@animalabs/agent-framework 0.22.1 → 0.22.3

package/dist/src/framework.d.ts

@@ -104,6 +104,35 @@ export declare class ResumeBlockedError extends Error {
         preview: RuntimeSettingsPreview;
     }>);
 }
+/**
+ * Thrown by `quiesce()` without `abandon` when the queue of deferred context
+ * writes can't reach disk: it's over its cap, so its record can't hold it, or
+ * its write failed, and that error is the `cause`. So the queue as it
+ * stands isn't on disk. The host's mode is as it was, and the
+ * message names the ways out, among them quiescing with `abandon: true`,
+ * which goes on with the queue in memory.
+ */
+export declare class QuiesceBlockedError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * How `runEphemeralToCompletion` rejects when a retryable provider failure
+ * states a wait the run won't sleep: one longer than an ephemeral run sleeps
+ * in its turn (600 s), an infinite one, or one that is `NaN`. The run ends at
+ * once, without retrying inside the wait, and every other ending of the run
+ * rejects with a plain `Error`. `retryAfterMs` is the wait as the provider
+ * stated it, in milliseconds, so `Infinity` or `NaN` in those two cases: a
+ * host that schedules a rerun from it handles a value that isn't finite, and
+ * one past the 2,147,483,647 ms a timer can hold. The message says the same
+ * in words. A host can test `instanceof` or the `name`, which also holds for
+ * an error from another copy of this package.
+ */
+export declare class ProviderWaitNotSleptError extends Error {
+    readonly retryAfterMs: number;
+    constructor(message: string, retryAfterMs: number);
+}
 interface InferenceToolSnapshot {
     sameRoundThinkTextPolicy: SameRoundThinkTextPolicy;
 }
@@ -115,18 +144,19 @@ interface InferenceToolSnapshot {
  *
  * 400 and 422 are how a provider answers a request that fails its
  * validation, as a history it can't accept does, but other refusals come
- * back the same way, such as Anthropic's 400 for a credit balance that's too
- * low. A 413 is the request's size. When the newest exchange made it too
- * large, as an oversized attachment does, shedding that exchange may bring
- * the request back under the limit, and nothing else in the framework
- * recovers a 413; when the history as a whole is too large, the shed doesn't
- * help, and the breaker stops at its rewind cap. The 413 arm takes both
- * labels a 413 arrives under, invalid_request and context_length, because
- * membrane's label for a 413 differs by version and adapter. Other statuses
- * keep the history, since shed history can't be got back and the status
- * gives no sign that a shed would help: a 404 is a model or an endpoint that
- * doesn't exist, and 405, 409, 410 and 415 are about the HTTP request or the
- * resource, as a rule, rather than the conversation.
+ * back the same way, such as a refusal of the account that membrane doesn't
+ * recognize by its text. A 413 is the request's size. When the newest
+ * exchange made it too large, as an oversized attachment does, shedding that
+ * exchange may bring the request back under the limit, and nothing else in
+ * the framework recovers a 413; when the history as a whole is too large,
+ * the shed doesn't help, and the breaker stops at its rewind cap. The 413 arm
+ * takes both labels membranes have given a 413, invalid_request and
+ * context_length (see the notes below). Other statuses keep the history,
+ * since a shed takes the exchange out of the agent's context, which only an
+ * operator's undo brings back, and the status gives no sign that a shed
+ * would help: a 404 is a model or an endpoint that doesn't exist, and 405,
+ * 409, 410 and 415 are about the HTTP request or the resource, as a rule,
+ * rather than the conversation.
  *
  * The table test in test/inference-exhaustion-rewind.test.ts is this
  * predicate's contract. The notes below on which membrane version gives which
@@ -141,13 +171,24 @@ interface InferenceToolSnapshot {
  *   adapter files every status it doesn't list (404, 405, 409, 410, 413,
  *   415, 422 …) as invalid_request, so it alone produces an invalid_request
  *   at 413 or 422, and no 0.5.86 adapter produces a context_length at 413.
- * - From membrane #56 (merged, not yet in a release), one table serves every
- *   adapter. Auth codes and context overflow are checked on a 400 or 422
- *   first, a 404 is invalid_request, a 413 is context_length, and other 4xx
- *   are invalid_request. So a 413 still sheds, an Anthropic one included,
- *   while a context_length at 400 or 422, a token overflow, keeps the
- *   history. The 422 arm then also covers an OpenAI-compatible server, such
- *   as a FastAPI one, that answers a validation failure with 422.
+ * - From membrane 0.5.87 (membrane #56 and #107), this package's floor, every
+ *   adapter sends an HTTP failure through one status table
+ *   (errorFromProviderStatus). On a 400 or 422, auth codes and reasons and
+ *   the two account refusals it recognizes by their text (a balance too low,
+ *   usage limits reached) are auth, and a context overflow, by its code or
+ *   text, is context_length. A 401, 402 or 403 is auth, a 408 timeout, a 429
+ *   rate_limit, a 404 invalid_request and a 413 context_length; other 4xx
+ *   are invalid_request. So a 413 the table types sheds, an Anthropic one
+ *   included, while a context_length at 400 or 422, a token overflow, keeps
+ *   the history, and so does an account refusal, which is auth. An adapter
+ *   can type a failure before the table does, as Anthropic's does for a
+ *   gateway's aggregate error (server). A failure with no HTTP status takes
+ *   the status its provider code implies when the table knows the code, as
+ *   for Anthropic's mid-stream errors, and is otherwise typed from its
+ *   message, with no status. The 422 arm also covers an
+ *   OpenAI-compatible server, such as a FastAPI one, that answers a
+ *   validation failure with 422. The test of provider answers through the
+ *   table, beside the table test, pins how the two meet at the floor.
  *
  * An error with no status, from a membrane that reports none, keeps the rule
  * the breaker had before: the type alone.
@@ -162,6 +203,22 @@ export declare class AgentFramework {
     private stopPromise;
     private stopCompleted;
     private ownedStoreClosed;
+    /** Whether the latest stop() stopped in time everything it waits on with
+     * its deadline (an operator's operations, modules and MCPL servers),
+     * whatever failed after that. create()'s release reads it to say whether
+     * part of what a failed create() started may still be running. */
+    private stopFinishedTeardown;
+    /** An operator's operations in flight, and the config materializations they
+     * start. stop() waits until this set is empty before it tears down, unless
+     * its wait budget runs out. */
+    private readonly operatorOperations;
+    /** What a wait of stop()'s left running when its budget ran out, by its
+     * promise: a stream it cancelled or an event loop still in a call. A later
+     * stop() waits for each again, beside what it finds, whatever has happened
+     * since to the entry it was found under (a run's end removes its stream's,
+     * a start() replaces the loop), so a budget never lets the store close
+     * under work still running. Each leaves once it settles. */
+    private readonly leftRunning;
     private membrane;
     private queue;
     private agents;
@@ -169,16 +226,6 @@ export declare class AgentFramework {
     private inferencePolicy;
     private errorPolicy;
     private pendingRequests;
-    /**
-     * Per-agent channel that triggered the agent's CURRENT inference turn, if any
-     * (item-3 redux). Read by the ChannelRegistry's `activeChannelResolver` to
-     * route a single-trunk agent's plain-text speech back to the channel it is
-     * answering, instead of the process-global most-recent-inbound locus that a
-     * concurrent message elsewhere can hijack. Set at turn start (or cleared for a
-     * heartbeat / no-trigger turn) in startAgentStream; overwritten by the next
-     * turn. Never read between turns (a given agent runs one turn at a time).
-     */
-    private activeTriggerChannels;
     private running;
     private loopPromise;
     /** Quiesce/maintenance mode (issue #122). DELIBERATELY separate from
@@ -190,6 +237,16 @@ export declare class AgentFramework {
      * running; only new turns (wake gate in processInferenceRequests) and MCPL
      * data planes are held. */
     private quiesced;
+    /** Whether the host-mode record may say quiesced, as this process last read
+     * or wrote it. quiesce() writes the record before it sets `quiesced`, and
+     * resume() clears `quiesced` before the record, so after a resume whose
+     * clear failed, or a quiesce whose write failed partway, memory can say
+     * serving while the record says quiesced, until a resume() clears it. */
+    private hostModeRecordMayBeQuiesced;
+    /** Whether a resume() is between serving and clearing the record: it has
+     * cleared `quiesced` and is flushing the deferred writes, then clearing the
+     * record. A resume() on the serving host leaves the record to it. */
+    private resumeInFlight;
     private quiesceReason?;
     private quiescedAt?;
     private traceListeners;
@@ -201,6 +258,14 @@ export declare class AgentFramework {
     private maintenanceRunId;
     private currentMaintenanceRun;
     private maintenanceHistory;
+    /** Each agent's last reported maintenance failure, its whole text and when
+     *  it was alerted, until its maintenance goes without one
+     *  (reportMaintenanceFailure). */
+    private maintenanceFailureReported;
+    /** Run records whose failure repeated one already reported, and whose report was suppressed. */
+    private maintenanceRepeats;
+    /** An operator's maintain (maintenanceTick) asked for the pass running or about to run: the run it records is kept in the history whatever it met. A pass with nothing to run records none. */
+    private maintenancePassRequested;
     private providerGates;
     private providerAccelerationCooldowns;
     private providerAccelerationRecoveries;
@@ -222,32 +287,11 @@ export declare class AgentFramework {
     private processLoggingPersist;
     private processLoggingBroadcast;
     private activeStreams;
-    /** Per-agent output locus FROZEN for the CURRENT logical turn. Resolved
-     *  eagerly in startAgentStream (home → addressed trigger → global default)
-     *  and never moved until the next turn: mid-turn injected messages — ambient
-     *  chatter, reactions, system markers — must not hijack where the agent's
-     *  plain prose lands (2026-07-21 Cairn lounge misroute). Lives here — not in
-     *  driveStream locals — so the pin survives a context-budget stream restart,
-     *  which continues the same logical turn in a fresh driveStream. Cleared or
-     *  re-set at the start of every non-restart turn. Since 2026-07-31 the pin
-     *  is no longer fully frozen: an ADDRESSED conversational injection — or a
-     *  conversational follow-up in a channel the agent itself explicitly sent
-     *  into this turn (turnEngagedChannels) — re-pins it at the boundary (see
-     *  the addressed re-pin block in the tool-result handler). Ambient chatter
-     *  elsewhere, reactions, and system markers still cannot move it. */
-    private turnLocusPins;
-    /** Channels the agent EXPLICITLY sent into during the CURRENT turn
-     *  (SEND_ENGAGEMENT_TOOLS, successful calls), per agent. Second re-pin
-     *  signal: a conversational reply in a channel the agent just engaged is
-     *  addressed by context even without a mention (2026-07-31 n=7: q's
-     *  #portables follow-up — no @mention — was answered in trailing prose
-     *  that followed the stale pin into repligate's DM). No author-kind
-     *  filter: agent-residents are full participants, and the bot flag
-     *  tracks nothing that matters (antra). Reactions/system markers are
-     *  excluded by isConversationalInjection; the engaged-this-turn scope
-     *  keeps unrelated channels from moving the pin. Cleared at every fresh
-     *  turn's start; budget restarts keep it. */
-    private turnEngagedChannels;
+    /** Told once per inbound acceptance (mcpl/inbound-source.ts). An internal
+     *  seam, unset here: the receipt work (shelf-354) assigns it inside the
+     *  framework, and tests set it by cast. */
+    private inboundAcceptanceObserver?;
+    private streamBoundaryEnds;
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
      *  not a reaction or a system marker) into the live stream. Tells
      *  driveStream to clear sticky explicit-send suppression before handling
@@ -258,15 +302,19 @@ export declare class AgentFramework {
      *  (KV-safe, no per-turn chatter). In-memory — after a process restart the
      *  first turn's locus is announced once to re-establish the baseline. */
     private lastAnnouncedLocus;
-    /** Latest bounced (undelivered) prose per agent — the `{{unsent}}` source. */
-    private proseClipboards;
-    /**
-     * Each agent's routing state for its current turn (TurnRouting): the
-     * sticky destination, the turn's destination for a resumed stream,
-     * hybrid's hold, a `!` continuation and receipt tallies. A fresh turn starts a new object
-     * instead of clearing the old one, and a stream that resumes the turn
-     * (resumesLogicalTurn) keeps it. A queued delivery holds the object of the
-     * turn that queued it, so prose a turn leaves queued when it ends (a
+    /** Every resident's held drafts: plain speech that was suppressed, bounced
+     *  or left without a destination, never published except by their
+     *  resident's resend, kept until resent or dismissed. A logical turn's own
+     *  drafts, for its receipt, are its TurnRouting's. */
+    private proseDrafts;
+    /**
+     * Each agent's routing state for its current logical turn (TurnRouting):
+     * its trigger channel, locus and engaged channels, the sticky destination,
+     * the turn's destination, hybrid's hold, a ` !` continuation and receipt
+     * tallies. The start that opens a turn makes a
+     * new object instead of clearing the old one, and every later stream of
+     * the turn shares it (openLogical). A queued delivery holds the object of
+     * the turn that queued it, so prose a turn leaves queued when it ends (a
      * skip_reply ends it before its posts have run) still follows that turn's
      * destination, and its late writes can't reach the next turn.
      */
@@ -278,23 +326,25 @@ export declare class AgentFramework {
      */
     private proseSpeechChains;
     /**
-     * Each agent's open logical turn (LogicalTurn). It stays open from the
-     * fresh start that opens it until the turn settles (settleAgent: it
-     * completes, a tool ends it, or it fails or is abandoned), and every fresh
-     * start that routes prose while it is open continues it: a framework
-     * retry, the start that consumes tool results the non-streaming fallback
-     * left (whichever wake the scheduler starts it with), the later compile a
-     * provider-capacity hold defers a turn to. A silent start neither
-     * continues nor opens one. A stream that ends without settling needs to do
-     * nothing to carry its turn. Settling only detaches the turn from future
-     * starts: the settling stream keeps its own object, which its remaining
-     * deliveries, its receipt and its ` !` check go on using (a completion
-     * settles before it awaits its chain and writes its receipt). So every
-     * logical end must close inheritance once, before the next fresh start:
-     * a turn left open would hand its object, late writes and all, to an
-     * unrelated turn. A tool-ended turn settles before the next turn can
-     * start. Only the stream that holds the open turn closes it; disposal
-     * drops it, and stop() clears every agent's.
+     * Each agent's open logical turn: its routing state and receipt tallies
+     * (TurnRouting). It stays open from the start that opens it until the
+     * turn settles (settleAgent: it completes, a tool ends it, or it fails or
+     * is abandoned), and every start that routes prose while it is open
+     * continues it with that object: a framework retry, the start that
+     * consumes tool results the non-streaming fallback left (whichever wake
+     * the scheduler starts it with), the later compile a provider-capacity
+     * hold defers a turn to. A silent start neither continues nor opens one,
+     * and leaves the open turn's object untouched (its own is the live routing
+     * while it runs: turnRouting). A stream that ends without
+     * settling needs to do nothing to carry its turn. Settling only detaches
+     * the turn from future starts: the settling stream keeps its own object,
+     * which its remaining deliveries, its receipt and its ` !` check go on
+     * using (a completion settles before it awaits its chain and writes its
+     * receipt). So every logical end must close inheritance once, before the
+     * next fresh start: a turn left open would hand its object, late writes
+     * and all, to an unrelated turn. A tool-ended turn settles before the
+     * next turn can start. Only the stream that holds the open turn closes
+     * it; disposal drops it, and stop() clears every agent's.
      */
     private openLogical;
     /** Consecutive bounce-wakes per agent; capped so an agent that keeps
@@ -322,7 +372,8 @@ export declare class AgentFramework {
      * The name is single-generation, so these frames still own their terminal
      * typing/outgoing close even after runEphemeralToCompletion deregisters them. */
     private disposedEphemeralFrames;
-    /** Per-agent count of consecutive exhausted inferences (reset on any success).
+    /** Per-agent count of consecutive exhausted inferences, reset when a turn
+     *  completes (inference:completed), not when a call answers mid-turn.
      *  Drives hard-down escalation — see noteInferenceExhausted. */
     private consecutiveInferenceFailures;
     /** N consecutive failed inferences ⇒ the agent is treated as hard-down and
@@ -346,7 +397,8 @@ export declare class AgentFramework {
      *  rewind loop — see refusalHandling + rewindTriggeringTurn. */
     private refusalRewinds;
     /** Per-agent count of poison-history rewinds performed by the hard-down
-     *  breaker (noteInferenceExhausted). Reset on any successful inference.
+     *  breaker (noteInferenceExhausted). Reset when a turn completes
+     *  (inference:completed).
      *  Bounds the automatic quarantine loop the same way refusalRewinds bounds
      *  the refusal loop, so the breaker can never shed the whole history. */
     private exhaustionRewinds;
@@ -357,6 +409,8 @@ export declare class AgentFramework {
      *  tick counts in the success log stop meaning anything. One kick per agent
      *  at a time; cleared when the kick settles (success or failure). */
     private overBudgetDrainInFlight;
+    /** The over-budget drain kicks running, which a branch move waits for as it waits for a maintenance pass. */
+    private overBudgetDrains;
     /** Per-agent current rewind episode: the single consolidated marker's id and
      *  how many turns have been shed so far. One marker per episode, updated in
      *  place (see updateRewindMarker); cleared when the episode ends. */
@@ -378,9 +432,20 @@ export declare class AgentFramework {
     /** Agents an abandon could not cancel (token held, no stream) — surfaced
      *  in HostModeStatus until the next quiesce/resume. */
     private lastUnabandonable;
-    /** True while the deferred-write queue has a persisted mirror (quiesced). */
+    /** True while the deferred-write queue is mirrored to its record, so each
+     *  change of it writes it: from a write of it that reached or may reach
+     *  the record, one that failed or met the cap unless quiesce() rejected
+     *  for it (deferredWritesFellBehind), or a boot that restored it, until a
+     *  write clears the record once the queue drains. */
     private deferredWritesPersisted;
-    private deferredWritesCapWarned;
+    /** True from a write of the queue that failed or met the cap, unless
+     *  quiesce() rejected for it, until one succeeds: a run of failures
+     *  (deferredWritesFellBehind). A quiesce({ abandon: true }) over the cap
+     *  goes on rather than rejecting, so its write begins a run too. */
+    private deferredWritesBehind;
+    /** True once the cap has been met in the current run, so its line is
+     *  logged once a run, whatever began the run. */
+    private deferredWritesCapLogged;
     /** Branch-independent recovery files (see FrameworkConfig.hostModePath /
      *  deferredWritesPath). Undefined → branch-local slot fallback. */
     private hostModePath;
@@ -425,6 +490,11 @@ export declare class AgentFramework {
     private redoStacks;
     /** Liveness watchdog (fail hard on a wedged main thread). Null unless enabled. */
     private livenessWatchdog;
+    /** The frameworks a SIGUSR2 dumps (joinDiagnostics): each joins in create()
+     *  where the liveness watchdog starts, or would if it isn't enabled, and
+     *  leaves in stop() where the watchdog stops. */
+    private static readonly diagnosed;
+    private static diagnosticsListenerInstalled;
     private mcplServerRegistry;
     private featureSetManager;
     private hookOrchestrator;
@@ -453,7 +523,7 @@ export declare class AgentFramework {
      * ephemeral agents have isolated slots and are their own only readers.
      */
     private readonly sharedSlotAgents;
-    /** Group commit: one fsync per event-loop turn, shared by every waiter. */
+    /** The coalescing commit in flight, if any (see commitCoalescingDurable). */
     private coalescingCommit;
     private inferenceRouter;
     private channelRegistry;
@@ -468,6 +538,9 @@ export declare class AgentFramework {
      * turn still lands in the right channel.
      */
     private conversationAgentHomes;
+    /** Forks being spawned, by channel id, each until its spawn settles (see
+     *  routeConversation). The promise never rejects. */
+    private readonly conversationSpawns;
     /** Last idle-TTL sweep timestamp. */
     private lastConversationSweep;
     /** Forks whose TTL closure turn has been queued — disposed (removed from
@@ -480,7 +553,8 @@ export declare class AgentFramework {
      *  result marks the script that made the call, and is applied to that
      *  script's code_execution result instead of cancelling the stream
      *  mid-script (which would wedge the turn). A stopped script's late result
-     *  marks only that script, never the agent's next one. */
+     *  marks only that script, never the agent's next one. Its `turnId` is the
+     *  turn of the code_execution call running it, which its calls carry. */
     private scriptDeferredEndTurn;
     /** RFC-007: per agent, the origin of the foreground script its runner is
      *  executing, handed to that script's inner calls (scripts run one at a
@@ -556,28 +630,114 @@ export declare class AgentFramework {
     private discordAwarenessBarrierGeneration;
     private eventGate;
     private usageTracker;
-    /** Explicit-send suppression carried into a tool-result-guard retry. */
+    /** Explicit-send or private suppression carried into a tool-result-guard retry. */
     private guardRetryTurnSilenced;
     /** Presentation-only wall-clock zone; persistence remains UTC/epoch. */
     private readonly timeZone;
     private constructor();
     /**
-     * Create and start the framework.
+     * Create and start the framework. A create() that fails releases what it
+     * had acquired before its error reaches the caller, so that the caller can
+     * try again in the same process: the framework it had begun is stopped, as
+     * stop() stops one, but giving up after 30 s on each of stop()'s two cleanup
+     * waits, for an operator's operations already running and then for its
+     * modules and MCPL servers, and a store it opened is closed. A store the
+     * caller passed in is left open.
      */
     static create(config: FrameworkConfig): Promise<AgentFramework>;
+    /**
+     * The error a failed create() rejects with, once what it acquired is
+     * released: the framework it had begun is stopped, with
+     * FAILED_CREATE_TEARDOWN_TIMEOUT_MS as stop()'s teardownTimeoutMs, and a
+     * store create() opened is closed even when that stop failed or timed out.
+     * stop() keeps an owned store open when any of its waits fails or times
+     * out, so that it can be called again, but no one can call it on a
+     * framework that create() never returned. When the release doesn't finish
+     * cleanly, the rejection carries create()'s error and then the release's,
+     * and its message says what didn't finish.
+     */
+    private static releaseFailedCreate;
+    /** create()'s work once it holds its store. The framework is named in
+     *  `building` as soon as it exists, so that create() can stop it if a later
+     *  step fails. */
+    private static createOn;
+    /**
+     * Diagnostics: `kill -USR2 <pid>` dumps live wake/inference state to stderr
+     * (journal) without a restart — for catching the wake-wedge on the running
+     * process. Each framework prints its own line: the gate's `inferring` set
+     * and buffered-event count (the wedge signature), active streams, and
+     * pending inference requests. A framework joins partway through create(),
+     * once its agents, modules and event gate are built, where the liveness
+     * watchdog starts (or would, when it isn't enabled). It leaves in stop()
+     * where the watchdog stops: after stop() has waited on its streams,
+     * maintenance, event loop and operator operations, so a dump shows what
+     * those waits are on, and before its modules and MCPL servers stop, so a
+     * stop() whose teardown hangs, fails or times out doesn't keep it listed.
+     * With none in the set, one line says no framework is running. A framework
+     * started again after a completed stop() doesn't rejoin; whether that
+     * lifecycle is supported is #315.
+     *
+     * One listener serves the process, installed by the first create() to
+     * reach the join and kept: once a process's last SIGUSR2 listener is
+     * removed, the signal's default action ends the process, and a dump can
+     * arrive between one framework's stop() and the next one's create(), as on
+     * a host's session switch. Until a create() first reaches the join, the
+     * process has no listener, and the default action applies.
+     */
+    private static joinDiagnostics;
+    private printDiagnostics;
     /**
      * Start the event loop.
      */
     start(): void;
     /**
-     * Stop the event loop. Failed module/MCPL cleanup can be retried with its
-     * original context; storage stays open until that cleanup succeeds.
-     * @param teardownTimeoutMs Optional module/MCPL wait budget. Omit to wait
-     * until cleanup settles, as required by existing module/child contracts. This
-     * does not bound earlier stream or event-loop quiescence, or cancel cleanup.
+     * Stop the event loop. After a failed or timed-out wait, storage stays open
+     * and stop() can be called again. A timed-out wait lets teardown go on while
+     * what it waited for may still act on what is being torn down.
+     * @param teardownTimeoutMs Optional budget for each of stop()'s waits, in
+     * turn: on the streams it cancels, on maintenance in flight (a pass or an
+     * over-budget drain kick), on the event loop, on an operator's operations
+     * already running, then on modules and MCPL together. With a budget, a
+     * stop() can take up to five of them, besides the withheld-spill deadline
+     * of a guard's write still under way. Omit to wait until each settles, as
+     * required by existing module/child contracts. A wait whose budget runs out
+     * fails the stop() with a ShutdownTimeoutError naming what it waited for;
+     * with more than one, or beside another failure, stop() fails with an
+     * AggregateError of them all. After it:
+     * - an agent still registered whose stream is still running keeps its
+     *   deferred writes queued, since the stream may still write. The stream's
+     *   own turn-end flush takes them when it settles, if the process lives on,
+     *   and a later stop() takes what that leaves; a memory-only queue loses
+     *   them if the process exits first.
+     * - every ephemeral run still registered is ended, as after any stop(), and
+     *   its end stores what is queued for it, as at any run's end, whatever its
+     *   stream is doing: once a run has left, its stream's late events are
+     *   dropped, though a write the stream already had under way can still
+     *   land in the run's namespace after them.
+     * - an event loop still in a call, such as a module's onProcess, finishes
+     *   that call and the rest of its iteration, and then exits. A start()
+     *   made meanwhile runs its own loop beside that last iteration.
+     * - a later stop() waits again, within its own budget, for any stream or
+     *   loop this one left running, so the store never closes under it.
      */
     stop(teardownTimeoutMs?: number | undefined): Promise<void>;
     private resetCompletedStop;
+    /** Register before invoking the body, so the set holds the operation for
+     * its whole life: its synchronous trace callbacks can reenter stop(), and
+     * that stop() must find it. Invocation stays in this stack, preserving
+     * immediate mode changes; the returned promise carries its result to the
+     * caller. */
+    private trackOperatorOperation;
+    /** Whether stop() has begun: an attempt in flight (stopPromise is set before
+     * its body runs, which emits traces before the queue closes) or a closed
+     * queue (after a failed or completed stop()). The admission rule for every
+     * operator entry point, the host/command listener included. */
+    private stopHasBegun;
+    private refuseOperatorAfterStop;
+    /** Wait in rounds until the set is empty: admitted work can still start work
+     * of its own. All rounds share the caller's deadline rather than renewing
+     * its budget. */
+    private waitForOperatorOperations;
     private stopOwned;
     /**
      * Advance queued ContextManager work without requiring a new message.
@@ -597,6 +757,20 @@ export declare class AgentFramework {
     private flushAuxiliaryAdmission;
     private waitForAuxiliaryIdle;
     private withAuxiliaryAdmission;
+    /**
+     * Maintenance makes no provider call while a surgery holds the store. The
+     * surgery waits for the maintenance work that is running before it moves
+     * the branch, so a call that parked at the gate would make it wait on
+     * whatever reopens the gate: the end of a cooldown, or the retry turn a
+     * cooldown queues, which the hold itself keeps from starting.
+     */
+    private withdrawMaintenanceUnderSurgery;
+    /**
+     * Nor once stop() has closed provider admission: a stop that catches a
+     * tick is the framework stopping on purpose, so the call is withdrawn, as
+     * under a surgery's hold, and no failure is reported for it.
+     */
+    private withdrawMaintenanceWhenStopping;
     private auxiliaryMembraneFor;
     /**
      * A conversation agent's auxiliary calls (its context manager's
@@ -606,7 +780,11 @@ export declare class AgentFramework {
      * as a resident's are, so they bind its auxiliary calls too: a held model
      * is refused without a call, and an auxiliary call's own stated wait is
      * recorded for it. (An ephemeral run records nothing, its name being
-     * single-use, so its context manager keeps the plain membrane.)
+     * single-use, so its context manager keeps the plain membrane.) Its
+     * compression is the background work a resident's is, whether a
+     * maintenance tick or a drain after a message starts it, so it is withdrawn
+     * as a resident's is: a call made while a surgery holds the store, or once
+     * stop() has closed provider admission, is withdrawn without being sent.
      */
     private conversationAuxiliaryMembraneFor;
     /** The framework's membrane, with each complete() call passed through
@@ -645,7 +823,8 @@ export declare class AgentFramework {
      */
     private nonOwningProviderWait;
     /** Why an ephemeral run ended instead of sleeping a provider's stated wait,
-     *  for its caller. */
+     *  for its caller: the text, and the wait itself, which its rejection
+     *  carries (ProviderWaitNotSleptError). */
     private statedWaitNotSlept;
     /** When a hold's timer next fires: at its deadline, stepped past what one
      *  timer can hold. A hold with no deadline (a wait held until released, or
@@ -710,26 +889,44 @@ export declare class AgentFramework {
     private recordProviderAccelerationRecovery;
     private cancelProviderAdmission;
     private startQueuedMaintenance;
+    /** resume()'s refusal while a surgery holds the store. */
+    private refuseResumeUnderSurgery;
+    /** Whether maintenance work is running: a pass, or an over-budget drain kick. */
+    private maintenanceRunning;
+    /** Wait for the maintenance work that is running, whatever its outcome. */
+    private settleMaintenancePass;
     private runQueuedMaintenance;
+    /**
+     * One agent's maintenance failure: recorded on its run, bounded as every
+     * failure sink is (`record.error`), and logged and alerted for that agent
+     * with the whole text. A failure that lasts, such as a manager whose
+     * strategy failed to initialize, meets every pass, a few seconds apart. It
+     * is logged and alerted again only when its whole text changes, once
+     * opsAlert's cooldown for it has passed since the webhook last posted it
+     * (so the webhook, which posts a kind at most once per cooldown, hears a
+     * failure that lasts), or after a pass in which that agent's maintenance
+     * went without a failure (maintenanceFailureReported). A record whose
+     * failure isn't reported again is marked as a repeat, and a pass whose
+     * every record is a repeat that took no tick stays out of the history.
+     */
+    private reportMaintenanceFailure;
+    /**
+     * An agent's context readiness, or the error that reading it threw. The
+     * context manager refuses while its strategy's initialization is pending
+     * or has failed (context-manager 0.14), and a strategy can refuse on its
+     * own, as the autobiographical one does after a store-level branch switch
+     * it hasn't reloaded for. Every such throw is that agent's failure.
+     */
+    private contextReadiness;
+    /** The strategy's progress snapshot, for diagnostics: one it can't give reads as none. */
     private contextProgress;
     /**
-     * A server's request or notification the host couldn't handle, answered
-     * with a JSON-RPC error when it is a request (a notification has no one to
-     * answer, and is logged), rather than thrown out of the connection's
-     * listener, where it was an unhandled rejection and the server's request
-     * waited for its timeout.
-     * - `refused`: the listener turned it away before its handler ran; the
-     *   host is stopping, and none of it was taken. Answered -32000, "the host
-     *   is stopping", the code the push coalescer already gives a stopping
-     *   host: the server can send it again to the host's next run.
-     * - `failed`: the handler threw, whatever it threw, `undefined` included.
-     *   While the host stops (its queue closed), that's answered -32000 too,
-     *   with the handler's own message after the stop wording; on a live host
-     *   it's a fault, answered -32603 with the handler's message. The handler
-     *   may have admitted part of the request first (an earlier message of a
-     *   batch), so nothing here claims that none of it was taken.
-     * A request the handler already answered before it threw isn't answered
-     * again: the failure is logged.
+     * A server's request turned away before its handler ran, because the host
+     * is stopping and none of it was taken: answered -32000, "the host is
+     * stopping", the code the push coalescer already gives a stopping host, so
+     * the server can send it again to the host's next run, and logged. A
+     * handler's own failure is answered by containedInboundHandler, with
+     * -32000 and the stop wording alone once the host is stopping.
      */
     private refuseServerItem;
     /**
@@ -795,6 +992,40 @@ export declare class AgentFramework {
      * Abort an in-flight inference for an agent.
      */
     abortInference(agentName: string, reason?: string): boolean;
+    /**
+     * Terminal for a deliberate cancellation of a live stream: the host's Stop
+     * button, an admin abort, a subagent reclaim — anything that went through
+     * Agent.cancelStream(reason) / abortInference(reason). Both of a stream's
+     * cancel twins land here (`aborted` with wire reason 'user', or `error`
+     * for implementations that report cancel() that way — see
+     * host-quiesce.test.ts), so the two cannot drift: settle the turn, ONE
+     * inference:aborted carrying the caller's reason, the neutral
+     * [turn-interrupted] marker, an attributable inference-log terminal, gate
+     * release. Deliberately none of the failure accounting: inference:failed /
+     * inference:exhausted feed the consecutive-failure streak, hard-down ops
+     * alerts, the poison-history breaker and the "[inference-failed]" marker —
+     * all of which told a resident, in the user's voice, that its turn failed
+     * and advised remediation for a failure that never happened — and
+     * errorPolicy would relaunch the very inference someone just stopped.
+     *
+     * Only called while `agent` still owns stream `myStreamId`.
+     */
+    private settleDeliberateCancel;
+    /**
+     * Terminal for a stop the framework itself made: stop()'s shutdown and an
+     * operator's quiesce abandon, each recorded in frameworkCancelledStreams
+     * before the cancel. A stream may report that cancel as `aborted`, as
+     * `error`, or by just closing, and each of those ends here, so the three
+     * cannot drift: settle the turn (an ephemeral run rejects with the stop's
+     * own text), an attributable inference-log terminal, ONE inference:aborted
+     * carrying the framework's reason, gate release. No [turn-interrupted]
+     * marker, since nobody stopped the agent, and none of the failure
+     * accounting that inference:failed / inference:exhausted drive.
+     *
+     * The script abort, reset and settle happen only while `agent` still owns
+     * stream `myStreamId`; the log line and the trace are written either way.
+     */
+    private settleFrameworkCancel;
     /**
      * Get all registered modules.
      */
@@ -857,7 +1088,11 @@ export declare class AgentFramework {
     private guardSpillsClosedFor;
     /** A new agent's guard: its persisted setting, the tool-results spill its
      *  withheld originals are written to, and the set stop() waits on
-     *  (agent-framework #277). */
+     *  (agent-framework #277). The setting is read from framework/state's
+     *  toolResultGuards by the agent's own name. A read that fails, or a
+     *  toolResultGuards that isn't an object, throws, naming the state: taken
+     *  as no setting, the agent would take its recipe's guard, and the next
+     *  guard change would store over a toolResultGuards that isn't an object. */
     private adoptToolResultGuard;
     /** Each guard that may have queued storage work, once, by agent name: the
      *  live agents' and every other that isn't idle. */
@@ -936,9 +1171,15 @@ export declare class AgentFramework {
     static readonly QUIESCE_TIMEOUT_MAX_MS = 600000;
     static readonly QUIESCE_TIMEOUT_DEFAULT_MS = 120000;
     /**
-     * Enter quiesce mode: persist the flag, suppress gate deliveries, pause all
-     * MCPL data planes, and wait for in-flight turns to settle (turn-alive is
-     * `activeTurnTokens`, which spans dequeue → settled teardown). Idempotent.
+     * Enter quiesce mode: write the deferred-write queue, persist the flag,
+     * suppress gate deliveries, pause all MCPL data planes, and wait for
+     * in-flight turns to settle (turn-alive is `activeTurnTokens`, which spans
+     * dequeue → settled teardown). Idempotent, but for the queue's write, which
+     * every call makes first: when the queue can't reach disk, because its
+     * write fails or it's over the cap, the call rejects with a
+     * QuiesceBlockedError and the host's mode as it was, unless it has
+     * `abandon`, which goes on with the queue in memory and an alert
+     * (writeDeferredWritesForQuiesce).
      *
      * On drain timeout the host STAYS quiesced (`drained: false` in the
      * result); with `abandon: true` the undrained streams are cancelled via a
@@ -950,6 +1191,7 @@ export declare class AgentFramework {
         timeoutMs?: number;
         abandon?: boolean;
     }): Promise<HostModeStatus>;
+    private runQuiesce;
     /** Cancel every turn-alive stream via the quiesce_abandoned kind and give
      *  teardown a bounded grace to settle. Shared by the drain-timeout path and
      *  the already-quiesced escalation path. */
@@ -965,13 +1207,20 @@ export declare class AgentFramework {
     resume(opts?: {
         force?: boolean;
     }): Promise<HostModeStatus>;
-    /**
-     * Land every deferred write whose target has no turn alive, one at a time,
-     * acknowledging each durably as it lands (the persisted queue is rewritten
-     * after every message). A crash mid-flush therefore replays exactly the
-     * un-acked remainder at the next boot — no loss, no duplicates. A write
-     * the store REJECTS is logged and acked too: replaying a poison message
-     * forever would wedge every later boot on it.
+    private runResume;
+    /**
+     * Land every deferred write whose target has no turn alive, as one batch
+     * acknowledged once: the chronicle is synced, then the persisted queue is
+     * rewritten without the batch (ackDeferredWrites). Until then the batch
+     * stays in the durable queue, so a crash mid-flush replays it at the next
+     * boot, which skips each entry that already landed, by its deferredWriteId
+     * — no loss, no duplicates. The batch is stored in queue order, whatever
+     * its targets (writeDrainedInOrder). A write the store rejects stays
+     * queued, logged, with what is queued behind it for its target, so the
+     * flush never stores that target's later entries ahead of it, and other
+     * targets' entries go on. (A write that isn't deferred can still land
+     * ahead of it, such as one for an idle agent once the host has resumed.)
+     * A boot that meets it again logs it and goes on.
      *
      * Per-target: an agent whose turn is still alive keeps ITS messages
      * deferred for its own turn boundary; everyone else's flush now.
@@ -998,12 +1247,38 @@ export declare class AgentFramework {
      * Which of `ids` already exist in some agent's store as a landed deferred
      * write (`metadata.deferredWriteId`). Scans each context manager's recent
      * tail blob-free — an interrupted flush is always within the last few
-     * hundred slots — and tolerates facades without windowed reads.
+     * hundred slots — and tolerates facades without windowed reads. A context
+     * that can't be read throws, naming its agent: counted as holding none, a
+     * write that landed there before its ack would land a second time.
      */
     private landedDeferredWriteIds;
-    /** Atomic JSON write for the recovery files (tmp + rename, 0600) — the
-     *  same idiom as the Discord awareness outbox. */
+    /** Atomic, durable JSON write for the recovery files. The document goes to
+     *  a temp file at 0600, which is synced and renamed over the record, so
+     *  the new record's data is asked to reach the disk before the rename
+     *  publishes it. Then the directory is synced, for the record's entry in
+     *  it, and its parent, for the directory's own entry, which is new when a
+     *  write, this one or an earlier one, had to make the directory; levels
+     *  above are left to the filesystem. Directories aren't synced on win32,
+     *  which syncs the file alone, or where the filesystem can't sync one
+     *  (syncRecoveryDirectory). A failure before the rename removes the temp
+     *  file, if it was made, and throws an error saying the record was left as
+     *  it was, with the original as its cause and its code kept. A directory
+     *  sync that fails, other than where the filesystem can't sync one, is
+     *  raised as an ops alert, not thrown: the new record is in place, and the
+     *  callers go on to record it as written. */
     private writeRecoveryFile;
+    /** Syncs the directory a recovery file is in, or that directory's parent,
+     *  so its entries reach the disk. win32 is left out. So is a sync refused
+     *  with EINVAL or EBADF, the answer where the filesystem or system can't
+     *  sync a directory: that refusal would come again on every write, and
+     *  PostgreSQL's fsync_fname_ext lets the same two go. Any other failure is
+     *  raised as an ops alert naming the record. */
+    private syncRecoveryDirectory;
+    /** A recovery file's document, or undefined when there's no file. Only a
+     *  missing file means none was written: any other failure to read it
+     *  (EACCES, ENOTDIR, EIO, which existsSync would answer false for)
+     *  throws, and text that isn't JSON throws a StoredFormError carrying
+     *  the parser's reason, since reading it again won't change it. */
     private readRecoveryFile;
     private warnRecoveryFallbackOnce;
     /**
@@ -1014,9 +1289,86 @@ export declare class AgentFramework {
      * window is operator-length, not turn-length. Lives in the
      * branch-independent recovery file so a rollback cannot orphan it.
      * Deferrals outside a quiesce window (turn-alive, mid-tool-cycle) are
-     * still memory-only: they flush within the turn, as before.
+     * mirrored only while such a queue is still persisted; otherwise they are
+     * memory-only: they land within the turn, at a tool boundary or at its
+     * end, and a crash before then loses them. That window runs to the turn's
+     * end for a message held there and what is queued behind it, and, on a
+     * stream that can't carry injected messages, for every message deferred
+     * during the turn.
+     *
+     * A write that fails, or a queue over the cap, which writes nothing,
+     * leaves the record as it last held it, except that store only, a write
+     * whose sync failed is in the store, where a later sync can still put it
+     * on disk (writeDeferredWritesSlot). The queue stays in memory and
+     * mirrored, so its next change writes it again. Until a write succeeds, a
+     * restart restores what the record holds, or doesn't start if it can't
+     * read the record: it loses writes queued since, and brings back an entry
+     * withdrawn since (removePlacement, RFC-006's removal of an unread
+     * deferred write) that it still lists. The callers go on: a
+     * deferral's caller has already answered its source, so failing it would
+     * lose a write that can still land at resume. The first such write after
+     * one that succeeded raises an ops alert, and a line says when a write
+     * succeeds again (deferredWritesFellBehind). quiesce() writes the queue
+     * itself before it changes the host's mode, and refuses instead, unless
+     * the call has `abandon` (writeDeferredWritesForQuiesce).
      */
     private persistDeferredWrites;
+    /**
+     * Write the queue to its record as it stands, when the host is quiesced
+     * (`quiesced`, which quiesce() passes before it sets the flag) or the
+     * queue is mirrored: the queue when it holds anything, and an empty one
+     * over a record that held one. What the write throws is thrown. A queue
+     * whose JSON is longer than the cap writes nothing.
+     */
+    private writeDeferredWrites;
+    /** Store only, the slot is the record, and a write isn't on disk until the
+     *  store syncs, so a sync that fails is the write's failure, as in
+     *  persistHostMode. The slot is set by then, and a later sync can still
+     *  put it on disk, so writeDeferredWrites marks the queue mirrored before
+     *  it writes; a boot that restores such a queue skips each entry that
+     *  already landed. */
+    private writeDeferredWritesSlot;
+    /** The durable queue: every deferred write not yet acked, pending and
+     *  un-acked, in deferral order. */
+    private durableDeferredWrites;
+    /** Where the queue is recorded, as an operator would look for it. */
+    private deferredWritesRecord;
+    /**
+     * quiesce()'s write of the queue, before it changes the host's mode, as a
+     * quiesced host keeps it: a write held only in memory, such as one
+     * deferred behind a turn still alive, is on disk before quiesce() goes on,
+     * as its record is. When the queue can't reach disk, because its write
+     * fails or it's over the cap, which writes nothing, a call with `abandon`
+     * goes on with the queue in memory and the failure's or the cap's alert.
+     * Any other throws a QuiesceBlockedError naming the ways out, so quiesce()
+     * rejects with the host's mode as it was (store only, the slot set before
+     * a sync that failed leaves the queue mirrored: writeDeferredWritesSlot).
+     * Writes a flush landed stay in the queue until a store sync acks them, so
+     * it first retries an ack whose sync failed: once a sync succeeds they're
+     * on disk, and they leave the queue rather than count against the cap.
+     */
+    private writeDeferredWritesForQuiesce;
+    /**
+     * A write of the queue failed, or met the cap, and quiesce() didn't reject
+     * for it. The queue stays mirrored, so its next change writes it again.
+     * The first such write since one that succeeded raises an ops alert naming
+     * the record, and the rest of the run raises none. A failed write's own
+     * line is logged each time (persistDeferredWrites), and the cap's line the
+     * first time the cap is met in a run, whatever began it. On a host that is
+     * or is about to be quiesced, both say to resume before any restart, since
+     * a quiesced host lands its deferred writes only at a resume.
+     */
+    private deferredWritesFellBehind;
+    /** A write of the queue succeeded after a run of failures: say that the
+     *  record has caught up. */
+    private deferredWritesCaughtUp;
+    /**
+     * Restore the deferred-write queue a crash or a stop left durable. Nothing
+     * stored is an empty queue. A queue that can't be read, or that reads as
+     * anything but a queue, throws, since taken as empty the next deferral
+     * would replace the stored one; so does a context that can't be checked
+     * for writes that already landed (see landedDeferredWriteIds).
+     */
     private restorePersistedDeferredWrites;
     /**
      * Operator-driven maintenance: run (or join) one bounded compression pass —
@@ -1035,13 +1387,28 @@ export declare class AgentFramework {
      * were activated right now — WITHOUT running inference, opening a stream, or
      * mutating agent state. Intended for debug/preview tooling.
      *
-     * Transparency contract (default): the preview is side-effect-free and
-     * leaves no trace on the system. It does only read-only work —
-     * `ContextManager.compile` (which never triggers compression itself;
-     * compression runs in the background out-of-band), tool filtering, and
-     * system-prompt assembly — then delegates to `Agent.buildActivationRequest`.
-     * No tokens are spent, nothing is written to Chronicle, and no external
-     * MCPL server is contacted.
+     * What a preview commits (default): nothing of its own. It compiles as a
+     * dry run (`dryRun`), filters tools and assembles the system prompt, then
+     * delegates to `Agent.buildActivationRequest`. No tokens are spent, no
+     * external MCPL server is contacted, no fold resolution is persisted and
+     * none of the compression its fold plan calls for is queued; the consumed
+     * watermark and any prepared budget change are left alone; and once
+     * context-manager's thinking binding (context-manager#160, not yet
+     * released) ships, no stamps are committed and no compile awaits
+     * acceptance. In context-manager 0.14 its dry run leaves nothing else
+     * behind but the release of an expired compression hold, as any compile
+     * does (see `Agent.compileWithInjections`). The preview keeps in-memory
+     * bookkeeping of its own, such as handing the context manager the
+     * compression tool definitions, as every activation request does.
+     * Under the autobiographical strategy, a budget the context can't fit
+     * still throws, as for a committing compile: a dry run skips only
+     * context-manager's post-pick check, and an adaptive fold plan that
+     * doesn't fit then overruns at the middle's emission, with a refusal that
+     * names the tokens and the limit. Windowed passthrough's newest message
+     * alone is the one window that comes back larger than the budget. For a
+     * verdict instead of the refusal, `previewContextSettings` returns
+     * context-manager's own at a budget, with the agent's `maxTokens` reserved
+     * for the response.
      *
      * The trade-off is fidelity: the dynamically-gathered ContextInjection[]
      * (module `gatherContext` + MCPL `beforeInference` hooks) are NOT included
@@ -1066,15 +1433,18 @@ export declare class AgentFramework {
      *
      * Unlike `previewActivation` (which renders a request), this returns the
      * picker's plan: resulting tokens, whether it fits, how many summaries would
-     * have to be produced first, and the per-chunk fold levels. Commits nothing:
-     * no resolution persistence, no compression enqueue, no transition
-     * bookkeeping — see `AutobiographicalStrategy.previewContext`.
+     * have to be produced first, and the per-chunk fold levels. It commits
+     * nothing: its select is a dry run, which in context-manager 0.14 leaves
+     * what a select leaves behind as the last committing compile left it —
+     * see `AutobiographicalStrategy.previewContext` and
+     * `Agent.compileWithInjections`.
      *
      * Returns null when the agent's strategy has no fold plan (non-adaptive).
      */
     previewContextSettings(agentName: string, budgetTokens: number, overrides?: Record<string, unknown>, opts?: {
         render?: boolean;
     }): unknown;
+    private previewContextFor;
     /**
      * Feasibility preview for a runtime-settings patch — or, with no patch, for
      * the agent's CURRENT settings (the resume-gate case: quiesce maintenance
@@ -1089,11 +1459,18 @@ export declare class AgentFramework {
      * the compile budget and rejected safe-by-construction paced descents.
      *
      * Never throws for preview-layer reasons: strategy without previewContext,
-     * preview overlap, stale branch generation, and the hierarchical (non-
-     * adaptive) path all come back as `{available: false, reason}`. Unknown
-     * agent still throws, matching the sibling accessors.
+     * preview overlap, stale branch generation, the hierarchical (non-
+     * adaptive) path, and a context manager that refuses its queries (its
+     * strategy's initialization pending or failed) all come back as
+     * `{available: false, reason}`. Unknown agent still throws, matching the
+     * sibling accessors, and so does a patch whose values the agent refuses,
+     * whatever its context manager's state. Whether the strategy takes live
+     * tail and pace settings is the manager's to say, so while it refuses, a
+     * patch that sets them gets no verdict either.
      */
     previewAgentRuntimeSettings(agentName: string, patch?: AgentRuntimeSettingsPatch): RuntimeSettingsPreview;
+    /** previewAgentRuntimeSettings for an agent in hand: boot restore previews one not yet registered. */
+    private previewRuntimeSettingsFor;
     /**
      * Check if process logging is enabled.
      */
@@ -1136,24 +1513,94 @@ export declare class AgentFramework {
      */
     getMembrane(): Membrane;
     getSessionUsage(): SessionUsageSnapshot;
+    /** Restore the usage totals a prior session stored. None stored starts
+     *  fresh (the constructor's tracker). Totals that can't be read, or that
+     *  read as anything but totals, throw: taken as none, the next inference's
+     *  persistUsageState would store fresh totals over them.
+     *
+     *  This is create()'s first read of framework/state, so it also refuses a
+     *  framework/state that isn't an object: every reader of that state would
+     *  take it as holding nothing, and its first write would replace it. */
     private restoreUsageState;
     private persistUsageState;
+    /** An agent's persisted record, or null when it has none. Throws the
+     *  store's error when it can't be read, and a StoredFormError when what's
+     *  stored for the agent, or the map that holds every agent's, isn't a record. */
     private readAgentRuntimeSettings;
     private validatePersistedAgentRuntimeSettings;
     /** Load resident-set inline caps from framework state, dropping (loudly)
-     *  anything that fails the same validation the live update enforces. */
+     *  anything that fails the same validation the live update enforces. A
+     *  failed read is logged and boot goes on without them: nothing is lost,
+     *  since persistToolResultInlineCap reads the stored caps again before it
+     *  writes one. */
     private readPersistedToolResultInlineCaps;
     /** Write (cap) or clear (null) one agent's resident-set inline cap. */
     private persistToolResultInlineCap;
+    /**
+     * Apply an agent's persisted settings at boot, each on its own, the budget
+     * last. A persisted setting never stops the agent booting, except a
+     * think-text policy, which fails closed: an invalid one is refused before
+     * this (validatePersistedAgentRuntimeSettings), and a valid one always
+     * applies. A tail, pace or budget that can't be applied now (a tail or pace
+     * on a strategy without live settings, a budget no longer above maxTokens,
+     * a lower one restored paced on a strategy that can't prepare a smaller
+     * window) is kept set but unapplied (Agent.keepRuntimeSettings), so a later
+     * persisting write keeps it in the record.
+     *
+     * A budget below the recipe's restores as a paced descent from it, unless
+     * the record carries its marker (`contextBudgetReachedTokens`, written when
+     * a compile fit at it) and the preflight says it fits now: then it is
+     * applied at once. The preflight plans the stored context as the context
+     * manager will, with the restored tail and pace, so it sees what a restart
+     * can change there: a new maxTokens (the response reserve) or strategy
+     * configuration. It also sees a context that grew while the agent ran at
+     * another budget after the record was written, through a persist: false
+     * change. The system prompt, tools and injections are outside the context
+     * manager's budget, so they don't enter it (context-manager #162). If a
+     * compile at a budget applied at once this way is refused, the agent
+     * restores it paced then (armed by Agent.restoreRuntimeSettings, run in
+     * Agent.compileAtLiveBudgetNoting). A budget at or above the recipe's is
+     * applied at once with or without the marker, as an increase always is.
+     *
+     * When a marked budget isn't applied at once or a setting can't be
+     * applied, one line says why, what couldn't be applied, and the budget set
+     * beside the one compiles plan at.
+     */
+    private restorePersistedRuntimeSettings;
+    /**
+     * What persists for an agent: its overrides, and `contextBudgetReachedTokens`
+     * when the agent's proof stands for the overridden budget: a compile fit at
+     * it, or the boot applied it at once on the record's proof, and the live
+     * budget hasn't changed since (context-manager #162). A
+     * change of budget, immediate or not, carries none until a compile at it
+     * fits; arming or cancelling a descent leaves the proof as it was.
+     */
+    private persistedRuntimeSettingsOf;
+    /**
+     * A compile at the agent's live budget came out differently from the last
+     * (Agent.onContextBudgetCompiled). Keep the persisted record's
+     * `contextBudgetReachedTokens` true to it: written when a compile fits at
+     * the record's own budget, withdrawn when the context manager refuses that
+     * budget. Nothing else in the record changes, and a budget other than the
+     * record's (one applied with `persist: false`, or a descent's starting
+     * budget) writes nothing. A record that can't be read, or written, is
+     * logged, and the next compile at that budget tells it again.
+     */
+    private recordCompiledContextBudget;
     private persistAgentRuntimeSettings;
-    /** Persist (or clear, with null) the host quiesce mode. First process-global
-     * key in the framework/state slot: quiesce survives a restart BY DESIGN — a
-     * crash mid-surgery must come back up NOT serving against a half-repaired
-     * store. Resume is always reachable (public method, WS/HTTP, control-plane
-     * host/command), and every quiesced boot logs a loud banner. */
+    /** Persist (or clear, with null) the host quiesce mode: in the recovery file
+     * when there's a path for one, and in framework/state's hostMode otherwise.
+     * (A boot with a path reads that legacy hostMode only while no file exists.)
+     * Quiesce survives a restart BY DESIGN — a crash mid-surgery must come back
+     * up NOT serving against a half-repaired store. Resume is always reachable
+     * (public method, WS/HTTP, control-plane host/command), and every quiesced
+     * boot logs a loud banner. */
     private persistHostMode;
     /** The recovery file wins whenever it exists; the branch-local slot is
-     *  read only for stores that predate it (or store-only configs). */
+     *  read only for stores that predate it (or store-only configs). No record
+     *  is a host that was never quiesced. A record that can't be read, or that
+     *  reads as anything but a host-mode record, throws: taken as "not
+     *  quiesced", a host that stopped mid-maintenance would boot serving. */
     private readHostMode;
     /**
      * Create an ephemeral agent that is NOT registered in the main event loop.
@@ -1179,6 +1626,17 @@ export declare class AgentFramework {
      * events after an ephemeral/conversation agent has been disposed. */
     private recordLogicalTurnToolCalls;
     private recordEphemeralToolCalls;
+    /**
+     * A start dropped before its stream sends anything (its agent was replaced,
+     * or stop() closed admission or ended the lifecycle the start began in)
+     * ends the logical turn it was running. stop() ends every open turn
+     * (openLogical), but a fresh start that awaited its batches' assembly
+     * across a stop() reaches its routing after it and opens its turn. That
+     * turn would then stay open, and the agent's first start after a restart
+     * would continue the dropped turn's routing. The identity check leaves any
+     * other turn open.
+     */
+    private endDroppedTurn;
     /** A logical turn's end, for every agent: it closes the agent's open
      *  logical turn when it is the settling stream's own (openLogical), and
      *  settles an active ephemeral run. The run's tool-call count comes from
@@ -1191,6 +1649,9 @@ export declare class AgentFramework {
      * The agent is temporarily registered, inference is triggered, and the
      * framework drives the stream (emitting traces, logging, dispatching tools).
      * Returns the agent's speech output when it finishes (no more tool calls).
+     * Rejects with ProviderWaitNotSleptError when the run ends rather than sleep
+     * a retryable failure's stated wait, and with a plain Error for any other
+     * ending.
      *
      * The caller provides a pre-created agent + contextManager (from createEphemeralAgent).
      * The task message should already be in the context manager.
@@ -1224,6 +1685,15 @@ export declare class AgentFramework {
     /** Discoverability for event tags (MCPL RFC-001): the reserved chat:* core,
      *  each connected server's declared tag ontology, and gate.js status. */
     private static readonly EVENT_TAGS_TOOL;
+    /** How long, in days, a draft beyond a resident's newest is kept (KEEP_IDLE_MS). */
+    private static readonly DRAFT_KEEP_DAYS;
+    /** Synthesized drafts tool — present whenever MCPL channels are
+     *  configured. A resident's held drafts (src/prose-drafts.ts): plain speech
+     *  that was not sent, never published except by its resident's resend, and
+     *  kept as that module's retention says. Nullable
+     *  fields, cast like save_recent_image's: a caller whose provider presents
+     *  every property as required can still say "not in use". */
+    private static readonly DRAFTS_TOOL;
     /** Synthesized save_image tool — present when a workspace module is
      *  registered. Lets the agent persist an image it has already seen in its
      *  own context (Discord attachments arrive inlined as base64 and are
@@ -1277,6 +1747,13 @@ export declare class AgentFramework {
      * Best-effort; mirrors reactToRefusal's locus resolution.
      */
     private announceRewind;
+    /**
+     * A turn that ended WITHOUT a refusal (a natural completion that wasn't
+     * one, or a tool-ended turn) ends the rewind episode: the model responded.
+     * Leave the consolidated marker in place as the durable record; just
+     * clear the per-episode counters, and report a forced `/unstick` done.
+     */
+    private endRefusalEpisode;
     /**
      * Conclude an active `/unstick` session: post the outcome (what was shed and
      * whether the model stopped refusing) to the channel the command came from,
@@ -1340,6 +1817,8 @@ export declare class AgentFramework {
      *   explicit, recorded operator override.
      */
     private handleHostCommand;
+    /** handleHostCommand's work, run where stop() can wait for it. */
+    private runHostCommand;
     /**
      * The last message the agent would see in its context right now, via the
      * transparent `previewActivation` render (no inference, no Chronicle
@@ -1370,6 +1849,22 @@ export declare class AgentFramework {
      * Get the most recent process logs (tail).
      */
     tailProcessLogs(count?: number, eventType?: string): ProcessLogEntryWithId[];
+    /**
+     * Switch the store to an existing branch, start the delivery of the
+     * Discord awareness marks the move changes (startDiscordAwarenessDelivery),
+     * and re-materialize the config mount from it. Resolves once the mount has
+     * run; if it fails, it rejects with the store already moved. The marks'
+     * delivery isn't awaited, and its failure doesn't fail the switch. The
+     * store has moved by the time the call returns, before its promise
+     * settles, and a refusal moves nothing. An operator's operation: refused
+     * once stop() has begun, and waited for by stop() while it runs.
+     *
+     * The branch moves under every agent sharing the store, so the switch
+     * reserves the store as a surgery does: every agent must be idle, or it is
+     * refused (OperatorActionError 'agent-busy'), and no turn starts until the
+     * switch is done.
+     */
+    switchBranch(name: string): Promise<void>;
     /**
      * Undo the last inference turn for an agent.
      *
@@ -1386,6 +1881,9 @@ export declare class AgentFramework {
         fromBranch?: string;
         toBranch?: string;
     };
+    /** undoLastTurn's work, for a host/command undo already admitted: a stop()
+     *  begun by a trace of one of its turns doesn't refuse the next. */
+    private runUndoLastTurn;
     /**
      * Redo a previously undone turn for an agent.
      *
@@ -1409,6 +1907,14 @@ export declare class AgentFramework {
     }): OperatorLogEntry[];
     /** Where the operator log is written, or undefined when disabled. */
     getOperatorLogPath(): string | undefined;
+    /**
+     * A default name for an operator branch: `base`, the timestamped name the
+     * caller passes, when the store doesn't hold it, else the first of `base-2`,
+     * `base-3`, … that it doesn't hold (firstFreeBranchName). Two changes of one
+     * kind made one after the other in a millisecond then get a branch each,
+     * where the second used to be refused under the first one's name.
+     */
+    private newOperatorBranchName;
     /**
      * The surgery gate — STORE-wide, not per agent. A branch switch moves the
      * active chronicle branch for every context manager sharing this store,
@@ -1453,7 +1959,7 @@ export declare class AgentFramework {
         messageId: string;
         requester?: OperatorRequester;
         note?: string;
-        /** Branch name for the fork (default `rollback/<agent>/<ts>`). */
+        /** Branch name for the fork (default `rollback/<agent>/<ts>`, or with `-2`, `-3`, … appended when the store already holds that name). */
         branchName?: string;
     }): Promise<{
         agentName: string;
@@ -1479,7 +1985,8 @@ export declare class AgentFramework {
     }>;
     /**
      * Suppress specific messages from the live context without touching the
-     * source branch: fork at the current head (`suppress/<agent>/<ts>`), redact
+     * source branch: fork at the current head (by default `suppress/<agent>/<ts>`,
+     * numbered `-2`, `-3`, … when the store already holds that name), redact
      * the messages on the fork, switch to it. Shards of a body group are always
      * removed together. Discord originals get awareness markers via the outbox;
      * the batch is `explicit`-activated only after every removal succeeded, and
@@ -1496,7 +2003,7 @@ export declare class AgentFramework {
         messageIds: string[];
         requester?: OperatorRequester;
         note?: string;
-        /** Branch name for the fork (default `suppress/<agent>/<ts>`). */
+        /** Branch name for the fork (default `suppress/<agent>/<ts>`, or with `-2`, `-3`, … appended when the store already holds that name). */
         branchName?: string;
     }): Promise<{
         agentName: string;
@@ -1543,9 +2050,9 @@ export declare class AgentFramework {
      * undo or redo) without the caller awaiting it. No operator response waits
      * for Discord to accept marks: the MCPL data-plane gate alone holds channel
      * traffic that arrives after it until they are attempted.
-     * `syncDiscordAwarenessMarkers` installs that gate synchronously, before
-     * its first await, so calling this while a surgery still holds the store
-     * puts the gate up before the store is released. With no drain running, the
+     * The sync's body installs that gate synchronously, before its first
+     * await, so calling this while a surgery still holds the store puts the
+     * gate up before the store is released. With no drain running, the
      * drain starts in the same synchronous run (the first reaction request can
      * be written before this returns); with one running, this generation's pass
      * follows it (drainForGeneration). Either way delivery continues
@@ -1556,10 +2063,20 @@ export declare class AgentFramework {
      * (queued when a surgery began, or arriving during its switch or fork): the
      * surgery's store reservation, which used to hold such a turn through the
      * drain, now ends once the gate is up. A failure is accounted by the gate
-     * itself: the current generation's failure recycles the connections, and a
-     * superseded one leaves that to the newer generation, whose own pass meets
-     * the same ledger. Here it is logged and raised as an ops alert, and the
-     * next sync, reconnect or start delivers what is still pending.
+     * itself: the current generation's failure recycles the connections (or,
+     * once the host is stopping, releases the gate instead), and a superseded
+     * one leaves that to the newer generation, whose own pass meets the same
+     * ledger. Here it is logged and raised as an ops alert, and the next sync,
+     * reconnect or start delivers what is still pending.
+     *
+     * Like a server's drain, the delivery runs apart from the operation that
+     * started it: it isn't an operator's operation, so stop() doesn't wait for
+     * it. A drain already running when stop() begins runs on while the
+     * connections close, and what it can't deliver stays pending in the
+     * durable outbox. Once stop() has begun, none is started, since there's
+     * no point opening a drain that the teardown is about to cut off: the
+     * marks stay pending, and the next start's barrier reconciles the outbox
+     * with the branch and delivers them.
      *
      * @param after What moved the branch, for the log and the alert
      *   ("rollback", "branch switch", "undo" …).
@@ -1567,8 +2084,8 @@ export declare class AgentFramework {
      *   branch switch that names none.
      */
     startDiscordAwarenessDelivery(after: string, agentName?: string): void;
-    /** Re-materialize config files from the (new) active branch — fire and
-     *  forget; the gate picks changes up via mtime. Mirrors undoLastTurn. */
+    /** Start config file IO without holding the caller or a surgery's store
+     * reservation. The gate picks it up by mtime; stop() still waits for it. */
     private materializeConfigMountAfterBranchSwitch;
     /**
      * Check if undo/redo is available for an agent.
@@ -1606,6 +2123,14 @@ export declare class AgentFramework {
      * Drop a departed agent's checkpoint tree key and turn/redo bookkeeping.
      * Without this, spawn-and-dispose agents leave a key (and in-memory map
      * entries) behind for the life of the store/session.
+     *
+     * Its callers are tearing an agent down: a conversation fork's disposal and
+     * an ephemeral run's end. A throw from the store here would stop that
+     * teardown partway, reject a finished ephemeral run in place of its result,
+     * and at a closure turn's end reject a stream promise that nothing holds.
+     * So a failed removal is logged and goes no further, and the agent's
+     * checkpoints stay in the store under its name, as a crash before its
+     * teardown leaves them.
      */
     private evictTurnCheckpoints;
     /**
@@ -1651,13 +2176,59 @@ export declare class AgentFramework {
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
      * template agent: own ContextManager under `conversations/{name}`, seeded
-     * with a copy of the template's compiled context (the SubagentModule
-     * wholesale-copy pattern), registered in the event loop like any agent —
-     * but never primary.
+     * with the template's compiled context without its thinking or its unpaired
+     * tool blocks (the SubagentModule wholesale-copy pattern; see the seeding
+     * comment below), registered in the event loop like any agent — but never
+     * primary.
      */
     private createConversationAgent;
-    /** Persist the router's generation counters (see hydration in create()). */
-    private persistConversationRouterState;
+    /**
+     * The router's decision for a message or batch on `facts.channelId`, made
+     * once no spawn is in flight for that channel, with a spawn it decides on
+     * already started. A routing that finds its channel's fork being spawned
+     * waits for that spawn to settle and decides then, whatever it would have
+     * decided meanwhile: once the fork is bound, the decision is the fork, and
+     * if the spawn failed, it decides as a message arriving next would, which
+     * proposes the spawn again if the message qualifies. The check, the
+     * decision and the spawn's start are one synchronous step, so at most one
+     * spawn per channel is in flight. Without the wait, a second spawn of the
+     * fork's name failed ("already registered or reserved"), and a message
+     * that didn't qualify on its own was dropped as unrouted; either way its
+     * message was lost. Each path that delivers messages handles them one at
+     * a time, but the event queue and the coalescer run beside each other, and
+     * a spawn can wait, as on its template's annotations
+     * (createConversationAgent); the waiting routing holds its own path for as
+     * long, which none of the spawn's awaits needs.
+     */
+    private routeConversation;
+    /**
+     * Store the router's counters with the spawn's generation, create the fork
+     * the decision names and bind its channel to it, registered in
+     * conversationSpawns under the channel until it settles. The store runs
+     * inside the spawn's promise, still in routeConversation's synchronous
+     * step, so a store that throws rejects the spawn, which each caller reports
+     * as a failed spawn, rather than throwing out of routeConversation before
+     * the caller's try. routeConversation registers a spawn only when none is
+     * in flight for the channel, and only this spawn's settlement removes it,
+     * so the entry it removes is its own. It's removed before anyone waiting
+     * on it resumes, so a waiter that decides again doesn't find it.
+     */
+    private spawnConversationAgent;
+    /**
+     * Store the router's generation counters with a spawn's generation, before
+     * the spawn it names (see hydration in create()). A fork whose counter isn't
+     * stored would have its name reused at the next restart, reopening its
+     * namespace, so a failed read or write throws and the caller refuses the
+     * spawn. The stored counters, the router's own and this spawn's are
+     * merged, each at its highest, in one synchronous step: another channel's
+     * spawn still in flight has stored its counter but not bound it yet, so
+     * the router's map alone would write that counter back down, and the
+     * router's own counters keep the stored ones from going back down when
+     * they read lower, as on a branch with older counters. The merge is a Map,
+     * so a channel id such as "constructor" is a key like any other. The
+     * callers name the channel; the errors name the state and what failed.
+     */
+    private storeConversationGeneration;
     /**
      * Remove a closed conversation fork from the framework: its closure turn
      * has finished, so the home mapping has served its purpose and keeping the
@@ -1703,11 +2274,26 @@ export declare class AgentFramework {
      * replies to the agent) DO still arrive, and nothing warned that answering
      * via option 1 leaves the human's natural un-@'d follow-up invisible (Sol
      * answered four #architecture mentions over four days while the follow-ups
-     * to her own replies were silently dropped). The wording now states the
-     * actual delivery model, and option 1 carries the consequence inline. When
-     * the surface tracks a missed-ambient tally (discord-mcpl sends
-     * `missedMessages`/`missedCharacters` in push origin), the invitation shows
-     * the count — the cost of staying out, as a number, at decision time.
+     * to her own replies were silently dropped). That pass stated discord-mcpl's
+     * delivery model here.
+     *
+     * #406: what reaches the agent from a channel, open or closed, is its
+     * server's delivery, which MCPL leaves to each server. discord-mcpl
+     * subscribes a channel on channels/open and unsubscribes it on
+     * channels/close. slack-mcpl keeps its own subscription, which decides
+     * whether a conversation's ordinary messages arrive, open or closed; open
+     * state only picks channels/incoming or push/event. So the invitation says
+     * only that messages addressing the agent reach it whether or not it opens
+     * the channel: it is shown only when one has arrived from a closed channel,
+     * and both servers deliver them either way. What else arrives is for the
+     * server to say on its push. Option 1 says a reply opens the channel,
+     * because routeSpeech opens a closed channel before delivering into it. Its
+     * old follow-up warning assumed the channel stays closed after the reply,
+     * which that open makes false (and on discord-mcpl, channels/open also
+     * subscribes). When the surface tracks a missed-ambient tally
+     * (discord-mcpl sends `missedMessages`/`missedCharacters` in push origin),
+     * the invitation shows the count — the cost of staying out, as a number, at
+     * decision time.
      */
     private buildClosedChannelInvitation;
     /**
@@ -1716,13 +2302,55 @@ export declare class AgentFramework {
      * id is reassigned to another endpoint (restartMcplServer with a new config).
      */
     private coalescingBinding;
-    private initializePushCoalescer;
+    /**
+     * Report one inbound acceptance to the observer, if one is installed
+     * (InboundAcceptanceObserver). Called where an envelope is first created —
+     * never for a delivery that reuses a frozen one. A failing observer is
+     * reported loudly (stderr + trace) and never affects delivery.
+     */
+    private noteInboundAccepted;
+    /**
+     * The inbound source envelope (mcpl/inbound-source.ts) of an item that
+     * belongs to a registered channel. The one place the framework decides
+     * which conversation an inbound item came from; every lane calls it at the
+     * point the host accepted the item, or reuses the envelope frozen then.
+     * `acceptedAt` falls back to now only for an event no admission path
+     * stamped (a direct framework caller), which is the closest observation.
+     */
+    private channelSource;
+    /** Source envelope of a channels/incoming event (lane facts as given). */
+    private channelEventSource;
+    /** Source envelope of a push event: its derived channel, else unscoped. */
+    private pushSource;
+    /**
+     * Source envelope for conversational input from a non-channel surface: a
+     * module's messages in response to an `external-message` (console, TUI) or
+     * `api:message` event. An event whose metadata names a channel is not a
+     * surface conversation and gets none (never a guessed identity).
+     */
+    private surfaceSourceFor;
+    /**
+     * The push coalescer, built and restored from its stored receipts and
+     * batches. initializeMcpl calls this before it builds anything else, so a
+     * refusal here leaves the MCPL subsystem as it was. Nothing stored is a
+     * coalescer with no history. What can't be read, reads as anything but
+     * this version's snapshot and receipts, or can't be restored, throws, and
+     * so does an agent's context that can't be checked for an occurrence
+     * already delivered (wasPublished): taken as no history, the next
+     * acceptance's receipt and the next flush would replace what's stored, and
+     * taken as undelivered, an occurrence would be delivered again.
+     */
+    private restorePushCoalescer;
+    /** Install a coalescer restorePushCoalescer built: none of this can fail. */
+    private installPushCoalescer;
     /**
      * Durability barrier for coalescing (RFC-006 §3.1/§3.2): everything
-     * written so far is fsynced before the caller proceeds. Group-committed —
-     * all acceptances that arrive in one event-loop turn share one
-     * `store.sync()` — so throughput is bounded by fsync rate per batch, not
-     * per message.
+     * written so far is fsynced before the caller proceeds. Commits asked for
+     * in the same event-loop turn would share one `store.sync()`, but the
+     * coalescer asks for every commit under its lock and holds the lock until
+     * the commit resolves, so no two share one. Each acceptance makes an fsync
+     * of its own, and so does each coalesced message a channels/incoming
+     * request newly admits, one at a time.
      */
     private commitCoalescingDurable;
     private scheduleCoalescingSnapshot;
@@ -1793,8 +2421,113 @@ export declare class AgentFramework {
      * turns, whose rows are stored exactly as before.
      */
     private silentTurnRowMetadata;
-    /** Record plain-prose segments this turn suppressed. */
+    /** Record plain-prose segments this turn suppressed without drafts (proseRouting=disabled). */
     private recordProseSuppression;
+    /**
+     * Silenced plain speech: an explicit send holds it as resendable drafts; a
+     * deliberate silence (skip_reply, a silent turn, or a private think in
+     * the same native round, where that policy applies: an XML-mode round has
+     * no verbatim content to route live, so its prose is routed at the turn's
+     * end as ordinary speech) keeps it private —
+     * counted for the receipt, never drafted. `segments` are the runs exactly
+     * as written (splitProseRuns), so a draft keeps the resident's words byte
+     * for byte. What it holds, keeps or moves is the round's turn's
+     * (round.routing), whenever the hold runs.
+     */
+    private holdSilencedProse;
+    /**
+     * Hold plain speech as drafts (src/prose-drafts.ts) instead of
+     * letting it vanish: journaled durably and recorded for the receipt of the
+     * turn whose round it came from (opts.routing). `notice: 'now'` also
+     * queues a private notice naming them, which
+     * the resident hears at its next tool boundary — only when the live stream
+     * presents mid-turn injections. Otherwise the turn-end receipt names them
+     * (or, after a crash, the next turn's catch-up). Drafts the journal cannot
+     * hold are reported in the receipt: their words remain in history only.
+     */
+    private holdProseDrafts;
+    private static readonly DRAFT_REASON_TEXT;
+    private static readonly DRAFT_REASON_SHORT;
+    private draftsHeldNotice;
+    /** Compact local time for draft listings. */
+    private draftTime;
+    /** A draft's opening words, for the drafts tool's listing only. */
+    private static draftPreview;
+    private static destinationText;
+    /** One line per draft: id, state, when, why, size, preview. */
+    private draftLine;
+    /** A draft's state in words that claim only what is known. */
+    private draftStateText;
+    /** Why an unconfirmed draft may already have been posted, in full. */
+    private riskText;
+    /** Whether an attempt with no outcome is still out: its draft's latest,
+     *  while that draft is being sent. Otherwise it never got one (a crash). */
+    private attemptIsOut;
+    /** Why an attempt has no outcome, in a risk's words. */
+    private noOutcomeText;
+    /** A delivered draft's historical receipt. */
+    private draftReceipt;
+    /**
+     * Turn start (or after a crash): name, privately and before the turn's
+     * compile, any open drafts no notice on the current branch names: none
+     * reached the history (a crash, an aborted turn), or a rollback or branch
+     * move took the notices away. Every draft it marks is named by id, newest
+     * first: the newest eight with their state and why each was held, the rest
+     * by id. Like every notice, it quotes none of their words; the drafts tool
+     * shows them. A draft a recent message already names is recorded as
+     * noticed rather than named again: its notice landed after its turn ended,
+     * as a bounce does when a delivery runs after a tool ends an explicit turn.
+     * It reads only the recent history (draftsNamedInHistory), so its notice
+     * claims no more than that. Left out are the open logical turn's own
+     * drafts, which its receipt names and its settlement records
+     * (settleTurnDrafts), and drafts a notice still waiting in the deferred
+     * queue names.
+     */
+    private noticeUnnoticedDrafts;
+    /**
+     * Logical turn end, after the turn's deferred notices are flushed: record
+     * as noticed exactly the drafts a stored message names (the receipt, a
+     * held-draft notice, a bounce notice), each with the message that names
+     * it. One whose notice never reached the history stays unnoticed, for the
+     * next turn's catch-up. The turn's draft tallies are spent here.
+     */
+    private settleTurnDrafts;
+    /** Record each named draft as noticed, with the message that names it
+     *  (draftsNamedInHistory). */
+    private recordDraftNotices;
+    /** How far back draftsNamedInHistory looks: this turn's notices are near
+     *  the end. One beyond it leaves its draft for the next turn's catch-up. */
+    private static readonly DRAFT_NOTICE_SCAN;
+    /** Which of these drafts a stored notice or receipt OF THIS RESIDENT names
+     *  (draft ids are unique only per resident, and residents can share one
+     *  history), each with the newest message that names it, reading only the
+     *  recent history, where this turn's notices are. */
+    private draftsNamedInHistory;
+    /** Page size for drafts(action: "list"). */
+    private static readonly DRAFTS_PAGE;
+    /** Drafts with a delivery attempt in flight, `${agent}\u0000${id}`: a
+     *  parallel resend (or `{{unsent}}`) of the same draft is refused. */
+    private draftsInFlight;
+    /** The drafts in draftsInFlight whose attempt is out right now (journaled,
+     *  its publish awaited). A dismissal of one is refused, and the resident
+     *  told to wait for that result, since a dismissal can't call back words
+     *  already on their way. A draft only queued in a resend batch can still
+     *  be dismissed: the batch honours that when it reaches the draft. */
+    private draftsSending;
+    /** The drafts tool's answer to a resident's call, from the model's own
+     *  dispatch or an agent-origin call through executeToolCall (a puppet's):
+     *  a failure the handler throws is answered as one. */
+    private draftsToolResult;
+    /**
+     * The resident's `drafts` tool: list, read, resend and dismiss its own held
+     * drafts. Private to the calling resident. `resend` is an explicit send:
+     * each draft is published verbatim, in order, through the normal publish
+     * executor, its attempt journaled durably before the request leaves.
+     */
+    private handleDraftsTool;
+    /** Why a draft can't be resent now (dismissed, or possibly already posted
+     *  without the resident's confirmation), or undefined when it can. */
+    private resendRefusal;
     /** Record a successful plain-prose delivery for this turn's receipt. */
     private recordProseDelivery;
     /**
@@ -1822,13 +2555,67 @@ export declare class AgentFramework {
      * inference; never locus-eligible itself (system + no channel metadata).
      */
     private announceLocusIfChanged;
+    /**
+     * The channel a message moves its turn's locus to, by the addressed
+     * re-pin rule (2026-07-31, n=6 and n=7): a conversational message (not a
+     * reaction or a system marker) that addressed the agent, or that follows
+     * up in a channel the turn sent into (TurnRouting.engaged). Undefined for
+     * any other message. A tool boundary weighs the messages it injects by it,
+     * and noteArrival the ones no boundary of the turn weighs.
+     */
+    private repinChannel;
+    /**
+     * Weigh a message that no tool boundary of the agent's open logical turn
+     * will weigh: one that would re-pin the locus becomes one of the turn's
+     * arrivals (TurnRouting.arrivals). A message tune-out diverted
+     * (metadata.tuneOut) never enters a resident's compiled view, so the agent
+     * won't see it, and it moves nothing.
+     */
+    private noteArrival;
+    /**
+     * Whether `agent`'s store is the residents' one message slot, which every
+     * ordinary resident reads (sharedSlotAgents). The subconscious reads that
+     * slot through a merged view, but its own store is isolated, as a fork's
+     * or an ephemeral agent's is.
+     */
+    private isOrdinaryResident;
+    /**
+     * Weigh a message just stored in an ordinary resident's store for every
+     * other ordinary resident's open turn, running or not: residents read one
+     * message slot, and a tool boundary weighs only the messages drained for
+     * its own agent, so no boundary of another resident's turn weighs it.
+     */
+    private noteForOtherResidents;
+    /**
+     * The channel of the turn's newest arrival whose message is still in the
+     * agent's store (TurnRouting.arrivals). A message removed since it was
+     * stored, such as an unread coalesced message its server retracted, moves
+     * nothing, and an earlier one that remains still does. Compression keeps a
+     * message in the store; the last compile can't be the test, since an
+     * arrival between the turn's streams isn't in it yet.
+     */
+    private remainingArrival;
+    /**
+     * Move a turn's locus to the channel its conversation moved to: an
+     * addressed message, or a follow-up in a channel the turn engaged (the
+     * addressed re-pin, repinChannel). Ambient chatter never moves it. Leaves
+     * a durable `[routing]` notice in the window and updates
+     * lastAnnouncedLocus once it's stored, so the next turn's announce-on-change
+     * diffs against what the agent was last told. Returns the notice as stored, for a live
+     * stream to inject with its boundary's other messages. Returns undefined
+     * when the locus is already there, and when the notice couldn't be
+     * stored. The locus has moved then too, but the announce baseline hasn't,
+     * so the agent's next turn announces where its speech lands.
+     */
+    private repinTurnLocus;
     /**
      * Durable window notice for a channel the agent did not ask to open —
      * subscription-policy admission, or an open forced by the agent's own
-     * delivery into a closed channel. The agent must always learn that new
-     * traffic will start flowing, and that `channel_close` opts out (their
-     * decision outranks policy). System message: never triggers inference,
-     * never conversational, never locus-eligible.
+     * delivery into a closed channel. The agent must always learn that the
+     * channel opened, and that `channel_close` opts out (their decision
+     * outranks policy). What an open channel delivers is its server's to say
+     * (#406), so the notice doesn't promise its traffic. System message: never
+     * triggers inference, never conversational, never locus-eligible.
      */
     private recordChannelAutoOpenNotice;
     /**
@@ -1847,7 +2634,7 @@ export declare class AgentFramework {
      * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md).
      * Every prose segment of an `explicit`-mode agent flows through here:
      * parse the `>>` prefix, resolve the target, deliver — or bounce to the
-     * clipboard with a resend notice. Misdelivery is structurally impossible:
+     * held bounce draft with a resend notice. Misdelivery is structurally impossible:
      * nothing is ever sent to a destination the model did not name (directly
      * or via the turn's sticky target).
      */
@@ -1860,6 +2647,27 @@ export declare class AgentFramework {
      */
     private admitProse;
     private deliverAdmittedProse;
+    /**
+     * `{{unsent}}` in an envelope body: the latest bounce draft's words. One
+     * that is out (being sent, or queued in a resend) or unconfirmed (its last
+     * attempt may have been posted) is never substituted — nothing is sent,
+     * and the resident gets the facts and the explicit route (drafts resend
+     * with confirmDuplicate) instead. The envelope's own words are held, as a
+     * bounced envelope's would be (unsentWords): one bounce draft with the
+     * whole text, `{{unsent}}` written out and its risk carried, so nothing
+     * the resident wrote has to be typed again. A bare `{{unsent}}` holds
+     * nothing new: its words already are that draft.
+     */
+    private takeUnsent;
+    /**
+     * Deliver an envelope that substituted `{{unsent}}`: the substituted
+     * draft's attempt is journaled durably before the request leaves, and its
+     * outcome after, exactly as a drafts resend would.
+     */
+    private deliverWithUnsent;
+    /** A draft's state as the journal reads it now: after a write that failed
+     *  and was reconciled, whatever reached the journal counts. */
+    private draftStateNow;
     /**
      * Where a delivered round leaves its turn's sticky destination, as the
      * explicit gateway sets it once the round's envelopes run: each `>>`
@@ -1869,9 +2677,35 @@ export declare class AgentFramework {
     private roundDestination;
     /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
     private deliverHybridProse;
+    /** `>>skip_reply {{unsent}}` and its hybrid form: set the latest bounce
+     *  draft aside — unless it is being sent right now, which a dismissal
+     *  can't call back: the resident is told instead. So are a dismissal whose
+     *  recording fails (with the state the draft reads as after it, and whether
+     *  `{{unsent}}` still names it) and one whose draft may already have been
+     *  posted. */
+    private dismissLatestBounce;
     private deliverProseEnvelope;
     /** Cap on consecutive bounce-triggered wakes (notices still append after). */
     private static readonly PROSE_BOUNCE_WAKE_CAP;
+    /**
+     * Words about to be held that may use `{{unsent}}` (a bounce, or an
+     * envelope an explicit send suppressed), under the one re-bounce rule. A
+     * bare `{{unsent}}` is the latest bounce itself, which stays the one draft
+     * of those words rather than being copied. Otherwise the whole authored
+     * text is kept, the token expanded to the latest bounce's words, nothing
+     * stripped or substituted. When that draft may already have been posted
+     * (unconfirmed, or in flight) the words carry its duplication risk: they
+     * can be resent only with confirmDuplicate, like the draft they copy. The
+     * evidence is the risk's own: the copied draft's uncertain attempt, else
+     * the risk that draft itself inherited, else (truly) that it was in flight
+     * when copied.
+     */
+    private unsentWords;
+    /**
+     * A routing envelope that could not be delivered: its words are held as a
+     * draft (the `{{unsent}}` source) and the resident is told, privately.
+     * `{{unsent}}` in it follows the re-bounce rule (unsentWords).
+     */
     private bounceProse;
     /**
      * One-time mode primer (docs/explicit-prose-routing.md): when an agent's
@@ -1881,6 +2715,18 @@ export declare class AgentFramework {
      */
     private maybePrimeProseMode;
     private startAgentStream;
+    /**
+     * End a turn that beginAgentTurn drops before it sends anything. The turn
+     * emitted inference:started, and listeners that bracket a turn, such as a
+     * typing loop or an activity indicator, end it on a terminal event, so it
+     * gets inference:aborted with `reason`, and lastInference records its end
+     * as driveStream's would, when the record is still this turn's. Nothing of
+     * the kind when another turn of this agent's name holds the turn token (one
+     * begun after a stop and start, or by a replacement agent object): the
+     * event and the record carry only the name, so this frame's would end that
+     * newer turn instead.
+     */
+    private abortDroppedTurn;
     /**
      * Body of startAgentStream, split out so the caller's try/finally owns the
      * turn token unconditionally. Returns true iff the token was handed off to
@@ -1942,7 +2788,10 @@ export declare class AgentFramework {
         toolUseId: string;
         result: ToolResult;
     }>;
+    /** puppetToolCall's work, run where stop() can wait for it. */
+    private runPuppetToolCall;
     private executeToolCallFrom;
+    /** A programmatic call of an MCPL tool: `serverId` and `prefix` as resolveMcplTool matched them. */
     private executeMcplToolCall;
     /** Event-pushing wrapper for the model-driven dispatch path. */
     private dispatchCodeExecutionToolCall;
@@ -1957,6 +2806,12 @@ export declare class AgentFramework {
      * results reach the running script and never the model context.
      */
     private runCodeExecution;
+    /** Background scripts are the primary agent's, or any agent's when no primary agent is named. */
+    private runsBackgroundScripts;
+    /** How many background scripts an agent may have running at once. */
+    private maxBackgroundScripts;
+    /** How many of this agent's background scripts are running now. */
+    private runningBackgroundScripts;
     /**
      * Start a background script: dedicated interpreter, output journaled to a
      * workspace file, wake_agent() available in-script. The tool result
@@ -2005,6 +2860,22 @@ export declare class AgentFramework {
      * live wire copy can reuse the identical strings.
      */
     private buildStoredToolResultContent;
+    /**
+     * A tool result's text as its stored copy is written before any cut, and
+     * what its live copy showed beside that text (see cutStoredToolResult). An
+     * error result is its error text. Any other is serialized by
+     * nonErrorResultText, which retains each inline image BEFORE its
+     * placeholder is written (issue #104): the placeholder embeds the ref, so
+     * the image stays reachable by provenance after the bytes leave the wire.
+     *
+     * The live copy is the stored text itself unless the result is a content
+     * array carrying an inline image, which tryNativeToolResultContent sends
+     * as native blocks. It takes the same arrays the serializer takes block by
+     * block, and shows each image and each reference block's stub whole and
+     * each text block up to where it cuts that block at the cap (`maxChars`,
+     * toolResultCutAt), so those are the ranges of the text it showed.
+     */
+    private storedToolResultText;
     /** Where a tool result labelled `label` is written: `<first writable
      *  mount>/tool-results/<label>.txt`, or null when there is no writable
      *  workspace. */
@@ -2050,9 +2921,10 @@ export declare class AgentFramework {
      * RFC-007: with an `origin`, observers see the call as they see a model
      * call (register, dispatch with its refusal sites, open; the terminal at
      * the waiter intercept), under the inner tool's own name and class.
+     * `turnId` is the turn the call was made in (dispatchToolCall).
      */
     private dispatchScriptToolCall;
-    /** Abort a running script when the agent's turn dies underneath it. */
+    /** Abort the agent's script, running or still starting, when the turn it belongs to ends or is reset to run again. */
     private abortAgentScript;
     private toMembraneToolResult;
     /**
@@ -2060,7 +2932,9 @@ export declare class AgentFramework {
      * convert to Membrane's native ToolResultContentBlock[]. Returns null when
      * the array is text-only (let JSON path handle it; saves a code path).
      * `maxChars`, when provided, caps each accompanying text block so an image
-     * inlined alongside an enormous text payload can't blow the context.
+     * inlined alongside an enormous text payload can't blow the context. A
+     * block is cut as the stored copy is (toolResultCutAt), never inside a
+     * slot, so the stored copy can keep exactly the slots this showed (#403).
      */
     private tryNativeToolResultContent;
     private toolImageLedgerFor;
@@ -2079,6 +2953,10 @@ export declare class AgentFramework {
     private resolveToolResultInlineCap;
     private approximateDecodedBase64Bytes;
     private sanitizeProcessLogValue;
+    /** Writes one inference-log entry. A stream's entries go through its
+     *  driveStream's `logStream`, which gives the stream's usage to one entry
+     *  only; an end that calls this directly for a stream writes a second
+     *  entry for it, and its usage can be counted twice in the log. */
     private logInference;
     private logProcessEvent;
     /** Forget one server's RFC-008 class declarations (see the close handler). */
@@ -2117,20 +2995,127 @@ export declare class AgentFramework {
     /**
      * Find the MCPL server for a tool: [serverId, prefix], or null.
      * Prefixes can nest (`foo` and `foo--bar`), so `foo--bar--x` can match
-     * both. The server whose tools/list produced the name decides; a name no
-     * live server listed (stale, or invented by the model) goes to the longest
-     * matching prefix. Never prefix-map insertion order.
+     * both. The tool listing decides: the server whose tools/list offered the
+     * name, after its tool policy, as of the last tool refresh (a server that
+     * closed since keeps its names until the next one). Where two servers list
+     * the same name, the listing holds the one listed last (#265). A name the
+     * listing doesn't hold (invented by the model, or no longer listed) goes to
+     * the longest matching prefix. Never prefix-map insertion order.
      */
     private resolveMcplTool;
+    /**
+     * Why this host refuses a skip_reply call, as the model will read it, or
+     * undefined when it doesn't (skipReplyWakeRefusal): without an EventGate,
+     * any wake_in_seconds; with one, a wake_in_seconds that isn't a number of
+     * seconds. Only when the channel registry handles skip_reply. The dispatch
+     * that refuses the call reads it here, and so does the turn's bookkeeping of
+     * a refused round, for the model's own calls: the silence before it, which
+     * comes back after its round, and in XML mode which round's prose stays
+     * private. A skip_reply round's own prose stays private by the tool's name,
+     * refused or not.
+     */
+    private skipReplyRefusal;
+    private refusesSelfWake;
+    /**
+     * Dispatch a call the agent made. `turnId` is the turn it was made in
+     * (TurnRouting.turnId), as its caller knows it: a model's call, the turn
+     * whose stream made it; a foreground script's inner call, the turn of the
+     * code_execution call whose script is running when the call arrives. A
+     * background script's call has none.
+     */
     private dispatchToolCall;
     private dispatchToolCallEvent;
     private addMessage;
+    /** Where addMessage delivers: the named agent, else the primary, else the
+     *  first registered agent. Undefined when there is no such agent. */
+    private deliveryAgent;
+    /** The notes addMessage takes for a message it stored: an arrival for the
+     *  agent when none of its turns is alive or the message was assembled for
+     *  the start now beginning (no tool boundary will weigh it), and one for
+     *  every other resident's open turn. */
+    private noteStored;
     /**
      * Splice out the deferred messages addressed to `agentName` (explicitly
      * via forAgent, or implicitly when it is the primary), leaving other
-     * targets' messages queued for their own boundaries.
+     * targets' messages queued for their own boundaries. With `stopAt`, the
+     * drain ends at the first of them (in queue order) that it matches: that
+     * message and every later one stay queued, so what is drained is always a
+     * prefix of the agent's queue.
      */
     private drainDeferredFor;
+    /**
+     * Put drained entries back into the queue under their ids and seq: out of
+     * the un-acked set, and persisted when the queue is. A memory-only queue
+     * keeps them while the framework runs.
+     */
+    private requeueDrained;
+    /**
+     * Write drained entries in queue (seq) order, whatever their targets:
+     * residents share one message slot, so the order entries arrived in is the
+     * order they're stored. Each target is cut at its own first entry that
+     * can't be stored: that entry and every later one for the same target go
+     * back into the queue under their ids and seq (requeueDrained) before
+     * anything is logged, and other targets' entries go on. Left in the
+     * un-acked set, the next ack would drop them from the durable queue.
+     *
+     * So none of a target's entries lands ahead of an earlier one, and a queued
+     * tool_use that can't be stored keeps the tool_result queued behind it from
+     * being stored alone. (A tool_use that is stored, followed by a tool_result
+     * that can't be, stays stored without it until the tool_result lands at a
+     * later flush. The only queued pair is puppetToolCall's defensive one,
+     * which no path reaches today.) An entry that keeps failing is logged by
+     * id at each flush, and holds its target's later queued writes rather than
+     * letting them land out of order.
+     *
+     * The hold is the queue's alone. A write that isn't deferred is stored at
+     * once and can land ahead of a held entry: a fresh tool_result, whatever
+     * its agent's state, and any write while its agent's turn, stream and tool
+     * cycle are all idle and the host isn't quiesced. So an entry that keeps
+     * failing holds only what is deferred behind it.
+     *
+     * A write can throw after its message is stored: a store listener, the
+     * strategy's handling of the add, or a later shard of a sharded body can
+     * throw once a record is written. Before an entry that threw is put back,
+     * its target's store is read from where it stood before the write, for
+     * messages carrying the entry's `deferredWriteId`. What it finds counts as
+     * written, at most once: the entry isn't requeued and stored a second
+     * time, and what landed, as later compiles render it (asCompiled), is what
+     * it returns as the entry's content. For a sharded body, that can be its
+     * first shards alone, since the append loop stops at the throw; the rest
+     * of the body isn't stored. (Requeued, the
+     * landed shards would be stored twice, and only the rest could not be
+     * appended later without splitting the body.) Boot's scan for landed
+     * writes counts a landed shard the same way.
+     *
+     * Returns what was written (stored, or deferred again by addMessage, whose
+     * id is then empty), in queue order: for one target, a prefix of its
+     * entries. `onLanded` hears an entry whose write threw after storing it,
+     * with the id it landed under, as soon as it's found: before the writes
+     * after it, so whatever it records keeps their order.
+     */
+    private writeDrainedInOrder;
+    /** How many messages the agent's store holds: undefined when its store
+     *  can't say. */
+    private storedCountOf;
+    /** The messages carrying `deferredWriteId` among those the agent's store
+     *  gained from position `from` on, in store order, with their blobs
+     *  resolved, as a request carries them. A sharded body's carry its
+     *  `bodyGroupId`. */
+    private storedCopiesOf;
+    /** The line naming a drained write that threw: one that couldn't be stored,
+     *  which is already back in the queue, or, with `landed`, one stored before
+     *  the throw (for a sharded body, how many of its shards). Logging mustn't
+     *  fail the flush that met it, so a thrown value that has no text is named
+     *  as such. */
+    private logDeferredWriteError;
+    /** Re-add drained entries through addMessage, which stores each or defers
+     *  it again, in queue order and cut per target (writeDrainedInOrder). With
+     *  `bypassDeferral`, each is stored past its target's deferral (stop()). A
+     *  write that threw after storing missed the notes addMessage takes after a
+     *  store, so they're taken for what landed as soon as it's found, before
+     *  the writes after it: an open turn's arrivals keep the order the writes
+     *  landed in, and its newest stays the newest (remainingArrival). */
+    private readdDrained;
     private editMessage;
     private removeMessage;
     private getMessage;
@@ -2239,7 +3224,7 @@ export declare class AgentFramework {
      * push event to wake the agent onto the same context.
      *
      * Bounded: at most `refusalHandling.maxRewinds` (default 3, hard cap 10)
-     * sheds per failure episode; the budget resets on any successful inference.
+     * sheds per failure episode; the budget resets when a turn completes.
      * At the cap (or with nothing left to shed) it stops — the agent stays up
      * and hard-down logging continues, but no further history is consumed.
      */
@@ -2252,9 +3237,16 @@ export declare class AgentFramework {
     /**
      * Reconcile the durable ledger with Chronicle, then deliver every server's
      * work. A drain still running is waited for and then followed by a fresh
-     * pass (drainForGeneration).
-     */
-    syncDiscordAwarenessMarkers(_onlyServerId?: string): Promise<void>;
+     * pass (drainForGeneration). Like the other operator entry points, it's
+     * refused once stop() has begun, and stop() waits for one already running.
+     * The framework's own branch moves start their delivery without awaiting
+     * it (startDiscordAwarenessDelivery).
+     */
+    syncDiscordAwarenessMarkers(onlyServerId?: string): Promise<void>;
+    /** The sync's work. It installs the MCPL data-plane gate before its first
+     *  await, so a caller that starts it while holding the store puts the gate
+     *  up before releasing the store. */
+    private runDiscordAwarenessSync;
     private resumePreparedDiscordSuppressions;
     /**
      * Deliver every due ref independently. Permanent Discord failures are kept
@@ -2297,6 +3289,13 @@ export declare class AgentFramework {
     private releaseMcplDataPlaneGate;
     private completeMcplDataPlaneGate;
     private failMcplDataPlaneGate;
+    /**
+     * Close a runtime connect's new connection for good, through the registry,
+     * after a step of that connect failed. A close that fails keeps the entry,
+     * so a later disconnect, restart or shutdown can close it again, and is
+     * logged here rather than replacing the failure the connect reports.
+     */
+    private closeFailedRuntimeConnect;
     /**
      * Connect a single MCPL server: register routing entries, open the
      * connection, wire events, and initialize feature sets / scopes /
@@ -2325,6 +3324,12 @@ export declare class AgentFramework {
      * tell→receipt→activate), emit ONE change receipt (§17.6).
      */
     private handleManifestChanged;
+    /** A refresh handleManifestChanged schedules for itself, after the fetch
+     *  floor or behind a fetch in flight. It's contained as the announcement's
+     *  own run is. Its fetch's own failure is logged by the fetch's catch, as
+     *  in 0.22.x; any other failure emits mcpl:request-handler-error and a
+     *  stderr line through the containment. */
+    private rerunManifestRefresh;
     /**
      * (Re-)establish a server's host-side MCPL registration: feature-set state
      * (plus the featureSets/update sent to the server), scope patterns, and
@@ -2382,9 +3387,12 @@ export declare class AgentFramework {
      * Connect a new MCPL server at runtime. Refreshes the tool list and
      * notifies the agent of newly available tools. Throws if the MCPL
      * subsystem is not initialized, the id is already connected, or the
-     * connection/handshake fails.
+     * connection/handshake fails. A config whose `inheritEnv` (on a stdio
+     * server), `reconnect` or `allowHostCommands` holds anything but true,
+     * false or null is refused, as `create()` refuses one.
      */
     connectMcplServer(config: import('./mcpl/types.js').McplServerConfig): Promise<void>;
+    private runConnectMcplServer;
     /**
      * Disconnect an MCPL server at runtime: close the connection, destroy its
      * feature-set and checkpoint state (permanent removal — unlike a transient
@@ -2393,13 +3401,17 @@ export declare class AgentFramework {
      * No-op-ish if the server is not connected (still clears routing state).
      */
     disconnectMcplServer(id: string): Promise<void>;
+    private runDisconnectMcplServer;
     /**
      * Restart an MCPL server at runtime: disconnect, then reconnect with the
      * same (or an updated) config. This actually respawns a stdio child —
      * unlike `reconnect: true`, which only retries after transport-level
      * failures. Throws if the server has no stored config and none is given.
+     * A config `connectMcplServer` would refuse for its boolean settings is
+     * refused before the running server is disconnected, so it stays up.
      */
     restartMcplServer(id: string, newConfig?: import('./mcpl/types.js').McplServerConfig): Promise<void>;
+    private runRestartMcplServer;
     /**
      * List configured MCPL servers with live connection status and the number
      * of tools each currently contributes.
@@ -2452,6 +3464,14 @@ export declare class AgentFramework {
         command?: string;
         url?: string;
     }>;
+    /**
+     * An inbound MCPL handler, contained: EventEmitter doesn't consume the
+     * promise a listener returns, so this keeps each handler's throw or
+     * rejection at this boundary, including failures after channels/register or
+     * channels/changed has acknowledged the request. It's invoked at once, so
+     * control-plane replies keep their acknowledge-before-reconcile order.
+     */
+    private containedInboundHandler;
     /**
      * Wire event listeners on an MCPL server connection.
      * Push events and inference requests are deferred to Steps 6/7.