@animalabs/agent-framework 0.23.2 → 0.24.0

package/dist/src/framework.d.ts

@@ -9,7 +9,8 @@ import { type ToolClass, type ToolClassSource } from './mcpl/tool-classes.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
 import type { SessionUsageSnapshot } from './usage/types.js';
-import { type SurgeryMarkerReceipt, type OperatorLogEntry, type OperatorLogInput, type OperatorRequester } from './operator-log.js';
+import { type DiscordAwarenessView, type DiscordAwarenessCancelReceipt, type DiscordAwarenessMarks, type DiscordAwarenessRetractReceipt } from './recovery/discord-awareness-outbox.js';
+import { type SurgeryMarkerReceipt, type SurgeryMarksPreview, type OperatorLogEntry, type OperatorLogInput, type OperatorRequester } from './operator-log.js';
 /**
  * Feasibility verdict for a runtime-settings patch, derived through the SAME
  * settings→config mapping the live apply path uses (`Agent.planRuntimeSettings`
@@ -76,9 +77,10 @@ export interface HostModeStatus {
      * scheduler's next pass consumes them). Continuations of a held turn
      * (budget restart, tool results) are never counted. */
     gatedRequests: number;
-    /** Background code-execution scripts still running. Quiesce does NOT stop
-     * them — they hold no turn token, so drain doesn't wait for them. Reported
-     * so the operator sees what is still acting during the window. */
+    /** code_execution scripts still running that no call is waiting on: left
+     * running after a yield, outside any turn. Quiesce does NOT stop them —
+     * they hold no turn token, so drain doesn't wait for them. Reported so the
+     * operator sees what is still acting during the window. */
     backgroundScripts: number;
     /** Context writes (module events, api message.send) withheld because the
      * host is quiesced. Persisted while quiesced and flushed by resume(). */
@@ -177,8 +179,8 @@ interface InferenceToolSnapshot {
  *   adapter files every status it doesn't list (404, 405, 409, 410, 413,
  *   415, 422 …) as invalid_request, so it alone produces an invalid_request
  *   at 413 or 422, and no 0.5.86 adapter produces a context_length at 413.
- * - From membrane 0.5.87 (membrane #56 and #107), this package's floor, every
- *   adapter sends an HTTP failure through one status table
+ * - From membrane 0.5.87 (membrane #56 and #107), below this package's
+ *   floor, every adapter sends an HTTP failure through one status table
  *   (errorFromProviderStatus). On a 400 or 422, auth codes and reasons and
  *   the two account refusals it recognizes by their text (a balance too low,
  *   usage limits reached) are auth, and a context overflow, by its code or
@@ -301,10 +303,13 @@ export declare class AgentFramework {
      *  framework, and tests set it by cast. */
     private inboundAcceptanceObserver?;
     private streamBoundaryEnds;
-    /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
-     *  not a reaction or a system marker) into the live stream. Tells
-     *  driveStream to clear sticky explicit-send suppression before handling
-     *  the next model round. Never affects routing: the turn locus is frozen. */
+    /** A tool boundary injected fresh CONVERSATIONAL input (a real message,
+     *  or an edit the coalescer marks as the agent's first view; not a system
+     *  marker or a reaction, reaction removal, edit or deletion marker) into
+     *  the live stream. Tells driveStream to clear sticky explicit-send
+     *  suppression before handling the next model round. The signal itself
+     *  never moves routing: the boundary re-pins the turn's locus by its own
+     *  rule (repinChannel). */
     private midTurnInputSignals;
     /** Last outbound locus announced to each agent as a durable `[routing]`
      *  window message. Announce-on-change only: steady state emits nothing
@@ -319,13 +324,13 @@ export declare class AgentFramework {
     /**
      * Each agent's routing state for its current logical turn (TurnRouting):
      * its trigger channel, locus and engaged channels, the sticky destination,
-     * the turn's destination, hybrid's hold, a ` !` continuation and receipt
-     * tallies. The start that opens a turn makes a
-     * new object instead of clearing the old one, and every later stream of
-     * the turn shares it (openLogical). A queued delivery holds the object of
-     * the turn that queued it, so prose a turn leaves queued when it ends (a
-     * skip_reply ends it before its posts have run) still follows that turn's
-     * destination, and its late writes can't reach the next turn.
+     * hybrid's hold, a ` !` continuation and receipt tallies. The start that
+     * opens a turn makes a new object instead of clearing the old one, and
+     * every later stream of the turn shares it (openLogical). A queued delivery
+     * holds the object of the turn that queued it, so prose a turn leaves
+     * queued when it ends (a skip_reply ends it before its posts have run)
+     * still follows that turn's routing, and its late writes can't reach the
+     * next turn.
      */
     private turnRouting;
     /**
@@ -334,6 +339,15 @@ export declare class AgentFramework {
      * posts go out in the order they were written, across streams and turns.
      */
     private proseSpeechChains;
+    /**
+     * Each stream whose `channels/outgoing/complete` hasn't gone yet, from
+     * its start: an ended one's waits for the deliveries it queued
+     * (driveStream's finally), and one the framework no longer tracks, such
+     * as a disposed ephemeral's, may still be running. stop() sends them at
+     * once, before it clears the channel registry and closes the MCPL
+     * connections.
+     */
+    private pendingOutgoingCompletes;
     /**
      * Each agent's open logical turn: its routing state and receipt tallies
      * (TurnRouting). It stays open from the start that opens it until the
@@ -379,6 +393,11 @@ export declare class AgentFramework {
     private usedEphemeralAgentNames;
     /** One-shot generation tickets minted by createEphemeralAgent. */
     private ephemeralCandidates;
+    /** Every agent createEphemeralAgent made, for as long as the object lives:
+     *  its usage counts in the usage record's one shared ephemeral entry. Kept
+     *  by the object, not the run's record (ephemeralRuns), which its cleanup
+     *  drops before a cancelled stream may count its last usage. */
+    private ephemeralAgents;
     /** Warn only once per Agent instance after utilities are registered. */
     private emptyUtilityPermissionWarnings;
     /** Physical ephemeral frames deliberately disposed by their run watchdog/caller.
@@ -487,6 +506,16 @@ export declare class AgentFramework {
     private deferredScanFrom;
     private deferredMessages;
     private activeTurnTokens;
+    /** Each turn whose settle has ended it (settleAgent, endDroppedTurn), for
+     *  its agent's scripts: its start's teardown can still hold the agent's
+     *  token, and a turn that has ended isn't live (liveTurns). A later start
+     *  that runs on the same routing, as a resume can, takes it out again
+     *  (beginAgentTurn). */
+    private settledTurns;
+    /** Agents whose fresh turn's coalescing assembly is running
+     *  (beginAgentTurn): the window in which addMessage honours a write's
+     *  bypassDeferralFor naming that agent. */
+    private readonly assembling;
     /**
      * The InferenceRequest that started each agent's turn in progress — set and
      * cleared exactly where the turn token is. Read-only outside: the host
@@ -569,7 +598,10 @@ export declare class AgentFramework {
      */
     private readonly sharedSlotAgents;
     /** The windows of forks and runs deregistered while the host was quiesced,
-     *  by agent name; resume() releases them (releaseWindowNowOrAfterResume). */
+     *  by agent name (releaseWindowNowOrAfterResume); resume() releases them
+     *  (runReleasesAfterResume), or stop() passes on what they left, unread or
+     *  queued, and clears them. While a name is here, no other flush drains
+     *  its queue (drainDeferredFor). */
     private readonly releasesAfterResume;
     /** The coalescing commit in flight, if any (see commitCoalescingDurable). */
     private coalescingCommit;
@@ -594,25 +626,20 @@ export declare class AgentFramework {
     /** Forks whose TTL closure turn has been queued — disposed (removed from
      * agents/agentConfigs/conversationAgentHomes) when their stream ends. */
     private closingConversationAgents;
-    private codeExecutionConfig;
-    private codeExecutionRunners;
+    private codeExecution;
     private scriptToolWaiters;
-    /** Per agent, the foreground script now running. An endTurn-carrying inner
-     *  result marks the script that made the call, and is applied to that
-     *  script's code_execution result instead of cancelling the stream
-     *  mid-script (which would wedge the turn). A stopped script's late result
-     *  marks only that script, never the agent's next one. Its `turnId` is the
-     *  turn of the code_execution call running it, which its calls carry. */
-    private scriptDeferredEndTurn;
-    /** RFC-007: per agent, the origin of the foreground script its runner is
-     *  executing, handed to that script's inner calls (scripts run one at a
-     *  time per runner). Background runners capture theirs in the closure. */
-    private foregroundScriptOrigins;
-    /** Background (daemon) scripts: model-authored watchers that outlive their
-     *  spawning turn. Each gets a DEDICATED PyRunner; wake_agent() injects a
-     *  provenance envelope + payload and requests inference. Keyed by script id. */
-    private backgroundScripts;
-    private backgroundScriptCounter;
+    /** Per agent, a round that called code_execution and waits for those calls'
+     *  results before its prose is routed (ScriptRound). */
+    private scriptRounds;
+    /** Each code_execution result, by the round that dispatched its call: it
+     *  settles only that round, even if a newer round reuses its call id. */
+    private scriptRoundOfResult;
+    /** Each code_execution call of a round that waits, by its watch, whether
+     *  the round waits on that call or not, a stop's included, though no call
+     *  a script makes once its stop is asked reaches a tool, since the runner
+     *  refuses it: its script's calls that reach the host while that call
+     *  watches it, which the round counts (ScriptRound.scripts). */
+    private scriptRoundCalls;
     /** Resident-set per-agent tool-result inline cap (chars), via
      *  agent_settings `tool_result_inline_max_chars`. DURABLE: persisted in
      *  framework state like the core runtime settings and restored at create
@@ -662,7 +689,7 @@ export declare class AgentFramework {
     /** Modern-MCP (2026-07-28) servers, by id; read through modernServers().
      *  They are kept apart from the MCPL registry on purpose: they have no
      *  grant, planes or server→host traffic, so the MCPL machinery (quiesce's
-     *  plane pauses, awareness gates, policy) never sees them. They take part
+     *  plane pauses, policy) never sees them. They take part
      *  only through the tool paths, and their list changes reach agents
      *  through ordinary admission. */
     private modernMcpConnections;
@@ -687,8 +714,9 @@ export declare class AgentFramework {
      *  subsystem can be lazily initialized by connectMcplServer when the
      *  framework started with zero configured servers. */
     private mcplInferenceRoutingConfig;
-    /** Durable, non-Chronicle projection queue for messages removed by a branch. */
-    private discordAwarenessOutbox;
+    /** The awareness ledger; null for a framework with neither storePath nor
+     *  discordAwarenessOutboxPath, which refuses a marks choice. */
+    private readonly discordAwarenessOutbox;
     private discordAwarenessEmoji;
     private discordAwarenessDeadlineMs;
     /** Durable JSONL record of operator-initiated mutations (see operator-log.ts). */
@@ -703,9 +731,10 @@ export declare class AgentFramework {
     private surgeryHold;
     /** Serialize per-server drains so reconnect and an online undo cannot race. */
     private discordAwarenessDrains;
-    /** Framework-global inference gate; older generations cannot release it. */
-    private discordAwarenessBarrier;
-    private discordAwarenessBarrierGeneration;
+    /** The servers whose running pass a later trigger joined
+     *  (drainDiscordAwarenessOutbox): before it leaves, that pass tries once
+     *  more what it had already tried. */
+    private discordAwarenessDrainsJoined;
     private eventGate;
     private usageTracker;
     /** Explicit-send or private suppression carried into a tool-result-guard retry. */
@@ -719,9 +748,9 @@ export declare class AgentFramework {
      * try again in the same process: the framework it had begun is stopped, as
      * stop() stops one, but giving up after 30 s on each of stop()'s cleanup
      * waits, for an operator's operations already running, then for its
-     * modules and MCPL servers, and then for awareness drains a failed startup
-     * barrier left running, and a store it opened is closed. A store the
-     * caller passed in is left open.
+     * modules and MCPL servers, and then for awareness drains still running,
+     * such as its startup's delivery, and a store it opened is closed. A store
+     * the caller passed in is left open.
      */
     static create(config: FrameworkConfig): Promise<AgentFramework>;
     /**
@@ -814,6 +843,14 @@ export declare class AgentFramework {
      *   iteration.
      * - a later stop() waits again, within its own budget, for any stream or
      *   loop this one left running, so the store never closes under it.
+     *
+     * Each conversation fork still live ends, as a closing fork's end does,
+     * whatever its stream is doing, as each run does: its channel unbinds, and
+     * its window's release passes on to the primary the notices it left that
+     * the primary takes in its place, unread in its window, or still queued
+     * for it unless it read the copy that landed there. Its end settles a
+     * tool-result batch its stream still held and removes the stream's
+     * entries, and once it has left, its stream's late events are dropped.
      */
     stop(teardownTimeoutMs?: number | undefined): Promise<void>;
     /** What start() and addModule() pass before either begins work of a
@@ -872,6 +909,10 @@ export declare class AgentFramework {
     private acquirePrimaryProviderGate;
     private releasePrimaryProviderGate;
     private flushAuxiliaryAdmission;
+    /** A provider hold's released requests start no turn (the scheduler drops
+     *  them): the primary turn the release left pending won't run, so the
+     *  recovery ends and auxiliary admission reopens. */
+    private endPendingPrimary;
     private waitForAuxiliaryIdle;
     private withAuxiliaryAdmission;
     /**
@@ -913,6 +954,12 @@ export declare class AgentFramework {
      *  and the cap applies only to AF's own default. A negative stated wait is
      *  a stated 0, as in ProviderWaits: the 1 s floor, plus jitter. */
     private accelerationCooldownMs;
+    /** Whether two requests are one wake, for a provider hold's dedup: the
+     *  same agent, reason, source, time and channel, and the same coalescing
+     *  marks: a batch wake's subject, a batch-only merge's subjects (it has no
+     *  single subject), and the write a wake reads. A wake with any of them
+     *  can be withdrawn or dropped on its own, and must not stand for one
+     *  without. (coalescingBatch is set only beside one of the first two.) */
     private sameInferenceRequest;
     private consultProviderHold;
     /** A host hold whose slice expired: ask the host again before spending an
@@ -977,9 +1024,8 @@ export declare class AgentFramework {
     /**
      * Refuse an auxiliary call to a model the provider asked this agent to wait
      * on, without calling it. The refusal is a retryable rate limit carrying
-     * the remaining wait, so a caller that paces (context-manager's compression
-     * lane, from its corrective round #138 on) waits it out instead of spending
-     * a call. It is marked
+     * the remaining wait, so a caller that paces waits it out instead of
+     * spending a call. It is marked
      * `providerAdmission: 'deferred'`: no call was made, so a caller can keep
      * the wait without counting a failed call (room-225 #47927).
      */
@@ -1165,7 +1211,7 @@ export declare class AgentFramework {
     /** The registered workspace module, if any (used by save_image). */
     private getWorkspaceModule;
     /** RFC-005 host-mediated reference fetcher (lazy; needs server configs +
-     *  a writable workspace mount for storage). */
+     *  a read-write workspace mount without an include for storage). */
     private referenceFetcherInstance?;
     private getReferenceFetcher;
     /** Register every RFC-005 reference in an MCPL peer's tool-result content
@@ -1354,14 +1400,16 @@ export declare class AgentFramework {
      * acknowledged once: the chronicle is synced, then the persisted queue is
      * rewritten without the batch (ackDeferredWrites). Until then the batch
      * stays in the durable queue, so a crash mid-flush replays it at the next
-     * boot, which skips each entry that already landed, by its deferredWriteId
-     * — no loss, no duplicates. The batch is stored in queue order, whatever
-     * its targets (writeDrainedInOrder). A write the store rejects stays
-     * queued, logged, with what is queued behind it for its target, so the
-     * flush never stores that target's later entries ahead of it, and other
-     * targets' entries go on. (A write that isn't deferred can still land
-     * ahead of it, such as one for an idle agent once the host has resumed.)
-     * A boot that meets it again logs it and goes on.
+     * boot, which skips each entry that already landed, by its deferredWriteId —
+     * no loss, no duplicates. The batch is stored in queue order, whatever its
+     * targets (writeDrainedInOrder). A write the store rejects stays queued,
+     * logged, with what is queued behind it for its target, so the flush never
+     * stores that target's later entries ahead of it, and other targets' entries
+     * go on. One the store refuses as malformed, which it would at every flush,
+     * is logged and dropped instead, and what is behind it goes on. (A write
+     * that isn't deferred can still land ahead of it, such as one for an idle
+     * agent once the host has resumed.) A boot that meets it again logs it and
+     * goes on.
      *
      * Per-target: an agent whose turn is still alive keeps ITS messages
      * deferred for its own turn boundary; everyone else's flush now.
@@ -1434,8 +1482,8 @@ export declare class AgentFramework {
      * memory-only: they land within the turn, at a tool boundary or at its
      * end, and a crash before then loses them. That window runs to the turn's
      * end for a message held there and what is queued behind it, and, on a
-     * stream that can't carry injected messages, for every message deferred
-     * during the turn.
+     * stream that declares it can't carry injected messages (membrane's XML
+     * prefill path, from 0.6.0), for every message deferred during the turn.
      *
      * A write that fails, or a queue over the cap, which writes nothing,
      * leaves the record as it last held it, except that store only, a write
@@ -1662,7 +1710,17 @@ export declare class AgentFramework {
      *
      *  This is create()'s first read of framework/state, so it also refuses a
      *  framework/state that isn't an object: every reader of that state would
-     *  take it as holding nothing, and its first write would replace it. */
+     *  take it as holding nothing, and its first write would replace it.
+     *
+     *  A stored entry restores into the shared ephemeral entry, rather than
+     *  under its own name, when it is marked as the shared entry, when it was an
+     *  ephemeral agent's from before they shared one entry, its name having an
+     *  ephemeral agent's namespace in the store (subagent/<name>, as
+     *  createEphemeralAgent opens it), or when it is the shared entry an earlier
+     *  framework wrote back without its mark. A name a persistent agent has keeps
+     *  an unmarked entry either way: one in `configured`, or one with a
+     *  resident's or a conversation agent's namespace (agents/<name>,
+     *  conversations/<name>). */
     private restoreUsageState;
     private persistUsageState;
     /** An agent's persisted record, or null when it has none. Throws the
@@ -1858,9 +1916,12 @@ export declare class AgentFramework {
     /**
      * Mark an inference refusal visibly: react on the message that holds the
      * refused agent's conversational locus (the most recent incoming channel
-     * message; an ephemeral run has none, so a subagent's refusal marks no
-     * message) with a category-specific emoji. Best-effort — failures are
-     * logged, never thrown, and non-Discord loci are silently skipped.
+     * message that isn't a reaction, reaction removal, edit or deletion
+     * marker, apart from an edit the coalescer delivers on acceptance as the
+     * agent's first view; an ephemeral run has none, so a subagent's refusal
+     * marks no message) with a category-specific emoji. Best-effort —
+     * failures are logged, never thrown, and non-Discord loci are silently
+     * skipped.
      */
     private reactToRefusal;
     /**
@@ -1949,7 +2010,7 @@ export declare class AgentFramework {
      *   advancing merges during a quiesce window.
      *
      *   host-status — report the quiesce state (drained / parked wakes /
-     *   running background scripts).
+     *   scripts left running).
      *
      *   release-provider-wait — end an agent's provider wait (a provider's
      *   stated retry-after, kept across restarts) for one `model` or all, as an
@@ -1989,14 +2050,14 @@ export declare class AgentFramework {
      */
     tailProcessLogs(count?: number, eventType?: string): ProcessLogEntryWithId[];
     /**
-     * Switch the store to an existing branch, start the delivery of the
-     * Discord awareness marks the move changes (startDiscordAwarenessDelivery),
-     * and re-materialize the config mount from it. Resolves once the mount has
-     * run; if it fails, it rejects with the store already moved. The marks'
-     * delivery isn't awaited, and its failure doesn't fail the switch. The
-     * store has moved by the time the call returns, before its promise
-     * settles, and a refusal moves nothing. An operator's operation: refused
-     * once stop() has begun, and waited for by stop() while it runs.
+     * Switch the store to an existing branch and re-materialize the config
+     * mount from it. A switch adds or removes no Discord awareness marks: they
+     * are one-shot, a surgery's or an operator's explicit choice. Resolves once
+     * the mount has run; if it fails, it rejects with the store already moved.
+     * It moves the store once any maintenance already running has finished, so
+     * the move can come after the call returns, and a refusal moves nothing.
+     * An operator's operation: refused once stop() has begun, and waited for
+     * by stop() while it runs.
      *
      * The branch moves under every agent sharing the store, so the switch
      * reserves the store as a surgery does: every agent must be idle, or it is
@@ -2072,6 +2133,29 @@ export declare class AgentFramework {
      * does. Always release in `finally`: a token nobody clears wedges the fleet.
      */
     private reserveStoreForSurgery;
+    /**
+     * A surgery's marker batch, recorded before its body change. If it can't
+     * be recorded, the surgery doesn't start, and the error says what the
+     * ledger may hold (DiscordAwarenessOutbox.prepare). Without a ledger there
+     * is none: a marks choice was refused before this (refuseMarksWithoutLedger),
+     * and a suppression runs with no record to resume it from.
+     */
+    private prepareMarkerBatch;
+    /**
+     * A marks choice needs a ledger to keep it: a framework that has none
+     * refuses one before anything is planned or changed.
+     */
+    private refuseMarksWithoutLedger;
+    /**
+     * After a failed surgery has put the source back: retire its prepared
+     * awareness batch, but only when the store is confirmed on the source. If
+     * it isn't, the batch stays prepared as the evidence of an unfinished body
+     * (a start on its target finishes a suppression's removals). Either way
+     * none of its marks is ever sent: a start retires what this can't.
+     * Never throws: the caller is already reporting the surgery's failure;
+     * returns a clause to append to it.
+     */
+    private retireAfterRestore;
     /**
      * After a failed switch or redaction: put the store back on `sourceBranch`
      * if it moved, and return a sentence saying what actually happened. Never
@@ -2082,14 +2166,17 @@ export declare class AgentFramework {
      * Roll the active branch back so `messageId` becomes its tail: fork the
      * chronicle at that message (origin-sequence time-travel branch) and switch
      * to the fork. Everything after the message stays on the source branch.
-     * Discord messages that left the live context get awareness markers via the
-     * durable outbox, exactly as message-granular `undo` does.
+     *
+     * The rollback is local to the resident. Marking removed Discord messages
+     * with an awareness reaction is a separate, explicit publication choice
+     * (`marks`, default `none`); `previewSurgeryMarks` shows what each scope
+     * would cover, and passing its `refs` binds the choice to exactly that set.
      *
      * Returns once the switch has landed: the body is applied, with a
      * marker-scheduling receipt (`markers`). It does not wait for Discord to
-     * accept the reactions: delivery is started, behind the MCPL data-plane
-     * gate, and continues without the caller or the store reservation waiting
-     * on it; its per-message outcomes stay in the outbox ledger.
+     * accept the reactions: delivery is started and continues without the
+     * caller, the store reservation or MCPL traffic waiting on it; what
+     * Discord answers is kept in the awareness ledger.
      *
      * Throws `OperatorActionError` (`agent-busy`, `unknown-message`, …) — the
      * agent must be idle; nothing is queued.
@@ -2100,6 +2187,8 @@ export declare class AgentFramework {
         note?: string;
         /** Branch name for the fork (default `rollback/<agent>/<ts>`, or with `-2`, `-3`, … appended when the store already holds that name). */
         branchName?: string;
+        /** Publication choice for awareness marks; default `none`. */
+        marks?: DiscordAwarenessMarks;
     }): Promise<{
         agentName: string;
         sourceBranch: string;
@@ -2127,9 +2216,10 @@ export declare class AgentFramework {
      * source branch: fork at the current head (by default `suppress/<agent>/<ts>`,
      * numbered `-2`, `-3`, … when the store already holds that name), redact
      * the messages on the fork, switch to it. Shards of a body group are always
-     * removed together. Discord originals get awareness markers via the outbox;
-     * the batch is `explicit`-activated only after every removal succeeded, and
-     * a crash mid-way is finished at next boot (resumePreparedDiscordSuppressions).
+     * removed together. With a marks choice, the Discord originals get awareness
+     * marks through the ledger: the batch is activated only after every removal
+     * succeeded, and a crash mid-way is finished at next boot
+     * (resumePreparedDiscordSuppressions), its marks retired unsent.
      * Like rollbackToMessage, it returns once the body change has landed, with
      * a marker-scheduling receipt (`markers`); delivery continues without the
      * caller waiting on it.
@@ -2144,6 +2234,8 @@ export declare class AgentFramework {
         note?: string;
         /** Branch name for the fork (default `suppress/<agent>/<ts>`, or with `-2`, `-3`, … appended when the store already holds that name). */
         branchName?: string;
+        /** Publication choice for awareness marks; default `none`. */
+        marks?: DiscordAwarenessMarks;
     }): Promise<{
         agentName: string;
         sourceBranch: string;
@@ -2163,66 +2255,94 @@ export declare class AgentFramework {
             preview?: string;
         } | null;
     }>;
+    /**
+     * The messages a rollback to `messageId` would remove, validated, without
+     * changing anything. Never bisects a body group: chronicle refuses that
+     * for removals and branchAt has no such guard, so the target snaps to the
+     * group's last shard.
+     */
+    private planRollback;
+    /**
+     * The removal intervals a suppression of `requestedIds` would apply
+     * (index-ordered, newest first), validated, without changing anything. A
+     * shard expands to its whole body group (chronicle refuses to bisect one),
+     * and a group interval is always removed as a range.
+     */
+    private planSuppression;
+    /**
+     * What a rollback or suppression would remove, and which Discord messages
+     * each publication scope would mark, without changing anything or reading
+     * message content. A surface shows this before an operator chooses
+     * `marks`; passing a scope's `refs` back as `marks.refs` binds the choice
+     * to exactly that set, so a later application never widens it.
+     */
+    previewSurgeryMarks(agentName: string, target: {
+        rollbackTo: string;
+    } | {
+        suppress: string[];
+    }): SurgeryMarksPreview;
+    /** The awareness ledger's batches and retract requests, for operator surfaces. */
+    listDiscordAwareness(): DiscordAwarenessView[];
+    /**
+     * Stop all further sends and retries of a batch's marks, or of a retract
+     * request's removals (by its request id). Never removes a reaction and
+     * never undoes one: requests already on the wire, or whose outcome is
+     * unknown, are reported and may still land.
+     */
+    cancelDiscordAwareness(target: string, opts?: {
+        requester?: OperatorRequester;
+        note?: string;
+    }): Promise<DiscordAwarenessCancelReceipt>;
+    /**
+     * Remove this bot's awareness mark, through each ref's configured MCPL
+     * route, from a batch's refs, or (`all`) from every ref of every batch not
+     * retired and every reaction the ledger holds. The receipt says how many
+     * removals were queued and on how many of those reactions an earlier add
+     * may land afterwards.
+     */
+    retractDiscordAwareness(target: string | 'all', opts?: {
+        requester?: OperatorRequester;
+        note?: string;
+    }): Promise<DiscordAwarenessRetractReceipt>;
+    private awarenessOperatorAction;
     /**
      * Record a surgery's prepared marker batch as active once its body change
      * has landed, and say what happened. Never throws: the body is already
      * applied, so a ledger failure here is reported in the receipt rather than
      * as a failed surgery an operator might retry. A batch that could not be
-     * activated is retired, so no later reconciliation can deliver it behind a
-     * receipt saying it was not scheduled (`not-scheduled`). If retiring fails
-     * too, the receipt says only that the outcome is `unresolved`: the batch is
-     * retained, and it may still be delivered. A rollback's batch
-     * (activated by target branch) may be promoted by the very next
-     * reconciliation, the one the delivery it starts runs; a suppression's
-     * (activated explicitly) waits for the next start.
+     * activated is retired, so no later start can deliver it behind a receipt
+     * saying it was not scheduled (`not-scheduled`). If retiring fails too, it
+     * stays prepared, and a start retires it, unsent: the receipt is
+     * `not-scheduled` either way.
      *
-     * A batch with no refs (a suppression journal with nothing addressable) is
-     * still activated, which closes its resume journal. It schedules no marks,
-     * so it reports `none` whatever the ledger does. If it can be neither
-     * activated nor retired, its journal is left prepared and closes at the
-     * next start: every interval it names has already committed, so the resume
-     * skips them all and activates it.
+     * A batch with no refs (a suppression's resume record, with nothing
+     * addressable) is still activated, which closes it. It schedules no marks,
+     * so it reports `none` whatever the ledger does, and a failure is logged.
+     * If it can be neither activated nor retired, it stays prepared, and
+     * closes at the next start on its branch: every interval it names has
+     * already committed, so the resume skips them all and retires it.
      */
     private activateSurgeryMarkers;
     /**
-     * Start awareness delivery after a branch move (a surgery, a switch, an
-     * undo or redo) without the caller awaiting it. No operator response waits
-     * for Discord to accept marks: the MCPL data-plane gate alone holds channel
-     * traffic that arrives after it until they are attempted.
-     * The sync's body installs that gate synchronously, before its first
-     * await, so calling this while a surgery still holds the store puts the
-     * gate up before the store is released. With no drain running, the
-     * drain starts in the same synchronous run (the first reaction request can
-     * be written before this returns); with one running, this generation's pass
-     * follows it (drainForGeneration). Either way delivery continues
-     * independently: the caller's response and any store reservation stop
-     * waiting on remote reactions. A turn may run during delivery when its wake
-     * carries no channel traffic (a scheduler timer, a provider admission), and
-     * also when its channel traffic was admitted before the gate went up
-     * (queued when a surgery began, or arriving during its switch or fork): the
-     * surgery's store reservation, which used to hold such a turn through the
-     * drain, now ends once the gate is up. A failure is accounted by the gate
-     * itself: the current generation's failure recycles the connections (or,
-     * once the host is stopping, releases the gate instead), and a superseded
-     * one leaves that to the newer generation, whose own pass meets the same
-     * ledger. Here it is logged and raised as an ops alert, and the next sync,
-     * reconnect or start delivers what is still pending.
-     *
-     * Like a server's drain, the delivery runs apart from the operation that
-     * started it: it isn't an operator's operation. A drain already running
-     * when stop() begins sends nothing more, and stop() waits for it to record
-     * the call it had in flight, which closing the connections ends; what it
-     * hasn't sent stays pending in the durable outbox, unrecorded. Once stop()
-     * has begun, none is started, since there's no point opening a drain that
-     * the teardown is about to cut off: the marks stay pending, and the next
-     * start's barrier reconciles the outbox with the branch and delivers them.
-     *
-     * @param after What moved the branch, for the log and the alert
-     *   ("rollback", "branch switch", "undo" …).
-     * @param agentName The agent the move was for, or "framework" for a
-     *   branch switch that names none.
-     */
-    startDiscordAwarenessDelivery(after: string, agentName?: string): void;
+     * The receipt for a batch whose body change has landed, from what the
+     * ledger settled. Anything short of `queued` is logged and raised as an
+     * ops alert: the body stands either way.
+     */
+    private settledMarkerReceipt;
+    /**
+     * Start awareness delivery without the caller awaiting it. The drain starts
+     * now and continues independently. Delivery never gates MCPL traffic or
+     * turns; a failure is logged and raised as an ops alert, and the queued
+     * work stays in the ledger for the next pass. It isn't an
+     * operator's operation, as syncDiscordAwarenessMarkers is: stop() waits
+     * for running drains only once it has closed their servers, within its
+     * budget, and once stop() has begun none is started, since the teardown
+     * would cut it off. The next start delivers what is due. A quiesce doesn't
+     * hold it, as it holds turns and what servers send: a delivery starts no
+     * turn, and the answers to the host's own requests are never held, so a
+     * surgery made during a quiesce has its marks sent then.
+     */
+    private deliverDiscordAwarenessInBackground;
     /** Start config file IO without holding the caller or a surgery's store
      * reservation. The gate picks it up by mtime; stop() still waits for it. */
     private materializeConfigMountAfterBranchSwitch;
@@ -2324,10 +2444,10 @@ export declare class AgentFramework {
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
      * template agent: own ContextManager under `conversations/{name}`, seeded
-     * with the template's compiled context without its thinking or its unpaired
-     * tool blocks (the SubagentModule wholesale-copy pattern; see the seeding
-     * comment below), registered in the event loop like any agent — but never
-     * primary.
+     * with the template's compiled context without its thinking, its channel
+     * and by-name notices, or its unpaired tool blocks (the SubagentModule
+     * wholesale-copy pattern; see the seeding comment below), registered in the
+     * event loop like any agent — but never primary.
      */
     private createConversationAgent;
     /**
@@ -2360,6 +2480,15 @@ export declare class AgentFramework {
      * in flight for the channel, and only this spawn's settlement removes it,
      * so the entry it removes is its own. It's removed before anyone waiting
      * on it resumes, so a waiter that decides again doesn't find it.
+     *
+     * It binds only while the fork it created is still the agent registered
+     * under its name. stop() ends each live fork and unbinds the channels
+     * bound to them, so a fork it ends while this spawn waits for the creation
+     * to return has no binding yet, and binding it then would route the
+     * channel to a name that's gone. The spawn rejects instead, as a failed
+     * spawn does. Its fork's name stays used, so the router's counter for the
+     * channel first moves to the spawn's generation, which the store already
+     * holds, and the channel's next qualifying message spawns the next one.
      */
     private spawnConversationAgent;
     /**
@@ -2378,17 +2507,27 @@ export declare class AgentFramework {
      */
     private storeConversationGeneration;
     /**
-     * Remove a closed conversation fork from the framework: its closure turn
-     * has finished, so the home mapping has served its purpose and keeping the
-     * agent registered would just grow every agent scan and broadcast filter
-     * forever. The fork's context stays in Chronicle for investigation.
+     * Remove a conversation fork from the framework, once its closure turn has
+     * finished or when stop() ends it: the home mapping has served its purpose,
+     * and keeping the agent registered would just grow every agent scan and
+     * broadcast filter forever. Its window is released now, or, while the host
+     * is quiesced, at resume (releaseWindowNowOrAfterResume); when stop() ends
+     * it then, stop()'s pass for postponed releases passes on the failed
+     * replies it left unread instead. No binding names it
+     * by then: the idle sweep unbinds its channel as the closure begins,
+     * stop() unbinds it just before it ends the fork, and a spawn whose fork
+     * stop() has ended binds nothing (spawnConversationAgent). The fork's
+     * context stays in Chronicle for investigation.
      */
     private disposeConversationAgent;
     /**
      * Scope MCPL context injections for a conversation-bound agent: drop
-     * injections that are another open channel's context (injection namespace
-     * = channelId by adapter convention), keep its own channel and anything
-     * that isn't channel context.
+     * injections that are another registered channel's context (injection
+     * namespace = channelId by adapter convention), keep its own channel and
+     * anything that isn't channel context. A channel's context is its own
+     * whether or not it's open: one the agent closed, or one whose server's
+     * transport closed and that isn't confirmed again yet, still belongs to
+     * its own fork.
      */
     private scopeInjectionsForAgent;
     /**
@@ -2466,6 +2605,20 @@ export declare class AgentFramework {
      * stamped (a direct framework caller), which is the closest observation.
      */
     private channelSource;
+    /**
+     * An inbound item's metadata with its stored copy's own digest
+     * (`storedBodyDigest`): the delivered-body digest's function over exactly
+     * the blocks handed to storage here — every decoration included, before
+     * storage shards them. That function hashes blocks as the store keeps them
+     * (inline media re-encoded and relabeled from its bytes), so an unsharded
+     * copy read back hashes to this too. A body the store shards (adaptive
+     * ingress chunking) carries this on every shard, with its metadata, and no
+     * shard hashes to it. Taken at each storage site, never earlier, because
+     * a path can still decorate the body after ingestion stamped it (the
+     * closed-channel invitation; room-220 #48282). An edit through
+     * editMessage keeps metadata but not this hash.
+     */
+    private static withStoredDigest;
     /** Source envelope of a channels/incoming event (lane facts as given). */
     private channelEventSource;
     /** Source envelope of a push event: its derived channel, else unscoped. */
@@ -2517,7 +2670,7 @@ export declare class AgentFramework {
     /** Queue a wake for each agent of the batch's audience, when its latest
      *  occurrence triggers inference. `plain`: an ordinary push wake, without
      *  the subject a withdrawal of the batch's wakes goes by, for a render
-     *  placed in its agent's deferred queue (wakeToRead). */
+     *  placed in its agent's deferred queue (wakeToRead), at `readsDeferredWrite`. */
     private queueCoalescedWakes;
     /** Withdraw unstarted wakes whose sole cause is this subject (§4.2). */
     private cancelCoalescedWakes;
@@ -2527,11 +2680,18 @@ export declare class AgentFramework {
      * scanning the unread tail (above the watermark) — never below it.
      */
     private resolvePlacement;
+    /** Unread (the coalescer's isUnread) by the consumed watermark, or, by the
+     *  shown watermark, never possibly shown (its isUnshown). A placement still
+     *  in the deferred queue is both, once settled (settleUnknownLandings): one
+     *  whose write may already be stored, its store unsearchable, is a doubt,
+     *  which counts as read and as shown. */
     private isUnreadPlacement;
     /**
      * Unread = stored, above the agent's consumed watermark on the current
      * branch, not a body-group shard (immutable), and not folded into any
      * summary (compression is consumption, §3.3). Conservative on every doubt.
+     * By the shown watermark (Agent.getShownWatermark), the same test says the
+     * message may never have been shown.
      */
     private isUnreadStoredMessage;
     private removePlacement;
@@ -2586,7 +2746,7 @@ export declare class AgentFramework {
      * (Named for its first use, the silent tick.)
      */
     private silentTurnRowMetadata;
-    /** Record plain-prose segments this turn suppressed without drafts (proseRouting=disabled). */
+    /** Record plain-prose segments this turn suppressed without drafts (proseRouting=disabled, or a round withheld before its scripts returned). */
     private recordProseSuppression;
     /**
      * Silenced plain speech: an explicit send holds it as resendable drafts; a
@@ -2722,10 +2882,12 @@ export declare class AgentFramework {
     private announceLocusIfChanged;
     /**
      * The channel a message moves its turn's locus to, by the addressed
-     * re-pin rule (2026-07-31, n=6 and n=7): a conversational message (not a
-     * reaction or a system marker) that addressed the agent, or that follows
-     * up in a channel the turn sent into (TurnRouting.engaged). Undefined for
-     * any other message. A tool boundary weighs the messages it injects by it,
+     * re-pin rule (2026-07-31, n=6 and n=7): a conversational message (by
+     * isConversationalInjection: not a system marker, nor a reaction, reaction
+     * removal, edit or deletion marker, apart from an edit the coalescer marks
+     * as the agent's first view) that addressed the agent, or that follows up
+     * in a channel the turn sent into (TurnRouting.engaged). Undefined for any
+     * other message. A tool boundary weighs the messages it injects by it,
      * and noteArrival the ones no boundary of the turn weighs.
      */
     private repinChannel;
@@ -2751,6 +2913,12 @@ export declare class AgentFramework {
      * its own agent, so no boundary of another resident's turn weighs it.
      */
     private noteForOtherResidents;
+    /**
+     * Show the turn's typing indicator in `channelId`, stopping the one it last
+     * showed elsewhere: this stream's, or one an earlier stream of the turn
+     * left running when it handed the turn on.
+     */
+    private showTurnTyping;
     /**
      * The channel of the turn's newest arrival whose message is still in the
      * agent's store (TurnRouting.arrivals). A message removed since it was
@@ -2776,15 +2944,155 @@ export declare class AgentFramework {
     /**
      * Durable window notice for a channel the agent did not ask to open: a
      * subscription-policy admission, announced as the decision before its
-     * transport RPC (a failed open keeps the decision, and channel_list shows
-     * transport state), or an open that the agent's own delivery or reply
-     * caused (`opened-by-delivery`, `opened-by-reply`), once its transport is
-     * confirmed. Either way it names `channel_close` as the opt-out (their
-     * decision outranks policy). What an open channel delivers is its server's
-     * to say (#406), so the notice doesn't promise its traffic. System message:
-     * never triggers inference, never conversational, never locus-eligible.
+     * transport RPC (a failed open keeps the decision, and the host tries again
+     * when the server next registers the channel), or an open that the agent's
+     * own delivery or reply caused (`opened-by-delivery`, `opened-by-reply`),
+     * once its transport is confirmed. It names `channel_close` as the opt-out
+     * (neither the subscription policy nor the server's default reopens a
+     * channel the agent closed) only where the agent it's addressed to can
+     * call it for every channel it names (canCloseChannels): a conversation
+     * fork may close only its home channel, and an agent's allowedTools can leave
+     * channel_close out. The other residents can read it too, where several
+     * share one slot (#291); a fork's seed leaves it out (primaryNoticeTexts).
+     * Where an
+     * agent's own send opened a channel it can't close, the primary is told by
+     * name too, if it's registered and can close it, and the agent is told
+     * that it was. What an open channel delivers is its server's to say (#406),
+     * so the notice says how servers differ rather than promising its traffic,
+     * and says that only to an agent whose window holds the channel's traffic
+     * (holdsChannelTraffic).
+     * System message: never triggers inference, never conversational, never
+     * locus-eligible.
      */
     private recordChannelAutoOpenNotice;
+    /**
+     * Write a builder's channel notices in order, each on its own: one that
+     * can't be written is logged, and the rest are still written. A reader's
+     * notice that says the primary was told comes after the primary's, and is
+     * written in its `untold` words where the primary's write failed, so it
+     * never says the primary was told of a notice that wasn't written. A write
+     * addMessage defers to the primary's next boundary, as it does any write
+     * to an agent mid-turn, counts as written: a memory-only queue loses it at
+     * exit, as it loses any deferred write. Through
+     * framework.addMessage for mid-turn safety (deferral + hear-while-acting
+     * injection): an open a delivery forces happens inside a live turn, and a
+     * direct context-manager append there would store the notice out of order.
+     */
+    private writeChannelNotices;
+    /**
+     * The notices recordChannelAutoOpenNotice writes, in order: the primary's
+     * by name where the reader can't close the channels, then the reader's,
+     * which then says the primary was told (`untold`: its words where that
+     * didn't land). None, logged, for an agent that has ended when there's no
+     * primary to tell.
+     * The reader's carries its inputs (`passOn`), the channels' server among
+     * them, where it's addressed to the agent whose send opened the channels
+     * and that agent was told it can close them, so a release that finds it
+     * unread can tell the primary in its place (channelNoticeForPrimary), which
+     * calls this again for the agent then gone. A policy admission's goes where
+     * addMessage delivers it, to no agent of its own, and carries none.
+     */
+    private channelOpenedNotices;
+    /**
+     * Whether `who` can call channel_close for every one of `channelIds` here:
+     * its allowedTools hold it (canAgentUseTool), and a conversation fork,
+     * whose channel_close dispatchChannelToolCall refuses for any channel but
+     * its home, only for its home.
+     */
+    private canCloseChannels;
+    /**
+     * Whether `who` holds the traffic of every one of `channelIds`, so that
+     * what an open channel delivers is in its window. Where conversations are
+     * routed, an incoming message goes to the fork its channel is bound to, or
+     * nowhere, and never to the primary (handleMcplChannelIncoming), so a fork
+     * holds only its home's, and only while the router binds its home to it.
+     * An idle expiry's sweep unbinds the home before the fork's closure turn
+     * (ConversationRouter.expired), and from then the closing fork holds none;
+     * a newer fork the home is bound to holds it instead. Elsewhere an
+     * incoming message is stored with no forAgent, in deliveryAgent()'s store,
+     * and where that's the residents' shared slot, every agent that reads the
+     * slot holds it (sharedSlotAgents: the ordinary residents, and the
+     * subconscious through its merged view); a run's store is its own. (A push
+     * names its channel and lands in the primary's window either way, but it
+     * comes whether or not the channel is open, so it isn't what opening one
+     * delivers.)
+     */
+    private holdsChannelTraffic;
+    /**
+     * Whether `who`'s window holds the traffic of the channels it may open or close, for the words its channel_open and
+     * channel_close carry. A conversation fork does for its home, the one
+     * channel it may close, decided by the home rather than the binding, so a fork whose binding expired keeps its words
+     * through its closure turn: changing them then would send its whole window uncached, for a sentence false for that
+     * turn only. Otherwise as holdsChannelTraffic has it: on a host that routes conversations, the trunk holds none, and
+     * otherwise the delivery agent and the readers of the residents' shared slot do. An ephemeral run holds none.
+     */
+    private holdsChannelTrafficForTools;
+    /** Whether `who` is the delivery agent, or reads the residents' shared slot it stores into. */
+    private residentHoldsTraffic;
+    /**
+     * How a notice to the primary names `agentName`: a conversation fork by the
+     * channel it's bound to, as notices name channels, with its own name once,
+     * after "named", and as "that fork" after that ("your fork" where the
+     * primary is the template forks are made from); any other agent by its
+     * name. `first` is said mid-sentence, so a fork's ends with a comma. A
+     * fork's home is known while it's registered and through its release; a
+     * notice passed on later, at resume or at boot, names it by its name.
+     */
+    private agentForPrimary;
+    /**
+     * How a notice to `reader` names the primary it says was told: "Your
+     * primary" to a conversation fork made from the primary, whose
+     * configuration is the primary's with only its name changed, so its prompt
+     * may give the primary's name as its own; the primary's name to any other
+     * agent, a fork made from another template included.
+     */
+    private primaryForReader;
+    /** Whether `agentName` is a conversation fork made from the primary: the
+     *  router's template is the primary (connectome-host's is). */
+    private forkOfPrimary;
+    /**
+     * Window notice for a reply whose channel couldn't be opened: the reply
+     * went out through its send tool, but the open that engaging the channel
+     * asks for failed. Without it the agent would wait for a conversation it
+     * won't see. It goes to the agent whose reply it was, or, when no agent
+     * is named, where addMessage delivers an unrouted message (deliveryAgent:
+     * the primary, else the first registered agent), as the opened notice
+     * does, and its advice is judged for that agent. Where the channel stays
+     * closed, an agent that has ended is told nothing, and nor is anyone in
+     * its place: nothing follows from the failure. Where it's selected for
+     * opening, the primary is told by name in its place, if one is registered,
+     * as the opened notice tells it of an open by an agent that has ended, so
+     * an agent that could close the channel hears it may open. It names
+     * channel_open as the way to try again only where the agent it's addressed
+     * to can call it: a conversation fork's channel_open is refused outright
+     * (dispatchChannelToolCall), and an agent's allowedTools can leave it out.
+     * The other residents can read it too, where several share one slot
+     * (#291); a fork's seed leaves it out (primaryNoticeTexts).
+     * Where the channel is selected for opening, it says so and why, as
+     * speech's failure does, and what that means: where the host couldn't
+     * record putting the channel's decision back, a later delivery or
+     * reconnect tries again; where the
+     * server's latest announcement or the subscription policy lifted the
+     * default put back, the host tries again itself, so channel_open isn't
+     * named. Either way channel_close withdraws that, named only to an agent
+     * that can call it here (a fork may close only its home channel). Where
+     * the reader can't, the primary is told by name too, if it's registered
+     * and can close it, and the reader is told that it was. System message, as
+     * the opened notice is.
+     */
+    private recordReplyOpenFailedNotice;
+    /**
+     * The notices recordReplyOpenFailedNotice writes, in order: the primary's
+     * by name where the reader can't close a channel selected for opening,
+     * then the reader's, which then says the primary was told (`untold`: its
+     * words where that didn't land). None, logged, where the agent has ended and the channel
+     * stays closed, or there's no primary to tell. The reader's carries its
+     * inputs (`passOn`), the channel's server among them, where it's addressed
+     * to the agent whose reply it was, the channel is selected for opening and
+     * that agent was told it can close it, so a release that finds it unread
+     * can tell the primary in its place (channelNoticeForPrimary).
+     */
+    private replyOpenFailedNotices;
     /**
      * A `!` continuation the turn asked for (`>>#x !`, `>>>#x !`): start another
      * turn now instead of pausing until the next external event. It reads the
@@ -2798,19 +3106,20 @@ export declare class AgentFramework {
     /** The agent's routing state for its current turn, made when it has none. */
     private routingOf;
     /**
-     * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md).
-     * Every prose segment of an `explicit`-mode agent flows through here:
-     * parse the `>>` prefix, resolve the target, deliver — or bounce to the
-     * held bounce draft with a resend notice. Misdelivery is structurally impossible:
-     * nothing is ever sent to a destination the model did not name (directly
-     * or via the turn's sticky target).
+     * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md),
+     * entered directly: parse the `>>` prefix, resolve the target, deliver, or
+     * bounce to the held bounce draft with a resend notice. Misdelivery is
+     * structurally impossible: nothing is ever sent to a destination the model
+     * did not name (directly or via the turn's sticky target). A stream's own
+     * deliveries go through deliverAdmittedProse with its outgoing stream
+     * (onPublished); this entry has no stream, and only tests call it.
      */
     private deliverProse;
     /**
      * Explicit prose's envelopes, each `>>` target resolved now, once. A live
-     * round is admitted at its boundary: its turn's destination is decided from
-     * these resolutions (roundDestination), and its queued delivery posts to
-     * them, however the registry's names change before it runs.
+     * round is admitted as it ends, at its tool-calls event, and its queued
+     * delivery posts to these resolutions, however the registry's names change
+     * before it runs.
      */
     private admitProse;
     private deliverAdmittedProse;
@@ -2835,13 +3144,6 @@ export declare class AgentFramework {
     /** A draft's state as the journal reads it now: after a write that failed
      *  and was reconciled, whatever reached the journal counts. */
     private draftStateNow;
-    /**
-     * Where a delivered round leaves its turn's sticky destination, as the
-     * explicit gateway sets it once the round's envelopes run: each `>>`
-     * envelope whose target resolved becomes the destination. One that didn't
-     * resolve bounces and leaves it, as do `>>skip_reply` and unprefixed text.
-     */
-    private roundDestination;
     /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
     private deliverHybridProse;
     /** `>>skip_reply {{unsent}}` and its hybrid form: set the latest bounce
@@ -2942,8 +3244,9 @@ export declare class AgentFramework {
     executeToolCall(call: ToolCall): Promise<ToolResult>;
     /**
      * Admin puppet: execute ONE tool call AS an agent and persist the
-     * tool_use + tool_result pair in that agent's window exactly as a
-     * model-initiated call is stored.
+     * tool_use + tool_result pair in that agent's window as a
+     * model-initiated call is stored, but under the inline cap its call
+     * carried, whereas a model's call takes the cap at the store.
      *
      * Born from the princess exemplar surgery (2026-08-23). Her folded
      * narrative said "I have no tools"; every past tool_use/tool_result pair
@@ -2988,51 +3291,67 @@ export declare class AgentFramework {
     /** Event-pushing wrapper for the model-driven dispatch path. */
     private dispatchCodeExecutionToolCall;
     /**
-     * Run one code_execution script for an agent. Never rejects.
+     * A model-issued tool's result has arrived. When it answers the last of
+     * the code_execution calls a round waits on (ScriptRound), the round's
+     * prose is routed now, its scripts' calls counted.
+     */
+    private settleScriptRound;
+    /**
+     * Whether a code_execution call watches a script that can change its
+     * round's routing, so the round waits for the call (ScriptRound): a run's
+     * script, or the script a wait names by its script_id, as it would watch
+     * it. Its code must name a tool whose call can change the round's routing
+     * in the turn's mode, under its same-round policy (routingToolsNamed,
+     * changesRouting). The reading is coarse, so a comment or a string naming
+     * such a tool holds the round as well, for no longer than the call's yield,
+     * and a name built at runtime isn't seen: its round is routed at once, as a
+     * round was before scripts counted. A stop's watch counts what reaches the
+     * host as any call's does (scriptRoundCalls), but nothing a script makes
+     * once its stop is asked reaches a tool, since the runner refuses it, so a
+     * stop holds no round, and a list returns at once.
+     * Without code execution, or for an agent whose allowedTools doesn't name
+     * code_execution, no script runs, and the call's answer settles no round,
+     * so a round waiting for it would be withheld when its stream ended.
+     */
+    private scriptMayRoute;
+    /**
+     * One code_execution call: run a script, or wait for, stop or list the
+     * agent's scripts. Never rejects.
      *
-     * The script runs in the agent's persistent python interpreter with every
-     * tool on the agent's CURRENT surface injected (minus code_execution
-     * itself). Inner tool calls are dispatched through dispatchToolCall — the
-     * exact model path, including MCPL state/checkpoint handling, channel
-     * routing, and traces — and resolved via scriptToolWaiters, so their
-     * results reach the running script and never the model context.
+     * A script runs in a process of its own, on the engine, with every tool on
+     * the agent's CURRENT surface (minus code_execution itself). Its calls come
+     * back through dispatchToolCall as the agent's — the exact model path,
+     * including MCPL state/checkpoint handling, channel routing, and traces —
+     * and are resolved via scriptToolWaiters, so their results reach the script
+     * and never the model context (scriptToolCall). The return says how the
+     * script ended, or that it's still running, first; then its calls, its
+     * value and its output since the last return (renderReturn). `roundCalls`,
+     * when a round waits on this call (ScriptRound), takes the script's calls
+     * that reach the host while this call watches it.
      */
     private runCodeExecution;
-    /** Background scripts are the primary agent's, or any agent's when no primary agent is named. */
-    private runsBackgroundScripts;
-    /** How many background scripts an agent may have running at once. */
-    private maxBackgroundScripts;
-    /** How many of this agent's background scripts are running now. */
-    private runningBackgroundScripts;
-    /**
-     * Start a background script: dedicated interpreter, output journaled to a
-     * workspace file, wake_agent() available in-script. The tool result
-     * returns immediately; the script runs until it ends, hits the lifetime
-     * ceiling, or is cancelled. Scripts DIE WITH THE HOST PROCESS — that
-     * limitation is stated in the tool description so agents can calibrate
-     * how much to rely on an armed wake.
-     */
-    private startBackgroundScript;
-    /** First read-write mount name, or null. */
-    private firstWritableMountName;
+    /** code_execution's settings and every agent's scripts, made once code execution is on. */
+    private makeCodeExecution;
+    /** The tools a script of this agent may call now: the agent's own surface, without code_execution. */
+    private scriptTools;
     /**
-     * wake_agent() from a background script: enforce the per-script wake cap
-     * and rate floor (delay, not drop — the script awaits the ack), then
-     * inject the provenance envelope + payload and request inference.
-     * Resolves null on delivery; an error string refuses the wake (raises
-     * RuntimeError inside the script).
+     * The first read-write mount without an include, or null. The framework
+     * keeps its own files there (`tool-results/`, `refs/`). A mount with an
+     * include holds only the files it names, so it would refuse them, and a
+     * setup whose only writable mount has one is treated as having none.
      */
-    private handleScriptWake;
-    /** Background script ended (clean, crash, deadline, cancel/dispose). */
-    private settleBackgroundScript;
+    private firstWritableMountName;
     /**
-     * Deliver a background-script event: provenance envelope into the agent's
-     * context + an inference request. Deliberately does NOT consult the event
+     * A script's word to its agent: a wake_agent() payload, or the ending of a
+     * left script that failed, crashed or was stopped at its limit. It enters
+     * the agent's context, spilled to the workspace past the agent's inline
+     * cap, with an inference request. Deliberately does NOT consult the event
      * gate — the agent armed this wake themselves (wake-through-sleep
      * authority); it enters tagged so gate policies could be taught about it
-     * later if that ever needs revisiting.
+     * later if that ever needs revisiting. Throws when it can't be delivered,
+     * so the script's wake_agent() says so.
      */
-    private injectScriptWake;
+    private scriptWake;
     /**
      * Oversized content policy (antra, 2026-07-31; completed for issue #89):
      * never hit the agent in the face with a huge blob, never silently destroy
@@ -3040,7 +3359,7 @@ export declare class AgentFramework {
      * file (readable with the agent's own tools — deterministic name, kept
      * until the workspace owner deletes it) and replaced by a truncated head +
      * a trailing file reference. Falls back to EXPLICIT plain truncation when
-     * there is no writable workspace. Cap resolution lives in
+     * there is no read-write mount without an include. Cap resolution lives in
      * resolveToolResultInlineCap; callers pass the resolved cap.
      */
     /**
@@ -3069,8 +3388,8 @@ export declare class AgentFramework {
      */
     private storedToolResultText;
     /** Where a tool result labelled `label` is written: `<first writable
-     *  mount>/tool-results/<label>.txt`, or null when there is no writable
-     *  workspace. */
+     *  mount without an include>/tool-results/<label>.txt` (see
+     *  firstWritableMountName), or null when there is no such mount. */
     private toolResultFilePlace;
     /**
      * A withheld original uses the remaining time in its batch's deadline.
@@ -3087,54 +3406,39 @@ export declare class AgentFramework {
     /**
      * Write one tool result's text to its tool-results file (see
      * toolResultFilePlace): the one place both the inline cap's spill and the
-     * guard's withheld originals go. null when there is no writable workspace.
+     * guard's withheld originals go. null when there is no writable mount
+     * without an include.
      * A failed write is reported, traced and logged here, never thrown. With a
      * branch, the file lands on that branch or isn't written (see writeBinary).
      */
     private writeToolResultFile;
+    /** How to read a tool result's file back a page at a time, with each page
+     *  sized to come back within `cap`. */
+    private spillPageAdvice;
     private spillOrTruncate;
-    private getOrCreateScriptRunner;
     /**
-     * Resolve one script-inner tool call to the string the script's tool
-     * function returns, and whether that result is an error (the script's
-     * `.is_error`). Never rejects: a failure without structured content becomes
-     * an "Error: ..." string, matching the managed PTC runtime ("Claude's code
-     * receives this error"), and a structured one its JSON object.
-     *
-     * A result without structured content is serialized with the HISTORY
-     * serializer: images become placeholders, since a script variable holding
-     * megabytes of base64 helps nobody. A result with structured content is
-     * one JSON object holding both of the server's views
-     * (scriptStructuredResult), so its content blocks reach the script as the
-     * dispatch gave them, images and payloads included. A module's result that
-     * can't be stored or sent, such as a cyclic object or a BigInt, is already
-     * an error naming the tool when the dispatch returns it (storableToolResult),
-     * so a script reads that error's text.
-     */
-    private handleScriptToolCall;
-    /** The 5MB protocol safety cap on what a script receives. */
-    private static readonly SCRIPT_RESULT_MAX_CHARS;
-    /**
-     * A structured MCP result as a script receives it: one JSON object holding
-     * both of the server's views, `{ content, structuredContent, isError }`,
-     * plus `error` (the text) on a tool error. `content` is the content array
-     * the dispatch gave this call (the direct reading): the server's blocks as
-     * sent, so payloads and images survive, except that an MCPL peer's blocks
-     * get the treatment RFC-005 gives them on every lane the model reads
-     * (referenceBlockForScript). `structuredContent` is the tool's own JSON, as
-     * sent. Past the size cap the result stays valid JSON: the whole object is
-     * saved to the workspace, and the script gets
-     * `{ isError, oversized: { chars, savedTo } }`. If it can't be saved, the
-     * script gets a failure to materialize the result, saying the tool may
-     * already have completed, never a success missing its result. A result
-     * that can't be converted to JSON (a cyclic object, a BigInt), which the
-     * dispatch's own check makes unlikely here, gets the same object empty,
-     * `{ content: [], structuredContent: null, isError: true, error }`, the
-     * error naming the tool. In every form, the script's `.is_error` is the
-     * `isError` of the object its string holds, and its `.structured` is read
-     * from that string.
-     */
-    private scriptStructuredResult;
+     * The bridge: one of a script's calls, as its agent's, through the ordinary
+     * dispatcher, so the agent's allowlist and every gate apply as they do to
+     * its own call: the bridge's half of adding nothing to what the agent's
+     * tools allow. Never rejects. A call the dispatcher refused before it
+     * opened (ToolResult.refused) reaches the script as a ToolRefused Error with
+     * the refusal's text; any other result, a failure included, reaches it in
+     * the one shape every tool answers (scriptResultAnswer).
+     */
+    private scriptToolCall;
+    /**
+     * A dispatched result as a script receives it: `{ content, structuredContent,
+     * isError }`, one shape for every tool. `content` is
+     * what the model would read: a structured result's blocks as the dispatch
+     * gave them (the direct reading, with RFC-005's treatment of an MCPL peer's
+     * blocks), and otherwise one text block of the model's text, which for a
+     * failure is its error. `structuredContent` is the tool's own structured
+     * content where it sent one, `false`, `0` and `null` included, else null.
+     * A result that can't be converted to JSON (a cyclic object, a BigInt),
+     * which the dispatch's own check makes unlikely here, is a failure naming
+     * the tool and saying the call itself completed.
+     */
+    private scriptResultAnswer;
     /**
      * Dispatch a script-inner tool call through the NORMAL dispatch path and
      * resolve with its result. The waiter intercept in handleProcessEvent
@@ -3147,8 +3451,25 @@ export declare class AgentFramework {
      * `turnId` is the turn the call was made in (dispatchToolCall).
      */
     private dispatchScriptToolCall;
-    /** Abort the agent's script, running or still starting, when the turn it belongs to ends or is reset to run again. */
-    private abortAgentScript;
+    /**
+     * A stream's turn ended without its calls' answers, or is reset to run
+     * again (a stream cancelled, failed or waiting on its provider): the
+     * agent's scripts take it as an abandoned end of that stream's turn
+     * (AgentScripts.turnEnded). A quiesce abandons its stream's own turn (or
+     * every turn, when it has none to name), and the host stopping every turn
+     * of the agent's (`'every'`).
+     */
+    private abandonAgentScripts;
+    /**
+     * The agent's turns still live, for its scripts (AgentScripts.turnEnded):
+     * its open logical turn, and the turn of its start in progress, unless
+     * that's `ending`'s or has settled. A start is in progress while it holds
+     * the agent's turn token, from its dequeue through its hooks, compile,
+     * stream and restarts to its settled teardown (activeTurnTokens); its turn
+     * ends at its settle, and the teardown after it, such as its speech's
+     * delivery, is no longer the turn's (settledTurns).
+     */
+    private liveTurns;
     private toMembraneToolResult;
     /**
      * If `data` is an MCP tool-result content array carrying at least one image,
@@ -3174,6 +3495,15 @@ export declare class AgentFramework {
      * result is the spill file, not an over-bound blob in live context).
      */
     private resolveToolResultInlineCap;
+    /**
+     * A tool call's resultMaxChars: how long its result may be and still reach
+     * its caller whole. A call from a running script resolves to the script,
+     * which takes any result that fits its memory (scriptResultMaxChars). Any
+     * other call's result is stored in its agent's context under the agent's
+     * inline cap, and a call for an agent the framework doesn't hold gets the
+     * house default.
+     */
+    private resultMaxCharsFor;
     private approximateDecodedBase64Bytes;
     private sanitizeProcessLogValue;
     /** Writes one inference-log entry. A stream's entries go through its
@@ -3234,25 +3564,44 @@ export declare class AgentFramework {
      * while unregistered. Genuine legacy caller names retain their surface. */
     private canAgentUseTool;
     private agentToolPermissionFailure;
+    /**
+     * A dispatched call answered without running its tool. RFC-007's lifecycle
+     * forgets it, and its result says it was refused (`ToolResult.refused`), both
+     * from here, so the two can't disagree.
+     */
+    private refusedResult;
     /**
      * Why this host refuses a skip_reply call, as the model will read it, or
      * undefined when it doesn't (skipReplyWakeRefusal): without an EventGate,
      * any wake_in_seconds; with one, a wake_in_seconds that isn't a number of
      * seconds. Only when the channel registry handles skip_reply. The dispatch
      * that refuses the call reads it here, and so does the turn's bookkeeping of
-     * a refused round, for the model's own calls: the silence before it, which
-     * comes back after its round, and in XML mode which round's prose stays
-     * private. A skip_reply round's own prose stays private by the tool's name,
-     * refused or not.
+     * a refused round (roundCallOf), for the model's calls and a script's calls
+     * that reach the host while a call of the round watches it: the silence
+     * before it, which comes back after its round, and in XML mode which round's
+     * prose stays private. A skip_reply round's own prose stays private by the
+     * tool's name, refused or not.
      */
     private skipReplyRefusal;
     private refusesSelfWake;
+    /**
+     * A call as its round's routing counts it, made directly, or by a script
+     * and reaching the host while a run or wait call of the round watches it
+     * (ScriptRound). A skip_reply refused, because the agent's allowedTools
+     * doesn't name it or because this host can't set the wake it asks for, is
+     * marked refused: it keeps its own round private and silences nothing after
+     * it. A refusal withholds the call's effect, not the model's choice to keep
+     * its words private. Any other call the list refuses posted nothing, so it
+     * gives no cause. A script's call the bridge refuses before dispatch
+     * (`refusedHere`) counts as one the list refuses.
+     */
+    private roundCallOf;
     /**
      * Dispatch a call the agent made. `turnId` is the turn it was made in
      * (TurnRouting.turnId), as its caller knows it: a model's call, the turn
-     * whose stream made it; a foreground script's inner call, the turn of the
-     * code_execution call whose script is running when the call arrives. A
-     * background script's call has none.
+     * whose stream made it; a script's call, the turn of the code_execution
+     * call watching the script when the call reaches the host. A call of a
+     * script left running, which no call watches, has none.
      */
     private dispatchToolCall;
     private dispatchToolCallEvent;
@@ -3291,18 +3640,53 @@ export declare class AgentFramework {
      *
      * So none of a target's entries lands ahead of an earlier one, and a queued
      * tool_use that can't be stored keeps the tool_result queued behind it from
-     * being stored alone. (A tool_use that is stored, followed by a tool_result
-     * that can't be, stays stored without it until the tool_result lands at a
-     * later flush. The only queued pair is puppetToolCall's defensive one,
-     * which no path reaches today.) An entry that keeps failing is logged by
-     * id at each flush, and holds its target's later queued writes rather than
-     * letting them land out of order.
+     * being stored alone, unless context-manager refused it as malformed
+     * (below). (A tool_use that is stored, followed by a tool_result that
+     * can't be, stays stored without it until the tool_result lands at a later
+     * flush, or for good when the store refuses the tool_result as malformed.
+     * The only queued pair is puppetToolCall's, queued only when its turn's
+     * token is no longer its own once the pair is built, which its comment
+     * calls defensive.) An entry that keeps failing is logged by id at each
+     * flush, and holds its target's later queued writes rather than letting
+     * them land out of order.
+     *
+     * An entry context-manager refuses as malformed (MalformedContentError) is
+     * the exception for the store's own validation: context-manager checks
+     * content and every shard before writing. A custom synchronous strategy
+     * hook can throw the same class after append (context-manager #288);
+     * unreadable landing in that callback escape remains a limitation until
+     * the CM follow-up lands. A copy actually found still counts first. Other
+     * ambiguous errors remain queued for ID reconciliation before retry. A
+     * malformed refusal would fail every flush and hold its target's later
+     * writes for good, so it's logged and dropped instead, and its
+     * target isn't cut: left in the un-acked set, the next ack drops it from
+     * the durable queue. A tool_use dropped this way leaves a tool_result
+     * queued behind it to be stored alone. context-manager mends a tool_use
+     * whose input isn't an object, so it refuses one only when that input has
+     * no JSON form or the block itself is malformed. addMessage refuses such
+     * content before it's queued, so an entry meets this here from a queue an
+     * earlier process persisted, as puppetToolCall's pair, which it queues
+     * itself, or when the strategy's chunking splits well-formed content into a
+     * shard the store refuses, which the store's error names.
      *
-     * The hold is the queue's alone. A write that isn't deferred is stored at
-     * once and can land ahead of a held entry: a fresh tool_result, whatever
-     * its agent's state, and any write while its agent's turn, stream and tool
-     * cycle are all idle and the host isn't quiesced. So an entry that keeps
-     * failing holds only what is deferred behind it.
+     * From a fresh turn's start to the end of its coalescing assembly, before
+     * its checkpoint, every write deferred for its agent lands in that
+     * request, in arrival order, up to one that can't be stored and unless the
+     * host is quiesced (flushForStart). The turn-start flush writes the queue;
+     * while the assembly runs, each write it makes into the agent's own window
+     * (addMessage's bypassDeferralFor) first writes what was deferred since;
+     * and what was deferred during the assembly is written once it ends. A
+     * write the assembly makes while an entry is held waits behind it in the
+     * queue, so the hold covers the assembly's writes too, and so does one
+     * made while the host is quiesced with anything queued for the agent: a
+     * quiesce that begins while an assembly awaits a render lets that turn
+     * drain, and what is queued waits for resume(). Outside that window the
+     * hold is the queue's alone: a write that isn't deferred is stored at once
+     * and can land ahead of a held entry, as a fresh tool_result does whatever
+     * its agent's state, and any write does while its agent's turn, stream and
+     * tool cycle are all idle and the host isn't quiesced. So an entry that
+     * keeps failing holds what is deferred behind it and the assembly's writes
+     * for its agent.
      *
      * A write can throw after its message is stored: a store listener, the
      * strategy's handling of the add, or a later shard of a sharded body can
@@ -3312,24 +3696,28 @@ export declare class AgentFramework {
      * written, at most once: the entry isn't requeued and stored a second
      * time, and what landed, as later compiles render it (asCompiled), is what
      * it returns as the entry's content. For a sharded body, that can be its
-     * first shards alone, since the append loop stops at the throw; the rest
-     * of the body isn't stored. (Requeued, the
+     * first shards alone if rollback could not remove them; context-manager
+     * from 0.15 otherwise removes shards from a failed append. (Requeued, the
      * landed shards would be stored twice, and only the rest could not be
      * appended later without splitting the body.) Boot's scan for landed
      * writes counts a landed shard the same way. When the store can't be read
-     * back (storedCopiesOf logs it), nothing is found, and the entry is put
-     * back as one that couldn't be stored: if it had landed, a later flush
-     * stores it again.
+     * back (storedCopiesOf logs it), or couldn't say how many messages it held
+     * before the write, whether the entry landed is unknown: it's put back
+     * marked so (`landing`), and before it's written again the store is
+     * searched for its id (landedCopiesById). Found, it counts as written, as
+     * above, at the flush that finds it; not found, it's written; and while
+     * the store can't be searched, it stays queued, holding what's behind it.
      *
      * Returns what was written (stored, or deferred again by addMessage, whose
-     * id is then empty), in queue order: for one target, a prefix of its
-     * entries. Each comes with its content: as given, unless the store took it
-     * as more than one message (a sharded body) and can be read back, when its
-     * copies are returned joined, as later compiles render them (asCompiled),
-     * or its write threw after storing it (above). `onLanded` hears an entry
-     * whose write threw after storing it, with the id it landed under, as soon
-     * as it's found: before the writes after it, so whatever it records keeps
-     * their order.
+     * id is then empty), in queue order: for one target, its entries up to the
+     * first that couldn't be stored, less entries refused as malformed and dropped. Each comes
+     * with its content: as given, unless the store took it as more than one
+     * message (a sharded body) and can be read back, when its copies are
+     * returned joined, as later compiles render them (asCompiled), or its write
+     * threw after storing it (above). `onLanded` hears an entry whose write
+     * threw after storing it, with the id it landed under, as soon as it's
+     * found: before the writes after it, so whatever it records keeps their
+     * order.
      */
     private writeDrainedInOrder;
     /** How many messages the agent's store holds: undefined when its store
@@ -3338,26 +3726,63 @@ export declare class AgentFramework {
     /** The messages carrying `deferredWriteId` among those the agent's store
      *  gained from position `from` on, in store order, with their blobs
      *  resolved, as a request carries them. A sharded body's carry its
-     *  `bodyGroupId`. */
+     *  `bodyGroupId`. Undefined when the store can't be read back, which is
+     *  logged: not the same as nothing found. */
     private storedCopiesOf;
+    /** The messages carrying `deferredWriteId` anywhere in the agent's store,
+     *  found by their id (queryMessages, as landedRow finds a held write's),
+     *  so no position is needed. Undefined when the store can't be searched,
+     *  which is logged. */
+    private landedCopiesById;
     /** The line naming a drained write that threw: one that couldn't be stored,
-     *  which is already back in the queue, or, with `landed`, one stored before
-     *  the throw (for a sharded body, how many of its shards). Logging mustn't
-     *  fail the flush that met it, so a thrown value that has no text is named
-     *  as such. */
+     *  which is already back in the queue; with 'dropped', a malformed refusal
+     *  from the store's pre-write validation (see the CM #288 caveat above);
+     *  with a count, one stored before the
+     *  throw (for a sharded body, how many of its shards), or, with
+     *  `foundLater`, one an earlier write of which landed and was found by its
+     *  id; with `'unknown'`, one whose store couldn't be read to tell
+     *  whether it landed, back in the queue to be looked up first; and with
+     *  `'still-unknown'`, one that still can't be looked up. Logging mustn't
+     *  fail the flush that met it, so a thrown value that has no text is
+     *  named as such. */
     private logDeferredWriteError;
+    /**
+     * Write what is queued for `agent` into its window past its deferral, in
+     * queue order and cut at a write that fails, though one the store refuses
+     * as malformed is dropped and what follows goes on (writeDrainedInOrder),
+     * between a fresh turn's start and its checkpoint, where what is stored is
+     * the turn's input: at the start, before each write the coalescing
+     * assembly makes for the agent, and once the assembly ends, the last two
+     * not while the host is quiesced, when what is queued waits for resume().
+     * What is stored is weighed for the start now beginning and for every
+     * other resident's open turn. Returns whether anything is still queued for
+     * the agent.
+     */
+    private flushForStart;
+    /** Whether anything is queued for `agentName`, by drainDeferredFor's
+     *  target rule. */
+    private queuedFor;
     /** Re-add drained entries through addMessage, which stores each or defers
      *  it again, in queue order and cut per target (writeDrainedInOrder). With
      *  `bypassDeferral`, each is stored past its target's deferral (stop()). A
      *  write that threw after storing missed the notes addMessage takes after a
      *  store, so they're taken for what landed as soon as it's found, before
      *  the writes after it: an open turn's arrivals keep the order the writes
-     *  landed in, and its newest stays the newest (remainingArrival). */
+     *  landed in, and its newest stays the newest (remainingArrival).
+     *
+     *  A target no longer registered (a fork or a run that has ended, here or
+     *  before a crash) has no window to land in: a failed reply queued for it,
+     *  or a channel notice it could have acted on, becomes the primary's
+     *  by-name notice, under the entry's own id and place in the queue
+     *  (queuedNoticeForPrimary), and is written with the rest; any other write
+     *  is dropped, logged, by addMessage. Nothing here reads the gone agent's
+     *  window, so such a notice an earlier write of which landed there, and
+     *  which the agent read, goes on too. */
     private readdDrained;
     /**
      * Where a notice about an agent's own action belongs: its failed reply, its
-     * bounced prose (beside its `{{unsent}}` clipboard), its background script's
-     * wake, the notices about its drafts. Every registered agent's notice is
+     * bounced prose (beside its `{{unsent}}` clipboard), its script's wake, the
+     * notices about its drafts. Every registered agent's notice is
      * addressed to that agent, so it lands in the window that agent reads and
      * waits on that agent's own turn, stream and tool cycle: a conversation
      * fork or an ephemeral run reads only its isolated slot, and a resident's
@@ -3368,9 +3793,10 @@ export declare class AgentFramework {
      * null when the agent is no longer registered (a fork or a run already
      * released): there is no window to write, so the caller writes nothing,
      * traces nothing and requests no wake. The drop is logged here, once. A
-     * failed reply is passed on by name instead (passFailedReplyToPrimary). The
-     * notice of a channel an agent's own send opened follows the same rule in
-     * recordChannelAutoOpenNotice, which passes it on by name too.
+     * failed reply is passed on by name instead (passNoticeToPrimary). The
+     * notices of a channel an agent's own send opened, or a reply couldn't
+     * open, follow the same rule in their builders (channelOpenedNotices,
+     * replyOpenFailedNotices), which pass them on by name too.
      */
     private noticeTargetFor;
     /**
@@ -3379,33 +3805,77 @@ export declare class AgentFramework {
      * (releaseWindowNowOrAfterResume), since a write could land mid-surgery.
      *
      * The agent never reads its window again, so every failed-reply notice it
-     * never read is passed to the primary, by name, once: each one stored in
-     * its window above its consumed watermark (flushed there at its turn's end,
-     * or stored while it was idle) and not heard at a tool boundary, and each
-     * one still queued for it. Writes still
-     * queued would wait for a boundary it never reaches, and the flush that
-     * finds it gone would drop them, so they land in its own window now, which
-     * Chronicle keeps for investigation. Its stream is over or cancelled, so it
-     * compiles nothing more. One path still stores after these writes: a
-     * `complete` that arrived while the agent still waited for tools awaits
-     * the spill of its last tool results, and stores them once that resolves,
-     * even if a watchdog has ended the run meanwhile. A tool boundary stores
-     * nothing for a round whose turn was stopped while its results were
+     * never read, and every channel notice it could act on and never read, is
+     * passed to the primary, by name, once (passesToPrimary,
+     * passOnFromReleasedWindow): each one stored in its window above its
+     * consumed watermark (flushed there at its turn's end, or stored while it
+     * was idle) and not heard at a tool boundary, and each one still queued
+     * for it, pending or un-acked. One with an entry still in the durable
+     * queue goes on only as that entry, under its own id and seq, so a crash
+     * before the ack below replays it once; a copy of it in the window decides
+     * only whether the agent read it. Writes still queued would wait for a
+     * boundary it never reaches, and a flush that finds it gone would drop all
+     * but the notices it passes on, so they land in its own window now, which
+     * Chronicle keeps for investigation. One whose earlier write may have
+     * landed (`landing` unknown) is looked up there by its id first, or, where
+     * the store can't be searched, in the window's own read: found, it isn't
+     * stored again; where neither can see the store, it's stored anyway, with
+     * a line saying it may now be stored twice, or, where storing it fails
+     * too, that it may be stored once, twice or not at all. Its stream is over
+     * or cancelled, or, when stop() ends it, may still run past its cancel, and
+     * then drops each event that comes after the agent has left (driveStream);
+     * a turn of its still assembling or compiling, as when stop() ends it,
+     * drops before it sends anything. One path still stores after these
+     * writes: a `complete` that arrived while the agent still waited for tools
+     * awaits the spill of its last tool results, and stores them once that
+     * resolves, even if a watchdog has ended the run meanwhile. A tool boundary
+     * stores nothing for a round whose turn was stopped while its results were
      * prepared.
      */
     private releaseWindow;
     /**
-     * The failed-reply notices stored in `agent`'s window that it never read:
-     * those above the lower of its consumed watermark and the point where the
-     * watermark's branch and the current one part (branchesPartAt), or every
-     * one, when it never compiled. The watermark moves at a compile, and at a
-     * tool boundary whose
-     * stream declares it carries the messages injected there
-     * (markContextConsumed), so a notice the live stream heard is under it, and
-     * one a boundary stored without sending (a turn a tool ended, a budget
-     * restart, a stream that may drop injections) is above it.
-     */
-    private unreadFailedReplies;
+     * The part of a released agent's pass to the primary that its release and
+     * stop() share (stop() runs it for a release the quiesce postponed). Each
+     * notice stored in its window that it never read and the primary takes in
+     * its place (passesToPrimary: a failed reply, or a channel notice its
+     * reader could act on) goes on as stored, by name (passNoticeToPrimary),
+     * except a copy of an entry for it still in the durable queue, pending or
+     * un-acked: that entry is the notice's one identity until its ack, the one
+     * boot's check for landed writes knows, so it's the entry that goes on, as
+     * the primary's by-name notice under its own id and seq (`passOn`,
+     * queuedNoticeForPrimary), and a crash before the ack replays it once, not
+     * twice. A queued notice goes on unless the agent read a copy of it that
+     * landed in its window; where the window can't be read, it goes on, since
+     * telling the primary of a notice the agent may have read costs less than
+     * telling no one. Both callers run this before their drain, which hands
+     * pending entries to the un-acked set, so the un-acked entries for the
+     * agent here have all landed (their write went through, or a lookup found
+     * it: settleFound), and they go on here; the pending ones are the
+     * caller's. Returns the window's read, `passOn`, what it has queued so far
+     * for the primary, and how many un-acked entries the agent had.
+     */
+    private passOnFromReleasedWindow;
+    /**
+     * What a released agent's window holds that its pass to the primary reads
+     * (passOnFromReleasedWindow): `unread`, the notices stored there that it
+     * never read and the primary takes in its place (passesToPrimary: its
+     * failed replies, and the channel notices it was told it could act on),
+     * other than copies of the entries `held` names; and `held`, for each of
+     * those entries with a copy there, its copies and whether any of them is
+     * unread. A notice is read below the lower of its consumed watermark and
+     * the point where the watermark's branch and the current one part
+     * (branchesPartAt), and unread everywhere when it has no watermark. The
+     * watermark is set when the agent is created, and moves at a compile, and
+     * at a tool boundary whose stream declares it carries the messages
+     * injected there (markContextConsumed). So a notice such a stream carried
+     * is under it. One a boundary stored without sending (a turn a tool ended,
+     * a budget restart) is above it, and so is one injected into a stream that
+     * doesn't declare it carries injections, which may have dropped it:
+     * counted as unread, it goes to the primary even if the agent heard it,
+     * rather than to no one where the stream dropped it. null when the window
+     * can't be read, which is logged.
+     */
+    private releasedWindow;
     /**
      * The last sequence two branches' histories share: Infinity for one branch,
      * and for two, the point where they part. A branch's records are numbered
@@ -3424,39 +3894,71 @@ export declare class AgentFramework {
      * deregistered, so its stream can't dispatch anything more and resume
      * doesn't weigh its context, and a write addressed to it meanwhile is
      * treated as for any agent no longer registered (dropped, or passed to the
-     * primary if it's a failed reply).
+     * primary if it's a failed reply, or a channel notice its reader could act
+     * on).
      */
     private releaseWindowNowOrAfterResume;
     /** resume(): the windows whose release the quiesce window postponed, each on its own. */
     private runReleasesAfterResume;
     /**
-     * A fork or an ephemeral run ended before reading that its reply's delivery
-     * to a channel failed: it was released with the notice stored in its window
-     * unread, or its delivery failed after release. (A notice still queued for
-     * it, at release or restored at boot, goes on as the queue entry itself:
-     * queuedFailedReplyForPrimary.) Tell the primary instead, naming the
-     * speaker, so an agent who can still act learns of it and can tell the
-     * human. It gives the reply's length, not its words, which stay in the
-     * speaker's window. Its wording follows the speaker's own notice
-     * (onRouteFailure): a delivery that wasn't confirmed may have been posted,
-     * and neither text says no one saw the reply, since only this channel's
-     * routing failed. Only for a delivery to a channel; a reply that had no
-     * channel to go to (no locus) had no human waiting for it. Never throws:
-     * it runs inside a release, which must complete whatever this write meets.
-     */
-    private passFailedReplyToPrimary;
-    /**
-     * A queued failed-reply entry for `speaker`, who is gone, as the primary's
-     * by-name notice (passFailedReplyToPrimary's words): the same entry, under
-     * its own id and seq, now addressed to the primary. Written through the
-     * drain, it lands stamped with that id, or waits in the queue under it, so
-     * boot's exactly-once holds for it: a crash before the original's ack
-     * replays one entry, never the original and a separate notice. null when no
-     * one is told (logged): a reply that had no channel to reach, or no primary.
-     */
-    private queuedFailedReplyForPrimary;
+     * A fork or an ephemeral run ended before reading a notice the primary
+     * takes in its place (passesToPrimary): it was released with the notice
+     * stored in its window unread, or, for a failed reply, its delivery failed
+     * after release. (A notice still queued for it, at release or restored at
+     * boot, goes on as the queue entry itself: queuedNoticeForPrimary.) Tell
+     * the primary instead, naming the speaker, so an agent who can still act
+     * learns of it (noticeForPrimary). Never throws: it runs inside a release,
+     * which must complete whatever this write meets.
+     */
+    private passNoticeToPrimary;
+    /**
+     * A queued entry for `speaker`, who is gone, that the primary takes in its
+     * place, as the primary's by-name notice (noticeForPrimary): the same
+     * entry, under its own id and seq, now addressed to the primary. Written
+     * through the drain, it lands stamped with that id, or waits in the queue
+     * under it, so boot's exactly-once holds for it: a crash before the
+     * original's ack replays one entry, never the original and a separate
+     * notice. An entry marked as one whose earlier write may have landed
+     * (`landing`) keeps the mark, so before it's written it's looked up by its
+     * id in the primary's window, where it would land now
+     * (writeDrainedInOrder). A release has looked in the speaker's own window
+     * first (releaseWindow). null when no one is told (logged where it's
+     * decided).
+     */
+    private queuedNoticeForPrimary;
+    /**
+     * The primary's by-name notice in place of one `speaker` never read, and
+     * what it's about, as a log line says it: a failed reply's
+     * (failedReplyNoticeForPrimary) or a channel notice's
+     * (channelNoticeForPrimary). null when no one is told, which is logged
+     * where it's decided.
+     */
+    private noticeForPrimary;
+    /**
+     * The primary's by-name notice in place of a channel notice `speaker` was
+     * told it could act on and never read: its builder, called again now that
+     * `speaker` has ended, gives the words it gives an agent that has ended,
+     * judged for the primary, or nothing, logged, with no primary to tell.
+     * They speak of the open or the failure as it was, as the notice did, a
+     * failed one's reason for its selection included, which an agent's
+     * channel_open since replaces in the record and not in the words, and
+     * only of what still holds by each channel's durable decision on its own
+     * server: the registry's (getDesiredState), or before there is one, as at
+     * a serving boot's flush, the lifecycle log's (desiredStateInLog). An
+     * opened channel is kept while it's decided open or tuned out, whatever its
+     * transport is doing at that moment: the decision is what channel_close
+     * changes and what the host carries out once the transport is back, and at
+     * a serving boot no transport is up yet. A failed one is kept only while
+     * it's still decided open and its transport isn't open, since "Not open"
+     * would misstate an open one. One tuned out since is left out too: the
+     * tune-out is a newer decision, by an agent that knows the channel, and
+     * the notice's reason and its channel_open advice, which a tuned-out
+     * channel refuses, would misstate it. With nothing left, no one is told,
+     * logged here.
+     */
+    private channelNoticeForPrimary;
     /** The primary's by-name notice of `speaker`'s failed reply, or null when no
-     *  one is told, which is logged here (see passFailedReplyToPrimary). */
+     *  one is told, which is logged here (see passNoticeToPrimary). */
     private failedReplyNoticeForPrimary;
     /**
      * A channel as a notice names it: the label when the registry has one, since
@@ -3479,17 +3981,18 @@ export declare class AgentFramework {
      * slot (sharedSlotAgents). A write whose target is gone isn't among them:
      * no module reads that agent's store, and the write waits for its window's
      * release (drainDeferredFor) or, at its flush, is dropped (addMessage), a
-     * failed reply passing to the primary as its notice
-     * (queuedFailedReplyForPrimary).
+     * failed reply, or a channel notice its reader could act on, passing to the
+     * primary as its notice (queuedNoticeForPrimary).
      */
     private heldWritesFor;
     /**
      * The writes held for `reader`'s store (heldWritesFor) as the rows a
-     * module's context reads: each under its handle, marked `held`, with the
-     * participant, content and metadata it was written with, the time it was
-     * first held as its timestamp, and a sequence after every row the store
-     * holds, in queue order. The sequence and timestamp are provisional: the
-     * stored row has the store's own.
+     * module's context reads: each under its handle, marked `held`, and
+     * `heldFromResidents` too when its metadata carries a tune-out's stamp
+     * (asModuleRow), with the participant, content and metadata it was
+     * written with, the time it was first held as its timestamp, and a
+     * sequence after every row the store holds, in queue order. The sequence
+     * and timestamp are provisional: the stored row has the store's own.
      */
     private heldRows;
     /** The row a held write landed as, found by the id it's stored with
@@ -3497,6 +4000,54 @@ export declare class AgentFramework {
      *  as addMessage answers a stored write. Null when it hasn't landed, or is
      *  no longer in the store. */
     private landedRow;
+    /**
+     * Settle held writes whose landing is unknown (DeferredWrite.landing),
+     * among those `which` picks, before a path reads or changes held writes:
+     * each is looked up by its id in its target's store (landedCopiesById).
+     * Found, the write landed (settleFound). Not found, the mark goes, and
+     * it's an ordinary held write, which is persisted as an edit is. Where the
+     * store can't be searched, it stays marked, a doubt each path reads by its
+     * own rule.
+     */
+    private settleUnknownLandings;
+    /**
+     * A marked held write found to have landed, as `stored`: it leaves the
+     * pending queue for the un-acked set, as a drained write does, so it stays
+     * in the durable queue until the next ack has synced the store that holds
+     * it, and it's a stored write from then on, so the paths for a landed
+     * write apply to it. It takes the notes a store takes (noteStored), which
+     * its first write missed when it threw, as a flush that finds such a write
+     * takes them (readdDrained), and is logged by its id. It isn't carried
+     * into a turn, as a flush that finds it carries it: the agent reads it at
+     * its next compile, where the store holds it.
+     */
+    private settleFound;
+    /**
+     * A stored row a module names by its id: where it carries the
+     * deferredWriteId of a marked held write the reader's store holds, it's
+     * that write's copy, so the write landed, and it's settled as found
+     * (settleFound) before the row is read or changed. A lookup by the id
+     * can't be needed then, so this holds where the store can't be searched
+     * too.
+     */
+    private settleByCopy;
+    /** A held write whose landing stays unknown after settling, its store
+     *  unsearchable, can't be edited or removed: it may already be stored, and
+     *  changing only the queued entry could leave its stored copy as it was.
+     *  Throws with nothing changed. */
+    private refuseUnsettled;
+    /** Whether the agent has nothing left to read of a deferred write, on
+     *  evidence only: the row it landed as is at or below the agent's consumed
+     *  watermark on its current branch, or it's in neither the queue (drained
+     *  entries not yet stored included) nor the store's current branch:
+     *  removed, or left on a branch the agent has switched from, where a turn
+     *  now would find nothing of it (switching back brings it back unread,
+     *  with no wake, as main's wake spent on this branch leaves it). Any doubt
+     *  reads as unread, such as a watermark that a branch switch or an undo
+     *  left on another branch, or a store that can't be read: a turn that
+     *  finds nothing new costs less than a write no wake brings the agent to
+     *  read. */
+    private deferredWriteReadOrGone;
     private editMessage;
     private removeMessage;
     private getMessage;
@@ -3654,80 +4205,132 @@ export declare class AgentFramework {
      *  closeAll does. `timeoutMs` bounds the wait without cancelling cleanup. */
     private closeModernMcpConnections;
     /**
-     * Reconcile the durable ledger with Chronicle, then deliver every server's
-     * work. A drain still running is waited for and then followed by a fresh
-     * pass (drainForGeneration). Like the other operator entry points, it's
-     * refused once stop() has begun, and stop() waits for one already running.
-     * The framework's own branch moves start their delivery without awaiting
-     * it (startDiscordAwarenessDelivery).
+     * Deliver every server's queued awareness operations now (or only
+     * `onlyServerId`'s) and wait for this pass, and for a pass already under
+     * way on a server, whose last request may still be on the wire with
+     * nothing left due. Like the other operator entry points, it's refused
+     * once stop() has begun, and stop() waits for one already running.
+     * Delivery never gates MCPL traffic or turns: the framework's own
+     * deliveries run in the background (deliverDiscordAwarenessInBackground).
+     * A server that is not connected is skipped (its work stays queued until
+     * it connects).
      */
     syncDiscordAwarenessMarkers(onlyServerId?: string): Promise<void>;
-    /** The sync's work. It installs the MCPL data-plane gate before its first
-     *  await, so a caller that starts it while holding the store puts the gate
-     *  up before releasing the store. */
+    /** One delivery pass over every server with due work, or only `onlyServerId`'s. */
     private runDiscordAwarenessSync;
+    /**
+     * Finish the removals of every suppression pending on the active branch
+     * (an interrupted surgery's, or a version 2 ledger's that 0.22.x never
+     * activated). Its batch is then retired, none of its marks sent, and
+     * reported with the redo that applies them (reportRetiredAwareness): a
+     * start never activates a surgery's marks. An interval whose messages are
+     * only partly present can't be finished safely, and stops the start.
+     */
     private resumePreparedDiscordSuppressions;
     /**
-     * Deliver every due ref independently. Permanent Discord failures are kept
-     * in the ledger for audit but do not block later operations; retryable
-     * failures remain pending for the next reconnect/list-change attempt.
-     * Once stop() has begun, a drain sends nothing more and records nothing
-     * for what it hasn't sent: that stays pending, as it was, for the next
-     * start's barrier. stop() closes the connections and then waits for each
-     * drain still running to record the call it had in flight.
+     * The start's reconciliation of the awareness ledger, before any
+     * delivery. It derives nothing from branch ancestry and activates nothing
+     * (recoverAtStartup): a batch an interrupted surgery left is retired, none
+     * of its marks sent, except a suppression whose removals are pending, which
+     * a start on its branch finishes (resumePreparedDiscordSuppressions); a
+     * request the previous process left on the wire is recorded unanswered. No
+     * content is read. Before it writes any of that, it logs what it does,
+     * reports each retirement (reportRetiredAwareness) and raises the delivery
+     * alert for reactions that reach the bound: each is written once, so a
+     * notice given after the write would be lost for good if the write landed
+     * and the process ended before the notice. A ledger it can't read stops
+     * the start: it can't tell whether a suppression's body is pending.
+     */
+    private reconcileDiscordAwarenessAtStartup;
+    /** What a start's reconciliation retires and records unanswered, before it is written. */
+    private announceDiscordAwarenessRecovery;
+    /**
+     * A version 2 ledger's rewrite as version 3, before it is written (the
+     * outbox's announceImport): the work agent-framework 0.22.x had still to
+     * do is never sent, since nobody chose it, and the batches it never
+     * activated are retired (a suppression whose body may be pending, once a
+     * start on its branch finishes the body). A retract of a batch 0.22.x
+     * activated takes off the mark of the batch's emoji from each of its
+     * messages, whichever batch placed it.
+     */
+    private announceDiscordAwarenessImport;
+    /**
+     * Report a batch a start retires, before that is recorded, with the redo
+     * that applies what was lost: the
+     * surgery again from its source, if that still has every message the
+     * surgery removed (a hide there, or the source's deletion, changes that),
+     * onto a new branch name, choosing marks again (framework.switchBranch,
+     * then rollbackToMessage or suppressMessages; offline, the recover CLI).
+     * A batch doesn't say which surgery made it: an offline recovery's reads
+     * as a rollback's, or as a suppression's when the recovery suppressed, so
+     * the report names both. One with marks not applied raises an ops alert;
+     * one without (no marks chosen, or its marks cancelled) is only logged.
+     */
+    private reportRetiredAwareness;
+    /**
+     * Deliver one server's owed awareness requests, one at a time, oldest act
+     * first. Every request is written ahead to the ledger before it can leave,
+     * and its answer is recorded from what the connection can actually know
+     * (McplRequestError.outcome): a request that was never written stays
+     * owed, one written and never answered may land, and a Discord answer is
+     * definitive (permanent when Discord says the message or channel is gone
+     * or inaccessible). A server that is not connected is skipped: its work
+     * simply stays queued.
      */
     private drainDiscordAwarenessOutbox;
-    private readDiscordAwarenessPending;
-    private writeDiscordAwarenessSuccess;
-    private writeDiscordAwarenessFailure;
-    private beginDiscordAwarenessBarrier;
-    /**
-     * One server's drain for a new generation: a gate completes only after
-     * every operation pending when it was armed has been attempted. A drain
-     * already running can't promise that. It never re-sends a key it has
-     * attempted, so an operation re-pended while it runs (a rollback, its undo,
-     * then a redo, all mid-drain) stays pending, and it may already have made
-     * its last read of the ledger, missing a batch activated since. So a
-     * generation that finds a drain running waits for it, then drains again
-     * with a fresh pass that reads the ledger anew. Two generations waiting on
-     * the same drain share the fresh pass that follows it. Once stop() has
-     * begun, a drain sends nothing more, so a gate armed then completes with
-     * what it found pending left for the next start.
-     */
-    private drainForGeneration;
-    /**
-     * Wait out the awareness gate for an inbound event: the generation current
-     * now, and any generation installed while waiting, until none is current
-     * or the current one is one already waited for. A handler that waited only
-     * for the generation it first saw would go on behind a newer one armed
-     * meanwhile. Rejects as the generation it waited for rejects.
-     */
-    private awaitDiscordAwarenessBarriers;
+    /**
+     * One pass of drainDiscordAwarenessOutbox. It leaves the registry in the
+     * microtasks that follow its last claim, a claim that found nothing owed,
+     * so a registered pass always has a claim ahead of it or running: a
+     * trigger that joins it is served by it, unless its route goes away or
+     * stop() begins first, when the pass stops claiming and the work stays
+     * queued for the next pass. Within a pass, a request is claimed once; a
+     * trigger that joined it also has what the pass already tried claimed
+     * once more before it leaves, so an operator's sync, a retract or a
+     * reconnect meeting a running pass doesn't leave a retryable mark untried. A request made owed after its last claim
+     * starts a new pass: the act that makes it owed runs after that claim's,
+     * and resolves only once its write is on disk, by when the pass has left.
+     * Leaving any later, when its promise settles, would let a request join a
+     * pass that will never claim again, and that work would stay due until
+     * some unrelated trigger.
+     */
+    private runDiscordAwarenessDrain;
+    private readDiscordAwarenessDue;
+    /**
+     * Open MCPL connections' planes (every connection when none is given). A
+     * connection whose policy exchange is in flight stays closed, both planes,
+     * until its grant exists: its exchange's caller opens it once that settles
+     * (mcplPlanesMayOpen). A quiesced host (issue #122) opens only control
+     * planes, so data planes stay held for the whole maintenance window;
+     * resume() calls this again once the flag is cleared. Otherwise a control
+     * plane comes up even while quiesced, since host/command (and with it
+     * resume) rides it.
+     */
+    private readyMcplPlanes;
     /**
      * Per connection, the transport epoch whose §5.3 policy exchange is in
      * flight: a connect's, from when the registry hands the connection back,
      * or a reconnect's, from its 'reconnect' event. Until the exchange settles,
-     * that transport's traffic must wait for its grant, so a gate that opens
-     * every connection's planes meanwhile (another server's list change, a
-     * resume, an awareness sync, startup's staged open) passes it by
-     * (mcplPlanesMayOpen), and the exchange's own caller opens them once it
-     * settles (openMcplPlanesAfterExchange).
+     * that transport's traffic must wait for its grant, so readyMcplPlanes,
+     * which a resume and startup's staged open run over every connection,
+     * passes it by (mcplPlanesMayOpen), and the exchange's own caller opens its
+     * planes once it settles.
      */
     private readonly mcplPolicyExchanges;
-    /** Whether a gate may open this connection's planes: no policy exchange is
-     *  in flight on its current transport (see mcplPolicyExchanges). */
+    /** Whether readyMcplPlanes may open this connection's planes: no policy
+     *  exchange is in flight on its current transport (see mcplPolicyExchanges). */
     private mcplPlanesMayOpen;
     /**
      * Run a connection's §5.3 policy exchange with its planes held: it is
-     * marked in flight for the transport it runs on, so no gate releases that
-     * transport's traffic before its grant exists. With `epoch`, it runs only
-     * on that transport: a runtime connect passes the one it registered, and
-     * if that transport is gone, the exchange isn't run, since a reconnect
+     * marked in flight for the transport it runs on, so no opener releases
+     * that transport's traffic before its grant exists. With `epoch`, it runs
+     * only on that transport: a runtime connect passes the one it registered,
+     * and if that transport is gone, the exchange isn't run, since a reconnect
      * that adopts a next transport, if one comes, runs that one's. With
      * `closeOnFailure`, as for a runtime connect or restart, an exchange that
      * throws closes the connection for good, through the registry, before it
      * lifts the marker: left live, the connection would be half registered,
-     * and unmarked before its close, a gate completing in between would let
+     * and unmarked before its close, an opener running in between would let
      * out what it held with no grant. A close that fails keeps the connection
      * registered, but closed for good, it readies nothing but its own reports.
      * Without `closeOnFailure`, as for a reconnect or a staged startup connect,
@@ -3735,32 +4338,6 @@ export declare class AgentFramework {
      * reached, empty if the policy step itself threw, and the marker lifts.
      */
     private settlePolicyExchange;
-    /**
-     * Open a connection's planes once its exchange has settled, when the gate
-     * its connect or reconnect installed was replaced during the exchange: the
-     * newer gate passed the connection by, and if it has completed, nothing
-     * else would open it. A connection whose transport dropped meanwhile is
-     * readied as any gate readies one between transports, so its own reports
-     * go on. How far follows what is held now: while a gate is up, only the
-     * control plane opens, since a gate holds data planes alone, and its
-     * completion, which no longer passes this connection by, opens the data
-     * plane; a quiesced host (issue #122) likewise opens only control planes;
-     * otherwise both open.
-     */
-    private openMcplPlanesAfterExchange;
-    /**
-     * Install one framework-global Discord-awareness generation before releasing
-     * any inference-bearing event. With pending work or a drain still running,
-     * every MCPL data plane is paused while the control planes remain live,
-     * but for a connection whose policy exchange is in flight, which neither
-     * the release nor the completion opens (mcplPlanesMayOpen).
-     * With neither, ready() runs synchronously so request responders preserve
-     * their historical same-stack behavior.
-     */
-    private installMcplDataPlaneGate;
-    private releaseMcplDataPlaneGate;
-    private completeMcplDataPlaneGate;
-    private failMcplDataPlaneGate;
     /**
      * Close a legacy connection for good through the registry. A close that
      * can't confirm its child exited keeps the connection registered, holding
@@ -3840,6 +4417,13 @@ export declare class AgentFramework {
      * disconnect are resumed, not reset.
      */
     private registerMcplServerFeatures;
+    /**
+     * Whether this server's child takes the framework's protective reaction
+     * default: a stdio server with no baseline declared in its env or
+     * inherited from the host. Only such a connect reads the awareness
+     * ledger (getPlacedReactionBaseline).
+     */
+    private derivesReactionBaseline;
     /**
      * Snapshot the protective Discord reaction default for this deployment, as
      * suppression tokens: the forms the Discord adapter's suppression matcher
@@ -4060,8 +4644,7 @@ export declare class AgentFramework {
      * A list change, including the relist after a reconnect, takes the legacy
      * engine's refresh path (`handleToolsListChanged`), so any wake it causes
      * goes through ordinary admission: it parks under quiesce or a hold like
-     * every other wake. It installs no awareness gate, since that gate orders
-     * MCPL data-plane traffic, which this family doesn't carry.
+     * every other wake.
      */
     private wireModernEvents;
     /** An MCP tool call's trace: a result the server marked an error (or one
@@ -4113,6 +4696,9 @@ export declare class AgentFramework {
      *  is in flight (mcpServerOps) or a restart holds the id, and "gone"
      *  otherwise. */
     private mcplServerAbsentText;
+    /** Whether a connect of this server id is in flight (mcpServerOps), or a
+     *  restart holds the id: this host is connecting to it. */
+    private mcplConnectInFlight;
     /** A modern connection a connect still under way registered: it registers
      *  before it starts, so until its first session is up it's no server to
      *  call, and a call reads the "connecting" text, as one during a legacy
@@ -4189,9 +4775,10 @@ export declare class AgentFramework {
      * every sibling in the round to settle; if one never does, fail closed
      * rather than trust an index the batch may still change. Sibling saves
      * produce no images and are not waited on (two saves in one batch would
-     * otherwise deadlock into a double timeout). Script-inner calls
-     * (`pytc-…`) run sequentially inside their script host and skip the
-     * barrier — the host call itself is the only pending sibling they'd see.
+     * otherwise deadlock into a double timeout). A script's own calls
+     * (`pytc-…`) skip the barrier: the batch's pending siblings include the
+     * code_execution call running that script, so waiting on them would wait
+     * on itself.
      */
     private awaitSiblingToolCalls;
     /**