A turn that a tool ends (skip_reply) settles before its queued
-        // prose has posted; that prose keeps its own turn's routing state
-        // (turnRouting), and the next turn's posts wait behind it.
-        const resumesTurn = resumesLogicalTurn(trigger?.reason);
+        // turn's streams and across turns. So an earlier stream's deliveries,
+        // and the sticky destination or hold they set, come before this stream's
+        // own. A stream queues only while it is the agent's current stream: the
+        // event loop stops at the first event after a replacement. A turn that a
+        // tool ends (skip_reply) settles before its queued prose has posted; that
+        // prose keeps its own turn's routing state (turnRouting), and the next
+        // turn's posts wait behind it.
         let turnSpeechChain = this.proseSpeechChains.get(agent.name) ?? Promise.resolve();
         this.proseSpeechChains.set(agent.name, turnSpeechChain);
         const chainSpeech = (link, failure) => {
@@ -9929,14 +10973,14 @@ export class AgentFramework {
             ? new ProseStreamRouter({
                 mode: turnProseRouting === 'explicit' ? 'explicit' : turnProseRouting === 'hybrid' ? 'hybrid' : 'locus',
                 // Explicit text has no destination until a `>>` prefix names one,
-                // so a fresh turn's stream starts suppressed. One that resumes the
-                // turn (a tool-result-guard retry, a budget restart) starts at the
-                // destination the turn's delivered rounds have set: a private
-                // round's prefixes don't count, and the gateway's queued
-                // deliveries needn't have run. The trigger channel is only where
-                // explicit mode's typing indicator shows.
+                // so a fresh turn's stream starts suppressed. A later stream of the
+                // turn (a resume, a retry, a re-inference, a capacity-deferred
+                // compile) starts at the destination the turn's delivered rounds
+                // have set: a private round's prefixes don't count, and the
+                // gateway's queued deliveries needn't have run. The trigger channel
+                // is only where explicit mode's typing indicator shows.
                 initialTarget: turnProseRouting === 'explicit'
-                    ? (resumesTurn ? streamRouting.destination : null)
+                    ? streamRouting.destination
                     : typingChannel,
                 resolve: (spec) => {
                     const r = this.channelRegistry.resolveProseTarget(spec);
@@ -10476,7 +11520,7 @@ export class AgentFramework {
                                     .filter((block) => block.type === 'text')
                                     .map((block) => block.text)
                                     .join('\n'),
-                        }, streamRouting.logical);
+                        }, streamRouting);
                         this.emitTrace({
                             type: 'inference:completed',
                             agentName: agent.name,
@@ -10753,13 +11797,11 @@ export class AgentFramework {
                                 }
                             }
                             else {
-                                // Reuse the locus pinned at the turn's first live-routed
-                                // segment (or resolve it now for a turn whose only prose is
-                                // trailing). This dispatch runs AFTER the agent is idle (see
-                                // PR #32 note below), so a queued inbound from another channel
-                                // could otherwise overwrite the per-agent triggering channel
-                                // between segments — and a turn that narrated live into one
-                                // channel must not land its postscript in another.
+                                // The turn's own locus, read from this stream's routing
+                                // state. This dispatch runs AFTER the agent is idle (see PR
+                                // #32 note below), so a next turn may already have started
+                                // with routing of its own, and a turn that narrated live into
+                                // one channel must not land its postscript in another.
                                 const locus = resolveTurnLocus();
                                 console.error(`[routing] ${agent.name}: tool-call turn [${toolNames.join(', ')}] -> routing ${segments.length} ${liveProseRouting ? 'trailing ' : ''}prose segment(s) -> ${locus ?? '(default)'}`);
                                 // Deliver sequentially (await each) so the segments land in order.
@@ -10838,7 +11880,7 @@ export class AgentFramework {
                                     stopReason: 'exhausted',
                                     speech: '',
                                     error: 'Turn abandoned by operator quiesce',
-                                }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting.logical : undefined);
+                                }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting : undefined);
                                 this.emitTrace({
                                     type: 'inference:aborted',
                                     agentName: agent.name,
@@ -10877,8 +11919,8 @@ export class AgentFramework {
                             this.settleAgent(agent.name, {
                                 stopReason: 'exhausted',
                                 speech: '',
-                                error: statedWait === 'fail' ? this.statedWaitNotSlept(err) : err.message,
-                            }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting.logical : undefined);
+                                ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
+                            }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting : undefined);
                             this.emitTrace({
                                 type: 'inference:exhausted',
                                 agentName: agent.name,
@@ -10936,7 +11978,7 @@ export class AgentFramework {
                                             stopReason: 'exhausted',
                                             speech: '',
                                             error: 'Turn abandoned by operator quiesce',
-                                        }, streamRouting.logical);
+                                        }, streamRouting);
                                     }
                                     this.emitTrace({
                                         type: 'inference:aborted',
@@ -10981,7 +12023,7 @@ export class AgentFramework {
                                 stopReason: 'exhausted',
                                 speech: '',
                                 error: `Stream aborted: ${reason}`,
-                            }, streamRouting.logical);
+                            }, streamRouting);
                             this.emitTrace({
                                 type: 'inference:exhausted',
                                 agentName: agent.name,
@@ -11008,12 +12050,9 @@ export class AgentFramework {
                         break;
                     }
                     case 'usage': {
+                        // The stream's accumulated fresh input, which is what the
+                        // maxStreamTokens budget checks.
                         agent.lastStreamInputTokens = event.usage.inputTokens;
-                        agent.lastStreamRealInputTokens =
-                            (event.usage.inputTokens ?? 0) +
-                                (event.usage.cacheCreationTokens ?? 0) +
-                                (event.usage.cacheReadTokens ?? 0);
-                        agent.lastStreamOutputTokens = event.usage.outputTokens ?? 0;
                         // Closed-loop estimator calibration (2026-07-12). Sample the REAL
                         // prefix size of THIS API call (fresh + cache write + cache read)
                         // and hand it to the context strategy, which accepts exactly one
@@ -11037,11 +12076,36 @@ export class AgentFramework {
                         };
                         previousUsage = cumulativeUsage;
                         outputTokensSinceStamp += perCallUsage.outputTokens;
+                        const realTotal = perCallUsage.inputTokens +
+                            perCallUsage.cacheCreationTokens +
+                            perCallUsage.cacheReadTokens;
+                        // The physical-window projection adds the next two fields as the
+                        // prior round's real input and output, so they take this call's
+                        // share, never the event's own figures: the event is the stream's
+                        // running total, which after k calls holds k prompts and would
+                        // restart a stream whose next request still fits. Every real call
+                        // has a prompt, and a call that ends at a tool boundary wrote
+                        // output (its tool_use), so a 0 in either is a count the adapter
+                        // left at 0, not an empty call. A call that reported no prompt is
+                        // unreported: the fields stay the last call that reported one,
+                        // which is what the provider billed, and its own output joins the
+                        // growth since that call (lastStreamUnreportedTokens). An output
+                        // of 0 counts as maxTokens, the bound on it, in either case, so
+                        // the projection errs toward a restart. That holds once a call on
+                        // the stream has reported a prompt: the projection runs only then.
+                        const callOutputTokens = perCallUsage.outputTokens > 0
+                            ? perCallUsage.outputTokens
+                            : agent.maxTokens;
+                        if (realTotal > 0) {
+                            agent.lastStreamRealInputTokens = realTotal;
+                            agent.lastStreamOutputTokens = callOutputTokens;
+                            agent.lastStreamUnreportedTokens = 0;
+                        }
+                        else {
+                            agent.lastStreamUnreportedTokens += callOutputTokens;
+                        }
                         const strat = agent.getContextManager?.()?.getStrategy?.();
                         try {
-                            const realTotal = perCallUsage.inputTokens +
-                                perCallUsage.cacheCreationTokens +
-                                perCallUsage.cacheReadTokens;
                             strat?.reportRealInputTokens?.(realTotal);
                         }
                         catch { /* calibration is best-effort */ }
@@ -11130,8 +12194,8 @@ export class AgentFramework {
             this.settleAgent(agent.name, {
                 stopReason: 'exhausted',
                 speech: '',
-                error: statedWait === 'fail' ? this.statedWaitNotSlept(err) : err.message,
-            }, streamRouting.logical);
+                ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
+            }, streamRouting);
             this.emitTrace({
                 type: 'inference:exhausted',
                 agentName: agent.name,
@@ -11336,6 +12400,11 @@ export class AgentFramework {
      *   the operator's call; the princess precedent was disclosed first.
      */
     async puppetToolCall(agentName, toolName, input) {
+        this.refuseOperatorAfterStop('puppet');
+        return this.trackOperatorOperation('puppet:tool-call', () => this.runPuppetToolCall(agentName, toolName, input));
+    }
+    /** puppetToolCall's work, run where stop() can wait for it. */
+    async runPuppetToolCall(agentName, toolName, input) {
         const agent = this.agents.get(agentName);
         if (!agent)
             throw new Error(`Unknown agent: ${agentName}`);
@@ -12869,6 +13938,12 @@ export class AgentFramework {
             opts.placement.agent = agent.name;
             opts.placement.messageId = stored;
         }
+        // Stored while none of the agent's turns is alive, or assembled for the
+        // start now beginning: no tool boundary will weigh it.
+        if (!this.activeTurnTokens.has(agent.name) || opts?.bypassDeferralFor === agent.name) {
+            this.noteArrival(agent.name, metadata, stored);
+        }
+        this.noteForOtherResidents(agent, metadata, stored);
         return stored;
     }
     /**
@@ -12910,7 +13985,7 @@ export class AgentFramework {
         if (!agent) {
             throw new Error('No agents configured');
         }
-        agent.getContextManager().removeMessage(id);
+        removeStoredMessage(agent.getContextManager(), id);
     }
     getMessage(id) {
         const agent = this.primaryAgentName
@@ -13322,31 +14397,56 @@ export class AgentFramework {
         // this turn — surface it on the ops-alert pipeline (ops:alert trace +
         // webhook → fleet-watch) immediately, not only at the hard-down streak.
         // The per-(agent,kind) cooldown throttles repeats; failures.log already
-        // has the per-exhaustion record from logFailure above.
-        if (overBudget) {
-            this.opsAlert('context-refusal', agentName, `compile refused (${errorType ?? 'unclassified'}): ${boundFailureText(wholeReason, FAILURE_SUMMARY_MAX_CHARS)} — ` +
-                `drain breaker ${agent ? 'kicking' : 'unavailable (no agent handle)'}; ` +
-                `if this persists, raise contextBudgetTokens or overBudgetGraceRatio.`, { skipLog: true });
-        }
-        if (agent && overBudget && !this.overBudgetDrainInFlight.has(agentName)) {
+        // has the per-exhaustion record from logFailure above. It says whether
+        // the drain breaker kicks, decided where the kick is. What ends drains is
+        // stop(), not a framework that was never started: one run with
+        // runUntilIdle() has no maintenance timer, so a drain is its recovery.
+        const drainState = !overBudget ? undefined
+            : !agent ? 'unavailable (no agent handle)'
+                : this.providerAdmissionClosed ? 'not kicked: the framework is stopping'
+                    : this.surgeryHold ? 'not kicked: a surgery holds the store'
+                        : this.overBudgetDrainInFlight.has(agentName) ? 'already draining'
+                            : 'kicking';
+        if (agent && drainState === 'kicking') {
             this.overBudgetDrainInFlight.add(agentName);
-            void (async () => {
+            // Like a maintenance pass: none starts once stop() has begun, it starts
+            // no tick while a surgery holds the store, and a surgery, a
+            // switchBranch or stop() waits for the tick in flight. It joins the
+            // drains they wait for before the alert is raised and before its body
+            // runs, so the alert's listeners find it: one that begins stop() or a
+            // surgery waits for it, and its body then ticks none and says why. So
+            // does a stop() made from inside its first tick, before that tick's
+            // first await.
+            const drain = Promise.resolve().then(async () => {
                 let ticks = 0;
                 try {
                     const cm = agent.getContextManager();
-                    while (ticks < 8) {
+                    while (ticks < 8 && !this.providerAdmissionClosed && !this.surgeryHold) {
                         await cm.tick();
                         ticks++;
                     }
-                    console.error(`[inference-failed] drain kicked for ${agentName} (OverBudget breaker, ${ticks} ticks)`);
+                    const stopped = ticks >= 8 ? '' : this.providerAdmissionClosed ? ', stopped as the framework stops' : ', stopped while a surgery holds the store';
+                    console.error(`[inference-failed] drain kicked for ${agentName} (OverBudget breaker, ${ticks} ticks${stopped})`);
                 }
                 catch (err) {
-                    console.error(`[inference-failed] drain kick failed for ${agentName} after ${ticks} ticks: ${describeFailureWithFrames(err)}`);
+                    if (err instanceof MaintenanceWithdrawnError) {
+                        console.error(`[inference-failed] drain kicked for ${agentName} (OverBudget breaker, ${ticks} ticks, stopped: ${err.message})`);
+                    }
+                    else {
+                        console.error(`[inference-failed] drain kick failed for ${agentName} after ${ticks} ticks: ${describeFailureWithFrames(err)}`);
+                    }
                 }
                 finally {
                     this.overBudgetDrainInFlight.delete(agentName);
                 }
-            })();
+            });
+            this.overBudgetDrains.add(drain);
+            void drain.finally(() => { this.overBudgetDrains.delete(drain); });
+        }
+        if (overBudget) {
+            this.opsAlert('context-refusal', agentName, `compile refused (${errorType ?? 'unclassified'}): ${boundFailureText(wholeReason, FAILURE_SUMMARY_MAX_CHARS)} — ` +
+                `drain breaker ${drainState}; ` +
+                `if this persists, raise contextBudgetTokens or overBudgetGraceRatio.`, { skipLog: true });
         }
         // (3) Hard-down escalation on repeated identical failure.
         if (streak >= this.inferenceFailureEscalationThreshold) {
@@ -13473,13 +14573,22 @@ export class AgentFramework {
             // belt-and-suspenders fallback.
             homeChannelResolver: (agentName) => this.conversationAgentHomes.get(agentName)
                 ?? this.conversationRouter?.channelForAgent(agentName),
-            // Route a single TRUNK agent's plain-text speech to the channel that
-            // triggered its CURRENT turn (item-3 redux). connectome-host runs every
-            // agent as a trunk (it never exposes conversation forks), so without this
-            // a reply falls back to the process-global most-recent-inbound locus and
-            // a concurrent message in another channel hijacks it. Empty for
-            // heartbeat / no-trigger turns → correct global fallback.
-            activeChannelResolver: (agentName) => this.activeTriggerChannels.get(agentName),
+            // A single TRUNK agent's channel for its CURRENT turn (item-3 redux):
+            // its locus once the turn has one, a re-pin's or a channel_open's
+            // included, else the channel that triggered the turn. connectome-host
+            // runs every agent as a trunk (it never exposes conversation forks), so
+            // without this a reply falls back to the process-global
+            // most-recent-inbound locus and a concurrent message in another
+            // channel hijacks it. An opening start resolves the turn's locus from
+            // it (the trigger channel then), and the channel context names it, so
+            // a later start of the turn is told where its unprefixed speech lands
+            // unless a hybrid `>>>` destination takes it. Empty for a heartbeat /
+            // no-trigger turn until its locus is resolved, so that resolution
+            // takes the global fallback; the turn then keeps that channel.
+            activeChannelResolver: (agentName) => {
+                const routing = this.turnRouting.get(agentName);
+                return routing?.locus ?? routing?.triggerChannel;
+            },
             // A text-only turn whose speech couldn't be delivered must not vanish
             // silently: record a `[discord-send-failed]` marker in chronicle so the
             // agent sees, on her next turn, that her reply never reached the human.
@@ -13570,15 +14679,17 @@ export class AgentFramework {
                 }
                 // Fail-open: log and continue with remaining servers
                 const err = error instanceof Error ? error : new Error(String(error));
-                console.error(`Failed to connect MCPL server "${config.id}":`, err.message);
+                console.error(`Failed to connect MCPL server "${config.id}": ${err.message}${withStderr(err)}`);
                 // Reaching this catch means no stub was created, so nothing will
                 // retry — except in the edge case where addServer succeeded (with a
                 // reconnecting stub) and a later setup step threw; config.reconnect
                 // is the best cheap approximation of that.
+                const stderrTail = stderrTailOf(err);
                 this.emitTrace({
                     type: 'mcpl:server-connect-failed',
                     serverId: config.id,
                     error: err.message,
+                    ...(stderrTail === undefined ? {} : { stderrTail }),
                     attempt: 0,
                     willRetry: config.reconnect === true,
                 });
@@ -13603,9 +14714,19 @@ export class AgentFramework {
     /**
      * Reconcile the durable ledger with Chronicle, then deliver every server's
      * work. A drain still running is waited for and then followed by a fresh
-     * pass (drainForGeneration).
+     * pass (drainForGeneration). Like the other operator entry points, it's
+     * refused once stop() has begun, and stop() waits for one already running.
+     * The framework's own branch moves start their delivery without awaiting
+     * it (startDiscordAwarenessDelivery).
      */
-    async syncDiscordAwarenessMarkers(_onlyServerId) {
+    async syncDiscordAwarenessMarkers(onlyServerId) {
+        this.refuseOperatorAfterStop('awareness sync');
+        return this.trackOperatorOperation('awareness:sync', () => this.runDiscordAwarenessSync(onlyServerId));
+    }
+    /** The sync's work. It installs the MCPL data-plane gate before its first
+     *  await, so a caller that starts it while holding the store puts the gate
+     *  up before releasing the store. */
+    async runDiscordAwarenessSync(_onlyServerId) {
         if (!this.discordAwarenessOutbox)
             return;
         // A targeted retry may discover pending work for other Discord servers
@@ -13641,10 +14762,7 @@ export class AgentFramework {
                     throw new Error(`Cannot safely resume Discord suppression ${batch.id}: interval ` +
                         `${interval.fromId}..${interval.toId} is only partially present`);
                 }
-                if (interval.fromId === interval.toId)
-                    cm.removeMessage(from.id);
-                else
-                    cm.removeMessages(from.id, to.id);
+                removeStoredMessages(cm, from, to);
             }
             this.discordAwarenessOutbox.activate(batch.id);
             console.error(`[discord-awareness] resumed suppression batch ${batch.id}`);
@@ -13903,6 +15021,15 @@ export class AgentFramework {
                 error: `Discord awareness accounting unhealthy: ${err.message}`,
             });
         }
+        // A stopping host closes these connections itself, so recycling them now
+        // would start reconnects only for stop() to close them again. Release the
+        // barrier instead, as a completed one is released: nothing waits on a
+        // rejected barrier, and unless the host is quiesced, what the pause held
+        // back reaches the listeners' stopping refusal.
+        if (this.queue?.isClosed) {
+            this.completeMcplDataPlaneGate(barrier);
+            return;
+        }
         await Promise.all(connections.map(async (connection) => {
             await connection.reconnectAfterFailure().catch((closeError) => {
                 console.error(`[discord-awareness] could not recycle unhealthy connection ${connection.id}:`, closeError instanceof Error ? closeError.message : closeError);
@@ -14374,6 +15501,10 @@ export class AgentFramework {
      * connection/handshake fails.
      */
     async connectMcplServer(config) {
+        this.refuseOperatorAfterStop('connect MCPL server');
+        return this.trackOperatorOperation('mcpl:connect', () => this.runConnectMcplServer(config));
+    }
+    async runConnectMcplServer(config) {
         // Lazily bring up the MCPL subsystem — a framework that started with zero
         // configured servers can still deploy its first one at runtime.
         if (!this.mcplServerRegistry || !this.mcplHostCapabilities) {
@@ -14402,6 +15533,10 @@ export class AgentFramework {
      * No-op-ish if the server is not connected (still clears routing state).
      */
     async disconnectMcplServer(id) {
+        this.refuseOperatorAfterStop('disconnect MCPL server');
+        return this.trackOperatorOperation('mcpl:disconnect', () => this.runDisconnectMcplServer(id));
+    }
+    async runDisconnectMcplServer(id) {
         if (!this.mcplServerRegistry) {
             throw new Error('MCPL subsystem is not initialized');
         }
@@ -14428,6 +15563,10 @@ export class AgentFramework {
      * failures. Throws if the server has no stored config and none is given.
      */
     async restartMcplServer(id, newConfig) {
+        this.refuseOperatorAfterStop('restart MCPL server');
+        return this.trackOperatorOperation('mcpl:restart', () => this.runRestartMcplServer(id, newConfig));
+    }
+    async runRestartMcplServer(id, newConfig) {
         const config = newConfig ?? this.mcplServerConfigs.get(id);
         if (!config) {
             throw new Error(`MCPL server "${id}" is not configured`);
@@ -14438,8 +15577,8 @@ export class AgentFramework {
         // refuses the restart and leaves the running child up, whatever the
         // server's baseline or transport. (No outbox configured: nothing to read.)
         this.getPlacedReactionBaseline();
-        await this.disconnectMcplServer(id);
-        await this.connectMcplServer(config);
+        await this.runDisconnectMcplServer(id);
+        await this.runConnectMcplServer(config);
     }
     /**
      * List configured MCPL servers with live connection status and the number
@@ -14650,8 +15789,8 @@ export class AgentFramework {
                 if (this.discordAwarenessBarrier)
                     await this.awaitDiscordAwarenessBarriers();
                 // A stopping host runs no host command: refused like the requests
-                // above, before its handler runs.
-                if (this.queue?.isClosed) {
+                // above, before its handler runs, from the moment stop() has begun.
+                if (this.stopHasBegun()) {
                     this.refuseServerItem('host/command', connection.id, answer, { kind: 'refused' });
                     return;
                 }
@@ -14729,6 +15868,7 @@ export class AgentFramework {
                 type: 'mcpl:server-connect-failed',
                 serverId: connection.id,
                 error: params.error,
+                ...(params.stderrTail === undefined ? {} : { stderrTail: params.stderrTail }),
                 attempt: params.attempt,
                 willRetry: connection.willReconnect,
             });
@@ -14738,6 +15878,7 @@ export class AgentFramework {
                 type: 'mcpl:server-connect-failed',
                 serverId: connection.id,
                 error: params.error,
+                ...(params.stderrTail === undefined ? {} : { stderrTail: params.stderrTail }),
                 attempt: params.attempt,
                 willRetry: connection.willReconnect,
             });
@@ -14746,7 +15887,12 @@ export class AgentFramework {
             // 5 failed attempts ≈ a few minutes of outage. Throttled per
             // (serverId, kind), so a long outage re-posts every ~15 min.
             if (params.attempt >= 5) {
-                this.opsAlert('mcpl-down', connection.id, `MCPL server unreachable (attempt ${params.attempt}): ${params.error}`);
+                this.opsAlert('mcpl-down', connection.id, 
+                // Not the server's stderr (params.stderrTail): the webhook posts
+                // outside the process, and a server's stderr can hold a credential
+                // its configuration gives it, such as a token, which nothing here
+                // redacts.
+                `MCPL server unreachable (attempt ${params.attempt}): ${params.error}`);
             }
         });
         // A late response to a tools/call that already timed out, carrying
@@ -14782,7 +15928,7 @@ export class AgentFramework {
         // on it would erase every checkpoint tree on an ordinary host restart while
         // a SIGKILL preserves them. Permanent removal is owned solely by
         // disconnectMcplServer, which deletes the trees explicitly.
-        connection.on('close', (code, signal) => {
+        connection.on('close', (code, signal, info) => {
             this.featureSetManager?.removeServer(connection.id);
             // RFC-008: a closed provider's class hints are stale — on reconnect it
             // may class its tools differently. Until the next tools/list its tools
@@ -14793,6 +15939,9 @@ export class AgentFramework {
                 serverId: connection.id,
                 code: code ?? null,
                 signal: signal ?? null,
+                // The transport's own words only: a WebSocket server's close text
+                // stays off the trace.
+                reason: info?.reason !== undefined && !info.reasonFromPeer ? boundFailureText(info.reason) : null,
                 willReconnect: connection.willReconnect,
             });
             this.emitTrace({ type: 'module:removed', moduleName: `mcpl:${connection.id}` });
@@ -15035,6 +16184,9 @@ export class AgentFramework {
         this.emitTrace({ type: 'tool:started', module: `mcpl:${serverId}`, tool: toolName, callId: call.id, input: call.input });
         const startTime = Date.now();
         const args = (call.input && typeof call.input === 'object') ? call.input : {};
+        // The turn that sends: a send's engaged channel is recorded on it, even
+        // when the send's result, or the open that follows, comes after the turn.
+        const sendingTurn = SEND_ENGAGEMENT_TOOLS.has(toolName) ? this.turnRouting.get(agentName) : undefined;
         // Build state params for stateful tools (Step 8).
         // A tools/list attribution selects that exact stateful set. Untagged tools
         // retain the host-managed or unique server-managed fallback, but never guess
@@ -15122,12 +16274,7 @@ export class AgentFramework {
                         // the microtask queue, i.e. before the tool-result event
                         // that evaluates injections.
                         if (status !== 'unknown-channel' && status !== 'ambiguous') {
-                            let engaged = this.turnEngagedChannels.get(agentName);
-                            if (!engaged) {
-                                engaged = new Set();
-                                this.turnEngagedChannels.set(agentName, engaged);
-                            }
-                            engaged.add(channelId ?? target);
+                            sendingTurn?.engaged.add(channelId ?? target);
                         }
                         if (status === 'opened') {
                             console.error(`[channel] ${agentName}: explicit ${toolName} into closed channel ${target} — opened (send implies engagement)`);
@@ -15233,6 +16380,15 @@ export class AgentFramework {
         }
         this.emitTrace({ type: 'tool:started', module: 'channels', tool: call.name, callId: call.id, input: call.input });
         const startTime = Date.now();
+        // The turn that called: a channel_open's result records its trigger
+        // channel there, however late it arrives, and moves its locus while the
+        // turn is still open, even once another start's routing is the agent's
+        // live one. A silent turn's open moves no locus: no silent start or
+        // resume registers its routing state as the open turn (openLogical), and
+        // a non-silent resume that does, a budget restart batched with an
+        // ordinary wake, starts only once its over-budget boundary has every
+        // result of the round.
+        const callingTurn = this.routingOf(agentName);
         this.channelRegistry.handleChannelToolCall(call.name, call.input, { kind: 'agent', agentName })
             .then((result) => {
             const durationMs = Date.now() - startTime;
@@ -15240,10 +16396,10 @@ export class AgentFramework {
             // A successful channel_open plants the agent's feet in the opened
             // channel. The agent's own deliberate open is the strongest "my next
             // words go here" signal in the system — stronger than any injection —
-            // so it MOVES the current turn's prose pin (turnLocusPins), not just
-            // the next turn's trigger state. (The original 2026-07-21 Aria fix
-            // set only activeTriggerChannels, which resolveLocus reads at the
-            // NEXT turn's freeze — the turn-frozen refactor had silently
+            // so it MOVES the current turn's locus (TurnRouting.locus), not just
+            // its trigger channel. (The original 2026-07-21 Aria fix set only
+            // the trigger channel, which resolveLocus reads at the NEXT turn's
+            // freeze — the turn-frozen refactor had silently
             // regressed the "reply right after opening" case; found while
             // mapping the routing logic 2026-07-31, antra-ratified fix.) The
             // announcement rides THIS TOOL RESULT — model-requested content,
@@ -15254,10 +16410,19 @@ export class AgentFramework {
                 const opened = result.data?.channelId
                     ?? call.input?.channelId;
                 if (opened) {
-                    this.activeTriggerChannels.set(agentName, opened);
+                    callingTurn.triggerChannel = opened;
                     const openerAgent = this.agents.get(agentName);
-                    if (openerAgent && (openerAgent.proseRouting === 'locus' || openerAgent.proseRouting === 'hybrid')) {
-                        this.turnLocusPins.set(agentName, opened);
+                    // The move is one this result tells the agent, so it needs the
+                    // turn that called still open. A result that lands after the turn
+                    // settled is dropped, so the agent never reads it, whether or not
+                    // a later start has replaced the turn's routing state yet: the
+                    // turn's locus stays where the agent was last told, for a resume
+                    // that opens the turn again, and so does the announce baseline,
+                    // which is the agent's across turns.
+                    if (openerAgent
+                        && (openerAgent.proseRouting === 'locus' || openerAgent.proseRouting === 'hybrid')
+                        && this.openLogical.get(agentName) === callingTurn) {
+                        callingTurn.locus = opened;
                         this.lastAnnouncedLocus.set(agentName, opened);
                         result = {
                             ...result,
@@ -15521,7 +16686,7 @@ export class AgentFramework {
                 }
             }
             else {
-                const locus = this.turnLocusPins.get(agentName) ?? null;
+                const locus = this.turnRouting.get(agentName)?.locus ?? null;
                 this.channelRegistry.routeSpeech(agentName, text, locus).catch((err) => {
                     console.error('[sleep] announce failed:', err instanceof Error ? err.message : err);
                 });
@@ -16355,9 +17520,10 @@ export class AgentFramework {
             // Conversation identity = the agent (a trunk agent IS its own conversation;
             // forks get their own agent). The turn's channel LOCUS — the "proper
             // conversation tracking" this once flagged as a TODO — is now tracked
-            // per-agent in `activeTriggerChannels` and surfaced to the agent via
-            // buildChannelContext (channels.defaultOutgoing) below, so the agent is
-            // told the same channel its speech will route to (item-3 redux).
+            // on the turn's routing state (TurnRouting.locus, from its trigger
+            // channel) and surfaced to the agent via buildChannelContext
+            // (channels.defaultOutgoing) below, so the agent is told the same
+            // channel its speech will route to (item-3 redux).
             conversationId: agent.name,
             turnIndex: 0, // Simplified; needs per-conversation counter TODO
             userMessage: null, // Could extract from trigger context