@animalabs/agent-framework 0.26.2 → 0.27.0

package/dist/src/framework.d.ts

@@ -1,10 +1,11 @@
 import { type PresentationSnapshot } from "./tool-presentation.js";
 import { JsStore } from '@animalabs/chronicle';
 import type { Membrane, NormalizedRequest } from '@animalabs/membrane';
+import { type RetrySettings } from '@animalabs/membrane/retry';
 import { ContextManager } from '@animalabs/context-manager';
 import type { TokenBudget } from '@animalabs/context-manager';
-import type { FrameworkConfig, TraceEventListener, InferenceLogQuery, InferenceLogQueryResult, InferenceLogEntryWithId, ProcessLogQuery, ProcessLogQueryResult, ProcessLogEntryWithId, ProcessEvent, ToolCall, ToolResult, AgentConfig, InferenceRequest, Module, ContextMaintenanceSnapshot, AgentRuntimeSettingsPatch, AgentRuntimeSettingsSnapshot, SameRoundThinkTextPolicy } from './types/index.js';
-import { Agent } from './agent.js';
+import type { FrameworkConfig, ErrorPolicy, ErrorAction, TraceEventListener, InferenceLogQuery, InferenceLogQueryResult, InferenceLogEntryWithId, ProcessLogQuery, ProcessLogQueryResult, ProcessLogEntryWithId, ProcessEvent, ToolCall, ToolResult, AgentConfig, InferenceRequest, Module, ContextMaintenanceSnapshot, AgentRuntimeSettingsPatch, AgentRuntimeSettingsSnapshot, SameRoundThinkTextPolicy } from './types/index.js';
+import { Agent, type RenderStats } from './agent.js';
 import { type ToolClass, type ToolClassSource } from './mcpl/tool-classes.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
@@ -160,6 +161,42 @@ export declare class ProviderWaitNotSleptError extends Error {
 interface InferenceToolSnapshot {
     sameRoundThinkTextPolicy: SameRoundThinkTextPolicy;
 }
+/**
+ * Default error policy: membrane's own retry schedules, decided here.
+ *
+ * The framework's turns pass `retry: false` to membrane, so a failure reaches
+ * this policy after one send, and the framework is the one retry layer: each
+ * retry is a fresh compile, a stop cancels its wait, and the wait is seen.
+ * The decision is membrane's (`@animalabs/membrane/retry`), on the settings
+ * given (membrane's defaults unless a host passes its own, e.g. from a
+ * recipe's retry config):
+ * - not retryable (400 invalid_request, 401 auth, context_length, safety,
+ *   a caller-code error): terminal on the first failure. Retrying them burns
+ *   API quota without any chance of success; production traces showed clerk +
+ *   reviewer wasting 4 inferences on each 400 due to blind retries.
+ * - overloaded (a 529, or an overloaded error mid-stream): the overloaded
+ *   schedule, jittered (by default 7 tries, 10 s doubling to 5 min, ~10 min).
+ * - rate limited (429): the base schedule with at least 5 tries.
+ * - any other retryable failure, a stream deadline on a sent request
+ *   included (membrane leaves those to its caller): the base schedule (by
+ *   default 3 tries, 1 s then 2 s).
+ * A provider's stated wait (`retryAfterMs`) is waited when it is longer than
+ * the backoff, up to the framework's own cap (PROVIDER_ACCELERATION_MAX_
+ * COOLDOWN_MS, ten minutes) where a schedule's ceiling is lower; past it the
+ * turn ends here. (Before this policy runs, the framework holds a resident
+ * for a stated wait or an acceleration 429 itself, and ends an ephemeral run
+ * on a wait past that cap; see holdProviderAcceleration and
+ * nonOwningProviderWait.)
+ * An error that isn't a MembraneError is retried as a retryable failure, on
+ * the base schedule.
+ */
+export declare class DefaultErrorPolicy implements ErrorPolicy {
+    /** The most retries any class allows (ErrorPolicy's bound, for readers). */
+    readonly maxRetries: number;
+    private readonly settings;
+    constructor(settings?: RetrySettings);
+    onInferenceError(error: Error, _agentName: string, attempt: number): ErrorAction;
+}
 /**
  * Whether the poison-history breaker may shed the newest exchange for a
  * failure: an `invalid_request` at HTTP 400, 413 or 422 or with no status, or
@@ -222,6 +259,29 @@ export declare class AgentFramework {
     private toolPresentations;
     private presentationPreviews;
     getRequestToolPresentation(request: object): PresentationSnapshot | null;
+    /**
+     * The render stats of the dry compile that built `request`, a request
+     * `previewActivation` returned (or `Agent.buildActivationRequest` with
+     * `dryRun`), as context-manager gives them in `CompileResult.renderStats`:
+     * what that compile's select put in the context, by kind. They count the
+     * selection, not each message of the request. The injections
+     * context-manager merges in after its select, such as those
+     * `previewActivation` gathers with `injections: true`, aren't counted;
+     * context-manager's doc of `CompileResult.renderStats` names what else its
+     * compile does after the select. The agent then changes the messages
+     * itself, and the stats come from before that: they count a message it
+     * drops, such as one left holding only blank text, and leave out the turns
+     * it adds, such as `[Continue]`, a silent heartbeat's separator,
+     * request-only turns, and the stand-ins `previewActivation` shows for the
+     * `afterUser` injections a start would store (stored-injections.ts). A
+     * later preview or live compile leaves them as they were.
+     * They're the object the compile returned, not a copy, so treat them as
+     * read-only: a change to them shows in every later read. Null for a request
+     * no dry run built, a request that is sent included, and when the agent's
+     * strategy records none (of context-manager's own, the autobiographical
+     * strategy and the knowledge strategy built on it do).
+     */
+    getRequestCompileStats(request: object): RenderStats | null;
     private store;
     private ownsStore;
     private stopPromise;
@@ -389,6 +449,10 @@ export declare class AgentFramework {
     /** Consecutive bounce-wakes per agent; capped so an agent that keeps
      *  emitting unprefixed prose can't wake-loop (notices still append). */
     private proseBounceStreaks;
+    /** Consecutive autoContinue continuations per agent, capped by its
+     *  maxConsecutive. Cleared when a turn starts with a cause of its own
+     *  (processInferenceRequests) or a tool ends a turn (skip_reply). */
+    private autoContinueStreaks;
     private pendingAssistantBlocks;
     /** Streams the FRAMEWORK cancelled for non-terminal reasons, keyed
      *  `${agentName}:${streamId}`: an endTurn tool result or a context-budget
@@ -521,6 +585,12 @@ export declare class AgentFramework {
      */
     private deferredScanFrom;
     private deferredMessages;
+    /** The marked held writes whose store couldn't be searched, each with the
+     *  failure said, said once until a lookup of them succeeds and again when
+     *  the failure changes (landedCopiesById), and those a drain has said it
+     *  holds what's queued behind (writeDrainedInOrder). */
+    private unsearchableSaid;
+    private stillUnknownSaid;
     private activeTurnTokens;
     /** Each running scheduler pass's requests, which it took from
      *  pendingRequests: it holds those of the agents it hasn't taken up yet
@@ -624,6 +694,9 @@ export declare class AgentFramework {
      * ephemeral agents have isolated slots and are their own only readers.
      */
     private readonly sharedSlotAgents;
+    /** The batched-wake lines already written (placeWakeLines), so every agent a
+     *  wake was for, and every later start of it, writes each at most once. */
+    private readonly placedWakeLines;
     /** Rounds of tool calls, by their results array, that a save_recent_image
      *  in the round counted by their share of the bound: such a round is
      *  stored by its share whether or not it fits (buildStoredToolResultContent). */
@@ -659,6 +732,21 @@ export declare class AgentFramework {
     private closingConversationAgents;
     private codeExecution;
     private scriptToolWaiters;
+    /** A script's call being dispatched, by its call id: what its script was
+     *  started with, its words' turn and reading. `turnId` is the turn the
+     *  script was started in, if one was (callingTurnOf); `readThrough` is the
+     *  consumed watermark its agent had when the run call started it, which a
+     *  publish the call makes is credited with (publishReadThrough). Kept only
+     *  while the dispatch runs (dispatchScriptToolCall). */
+    private readonly scriptCallStarts;
+    /** Per agent, the unexpected thinking drops its last operator alert counted (noteThinkingLoss). */
+    private readonly thinkingLossIncidents;
+    /** Per live stream that can be noted, its rows so far after the compiled messages (noteRoundSent). */
+    private readonly streamRequestNotes;
+    /** Per pending round's blocks (pendingAssistantBlocks' value), what membrane held as that round's reply
+     *  (`roundContent`, its results left out); null where the round has no `roundContent` (XML or fallback). Keyed by
+     *  the blocks themselves, so it goes wherever they go. */
+    private readonly pendingRoundSent;
     /** Per agent, a round that called code_execution and waits for those calls'
      *  results before its prose is routed (ScriptRound). */
     private scriptRounds;
@@ -741,6 +829,10 @@ export declare class AgentFramework {
     /** Host capabilities advertised during the MCP handshake — stored so servers
      *  can be connected at runtime (connectMcplServer) after initialization. */
     private mcplHostCapabilities;
+    /** MCPL RFC-014: every toolHints server's tool presence, for the
+     *  `toolsets` module's meta-tools and reminders. Made when the first
+     *  server configured with `toolHints: true` is set up; null until then. */
+    private toolsetHub;
     /** Inference routing policy from FrameworkConfig — stored so the MCPL
      *  subsystem can be lazily initialized by connectMcplServer when the
      *  framework started with zero configured servers. */
@@ -986,7 +1078,8 @@ export declare class AgentFramework {
      *  a stated 0, as in ProviderWaits: the 1 s floor, plus jitter. */
     private accelerationCooldownMs;
     /** Whether two requests are one wake, for a provider hold's dedup: the
-     *  same agent, reason, source, time and channel, and the same coalescing
+     *  same agent, reason, source, time and channel, on the same server (two
+     *  servers' channels can share an id), and the same coalescing
      *  marks: a batch wake's subject, a batch-only merge's subjects (it has no
      *  single subject), and the write a wake reads. A wake with any of them
      *  can be withdrawn or dropped on its own, and must not stand for one
@@ -1254,6 +1347,10 @@ export declare class AgentFramework {
      *  a read-write workspace mount without an include for storage). */
     private referenceFetcherInstance?;
     private getReferenceFetcher;
+    /** Configure an MCPL server: its config, for tool routing and the fetcher,
+     *  which reads a server's address and credential from it, and its address
+     *  in the reference registry, where a reference's stub reads it. */
+    private setMcplServerConfig;
     /** Register every RFC-005 reference in an MCPL peer's tool-result content
      *  against its server, then fetch by `mode`:
      *  - `register`: nothing. An in-process caller (executeMcplToolCall) may
@@ -1263,13 +1360,18 @@ export declare class AgentFramework {
      *    bound, so fetch_reference can fetch it.
      *  - `model`: eagerly fetch the ones inside the autofetch envelope (below
      *    the eager ceiling, connection origin — never worse than the server
-     *    having inlined the bytes). Failures are non-fatal: the stub then says
-     *    fetch_reference instead of a path.
-     *  - `script`: as `model`, then fetch every reference ("eagerly lazy"): a
+     *    having inlined the bytes, for a reference whose claim is true; a fetch
+     *    it starts stops reading at the first chunk past that ceiling).
+     *    Failures are non-fatal: the stub then says fetch_reference instead of
+     *    a path, and the eager default doesn't choose that reference again.
+     *  - `script`: as `model`, then fetch every reference but a link ("eagerly lazy"): a
      *    script receiving a result is the strongest available signal that the
      *    bytes are wanted (scripts process, they do not browse), so the stub it
      *    receives carries a workspace path it can open directly.
-     *  A uri the result calls expired is fetched in no mode. */
+     *  A uri the result calls expired is fetched in no mode: by its blocks, or
+     *  by `claims` where given, those of everything a script's view of it
+     *  shows (scriptViewClaims), nested fields included, as the module
+     *  route's demand fetch reads them (Ada-1017, room-203 #201013). */
     private autoFetchReferences;
     /** Core agent_settings keys — extension keys must not collide with these. */
     private static readonly AGENT_SETTINGS_CORE_KEYS;
@@ -1284,6 +1386,74 @@ export declare class AgentFramework {
     private spillSettingsExtension;
     private captureInferenceToolSnapshot;
     private toolResultGuardSettingsExtension;
+    /** Whether the agent wants the note on words that land in a closed channel:
+     *  on unless they've turned it off with agent_settings. */
+    private closedChannelNoteOn;
+    private closedChannelNoteSettingsExtension;
+    /** What `who` is told when their words go to a channel that stays closed
+     *  because it closed or declined the channel itself (ChannelRegistry
+     *  closedByAgent), or undefined where nothing needs saying. Speech also
+     *  leaves a channel a module closed as it stands (speechOpens), but there
+     *  the module's own tool is the way back. Every other closed channel opens
+     *  on speech where this host directs its server's lifecycle, as it always
+     *  did, so the agent meets the change here, where speaking used to reopen
+     *  what it had closed. The channel is read on the server the words went
+     *  to. A channel whose transport is open, as when its server refused the
+     *  agent's close, gets none, since its traffic still flows.
+     *
+     *  The rest is judged for its reader, as the opened notices' advice is
+     *  (channelOpenedNotices). That messages addressing it still reach it is
+     *  said where they land in its window: a push, and off a host that routes
+     *  conversations a channel's incoming message, is stored with the delivery
+     *  agent, where the residents' shared slot is read (residentHoldsTraffic),
+     *  and an ephemeral run's window is its own. What a closed channel
+     *  delivers beyond those is the connector's (slack-mcpl delivers ambient
+     *  traffic by its own subscription), so the note promises only those. One
+     *  connector state the host can't see makes that sentence false: a channel
+     *  muted with discord-mcpl's mute_channel delivers nothing, messages that
+     *  address the agent included. The agent that muted it knows. channel_open
+     *  is offered where the reader may call it (canAgentUseTool) and this host
+     *  may open the channel: everywhere but a server that's up without
+     *  channels.lifecycle (lifecycleWithheld), since a reconnecting server's
+     *  grant is empty only until its next exchange, and the note stays in the
+     *  window after that. */
+    private closedChannelNoteFor;
+    /** What an agent is told when a send tool's words go to a channel it tuned
+     *  out, or undefined where nothing needs saying. A send keeps the tune-out
+     *  (ChannelRegistry.openChannelNow), so the agent that sent there expecting
+     *  answers learns they still go to its subconscious. A send tool's answer
+     *  carries this, send_dm's included, or for a code_execution script's send
+     *  a notice in the agent's window: a tune-out diverts a DM too. The same setting
+     *  turns it off, a conversation agent gets none, and a failure while
+     *  working it out is logged and adds nothing, as for the closed-channel
+     *  note. */
+    private tunedOutSendNote;
+    /** How to stop the closed-channel note, said once wherever it appears, to
+     *  a reader that may call agent_settings (canAgentUseTool), with the space
+     *  before it; nothing to one that may not. */
+    private closedChannelNoteOff;
+    /** The closed-channel notes for an agent's words that landed in these
+     *  channels, or none when they've turned the note off. A conversation agent
+     *  gets none: channel_open is refused to it and its settings end with its
+     *  conversation, so neither what the note offers nor turning it off is its
+     *  own, and the resident that owns the channel gets the note for its own
+     *  words. The note is advice: if working it out fails, the words were still
+     *  delivered, so that's logged and nothing is added. */
+    private closedChannelNotes;
+    /**
+     * A send tool's answer, with the closed-channel note where its words
+     * stayed in a channel the agent closed or declined itself, or the tune-out
+     * line where they went to one it tuned out, after the server's own words:
+     * one more text block where the answer is a list of blocks, or a paragraph
+     * where it's text. A code_execution script's send (`forScript`) keeps the
+     * server's answer alone, since the script parses it, and the agent whose
+     * script sent is told in its own window instead, as a notice. The channel
+     * is the one the send went to on its server (resolveSendTarget), from the
+     * id the send's answer or its call named. The note is advice: if working it
+     * out fails, or the window can't take the notice, that's logged, and the
+     * answer stays as it was.
+     */
+    private noteSendIntoKeptChannel;
     /** Every guard's annotation still running, for stop() (agent-framework #277). */
     private readonly guardAnnotations;
     /** Each guard that isn't idle, by agent name, as the guard reports it. An
@@ -1650,10 +1820,9 @@ export declare class AgentFramework {
      * delegates to `Agent.buildActivationRequest`. No tokens are spent, no
      * external MCPL server is contacted, no fold resolution is persisted and
      * none of the compression its fold plan calls for is queued; the consumed
-     * watermark and any prepared budget change are left alone; and once
-     * context-manager's thinking binding (context-manager#160, not yet
-     * released) ships, no stamps are committed and no compile awaits
-     * acceptance. In context-manager 0.14 its dry run leaves nothing else
+     * watermark and any prepared budget change are left alone; and with the
+     * thinking binding (`thinkingBinding.binds`), no binding record is
+     * written. In context-manager 0.14 its dry run leaves nothing else
      * behind but the release of an expired compression hold, as any compile
      * does (see `Agent.compileWithInjections`). The preview keeps in-memory
      * bookkeeping of its own, such as handing the context manager the
@@ -1679,6 +1848,16 @@ export declare class AgentFramework {
      *
      * Pass `{ injections: true }` to opt into full-fidelity gathering and accept
      * those side effects (byte-faithful to a real activation's injected context).
+     * An `afterUser` injection a start would store (stored-injections.ts) is
+     * shown where that start's compile would render it, and one it would skip
+     * isn't shown again; nothing is stored. The stand-in isn't weighed against
+     * the budget or shaped as the stored row would be, so where the strategy
+     * would cap, shard or leave out rows to fit it, the start's request
+     * differs from the preview.
+     *
+     * What the dry compile selected, by kind, is `getRequestCompileStats` of the
+     * request this returns. It doesn't count the stand-in, which is added after
+     * the compile.
      */
     previewActivation(agentName: string, opts?: {
         injections?: boolean;
@@ -1747,11 +1926,21 @@ export declare class AgentFramework {
     getModule(name: string): Module | null;
     /**
      * Add or replace (upsert) a gate policy at runtime. Validated and persisted
-     * to gate.json; hot-applied in memory. Throws if no gate is configured or the
-     * policy is invalid. Placement: `'prepend'` puts a rule ahead of EVERYTHING
-     * (including addressed-message wake rules — see EventGate.lintShadows);
-     * `{before: name}` / `{after: name}` anchor it against a specific rule,
-     * which is usually what a sampler or debounce actually wants.
+     * to gate.json; hot-applied in memory. Placement: `'prepend'` puts a rule
+     * ahead of EVERYTHING (including addressed-message wake rules — see
+     * EventGate.lintShadows); `{before: name}` / `{after: name}` anchor it
+     * against a specific rule, which is usually what a sampler or debounce
+     * actually wants. Every rule the change doesn't touch is written back as it
+     * was written. Over a gate.json the gate doesn't use, the change is written
+     * only if gate.json then loads, as when it replaces or removes the rule that
+     * keeps it out. Fields the gate reads nowhere, and that aren't a slip of one
+     * it does, are left out, and named to `onIgnoredFields`, called once the
+     * change is made; a throw from it is logged, not thrown. Throws if no gate is
+     * configured, the policy is invalid, the placement can't be made, gate.json
+     * has no rule list a change could edit, it isn't used and the change doesn't
+     * mend it, or it can't be read, isn't JSON or can't be written
+     * (EventGate.addPolicy). A refusal leaves gate.json as it is; a write that
+     * fails after its open may leave it part-written, and its error says so.
      */
     addGatePolicy(rawPolicy: unknown, options?: {
         position?: 'append' | 'prepend' | {
@@ -1759,10 +1948,14 @@ export declare class AgentFramework {
         } | {
             after: string;
         };
+        onIgnoredFields?: (notes: string[]) => void;
     }): import('./gate/types.js').GatePolicy;
     /**
      * Remove a gate policy by name at runtime. Returns false if it didn't exist.
-     * Throws if no gate is configured.
+     * Throws if no gate is configured, gate.json has no rule list a change could
+     * edit, it isn't used and the removal doesn't mend it, or it can't be read,
+     * isn't JSON or can't be written (EventGate.removePolicy); the rules in
+     * force then stay as they were.
      */
     removeGatePolicy(name: string): boolean;
     /** Current gate policy names (freshest on-disk view). Empty when no gate. */
@@ -2582,8 +2775,9 @@ export declare class AgentFramework {
      * and keeping the agent registered would just grow every agent scan and
      * broadcast filter forever. Its window is released now, or, while the host
      * is quiesced, at resume (releaseWindowNowOrAfterResume); when stop() ends
-     * it then, stop()'s pass for postponed releases passes on the failed
-     * replies it left unread instead. No binding names it
+     * it then, stop()'s pass for postponed releases passes on what it left
+     * unread that the primary takes in its place instead (passesToPrimary:
+     * failed replies, channel notices, module writes). No binding names it
      * by then: the idle sweep unbinds its channel as the closure begins,
      * stop() unbinds it just before it ends the fork, and a spawn whose fork
      * stop() has ended binds nothing (spawnConversationAgent). The fork's
@@ -2643,14 +2837,22 @@ export declare class AgentFramework {
      * only that messages addressing the agent reach it whether or not it opens
      * the channel: it is shown only when one has arrived from a closed channel,
      * and both servers deliver them either way. What else arrives is for the
-     * server to say on its push. Option 1 says a reply opens the channel,
-     * because routeSpeech opens a closed channel before delivering into it. Its
-     * old follow-up warning assumed the channel stays closed after the reply,
-     * which that open makes false (and on discord-mcpl, channels/open also
-     * subscribes). When the surface tracks a missed-ambient tally
-     * (discord-mcpl sends `missedMessages`/`missedCharacters` in push origin),
-     * the invitation shows the count — the cost of staying out, as a number, at
-     * decision time.
+     * server to say on its push. Option 1 says what a reply does, which
+     * speechOpens decides: a reply opens a closed channel nobody decided to keep
+     * closed, and leaves one the agent closed or declined itself closed. What
+     * else reaches the agent from a channel left closed is its server's to say
+     * on its push, so the option says nothing about it. When the surface tracks
+     * a missed-ambient tally (discord-mcpl sends
+     * `missedMessages`/`missedCharacters` in push origin), the invitation shows
+     * the count — the cost of staying out, as a number, at decision time.
+     *
+     * No invitation on a direct message (`chat:dm`): every message of a DM is
+     * addressed, so it reaches the agent open or closed, and there is nothing
+     * to miss or open. A DM registers closed, and stays closed until the agent
+     * answers it, or for good once the agent closes it, so without this a DM
+     * would carry the block. The tag describes the message, not the channel:
+     * a whisper tagged `chat:dm` inside a shared channel that is closed
+     * carries no invitation either.
      */
     private buildClosedChannelInvitation;
     /**
@@ -2740,7 +2942,8 @@ export declare class AgentFramework {
     /** Queue a wake for each agent of the batch's audience, when its latest
      *  occurrence triggers inference. `plain`: an ordinary push wake, without
      *  the subject a withdrawal of the batch's wakes goes by, for a render
-     *  placed in its agent's deferred queue (wakeToRead), at `readsDeferredWrite`. */
+     *  placed in its agent's deferred queue (wakeToRead), at `readsDeferredWrite`,
+     *  marked ambient when every notice the render folds was (`allAmbient`). */
     private queueCoalescedWakes;
     /** Withdraw unstarted wakes whose sole cause is this subject (§4.2). */
     private cancelCoalescedWakes;
@@ -2776,6 +2979,34 @@ export declare class AgentFramework {
      * a fork is that fork's conversation, so no other agent takes it.
      */
     private mayTakeGateRoute;
+    /**
+     * The one channel a wake's channel names: `channelId` on `serverId` when
+     * the wake gives its server, otherwise the one registered channel that id,
+     * or its server-qualified name, means (ChannelRegistry.channelsNamed).
+     * Undefined when it means none or several: channel ids are unique only
+     * within one server's connection (MCPL §14.2), and a name two servers'
+     * channels answer to is never resolved to either.
+     */
+    private channelNamed;
+    /**
+     * Explicit mode's typing channel for one start of a turn, which has no
+     * locus, read once as the start opens (driveStream then shows what the
+     * start showed, TurnRouting.typing): where that start's wake came from,
+     * its trigger's channel with its server (channelNamed), so a start batched
+     * with a new wake shows typing where that wake came from. Not the turn's
+     * trigger channel, which a channel_open moves as the turn's default
+     * outgoing channel. A start whose wake names no one channel, as a budget
+     * restart's or a re-inference's names none, keeps the channel the turn
+     * shows typing in (TurnRouting.typing), showing it again where a stop or
+     * a failed start ended the indicator, since the turn is still at work
+     * there; a turn that has shown none, as a heartbeat's, shows none. A guard
+     * retry's wake is its start's, read again. In a turn that has no channel
+     * (TurnRouting.noChannel), a wake named without its server isn't read: a
+     * retry's trigger names it again, and reading it then could take a
+     * channel the turn never had. A wake that gives its server, as every one
+     * the framework makes for a channel does, names that pair.
+     */
+    private explicitTypingChannel;
     /**
      * Derive the MCPL composite channel id (the outbound routing locus) for a
      * push event from its server-defined `origin`, if it carries one.
@@ -2851,7 +3082,9 @@ export declare class AgentFramework {
     private draftTime;
     /** A draft's opening words, for the drafts tool's listing only. */
     private static draftPreview;
-    private static destinationText;
+    /** A destination as the agent is shown it: its label, with its name as
+     *  ChannelRegistry.nameShown gives it. */
+    private destinationText;
     /** One line per draft: id, state, when, why, size, preview. */
     private draftLine;
     /** A draft's state in words that claim only what is known. */
@@ -2882,6 +3115,16 @@ export declare class AgentFramework {
      * queue names.
      */
     private noticeUnnoticedDrafts;
+    /**
+     * Turn start, every one: where the agent's history holds neither its
+     * latest direct write to a mount nor the notice of its departure
+     * from it, as after an undo or another move of the store's head away from
+     * that write, the workspace's notice that those writes are still on disk
+     * goes into the history, privately, before the compile, as the drafts
+     * notice does, and the workspace keeps its id (headMoveNotice). On an
+     * unmoved head it finds nothing due and stores nothing.
+     */
+    private noticeHeadMoves;
     /**
      * Logical turn end, after the turn's deferred notices are flushed: record
      * as noticed exactly the drafts a stored message names (the receipt, a
@@ -2921,6 +3164,9 @@ export declare class AgentFramework {
      * drafts. Private to the calling resident. `resend` is an explicit send:
      * each draft is published verbatim, in order, through the normal publish
      * executor, its attempt journaled durably before the request leaves.
+     * `turn` is the turn the call was made in (callingTurnOf), none for a
+     * call made outside the agent's current turn: a resend's destination names
+     * its own channels (ownChannels) by their ids, and its sends engage it.
      */
     private handleDraftsTool;
     /** Why a draft can't be resent now (dismissed, or possibly already posted
@@ -2942,6 +3188,17 @@ export declare class AgentFramework {
      * ([discord-send-failed]); this is the success half.
      */
     private appendProseDeliveryReceipt;
+    /**
+     * The closed-channel note alone, in a send's words, at explicit mode's turn
+     * end, which has no `[delivered]` receipt since the agent named every
+     * destination itself. A `>>` into a channel the agent closed or declined
+     * leaves it closed, so the note goes wherever the turn's speech stayed in
+     * such a channel, once per channel. It goes through addMessage, as the
+     * open notices do: held while the agent has a turn alive and written at
+     * that turn's next boundary, so it reaches the agent once and never
+     * mid-turn. No-op otherwise.
+     */
+    private appendClosedChannelNoteAlone;
     /**
      * Announce-on-change locus notice (turn-frozen routing). Appends a durable
      * `[routing]` window message when the turn's effective outbound locus
@@ -2987,6 +3244,65 @@ export declare class AgentFramework {
      * window's all the same, so it's returned, and a tool boundary injects it.
      */
     private storeDueClock;
+    /**
+     * Store `agent`'s `afterUser` injections in its own window, as the
+     * messages `compile()` would have placed after the last user message, and
+     * return the injections left for `compile()` to place: the rest, and any
+     * that couldn't be stored (stored-injections.ts, #155 part 5). Which are
+     * stored, and which skipped, is planInjectionStores'.
+     *
+     * Nothing is stored while the window is held (slotHeldFrom: the host is
+     * quiesced, or another reader of the residents' shared slot has a turn
+     * alive, as for a clock row): `compile()` places what the plan would have
+     * stored, and what it skips, being in view already, isn't placed again.
+     * Rows are written in the order gathered. A row whose write throws is
+     * placed by `compile()` instead, with every row after it, unless the
+     * read-back shows it landed; where the read-back fails, a row whose write
+     * returned counts as landed and the rest are placed, so the request may
+     * carry a landed one twice, which is logged as unknown.
+     */
+    private storeInjections;
+    /**
+     * Which of `injections` a start stores in `agent`'s window, and which it
+     * leaves for `compile()`. Each source's stored kind (isStoredKind), by
+     * namespace, is one unit. A unit is skipped, neither stored nor placed,
+     * when the copy the agent will read as that namespace's current one has
+     * every part of it with the same content: the newest copy this agent
+     * stored since its last request compiled to send, where a start stored one
+     * and its compile then didn't record, as when it threw
+     * (Agent.unsentInjection), and otherwise the
+     * newest stored unit of that namespace the last request held
+     * (Agent.renderedInjection). It's where the agent saw it, or will see it
+     * at this compile, and placing it again would move it; a fold or scroll-out
+     * since costs one request, as below. A part the strategy cut at its
+     * per-message cap, or stripped an image from, counts as held, since a new
+     * copy would meet the same. One a fold has summarized, a strategy's window
+     * has scrolled past, a throwing write left part-stored, or that no request
+     * since this agent started has held (and no failed start since has
+     * stored), is stored again at the next start,
+     * so the agent has the current copy at the cost of one more row: a fold
+     * between two starts leaves the request after it with the summary's word,
+     * and the start after that stores it again. The rows to store come in the order gathered,
+     * as `compile()` would have placed them. A stored row is appended, so
+     * where the window ends on a user message (a turn's start, a restart
+     * after tool results) it lands where `compile()` would have placed it;
+     * where it ends on the agent's latest reply (a wake with nothing new), it
+     * lands after that reply, where `compile()` placed it after the last user
+     * message, before the reply, or at the end when there was none.
+     * Undefined when there's nothing of the stored kind.
+     */
+    private planInjectionStores;
+    /**
+     * Whether a write the framework makes into `agent`'s window of its own
+     * accord (a clock row, a batched wake's line) waits: while the host is
+     * quiesced, or, for a reader of the residents' shared slot (the
+     * subconscious, which reads it through a merged view, included), while
+     * another reader of it has a turn alive, where it would land inside that
+     * turn.
+     */
+    private slotHeldFrom;
+    /** Rows isNewestIn reads back past clock rows and stored injections. */
+    private static readonly NEWEST_SCAN_ROWS;
     /** Rows a window's last-clock scan reads at a time. */
     private static readonly CLOCK_SCAN_ROWS;
     /** What the next clock is planned from: the window's newest row's time and
@@ -3019,7 +3335,7 @@ export declare class AgentFramework {
      */
     private noteForOtherResidents;
     /**
-     * Show the turn's typing indicator in `channelId`, stopping the one it last
+     * Show the turn's typing indicator in `channel`, stopping the one it last
      * showed elsewhere: this stream's, or one an earlier stream of the turn
      * left running when it handed the turn on.
      */
@@ -3053,8 +3369,9 @@ export declare class AgentFramework {
      * when the server next registers the channel), or an open that the agent's
      * own delivery or reply caused (`opened-by-delivery`, `opened-by-reply`),
      * once its transport is confirmed. It names `channel_close` as the opt-out
-     * (neither the subscription policy nor the server's default reopens a
-     * channel the agent closed) only where the agent it's addressed to can
+     * (neither the agent's own speech there, the subscription policy nor the
+     * server's default reopens a channel the agent closed: speechOpens and
+     * ensureInitialDesiredState) only where the agent it's addressed to can
      * call it for every channel it names (canCloseChannels): a conversation
      * fork may close only its home channel, and an agent's allowedTools can leave
      * channel_close out. The other residents can read it too, where several
@@ -3099,14 +3416,14 @@ export declare class AgentFramework {
      */
     private channelOpenedNotices;
     /**
-     * Whether `who` can call channel_close for every one of `channelIds` here:
+     * Whether `who` can call channel_close for every one of `channels` here:
      * its allowedTools hold it (canAgentUseTool), and a conversation fork,
      * whose channel_close dispatchChannelToolCall refuses for any channel but
      * its home, only for its home.
      */
     private canCloseChannels;
     /**
-     * Whether `who` holds the traffic of every one of `channelIds`, so that
+     * Whether `who` holds the traffic of every one of `channels`, so that
      * what an open channel delivers is in its window. Where conversations are
      * routed, an incoming message goes to the fork its channel is bound to, or
      * nowhere, and never to the primary (handleMcplChannelIncoming), so a fork
@@ -3208,8 +3525,77 @@ export declare class AgentFramework {
      * a turn abandoned by a quiesce asks for none.
      */
     private requestProseContinuation;
+    /**
+     * autoContinue (AgentConfig.autoContinue): after a turn the model ended
+     * itself (AUTO_CONTINUE_STOP_REASONS), with prose or with nothing, queue
+     * another, unless its last word was a skip (`>>skip_reply`, or a hybrid
+     * `>>>skip_reply` hold still standing). Runs at the logical turn end of a
+     * stream's `complete`, after the turn's deliveries and `[delivered]`
+     * receipt, and only when the turn asked for no ` !` continuation (that one
+     * runs instead). A tool that ends the turn (skip_reply, sleep) never
+     * reaches here, and clears the run's count.
+     *
+     * It continues only an agent that has a way to stop it is offered: the
+     * skip_reply tool, or in explicit/hybrid mode a skip envelope. It leaves
+     * a turn whose closing prose bounced to the bounce, and never continues an
+     * ephemeral run or a conversation fork. The wake names
+     * the turn's locus, or the unresolved channel of a turn that had none, so
+     * the next turn speaks, or doesn't, where this one did; a batched message's
+     * channel outranks it. Its mark (InferenceRequest.autoContinueRun) holds
+     * what the `[continue]` row says, written as the turn starts
+     * (startAgentStream). A run is capped at maxConsecutive; the last allowed
+     * row says so, and the cap holds until a turn starts with a cause of its own.
+     */
+    private autoContinueAfterTurn;
+    /** How an autoContinue agent stops a run, as its `[continue]` row says it,
+     *  or undefined when no way is offered: the skip_reply tool when the
+     *  channel registry offers it and the agent may call it, else a skip
+     *  envelope in explicit or hybrid mode. */
+    private autoContinueStop;
+    /**
+     * Store a continuation's `[continue]` row in the agent's window as its turn
+     * starts (startAgentStream), with the run's count as it stands and the
+     * agent's cap. False when it couldn't be stored.
+     */
+    private writeAutoContinueNotice;
+    /** Whether another reader of the residents' shared slot has a turn alive,
+     *  so no row may be written there now (as storeDueClock checks). */
+    private sharedSlotBusy;
+    /** A continuation whose turn doesn't run: the run's count goes back to
+     *  what it was before it was queued. */
+    private giveBackAutoContinue;
     /** The agent's routing state for its current turn, made when it has none. */
     private routingOf;
+    /**
+     * A turn's own channels, every channel that has been its trigger or its
+     * locus (TurnRouting.wasIn), so a channel_open or a re-pin adds one and
+     * drops none: a `>>` target, a drafts resend's destination or a channel
+     * tool's name one of them answers to by its id means that channel, on its
+     * server (ChannelRegistry.ownChannelNamed). A tool call takes them only
+     * when it is made inside that turn (callOwnChannels).
+     */
+    private ownChannels;
+    /**
+     * The agent's current turn, where a tool call was made inside it, else
+     * none: a call made outside it, such as a script's left running after its
+     * turn, carries no turn (ToolCall.callerTurnId), and a script's call in a
+     * turn other than the one that started the script isn't that turn's. The
+     * one test for both what a call's names mean (callOwnChannels) and which
+     * turn's routing it may change: a channel_open's move of the trigger and
+     * locus, and the engagement of a send or a drafts resend. Read while the
+     * call is dispatched, since a script's start turn is kept only then.
+     */
+    private callingTurnOf;
+    /** What a publish a call makes is credited with having read
+     *  (Agent.notePublished): its agent's consumed watermark at the call, or,
+     *  for a script's call, the watermark when the run call started the
+     *  script. A script is written then, and a later round's wait that watches
+     *  it shares the turn's id but not what the agent has read since, so the
+     *  script's words can't answer anything injected after it started. */
+    private publishReadThrough;
+    /** The own channels (ownChannels) of the turn a tool call was made in
+     *  (callingTurnOf), and none for a call made outside it. */
+    private callOwnChannels;
     /**
      * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md),
      * entered directly: parse the `>>` prefix, resolve the target, deliver, or
@@ -3373,12 +3759,15 @@ export declare class AgentFramework {
     /**
      * Execute a tool call and return the result.
      * Routes to the appropriate handler (module registry or MCPL).
-     * Used by SubagentModule to dispatch tool calls for ephemeral agents.
+     * Its one caller in the framework is the operator's puppet
+     * (puppetToolCall), which puts the agent's inline cap on the call as
+     * resultMaxChars; a host may call it as well.
      *
-     * This public entry always carries AGENT origin. Ephemeral/promise-based
-     * callers are models, and provenance must identify which internal path a
-     * call entered through — a public method shared with model callers can
-     * never confer module trust, whatever the input claims. Module origin
+     * This public entry always carries AGENT origin. Its callers act for an
+     * agent, the puppet as the agent and a host for the model it runs, and
+     * provenance must identify which internal path a call entered through — a
+     * public method shared with model callers can never confer module trust,
+     * whatever the input claims. Module origin
      * exists only through the private closure handed to ModuleRegistry
      * (ctx.callTool → executeToolCallFrom with {kind:'module'}), which is exempt
      * from agent allowlists. Registered agents' allowedTools is enforced at
@@ -3432,7 +3821,42 @@ export declare class AgentFramework {
     /** puppetToolCall's work, run where stop() can wait for it. */
     private runPuppetToolCall;
     private executeToolCallFrom;
-    /** A programmatic call of an MCPL tool: `serverId` and `prefix` as resolveMcplTool matched them. */
+    /**
+     * RFC-014: the calls toolsets--act resolved to a server's dynamic tool,
+     * with the instance each is for (`_meta["mcpl/instance"]`, §5.5). The MCPL
+     * dispatch paths read it: such a call isn't refused as a dynamic tool
+     * called by name, and carries its instance. Nothing else about it differs
+     * from a direct call of the tool. Created on first use, so a framework
+     * assembled field by field (as unit tests do) needs no setup for it.
+     */
+    private toolsetActCalls?;
+    /** A toolsets--act call resolved (resolveAct) to the call of the server's
+     *  tool it makes, under that tool's model-facing name and with its
+     *  arguments, its id kept; or the reason it can't be sent. */
+    private resolveToolsetAct;
+    /**
+     * RFC-014 §8.2: a toolsets--act call from the agent (the model's, or a
+     * script's) goes down the path a direct call of the server's tool takes
+     * (dispatchMcplToolCall): its agent's allowedTools, the server's tool
+     * policy, the state exchange, RFC-005's reading of the result, the tool
+     * change shown after it, and RFC-007's lifecycle, which describes the call
+     * as that tool, with its arguments, before it opens. Only
+     * `_meta["mcpl/instance"]` is added. A call act can't resolve is refused
+     * before anything is sent.
+     */
+    private dispatchToolsetAct;
+    /**
+     * RFC-014 §6.2: a tool result that goes to the agent, with the tool change
+     * its hints made (applied as the result was read) told after the server's
+     * content; taking it means it isn't told again as a notice. The result
+     * itself when there's none, as for every server without toolHints.
+     */
+    private withToolsetChange;
+    /** A programmatic call of an MCPL tool: `serverId` and `prefix` as
+     *  resolveMcplTool matched them, or as toolsets--act resolved them
+     *  (toolsetActCalls). Its RFC-014 tool change isn't shown with its result,
+     *  which goes to its caller, not necessarily to the agent: it's told as a
+     *  notice (ToolsetController.tellUnlessClaimed). */
     private executeMcplToolCall;
     /** Event-pushing wrapper for the model-driven dispatch path. */
     private dispatchCodeExecutionToolCall;
@@ -3481,12 +3905,21 @@ export declare class AgentFramework {
     /** The tools a script of this agent may call now: the agent's own surface, without code_execution. */
     private scriptTools;
     /**
-     * The first read-write mount without an include, or null. The framework
-     * keeps its own files there (`tool-results/`, `refs/`). A mount with an
-     * include holds only the files it names, so it would refuse them, and a
-     * setup whose only writable mount has one is treated as having none.
+     * The first read-write mount without an include that isn't configured
+     * direct, or null. The framework keeps its own files there
+     * (`tool-results/`, `refs/`). A mount with an include holds only the files
+     * it names, so it would refuse them, and a setup whose only writable mount
+     * has one, or is direct, is treated as having none.
      */
     private firstWritableMountName;
+    /**
+     * Why firstWritableMountName found no mount, for the words that say so:
+     * none writable without an include, or only mounts configured direct, which
+     * it passes over.
+     */
+    private noFileMountText;
+    /** Whether firstWritableMountName passed over a writable mount without an include because it's configured direct. */
+    private directPassedOver;
     /**
      * A script's word to its agent: a wake_agent() payload, or the ending of a
      * left script that failed, crashed or was stopped at its limit. It enters
@@ -3526,15 +3959,16 @@ export declare class AgentFramework {
      * the image stays reachable by provenance after the bytes leave the wire.
      *
      * The live copy is the stored text itself unless the result is a content
-     * array carrying an inline image, which tryNativeToolResultContent sends
-     * as native blocks. It takes the same arrays the serializer takes block by
-     * block, and shows each image and each reference block's stub whole and
-     * each text block up to where it cuts that block at the cap (`maxChars`,
-     * toolResultCutAt), so those are the ranges of the text it showed.
+     * array carrying an inline image whose links and markers fit the cap
+     * together (goesNative). Then `live` holds the blocks this text was made
+     * from, which toMembraneToolResult sends as native blocks (nativeContent),
+     * showing each image, stub and marker whole and each text block up to where
+     * it cuts that block at the cap (`maxChars`, toolResultCutAt), so those are
+     * the ranges of the text it showed.
      */
     private storedToolResultText;
     /** Where a tool result labelled `label` is written: `<first writable
-     *  mount without an include>/tool-results/<label>.txt` (see
+     *  mount without an include, not configured direct>/tool-results/<label>.txt` (see
      *  firstWritableMountName), or null when there is no such mount. */
     private toolResultFilePlace;
     /**
@@ -3595,7 +4029,9 @@ export declare class AgentFramework {
      * what the model would read: a structured result's blocks as the dispatch
      * gave them (the direct reading, with RFC-005's treatment of an MCPL peer's
      * blocks there, bound to the server that sent them), a module's under
-     * history's reading of RFC-005 at every depth (shownToScript), and
+     * history's reading of RFC-005 at every depth (shownToScript), each
+     * reading the claims of everything the script's view shows, nested fields
+     * included (scriptViewClaims), and
      * otherwise one text block of the model's text, which for a failure is its
      * error. A module's is any result whose call the dispatch didn't send to
      * a server (`toServer`, from the call's waiter). `structuredContent` is the
@@ -3617,9 +4053,11 @@ export declare class AgentFramework {
      * RFC-007: with an `origin`, observers see the call as they see a model
      * call (register, dispatch with its refusal sites, open; the terminal at
      * the waiter intercept), under the inner tool's own name and class.
-     * `turnId` is the turn the call was made in (dispatchToolCall). `route` is
-     * the waiter's: the dispatch sets `toServer` when it sends the call to a
-     * server.
+     * `turnId` is the turn the call was made in (dispatchToolCall), the turn
+     * of the run or wait call watching the script; `start` is what the script
+     * was started with, its turn and its agent's reading, which its words
+     * carry (scriptCallStarts). `route` is the waiter's: the dispatch sets
+     * `toServer` when it sends the call to a server.
      */
     private dispatchScriptToolCall;
     /**
@@ -3643,17 +4081,20 @@ export declare class AgentFramework {
     private liveTurns;
     private toMembraneToolResult;
     /**
-     * If `data` is an MCP tool-result content array carrying at least one image,
-     * convert to Membrane's native ToolResultContentBlock[]. Returns null when
-     * the array is text-only (let JSON path handle it; saves a code path).
-     * `maxChars`, when provided, caps each accompanying text block so an image
-     * inlined alongside an enormous text payload can't blow the context. A
-     * block is cut at the cap as the stored copy's cut at that cap is
-     * (toolResultCutAt), never inside a slot, so the stored copy can keep
-     * exactly the slots this showed (#403); under a readers' bound the stored
-     * copy's cut can come earlier (cutStoredToolResultToFit).
-     */
-    private tryNativeToolResultContent;
+     * A content array's blocks (toolResultBlocks) as Membrane's native
+     * ToolResultContentBlock[], for a caller that found they go natively: at
+     * least one image, with links and markers that fit the cap together
+     * (goesNative), which this doesn't check. Each image as itself, each text block
+     * cut at the cap, and every other block whole, as the text the stored copy
+     * shows for it. `maxChars`, when provided, caps each text block so an image
+     * inlined beside an enormous text payload can't blow the context. A block
+     * is cut as the stored copy is at that cap (toolResultCutAt), never inside a
+     * slot, so the stored copy can keep exactly the slots this showed (#403);
+     * under a readers' bound the stored copy's cut can come earlier
+     * (cutStoredToolResultToFit). Each text is already well formed, as the
+     * stored copy's is (toolResultBlocks).
+     */
+    private nativeContent;
     private toolImageLedgerFor;
     /** Strategy-derived per-message bound (maxMessageTokens * 4 chars). */
     private strategyDerivedToolResultChars;
@@ -3784,6 +4225,61 @@ export declare class AgentFramework {
     private dispatchToolCall;
     private dispatchToolCallEvent;
     private addMessage;
+    /**
+     * Whether an MCPL event's own stored entry is the newest entry in the window
+     * a batched wake's line is written to (deliveryAgent(): the primary's), with
+     * no turn alive there (turnAlive: started, streaming, or waiting on its
+     * tools) and nothing waiting to be written (deferred). The gate then hands
+     * the line to the wake (WakeLine) instead of writing it, and the turn's
+     * start decides it (placeWakeLines). A channel message is found by its
+     * server, channel and message id, a push event by its server and event id.
+     * A message a tune-out holds from the residents is never "newest" here.
+     */
+    private isNewestContextEntry;
+    /**
+     * Write the batched-wake lines the gate left to this turn's start (WakeLine)
+     * into the window they name, the delivery agent's (the residents' shared
+     * slot where it is one), on that agent's own start only. Called by a fresh
+     * start that doesn't resume a logical turn, after the turn's own inputs (a
+     * due clock row, the deferred-write and assembly flushes) and before its
+     * checkpoint, so a line lands after whatever arrived since the gate's
+     * decision, before the notices the turn's start writes itself (the locus
+     * notice among them), and before the agent's answer to the wake.
+     *
+     * - A wake's one line whose event is still the newest entry is left out:
+     *   no message follows the wake's, so it is the wake's whole cause, and the
+     *   start's token defers an arrival into the window past its request. (The
+     *   start's own notices, written after this, aren't messages a reply could
+     *   be meant for.)
+     * - A co-resident's start places nothing. Every resident gets every
+     *   batched wake, so a co-resident writing the line would put it under the
+     *   message, the line #727 left out, or after the delivery agent's answer,
+     *   a wake line for a message already answered. Its request shows what the
+     *   slot holds, as on `main`: a reply after the message is in the message's
+     *   own channel, but a message from another channel that lands between the
+     *   gate's decision and its compile follows the message with no line.
+     * - Two or more lines are all written, each naming its message, its age
+     *   counted to now.
+     * - None is written while the host is quiesced or another reader of the
+     *   slot has a turn alive (slotHeldFrom, as for a clock row): written, a
+     *   line would land inside that turn, and deferred, it would wait for the
+     *   delivery agent's next boundary, never reaching this request
+     *   (overlapping turns in the slot, #286). They stay undecided, and are
+     *   written only if another fresh start of the wake comes (a provider
+     *   hold's release, a requeue): this start's request goes without them.
+     *
+     * A line left out is traced. Each line is written once (placedWakeLines),
+     * across the wake's retries and holds, whichever copy of its trigger a
+     * start carries: every request for the wake carries the same line. A line
+     * left out, or whose write fails, stays undecided for a later fresh start.
+     */
+    private placeWakeLines;
+    /** Whether `entry`'s own stored entry is the newest in `agent`'s window,
+     *  clock rows and stored context injections after it aside: a channel
+     *  message by its server, channel and message id, a push event by its
+     *  server and event id, and never one a tune-out holds. Past
+     *  NEWEST_SCAN_ROWS such rows, it answers no. */
+    private isNewestIn;
     /** Where addMessage delivers: the named agent, else the primary, else the
      *  first registered agent. Undefined when there is no such agent. */
     private deliveryAgent;
@@ -3813,25 +4309,13 @@ export declare class AgentFramework {
      * its window (ContextManager.renderAsNewest): cut by the per-message cap,
      * a sharded body joined, and the image limits applied over the batch, so
      * the live stream hears what the next compile sends. An id comes back as
-     * null where that compile won't send the message among its newest.
-     * Undefined where the strategy has no such hook, or the render threw,
-     * which is logged: the boundary then injects what it stored, as it did
-     * before strategies could say.
+     * null where the render can't place the message among the newest, and the
+     * boundary injects that one as stored (see the boundary's null). Undefined
+     * where the strategy has no such hook, or the render threw, which is
+     * logged: the boundary then injects what it stored, as it did before
+     * strategies could say.
      */
     private renderForInjection;
-    /**
-     * Tell the agent of the messages a tool boundary stored and left out of
-     * its injection, since the next compile won't send them among its newest:
-     * who sent each and its size, and how to read it, `history--extract`
-     * around it where the agent is shown that tool, else its id. None of a
-     * message's words: the line stands in for a message the live round
-     * doesn't carry. A system line, so it's no conversation: it neither
-     * re-pins the turn nor clears its send suppression. It names the agent
-     * it's for, since every resident sharing the slot reads it too. Returns
-     * the notice as stored, for the boundary to inject after the batch, or
-     * undefined when it couldn't be stored, which is logged.
-     */
-    private recordLeftOutNotice;
     /**
      * Write drained entries in queue (seq) order, whatever their targets:
      * residents share one message slot, so the order entries arrived in is the
@@ -3905,11 +4389,15 @@ export declare class AgentFramework {
      * appended later without splitting the body.) Boot's scan for landed
      * writes counts a landed shard the same way. When the store can't be read
      * back (storedCopiesOf logs it), or couldn't say how many messages it held
-     * before the write, whether the entry landed is unknown: it's put back
+     * before the write, the store is searched for the entry's id at once
+     * (landedCopiesById): found, it counts as written, as above. When that
+     * can't be done either, whether the entry landed is unknown: it's put back
      * marked so (`landing`), and before it's written again the store is
-     * searched for its id (landedCopiesById). Found, it counts as written, as
-     * above, at the flush that finds it; not found, it's written; and while
-     * the store can't be searched, it stays queued, holding what's behind it.
+     * searched for its id. Found then, it counts as written where it was
+     * stored, ahead of what was stored since without it, a known limit
+     * (context-manager #155, named at the tool boundary's drain); not found,
+     * it's written. While the store can't be searched, it stays queued,
+     * holding what's behind it.
      *
      * Returns what was written (stored, or deferred again by addMessage, whose
      * id is then empty), in queue order: for one target, its entries up to the
@@ -3937,10 +4425,29 @@ export declare class AgentFramework {
      *  when the store can't be read back, which is logged under `tag`, naming
      *  `what` was written: not the same as nothing found. */
     private storedSince;
-    /** The messages carrying `deferredWriteId` anywhere in the agent's store,
-     *  found by their id (queryMessages, as landedRow finds a held write's),
-     *  so no position is needed. Undefined when the store can't be searched,
-     *  which is logged. */
+    /**
+     * The positions on `cm`'s current branch of the messages carrying
+     * `deferredWriteId`, in store order: the whole branch, read in blob-free
+     * windows, so a blob missing from some other message can't make it fail,
+     * as it makes queryMessages fail (every blob on the branch is resolved for
+     * it). Throws when a window can't be read, or holds fewer messages than it
+     * was asked for: a scan that didn't reach every message can't say a write
+     * is absent, and a write taken as absent is stored again.
+     */
+    private landedPositions;
+    /**
+     * The messages carrying `deferredWriteId` anywhere on the agent's current
+     * branch, in store order with their blobs resolved, as a request carries
+     * them, so no position is needed. They're found with queryMessages, over
+     * context-manager's cached view, as landedRow finds a held write's row.
+     * Where that throws, as one blob missing anywhere on the branch makes it
+     * do, the branch is scanned blob-free instead (landedPositions), and only
+     * the rows that match are read with their blobs. Undefined when the store
+     * can be searched neither way, or the scan finds the write's rows but one
+     * of them can't be read. Each write whose lookup fails is said once until
+     * a lookup of it succeeds, since every path that reads held writes looks
+     * again.
+     */
     private landedCopiesById;
     /** The line naming a drained write that threw: one that couldn't be stored,
      *  which is already back in the queue; with 'dropped', a malformed refusal
@@ -3981,9 +4488,10 @@ export declare class AgentFramework {
      *  A target no longer registered (a fork or a run that has ended, here or
      *  before a crash) has no window to land in: a failed reply queued for it,
      *  or a channel notice it could have acted on, becomes the primary's
-     *  by-name notice, under the entry's own id and place in the queue
-     *  (queuedNoticeForPrimary), and is written with the rest; any other write
-     *  is dropped, logged, by addMessage. Nothing here reads the gone agent's
+     *  by-name notice, and a module's write for a run or a fork goes to it as
+     *  written, each under the entry's own id and place in the queue
+     *  (passesToPrimary, queuedNoticeForPrimary), written with the rest; any
+     *  other write is dropped, logged, by addMessage. Nothing here reads the gone agent's
      *  window, so such a notice an earlier write of which landed there, and
      *  which the agent read, goes on too. */
     private readdDrained;
@@ -4014,7 +4522,8 @@ export declare class AgentFramework {
      *
      * The agent never reads its window again, so every failed-reply notice it
      * never read, and every channel notice it could act on and never read, is
-     * passed to the primary, by name, once (passesToPrimary,
+     * passed to the primary, by name, once, and so is every module write for
+     * it that it never read, as the write itself (passesToPrimary,
      * passOnFromReleasedWindow): each one stored in its window above its
      * consumed watermark (flushed there at its turn's end, or stored while it
      * was idle) and not heard at a tool boundary, and each one still queued
@@ -4045,8 +4554,9 @@ export declare class AgentFramework {
      * The part of a released agent's pass to the primary that its release and
      * stop() share (stop() runs it for a release the quiesce postponed). Each
      * notice stored in its window that it never read and the primary takes in
-     * its place (passesToPrimary: a failed reply, or a channel notice its
-     * reader could act on) goes on as stored, by name (passNoticeToPrimary),
+     * its place (passesToPrimary: a failed reply, a channel notice its reader
+     * could act on, or a module's write for a run or a fork, which goes as
+     * the write itself) goes on as stored, by name (passNoticeToPrimary),
      * except a copy of an entry for it still in the durable queue, pending or
      * un-acked: that entry is the notice's one identity until its ack, the one
      * boot's check for landed writes knows, so it's the entry that goes on, as
@@ -4067,8 +4577,11 @@ export declare class AgentFramework {
      * What a released agent's window holds that its pass to the primary reads
      * (passOnFromReleasedWindow): `unread`, the notices stored there that it
      * never read and the primary takes in its place (passesToPrimary: its
-     * failed replies, and the channel notices it was told it could act on),
-     * other than copies of the entries `held` names; and `held`, for each of
+     * failed replies, the channel notices it was told it could act on, and a
+     * run's or a fork's module writes), each with its participant and
+     * content, a sharded body's shards joined into one text, as the
+     * autobiographical strategy joins them (asCompiled), other than
+     * copies of the entries `held` names; and `held`, for each of
      * those entries with a copy there, its copies and whether any of them is
      * unread. A notice is read below the lower of its consumed watermark and
      * the point where the watermark's branch and the current one part
@@ -4102,8 +4615,8 @@ export declare class AgentFramework {
      * deregistered, so its stream can't dispatch anything more and resume
      * doesn't weigh its context, and a write addressed to it meanwhile is
      * treated as for any agent no longer registered (dropped, or passed to the
-     * primary if it's a failed reply, or a channel notice its reader could act
-     * on).
+     * primary if it's a failed reply, a channel notice its reader could act
+     * on, or a module's write for a run or a fork: passesToPrimary).
      */
     private releaseWindowNowOrAfterResume;
     /** resume(): the windows whose release the quiesce window postponed, each on its own. */
@@ -4138,7 +4651,10 @@ export declare class AgentFramework {
      * The primary's by-name notice in place of one `speaker` never read, and
      * what it's about, as a log line says it: a failed reply's
      * (failedReplyNoticeForPrimary) or a channel notice's
-     * (channelNoticeForPrimary). null when no one is told, which is logged
+     * (channelNoticeForPrimary). A module's write for a run or a fork that
+     * it never read (PRIMARY_IF_UNREAD_KEY), given with what was `written`,
+     * goes as the write itself: its participant, its content, and its
+     * metadata without the mark. null when no one is told, which is logged
      * where it's decided.
      */
     private noticeForPrimary;
@@ -4175,11 +4691,34 @@ export declare class AgentFramework {
      */
     private channelForNotice;
     /**
-     * A module's write through its context: addMessage's, except that a write
-     * the framework holds is answered by its handle (heldHandle) rather than
-     * '', so the module can find, read, edit and remove what it wrote before
-     * the write lands. The framework's own callers keep the '' they've always
-     * had, which their traces and checks take as a write not stored yet.
+     * A channel as the agent is shown it: its label, with the name that picks
+     * it alone (ChannelRegistry.nameShown), which is its id, or, where another
+     * server registers the same id, its server-qualified name; or, for a
+     * channel no string picks alone, its id and its server.
+     */
+    private channelShown;
+    /** A channel named in a notice with the label it was given there: the
+     *  label, with its name as ChannelRegistry.nameShown gives it. */
+    private labelledChannel;
+    /**
+     * A module's write through its context (ModuleContext.addMessage):
+     * addMessage's, except that a write the framework holds is answered by its
+     * handle (heldHandle) rather than '', so the module can find, read, edit
+     * and remove what it wrote before the write lands, through getMessage,
+     * editMessage and removeMessage, which read the delivery agent's window: a
+     * handle for a write held for a fork or a sub-agent isn't found there. The
+     * framework's own callers keep the '' they've always had, which their
+     * traces and checks take as a write not stored yet.
+     *
+     * With `forAgent`, the write is for the named agent's window, which must
+     * be registered when the write is made: a name that isn't, or the empty
+     * one, which addMessage would read as none (deliveryAgent), throws, naming
+     * the registered ones, as queryMessages does. The framework's own writes
+     * log and drop instead, as a held write does whose agent is gone by its
+     * flush. A write for an ephemeral run or a conversation fork, whose
+     * window nothing reads after its release, is marked (PRIMARY_IF_UNREAD_KEY),
+     * so the release passes it to the primary if its target never read it,
+     * as it passes a notice (passOnFromReleasedWindow).
      */
     private addModuleMessage;
     /**
@@ -4190,7 +4729,8 @@ export declare class AgentFramework {
      * no module reads that agent's store, and the write waits for its window's
      * release (drainDeferredFor) or, at its flush, is dropped (addMessage), a
      * failed reply, or a channel notice its reader could act on, passing to the
-     * primary as its notice (queuedNoticeForPrimary).
+     * primary as its notice, and a module's write for a run as written
+     * (passesToPrimary, queuedNoticeForPrimary).
      */
     private heldWritesFor;
     /**
@@ -4212,10 +4752,11 @@ export declare class AgentFramework {
      * Settle held writes whose landing is unknown (DeferredWrite.landing),
      * among those `which` picks, before a path reads or changes held writes:
      * each is looked up by its id in its target's store (landedCopiesById).
-     * Found, the write landed (settleFound). Not found, the mark goes, and
-     * it's an ordinary held write, which is persisted as an edit is. Where the
-     * store can't be searched, it stays marked, a doubt each path reads by its
-     * own rule.
+     * Found, the write landed (settleFound), where its copy sits, a known
+     * limit (writeDrainedInOrder). Not found, the mark goes, and it's an
+     * ordinary held write, which is persisted as an edit is. Where the store
+     * can't be searched, it stays marked, a doubt each path reads by its own
+     * rule.
      */
     private settleUnknownLandings;
     /**
@@ -4236,7 +4777,8 @@ export declare class AgentFramework {
      * that write's copy, so the write landed, and it's settled as found
      * (settleFound) before the row is read or changed. A lookup by the id
      * can't be needed then, so this holds where the store can't be searched
-     * too.
+     * too. One row of a sharded body says it's a shard, without a count,
+     * since one row doesn't tell how many landed.
      */
     private settleByCopy;
     /** A held write whose landing stays unknown after settling, its store
@@ -4244,21 +4786,43 @@ export declare class AgentFramework {
      *  changing only the queued entry could leave its stored copy as it was.
      *  Throws with nothing changed. */
     private refuseUnsettled;
-    /** Whether the agent has nothing left to read of a deferred write, on
-     *  evidence only: the row it landed as is at or below the agent's consumed
-     *  watermark on its current branch, or it's in neither the queue (drained
-     *  entries not yet stored included) nor the store's current branch:
-     *  removed, or left on a branch the agent has switched from, where a turn
-     *  now would find nothing of it (switching back brings it back unread,
-     *  with no wake, as main's wake spent on this branch leaves it). Any doubt
-     *  reads as unread, such as a watermark that a branch switch or an undo
-     *  left on another branch, or a store that can't be read: a turn that
-     *  finds nothing new costs less than a write no wake brings the agent to
-     *  read. */
-    private deferredWriteReadOrGone;
+    /** Whether a wake for a deferred write has nothing left for the agent to
+     *  do, on evidence only. The write's row is at or below the newest
+     *  consumed watermark of an answered request (Agent.getAnsweredWatermark)
+     *  on the agent's current branch, and for a wake that carries a channel
+     *  and wasn't marked ambient (`to`, that channel on the wake's server), the
+     *  agent has since published there having read the row
+     *  (Agent.publishedAfterReading): hearing a message isn't answering it,
+     *  and the wake's turn is the agent's chance to answer there. Or the
+     *  write is in neither the queue (drained entries not yet stored
+     *  included) nor the store's current branch: removed, or left on a
+     *  branch the agent has switched from, where a turn now would find
+     *  nothing of it (switching back brings it back unread, with no wake, as
+     *  main's wake spent on this branch leaves it). Any doubt keeps the
+     *  wake, such as a watermark that a branch switch or an undo left on
+     *  another branch, or a store that can't be read: a turn that finds
+     *  nothing new costs less than a write no wake brings the agent to read
+     *  or answer. */
+    private deferredWriteDone;
+    /** The mark a wake for `agentName` takes for the write it was queued with
+     *  (`placement`, addMessage's out-param): set only when that write was
+     *  deferred for that agent, since a stored write's wake starts the turn
+     *  that reads it. The scheduler drops the wake once the write needs
+     *  nothing more of the agent (deferredWriteDone). */
+    private readsDeferredFor;
     private editMessage;
     private removeMessage;
     private getMessage;
+    /** The refusal of a module's `forAgent` that names no registered agent:
+     *  the name, cut at 120 characters; the registered ones, a list over 400
+     *  characters cut with how many there are; and what leaving forAgent out
+     *  does. With none registered, there's no window either way, and it says
+     *  so. */
+    private unknownAgentError;
+    /** A module's query (ModuleContext.queryMessages): the delivery agent's
+     *  window (the primary's, or the first agent's when none is primary), or
+     *  the named agent's, which must be registered: an unknown name, or the
+     *  empty one, throws, naming the registered ones, as a write's does. */
     private queryMessages;
     private createFrameworkState;
     private emitTrace;
@@ -4317,6 +4881,41 @@ export declare class AgentFramework {
      * failures.log + ops:alert trace + CONNECTOME_OPS_WEBHOOK.
      */
     notifyOps(kind: string, agentName: string, message: string, data?: Record<string, unknown>): void;
+    /**
+     * Tells the context manager what a stream's later round carries after its compiled messages: every round so far,
+     * in sent order, with the round's own rows appended (roundRows): each stored row's id where the next request will
+     * carry it as the stream sent it, the marker where it won't. A request-only row (a heartbeat tick, a `[Continue]`)
+     * isn't a row here: the next request puts it back in the same place (renderRequestOnlyRows), and no compile holds
+     * it. A round with no `roundContent` (membrane's XML or fallback path, where the stored reply is the framework's
+     * rebuild) can't be vouched for, so nothing more of the stream is noted, and its later rounds' thinking is left
+     * out at the next compile rather than refused. So is a stream whose note threw or wrote nothing (noteStreamRows).
+     */
+    private noteRoundSent;
+    /**
+     * At the stream's end, after its last reply is stored: every row so far, judged as of now, with that reply as the
+     * final row (or none, where the stream's last request had no reply after it). Past the record's end nothing
+     * keeps its thinking, so the last reply keeps its own only by being noted here. Judged as of now, a batch the
+     * tool-result guard held at its boundary and has since settled to the originals is named. A reply with no
+     * `roundContent` to vouch for ends noting instead, as a round's does.
+     */
+    private noteStreamEnd;
+    /**
+     * Every row so far, judged as of now (roundRows), noted. A note the context manager writes nothing for (false)
+     * ends the stream's notes, with a line saying so: where the stream's compile no longer wrote the branch's record, or
+     * the branch has none, no later note could write either; where its store failed, a later one might, and stopping
+     * gives that up for this stream's later rounds, whose thinking then goes at the next compile, as it would have
+     * after the failed write. A note that throws is a fault, and ends them too.
+     */
+    private noteStreamRows;
+    /**
+     * A call's dropped blocks, placed, against the branch's binding-record start (splitThinkingDrops). Replies stored at
+     * or below it may lose their thinking with no strip having missed, since the context manager recorded nothing they
+     * were sent under, and so may any block for a binding the record doesn't track (the account's). Any other drop is
+     * one the record doesn't account for: a change ahead of it that the record didn't see. The operators hear of it
+     * once per incident, again only if a call shows more, and the incident ends at a call that shows no unexpected drop
+     * (ThinkingLossIncidents).
+     */
+    private noteThinkingLoss;
     private opsAlert;
     /**
      * Record a model refusal for observability: per-agent stats + a
@@ -4561,6 +5160,32 @@ export declare class AgentFramework {
      * logged here rather than replacing the failure the connect reports.
      */
     private closeFailedRuntimeConnect;
+    /**
+     * The host capabilities offered to one server: the host's own, plus
+     * RFC-014's `toolHints` where its configuration asks for them. Without it,
+     * the very object every server is offered.
+     */
+    private mcplHostCapabilitiesFor;
+    /** RFC-014: every toolHints server's presence, made on first use. */
+    private toolsets;
+    /** RFC-014: the `toolsets` module (toolsets--open, --act, --look,
+     *  --close), registered once, by the first server configured with
+     *  toolHints. Its tools don't change after that. */
+    private ensureToolsetsModule;
+    /** RFC-014 §5.3: after a (re)connect whose policy has settled, read what
+     *  the server holds open and adopt it. In the background: its notices are
+     *  written as they come. */
+    private reattachToolsets;
+    /**
+     * RFC-014 §8.3: a tool change with no result or event to ride on (a
+     * standalone tools/hints, a late result, a reconnect's adoption, a
+     * recovery) is told as a notice, which doesn't wake the agent. Like any
+     * delivery from a server into the conversation, it needs `pushEvents`
+     * (§6.1); without it the change is still tracked, and toolsets--look shows
+     * it. The text is the server's (its tool definitions, titles, reasons), so
+     * the notice names the server.
+     */
+    private recordToolsetNotice;
     /**
      * Connect a single MCPL server: register routing entries, open the
      * connection, wire events, and initialize feature sets / scopes /
@@ -4983,8 +5608,8 @@ export declare class AgentFramework {
      * Handle the synthesized `read_image` tool: read image bytes from a
      * workspace mount and return them as a native MCP-shaped content array
      * (`[{type:'text'…},{type:'image', data, mimeType}]`). The live-turn
-     * converter (tryNativeToolResultContent → membrane tool_result image
-     * blocks) delivers the actual image to the model; history storage keeps
+     * converter (toMembraneToolResult's nativeContent → membrane tool_result
+     * image blocks) delivers the actual image to the model; history storage keeps
      * the standard compact `[image: …]` placeholder.
      */
     /** RFC-005 on-demand dereference: [ref id] → workspace file, via the
@@ -5021,9 +5646,10 @@ export declare class AgentFramework {
      */
     private dispatchSaveImageToolCall;
     /** The `utils` meta-tool: list/describe/run over module utilities
-     *  (Module.getUtilities). Shared by the model-facing dispatcher and the
-     *  programmatic path (executeToolCall), so code_execution scripts and
-     *  ephemerals reach utilities too. */
+     *  (Module.getUtilities). Shared by the model-facing dispatcher, which a
+     *  running code_execution script's calls take too, and executeToolCallFrom,
+     *  which the puppet and a host reach through executeToolCall and a module
+     *  through callTool. */
     private handleUtilsToolCall;
     private dispatchUtilsToolCall;
     private dispatchAgentSettingsToolCall;
@@ -5032,6 +5658,10 @@ export declare class AgentFramework {
     private buildEventTagsResult;
     private dispatchEventTagsToolCall;
     private dispatchGateToolCall;
+    /** The channel context one server is told for an agent's inference
+     *  (context/beforeInference, §14.4): only that server's own channels
+     *  (ChannelRegistry.buildChannelContext). */
+    private channelsForServer;
     private buildBeforeInferenceParams;
 }
 export {};