@animalabs/agent-framework 0.22.2 → 0.23.0

package/src/mcpl/channel-registry.ts

@@ -14,8 +14,10 @@
  */
 
 import type { ContentBlock } from '@animalabs/membrane';
-import { INLINE_WITHHELD_TEXT, isInlineContradiction, referenceStubOrNull } from './references.js';
+import { convertBlock } from './convert-block.js';
 import type { JsStore } from '@animalabs/chronicle';
+import { isDeepStrictEqual } from 'node:util';
+import { ensureStateRegistered } from '../module-registry.js';
 
 import type {
   ChannelDescriptor,
@@ -30,7 +32,6 @@ import type {
   ChannelsPublishParams,
   ChannelsOpenResult,
   ChannelHistoryRequest,
-  McplContentBlock,
 } from './types.js';
 
 import type { McplServerRegistry } from './server-registry.js';
@@ -38,18 +39,55 @@ import type { FeatureSetManager } from './feature-set-manager.js';
 import type { ToolDefinition, ToolResult, ProcessEvent } from '../types/index.js';
 import { expandCoreTags } from './tags.js';
 import { coalesceRejectionReason, EmptyContentError, validateCoalescedContent } from './push-coalescer.js';
-import { isVisiblyEmptyContent } from './visible-content.js';
+import { isVisiblyEmptyConversion } from './visible-content.js';
 import { logDetail, logValue } from './log-value.js';
 import { RefusalLines } from './refusal-lines.js';
 import { CapabilityGrant } from './capability-grant.js';
+import type { InboundSource } from './inbound-source.js';
+import { McplRequestError } from './server-connection.js';
+import { readSkipReplyWake } from './skip-reply-wake.js';
 
 // ============================================================================
 // Typing indicator interval (Discord typing lasts ~10s, so 7s keeps it alive)
 // ============================================================================
 
 const TYPING_INTERVAL_MS = 7_000;
+const MAX_CHANNEL_LIFECYCLE_ATTEMPTS = 5;
+
+/** A successful RPC can still fail to establish the latest channel target. */
+class ChannelLifecycleConvergenceError extends Error {}
+/** A channels/open answered for a channel other than the one it named. */
+class ChannelOpenSubstitutionError extends Error {}
+/** An operation queued for a server's registrations that were removed. */
+class ChannelLifecycleCancelledError extends Error {}
 const CHANNEL_LIFECYCLE_LOG_ID = 'mcpl/channel-lifecycle';
 
+/**
+ * What a channels/open answer says about which channel the server opened:
+ * its `channel.id`, or else the `channelId` of a history item. Each is
+ * evidence. A string other than the requested id names another channel (ids
+ * compare exactly, as the server's traffic is matched). Null or absence names
+ * no channel, and gives undefined, as does an answer that names none at all.
+ * Any other value is malformed: it names nothing the host could register.
+ */
+function substitutedChannel(
+  result: ChannelsOpenResult | undefined,
+  requested: string,
+): { kind: 'other'; id: string } | { kind: 'malformed'; value: unknown } | undefined {
+  const named = (value: unknown) => {
+    if (value === undefined || value === null || value === requested) return undefined;
+    return typeof value === 'string' ? { kind: 'other' as const, id: value } : { kind: 'malformed' as const, value };
+  };
+  const answered = named(result?.channel?.id);
+  if (answered) return answered;
+  const history: unknown[] = Array.isArray(result?.history) ? result.history : [];
+  for (const item of history) {
+    const from = named((item as { channelId?: unknown } | null)?.channelId);
+    if (from) return from;
+  }
+  return undefined;
+}
+
 /**
  * Durable "which label did this channelId have, each time we saw it" log.
  * `resolveProseTarget()` resolves a label to an id only for channels
@@ -210,9 +248,14 @@ function shallowEqualRecord(
 interface ChannelEntry {
   serverId: string;
   descriptor: ChannelDescriptor;
+  /** Whether the current target is confirmed open; false can be unconfirmed. */
   open: boolean;
 }
 
+function sameChannelTarget(a: ChannelDescriptor, b: ChannelDescriptor): boolean {
+  return a.type === b.type && isDeepStrictEqual(a.address, b.address);
+}
+
 /** Minimal responder interface for sending JSON-RPC results back. */
 interface Responder {
   respond(result: unknown): void;
@@ -239,94 +282,30 @@ interface McplChannelIncomingEvent {
   tags?: string[];
   triggerInference?: boolean;
   targetAgents?: string[];
+  /** Host acceptance time (epoch ms), stamped where the message is admitted. */
+  acceptedAt?: number;
+  /** Source envelope frozen at admission (mcpl/inbound-source.ts). */
+  inboundSource?: InboundSource;
 }
 
 // ============================================================================
-// Content Conversion: McplContentBlock → membrane ContentBlock
+// Channel Tool Definitions
 // ============================================================================
 
 /**
- * Convert a single MCPL wire-format content block to a membrane ContentBlock.
+ * `journal`'s description. It tells the model to call `skip_reply` to end the
+ * turn only where the agent may call it: the framework builds each agent's
+ * surface with that agent's permission, and a refused `skip_reply` leaves the
+ * turn going on.
  */
-function convertBlock(block: McplContentBlock): ContentBlock {
-  switch (block.type) {
-    case 'text':
-      // Text that isn't a string is no text, as the request sanitizer and
-      // the visible-content check already read it.
-      return { type: 'text', text: typeof block.text === 'string' ? block.text : '' };
-
-    case 'image':
-      if (isInlineContradiction(block)) {
-        // RFC-005 vector 2: inline data claiming bulk disposition — fail
-        // closed, withhold the data (checked BEFORE the data branch).
-        return { type: 'text', text: INLINE_WITHHELD_TEXT };
-      }
-      if (isFilledString(block.uri) && block.disposition) {
-        // RFC-005 uri-form media with a disposition claim: stub, do not
-        // hand the URI to the provider or inline it.
-        return { type: 'text', text: referenceStubOrNull(block, 'attachment on channel message') ?? '[reference]' };
-      }
-      if (isFilledString(block.data) && isFilledString(block.mimeType)) {
-        return {
-          type: 'image',
-          source: { type: 'base64', data: block.data, mediaType: block.mimeType },
-        } as ContentBlock;
-      }
-      if (isFilledString(block.uri)) {
-        return {
-          type: 'image',
-          source: { type: 'url', url: block.uri },
-        } as ContentBlock;
-      }
-      return { type: 'text', text: isFilledString(block.data) ? '[Image: no media type]' : '[Image: no data]' };
-
-    case 'audio':
-      if (isInlineContradiction(block)) {
-        // RFC-005 vector 2: inline data claiming bulk disposition — fail
-        // closed, withhold the data (checked BEFORE the data branch).
-        return { type: 'text', text: INLINE_WITHHELD_TEXT };
-      }
-      if (isFilledString(block.uri) && block.disposition) {
-        // RFC-005 uri-form media with a disposition claim: stub, do not
-        // hand the URI to the provider or inline it.
-        return { type: 'text', text: referenceStubOrNull(block, 'attachment on channel message') ?? '[reference]' };
-      }
-      if (isFilledString(block.data) && isFilledString(block.mimeType)) {
-        return {
-          type: 'audio',
-          source: { type: 'base64', data: block.data, mediaType: block.mimeType },
-        } as ContentBlock;
-      }
-      return { type: 'text', text: isFilledString(block.data) ? '[Audio: no media type]' : '[Audio: no data]' };
-
-    case 'resource':
-      // RFC-005: reference blocks become bounded stubs — never raw URIs
-      // (a signed URL is a bearer credential that looks like a location).
-      return { type: 'text', text: referenceStubOrNull(block, 'attachment on channel message') ?? '[reference]' };
-
-    default: {
-      // Unknown wire block types previously fell off the exhaustive switch
-      // and propagated `undefined` into ContentBlock[]. Fail visibly. A type
-      // that isn't a string is no type, and is never converted to one: an
-      // object can throw when it is.
-      const type: unknown = (block as { type?: unknown }).type;
-      return { type: 'text', text: `[unrecognized content block: ${typeof type === 'string' ? type : 'untyped'}]` };
-    }
-  }
-}
-
-/** A string with something in it: the only data, mimeType or uri a block's
- *  source is built from, and the only uri that makes it a reference. Anything
- *  else a sender puts there leaves the block without it, so conversion never
- *  throws and never copies a non-string. */
-function isFilledString(value: unknown): value is string {
-  return typeof value === 'string' && value !== '';
+export function journalToolDescription(canSkipReply: boolean): string {
+  return 'Write an entry in your private journal. The entry stays in your own context and ' +
+    'memory and is NOT sent to any channel, surface or person. Use it for anything longer ' +
+    'than a line that you want to keep for yourself — reflections, what you decided and ' +
+    'why, notes for later. It does not end your turn and does not affect where ordinary ' +
+    'text is routed' + (canSkipReply ? '; to end the turn without replying, call skip_reply afterwards.' : '.');
 }
 
-// ============================================================================
-// Channel Tool Definitions
-// ============================================================================
-
 const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   {
     name: 'channel_list',
@@ -336,9 +315,8 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   {
     name: 'channel_open',
     description:
-      'Open a channel to start receiving its ordinary ongoing traffic. The MCPL ' +
-      'integration performs its own subscribe/join/attach operation. Optionally request ' +
-      'history preceding the message that invited you into the channel.',
+      'Open a channel. What an open channel delivers to you depends on its MCPL server. ' +
+      'Optionally request history preceding the message that invited you into the channel.',
     inputSchema: {
       type: 'object' as const,
       properties: {
@@ -378,7 +356,9 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   },
   {
     name: 'channel_close',
-    description: 'Close a channel to stop receiving messages',
+    description:
+      'Close a channel. Messages that address you still reach you; what else stops reaching you ' +
+      'depends on its server.',
     inputSchema: {
       type: 'object' as const,
       properties: {
@@ -390,11 +370,11 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   },
   {
     name: 'channel_publish',
-    description: 'Publish a message to a channel. If channelId is omitted, publishes to the most recent incoming channel.',
+    description: 'Publish a message to a channel. If channelId is omitted, publishes to the channel this conversation is bound to, if any, else to the most recent incoming channel. A subagent has neither, and must name one.',
     inputSchema: {
       type: 'object' as const,
       properties: {
-        channelId: { type: 'string', description: 'ID of the channel to publish to (defaults to the most recent incoming channel)' },
+        channelId: { type: 'string', description: 'ID of the channel to publish to (defaults to the conversation\'s bound channel, else the most recent incoming channel; required of a subagent)' },
         content: { type: 'string', description: 'Text content to publish' },
         text: { type: 'string', description: 'Alias for content' },
       },
@@ -403,6 +383,9 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   },
   {
     name: 'think',
+    // No agent's surface shows this description: getToolsForAgent gives every
+    // agent its own think (buildThinkTool), which names skip_reply only where
+    // that agent may call it.
     description:
       'Reason privately. The content stays in your own context and is NOT sent to any ' +
       'channel or surface. Same-round routing of ordinary text beside think() depends on ' +
@@ -422,12 +405,7 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
   },
   {
     name: 'journal',
-    description:
-      'Write an entry in your private journal. The entry stays in your own context and ' +
-      'memory and is NOT sent to any channel, surface or person. Use it for anything longer ' +
-      'than a line that you want to keep for yourself — reflections, what you decided and ' +
-      'why, notes for later. It does not end your turn and does not affect where ordinary ' +
-      'text is routed; to end the turn without replying, call skip_reply afterwards.',
+    description: journalToolDescription(true),
     inputSchema: {
       type: 'object' as const,
       properties: {
@@ -457,8 +435,9 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
           type: 'number',
           description:
             'Optional self-wake: if nothing else wakes you first, you wake again after this ' +
-            'many seconds (1 = go again almost immediately; clamped to 1–3600). Any other ' +
-            'wake before then cancels it. Omit to stay idle until the next external wake.',
+            'many seconds, from 1 to 3600; a larger number waits 3600 (1 = go again almost ' +
+            'immediately). Any other wake before then cancels it. Omit to stay idle until the ' +
+            'next external wake.',
         },
       },
       required: [],
@@ -470,7 +449,130 @@ const CHANNEL_TOOL_DEFINITIONS: ToolDefinition[] = [
 // Constructor Options
 // ============================================================================
 
+/** Bound connector values for notices, logs and an outcome's reason. A
+ *  PublishOutcome keeps the connector's structured data (`detail`) whole. */
+export function connectorText(value: unknown): string {
+  let text: string;
+  try {
+    text = typeof value === 'string' ? value : JSON.stringify(value) ?? String(value);
+  } catch {
+    return '[unserializable connector value]';
+  }
+  const limit = 2000;
+  const suffix = '… [truncated]';
+  return text.length > limit ? text.slice(0, limit - suffix.length) + suffix : text;
+}
+
+/** Where a publish was resolved to go — named by the registry, never by
+ *  the caller's spelling. */
+export interface PublishDestination {
+  serverId: string;
+  channelId: string;
+  /** The channel's registered label when the attempt was made. */
+  label?: string;
+}
+
+/**
+ * What one channels/publish attempt established (ChannelRegistry.publish).
+ * - `delivered`: the connector returned `delivered: true`. A historical
+ *   receipt (confirmed at `at`, to `destination`, message `messageId` when
+ *   the connector named one), not a claim the message still exists.
+ * - `failed`: nothing was posted: the request never left the host
+ *   (unresolvable or shared channel id, missing grant, failed open, closed
+ *   connection), or the connector answered `delivered: false` and named no
+ *   message.
+ * - `unknown`: the request was dispatched and no valid receipt came back (an
+ *   error response, a timeout, a lost connection, or a missing, malformed or
+ *   contradictory receipt, such as `delivered: false` beside a message id).
+ *   It may or may not have been posted.
+ */
+export interface PublishOutcome {
+  status: 'delivered' | 'failed' | 'unknown';
+  /** Absent only when no destination could be resolved. */
+  destination?: PublishDestination;
+  messageId?: string;
+  /** Why it failed, or why its outcome is unknown — for a connector error,
+   *  its message, bounded (which may say what was already posted). */
+  reason?: string;
+  /** The connector error's structured `data`, verbatim, when it sent one. */
+  detail?: unknown;
+  /** When the outcome was established (epoch ms). */
+  at: number;
+}
+
+/**
+ * What a channels/publish request that threw establishes. Only a request
+ * that never left the host proves nothing was posted. An error response may
+ * follow a partial post (a multi-part send whose later part failed), so it
+ * is unknown, with the connector's own words, bounded, and its data kept for
+ * the resident to judge. The publish executor and channel_publish both read
+ * a failed request this way.
+ */
+function publishErrorOutcome(err: unknown, destination: PublishDestination, at: number): PublishOutcome {
+  // This host's own words for a request that wasn't sent or wasn't answered
+  // are sentences, and every composition of the reason adds its own ending,
+  // so one final period comes off them. A server's error answer keeps its
+  // words as they came.
+  const text = connectorText(err instanceof Error ? err.message : String(err));
+  const message = err instanceof McplRequestError && err.outcome !== 'error-response' ? text.replace(/(?<!\.)\.$/, '') : text;
+  const notSent = err instanceof McplRequestError && err.outcome === 'not-sent';
+  const detail = err instanceof McplRequestError ? err.data : undefined;
+  return {
+    status: notSent ? 'failed' : 'unknown',
+    destination,
+    reason: notSent ? message : `${message} (delivery uncertain)`,
+    ...(detail !== undefined ? { detail } : {}),
+    at,
+  };
+}
+
+/**
+ * What a channels/publish answer establishes. A final publish is a request,
+ * so success requires an explicit receipt; a missing or malformed one leaves
+ * delivery uncertain (anima-research/agent-framework#163's rule).
+ * `delivered: false` proves nothing went out only when the receipt names no
+ * message at all: a message id beside it, valid or malformed, contradicts it,
+ * since something may have been posted. The publish executor and
+ * channel_publish both read an answer this way.
+ */
+function publishReceiptOutcome(result: unknown, destination: PublishDestination, at: number): PublishOutcome {
+  const receipt = (result ?? {}) as { delivered?: unknown; messageId?: unknown };
+  const messageId = typeof receipt.messageId === 'string' && receipt.messageId ? receipt.messageId : undefined;
+  if (receipt.delivered === true) {
+    return { status: 'delivered', destination, ...(messageId ? { messageId } : {}), at };
+  }
+  if (receipt.delivered === false) {
+    if (receipt.messageId === undefined || receipt.messageId === null) {
+      return { status: 'failed', destination, reason: `server "${destination.serverId}" reported delivered:false`, at };
+    }
+    return {
+      status: 'unknown',
+      destination,
+      ...(messageId ? { messageId } : {}),
+      reason: messageId
+        ? `server "${destination.serverId}" reported delivered:false but named posted message ${connectorText(messageId)} (delivery uncertain)`
+        : `server "${destination.serverId}" reported delivered:false beside a malformed message id ` +
+          `${connectorText(receipt.messageId)} (contradictory receipt; delivery uncertain)`,
+      at,
+    };
+  }
+  return {
+    status: 'unknown',
+    destination,
+    ...(messageId ? { messageId } : {}),
+    reason: `server "${destination.serverId}" returned no valid delivery receipt (delivery uncertain)`,
+    at,
+  };
+}
+
 interface ChannelRegistryOptions {
+  /**
+   * An ordinary (uncoalesced) `channels/incoming` message has just been
+   * admitted, before it is queued or acknowledged: return its source
+   * envelope, frozen now (mcpl/inbound-source.ts). The framework observes the
+   * acceptance here; coalesced work is stamped and observed by its own path.
+   */
+  acceptInbound?: (event: McplChannelIncomingEvent) => InboundSource | undefined;
   /**
    * RFC-006: an admitted `channels/incoming` message carrying `coalesce`, with
    * the event the ordinary path would have queued. The handler decides
@@ -489,8 +591,10 @@ interface ChannelRegistryOptions {
   /**
    * Called when a text-only turn's speech could NOT be delivered to its
    * conversational locus — no locus, an unregistered channel, a missing
-   * server, or the server reporting `delivered: false`. The host wires this
-   * to drop a `[discord-send-failed]` marker into chronicle so the failure is
+   * server, or the server reporting `delivered: false`. Not called for an
+   * ephemeral run's speech with no locus, which is its caller's result
+   * (`takesGlobalFallback`). The host wires this to drop a
+   * `[discord-send-failed]` marker into chronicle so the failure is
    * visible to the agent (and operator) rather than silently lost. Must not
    * itself trigger inference (avoid wake loops).
    */
@@ -499,15 +603,22 @@ interface ChannelRegistryOptions {
     channelId: string | null;
     reason: string;
     textLen: number;
+    /** `failed`: nothing was posted; `unknown`: the request was dispatched
+     *  and no valid receipt came back, so it may or may not have been. */
+    outcome?: 'failed' | 'unknown';
+    /** Bounded display of the connector's structured error data, when present. */
+    detail?: string;
   }) => void;
   /**
-   * Called when channels were opened WITHOUT the agent asking (subscription
-   * policy admitting a newly discovered channel, or delivery into a closed
-   * locus). The host wires this to drop a durable notice into the agent's
-   * window — the agent must always learn that new traffic will start
-   * flowing, and that `channel_close` opts out (their decision outranks
-   * policy). Fires ONCE per channel ever: the desired-state decision is
-   * durable, so reboots do not re-announce. Must not trigger inference.
+   * Announces either a durable subscription-policy admission (before its
+   * transport RPC; not an open confirmation), or a delivery that turned a
+   * closed channel open, once its transport is confirmed. Reconfirming the
+   * transport of a channel already decided open or tuned out isn't one.
+   * The host records a durable, non-waking notice. What an open channel
+   * delivers is the server's to say (#406).
+   * Policy admissions fire once per channel: the persisted desired-state
+   * decision prevents re-announcement on retry or reboot. channel_close
+   * supersedes policy; a fresh delivery into a closed locus engages it again.
    */
   onChannelAutoOpened?: (info: {
     /** Agent whose action caused the open (delivery); absent for policy opens. */
@@ -543,6 +654,20 @@ interface ChannelRegistryOptions {
    * `defaultPublishChannel`.
    */
   activeChannelResolver?: (agentName: string) => string | undefined;
+  /**
+   * Whether a conversation takes the process-global fallback, the channel of
+   * the most recent delivered inbound message: as where its plain speech lands
+   * when it has no home and no channel of its own this turn, as its channel
+   * context's `incoming` and default outgoing channel, and as
+   * `channel_publish`'s target when it names none. False for an ephemeral run
+   * (a subagent): its prose is its caller's result, so a channel that only the
+   * latest inbound message picked is never its destination, and its plain
+   * speech with no channel of its own is undelivered rather than a failed
+   * delivery. Absent, every conversation takes it.
+   */
+  takesGlobalFallback?: (conversationId: string) => boolean;
+  /** Whether this framework has EventGate and can honor skip_reply self-wakes. */
+  eventGatePresent?: boolean;
 }
 
 // ============================================================================
@@ -576,12 +701,7 @@ export class ChannelRegistry {
     op?: 'start' | 'stop',
   ) => void;
   private shouldTriggerInference?: (content: string, metadata: Record<string, unknown>) => boolean;
-  private onRouteFailure?: (info: {
-    conversationId: string;
-    channelId: string | null;
-    reason: string;
-    textLen: number;
-  }) => void;
+  private onRouteFailure?: ChannelRegistryOptions['onRouteFailure'];
   private onChannelAutoOpened?: (info: {
     conversationId?: string;
     serverId: string;
@@ -590,6 +710,7 @@ export class ChannelRegistry {
   }) => void;
   private homeChannelResolver?: (agentName: string) => string | undefined;
   private activeChannelResolver?: (agentName: string) => string | undefined;
+  private takesGlobalFallback?: (conversationId: string) => boolean;
   private store?: JsStore;
 
   /** Registered channels, keyed by `{serverId}:{channelId}`. */
@@ -679,7 +800,49 @@ export class ChannelRegistry {
   /** One-time migration inputs from the retired recipe auto-open policy. */
   private legacyPolicies = new Map<string, 'auto' | 'manual' | string[]>();
   private migratedLegacyPolicies = new Set<string>();
+
+  // Keep one transport operation in flight per logical channel, including
+  // across descriptor replacement. Settled tails release themselves; a
+  // failed operation must not poison later decisions.
+  private channelLifecycleTails = new Map<string, Promise<void>>();
+  // Bumped when a server's registrations are removed: an operation queued
+  // before that is cancelled when it would run, rather than acting on a
+  // closing connection or on a later re-registration's entries.
+  private serverRemovals = new Map<string, number>();
+  // Operations queued or running per channel that will still read its
+  // target before confirming anything. Unlike the tail, which settles a few
+  // microtasks after its operation's last check, this drops at that check.
+  private lifecycleOutstanding = new Map<string, number>();
+  // Losing an open receipt does not confirm closure. Keep that distinction
+  // private while preserving the public open:boolean availability projection.
+  private unconfirmedChannelTargets = new WeakSet<ChannelEntry>();
+
+  private invalidateTransportConfirmation(entry: ChannelEntry): void {
+    entry.open = false;
+    this.unconfirmedChannelTargets.add(entry);
+  }
+
+  /** Whether the host directs this server's channel lifecycle (§14.1: its
+   *  `channels.lifecycle` grant). Where it doesn't, the server opens and
+   *  closes its own channels, and sends no receipt the host could wait for. */
+  private directsLifecycle(serverId: string): boolean {
+    return CapabilityGrant.of(this.serverRegistry.getServer(serverId)).has('channels.lifecycle');
+  }
+
+  /** A registration's entry: nothing about its transport is known until a
+   *  receipt for its target confirms it open or closed. */
+  private registerEntry(key: string, serverId: string, descriptor: ChannelDescriptor): void {
+    const entry: ChannelEntry = { serverId, descriptor, open: false };
+    this.channels.set(key, entry);
+    this.unconfirmedChannelTargets.add(entry);
+  }
+
+  private hasPendingLifecycle(entry: ChannelEntry): boolean {
+    return this.channelLifecycleTails.has(this.lifecycleKey(entry.serverId, entry.descriptor.id));
+  }
   private handleCoalescedIncoming?: ChannelRegistryOptions['handleCoalescedIncoming'];
+  private acceptInbound?: ChannelRegistryOptions['acceptInbound'];
+  private channelTools: ToolDefinition[];
 
   constructor(
     serverRegistry: McplServerRegistry,
@@ -696,6 +859,24 @@ export class ChannelRegistry {
     },
   ) {
     this.handleCoalescedIncoming = options?.handleCoalescedIncoming;
+    this.acceptInbound = options?.acceptInbound;
+    this.channelTools = CHANNEL_TOOL_DEFINITIONS.map((tool) => {
+      if (tool.name !== 'skip_reply' || options?.eventGatePresent === true) return tool;
+      const schema = tool.inputSchema as {
+        type: 'object';
+        properties: NonNullable<ToolDefinition['inputSchema']['properties']>;
+        required?: string[];
+      };
+      const { wake_in_seconds: _wake, ...properties } = schema.properties;
+      return {
+        ...tool,
+        description: tool.description.replace(
+          ' To end this turn but come back on your own shortly, set wake_in_seconds.',
+          '',
+        ),
+        inputSchema: { ...schema, properties },
+      };
+    });
     this.serverRegistry = serverRegistry;
     this.featureSetManager = featureSetManager;
     this.pushEventFn = pushEventFn;
@@ -706,6 +887,7 @@ export class ChannelRegistry {
     this.onChannelAutoOpened = options?.onChannelAutoOpened;
     this.homeChannelResolver = options?.homeChannelResolver;
     this.activeChannelResolver = options?.activeChannelResolver;
+    this.takesGlobalFallback = options?.takesGlobalFallback;
     this.store = options?.store;
     this.initializeLifecycleStore();
     this.initializeLabelHistoryStore();
@@ -749,11 +931,7 @@ export class ChannelRegistry {
         continue;
       }
       const key = `${serverId}:${channel.id}`;
-      this.channels.set(key, {
-        serverId,
-        descriptor: channel,
-        open: false,
-      });
+      this.registerEntry(key, serverId, channel);
       this.appendLabelSighting(channel.id, channel.label, extractDmMeta(channel.metadata));
       registeredIds.push(channel.id);
       results.push({ id: channel.id, accepted: true });
@@ -794,6 +972,7 @@ export class ChannelRegistry {
     // channels/register — a changed-set cannot smuggle in what register
     // would have rejected (PR #79 review blocker 5).
     const addedResults: Array<{ id: string; accepted: boolean; reason?: string }> = [];
+    const retargeted: ChannelDescriptor[] = [];
     // Process removed channels — itemized truthfully: removal of a channel
     // we never had is reported, not silently accepted.
     if (params.removed) {
@@ -823,6 +1002,21 @@ export class ChannelRegistry {
           this.emitTraceFn({ type: 'mcpl:channel-descriptor-rejected', serverId, channelId: channel.id, reason: 'update for unregistered channel' });
           continue;
         }
+        // A live subscription to the old target does not confirm the new
+        // type/address. Label-only updates preserve that confirmation. A
+        // channel decided open (or tuned out) is opened at its new target.
+        if (!sameChannelTarget(existing.descriptor, channel)) {
+          this.invalidateTransportConfirmation(existing);
+          // An operation queued or running for this channel reads its target
+          // again before it confirms anything, and after a failed RPC, so it
+          // opens the new one. With none, a channel decided open (or tuned
+          // out) is reconciled here.
+          const desired = this.getDesiredState(serverId, channel.id);
+          if ((desired === 'open' || desired === 'tuned-out') &&
+              !this.lifecycleOutstanding.has(this.lifecycleKey(serverId, channel.id))) {
+            retargeted.push(channel);
+          }
+        }
         existing.descriptor = channel;
         this.appendLabelSighting(channel.id, channel.label, extractDmMeta(channel.metadata));
         addedResults.push({ id: channel.id, accepted: true });
@@ -840,11 +1034,7 @@ export class ChannelRegistry {
           continue;
         }
         const key = `${serverId}:${channel.id}`;
-        this.channels.set(key, {
-          serverId,
-          descriptor: channel,
-          open: false,
-        });
+        this.registerEntry(key, serverId, channel);
         this.appendLabelSighting(channel.id, channel.label, extractDmMeta(channel.metadata));
         addedResults.push({ id: channel.id, accepted: true });
         accepted.push(channel);
@@ -859,7 +1049,8 @@ export class ChannelRegistry {
     // settled above, so nothing in the response depends on reconciling.
     responder?.respond({ results: addedResults });
 
-    if (accepted.length > 0) await this.reconcileChannels(serverId, accepted);
+    const reconcile = [...accepted, ...retargeted];
+    if (reconcile.length > 0) await this.reconcileChannels(serverId, reconcile);
 
     this.emitTraceFn({
       type: 'mcpl:channels-changed',
@@ -1031,8 +1222,8 @@ export class ChannelRegistry {
         }
       }
       if (message.tags) message.tags = expandCoreTags(message.tags);
-      const convertedContent: ContentBlock[] = message.content.map(convertBlock);
-      if (!emptyAllowed && isVisiblyEmptyContent(convertedContent)) {
+      const convertedContent: ContentBlock[] = message.content.map((block) => convertBlock(block, 'attachment on channel message', serverId));
+      if (!emptyAllowed && isVisiblyEmptyConversion(message.content, convertedContent)) {
         rejectEmpty();
         continue;
       }
@@ -1043,15 +1234,31 @@ export class ChannelRegistry {
       // exactly the authority a self-attested channel would be stealing).
       // A coalesced item is "accepted" only once the coalescer admits it, so
       // for those this runs after the hook (below).
+      const incomingEntry = this.channels.get(incomingKey)!;
       const markAccepted = () => {
         this.defaultPublishChannel = message.channelId;
         this.defaultPublishMessageId = message.messageId;
         this.defaultPublishThreadId = message.threadId;
-        // A server sending channels/incoming is authoritative evidence that
-        // the transport is actually open. This repairs transient status only;
-        // durable desired state still changes exclusively through lifecycle
-        // operations.
-        this.channels.get(incomingKey)!.open = true;
+        // Where the host directs this server's lifecycle, only a receipt for
+        // the current target confirms it: traffic shows the transport open
+        // only for a confirmed target, and only for a channel still decided
+        // open or tuned out. After a retarget, traffic for this id may still
+        // come from the old subscription, and a close receipt that landed
+        // first (or during the coalescer's await) stands. Where the host
+        // doesn't direct it, the server opens its own channels and its
+        // traffic is the only evidence the host gets, so it marks the
+        // channel open, as it always has. The entry is the one the message
+        // was accepted for: one a re-registration put in its place meanwhile
+        // waits for its own evidence. Durable desired state still changes
+        // exclusively through lifecycle operations.
+        if (this.directsLifecycle(serverId)) {
+          if (this.unconfirmedChannelTargets.has(incomingEntry)) return;
+          const desired = this.getDesiredState(serverId, message.channelId);
+          if (desired !== 'open' && desired !== 'tuned-out') return;
+        } else {
+          this.unconfirmedChannelTargets.delete(incomingEntry);
+        }
+        incomingEntry.open = true;
       };
       if (!coalesced) markAccepted();
 
@@ -1060,7 +1267,7 @@ export class ChannelRegistry {
       if (this.shouldTriggerInference) {
         // The text the agent's context gets, as the push lane's filter reads
         // it: the converted text blocks, a placeholder or reference stub
-        // among them, and a text block's non-string text as empty text.
+        // among them, NON_STRING_TEXT_PLACEHOLDER included.
         const textContent = convertedContent
           .filter((b): b is ContentBlock & { type: 'text' } => b.type === 'text')
           .map((b) => b.text)
@@ -1093,6 +1300,7 @@ export class ChannelRegistry {
         metadata: message.metadata,
         ...(message.tags ? { tags: message.tags } : {}),
         triggerInference,
+        acceptedAt: Date.now(),
       };
 
       if (coalesced) {
@@ -1118,6 +1326,12 @@ export class ChannelRegistry {
         continue;
       }
 
+      // The source envelope is frozen here, at admission, before the message
+      // is queued or acknowledged: a rename or rebind while it waits in the
+      // queue cannot change where it says it came from.
+      const inboundSource = this.acceptInbound?.(event);
+      if (inboundSource) event.inboundSource = inboundSource;
+
       // Push to the processing queue
       // Cast through unknown because McplChannelIncomingEvent matches the
       // CustomEvent `${string}:${string}` type pattern but lacks an index signature.
@@ -1171,20 +1385,34 @@ export class ChannelRegistry {
         (existing.descriptor.metadata as { lazyRegistered?: boolean } | undefined)?.lazyRegistered &&
         label && existing.descriptor.label === channelId
       ) {
-        existing.descriptor.label = label;
-        if (extraMetadata) {
-          existing.descriptor.metadata = { ...existing.descriptor.metadata, ...extraMetadata };
-        }
+        const metadata = extraMetadata
+          ? { ...existing.descriptor.metadata, ...extraMetadata }
+          : existing.descriptor.metadata;
         // The channel now has a real label, not just the bare id — durable.
-        this.appendLabelSighting(
-          existing.descriptor.id,
-          existing.descriptor.label,
-          extractDmMeta(existing.descriptor.metadata),
-        );
+        // Recorded before the live descriptor takes it, since this branch's
+        // guard reads the descriptor: an append that throws leaves the
+        // placeholder, so the next push tries again.
+        this.appendLabelSighting(existing.descriptor.id, label, extractDmMeta(metadata));
+        existing.descriptor.label = label;
+        existing.descriptor.metadata = metadata;
       }
       return;
     }
 
+    // Only persist a REAL label durably. Falling back to the bare
+    // channelId as a placeholder (no server-supplied label at all — e.g. a
+    // Discord DM push missing both channelName and an author name,
+    // framework.ts's derivePushEventChannel) must never overwrite a real
+    // label already on file from a previous boot: after a restart the live
+    // `channels` map starts empty, so THIS is the very branch a
+    // label-less post-restart event takes — recording the placeholder here
+    // would clobber the good label initializeLabelHistoryStore() just
+    // replayed, defeating the entire point of the durable log. The live
+    // descriptor below still carries the placeholder for in-process
+    // routing; only the durable write is skipped when there's no real
+    // label to record. A real label is recorded before the entry exists:
+    // an append that throws registers nothing, so the next push tries again.
+    if (label) this.appendLabelSighting(channelId, label, extractDmMeta(extraMetadata));
     const key = `${serverId}:${channelId}`;
     this.channels.set(key, {
       serverId,
@@ -1197,19 +1425,6 @@ export class ChannelRegistry {
       },
       open: false,
     });
-    // Only persist a REAL label durably. Falling back to the bare
-    // channelId as a placeholder (no server-supplied label at all — e.g. a
-    // Discord DM push missing both channelName and an author name,
-    // framework.ts's derivePushEventChannel) must never overwrite a real
-    // label already on file from a previous boot: after a restart the live
-    // `channels` map starts empty, so THIS is the very branch a
-    // label-less post-restart event takes — recording the placeholder here
-    // would clobber the good label initializeLabelHistoryStore() just
-    // replayed, defeating the entire point of the durable log. The live
-    // descriptor above still carries the placeholder for in-process
-    // routing; only the durable write is skipped when there's no real
-    // label to record.
-    if (label) this.appendLabelSighting(channelId, label, extractDmMeta(extraMetadata));
     this.emitTraceFn({
       type: 'mcpl:channel-lazy-registered',
       serverId,
@@ -1344,6 +1559,13 @@ export class ChannelRegistry {
     return this.findChannelEntry(channelId)?.descriptor;
   }
 
+  /** The registered label of `channelId` on exactly `serverId` (no
+   *  cross-server first match), or undefined when it has none. */
+  getChannelLabel(serverId: string, channelId: string): string | undefined {
+    const label = this.channels.get(`${serverId}:${channelId}`)?.descriptor.label;
+    return typeof label === 'string' && label.length > 0 ? label : undefined;
+  }
+
   isChannelOpen(channelId: string): boolean {
     return this.findChannelEntry(channelId)?.open === true;
   }
@@ -1373,7 +1595,7 @@ export class ChannelRegistry {
    * Get synthesized tool definitions for channel operations.
    */
   getChannelTools(): ToolDefinition[] {
-    return CHANNEL_TOOL_DEFINITIONS;
+    return this.channelTools;
   }
 
   /**
@@ -1425,7 +1647,7 @@ export class ChannelRegistry {
         });
 
       case 'channel_publish':
-        return this.handleToolPublish(input as { channelId: string; content: string });
+        return this.handleToolPublish(input as { channelId: string; content: string }, origin);
 
       case 'think':
         return this.handleToolThink(input as { content?: string });
@@ -1434,7 +1656,7 @@ export class ChannelRegistry {
         return this.handleToolJournal(input as { content?: string });
 
       case 'skip_reply':
-        return this.handleToolSkipReply(input as { reason?: string; wake_in_seconds?: number });
+        return this.handleToolSkipReply(input as { reason?: string; wake_in_seconds?: unknown });
 
       default:
         return { success: false, error: `Unknown channel tool: ${toolName}`, isError: true };
@@ -1460,9 +1682,15 @@ export class ChannelRegistry {
     // (heartbeats). Without this, a fork
     // was advertised the global locus but published somewhere else; and a trunk
     // agent was told the wrong channel under concurrency.
-    const home = agentName ? this.homeChannelResolver?.(agentName) : undefined;
-    const active = agentName ? this.activeChannelResolver?.(agentName) : undefined;
-    const outgoing = home ?? active ?? this.defaultPublishChannel;
+    // Each lookup is keyed on whether a name was given, not its truthiness:
+    // '' is a name an ephemeral run can have, and resolveLocus reads it too.
+    const home = agentName !== undefined ? this.homeChannelResolver?.(agentName) : undefined;
+    const active = agentName !== undefined ? this.activeChannelResolver?.(agentName) : undefined;
+    // An ephemeral run takes no global fallback (takesGlobalFallback): neither
+    // the latest inbound message's channel as its outgoing one, nor that
+    // message as the one it is replying to.
+    const fallback = agentName !== undefined ? this.globalFallbackFor(agentName) : this.defaultPublishChannel;
+    const outgoing = home ?? active ?? fallback;
 
     if (openChannels.length === 0 && !outgoing) {
       return undefined;
@@ -1473,9 +1701,9 @@ export class ChannelRegistry {
     // Incoming: the most-recent inbound message (what the agent is replying to).
     // Left process-global — per-channel inbound tracking (the right messageId for
     // a fork's own channel) is a separate concern from the outbound routing fix.
-    if (this.defaultPublishChannel && this.defaultPublishMessageId) {
+    if (fallback && this.defaultPublishMessageId) {
       context.incoming = {
-        channelId: this.defaultPublishChannel,
+        channelId: fallback,
         messageId: this.defaultPublishMessageId,
         threadId: this.defaultPublishThreadId,
       };
@@ -1506,6 +1734,10 @@ export class ChannelRegistry {
    * server's channels don't linger and route speech into the void.
    */
   removeServer(serverId: string): void {
+    // Every lifecycle operation queued for this server is cancelled when it
+    // would run (ChannelLifecycleCancelledError), so none acts on a closing
+    // connection or on a later re-registration's entries.
+    this.serverRemovals.set(serverId, (this.serverRemovals.get(serverId) ?? 0) + 1);
     for (const [key, entry] of this.channels) {
       if (entry.serverId !== serverId) continue;
       this.channels.delete(key);
@@ -1549,13 +1781,7 @@ export class ChannelRegistry {
   private initializeLifecycleStore(): void {
     if (!this.store) return;
 
-    try {
-      this.store.registerState({ id: CHANNEL_LIFECYCLE_LOG_ID, strategy: 'append_log' });
-    } catch (error) {
-      if (!(error instanceof Error) || !error.message.includes('State already exists')) {
-        throw error;
-      }
-    }
+    ensureStateRegistered(this.store, { id: CHANNEL_LIFECYCLE_LOG_ID, strategy: 'append_log' });
 
     const raw = this.store.getStateJson(CHANNEL_LIFECYCLE_LOG_ID);
     if (!Array.isArray(raw)) return;
@@ -1598,6 +1824,15 @@ export class ChannelRegistry {
     }
   }
 
+  /**
+   * Each writer appends its record here before it changes memory for it, so
+   * an append that throws, as on a full disk, fails the operation with that
+   * change unmade, and memory and the log still agree. A retry then records
+   * the change rather than finding it in memory already, where
+   * setDesiredState's same-state return would record nothing, and a restart
+   * replays what memory held. appendLabelSighting keeps the same order for
+   * the label history.
+   */
   private appendLifecycleEvent(event: ChannelLifecycleEvent): void {
     this.store?.appendToStateJson(CHANNEL_LIFECYCLE_LOG_ID, event);
   }
@@ -1616,13 +1851,7 @@ export class ChannelRegistry {
   private initializeLabelHistoryStore(): void {
     if (!this.store) return;
 
-    try {
-      this.store.registerState({ id: CHANNEL_LABEL_HISTORY_LOG_ID, strategy: 'append_log' });
-    } catch (error) {
-      if (!(error instanceof Error) || !error.message.includes('State already exists')) {
-        throw error;
-      }
-    }
+    ensureStateRegistered(this.store, { id: CHANNEL_LABEL_HISTORY_LOG_ID, strategy: 'append_log' });
 
     const raw = this.store.getStateJson(CHANNEL_LABEL_HISTORY_LOG_ID);
     if (!Array.isArray(raw)) return;
@@ -1703,6 +1932,16 @@ export class ChannelRegistry {
     const recipientNameUnchanged = recipientName === undefined || recipientName === this.dmRecipientNames.get(channelId);
     const isDmUnchanged = isDm === undefined || this.dmClassified.get(channelId) === true;
     if (labelUnchanged && recipientIdUnchanged && recipientNameUnchanged && isDmUnchanged) return;
+    // The log first, as for lifecycle events: an append that throws leaves
+    // the history in memory as it was, so the next sighting records it.
+    this.store?.appendToStateJson(CHANNEL_LABEL_HISTORY_LOG_ID, {
+      channelId,
+      label,
+      ts: Date.now(),
+      ...(recipientId ? { recipientId } : {}),
+      ...(recipientName ? { recipientName } : {}),
+      ...(isDm ? { isDm } : {}),
+    } satisfies ChannelLabelSightingEvent);
     this.labelHistory.set(channelId, label);
     let seen = this.allLabelsSeen.get(channelId);
     if (!seen) {
@@ -1713,14 +1952,6 @@ export class ChannelRegistry {
     if (recipientId) this.dmRecipientIds.set(channelId, recipientId);
     if (recipientName) this.dmRecipientNames.set(channelId, recipientName);
     if (isDm) this.dmClassified.set(channelId, true);
-    this.store?.appendToStateJson(CHANNEL_LABEL_HISTORY_LOG_ID, {
-      channelId,
-      label,
-      ts: Date.now(),
-      ...(recipientId ? { recipientId } : {}),
-      ...(recipientName ? { recipientName } : {}),
-      ...(isDm ? { isDm } : {}),
-    } satisfies ChannelLabelSightingEvent);
   }
 
   /**
@@ -1945,7 +2176,6 @@ export class ChannelRegistry {
   ): void {
     const key = this.lifecycleKey(serverId, channelId);
     if (this.desiredStates.get(key)?.state === desired) return;
-    this.desiredStates.set(key, { state: desired, source });
     this.appendLifecycleEvent({
       kind: 'desired-state',
       serverId,
@@ -1954,6 +2184,7 @@ export class ChannelRegistry {
       source,
       timestamp: new Date().toISOString(),
     });
+    this.desiredStates.set(key, { state: desired, source });
   }
 
   // ==========================================================================
@@ -1973,12 +2204,6 @@ export class ChannelRegistry {
     source: string,
   ): void {
     const key = this.lifecycleKey(serverId, channelId);
-    this.desiredStates.set(key, {
-      state: 'tuned-out',
-      source,
-      tuneOut: params,
-      wakeCount: 0,
-    });
     this.appendLifecycleEvent({
       kind: 'desired-state',
       serverId,
@@ -1988,6 +2213,12 @@ export class ChannelRegistry {
       source,
       timestamp: new Date().toISOString(),
     });
+    this.desiredStates.set(key, {
+      state: 'tuned-out',
+      source,
+      tuneOut: params,
+      wakeCount: 0,
+    });
   }
 
   /**
@@ -2006,7 +2237,6 @@ export class ChannelRegistry {
     const current = this.desiredStates.get(key);
     if (current?.state !== 'tuned-out' || !current.tuneOut) return null;
     const ended = { params: current.tuneOut, wakeCount: current.wakeCount ?? 0 };
-    this.desiredStates.set(key, { state: nextState, source });
     this.appendLifecycleEvent({
       kind: 'desired-state',
       serverId,
@@ -2015,6 +2245,7 @@ export class ChannelRegistry {
       source,
       timestamp: new Date().toISOString(),
     });
+    this.desiredStates.set(key, { state: nextState, source });
     return ended;
   }
 
@@ -2032,16 +2263,17 @@ export class ChannelRegistry {
     const key = this.lifecycleKey(serverId, channelId);
     const current = this.desiredStates.get(key);
     if (current?.state !== 'tuned-out' || !current.tuneOut) return null;
-    current.wakeCount = (current.wakeCount ?? 0) + 1;
+    const wakeCount = (current.wakeCount ?? 0) + 1;
     this.appendLifecycleEvent({
       kind: 'tune-out-wake',
       serverId,
       channelId,
       epochId: current.tuneOut.epochId,
-      wakeCount: current.wakeCount,
+      wakeCount,
       timestamp: new Date().toISOString(),
     });
-    return { params: current.tuneOut, wakeCount: current.wakeCount };
+    current.wakeCount = wakeCount;
+    return { params: current.tuneOut, wakeCount };
   }
 
   /** Active tune-out params + wake count for a channel, or null. */
@@ -2069,17 +2301,13 @@ export class ChannelRegistry {
    */
   readCoordinatorState(stateId: string): unknown {
     if (!this.store) return null;
-    try {
-      this.store.registerState({ id: stateId, strategy: 'snapshot' });
-    } catch { /* already registered */ }
+    ensureStateRegistered(this.store, { id: stateId, strategy: 'snapshot' });
     return this.store.getStateJson(stateId);
   }
 
   writeCoordinatorState(stateId: string, value: unknown): void {
     if (!this.store) return;
-    try {
-      this.store.registerState({ id: stateId, strategy: 'snapshot' });
-    } catch { /* already registered */ }
+    ensureStateRegistered(this.store, { id: stateId, strategy: 'snapshot' });
     this.store.setStateJson(stateId, value);
   }
 
@@ -2116,13 +2344,13 @@ export class ChannelRegistry {
       this.setDesiredState(serverId, channel.id, desired, 'legacy-recipe-migration');
     }
 
-    this.migratedLegacyPolicies.add(serverId);
     this.appendLifecycleEvent({
       kind: 'legacy-policy-migrated',
       serverId,
       source: Array.isArray(policy) ? 'allow-list' : policy,
       timestamp: new Date().toISOString(),
     });
+    this.migratedLegacyPolicies.add(serverId);
   }
 
   /**
@@ -2181,6 +2409,225 @@ export class ChannelRegistry {
     return channel.initiallyOpen !== true && byPolicy;
   }
 
+  /**
+   * Apply current durable intent, serializing the transport rather than the
+   * server's registration ACK. Re-read after every await: registration,
+   * descriptor updates, or a newer decision may have replaced our snapshot.
+   */
+  private applyDesiredChannelState(
+    serverId: string,
+    channelId: string,
+    options?: { history?: ChannelHistoryRequest },
+  ): Promise<{ open: boolean; result?: ChannelsOpenResult }> {
+    const lifecycleKey = this.lifecycleKey(serverId, channelId);
+    const removals = this.serverRemovals.get(serverId) ?? 0;
+    const previous = this.channelLifecycleTails.get(lifecycleKey) ?? Promise.resolve();
+    this.lifecycleOutstanding.set(lifecycleKey, (this.lifecycleOutstanding.get(lifecycleKey) ?? 0) + 1);
+    const operation = previous.catch(() => {}).then(
+      () => this.runLifecycleOperation(serverId, channelId, removals, options),
+    );
+    // Keep the rejection visible to existing joiners, while observing it
+    // immediately and letting each queued successor start after either result.
+    const tail = operation.then(() => {});
+    this.channelLifecycleTails.set(lifecycleKey, tail);
+    const cleanup = () => {
+      if (this.channelLifecycleTails.get(lifecycleKey) === tail) {
+        this.channelLifecycleTails.delete(lifecycleKey);
+      }
+    };
+    void tail.then(cleanup, cleanup);
+    return operation;
+  }
+
+  /** One queued lifecycle operation, run when its turn in the queue comes. */
+  private async runLifecycleOperation(
+    serverId: string,
+    channelId: string,
+    removals: number,
+    options?: { history?: ChannelHistoryRequest },
+  ): Promise<{ open: boolean; result?: ChannelsOpenResult }> {
+    const channelKey = `${serverId}:${channelId}`;
+    const lifecycleKey = this.lifecycleKey(serverId, channelId);
+    try {
+      let attempts = 0;
+      for (;;) {
+        if ((this.serverRemovals.get(serverId) ?? 0) !== removals) {
+          throw new ChannelLifecycleCancelledError(
+            `Channel ${channelId}: its server's registrations were removed while this operation was queued`,
+          );
+        }
+        const entry = this.channels.get(channelKey);
+        if (!entry) throw new Error(`Channel is no longer registered: ${channelId}`);
+        const server = this.serverRegistry.getServer(serverId);
+        if (!server) throw new Error(`Server not found: ${serverId}`);
+        if (!CapabilityGrant.of(server).has('channels.lifecycle')) {
+          throw new Error(`channels.lifecycle not in "${serverId}"'s effective grant (§14.1)`);
+        }
+        const descriptor = entry.descriptor;
+        const desired = this.getDesiredState(serverId, channelId);
+        const open = desired === 'open' || desired === 'tuned-out';
+        // Per-RPC timeouts do not bound a stream of promptly successful but
+        // continually superseded receipts. Bound this whole operation, then
+        // release its queue slot and surface the failure to delivery joiners.
+        // Its open flag needs no change here: every retry follows a replaced
+        // registration, a retarget (already invalidated, whether the old
+        // target's RPC was answered or failed), or a receipt for this very
+        // target.
+        if (attempts >= MAX_CHANNEL_LIFECYCLE_ATTEMPTS) {
+          const error = new ChannelLifecycleConvergenceError(
+            `Channel ${channelId} did not converge after ${attempts} lifecycle attempts; its target or desired state kept changing`,
+          );
+          this.emitTraceFn({
+            type: 'mcpl:channel-reconcile-failed',
+            serverId, channelId, desired, attempts, error: error.message,
+          });
+          throw error;
+        }
+        attempts++;
+        const sameTarget = () => this.serverRegistry.getServer(serverId) === server &&
+          sameChannelTarget(entry.descriptor, descriptor);
+        let result: ChannelsOpenResult | undefined;
+        try {
+          if (open) {
+            result = await server.sendChannelsOpen({
+              channelId, type: descriptor.type, address: descriptor.address,
+              ...(options?.history ? { history: options.history } : {}),
+            });
+          } else {
+            await server.sendChannelsClose({ channelId });
+          }
+        } catch (error) {
+          // An RPC can fail after the server acted, so a failure for the
+          // current target leaves its outcome unknown: it is marked
+          // unconfirmed with open unchanged, which keeps a confirmed-open
+          // channel usable after a failed backscroll (the mark is read only
+          // while not open). A failure from an older connection or target
+          // also withdraws the open flag.
+          if (this.channels.get(channelKey) === entry) {
+            if (sameTarget()) this.unconfirmedChannelTargets.add(entry);
+            else this.invalidateTransportConfirmation(entry);
+          }
+          // A retarget while this RPC was out queued nothing for the new
+          // target, since handleChanged leaves that to this operation. So a
+          // failure for the old target says nothing about the new one, and a
+          // channel still decided open or tuned out tries its new target,
+          // within the attempt limit.
+          if (this.channels.get(channelKey) === entry && !sameChannelTarget(entry.descriptor, descriptor)) {
+            const now = this.getDesiredState(serverId, channelId);
+            if (now === 'open' || now === 'tuned-out') continue;
+          }
+          throw error;
+        }
+        // A server can answer for a channel other than the one named: one
+        // that falls back to its first channel of the type for an id it no
+        // longer knows opens that channel and returns its history. Whatever
+        // becomes of this receipt, the server did that: say so, and undo the
+        // open it made if the host wants that channel closed.
+        const substitute = open ? substitutedChannel(result, channelId) : undefined;
+        if (substitute !== undefined) {
+          // Each id prints through logValue, as the rejection lines' ids do,
+          // so an odd one can't add a line or a field.
+          const answered = logValue(substitute.kind === 'other' ? substitute.id : substitute.value);
+          console.error(
+            `[channel-open-substituted] server=${serverId} requested=${logValue(channelId)} answered=${answered}`,
+          );
+          this.emitTraceFn({ type: 'mcpl:channel-open-substituted', serverId, channelId, answeredFor: answered });
+          // A malformed id names nothing registered here, so there is
+          // nothing to close.
+          if (substitute.kind === 'other') this.closeSubstitutedChannel(serverId, substitute.id);
+        }
+        // Never apply an old receipt to the current target, even transiently:
+        // a corrective open might fail before that stale bit is replaced.
+        if (this.channels.get(channelKey) !== entry) continue;
+        if (!sameTarget()) {
+          this.invalidateTransportConfirmation(entry);
+          continue;
+        }
+        // A current receipt for another channel confirms nothing about this
+        // one, and its history is another channel's. So the open fails,
+        // nothing in the answer is used, and this channel's open state is
+        // unconfirmed: a server that doesn't resolve this id may not resolve
+        // its sends either.
+        if (substitute !== undefined) {
+          this.invalidateTransportConfirmation(entry);
+          throw new ChannelOpenSubstitutionError(
+            `Server "${serverId}" answered channels/open for ${channelId} with ` +
+            (substitute.kind === 'other' ? 'a different channel' : 'a channel id that is not a string') +
+            `; ${channelId} is not marked open, and nothing in the answer is used`,
+          );
+        }
+        entry.open = open;
+        this.unconfirmedChannelTargets.delete(entry);
+        const now = this.getDesiredState(serverId, channelId);
+        if (open !== (now === 'open' || now === 'tuned-out')) continue;
+        return { open, result };
+      }
+    } finally {
+      // Synchronous with the operation's last look at its target: from here
+      // on, nothing it does will open a new target.
+      const left = (this.lifecycleOutstanding.get(lifecycleKey) ?? 1) - 1;
+      if (left > 0) this.lifecycleOutstanding.set(lifecycleKey, left);
+      else this.lifecycleOutstanding.delete(lifecycleKey);
+    }
+  }
+
+  /**
+   * A server that answered an open with another channel really opened that
+   * one. When it's registered here and the host wants it closed, close it
+   * through its own lifecycle queue: otherwise its traffic would reach the
+   * resident, marked open by its first incoming message. A channel the host
+   * wants open is left alone, and a close can't be answered for another
+   * channel, so this never starts another substitution. An id the host
+   * doesn't know needs nothing: §14.5 refuses its traffic.
+   */
+  private closeSubstitutedChannel(serverId: string, channelId: string): void {
+    if (!this.channels.has(`${serverId}:${channelId}`)) return;
+    if (this.getDesiredState(serverId, channelId) !== 'closed') return;
+    this.applyDesiredChannelState(serverId, channelId).catch((err) => {
+      // Removal while queued is cancellation, as in reconcileChannels, and
+      // exhausted convergence emitted its own diagnostic.
+      if (!this.channels.has(`${serverId}:${channelId}`) ||
+          err instanceof ChannelLifecycleCancelledError ||
+          err instanceof ChannelLifecycleConvergenceError) return;
+      this.emitTraceFn({
+        type: 'mcpl:channel-reconcile-failed',
+        serverId, channelId, desired: 'closed', error: (err as Error).message,
+      });
+    });
+  }
+
+  /**
+   * Join outstanding lifecycle work without recording new intent. Retargeting
+   * may have invalidated open confirmation while the decision remains pending.
+   * A close that settles during the wait remains authoritative; waiting for
+   * it is not an instruction to open the channel again.
+   */
+  private async waitForOpenChannel(entry: ChannelEntry): Promise<ChannelEntry> {
+    const lifecycleKey = this.lifecycleKey(entry.serverId, entry.descriptor.id);
+    for (;;) {
+      const pending = this.channelLifecycleTails.get(lifecycleKey);
+      if (!pending) break;
+      try {
+        await pending;
+      } catch (error) {
+        // A redundant backscroll failure can leave a known-open channel
+        // usable. Exhausted convergence is different: it never established
+        // the current target, so joined delivery must fail visibly.
+        if (error instanceof ChannelLifecycleConvergenceError) throw error;
+      }
+      // A settled tail releases its own key. One still current after it
+      // settled would be awaited again without ever yielding to the event
+      // loop, so stop waiting rather than spin.
+      if (this.channelLifecycleTails.get(lifecycleKey) === pending) break;
+    }
+    const current = this.channels.get(`${entry.serverId}:${entry.descriptor.id}`);
+    if (!current) throw new Error('Channel registration was removed while delivery waited');
+    if (!current.open || this.getDesiredState(current.serverId, current.descriptor.id) === 'closed') {
+      throw new Error('Channel is not confirmed open for delivery, or was selected for closure while delivery waited');
+    }
+    return current;
+  }
+
   private async reconcileChannels(
     serverId: string,
     channels: ChannelDescriptor[],
@@ -2206,54 +2653,18 @@ export class ChannelRegistry {
     // first boot on a new policy doesn't produce one notice per channel.
     const policyOpened: Array<{ channelId: string; label?: string }> = [];
 
+    // Record all admissions before waiting on any channel. A slow first RPC
+    // must not delay intent for the rest of this registration batch.
     for (const channel of channels) {
-      if (this.ensureInitialDesiredState(serverId, channel)) {
-        policyOpened.push({ channelId: channel.id, label: channel.label });
-      }
-      const key = `${serverId}:${channel.id}`;
-      const desired = this.getDesiredState(serverId, channel.id);
-      const entry = this.channels.get(key);
-      // Tuned-out sits on the OPEN side of reconcile: traffic must keep
-      // arriving (the subconscious reads it); only main's wake/visibility
-      // is diverted, downstream at ingestion.
-      if (desired !== 'open' && desired !== 'tuned-out') {
-        try {
-          await server.sendChannelsClose({ channelId: channel.id });
-          if (entry) entry.open = false;
-        } catch (err) {
-          this.emitTraceFn({
-            type: 'mcpl:channel-reconcile-failed',
-            serverId,
-            channelId: channel.id,
-            desired,
-            error: (err as Error).message,
-          });
-        }
-        continue;
-      }
-
-      try {
-        await server.sendChannelsOpen({
-          channelId: channel.id,
-          type: channel.type,
-          address: channel.address,
-        });
-        if (entry) entry.open = true;
-      } catch (err) {
-        if (entry) entry.open = false;
-        this.emitTraceFn({
-          type: 'mcpl:channel-reconcile-failed',
-          serverId,
-          channelId: channel.id,
-          desired,
-          error: (err as Error).message,
-        });
+      const entry = this.channels.get(`${serverId}:${channel.id}`);
+      if (entry && this.ensureInitialDesiredState(serverId, entry.descriptor)) {
+        policyOpened.push({ channelId: channel.id, label: entry.descriptor.label });
       }
     }
 
-    // Announce policy admissions to the agent — nothing may start flowing
-    // traffic into their window without them being told, and told how to
-    // opt out (channel_close; their decision outranks policy).
+    // Announce the durable admission decision before awaiting transport.
+    // This is intent, not confirmation that an open RPC succeeded. It stays
+    // truthful if the first attempt fails, and a retry needs no new admission.
     if (policyOpened.length > 0) {
       try {
         this.onChannelAutoOpened?.({
@@ -2265,6 +2676,30 @@ export class ChannelRegistry {
         console.error('onChannelAutoOpened (policy) failed:', err);
       }
     }
+
+    // Each channel has its own lifecycle queue, so a held RPC for one (up to
+    // its timeout, times its attempts) doesn't delay its siblings.
+    await Promise.allSettled(channels.map(async (channel) => {
+      if (!this.channels.has(`${serverId}:${channel.id}`)) return;
+      try {
+        await this.applyDesiredChannelState(serverId, channel.id);
+      } catch (err) {
+        // Removal while queued is cancellation, not a failed subscription.
+        // Exhausted convergence and a substituted answer already emitted
+        // their own diagnostics.
+        if (!this.channels.has(`${serverId}:${channel.id}`) ||
+            err instanceof ChannelLifecycleCancelledError ||
+            err instanceof ChannelLifecycleConvergenceError ||
+            err instanceof ChannelOpenSubstitutionError) return;
+        this.emitTraceFn({
+          type: 'mcpl:channel-reconcile-failed',
+          serverId,
+          channelId: channel.id,
+          desired: this.getDesiredState(serverId, channel.id),
+          error: (err as Error).message,
+        });
+      }
+    }));
   }
 
   // ==========================================================================
@@ -2386,37 +2821,39 @@ export class ChannelRegistry {
   }
 
   /**
-   * The single open executor: record durable desired-open intent, tell the
-   * server to subscribe, mark the live entry open. Every path that opens a
-   * channel — the agent's channel_open tool, delivery into a closed locus,
-   * an explicit send into a closed channel — funnels here, so lifecycle
-   * events, desired state, and live state can never diverge by path.
+   * Record durable desired-open intent, then queue the channel's lifecycle
+   * work (applyDesiredChannelState), which tells the server to subscribe and
+   * marks the live entry open on a receipt for its current target. Every
+   * open the agent or its speech asks for — the channel_open tool, delivery
+   * into a closed locus, an explicit send into a closed channel — comes
+   * here. Reconciliation queues that work directly, as the closes do
+   * (channel_close, a decline, and the close of a substituted channel).
    * Desired state is recorded BEFORE the server round-trip: intent sticks
    * even if the subscribe fails, and reconciliation retries later.
+   * Automatic delivery needs open transport, not a change of attention:
+   * preserve tune-out epochs both before and during the round-trip.
+   *
+   * `opened` says whether this call turned a closed channel open, which is
+   * what the delivery and reply notices tell the resident. Reconfirming the
+   * transport of a channel already decided open or tuned out isn't one.
    */
   private async openChannelNow(
     entry: ChannelEntry,
-    source: string,
+    source: 'agent-tool' | 'opened-by-reply' | 'opened-by-delivery',
     history?: ChannelHistoryRequest,
-  ): Promise<ChannelsOpenResult> {
-    this.setDesiredState(entry.serverId, entry.descriptor.id, 'open', source);
-    const server = this.serverRegistry.getServer(entry.serverId);
-    if (!server) {
-      throw new Error(`Server not found: ${entry.serverId}`);
+  ): Promise<{ result: ChannelsOpenResult; opened: boolean }> {
+    const transportOnly = source !== 'agent-tool';
+    const before = this.getDesiredState(entry.serverId, entry.descriptor.id);
+    const opened = before !== 'open' && before !== 'tuned-out';
+    if (!transportOnly || before !== 'tuned-out') {
+      this.setDesiredState(entry.serverId, entry.descriptor.id, 'open', source);
     }
-    if (!CapabilityGrant.of(server).has('channels.lifecycle')) {
-      // Desired state is already recorded — intent sticks; reconciliation
-      // will retry if the grant later widens (§6.7 expansion-on-receipt).
-      throw new Error(`channels.lifecycle not in "${entry.serverId}"'s effective grant (§14.1)`);
+    const applied = await this.applyDesiredChannelState(entry.serverId, entry.descriptor.id, { history });
+    const desired = this.getDesiredState(entry.serverId, entry.descriptor.id);
+    if (!applied.open || (desired !== 'open' && !(transportOnly && desired === 'tuned-out'))) {
+      throw new Error('Channel open was superseded by a newer lifecycle decision');
     }
-    const result: ChannelsOpenResult = await server.sendChannelsOpen({
-      channelId: entry.descriptor.id,
-      type: entry.descriptor.type,
-      address: entry.descriptor.address,
-      ...(history ? { history } : {}),
-    });
-    entry.open = true;
-    return result;
+    return { result: applied.result!, opened };
   }
 
   /**
@@ -2627,19 +3064,25 @@ export class ChannelRegistry {
     }
     if (matches.length === 0) return { status: 'unknown-channel' };
     if (matches.length > 1) return { status: 'ambiguous' };
-    const entry = matches[0]!;
-    const resolved = { channelId: entry.descriptor.id, label: entry.descriptor.label };
-    if (entry.open && this.getDesiredState(entry.serverId, entry.descriptor.id) === 'open') {
-      return { status: 'already-open', ...resolved };
-    }
+    let entry = matches[0]!;
     try {
-      await this.openChannelNow(entry, 'opened-by-reply');
-      this.emitTraceFn({
-        type: 'mcpl:channel-opened-by-send',
-        serverId: entry.serverId,
-        channelId: entry.descriptor.id,
-      });
-      return { status: 'opened', ...resolved };
+      if (this.hasPendingLifecycle(entry)) {
+        entry = await this.waitForOpenChannel(entry);
+      }
+      const desired = this.getDesiredState(entry.serverId, entry.descriptor.id);
+      if (entry.open && (desired === 'open' || desired === 'tuned-out')) {
+        return { status: 'already-open', channelId: entry.descriptor.id, label: entry.descriptor.label };
+      }
+      const { opened } = await this.openChannelNow(entry, 'opened-by-reply');
+      entry = await this.waitForOpenChannel(entry);
+      if (opened) {
+        this.emitTraceFn({
+          type: 'mcpl:channel-opened-by-send',
+          serverId: entry.serverId,
+          channelId: entry.descriptor.id,
+        });
+      }
+      return { status: opened ? 'opened' : 'already-open', channelId: entry.descriptor.id, label: entry.descriptor.label };
     } catch (err) {
       this.emitTraceFn({
         type: 'mcpl:channel-open-failed',
@@ -2647,7 +3090,9 @@ export class ChannelRegistry {
         channelId: entry.descriptor.id,
         error: (err as Error).message,
       });
-      return { status: 'open-failed', ...resolved };
+      const current = this.channels.get(`${entry.serverId}:${entry.descriptor.id}`);
+      return { status: 'open-failed', channelId: entry.descriptor.id,
+        ...(current ? { label: current.descriptor.label } : {}) };
     }
   }
 
@@ -2670,11 +3115,13 @@ export class ChannelRegistry {
     // A tuned-out channel is transport-open but attention-diverted; a plain
     // open would silently discard the epoch (and its pending backlog dump).
     // Cancelling is the tune-out coordinator's flow, reached via its own
-    // tool — refuse with the pointer rather than eat the state.
+    // tool — refuse with the pointer rather than eat the state. As an error
+    // result, the agent reads the pointer itself; `data` names the refusal
+    // for an in-process caller.
     if (this.getDesiredState(entry.serverId, input.channelId) === 'tuned-out') {
       return {
         success: false,
-        isError: false,
+        isError: true,
         error:
           `Channel ${input.channelId} is tuned out. Cancel the tune-out ` +
           `(tune_out with mode: 'cancel') to resume normal attention — ` +
@@ -2684,7 +3131,7 @@ export class ChannelRegistry {
     }
 
     const alreadyDesiredOpen = this.getDesiredState(entry.serverId, input.channelId) === 'open';
-    if (entry.open && alreadyDesiredOpen && !input.backscroll) {
+    if (entry.open && alreadyDesiredOpen && !input.backscroll && !this.hasPendingLifecycle(entry)) {
       return {
         success: true,
         data: { channelId: input.channelId, status: 'already open' },
@@ -2698,7 +3145,7 @@ export class ChannelRegistry {
             ...(input.beforeMessageId ? { beforeMessageId: input.beforeMessageId } : {}),
           }
         : undefined;
-      const result = await this.openChannelNow(entry, 'agent-tool', history);
+      const { result } = await this.openChannelNow(entry, 'agent-tool', history);
       return {
         success: true,
         data: {
@@ -2709,9 +3156,18 @@ export class ChannelRegistry {
         },
       };
     } catch (err) {
+      // The decision was recorded before the round-trip and outlives its
+      // failure. Say so: otherwise a later delivery that opens the channel
+      // would be the resident's first sign that it was still wanted open.
+      const current = this.channels.get(`${entry.serverId}:${input.channelId}`);
+      const stillSelected = current !== undefined && !current.open &&
+        this.getDesiredState(entry.serverId, input.channelId) === 'open';
       return {
         success: false,
-        error: `Failed to open channel: ${(err as Error).message}`,
+        error: `Failed to open channel: ${(err as Error).message}` +
+          (stillSelected
+            ? ' (it stays selected for opening: a later delivery or reconnect tries again, and channel_close withdraws that)'
+            : ''),
         isError: true,
       };
     }
@@ -2747,7 +3203,8 @@ export class ChannelRegistry {
     }
 
     const alreadyDesiredClosed = this.getDesiredState(entry.serverId, input.channelId) === 'closed';
-    if (!entry.open && alreadyDesiredClosed) {
+    if (!entry.open && alreadyDesiredClosed && !this.hasPendingLifecycle(entry) &&
+        !this.unconfirmedChannelTargets.has(entry)) {
       return {
         success: true,
         data: { channelId: input.channelId, status: 'already closed' },
@@ -2816,8 +3273,10 @@ export class ChannelRegistry {
           isError: true,
         };
       }
-      await server.sendChannelsClose({ channelId: input.channelId });
-      entry.open = false;
+      const applied = await this.applyDesiredChannelState(entry.serverId, input.channelId);
+      if (applied.open || this.getDesiredState(entry.serverId, input.channelId) !== 'closed') {
+        throw new Error('Channel close was superseded by a newer lifecycle decision');
+      }
       return {
         success: true,
         data: { channelId: input.channelId, status: 'closed' },
@@ -2845,7 +3304,7 @@ export class ChannelRegistry {
     if (entry.open || this.getDesiredState(entry.serverId, input.channelId) === 'open') {
       return {
         success: false,
-        error: `Channel is already open: ${input.channelId}. Use channel_close to leave it.`,
+        error: `Channel is already open: ${input.channelId}. Use channel_close to close it.`,
         isError: true,
       };
     }
@@ -2883,6 +3342,23 @@ export class ChannelRegistry {
       }
     }
 
+    // Where the host directs the lifecycle, a decline goes through the
+    // lifecycle queue like any closed decision, unless a receipt confirmed
+    // the transport closed with nothing pending: an unconfirmed transport may
+    // be open, and pending work must settle on this decision. A failed close
+    // is reported; the decision stands.
+    let closeError: string | undefined;
+    const current = this.channels.get(`${entry.serverId}:${input.channelId}`);
+    if (current && this.directsLifecycle(entry.serverId) &&
+        (this.unconfirmedChannelTargets.has(current) || this.hasPendingLifecycle(current))) {
+      try {
+        const applied = await this.applyDesiredChannelState(entry.serverId, input.channelId);
+        if (applied.open) closeError = 'the close was superseded by a newer lifecycle decision';
+      } catch (error) {
+        closeError = (error as Error).message;
+      }
+    }
+
     this.appendLifecycleEvent({
       kind: 'invitation-declined',
       serverId: entry.serverId,
@@ -2899,6 +3375,7 @@ export class ChannelRegistry {
         acknowledged,
         ...(representation ? { representation } : {}),
         ...(acknowledgmentError ? { acknowledgmentError } : {}),
+        ...(closeError ? { closeError: `Failed to close the channel's transport: ${closeError}` } : {}),
       },
     };
   }
@@ -2907,7 +3384,8 @@ export class ChannelRegistry {
    * Handle the synthesized `think` tool — a private reasoning scratchpad. It
    * sends nothing, and (unlike before) does NOT silence the turn: trailing
    * plain text is still routed as the reply. The thought stays in the agent's
-   * own context/chronicle. To deliberately not reply, the agent uses skip_reply.
+   * own context/chronicle. To deliberately not reply, an agent that may call
+   * skip_reply uses it.
    */
   private handleToolThink(input: { content?: string }): ToolResult {
     return {
@@ -2916,10 +3394,12 @@ export class ChannelRegistry {
       // tool_use block; don't duplicate it in the result.
       data: {
         noted: true,
+        // No tool to end the turn with: this handler can't see whether the
+        // caller may call skip_reply, and think's own description says so
+        // where it may.
         note:
           'Thought recorded (private — not sent anywhere). Same-round text routing depends on ' +
-          'your current same_round_think_text_policy; use agent_settings get to inspect it, or ' +
-          'call skip_reply to end the turn without replying.',
+          'your current same_round_think_text_policy; use agent_settings get to inspect it.',
       },
     };
   }
@@ -2953,14 +3433,15 @@ export class ChannelRegistry {
    * tool, so any trailing prose this turn is NOT posted. Replaces the old
    * overloaded use of `think` for staying silent.
    */
-  private handleToolSkipReply(input: { reason?: string; wake_in_seconds?: number }): ToolResult {
+  private handleToolSkipReply(input: { reason?: string; wake_in_seconds?: unknown }): ToolResult {
     // The self-wake itself is armed by the framework (which owns the
-    // EventGate) BEFORE this dispatch; when the gate is absent the framework
-    // strips the field so this confirmation stays truthful.
-    const wakeSecs = Number(input.wake_in_seconds);
-    const selfWake = Number.isFinite(wakeSecs) && wakeSecs > 0
-      ? Math.max(1, Math.min(3600, Math.floor(wakeSecs)))
-      : undefined;
+    // EventGate) BEFORE its dispatch reaches this handler, from the same
+    // reading, and the framework refuses a wake the host can't set before
+    // dispatching. A caller of this registry's handleChannelToolCall
+    // (AgentFramework.channels) goes past both, so its note names a wake
+    // nothing armed.
+    const wake = readSkipReplyWake(input);
+    const selfWake = wake.kind === 'wake' ? wake.seconds : undefined;
     return {
       success: true,
       // The note says "ended the turn" — make it TRUE. Without endTurn the
@@ -3053,10 +3534,220 @@ export class ChannelRegistry {
 
   resolveLocus(conversationId: string): string | null {
     const home = this.homeChannelResolver?.(conversationId);
-    return home ?? this.activeChannelResolver?.(conversationId) ?? this.defaultPublishChannel ?? null;
+    return home ?? this.activeChannelResolver?.(conversationId) ?? this.globalFallbackFor(conversationId);
   }
 
-  async routeSpeech(
+  /** The process-global fallback channel for this conversation, or null when it takes none (takesGlobalFallback). */
+  private globalFallbackFor(conversationId: string): string | null {
+    return this.takesGlobalFallback?.(conversationId) === false ? null : this.defaultPublishChannel;
+  }
+
+  /**
+   * Resolve a publish target to exactly one registered channel: `serverId`
+   * plus `channelId` when the caller has the server, otherwise a channel id
+   * registered by exactly one server. A shared id is refused, never resolved
+   * to whichever server registered it first.
+   */
+  resolveDestination(
+    target: { serverId?: string; channelId: string },
+  ): { destination: PublishDestination } | { error: string } {
+    const entry = this.findExactEntry(target);
+    if ('error' in entry) return entry;
+    return {
+      destination: {
+        serverId: entry.entry.serverId,
+        channelId: entry.entry.descriptor.id,
+        ...(entry.entry.descriptor.label ? { label: entry.entry.descriptor.label } : {}),
+      },
+    };
+  }
+
+  private findExactEntry(
+    target: { serverId?: string; channelId: string },
+  ): { entry: ChannelEntry } | { error: string } {
+    // A supplied selector is checked, never read as omission: an empty or
+    // non-string serverId would otherwise widen to "any server".
+    if (typeof target.channelId !== 'string' || !target.channelId) {
+      return { error: 'the destination names no channel id' };
+    }
+    if (target.serverId !== undefined && (typeof target.serverId !== 'string' || !target.serverId)) {
+      return { error: 'serverId must name a server (omit it to resolve the channel id alone)' };
+    }
+    const matches = [...this.channels.values()].filter(
+      (e) => e.descriptor.id === target.channelId && (!target.serverId || e.serverId === target.serverId),
+    );
+    if (matches.length === 0) {
+      return {
+        error: target.serverId
+          ? `no registered channel "${target.channelId}" on server "${target.serverId}"`
+          : `no registered channel "${target.channelId}"`,
+      };
+    }
+    if (matches.length > 1) {
+      return {
+        error: `channel id "${target.channelId}" is registered by more than one MCPL server; the destination must name its server`,
+      };
+    }
+    return { entry: matches[0]! };
+  }
+
+  /**
+   * Publish `text` to one registered channel and report what the attempt
+   * established (PublishOutcome). The delivery executor behind plain speech
+   * (deliverSpeech / routeSpeech) and resident resends of held drafts.
+   * channel_publish (and publishForAgent, which shares its handler) resolves
+   * and sends on its own path, and reads its answer through the same
+   * publishReceiptOutcome and publishErrorOutcome.
+   *
+   * Resolution is exact (resolveDestination): `serverId` plus `channelId`
+   * when the caller has the server, otherwise the channel id must be
+   * registered by exactly one server (a shared id is refused, never routed
+   * through whichever server came first). An omitted `serverId` means "not
+   * in use"; a supplied one must be a non-empty server id, and an empty or
+   * non-string selector is refused rather than read as omission. It is not
+   * possible to send into a closed channel: a closed but registered
+   * destination is opened first (`openSource` names why), once its server
+   * and that server's channels.publish grant are known to take the send, so
+   * a refused send opens nothing; and a failed open sends nothing.
+   *
+   * Only the connector's `delivered: true` confirms a post. `failed` means
+   * nothing was posted: the attempt stopped before the request was written,
+   * or the connector answered `delivered: false` and named no message (no
+   * `messageId`, or null). Everything else is `unknown`: once the request
+   * has been handed to the transport, an error response, a timeout, a lost
+   * connection, or a missing, malformed or contradictory receipt (such as
+   * `delivered: false` beside a message id, valid or not) means the post may
+   * or may not exist, and the caller must not treat it as safe to retry
+   * blindly.
+   */
+  async publish(
+    conversationId: string,
+    text: string,
+    target: {
+      serverId?: string;
+      channelId: string;
+      /** Set by speech routing (deliverSpeech): opening a closed channel
+       *  for this publish is logged under `[routeSpeech]`, with speech
+       *  routing's other lines. */
+      routed?: boolean;
+    },
+    openSource: 'opened-by-delivery' | 'opened-by-reply' = 'opened-by-delivery',
+  ): Promise<PublishOutcome> {
+    const at = (): number => Date.now();
+    const found = this.findExactEntry(target);
+    if ('error' in found) return { status: 'failed', reason: found.error, at: at() };
+    let entry = found.entry;
+    const destination: PublishDestination = {
+      serverId: entry.serverId,
+      channelId: entry.descriptor.id,
+      ...(entry.descriptor.label ? { label: entry.descriptor.label } : {}),
+    };
+
+    // A send that would be refused is refused before anything opens: a
+    // closed channel opens only for words that can go out.
+    const server = this.serverRegistry.getServer(entry.serverId);
+    if (!server) {
+      return { status: 'failed', destination, reason: `server "${entry.serverId}" not found`, at: at() };
+    }
+    // §14.1: channels/publish requires channels.publish in the grant. The
+    // host not sending is the enforcement.
+    if (!CapabilityGrant.of(server).has('channels.publish')) {
+      return {
+        status: 'failed',
+        destination,
+        reason: `channels.publish not in "${entry.serverId}"'s effective grant (§14.1)`,
+        at: at(),
+      };
+    }
+
+    // Lifecycle work already queued for the channel settles first: words go
+    // out only into the channel it leaves, and fail visibly if it leaves
+    // none open.
+    if (this.hasPendingLifecycle(entry)) {
+      try {
+        entry = await this.waitForOpenChannel(entry);
+      } catch (err) {
+        return {
+          status: 'failed',
+          destination,
+          reason: `lifecycle work prevented delivery: ${connectorText(err instanceof Error ? err.message : String(err))}`,
+          at: at(),
+        };
+      }
+    }
+
+    // INVARIANT: it is not possible to send into a closed channel. A send
+    // into a closed-but-registered channel (the canonical case: a DM that
+    // woke the agent, since DMs register closed) OPENS it first, so typing
+    // indicators, reaction machinery and inbound forwarding come alive with
+    // the words. If the open fails, nothing goes out: a half-alive delivery
+    // is worse than a loud marker. A channel decided closed is engaged even
+    // while its transport is still open (a close that failed), as a reply
+    // would engage it, wherever an open can succeed. Without the lifecycle
+    // grant it can't, and a send opens before it publishes, so there a
+    // channel whose transport is open keeps publishing.
+    const engagesDecidedClosed = this.getDesiredState(entry.serverId, entry.descriptor.id) === 'closed' &&
+      CapabilityGrant.of(server).has('channels.lifecycle');
+    if (!entry.open || engagesDecidedClosed) {
+      try {
+        const { opened } = await this.openChannelNow(entry, openSource);
+        entry = await this.waitForOpenChannel(entry);
+        if (opened) {
+          if (target.routed) {
+            console.error(
+              `[routeSpeech] ${conversationId}: locus ${logValue(entry.descriptor.id)} was closed — opened by delivery (speech implies engagement)`,
+            );
+          }
+          this.emitTraceFn({
+            type: 'mcpl:channel-opened-by-send',
+            serverId: entry.serverId,
+            channelId: entry.descriptor.id,
+          });
+          if (openSource === 'opened-by-delivery') {
+            try {
+              this.onChannelAutoOpened?.({
+                conversationId,
+                serverId: entry.serverId,
+                source: 'opened-by-delivery',
+                channels: [{ channelId: entry.descriptor.id, label: entry.descriptor.label }],
+              });
+            } catch (err) {
+              console.error('onChannelAutoOpened (delivery) failed:', err);
+            }
+          }
+        }
+      } catch (err) {
+        return {
+          status: 'failed',
+          destination,
+          reason: `channel is closed and open failed: ${connectorText(err instanceof Error ? err.message : String(err))}`,
+          at: at(),
+        };
+      }
+    }
+
+    let result: unknown;
+    try {
+      result = await server.sendChannelsPublish({
+        conversationId,
+        channelId: entry.descriptor.id,
+        content: [{ type: 'text', text }],
+      });
+    } catch (err) {
+      return publishErrorOutcome(err, destination, at());
+    }
+    return publishReceiptOutcome(result, destination, at());
+  }
+
+  /**
+   * Plain speech for one turn segment: publish `text` to the turn's frozen
+   * locus and report the PublishOutcome. A failure (or an uncertain outcome)
+   * is surfaced as a trace and through onRouteFailure, so the agent learns
+   * its words did not (or may not have) reached anyone. An ephemeral run's
+   * speech with no locus is the exception: it is its caller's result, so it
+   * returns as not delivered and surfaces nothing.
+   */
+  async deliverSpeech(
     conversationId: string,
     text: string,
     /** The turn's FROZEN locus, snapshotted once by the caller (resolveLocus
@@ -3065,123 +3756,98 @@ export class ChannelRegistry {
      *  dispatch resolving live can read the NEXT turn's trigger state or a
      *  stale global default and land the reply in the wrong channel (item-3,
      *  PR #32, and the 2026-07-22 Sol DM misroute). Explicit `null` means
-     *  "this turn is pinned to no locus": fail loudly rather than guess. */
+     *  "this turn is pinned to no locus": fail loudly rather than guess,
+     *  except for an ephemeral run, whose speech is then its caller's
+     *  result. */
     locusChannelId: string | null,
-  ): Promise<{ delivered: boolean; channelId: string; messageId?: string } | null> {
-    // Surface a routing failure: emit a trace AND notify the host (which drops
-    // a `[discord-send-failed]` marker into chronicle) so the agent learns her
-    // reply never reached the human, instead of it vanishing silently.
-    const fail = (channelId: string | null, reason: string): null => {
-      console.error(`[routeSpeech] ${conversationId}: ${reason} — speech NOT routed (${text.length} chars stay in chronicle)`);
+    /** `heldOnFailure`: the caller holds a `failed` delivery's words as a
+     *  draft with its own notice, so no failure marker is written for it.
+     *  An `unknown` outcome still gets its marker. */
+    opts?: { heldOnFailure?: boolean },
+  ): Promise<PublishOutcome> {
+    const fail = (channelId: string | null, reason: string, outcome: PublishOutcome): PublishOutcome => {
+      const status = outcome.status === 'unknown' ? 'unknown' : 'failed';
+      const detail = outcome.detail !== undefined ? connectorText(outcome.detail) : undefined;
+      const detailText = detail !== undefined ? `; connector detail: ${detail}` : '';
+      console.error(`[routeSpeech] ${conversationId}: ${reason}${detailText} — speech ${status === 'unknown' ? 'delivery NOT confirmed' : 'NOT routed'} (${text.length} chars stay in chronicle)`);
       this.emitTraceFn({
         type: 'mcpl:speech-route-failed',
         conversationId,
         channelId: channelId ?? '',
         reason,
         textLen: text.length,
+        outcome: status,
+        ...(detail !== undefined ? { detail } : {}),
       });
-      this.onRouteFailure?.({ conversationId, channelId, reason, textLen: text.length });
-      return null;
+      if (status === 'unknown' || !opts?.heldOnFailure) {
+        this.onRouteFailure?.({ conversationId, channelId, reason, textLen: text.length, outcome: status, ...(detail !== undefined ? { detail } : {}) });
+      }
+      return outcome;
     };
 
     // Runtime backstop for JS callers the compiler can't see: an omitted
     // locus is a routing bug at the call site, never something to paper over
     // with a live re-resolution.
     if (locusChannelId === undefined) {
-      return fail(null, 'caller passed no locus (routing bug: every speech path must snapshot the turn locus)');
-    }
-    const channelId = locusChannelId;
-    if (!channelId) {
+      const reason = 'caller passed no locus (routing bug: every speech path must snapshot the turn locus)';
+      return fail(null, reason, { status: 'failed', reason, at: Date.now() });
+    }
+    if (!locusChannelId) {
+      // An ephemeral run with no channel of its own: its plain speech is its
+      // caller's result (takesGlobalFallback). It returns as not delivered,
+      // with its own reason, and writes no line, trace or notice.
+      if (this.takesGlobalFallback?.(conversationId) === false) {
+        return { status: 'failed', reason: "an ephemeral run's plain speech with no channel of its own is its caller's result", at: Date.now() };
+      }
       // The turn froze with no locus (no home, no triggering channel, no
       // global inbound ever seen) — the agent was told its prose stays in
       // the archive; honor that.
-      return fail(null, 'turn has no locus (no home/trigger channel; nothing to deliver into)');
+      const reason = 'turn has no locus (no home/trigger channel; nothing to deliver into)';
+      return fail(null, reason, { status: 'failed', reason, at: Date.now() });
     }
 
-    const entry = this.findChannelEntry(channelId);
-    if (!entry) {
-      return fail(channelId, `no registered channel for locus "${channelId}"`);
+    const outcome = await this.publish(conversationId, text, { channelId: locusChannelId, routed: true });
+    const channelId = outcome.destination?.channelId ?? locusChannelId;
+    if (outcome.status !== 'delivered') {
+      return fail(channelId, outcome.reason ?? 'delivery not confirmed', outcome);
     }
 
-    // INVARIANT: it is not possible to send into a closed channel. Speech
-    // routed into a closed-but-registered locus (the canonical case: a DM
-    // that woke the agent — DMs register closed) OPENS the channel first,
-    // so typing indicators, reaction machinery, and inbound forwarding come
-    // alive with the reply. If the open fails, the speech does NOT go out:
-    // a half-alive delivery is worse than a loud marker.
-    if (!entry.open) {
-      try {
-        await this.openChannelNow(entry, 'opened-by-delivery');
-        console.error(
-          `[routeSpeech] ${conversationId}: locus ${logValue(channelId)} was closed — opened by delivery (speech implies engagement)`,
-        );
-        this.emitTraceFn({
-          type: 'mcpl:channel-opened-by-send',
-          serverId: entry.serverId,
-          channelId,
-        });
-        try {
-          this.onChannelAutoOpened?.({
-            conversationId,
-            serverId: entry.serverId,
-            source: 'opened-by-delivery',
-            channels: [{ channelId, label: entry.descriptor.label }],
-          });
-        } catch (err) {
-          console.error('onChannelAutoOpened (delivery) failed:', err);
-        }
-      } catch (err) {
-        return fail(channelId, `locus channel is closed and open failed: ${(err as Error).message}`);
-      }
-    }
-
-    const server = this.serverRegistry.getServer(entry.serverId);
-    if (!server) {
-      return fail(channelId, `server "${entry.serverId}" not found`);
-    }
-    // §14.1: channels/publish requires channels.publish in the grant. The
-    // host not sending is the enforcement — a send to an ungranted server
-    // would have it act on authority it was never told it has.
-    if (!CapabilityGrant.of(server).has('channels.publish')) {
-      return fail(channelId, `channels.publish not in "${entry.serverId}"'s effective grant (§14.1)`);
-    }
-
-    const publishParams: ChannelsPublishParams = {
-      conversationId,
-      channelId,
-      content: [{ type: 'text', text }],
-    };
-    const result = await server.sendChannelsPublish(publishParams);
-    const delivered = (result as { delivered?: boolean } | undefined)?.delivered ?? true;
-    // Surface the posted message's id (ChannelsPublishResult.messageId) so
-    // trace consumers can act on the just-posted message — e.g. a TTS-relay
-    // tap editing it down to the words actually voiced on interruption.
-    // Previously this was silently dropped here.
-    const messageId = (result as { messageId?: string } | undefined)?.messageId;
-
-    // The server accepted the publish RPC but reported the message was not
-    // actually delivered (e.g. missing Send Messages permission). Previously
-    // this returned `{ delivered: true }`, masking the failure. Surface it.
-    if (delivered === false) {
-      return fail(channelId, `server "${entry.serverId}" reported delivered:false for "${channelId}"`);
-    }
-
-    console.error(`[routeSpeech] ${conversationId}: routed ${text.length} chars -> ${logValue(channelId)} (server=${entry.serverId}, delivered=${delivered})`);
+    console.error(`[routeSpeech] ${conversationId}: routed ${text.length} chars -> ${logValue(channelId)} (server=${outcome.destination!.serverId}, delivered=true)`);
     this.emitTraceFn({
       type: 'mcpl:speech-routed',
       conversationId,
-      serverId: entry.serverId,
+      serverId: outcome.destination!.serverId,
       channelId,
-      delivered,
+      delivered: true,
       textLen: text.length,
       text,
-      ...(messageId !== undefined ? { messageId } : {}),
+      // Surface the posted message's id (ChannelsPublishResult.messageId) so
+      // trace consumers can act on the just-posted message — e.g. a TTS-relay
+      // tap editing it down to the words actually voiced on interruption.
+      ...(outcome.messageId !== undefined ? { messageId: outcome.messageId } : {}),
     });
+    return outcome;
+  }
 
-    return { delivered, channelId, ...(messageId !== undefined ? { messageId } : {}) };
+  /** deliverSpeech, reduced to the confirmed delivery (null when there was none). */
+  async routeSpeech(
+    conversationId: string,
+    text: string,
+    locusChannelId: string | null,
+  ): Promise<{ delivered: boolean; channelId: string; messageId?: string } | null> {
+    const outcome = await this.deliverSpeech(conversationId, text, locusChannelId);
+    if (outcome.status !== 'delivered') return null;
+    return {
+      delivered: true,
+      channelId: outcome.destination!.channelId,
+      ...(outcome.messageId !== undefined ? { messageId: outcome.messageId } : {}),
+    };
   }
 
-  private async handleToolPublish(input: { channelId?: string; content?: string; text?: string }): Promise<ToolResult> {
+  private async handleToolPublish(
+    input: { channelId?: string; content?: string; text?: string },
+    origin?: ChannelToolOrigin,
+  ): Promise<ToolResult> {
     // Resolve content: accept both `content` and `text` (backward compat)
     const messageText = input.content ?? input.text;
     if (!messageText) {
@@ -3192,12 +3858,17 @@ export class ChannelRegistry {
       };
     }
 
-    // Resolve channelId: default to most recent incoming channel
-    const channelId = input.channelId ?? this.defaultPublishChannel;
+    // Resolve channelId: default to the most recent incoming channel, which an
+    // ephemeral run never takes (takesGlobalFallback), so it names one.
+    const caller = origin?.kind === 'agent' ? origin.agentName : undefined;
+    const channelId = input.channelId ?? (caller !== undefined ? this.globalFallbackFor(caller) : this.defaultPublishChannel);
     if (!channelId) {
       return {
         success: false,
-        error: 'No channelId specified and no default channel available',
+        error: caller !== undefined && this.takesGlobalFallback?.(caller) === false
+          ? 'Nothing was published: name the channel with channelId. A subagent has no default channel, since its plain '
+            + 'speech is returned to whoever called it, so channel_publish sends only to a channel it names.'
+          : 'No channelId specified and no default channel available',
         isError: true,
       };
     }
@@ -3220,31 +3891,44 @@ export class ChannelRegistry {
       };
     }
 
-    try {
-      if (!CapabilityGrant.of(server).has('channels.publish')) {
-        return {
-          success: false,
-          error: `channels.publish not in "${server.id}"'s effective grant (§14.1)`,
-          isError: true,
-        };
-      }
-      const publishParams: ChannelsPublishParams = {
-        conversationId: '', // Framework will fill this when wired
-        channelId,
-        content: [{ type: 'text', text: messageText }],
-      };
-
-      const result = await server.sendChannelsPublish(publishParams);
-      return {
-        success: true,
-        data: result ?? { delivered: true },
-      };
-    } catch (err) {
+    if (!CapabilityGrant.of(server).has('channels.publish')) {
       return {
         success: false,
-        error: `Failed to publish to channel: ${(err as Error).message}`,
+        error: `channels.publish not in "${server.id}"'s effective grant (§14.1)`,
         isError: true,
       };
     }
+    const publishParams: ChannelsPublishParams = {
+      conversationId: '', // Framework will fill this when wired
+      channelId,
+      content: [{ type: 'text', text: messageText }],
+    };
+    const destination: PublishDestination = {
+      serverId: entry.serverId,
+      channelId: entry.descriptor.id,
+      ...(entry.descriptor.label ? { label: entry.descriptor.label } : {}),
+    };
+
+    // The answer counts by the same rule as plain speech's: only the
+    // connector's delivered:true confirms a post.
+    let result: unknown;
+    let outcome: PublishOutcome;
+    try {
+      result = await server.sendChannelsPublish(publishParams);
+      outcome = publishReceiptOutcome(result, destination, Date.now());
+    } catch (err) {
+      outcome = publishErrorOutcome(err, destination, Date.now());
+    }
+    if (outcome.status === 'delivered') return { success: true, data: result };
+    // The connector's data may say what a multi-part send already posted.
+    const detail = outcome.status === 'unknown' && outcome.detail !== undefined ? ` Connector detail: ${connectorText(outcome.detail)}` : '';
+    return {
+      success: false,
+      error: (outcome.status === 'failed'
+        ? `Publish to ${channelId} failed: ${outcome.reason}. Nothing was posted.`
+        : `Publish to ${channelId} wasn't confirmed: ${outcome.reason}. ` +
+          'It may or may not have been posted, so sending it again could post it twice.') + detail,
+      isError: true,
+    };
   }
 }