@animalabs/agent-framework 0.26.2 → 0.28.0

package/dist/src/framework.d.ts

@@ -1,10 +1,11 @@
 import { type PresentationSnapshot } from "./tool-presentation.js";
 import { JsStore } from '@animalabs/chronicle';
 import type { Membrane, NormalizedRequest } from '@animalabs/membrane';
+import { type RetrySettings } from '@animalabs/membrane/retry';
 import { ContextManager } from '@animalabs/context-manager';
 import type { TokenBudget } from '@animalabs/context-manager';
-import type { FrameworkConfig, TraceEventListener, InferenceLogQuery, InferenceLogQueryResult, InferenceLogEntryWithId, ProcessLogQuery, ProcessLogQueryResult, ProcessLogEntryWithId, ProcessEvent, ToolCall, ToolResult, AgentConfig, InferenceRequest, Module, ContextMaintenanceSnapshot, AgentRuntimeSettingsPatch, AgentRuntimeSettingsSnapshot, SameRoundThinkTextPolicy } from './types/index.js';
-import { Agent } from './agent.js';
+import type { FrameworkConfig, ErrorPolicy, ErrorAction, TraceEventListener, InferenceLogQuery, InferenceLogQueryResult, InferenceLogEntryWithId, ProcessLogQuery, ProcessLogQueryResult, ProcessLogEntryWithId, ProcessEvent, ToolCall, ToolResult, AgentConfig, InferenceRequest, Module, ContextMaintenanceSnapshot, AgentRuntimeSettingsPatch, AgentRuntimeSettingsSnapshot, SameRoundThinkTextPolicy } from './types/index.js';
+import { Agent, type RenderStats } from './agent.js';
 import { type ToolClass, type ToolClassSource } from './mcpl/tool-classes.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
@@ -87,11 +88,15 @@ export interface HostModeStatus {
      * is false until it has. A parked continuation of a turn is counted here
      * and, as a turn alive, in `activeTurns` and `activeTurnAgents`. */
     parkedAdmissions: number;
-    /** Inference requests parked by the quiesce wake gate (while quiesced), or
-     * simply queued (while serving — non-zero right after a resume until the
-     * scheduler's next pass consumes them). Continuations of a held turn
-     * (budget restart, tool results) and a held turn's retry, which a quiesce
-     * lets through, are never counted. */
+    /** Inference requests waiting to start: queued (parked by the quiesce wake
+     * gate while quiesced, or, while serving, until the scheduler's next pass
+     * takes them), in a scheduler pass's hands, or held by a provider hold (an
+     * acceleration or host hold, or a provider's stated wait). There, a start
+     * that carries a turn on counts as the wakes merged into it. A start parked
+     * on provider admission behind an auxiliary call counts once in
+     * `parkedAdmissions` instead, however many wakes are merged into it.
+     * Continuations of a turn (budget restart, tool results) and a held turn's
+     * retry, which a quiesce lets through, are never counted. */
     gatedRequests: number;
     /** code_execution scripts still running that no call is waiting on: left
      * running after a yield, outside any turn. Quiesce does NOT stop them —
@@ -105,11 +110,12 @@ export interface HostModeStatus {
      * turn token held with no stream to cancel and no check ahead to stop it
      * at (a puppet tool turn, a store surgery's reservation, a turn finishing
      * its last delivery), or a turn with no stream that hasn't reached its
-     * next check, such as one in a hook that hasn't returned. A turn whose
-     * stream the abandon cancelled isn't listed, even one still running when
-     * the grace runs out, as one whose tool-result guard waits on its speech
-     * may be. Present only after an abandon that left such turns behind, while
-     * the host stays quiesced. */
+     * next check, such as one in a hook that hasn't returned, or a turn whose
+     * stream's cancel threw with no check ahead, so that its stream goes on.
+     * A turn whose stream the abandon cancelled isn't listed, even one still
+     * running when the grace runs out, as one whose tool-result guard waits on
+     * its speech may be. Present only after an abandon that left such turns
+     * behind, while the host stays quiesced. */
     unabandonable?: string[];
 }
 /**
@@ -160,6 +166,78 @@ export declare class ProviderWaitNotSleptError extends Error {
 interface InferenceToolSnapshot {
     sameRoundThinkTextPolicy: SameRoundThinkTextPolicy;
 }
+/**
+ * Default error policy: membrane's own retry schedules, decided here.
+ *
+ * The framework's turns pass `retry: false` to membrane, so a failure reaches
+ * this policy after one send, and the framework is the one retry layer: each
+ * retry is a fresh compile, a stop cancels its wait, and the wait is seen.
+ * The decision is membrane's (`@animalabs/membrane/retry`), on the settings
+ * given: membrane's, with the two changes below for the turn path, unless a
+ * host passes its own (e.g. from a recipe's retry config), which are taken as
+ * they are:
+ * - not retryable (400 invalid_request, 401 auth, context_length, safety,
+ *   a caller-code error): terminal on the first failure. Retrying them burns
+ *   API quota without any chance of success; production traces showed clerk +
+ *   reviewer wasting 4 inferences on each 400 due to blind retries.
+ * - overloaded (a 529, or an overloaded error mid-stream): the overloaded
+ *   schedule, jittered, 10 s doubling to 5 min (by default 13 tries, where
+ *   membrane's settings have 7: about 30 min).
+ * - rate limited (429): the base schedule with at least 5 tries.
+ * - any other retryable failure, a stream deadline on a sent request
+ *   included (membrane leaves those to its caller): the base schedule (by
+ *   default 3 tries, 1 s then 2 s).
+ * A provider's stated wait (`retryAfterMs`) is waited when it is longer than
+ * the backoff, up to the schedule's ceiling, which by default is at least the
+ * framework's own cap (PROVIDER_ACCELERATION_MAX_COOLDOWN_MS, ten minutes);
+ * past it the turn ends here. A host's own settings keep their ceilings.
+ * (Before this policy runs, the framework holds a resident for a stated wait
+ * or an acceleration 429 itself, and ends an ephemeral run on a wait past
+ * that cap; see holdProviderAcceleration and nonOwningProviderWait.)
+ * An error that isn't a MembraneError is retried as a retryable failure, on
+ * the base schedule.
+ */
+export declare class DefaultErrorPolicy implements ErrorPolicy {
+    /** The most retries any class allows (ErrorPolicy's bound, for readers). */
+    readonly maxRetries: number;
+    private readonly settings;
+    constructor(settings?: RetrySettings);
+    onInferenceError(error: Error, _agentName: string, attempt: number): ErrorAction;
+}
+export interface ReinitAlertText {
+    opening: string;
+    message: string;
+}
+export declare const REINIT_MOVES: readonly ['undo', 'redo', 'rollback', 'suppression', 'branch switch'];
+export type ReinitMove = (typeof REINIT_MOVES)[number];
+export declare function refusedWorkAlert(move: ReinitMove, cause: string): ReinitAlertText;
+export declare function restoreAlert(restore: {
+    source: string;
+    now: string;
+    selected: boolean;
+    cause: string;
+} & ({
+    move: 'rollback';
+    managerCurrent?: false;
+} | {
+    move: 'suppression';
+    managerCurrent: boolean;
+})): ReinitAlertText;
+export declare function disposalAlert(disposal: {
+    move: ReinitMove;
+    heldWrites?: number;
+    reinitFailed?: string;
+    cleanupFailed?: string;
+}): ReinitAlertText;
+export declare function longHoldAlert(hold: {
+    move: string;
+    agentName: string;
+    heldSeconds: number;
+    queued: number;
+    reinitializing?: string;
+    waitingForMaintenance: boolean;
+}): ReinitAlertText;
+export declare function opsWebhookText(message: string): string;
 /**
  * Whether the poison-history breaker may shed the newest exchange for a
  * failure: an `invalid_request` at HTTP 400, 413 or 422 or with no status, or
@@ -222,11 +300,35 @@ export declare class AgentFramework {
     private toolPresentations;
     private presentationPreviews;
     getRequestToolPresentation(request: object): PresentationSnapshot | null;
+    /**
+     * The render stats of the dry compile that built `request`, a request
+     * `previewActivation` returned (or `Agent.buildActivationRequest` with
+     * `dryRun`), as context-manager gives them in `CompileResult.renderStats`:
+     * what that compile's select put in the context, by kind. They count the
+     * selection, not each message of the request. The injections
+     * context-manager merges in after its select, such as those
+     * `previewActivation` gathers with `injections: true`, aren't counted;
+     * context-manager's doc of `CompileResult.renderStats` names what else its
+     * compile does after the select. The agent then changes the messages
+     * itself, and the stats come from before that: they count a message it
+     * drops, such as one left holding only blank text, and leave out the turns
+     * it adds, such as `[Continue]`, a silent heartbeat's separator,
+     * request-only turns, and the stand-ins `previewActivation` shows for the
+     * `afterUser` injections a start would store (stored-injections.ts). A
+     * later preview or live compile leaves them as they were.
+     * They're the object the compile returned, not a copy, so treat them as
+     * read-only: a change to them shows in every later read. Null for a request
+     * no dry run built, a request that is sent included, and when the agent's
+     * strategy records none (of context-manager's own, the autobiographical
+     * strategy and the knowledge strategy built on it do).
+     */
+    getRequestCompileStats(request: object): RenderStats | null;
     private store;
     private ownsStore;
     private stopPromise;
     private stopCompleted;
     private ownedStoreClosed;
+    private ownedStoreManagersClosed;
     /** Whether the latest stop() got through its teardown with nothing failed:
      * every step and every wait up to and including the one on awareness
      * drains, whatever failed after that, in the storage work that finishes
@@ -254,6 +356,8 @@ export declare class AgentFramework {
     private inferencePolicy;
     private errorPolicy;
     private pendingRequests;
+    private readonly exhaustedTurns;
+    private readonly roundTurns;
     private running;
     private loopPromise;
     /** Quiesce/maintenance mode (issue #122). DELIBERATELY separate from
@@ -305,6 +409,7 @@ export declare class AgentFramework {
     private providerWaits;
     /** Wakers for error-policy retry waits in progress: stop() ends them. */
     private retryWaitWakers;
+    private waitingTraceEveryMs;
     private providerAdmissionClosed;
     /** Invalidates framework turns still assembling when stop begins. */
     private lifecycleGeneration;
@@ -319,6 +424,7 @@ export declare class AgentFramework {
      *  framework, and tests set it by cast. */
     private inboundAcceptanceObserver?;
     private streamBoundaryEnds;
+    private streamCarries;
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message,
      *  or an edit the coalescer marks as the agent's first view; not a system
      *  marker or a reaction, reaction removal, edit or deletion marker) into
@@ -349,6 +455,7 @@ export declare class AgentFramework {
      * next turn.
      */
     private turnRouting;
+    private readonly reasoningLoss;
     /**
      * The latest link of each agent's chain of queued prose deliveries. Every
      * stream queues its own behind it, a fresh turn's included, so the agent's
@@ -389,6 +496,10 @@ export declare class AgentFramework {
     /** Consecutive bounce-wakes per agent; capped so an agent that keeps
      *  emitting unprefixed prose can't wake-loop (notices still append). */
     private proseBounceStreaks;
+    /** Consecutive autoContinue continuations per agent, capped by its
+     *  maxConsecutive. Cleared when a turn starts with a cause of its own
+     *  (processInferenceRequests) or a tool ends a turn (skip_reply). */
+    private autoContinueStreaks;
     private pendingAssistantBlocks;
     /** Streams the FRAMEWORK cancelled for non-terminal reasons, keyed
      *  `${agentName}:${streamId}`: an endTurn tool result or a context-budget
@@ -521,6 +632,12 @@ export declare class AgentFramework {
      */
     private deferredScanFrom;
     private deferredMessages;
+    /** The marked held writes whose store couldn't be searched, each with the
+     *  failure said, said once until a lookup of them succeeds and again when
+     *  the failure changes (landedCopiesById), and those a drain has said it
+     *  holds what's queued behind (writeDrainedInOrder). */
+    private unsearchableSaid;
+    private stillUnknownSaid;
     private activeTurnTokens;
     /** Each running scheduler pass's requests, which it took from
      *  pendingRequests: it holds those of the agents it hasn't taken up yet
@@ -624,6 +741,9 @@ export declare class AgentFramework {
      * ephemeral agents have isolated slots and are their own only readers.
      */
     private readonly sharedSlotAgents;
+    /** The batched-wake lines already written (placeWakeLines), so every agent a
+     *  wake was for, and every later start of it, writes each at most once. */
+    private readonly placedWakeLines;
     /** Rounds of tool calls, by their results array, that a save_recent_image
      *  in the round counted by their share of the bound: such a round is
      *  stored by its share whether or not it fits (buildStoredToolResultContent). */
@@ -634,6 +754,11 @@ export declare class AgentFramework {
      *  queued, and clears them. While a name is here, no other flush drains
      *  its queue (drainDeferredFor). */
     private readonly releasesAfterResume;
+    private readonly managerReleases;
+    private readonly releasedByCleanup;
+    private readonly openManagers;
+    private readonly openManagerRefs;
+    private readonly collectedManagers;
     /** The coalescing commit in flight, if any (see commitCoalescingDurable). */
     private coalescingCommit;
     private inferenceRouter;
@@ -659,8 +784,24 @@ export declare class AgentFramework {
     private closingConversationAgents;
     private codeExecution;
     private scriptToolWaiters;
-    /** Per agent, a round that called code_execution and waits for those calls'
-     *  results before its prose is routed (ScriptRound). */
+    /** A script's call being dispatched, by its call id: what its script was
+     *  started with, its words' turn and reading. `turnId` is the turn the
+     *  script was started in, if one was (callingTurnOf); `readThrough` is the
+     *  consumed watermark its agent had when the run call started it, which a
+     *  publish the call makes is credited with (publishReadThrough). Kept only
+     *  while the dispatch runs (dispatchScriptToolCall). */
+    private readonly scriptCallStarts;
+    /** Per agent, the unexpected thinking drops its last operator alert counted (noteThinkingLoss). */
+    private readonly thinkingLossIncidents;
+    /** Per live stream that can be noted, its rows so far after the compiled messages (noteRoundSent). */
+    private readonly streamRequestNotes;
+    private readonly streamCarried;
+    /** Per pending round's blocks (pendingAssistantBlocks' value), what membrane held as that round's reply
+     *  (`roundContent`, its results left out); null where the round has no `roundContent` (XML or fallback). Keyed by
+     *  the blocks themselves, so it goes wherever they go. */
+    private readonly pendingRoundSent;
+    /** Per agent, a round that called code_execution or sent, and waits for
+     *  those calls' results before its prose is routed (ScriptRound). */
     private scriptRounds;
     /** Each code_execution result, by the round that dispatched its call: it
      *  settles only that round, even if a newer round reuses its call id. */
@@ -741,6 +882,10 @@ export declare class AgentFramework {
     /** Host capabilities advertised during the MCP handshake — stored so servers
      *  can be connected at runtime (connectMcplServer) after initialization. */
     private mcplHostCapabilities;
+    /** MCPL RFC-014: every toolHints server's tool presence, for the
+     *  `toolsets` module's meta-tools and reminders. Made when the first
+     *  server configured with `toolHints: true` is set up; null until then. */
+    private toolsetHub;
     /** Inference routing policy from FrameworkConfig — stored so the MCPL
      *  subsystem can be lazily initialized by connectMcplServer when the
      *  framework started with zero configured servers. */
@@ -760,6 +905,9 @@ export declare class AgentFramework {
      * scheduler, ephemeral admission and puppet entry points.
      */
     private surgeryHold;
+    private readonly conversationSpawnsInFlight;
+    private syncMoveReinit;
+    private holdAlertMs;
     /** Serialize per-server drains so reconnect and an online undo cannot race. */
     private discordAwarenessDrains;
     /** The servers whose running pass a later trigger joined
@@ -767,9 +915,10 @@ export declare class AgentFramework {
      *  more what it had already tried. */
     private discordAwarenessDrainsJoined;
     private eventGate;
+    private judgeWired;
+    /** The heartbeat (FrameworkConfig.heartbeat), when the host turns it on. */
+    private heartbeat;
     private usageTracker;
-    /** Explicit-send or private suppression carried into a tool-result-guard retry. */
-    private guardRetryTurnSilenced;
     /** Presentation-only wall-clock zone; persistence remains UTC/epoch. */
     private readonly timeZone;
     private constructor();
@@ -787,8 +936,9 @@ export declare class AgentFramework {
     /**
      * The error a failed create() rejects with, once what it acquired is
      * released: the framework it had begun is stopped, with
-     * FAILED_CREATE_TEARDOWN_TIMEOUT_MS as stop()'s teardownTimeoutMs, and a
-     * store create() opened is closed even when that stop failed or timed out.
+     * FAILED_CREATE_TEARDOWN_TIMEOUT_MS as stop()'s teardownTimeoutMs, the
+     * context managers it opened are closed, and a store create() opened is
+     * closed even when that stop failed or timed out.
      * stop() keeps an owned store open when any of its waits fails or times
      * out, so that it can be called again, but no one can call it on a
      * framework that create() never returned. When the release doesn't finish
@@ -887,8 +1037,9 @@ export declare class AgentFramework {
     /** What start() and addModule() pass before either begins work of a
      * lifecycle. A stop() still running refuses both, from the moment it
      * claims its attempt until that attempt settles. A failed stop() has
-     * cleared its attempt, unless it closed an owned store, which is refused
-     * first. A completed stop() is cleared, and the call goes on as before;
+     * cleared its attempt, unless it closed an owned store, or the context
+     * managers it closes before that store, which are refused first. A
+     * completed stop() is cleared, and the call goes on as before;
      * whether a lifecycle should begin after a stop() is #315's question. */
     private resetCompletedStop;
     /** Register before invoking the body, so the set holds the operation for
@@ -960,7 +1111,56 @@ export declare class AgentFramework {
      * under a surgery's hold, and no failure is reported for it.
      */
     private withdrawMaintenanceWhenStopping;
+    /**
+     * Wakes the framework holds for `agentName` that need no new event: a
+     * request already queued for it (it runs as soon as the agent is free) and
+     * turns a provider cooldown holds until its end. The reply judge is told of
+     * them beside the gate's own timers, so it can weigh what waiting costs.
+     */
+    private upcomingWakesFor;
+    /** The agents the heartbeat wakes: the residents, not conversation forks,
+     *  ephemeral runs or the subconscious, which keep windows of their own. */
+    private heartbeatTargets;
+    /**
+     * The event a heartbeat wake is to the gate: a push from the server id
+     * `heartbeat`, as heartbeat-mcpl's ticks and reminders were. So the
+     * agent's rules govern it as they governed those (a rule matching
+     * `source: "heartbeat"`, a `defer` default), and its sleep lets it through,
+     * as it lets that server id through.
+     */
+    private heartbeatGateEvent;
+    /**
+     * Deliver one of the heartbeat's wakes, as heartbeat-mcpl's push events
+     * were: a message-mode tick's or a reminder's text is stored, and the gate
+     * decides the wake by the agent's rules (heartbeatGateEvent), a sleep
+     * letting it through as it lets that server's pushes through. A silent
+     * tick stores no prompt: its turn, when the gate triggers one, is a silent
+     * heartbeat (silent-heartbeat.ts), prose suppressed. As for a stored push,
+     * the wake of the agent the text was delivered to is dropped once a
+     * request of its own has carried and answered the text (readsWriteFor);
+     * another resident's isn't tied to it.
+     */
+    private deliverHeartbeat;
+    /** Handle a call to one of the heartbeat's tools. */
+    private dispatchHeartbeatToolCall;
+    /**
+     * Why `agentName` may not make this heartbeat call, or null when it may.
+     * The heartbeat is the agent's, and wakes its residents: a conversation
+     * fork, an ephemeral run or the subconscious may look at it, but not
+     * change it or set a reminder that would wake someone else. Refused before
+     * the tool runs, as a fork's sleep is.
+     */
+    private heartbeatRefusal;
+    /** Run a heartbeat call, its throw an error result. */
+    private runHeartbeatTool;
     private auxiliaryMembraneFor;
+    /**
+     * The reply judge's calls. None waits: under the agent's holds a call is
+     * refused without being made, and the agent's turn stops the judge. A call
+     * that fails records the wait its provider states, if any, and holds
+     * nothing else.
+     */
+    private judgeMembraneFor;
     /**
      * A conversation agent's auxiliary calls (its context manager's
      * compression). A conversation agent takes no provider gate: admission
@@ -969,13 +1169,20 @@ export declare class AgentFramework {
      * as a resident's are, so they bind its auxiliary calls too: a held model
      * is refused without a call, and an auxiliary call's own stated wait is
      * recorded for it. (An ephemeral run records nothing, its name being
-     * single-use, so its context manager keeps the plain membrane.) Its
+     * single-use, so its context manager's calls are only withdrawn, as below,
+     * through ephemeralAuxiliaryMembraneFor.) Its
      * compression is the background work a resident's is, whether a
      * maintenance tick or a drain after a message starts it, so it is withdrawn
      * as a resident's is: a call made while a surgery holds the store, or once
      * stop() has closed provider admission, is withdrawn without being sent.
      */
     private conversationAuxiliaryMembraneFor;
+    private ephemeralAuxiliaryMembraneFor;
+    private withdrawnOnceReleased;
+    private releaseManager;
+    private trackManager;
+    private closeManager;
+    private closeOpenManagers;
     /** The framework's membrane, with each complete() call passed through
      *  `admit` along with the model it names. */
     private membraneAdmitting;
@@ -986,7 +1193,8 @@ export declare class AgentFramework {
      *  a stated 0, as in ProviderWaits: the 1 s floor, plus jitter. */
     private accelerationCooldownMs;
     /** Whether two requests are one wake, for a provider hold's dedup: the
-     *  same agent, reason, source, time and channel, and the same coalescing
+     *  same agent, reason, source, time and channel, on the same server (two
+     *  servers' channels can share an id), and the same coalescing
      *  marks: a batch wake's subject, a batch-only merge's subjects (it has no
      *  single subject), and the write a wake reads. A wake with any of them
      *  can be withdrawn or dropped on its own, and must not stand for one
@@ -1015,7 +1223,8 @@ export declare class AgentFramework {
      * - An ephemeral run's name is single-use, so a wait recorded for it would
      *   bind nothing, and its caller is waiting on it. A retryable stated wait
      *   up to PROVIDER_ACCELERATION_MAX_COOLDOWN_MS is left to the error policy,
-     *   slept and retried. A longer one, or one that can't be represented, ends
+     *   which sleeps and retries it unless it declines, as a host's own ceiling
+     *   can. A longer one, or one that can't be represented, ends
      *   the run now ('fail'): it is never retried before the provider's time,
      *   and the caller hears why at once.
      * Anything else is the error policy's.
@@ -1254,6 +1463,10 @@ export declare class AgentFramework {
      *  a read-write workspace mount without an include for storage). */
     private referenceFetcherInstance?;
     private getReferenceFetcher;
+    /** Configure an MCPL server: its config, for tool routing and the fetcher,
+     *  which reads a server's address and credential from it, and its address
+     *  in the reference registry, where a reference's stub reads it. */
+    private setMcplServerConfig;
     /** Register every RFC-005 reference in an MCPL peer's tool-result content
      *  against its server, then fetch by `mode`:
      *  - `register`: nothing. An in-process caller (executeMcplToolCall) may
@@ -1263,13 +1476,18 @@ export declare class AgentFramework {
      *    bound, so fetch_reference can fetch it.
      *  - `model`: eagerly fetch the ones inside the autofetch envelope (below
      *    the eager ceiling, connection origin — never worse than the server
-     *    having inlined the bytes). Failures are non-fatal: the stub then says
-     *    fetch_reference instead of a path.
-     *  - `script`: as `model`, then fetch every reference ("eagerly lazy"): a
+     *    having inlined the bytes, for a reference whose claim is true; a fetch
+     *    it starts stops reading at the first chunk past that ceiling).
+     *    Failures are non-fatal: the stub then says fetch_reference instead of
+     *    a path, and the eager default doesn't choose that reference again.
+     *  - `script`: as `model`, then fetch every reference but a link ("eagerly lazy"): a
      *    script receiving a result is the strongest available signal that the
      *    bytes are wanted (scripts process, they do not browse), so the stub it
      *    receives carries a workspace path it can open directly.
-     *  A uri the result calls expired is fetched in no mode. */
+     *  A uri the result calls expired is fetched in no mode: by its blocks, or
+     *  by `claims` where given, those of everything a script's view of it
+     *  shows (scriptViewClaims), nested fields included, as the module
+     *  route's demand fetch reads them (Ada-1017, room-203 #201013). */
     private autoFetchReferences;
     /** Core agent_settings keys — extension keys must not collide with these. */
     private static readonly AGENT_SETTINGS_CORE_KEYS;
@@ -1284,6 +1502,74 @@ export declare class AgentFramework {
     private spillSettingsExtension;
     private captureInferenceToolSnapshot;
     private toolResultGuardSettingsExtension;
+    /** Whether the agent wants the note on words that land in a closed channel:
+     *  on unless they've turned it off with agent_settings. */
+    private closedChannelNoteOn;
+    private closedChannelNoteSettingsExtension;
+    /** What `who` is told when their words go to a channel that stays closed
+     *  because it closed or declined the channel itself (ChannelRegistry
+     *  closedByAgent), or undefined where nothing needs saying. Speech also
+     *  leaves a channel a module closed as it stands (speechOpens), but there
+     *  the module's own tool is the way back. Every other closed channel opens
+     *  on speech where this host directs its server's lifecycle, as it always
+     *  did, so the agent meets the change here, where speaking used to reopen
+     *  what it had closed. The channel is read on the server the words went
+     *  to. A channel whose transport is open, as when its server refused the
+     *  agent's close, gets none, since its traffic still flows.
+     *
+     *  The rest is judged for its reader, as the opened notices' advice is
+     *  (channelOpenedNotices). That messages addressing it still reach it is
+     *  said where they land in its window: a push, and off a host that routes
+     *  conversations a channel's incoming message, is stored with the delivery
+     *  agent, where the residents' shared slot is read (residentHoldsTraffic),
+     *  and an ephemeral run's window is its own. What a closed channel
+     *  delivers beyond those is the connector's (slack-mcpl delivers ambient
+     *  traffic by its own subscription), so the note promises only those. One
+     *  connector state the host can't see makes that sentence false: a channel
+     *  muted with discord-mcpl's mute_channel delivers nothing, messages that
+     *  address the agent included. The agent that muted it knows. channel_open
+     *  is offered where the reader may call it (canAgentUseTool) and this host
+     *  may open the channel: everywhere but a server that's up without
+     *  channels.lifecycle (lifecycleWithheld), since a reconnecting server's
+     *  grant is empty only until its next exchange, and the note stays in the
+     *  window after that. */
+    private closedChannelNoteFor;
+    /** What an agent is told when a send tool's words go to a channel it tuned
+     *  out, or undefined where nothing needs saying. A send keeps the tune-out
+     *  (ChannelRegistry.openChannelNow), so the agent that sent there expecting
+     *  answers learns they still go to its subconscious. A send tool's answer
+     *  carries this, send_dm's included, or for a code_execution script's send
+     *  a notice in the agent's window: a tune-out diverts a DM too. The same setting
+     *  turns it off, a conversation agent gets none, and a failure while
+     *  working it out is logged and adds nothing, as for the closed-channel
+     *  note. */
+    private tunedOutSendNote;
+    /** How to stop the closed-channel note, said once wherever it appears, to
+     *  a reader that may call agent_settings (canAgentUseTool), with the space
+     *  before it; nothing to one that may not. */
+    private closedChannelNoteOff;
+    /** The closed-channel notes for an agent's words that landed in these
+     *  channels, or none when they've turned the note off. A conversation agent
+     *  gets none: channel_open is refused to it and its settings end with its
+     *  conversation, so neither what the note offers nor turning it off is its
+     *  own, and the resident that owns the channel gets the note for its own
+     *  words. The note is advice: if working it out fails, the words were still
+     *  delivered, so that's logged and nothing is added. */
+    private closedChannelNotes;
+    /**
+     * A send tool's answer, with the closed-channel note where its words
+     * stayed in a channel the agent closed or declined itself, or the tune-out
+     * line where they went to one it tuned out, after the server's own words:
+     * one more text block where the answer is a list of blocks, or a paragraph
+     * where it's text. A code_execution script's send (`forScript`) keeps the
+     * server's answer alone, since the script parses it, and the agent whose
+     * script sent is told in its own window instead, as a notice. The channel
+     * is the one the send went to on its server (resolveSendTarget), from the
+     * id the send's answer or its call named. The note is advice: if working it
+     * out fails, or the window can't take the notice, that's logged, and the
+     * answer stays as it was.
+     */
+    private noteSendIntoKeptChannel;
     /** Every guard's annotation still running, for stop() (agent-framework #277). */
     private readonly guardAnnotations;
     /** Each guard that isn't idle, by agent name, as the guard reports it. An
@@ -1382,6 +1668,7 @@ export declare class AgentFramework {
     cancelAgentRuntimeSettingsTransition(agentName: string, opts?: {
         requester?: OperatorRequester;
     }): AgentRuntimeSettingsSnapshot;
+    private refuseRuntimeSettingsChangeUnderHold;
     /**
      * Wakes that passed the scheduler and now own provider admission while
      * waiting for an in-flight auxiliary call to settle — no turn token yet,
@@ -1650,10 +1937,9 @@ export declare class AgentFramework {
      * delegates to `Agent.buildActivationRequest`. No tokens are spent, no
      * external MCPL server is contacted, no fold resolution is persisted and
      * none of the compression its fold plan calls for is queued; the consumed
-     * watermark and any prepared budget change are left alone; and once
-     * context-manager's thinking binding (context-manager#160, not yet
-     * released) ships, no stamps are committed and no compile awaits
-     * acceptance. In context-manager 0.14 its dry run leaves nothing else
+     * watermark and any prepared budget change are left alone; and with the
+     * thinking binding (`thinkingBinding.binds`), no binding record is
+     * written. In context-manager 0.14 its dry run leaves nothing else
      * behind but the release of an expired compression hold, as any compile
      * does (see `Agent.compileWithInjections`). The preview keeps in-memory
      * bookkeeping of its own, such as handing the context manager the
@@ -1679,6 +1965,16 @@ export declare class AgentFramework {
      *
      * Pass `{ injections: true }` to opt into full-fidelity gathering and accept
      * those side effects (byte-faithful to a real activation's injected context).
+     * An `afterUser` injection a start would store (stored-injections.ts) is
+     * shown where that start's compile would render it, and one it would skip
+     * isn't shown again; nothing is stored. The stand-in isn't weighed against
+     * the budget or shaped as the stored row would be, so where the strategy
+     * would cap, shard or leave out rows to fit it, the start's request
+     * differs from the preview.
+     *
+     * What the dry compile selected, by kind, is `getRequestCompileStats` of the
+     * request this returns. It doesn't count the stand-in, which is added after
+     * the compile.
      */
     previewActivation(agentName: string, opts?: {
         injections?: boolean;
@@ -1747,11 +2043,21 @@ export declare class AgentFramework {
     getModule(name: string): Module | null;
     /**
      * Add or replace (upsert) a gate policy at runtime. Validated and persisted
-     * to gate.json; hot-applied in memory. Throws if no gate is configured or the
-     * policy is invalid. Placement: `'prepend'` puts a rule ahead of EVERYTHING
-     * (including addressed-message wake rules — see EventGate.lintShadows);
-     * `{before: name}` / `{after: name}` anchor it against a specific rule,
-     * which is usually what a sampler or debounce actually wants.
+     * to gate.json; hot-applied in memory. Placement: `'prepend'` puts a rule
+     * ahead of EVERYTHING (including addressed-message wake rules — see
+     * EventGate.lintShadows); `{before: name}` / `{after: name}` anchor it
+     * against a specific rule, which is usually what a sampler or debounce
+     * actually wants. Every rule the change doesn't touch is written back as it
+     * was written. Over a gate.json the gate doesn't use, the change is written
+     * only if gate.json then loads, as when it replaces or removes the rule that
+     * keeps it out. Fields the gate reads nowhere, and that aren't a slip of one
+     * it does, are left out, and named to `onIgnoredFields`, called once the
+     * change is made; a throw from it is logged, not thrown. Throws if no gate is
+     * configured, the policy is invalid, the placement can't be made, gate.json
+     * has no rule list a change could edit, it isn't used and the change doesn't
+     * mend it, or it can't be read, isn't JSON or can't be written
+     * (EventGate.addPolicy). A refusal leaves gate.json as it is; a write that
+     * fails after its open may leave it part-written, and its error says so.
      */
     addGatePolicy(rawPolicy: unknown, options?: {
         position?: 'append' | 'prepend' | {
@@ -1759,10 +2065,14 @@ export declare class AgentFramework {
         } | {
             after: string;
         };
+        onIgnoredFields?: (notes: string[]) => void;
     }): import('./gate/types.js').GatePolicy;
     /**
      * Remove a gate policy by name at runtime. Returns false if it didn't exist.
-     * Throws if no gate is configured.
+     * Throws if no gate is configured, gate.json has no rule list a change could
+     * edit, it isn't used and the removal doesn't mend it, or it can't be read,
+     * isn't JSON or can't be written (EventGate.removePolicy); the rules in
+     * force then stay as they were.
      */
     removeGatePolicy(name: string): boolean;
     /** Current gate policy names (freshest on-disk view). Empty when no gate. */
@@ -1798,7 +2108,7 @@ export declare class AgentFramework {
     private readAgentRuntimeSettings;
     private validatePersistedAgentRuntimeSettings;
     /** Load resident-set inline caps from framework state, dropping (loudly)
-     *  anything that fails the same validation the live update enforces. A
+     *  anything Number() doesn't read as a finite number of at least 1000. A
      *  failed read is logged and boot goes on without them: nothing is lost,
      *  since persistToolResultInlineCap reads the stored caps again before it
      *  writes one. */
@@ -1883,7 +2193,13 @@ export declare class AgentFramework {
      * `{namespace}/messages`, context log to `{namespace}/context`.
      *
      * Data persists after cleanup for investigation and cross-revert.
-     * Call cleanup() when done to release the ContextManager.
+     * Call cleanup() when done with the agent: the agent can't run again. From
+     * the run's end, or from cleanup(), its ContextManager makes no provider
+     * call, and the calls it has out are aborted. It starts no new call while a
+     * surgery holds the store or once stop() has begun, either; one already out
+     * then runs on until stop(), with a store the framework owns, closes the
+     * ContextManager, before the store. Until then the ContextManager stays
+     * open.
      */
     createEphemeralAgent(config: AgentConfig): Promise<{
         agent: Agent;
@@ -1921,8 +2237,9 @@ export declare class AgentFramework {
      * framework drives the stream (emitting traces, logging, dispatching tools).
      * Returns the agent's speech output when it finishes (no more tool calls).
      * Rejects with ProviderWaitNotSleptError when the run ends rather than sleep
-     * a retryable failure's stated wait, and with a plain Error for any other
-     * ending.
+     * a retryable failure's stated wait longer than the framework's ten-minute
+     * cap, or one it can't represent, and with a plain Error for any other
+     * ending, a stated wait its error policy declines among them.
      *
      * The caller provides a pre-created agent + contextManager (from createEphemeralAgent).
      * The task message should already be in the context manager.
@@ -1953,6 +2270,7 @@ export declare class AgentFramework {
      *  hot-reloaded gate.json (same validation as load), so a rule takes effect
      *  immediately and survives restart. */
     private static readonly WAKE_RULE_TOOLS;
+    private static readonly JUDGED_WAKE_RULE_TOOLS;
     /** Discoverability for event tags (MCPL RFC-001): the reserved chat:* core,
      *  each connected server's declared tag ontology, and gate.js status. */
     private static readonly EVENT_TAGS_TOOL;
@@ -1986,26 +2304,13 @@ export declare class AgentFramework {
      * Mark an inference refusal visibly: react on the message that holds the
      * refused agent's conversational locus (the most recent incoming channel
      * message that isn't a reaction, reaction removal, edit or deletion
-     * marker, apart from an edit the coalescer delivers on acceptance as the
+     * marker or a chat:system notice, apart from an edit the coalescer delivers on acceptance as the
      * agent's first view; an ephemeral run has none, so a subagent's refusal
      * marks no message) with a category-specific emoji. Best-effort —
      * failures are logged, never thrown, and non-Discord loci are silently
      * skipped.
      */
     private reactToRefusal;
-    /**
-     * Shed the newest turn: remove the newest message that isn't a system
-     * message, whoever wrote it, with the rest of its exchange (the tool_use
-     * turn paired with a tool result, and the whole of a body stored in
-     * shards). It adds no marker; the caller keeps one consolidated marker for
-     * the episode (updateRewindMarker). The returned record's descriptor says
-     * what was removed and its size, never the content, while the raw record
-     * survives in the chronicle log for forensics. Returns null when only
-     * system messages remain.
-     *
-     * Shared by the refusal rewind, automatic or forced by `/unstick`, and by
-     * the shed after inference exhaustion (quarantinePoisonedHistory).
-     */
     private shedNewestTurn;
     /**
      * Maintain exactly ONE consolidated marker for the current rewind episode,
@@ -2049,8 +2354,11 @@ export declare class AgentFramework {
         ok: boolean;
         error?: string;
         agentName?: string;
-        /** Agent state at queue time — 'idle' means the turn starts on the next
-         *  scheduler pass; anything else means it runs after the current turn. */
+        /** Agent state at queue time — 'idle' means no turn holds the agent, so
+         *  the turn starts on the next scheduler pass unless a provider hold (a
+         *  provider's stated wait, or a capacity cooldown) holds it until the hold
+         *  ends, or a start of the agent's that waits for an auxiliary call to
+         *  finish goes first; anything else means it runs after the current turn. */
         agentStatus?: string;
         /** True when the host is quiesced: the wake is PARKED, not running, until resume(). */
         quiesced?: boolean;
@@ -2078,7 +2386,7 @@ export declare class AgentFramework {
      *   return the snapshot; the operator lever for draining quarantine or
      *   advancing merges during a quiesce window.
      *
-     *   host-status — report the quiesce state (drained / parked wakes /
+     *   host-status — report the quiesce state (drained / waiting wakes /
      *   scripts left running).
      *
      *   release-provider-wait — end an agent's provider wait (a provider's
@@ -2133,6 +2441,14 @@ export declare class AgentFramework {
      * turn alive (no continuation or held retry of one on its way), or it is
      * refused (OperatorActionError 'agent-busy'), and no turn starts until the
      * switch is done.
+     *
+     * Every agent's context manager is re-initialized for the branch before
+     * the store is released (reinitializeManagers). One whose
+     * re-initialization fails raises an ops alert naming its agent
+     * (`context-reinit-failed`), and the switch still resolves. A switch to the
+     * branch the store is already on re-initializes them too, which is how a
+     * manager left refusing by a failed re-initialization is recovered without
+     * a restart.
      */
     switchBranch(name: string): Promise<void>;
     /**
@@ -2144,12 +2460,30 @@ export declare class AgentFramework {
      *
      * The undone branch is saved so `redo()` can restore it.
      * Returns the checkpoint that was undone, or null if nothing to undo.
+     *
+     * The branch moves under every agent sharing the store, so an undo
+     * reserves the store as a surgery does: every agent must be idle, or it is
+     * refused (OperatorActionError 'agent-busy'). It returns once the store has
+     * moved, and the store stays reserved until every agent's context manager
+     * is re-initialized for the new branch, so no turn starts before then. One
+     * whose re-initialization fails raises an ops alert naming its agent
+     * (`context-reinit-failed`). An undo or redo made before the managers are
+     * done moves the store again under the same reservation, and they are
+     * re-initialized for the branch the last one leaves.
+     *
+     * `settled`, present when the store moved, settles once that reservation
+     * is released, every manager re-initialized or its failure alerted, and
+     * never rejects. Await it before work that needs the store free: a
+     * compile on an agent's own context manager, or a write meant to land at
+     * once, which the reservation would defer. An undo or redo that moves the
+     * store again under the same reservation settles with it.
      */
     undoLastTurn(agentName: string, requester?: OperatorRequester): {
         undone: boolean;
         turnIndex?: number;
         fromBranch?: string;
         toBranch?: string;
+        settled?: Promise<void>;
     };
     /** undoLastTurn's work, for a host/command undo already admitted: a stop()
      *  begun by a trace of one of its turns doesn't refuse the next. */
@@ -2159,11 +2493,15 @@ export declare class AgentFramework {
      *
      * Switches back to the branch that was active before the last undo.
      * Returns false if there's nothing to redo.
+     *
+     * It reserves the store and re-initializes every agent's context manager
+     * as undoLastTurn() does, and its result's `settled` is undoLastTurn()'s.
      */
     redo(agentName: string, requester?: OperatorRequester): {
         redone: boolean;
         fromBranch?: string;
         toBranch?: string;
+        settled?: Promise<void>;
     };
     /**
      * Append a record to the operator action log and broadcast it as an
@@ -2203,6 +2541,13 @@ export declare class AgentFramework {
      * does. Always release in `finally`: a token nobody clears wedges the fleet.
      */
     private reserveStoreForSurgery;
+    private reinitializeManagers;
+    private reportLongHold;
+    private disposeEmptiedForks;
+    private reportReinitFailures;
+    private reportReinitFailure;
+    private beginSyncMove;
+    private reinitializeAfterSyncMove;
     /**
      * A surgery's marker batch, recorded before its body change. If it can't
      * be recorded, the surgery doesn't start, and the error says what the
@@ -2511,6 +2856,7 @@ export declare class AgentFramework {
      * the template ("trunk") is a dormant warm checkpoint, not a listener.
      */
     private routeConversationIncoming;
+    private writeToFork;
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
      * template agent: own ContextManager under `conversations/{name}`, seeded
@@ -2543,13 +2889,15 @@ export declare class AgentFramework {
      * Store the router's counters with the spawn's generation, create the fork
      * the decision names and bind its channel to it, registered in
      * conversationSpawns under the channel until it settles. The store runs
-     * inside the spawn's promise, still in routeConversation's synchronous
-     * step, so a store that throws rejects the spawn, which each caller reports
-     * as a failed spawn, rather than throwing out of routeConversation before
-     * the caller's try. routeConversation registers a spawn only when none is
-     * in flight for the channel, and only this spawn's settlement removes it,
-     * so the entry it removes is its own. It's removed before anyone waiting
-     * on it resumes, so a waiter that decides again doesn't find it.
+     * inside the spawn's promise, after it waits out a move's hold, so the
+     * counter lands on the branch the fork is created on; with no hold up, it
+     * runs in routeConversation's synchronous step. Either way a store that
+     * throws rejects the spawn, which each caller reports as a failed spawn,
+     * rather than throwing out of routeConversation before the caller's try.
+     * routeConversation registers a spawn only when none is in flight for the
+     * channel, and only this spawn's settlement removes it, so the entry it
+     * removes is its own. It's removed before anyone waiting on it resumes, so
+     * a waiter that decides again doesn't find it.
      *
      * It binds only while the fork it created is still the agent registered
      * under its name. stop() ends each live fork and unbinds the channels
@@ -2582,8 +2930,9 @@ export declare class AgentFramework {
      * and keeping the agent registered would just grow every agent scan and
      * broadcast filter forever. Its window is released now, or, while the host
      * is quiesced, at resume (releaseWindowNowOrAfterResume); when stop() ends
-     * it then, stop()'s pass for postponed releases passes on the failed
-     * replies it left unread instead. No binding names it
+     * it then, stop()'s pass for postponed releases passes on what it left
+     * unread that the primary takes in its place instead (passesToPrimary:
+     * failed replies, channel notices, module writes). No binding names it
      * by then: the idle sweep unbinds its channel as the closure begins,
      * stop() unbinds it just before it ends the fork, and a spawn whose fork
      * stop() has ended binds nothing (spawnConversationAgent). The fork's
@@ -2643,14 +2992,22 @@ export declare class AgentFramework {
      * only that messages addressing the agent reach it whether or not it opens
      * the channel: it is shown only when one has arrived from a closed channel,
      * and both servers deliver them either way. What else arrives is for the
-     * server to say on its push. Option 1 says a reply opens the channel,
-     * because routeSpeech opens a closed channel before delivering into it. Its
-     * old follow-up warning assumed the channel stays closed after the reply,
-     * which that open makes false (and on discord-mcpl, channels/open also
-     * subscribes). When the surface tracks a missed-ambient tally
-     * (discord-mcpl sends `missedMessages`/`missedCharacters` in push origin),
-     * the invitation shows the count — the cost of staying out, as a number, at
-     * decision time.
+     * server to say on its push. Option 1 says what a reply does, which
+     * speechOpens decides: a reply opens a closed channel nobody decided to keep
+     * closed, and leaves one the agent closed or declined itself closed. What
+     * else reaches the agent from a channel left closed is its server's to say
+     * on its push, so the option says nothing about it. When the surface tracks
+     * a missed-ambient tally (discord-mcpl sends
+     * `missedMessages`/`missedCharacters` in push origin), the invitation shows
+     * the count — the cost of staying out, as a number, at decision time.
+     *
+     * No invitation on a direct message (`chat:dm`): every message of a DM is
+     * addressed, so it reaches the agent open or closed, and there is nothing
+     * to miss or open. A DM registers closed, and stays closed until the agent
+     * answers it, or for good once the agent closes it, so without this a DM
+     * would carry the block. The tag describes the message, not the channel:
+     * a whisper tagged `chat:dm` inside a shared channel that is closed
+     * carries no invitation either.
      */
     private buildClosedChannelInvitation;
     /**
@@ -2740,7 +3097,8 @@ export declare class AgentFramework {
     /** Queue a wake for each agent of the batch's audience, when its latest
      *  occurrence triggers inference. `plain`: an ordinary push wake, without
      *  the subject a withdrawal of the batch's wakes goes by, for a render
-     *  placed in its agent's deferred queue (wakeToRead), at `readsDeferredWrite`. */
+     *  placed in its agent's deferred queue (wakeToRead), at `readsDeferredWrite`,
+     *  marked ambient when every notice the render folds was (`allAmbient`). */
     private queueCoalescedWakes;
     /** Withdraw unstarted wakes whose sole cause is this subject (§4.2). */
     private cancelCoalescedWakes;
@@ -2776,6 +3134,34 @@ export declare class AgentFramework {
      * a fork is that fork's conversation, so no other agent takes it.
      */
     private mayTakeGateRoute;
+    /**
+     * The one channel a wake's channel names: `channelId` on `serverId` when
+     * the wake gives its server, otherwise the one registered channel that id,
+     * or its server-qualified name, means (ChannelRegistry.channelsNamed).
+     * Undefined when it means none or several: channel ids are unique only
+     * within one server's connection (MCPL §14.2), and a name two servers'
+     * channels answer to is never resolved to either.
+     */
+    private channelNamed;
+    /**
+     * Explicit mode's typing channel for one start of a turn, which has no
+     * locus, read once as the start opens (driveStream then shows what the
+     * start showed, TurnRouting.typing): where that start's wake came from,
+     * its trigger's channel with its server (channelNamed), so a start batched
+     * with a new wake shows typing where that wake came from. Not the turn's
+     * trigger channel, which a channel_open moves as the turn's default
+     * outgoing channel. A start whose wake names no one channel, as a budget
+     * restart's or a re-inference's names none, keeps the channel the turn
+     * shows typing in (TurnRouting.typing), showing it again where a stop or
+     * a failed start ended the indicator, since the turn is still at work
+     * there; a turn that has shown none, as a heartbeat's, shows none. A guard
+     * retry's wake is its start's, read again. In a turn that has no channel
+     * (TurnRouting.noChannel), a wake named without its server isn't read: a
+     * retry's trigger names it again, and reading it then could take a
+     * channel the turn never had. A wake that gives its server, as every one
+     * the framework makes for a channel does, names that pair.
+     */
+    private explicitTypingChannel;
     /**
      * Derive the MCPL composite channel id (the outbound routing locus) for a
      * push event from its server-defined `origin`, if it carries one.
@@ -2822,7 +3208,10 @@ export declare class AgentFramework {
     /** Record plain-prose segments this turn suppressed without drafts (proseRouting=disabled, or a round withheld before its scripts returned). */
     private recordProseSuppression;
     /**
-     * Silenced plain speech: an explicit send holds it as resendable drafts; a
+     * Silenced plain speech: an explicit send that may have posted where it was
+     * going holds it as resendable drafts (in a round that calls `drafts` and
+     * sends nothing else, 'kept', its plain speech is kept and counted
+     * instead); a
      * deliberate silence (skip_reply, a silent turn, or a private think in
      * the same native round, where that policy applies: an XML-mode round has
      * no verbatim content to route live, so its prose is routed at the turn's
@@ -2830,9 +3219,12 @@ export declare class AgentFramework {
      * counted for the receipt, never drafted. `segments` are the runs exactly
      * as written (splitProseRuns), so a draft keeps the resident's words byte
      * for byte. What it holds, keeps or moves is the round's turn's
-     * (round.routing), whenever the hold runs.
+     * (round.routing), whenever the hold runs. Hybrid speech under a send goes
+     * through routeSilencedHybrid.
      */
     private holdSilencedProse;
+    private routeSilencedHybrid;
+    private sendHoldText;
     /**
      * Hold plain speech as drafts (src/prose-drafts.ts) instead of
      * letting it vanish: journaled durably and recorded for the receipt of the
@@ -2851,7 +3243,9 @@ export declare class AgentFramework {
     private draftTime;
     /** A draft's opening words, for the drafts tool's listing only. */
     private static draftPreview;
-    private static destinationText;
+    /** A destination as the agent is shown it: its label, with its name as
+     *  ChannelRegistry.nameShown gives it. */
+    private destinationText;
     /** One line per draft: id, state, when, why, size, preview. */
     private draftLine;
     /** A draft's state in words that claim only what is known. */
@@ -2882,6 +3276,16 @@ export declare class AgentFramework {
      * queue names.
      */
     private noticeUnnoticedDrafts;
+    /**
+     * Turn start, every one: where the agent's history holds neither its
+     * latest direct write to a mount nor the notice of its departure
+     * from it, as after an undo or another move of the store's head away from
+     * that write, the workspace's notice that those writes are still on disk
+     * goes into the history, privately, before the compile, as the drafts
+     * notice does, and the workspace keeps its id (headMoveNotice). On an
+     * unmoved head it finds nothing due and stores nothing.
+     */
+    private noticeHeadMoves;
     /**
      * Logical turn end, after the turn's deferred notices are flushed: record
      * as noticed exactly the drafts a stored message names (the receipt, a
@@ -2921,6 +3325,9 @@ export declare class AgentFramework {
      * drafts. Private to the calling resident. `resend` is an explicit send:
      * each draft is published verbatim, in order, through the normal publish
      * executor, its attempt journaled durably before the request leaves.
+     * `turn` is the turn the call was made in (callingTurnOf), none for a
+     * call made outside the agent's current turn: a resend's destination names
+     * its own channels (ownChannels) by their ids, and its sends engage it.
      */
     private handleDraftsTool;
     /** Why a draft can't be resent now (dismissed, or possibly already posted
@@ -2942,6 +3349,19 @@ export declare class AgentFramework {
      * ([discord-send-failed]); this is the success half.
      */
     private appendProseDeliveryReceipt;
+    private nameUnpostedSpeech;
+    private noteFailedTurnEnd;
+    /**
+     * The closed-channel note alone, in a send's words, at explicit mode's turn
+     * end, which has no `[delivered]` receipt since the agent named every
+     * destination itself. A `>>` into a channel the agent closed or declined
+     * leaves it closed, so the note goes wherever the turn's speech stayed in
+     * such a channel, once per channel. It goes through addMessage, as the
+     * open notices do: held while the agent has a turn alive and written at
+     * that turn's next boundary, so it reaches the agent once and never
+     * mid-turn. No-op otherwise.
+     */
+    private appendClosedChannelNoteAlone;
     /**
      * Announce-on-change locus notice (turn-frozen routing). Appends a durable
      * `[routing]` window message when the turn's effective outbound locus
@@ -2987,6 +3407,65 @@ export declare class AgentFramework {
      * window's all the same, so it's returned, and a tool boundary injects it.
      */
     private storeDueClock;
+    /**
+     * Store `agent`'s `afterUser` injections in its own window, as the
+     * messages `compile()` would have placed after the last user message, and
+     * return the injections left for `compile()` to place: the rest, and any
+     * that couldn't be stored (stored-injections.ts, #155 part 5). Which are
+     * stored, and which skipped, is planInjectionStores'.
+     *
+     * Nothing is stored while the window is held (slotHeldFrom: the host is
+     * quiesced, or another reader of the residents' shared slot has a turn
+     * alive, as for a clock row): `compile()` places what the plan would have
+     * stored, and what it skips, being in view already, isn't placed again.
+     * Rows are written in the order gathered. A row whose write throws is
+     * placed by `compile()` instead, with every row after it, unless the
+     * read-back shows it landed; where the read-back fails, a row whose write
+     * returned counts as landed and the rest are placed, so the request may
+     * carry a landed one twice, which is logged as unknown.
+     */
+    private storeInjections;
+    /**
+     * Which of `injections` a start stores in `agent`'s window, and which it
+     * leaves for `compile()`. Each source's stored kind (isStoredKind), by
+     * namespace, is one unit. A unit is skipped, neither stored nor placed,
+     * when the copy the agent will read as that namespace's current one has
+     * every part of it with the same content: the newest copy this agent
+     * stored since its last request compiled to send, where a start stored one
+     * and its compile then didn't record, as when it threw
+     * (Agent.unsentInjection), and otherwise the
+     * newest stored unit of that namespace the last request held
+     * (Agent.renderedInjection). It's where the agent saw it, or will see it
+     * at this compile, and placing it again would move it; a fold or scroll-out
+     * since costs one request, as below. A part the strategy cut at its
+     * per-message cap, or stripped an image from, counts as held, since a new
+     * copy would meet the same. One a fold has summarized, a strategy's window
+     * has scrolled past, a throwing write left part-stored, or that no request
+     * since this agent started has held (and no failed start since has
+     * stored), is stored again at the next start,
+     * so the agent has the current copy at the cost of one more row: a fold
+     * between two starts leaves the request after it with the summary's word,
+     * and the start after that stores it again. The rows to store come in the order gathered,
+     * as `compile()` would have placed them. A stored row is appended, so
+     * where the window ends on a user message (a turn's start, a restart
+     * after tool results) it lands where `compile()` would have placed it;
+     * where it ends on the agent's latest reply (a wake with nothing new), it
+     * lands after that reply, where `compile()` placed it after the last user
+     * message, before the reply, or at the end when there was none.
+     * Undefined when there's nothing of the stored kind.
+     */
+    private planInjectionStores;
+    /**
+     * Whether a write the framework makes into `agent`'s window of its own
+     * accord (a clock row, a batched wake's line) waits: while the host is
+     * quiesced, or, for a reader of the residents' shared slot (the
+     * subconscious, which reads it through a merged view, included), while
+     * another reader of it has a turn alive, where it would land inside that
+     * turn.
+     */
+    private slotHeldFrom;
+    /** Rows isNewestIn reads back past clock rows and stored injections. */
+    private static readonly NEWEST_SCAN_ROWS;
     /** Rows a window's last-clock scan reads at a time. */
     private static readonly CLOCK_SCAN_ROWS;
     /** What the next clock is planned from: the window's newest row's time and
@@ -3019,11 +3498,12 @@ export declare class AgentFramework {
      */
     private noteForOtherResidents;
     /**
-     * Show the turn's typing indicator in `channelId`, stopping the one it last
+     * Show the turn's typing indicator in `channel`, stopping the one it last
      * showed elsewhere: this stream's, or one an earlier stream of the turn
      * left running when it handed the turn on.
      */
     private showTurnTyping;
+    private heardSince;
     /**
      * The channel of the turn's newest arrival whose message is still in the
      * agent's store (TurnRouting.arrivals). A message removed since it was
@@ -3053,8 +3533,9 @@ export declare class AgentFramework {
      * when the server next registers the channel), or an open that the agent's
      * own delivery or reply caused (`opened-by-delivery`, `opened-by-reply`),
      * once its transport is confirmed. It names `channel_close` as the opt-out
-     * (neither the subscription policy nor the server's default reopens a
-     * channel the agent closed) only where the agent it's addressed to can
+     * (neither the agent's own speech there, the subscription policy nor the
+     * server's default reopens a channel the agent closed: speechOpens and
+     * ensureInitialDesiredState) only where the agent it's addressed to can
      * call it for every channel it names (canCloseChannels): a conversation
      * fork may close only its home channel, and an agent's allowedTools can leave
      * channel_close out. The other residents can read it too, where several
@@ -3070,6 +3551,7 @@ export declare class AgentFramework {
      * locus-eligible.
      */
     private recordChannelAutoOpenNotice;
+    private tellReasoningLoss;
     /**
      * Write a builder's channel notices in order, each on its own: one that
      * can't be written is logged, and the rest are still written. A reader's
@@ -3099,14 +3581,14 @@ export declare class AgentFramework {
      */
     private channelOpenedNotices;
     /**
-     * Whether `who` can call channel_close for every one of `channelIds` here:
+     * Whether `who` can call channel_close for every one of `channels` here:
      * its allowedTools hold it (canAgentUseTool), and a conversation fork,
      * whose channel_close dispatchChannelToolCall refuses for any channel but
      * its home, only for its home.
      */
     private canCloseChannels;
     /**
-     * Whether `who` holds the traffic of every one of `channelIds`, so that
+     * Whether `who` holds the traffic of every one of `channels`, so that
      * what an open channel delivers is in its window. Where conversations are
      * routed, an incoming message goes to the fork its channel is bound to, or
      * nowhere, and never to the primary (handleMcplChannelIncoming), so a fork
@@ -3208,8 +3690,77 @@ export declare class AgentFramework {
      * a turn abandoned by a quiesce asks for none.
      */
     private requestProseContinuation;
+    /**
+     * autoContinue (AgentConfig.autoContinue): after a turn the model ended
+     * itself (AUTO_CONTINUE_STOP_REASONS), with prose or with nothing, queue
+     * another, unless its last word was a skip (`>>skip_reply`, or a hybrid
+     * `>>>skip_reply` hold still standing). Runs at the logical turn end of a
+     * stream's `complete`, after the turn's deliveries and `[delivered]`
+     * receipt, and only when the turn asked for no ` !` continuation (that one
+     * runs instead). A tool that ends the turn (skip_reply, sleep) never
+     * reaches here, and clears the run's count.
+     *
+     * It continues only an agent that has a way to stop it is offered: the
+     * skip_reply tool, or in explicit/hybrid mode a skip envelope. It leaves
+     * a turn whose closing prose bounced to the bounce, and never continues an
+     * ephemeral run or a conversation fork. The wake names
+     * the turn's locus, or the unresolved channel of a turn that had none, so
+     * the next turn speaks, or doesn't, where this one did; a batched message's
+     * channel outranks it. Its mark (InferenceRequest.autoContinueRun) holds
+     * what the `[continue]` row says, written as the turn starts
+     * (startAgentStream). A run is capped at maxConsecutive; the last allowed
+     * row says so, and the cap holds until a turn starts with a cause of its own.
+     */
+    private autoContinueAfterTurn;
+    /** How an autoContinue agent stops a run, as its `[continue]` row says it,
+     *  or undefined when no way is offered: the skip_reply tool when the
+     *  channel registry offers it and the agent may call it, else a skip
+     *  envelope in explicit or hybrid mode. */
+    private autoContinueStop;
+    /**
+     * Store a continuation's `[continue]` row in the agent's window as its turn
+     * starts (startAgentStream), with the run's count as it stands and the
+     * agent's cap. False when it couldn't be stored.
+     */
+    private writeAutoContinueNotice;
+    /** Whether another reader of the residents' shared slot has a turn alive,
+     *  so no row may be written there now (as storeDueClock checks). */
+    private sharedSlotBusy;
+    /** A continuation whose turn doesn't run: the run's count goes back to
+     *  what it was before it was queued. */
+    private giveBackAutoContinue;
     /** The agent's routing state for its current turn, made when it has none. */
     private routingOf;
+    /**
+     * A turn's own channels, every channel that has been its trigger or its
+     * locus (TurnRouting.wasIn), so a channel_open or a re-pin adds one and
+     * drops none: a `>>` target, a drafts resend's destination or a channel
+     * tool's name one of them answers to by its id means that channel, on its
+     * server (ChannelRegistry.ownChannelNamed). A tool call takes them only
+     * when it is made inside that turn (callOwnChannels).
+     */
+    private ownChannels;
+    /**
+     * The agent's current turn, where a tool call was made inside it, else
+     * none: a call made outside it, such as a script's left running after its
+     * turn, carries no turn (ToolCall.callerTurnId), and a script's call in a
+     * turn other than the one that started the script isn't that turn's. The
+     * one test for both what a call's names mean (callOwnChannels) and which
+     * turn's routing it may change: a channel_open's move of the trigger and
+     * locus, and the engagement of a send or a drafts resend. Read while the
+     * call is dispatched, since a script's start turn is kept only then.
+     */
+    private callingTurnOf;
+    /** What a publish a call makes is credited with having read
+     *  (Agent.notePublished): its agent's consumed watermark at the call, or,
+     *  for a script's call, the watermark when the run call started the
+     *  script. A script is written then, and a later round's wait that watches
+     *  it shares the turn's id but not what the agent has read since, so the
+     *  script's words can't answer anything injected after it started. */
+    private publishReadThrough;
+    /** The own channels (ownChannels) of the turn a tool call was made in
+     *  (callingTurnOf), and none for a call made outside it. */
+    private callOwnChannels;
     /**
      * Explicit-prose-routing delivery gateway (docs/explicit-prose-routing.md),
      * entered directly: parse the `>>` prefix, resolve the target, deliver, or
@@ -3251,6 +3802,7 @@ export declare class AgentFramework {
     private draftStateNow;
     /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
     private deliverHybridProse;
+    private deliverHybridEnvelope;
     /** `>>skip_reply {{unsent}}` and its hybrid form: set the latest bounce
      *  draft aside — unless it is being sent right now, which a dismissal
      *  can't call back: the resident is told instead. So are a dismissal whose
@@ -3307,7 +3859,8 @@ export declare class AgentFramework {
      * abandon or a stop of a registered agent settles the turn as it settles a
      * turn's start (endStoppedStart: one inference:aborted, the turn settled,
      * the gate released). Any other drop ends it as a start dropped before it
-     * sends anything ends. That frame, if it hasn't let go of its token yet,
+     * sends anything ends, and settles a registered ephemeral run's turn with
+     * the drop's reason. That frame, if it hasn't let go of its token yet,
      * ends on its own and settles nothing. What was deferred for the agent
      * lands now, or at that frame's end.
      */
@@ -3317,8 +3870,9 @@ export declare class AgentFramework {
      * admission, the hold installs nothing (holdForProviderWait,
      * holdProviderAcceleration), so no retry follows the turn's
      * inference:failed, and the turn ends as a retry a stop cancelled ends, with
-     * an inference:aborted saying so. Nothing is written. True when it ended
-     * the turn.
+     * an inference:aborted saying so. Nothing is written but the
+     * [speech-not-posted] notice, for speech the turn's rounds left unposted.
+     * True when it ended the turn.
      */
     private endFailureAtStop;
     /**
@@ -3353,6 +3907,42 @@ export declare class AgentFramework {
      * terminal, and the caller's goes with it.
      */
     private takeStartStop;
+    /**
+     * Cancel a stream the framework stops, under `kind`, the mark that tells
+     * the stream's end apart from a caller's stop (frameworkCancelledStreams).
+     * A mark records a cancel that happened, so a cancel that throws takes its
+     * mark back, leaving an earlier mark of the same stream as it was, and the
+     * throw goes on to the caller. With no `kind` (the agent holds no stream),
+     * nothing is marked.
+     */
+    private cancelUnderMark;
+    /**
+     * Cancel a live stream the framework ends at a tool boundary (`site` says
+     * where), under its mark. A cancel that throws leaves the stream going: its
+     * mark is taken back (cancelUnderMark), `onFailed` undoes what the site
+     * did ahead of the cancel, and the failure is logged. The stream waits for
+     * the round's results, which the boundary doesn't send, and the turn holds
+     * its token until the stream ends, as an abort does when its own cancel
+     * goes through. Only an operator's abort or stop, or an ephemeral run's
+     * idle watchdog, comes back to it, so an operator alert says so too.
+     * Returns whether the cancel went through.
+     */
+    private cancelLiveStream;
+    /**
+     * Cancel a stream a start compiled and won't send (`site` says why).
+     * Membrane's yielding stream starts its request when it is first iterated,
+     * and this one never is, so it has sent nothing: a cancel that throws is
+     * logged, and the start's cleanup goes on as if it had worked.
+     */
+    private cancelUnsentStream;
+    /**
+     * Cancel a stream that no longer owns its agent: the agent was replaced or
+     * removed, or a newer stream took it. Its frame settles nothing and is
+     * leaving, so a cancel that throws is logged and the frame leaves all the
+     * same. Thrown on, it would reject driveStream's promise, which nothing
+     * awaits but stop().
+     */
+    private cancelSupersededStream;
     /**
      * End a start that a stop reached before it sent anything, through the
      * terminal the same stop gets on a live stream: a caller's stop as
@@ -3373,12 +3963,15 @@ export declare class AgentFramework {
     /**
      * Execute a tool call and return the result.
      * Routes to the appropriate handler (module registry or MCPL).
-     * Used by SubagentModule to dispatch tool calls for ephemeral agents.
+     * Its one caller in the framework is the operator's puppet
+     * (puppetToolCall), which puts the agent's inline cap on the call as
+     * resultMaxChars; a host may call it as well.
      *
-     * This public entry always carries AGENT origin. Ephemeral/promise-based
-     * callers are models, and provenance must identify which internal path a
-     * call entered through — a public method shared with model callers can
-     * never confer module trust, whatever the input claims. Module origin
+     * This public entry always carries AGENT origin. Its callers act for an
+     * agent, the puppet as the agent and a host for the model it runs, and
+     * provenance must identify which internal path a call entered through — a
+     * public method shared with model callers can never confer module trust,
+     * whatever the input claims. Module origin
      * exists only through the private closure handed to ModuleRegistry
      * (ctx.callTool → executeToolCallFrom with {kind:'module'}), which is exempt
      * from agent allowlists. Registered agents' allowedTools is enforced at
@@ -3432,16 +4025,55 @@ export declare class AgentFramework {
     /** puppetToolCall's work, run where stop() can wait for it. */
     private runPuppetToolCall;
     private executeToolCallFrom;
-    /** A programmatic call of an MCPL tool: `serverId` and `prefix` as resolveMcplTool matched them. */
+    /**
+     * RFC-014: the calls toolsets--act resolved to a server's dynamic tool,
+     * with the instance each is for (`_meta["mcpl/instance"]`, §5.5). The MCPL
+     * dispatch paths read it: such a call isn't refused as a dynamic tool
+     * called by name, and carries its instance. Nothing else about it differs
+     * from a direct call of the tool. Created on first use, so a framework
+     * assembled field by field (as unit tests do) needs no setup for it.
+     */
+    private toolsetActCalls?;
+    private puppetChanges?;
+    /** RFC-014 §6.1: a change reaches the agent once, so it goes with a result
+     *  only where the result is stored in an agent's window (the puppet's) or
+     *  handed to an agent awaiting it; null where it may not reach one. */
+    private changeTaker;
+    /** A toolsets--act call resolved (resolveAct) to the call of the server's
+     *  tool it makes, under that tool's model-facing name and with its
+     *  arguments, its id kept; or the reason it can't be sent. */
+    private resolveToolsetAct;
+    /**
+     * RFC-014 §8.2: a toolsets--act call from the agent (the model's, or a
+     * script's) goes down the path a direct call of the server's tool takes
+     * (dispatchMcplToolCall): its agent's allowedTools, the server's tool
+     * policy, the state exchange, RFC-005's reading of the result, the tool
+     * change shown after it, and RFC-007's lifecycle, which describes the call
+     * as that tool, with its arguments, before it opens. Only
+     * `_meta["mcpl/instance"]` is added. A call act can't resolve is refused
+     * before anything is sent.
+     */
+    private dispatchToolsetAct;
+    /** A programmatic call of an MCPL tool: `serverId` and `prefix` as
+     *  resolveMcplTool matched them, or as toolsets--act resolved them
+     *  (toolsetActCalls). Its RFC-014 tool change goes with its result only
+     *  where the result is stored in an agent's window or handed to an agent
+     *  awaiting it (changeTaker); any other caller's
+     *  result may never reach one, so its change is told as a notice
+     *  (ToolsetController.tellUnlessClaimed). */
     private executeMcplToolCall;
+    private withWholeChange;
+    private withActStateHint;
     /** Event-pushing wrapper for the model-driven dispatch path. */
     private dispatchCodeExecutionToolCall;
+    private decideWaitingRound;
     /**
      * A model-issued tool's result has arrived. When it answers the last of
-     * the code_execution calls a round waits on (ScriptRound), the round's
-     * prose is routed now, its scripts' calls counted.
+     * the code_execution calls and sends a round waits on (ScriptRound), the
+     * round's prose is routed now, its scripts' calls counted.
      */
     private settleScriptRound;
+    private sendReachOf;
     /**
      * Whether a code_execution call watches a script that can change its
      * round's routing, so the round waits for the call (ScriptRound): a run's
@@ -3481,12 +4113,21 @@ export declare class AgentFramework {
     /** The tools a script of this agent may call now: the agent's own surface, without code_execution. */
     private scriptTools;
     /**
-     * The first read-write mount without an include, or null. The framework
-     * keeps its own files there (`tool-results/`, `refs/`). A mount with an
-     * include holds only the files it names, so it would refuse them, and a
-     * setup whose only writable mount has one is treated as having none.
+     * The first read-write mount without an include that isn't configured
+     * direct, or null. The framework keeps its own files there
+     * (`tool-results/`, `refs/`). A mount with an include holds only the files
+     * it names, so it would refuse them, and a setup whose only writable mount
+     * has one, or is direct, is treated as having none.
      */
     private firstWritableMountName;
+    /**
+     * Why firstWritableMountName found no mount, for the words that say so:
+     * none writable without an include, or only mounts configured direct, which
+     * it passes over.
+     */
+    private noFileMountText;
+    /** Whether firstWritableMountName passed over a writable mount without an include because it's configured direct. */
+    private directPassedOver;
     /**
      * A script's word to its agent: a wake_agent() payload, or the ending of a
      * left script that failed, crashed or was stopped at its limit. It enters
@@ -3526,15 +4167,16 @@ export declare class AgentFramework {
      * the image stays reachable by provenance after the bytes leave the wire.
      *
      * The live copy is the stored text itself unless the result is a content
-     * array carrying an inline image, which tryNativeToolResultContent sends
-     * as native blocks. It takes the same arrays the serializer takes block by
-     * block, and shows each image and each reference block's stub whole and
-     * each text block up to where it cuts that block at the cap (`maxChars`,
-     * toolResultCutAt), so those are the ranges of the text it showed.
+     * array carrying an inline image whose links and markers fit the cap
+     * together (goesNative). Then `live` holds the blocks this text was made
+     * from, which toMembraneToolResult sends as native blocks (nativeContent),
+     * showing each image, stub and marker whole and each text block up to where
+     * it cuts that block at the cap (`maxChars`, toolResultCutAt), so those are
+     * the ranges of the text it showed.
      */
     private storedToolResultText;
     /** Where a tool result labelled `label` is written: `<first writable
-     *  mount without an include>/tool-results/<label>.txt` (see
+     *  mount without an include, not configured direct>/tool-results/<label>.txt` (see
      *  firstWritableMountName), or null when there is no such mount. */
     private toolResultFilePlace;
     /**
@@ -3595,7 +4237,9 @@ export declare class AgentFramework {
      * what the model would read: a structured result's blocks as the dispatch
      * gave them (the direct reading, with RFC-005's treatment of an MCPL peer's
      * blocks there, bound to the server that sent them), a module's under
-     * history's reading of RFC-005 at every depth (shownToScript), and
+     * history's reading of RFC-005 at every depth (shownToScript), each
+     * reading the claims of everything the script's view shows, nested fields
+     * included (scriptViewClaims), and
      * otherwise one text block of the model's text, which for a failure is its
      * error. A module's is any result whose call the dispatch didn't send to
      * a server (`toServer`, from the call's waiter). `structuredContent` is the
@@ -3617,9 +4261,11 @@ export declare class AgentFramework {
      * RFC-007: with an `origin`, observers see the call as they see a model
      * call (register, dispatch with its refusal sites, open; the terminal at
      * the waiter intercept), under the inner tool's own name and class.
-     * `turnId` is the turn the call was made in (dispatchToolCall). `route` is
-     * the waiter's: the dispatch sets `toServer` when it sends the call to a
-     * server.
+     * `turnId` is the turn the call was made in (dispatchToolCall), the turn
+     * of the run or wait call watching the script; `start` is what the script
+     * was started with, its turn and its agent's reading, which its words
+     * carry (scriptCallStarts). `route` is the waiter's: the dispatch sets
+     * `toServer` when it sends the call to a server.
      */
     private dispatchScriptToolCall;
     /**
@@ -3643,17 +4289,20 @@ export declare class AgentFramework {
     private liveTurns;
     private toMembraneToolResult;
     /**
-     * If `data` is an MCP tool-result content array carrying at least one image,
-     * convert to Membrane's native ToolResultContentBlock[]. Returns null when
-     * the array is text-only (let JSON path handle it; saves a code path).
-     * `maxChars`, when provided, caps each accompanying text block so an image
-     * inlined alongside an enormous text payload can't blow the context. A
-     * block is cut at the cap as the stored copy's cut at that cap is
-     * (toolResultCutAt), never inside a slot, so the stored copy can keep
-     * exactly the slots this showed (#403); under a readers' bound the stored
-     * copy's cut can come earlier (cutStoredToolResultToFit).
-     */
-    private tryNativeToolResultContent;
+     * A content array's blocks (toolResultBlocks) as Membrane's native
+     * ToolResultContentBlock[], for a caller that found they go natively: at
+     * least one image, with links and markers that fit the cap together
+     * (goesNative), which this doesn't check. Each image as itself, each text block
+     * cut at the cap, and every other block whole, as the text the stored copy
+     * shows for it. `maxChars`, when provided, caps each text block so an image
+     * inlined beside an enormous text payload can't blow the context. A block
+     * is cut as the stored copy is at that cap (toolResultCutAt), never inside a
+     * slot, so the stored copy can keep exactly the slots this showed (#403);
+     * under a readers' bound the stored copy's cut can come earlier
+     * (cutStoredToolResultToFit). Each text is already well formed, as the
+     * stored copy's is (toolResultBlocks).
+     */
+    private nativeContent;
     private toolImageLedgerFor;
     /** Strategy-derived per-message bound (maxMessageTokens * 4 chars). */
     private strategyDerivedToolResultChars;
@@ -3728,8 +4377,9 @@ export declare class AgentFramework {
     }>;
     /**
      * Find the MCPL server for a tool: [serverId, prefix], or null.
-     * The tool listing decides: the server whose tools/list offered the
-     * name, after its tool policy, as of the last tool refresh (a server that
+     * The tool listing decides: the server whose tools/list listed the name
+     * (offered to the model, or an RFC-014 dynamic tool, which dispatch then
+     * refuses by that name unless the published list or the server's latest tools/list puts it as static), after its tool policy, as of the last tool refresh (a server that
      * closed since keeps its names until the next one). A name the listing
      * doesn't hold (invented by the model, or no longer listed) goes to the
      * longest matching prefix. Prefixes that meet, such as `foo` and
@@ -3742,10 +4392,13 @@ export declare class AgentFramework {
      * while unregistered. Genuine legacy caller names retain their surface. */
     private canAgentUseTool;
     private agentToolPermissionFailure;
+    private markedInputFailure;
+    private cutOffResults;
     /**
-     * A dispatched call answered without running its tool. RFC-007's lifecycle
-     * forgets it, and its result says it was refused (`ToolResult.refused`), both
-     * from here, so the two can't disagree.
+     * A call answered without running its tool: one the dispatcher refused, or
+     * one in the last round of a response the output limit cut off. RFC-007's
+     * lifecycle forgets it, and its result says it was refused
+     * (`ToolResult.refused`), both from here, so the two can't disagree.
      */
     private refusedResult;
     /**
@@ -3766,7 +4419,8 @@ export declare class AgentFramework {
      * A call as its round's routing counts it, made directly, or by a script
      * and reaching the host while a run or wait call of the round watches it
      * (ScriptRound). A skip_reply refused, because the agent's allowedTools
-     * doesn't name it or because this host can't set the wake it asks for, is
+     * doesn't name it, because its arguments are refused (markedInputRefusal)
+     * or because this host can't set the wake it asks for, is
      * marked refused: it keeps its own round private and silences nothing after
      * it. A refusal withholds the call's effect, not the model's choice to keep
      * its words private. Any other call the list refuses posted nothing, so it
@@ -3784,6 +4438,61 @@ export declare class AgentFramework {
     private dispatchToolCall;
     private dispatchToolCallEvent;
     private addMessage;
+    /**
+     * Whether an MCPL event's own stored entry is the newest entry in the window
+     * a batched wake's line is written to (deliveryAgent(): the primary's), with
+     * no turn alive there (turnAlive: started, streaming, or waiting on its
+     * tools) and nothing waiting to be written (deferred). The gate then hands
+     * the line to the wake (WakeLine) instead of writing it, and the turn's
+     * start decides it (placeWakeLines). A channel message is found by its
+     * server, channel and message id, a push event by its server and event id.
+     * A message a tune-out holds from the residents is never "newest" here.
+     */
+    private isNewestContextEntry;
+    /**
+     * Write the batched-wake lines the gate left to this turn's start (WakeLine)
+     * into the window they name, the delivery agent's (the residents' shared
+     * slot where it is one), on that agent's own start only. Called by a fresh
+     * start that doesn't resume a logical turn, after the turn's own inputs (a
+     * due clock row, the deferred-write and assembly flushes) and before its
+     * checkpoint, so a line lands after whatever arrived since the gate's
+     * decision, before the notices the turn's start writes itself (the locus
+     * notice among them), and before the agent's answer to the wake.
+     *
+     * - A wake's one line whose event is still the newest entry is left out:
+     *   no message follows the wake's, so it is the wake's whole cause, and the
+     *   start's token defers an arrival into the window past its request. (The
+     *   start's own notices, written after this, aren't messages a reply could
+     *   be meant for.)
+     * - A co-resident's start places nothing. Every resident gets every
+     *   batched wake, so a co-resident writing the line would put it under the
+     *   message, the line #727 left out, or after the delivery agent's answer,
+     *   a wake line for a message already answered. Its request shows what the
+     *   slot holds, as on `main`: a reply after the message is in the message's
+     *   own channel, but a message from another channel that lands between the
+     *   gate's decision and its compile follows the message with no line.
+     * - Two or more lines are all written, each naming its message, its age
+     *   counted to now.
+     * - None is written while the host is quiesced or another reader of the
+     *   slot has a turn alive (slotHeldFrom, as for a clock row): written, a
+     *   line would land inside that turn, and deferred, it would wait for the
+     *   delivery agent's next boundary, never reaching this request
+     *   (overlapping turns in the slot, #286). They stay undecided, and are
+     *   written only if another fresh start of the wake comes (a provider
+     *   hold's release, a requeue): this start's request goes without them.
+     *
+     * A line left out is traced. Each line is written once (placedWakeLines),
+     * across the wake's retries and holds, whichever copy of its trigger a
+     * start carries: every request for the wake carries the same line. A line
+     * left out, or whose write fails, stays undecided for a later fresh start.
+     */
+    private placeWakeLines;
+    /** Whether `entry`'s own stored entry is the newest in `agent`'s window,
+     *  clock rows and stored context injections after it aside: a channel
+     *  message by its server, channel and message id, a push event by its
+     *  server and event id, and never one a tune-out holds. Past
+     *  NEWEST_SCAN_ROWS such rows, it answers no. */
+    private isNewestIn;
     /** Where addMessage delivers: the named agent, else the primary, else the
      *  first registered agent. Undefined when there is no such agent. */
     private deliveryAgent;
@@ -3813,25 +4522,13 @@ export declare class AgentFramework {
      * its window (ContextManager.renderAsNewest): cut by the per-message cap,
      * a sharded body joined, and the image limits applied over the batch, so
      * the live stream hears what the next compile sends. An id comes back as
-     * null where that compile won't send the message among its newest.
-     * Undefined where the strategy has no such hook, or the render threw,
-     * which is logged: the boundary then injects what it stored, as it did
-     * before strategies could say.
+     * null where the render can't place the message among the newest, and the
+     * boundary injects that one as stored (see the boundary's null). Undefined
+     * where the strategy has no such hook, or the render threw, which is
+     * logged: the boundary then injects what it stored, as it did before
+     * strategies could say.
      */
     private renderForInjection;
-    /**
-     * Tell the agent of the messages a tool boundary stored and left out of
-     * its injection, since the next compile won't send them among its newest:
-     * who sent each and its size, and how to read it, `history--extract`
-     * around it where the agent is shown that tool, else its id. None of a
-     * message's words: the line stands in for a message the live round
-     * doesn't carry. A system line, so it's no conversation: it neither
-     * re-pins the turn nor clears its send suppression. It names the agent
-     * it's for, since every resident sharing the slot reads it too. Returns
-     * the notice as stored, for the boundary to inject after the batch, or
-     * undefined when it couldn't be stored, which is logged.
-     */
-    private recordLeftOutNotice;
     /**
      * Write drained entries in queue (seq) order, whatever their targets:
      * residents share one message slot, so the order entries arrived in is the
@@ -3905,11 +4602,15 @@ export declare class AgentFramework {
      * appended later without splitting the body.) Boot's scan for landed
      * writes counts a landed shard the same way. When the store can't be read
      * back (storedCopiesOf logs it), or couldn't say how many messages it held
-     * before the write, whether the entry landed is unknown: it's put back
+     * before the write, the store is searched for the entry's id at once
+     * (landedCopiesById): found, it counts as written, as above. When that
+     * can't be done either, whether the entry landed is unknown: it's put back
      * marked so (`landing`), and before it's written again the store is
-     * searched for its id (landedCopiesById). Found, it counts as written, as
-     * above, at the flush that finds it; not found, it's written; and while
-     * the store can't be searched, it stays queued, holding what's behind it.
+     * searched for its id. Found then, it counts as written where it was
+     * stored, ahead of what was stored since without it, a known limit
+     * (context-manager #155, named at the tool boundary's drain); not found,
+     * it's written. While the store can't be searched, it stays queued,
+     * holding what's behind it.
      *
      * Returns what was written (stored, or deferred again by addMessage, whose
      * id is then empty), in queue order: for one target, its entries up to the
@@ -3937,10 +4638,29 @@ export declare class AgentFramework {
      *  when the store can't be read back, which is logged under `tag`, naming
      *  `what` was written: not the same as nothing found. */
     private storedSince;
-    /** The messages carrying `deferredWriteId` anywhere in the agent's store,
-     *  found by their id (queryMessages, as landedRow finds a held write's),
-     *  so no position is needed. Undefined when the store can't be searched,
-     *  which is logged. */
+    /**
+     * The positions on `cm`'s current branch of the messages carrying
+     * `deferredWriteId`, in store order: the whole branch, read in blob-free
+     * windows, so a blob missing from some other message can't make it fail,
+     * as it makes queryMessages fail (every blob on the branch is resolved for
+     * it). Throws when a window can't be read, or holds fewer messages than it
+     * was asked for: a scan that didn't reach every message can't say a write
+     * is absent, and a write taken as absent is stored again.
+     */
+    private landedPositions;
+    /**
+     * The messages carrying `deferredWriteId` anywhere on the agent's current
+     * branch, in store order with their blobs resolved, as a request carries
+     * them, so no position is needed. They're found with queryMessages, over
+     * context-manager's cached view, as landedRow finds a held write's row.
+     * Where that throws, as one blob missing anywhere on the branch makes it
+     * do, the branch is scanned blob-free instead (landedPositions), and only
+     * the rows that match are read with their blobs. Undefined when the store
+     * can be searched neither way, or the scan finds the write's rows but one
+     * of them can't be read. Each write whose lookup fails is said once until
+     * a lookup of it succeeds, since every path that reads held writes looks
+     * again.
+     */
     private landedCopiesById;
     /** The line naming a drained write that threw: one that couldn't be stored,
      *  which is already back in the queue; with 'dropped', a malformed refusal
@@ -3981,9 +4701,10 @@ export declare class AgentFramework {
      *  A target no longer registered (a fork or a run that has ended, here or
      *  before a crash) has no window to land in: a failed reply queued for it,
      *  or a channel notice it could have acted on, becomes the primary's
-     *  by-name notice, under the entry's own id and place in the queue
-     *  (queuedNoticeForPrimary), and is written with the rest; any other write
-     *  is dropped, logged, by addMessage. Nothing here reads the gone agent's
+     *  by-name notice, and a module's write for a run or a fork goes to it as
+     *  written, each under the entry's own id and place in the queue
+     *  (passesToPrimary, queuedNoticeForPrimary), written with the rest; any
+     *  other write is dropped, logged, by addMessage. Nothing here reads the gone agent's
      *  window, so such a notice an earlier write of which landed there, and
      *  which the agent read, goes on too. */
     private readdDrained;
@@ -4014,7 +4735,8 @@ export declare class AgentFramework {
      *
      * The agent never reads its window again, so every failed-reply notice it
      * never read, and every channel notice it could act on and never read, is
-     * passed to the primary, by name, once (passesToPrimary,
+     * passed to the primary, by name, once, and so is every module write for
+     * it that it never read, as the write itself (passesToPrimary,
      * passOnFromReleasedWindow): each one stored in its window above its
      * consumed watermark (flushed there at its turn's end, or stored while it
      * was idle) and not heard at a tool boundary, and each one still queued
@@ -4045,8 +4767,9 @@ export declare class AgentFramework {
      * The part of a released agent's pass to the primary that its release and
      * stop() share (stop() runs it for a release the quiesce postponed). Each
      * notice stored in its window that it never read and the primary takes in
-     * its place (passesToPrimary: a failed reply, or a channel notice its
-     * reader could act on) goes on as stored, by name (passNoticeToPrimary),
+     * its place (passesToPrimary: a failed reply, a channel notice its reader
+     * could act on, or a module's write for a run or a fork, which goes as
+     * the write itself) goes on as stored, by name (passNoticeToPrimary),
      * except a copy of an entry for it still in the durable queue, pending or
      * un-acked: that entry is the notice's one identity until its ack, the one
      * boot's check for landed writes knows, so it's the entry that goes on, as
@@ -4067,8 +4790,11 @@ export declare class AgentFramework {
      * What a released agent's window holds that its pass to the primary reads
      * (passOnFromReleasedWindow): `unread`, the notices stored there that it
      * never read and the primary takes in its place (passesToPrimary: its
-     * failed replies, and the channel notices it was told it could act on),
-     * other than copies of the entries `held` names; and `held`, for each of
+     * failed replies, the channel notices it was told it could act on, and a
+     * run's or a fork's module writes), each with its participant and
+     * content, a sharded body's shards joined into one text, as the
+     * autobiographical strategy joins them (asCompiled), other than
+     * copies of the entries `held` names; and `held`, for each of
      * those entries with a copy there, its copies and whether any of them is
      * unread. A notice is read below the lower of its consumed watermark and
      * the point where the watermark's branch and the current one part
@@ -4102,8 +4828,8 @@ export declare class AgentFramework {
      * deregistered, so its stream can't dispatch anything more and resume
      * doesn't weigh its context, and a write addressed to it meanwhile is
      * treated as for any agent no longer registered (dropped, or passed to the
-     * primary if it's a failed reply, or a channel notice its reader could act
-     * on).
+     * primary if it's a failed reply, a channel notice its reader could act
+     * on, or a module's write for a run or a fork: passesToPrimary).
      */
     private releaseWindowNowOrAfterResume;
     /** resume(): the windows whose release the quiesce window postponed, each on its own. */
@@ -4138,7 +4864,10 @@ export declare class AgentFramework {
      * The primary's by-name notice in place of one `speaker` never read, and
      * what it's about, as a log line says it: a failed reply's
      * (failedReplyNoticeForPrimary) or a channel notice's
-     * (channelNoticeForPrimary). null when no one is told, which is logged
+     * (channelNoticeForPrimary). A module's write for a run or a fork that
+     * it never read (PRIMARY_IF_UNREAD_KEY), given with what was `written`,
+     * goes as the write itself: its participant, its content, and its
+     * metadata without the mark. null when no one is told, which is logged
      * where it's decided.
      */
     private noticeForPrimary;
@@ -4175,11 +4904,34 @@ export declare class AgentFramework {
      */
     private channelForNotice;
     /**
-     * A module's write through its context: addMessage's, except that a write
-     * the framework holds is answered by its handle (heldHandle) rather than
-     * '', so the module can find, read, edit and remove what it wrote before
-     * the write lands. The framework's own callers keep the '' they've always
-     * had, which their traces and checks take as a write not stored yet.
+     * A channel as the agent is shown it: its label, with the name that picks
+     * it alone (ChannelRegistry.nameShown), which is its id, or, where another
+     * server registers the same id, its server-qualified name; or, for a
+     * channel no string picks alone, its id and its server.
+     */
+    private channelShown;
+    /** A channel named in a notice with the label it was given there: the
+     *  label, with its name as ChannelRegistry.nameShown gives it. */
+    private labelledChannel;
+    /**
+     * A module's write through its context (ModuleContext.addMessage):
+     * addMessage's, except that a write the framework holds is answered by its
+     * handle (heldHandle) rather than '', so the module can find, read, edit
+     * and remove what it wrote before the write lands, through getMessage,
+     * editMessage and removeMessage, which read the delivery agent's window: a
+     * handle for a write held for a fork or a sub-agent isn't found there. The
+     * framework's own callers keep the '' they've always had, which their
+     * traces and checks take as a write not stored yet.
+     *
+     * With `forAgent`, the write is for the named agent's window, which must
+     * be registered when the write is made: a name that isn't, or the empty
+     * one, which addMessage would read as none (deliveryAgent), throws, naming
+     * the registered ones, as queryMessages does. The framework's own writes
+     * log and drop instead, as a held write does whose agent is gone by its
+     * flush. A write for an ephemeral run or a conversation fork, whose
+     * window nothing reads after its release, is marked (PRIMARY_IF_UNREAD_KEY),
+     * so the release passes it to the primary if its target never read it,
+     * as it passes a notice (passOnFromReleasedWindow).
      */
     private addModuleMessage;
     /**
@@ -4190,7 +4942,8 @@ export declare class AgentFramework {
      * no module reads that agent's store, and the write waits for its window's
      * release (drainDeferredFor) or, at its flush, is dropped (addMessage), a
      * failed reply, or a channel notice its reader could act on, passing to the
-     * primary as its notice (queuedNoticeForPrimary).
+     * primary as its notice, and a module's write for a run as written
+     * (passesToPrimary, queuedNoticeForPrimary).
      */
     private heldWritesFor;
     /**
@@ -4212,10 +4965,11 @@ export declare class AgentFramework {
      * Settle held writes whose landing is unknown (DeferredWrite.landing),
      * among those `which` picks, before a path reads or changes held writes:
      * each is looked up by its id in its target's store (landedCopiesById).
-     * Found, the write landed (settleFound). Not found, the mark goes, and
-     * it's an ordinary held write, which is persisted as an edit is. Where the
-     * store can't be searched, it stays marked, a doubt each path reads by its
-     * own rule.
+     * Found, the write landed (settleFound), where its copy sits, a known
+     * limit (writeDrainedInOrder). Not found, the mark goes, and it's an
+     * ordinary held write, which is persisted as an edit is. Where the store
+     * can't be searched, it stays marked, a doubt each path reads by its own
+     * rule.
      */
     private settleUnknownLandings;
     /**
@@ -4236,7 +4990,8 @@ export declare class AgentFramework {
      * that write's copy, so the write landed, and it's settled as found
      * (settleFound) before the row is read or changed. A lookup by the id
      * can't be needed then, so this holds where the store can't be searched
-     * too.
+     * too. One row of a sharded body says it's a shard, without a count,
+     * since one row doesn't tell how many landed.
      */
     private settleByCopy;
     /** A held write whose landing stays unknown after settling, its store
@@ -4244,21 +4999,40 @@ export declare class AgentFramework {
      *  changing only the queued entry could leave its stored copy as it was.
      *  Throws with nothing changed. */
     private refuseUnsettled;
-    /** Whether the agent has nothing left to read of a deferred write, on
-     *  evidence only: the row it landed as is at or below the agent's consumed
-     *  watermark on its current branch, or it's in neither the queue (drained
-     *  entries not yet stored included) nor the store's current branch:
-     *  removed, or left on a branch the agent has switched from, where a turn
-     *  now would find nothing of it (switching back brings it back unread,
-     *  with no wake, as main's wake spent on this branch leaves it). Any doubt
-     *  reads as unread, such as a watermark that a branch switch or an undo
-     *  left on another branch, or a store that can't be read: a turn that
-     *  finds nothing new costs less than a write no wake brings the agent to
-     *  read. */
-    private deferredWriteReadOrGone;
+    /** Whether a wake for a deferred write has nothing left for the agent to
+     *  do, on evidence only. The write's row is at or below the newest
+     *  consumed watermark of an answered request (Agent.getAnsweredWatermark)
+     *  on the agent's current branch, and for a wake that carries a channel
+     *  and wasn't marked ambient (`to`, that channel on the wake's server), the
+     *  agent has since published there having read the row
+     *  (Agent.publishedAfterReading): hearing a message isn't answering it,
+     *  and the wake's turn is the agent's chance to answer there. Or the
+     *  write is in neither the queue (drained entries not yet stored
+     *  included) nor the store's current branch: removed, or left on a
+     *  branch the agent has switched from, where a turn now would find
+     *  nothing of it (switching back brings it back unread, with no wake, as
+     *  main's wake spent on this branch leaves it). Any doubt keeps the
+     *  wake, such as a watermark that a branch switch or an undo left on
+     *  another branch, or a store that can't be read: a turn that finds
+     *  nothing new costs less than a write no wake brings the agent to read
+     *  or answer. */
+    private deferredWriteDone;
+    private storedMessageDone;
+    private writeAnswered;
+    private readsWriteFor;
     private editMessage;
     private removeMessage;
     private getMessage;
+    /** The refusal of a module's `forAgent` that names no registered agent:
+     *  the name, cut at 120 characters; the registered ones, a list over 400
+     *  characters cut with how many there are; and what leaving forAgent out
+     *  does. With none registered, there's no window either way, and it says
+     *  so. */
+    private unknownAgentError;
+    /** A module's query (ModuleContext.queryMessages): the delivery agent's
+     *  window (the primary's, or the first agent's when none is primary), or
+     *  the named agent's, which must be registered: an unknown name, or the
+     *  empty one, throws, naming the registered ones, as a write's does. */
     private queryMessages;
     private createFrameworkState;
     private emitTrace;
@@ -4317,6 +5091,41 @@ export declare class AgentFramework {
      * failures.log + ops:alert trace + CONNECTOME_OPS_WEBHOOK.
      */
     notifyOps(kind: string, agentName: string, message: string, data?: Record<string, unknown>): void;
+    /**
+     * Tells the context manager what a stream's later round carries after its compiled messages: every round so far,
+     * in sent order, with the round's own rows appended (roundRows): each stored row's id where the next request will
+     * carry it as the stream sent it, the marker where it won't. A request-only row (a heartbeat tick, a `[Continue]`)
+     * isn't a row here: the next request puts it back in the same place (renderRequestOnlyRows), and no compile holds
+     * it. A round with no `roundContent` (membrane's XML or fallback path, where the stored reply is the framework's
+     * rebuild) can't be vouched for, so nothing more of the stream is noted, and its later rounds' thinking is left
+     * out at the next compile rather than refused. So is a stream whose note threw or wrote nothing (noteStreamRows).
+     */
+    private noteRoundSent;
+    /**
+     * At the stream's end, after its last reply is stored: every row so far, judged as of now, with that reply as the
+     * final row (or none, where the stream's last request had no reply after it). Past the record's end nothing
+     * keeps its thinking, so the last reply keeps its own only by being noted here. Judged as of now, a batch the
+     * tool-result guard held at its boundary and has since settled to the originals is named. A reply with no
+     * `roundContent` to vouch for ends noting instead, as a round's does.
+     */
+    private noteStreamEnd;
+    /**
+     * Every row so far, judged as of now (roundRows), noted. A note the context manager writes nothing for (false)
+     * ends the stream's notes, with a line saying so: where the stream's compile no longer wrote the branch's record, or
+     * the branch has none, no later note could write either; where its store failed, a later one might, and stopping
+     * gives that up for this stream's later rounds, whose thinking then goes at the next compile, as it would have
+     * after the failed write. A note that throws is a fault, and ends them too.
+     */
+    private noteStreamRows;
+    /**
+     * A call's dropped blocks, placed, against the branch's binding-record start (splitThinkingDrops). Replies stored at
+     * or below it may lose their thinking with no strip having missed, since the context manager recorded nothing they
+     * were sent under, and so may any block for a binding the record doesn't track (the account's). Any other drop is
+     * one the record doesn't account for: a change ahead of it that the record didn't see. The operators hear of it
+     * once per incident, again only if a call shows more, and the incident ends at a call that shows no unexpected drop
+     * (ThinkingLossIncidents).
+     */
+    private noteThinkingLoss;
     private opsAlert;
     /**
      * Record a model refusal for observability: per-agent stats + a
@@ -4561,6 +5370,32 @@ export declare class AgentFramework {
      * logged here rather than replacing the failure the connect reports.
      */
     private closeFailedRuntimeConnect;
+    /**
+     * The host capabilities offered to one server: the host's own, plus
+     * RFC-014's `toolHints` where its configuration asks for them. Without it,
+     * the very object every server is offered.
+     */
+    private mcplHostCapabilitiesFor;
+    /** RFC-014: every toolHints server's presence, made on first use. */
+    private toolsets;
+    /** RFC-014: the `toolsets` module (toolsets--open, --act, --look,
+     *  --close), registered once, by the first server configured with
+     *  toolHints. Its tools don't change after that. */
+    private ensureToolsetsModule;
+    /** RFC-014 §5.3: after a (re)connect whose policy has settled, read what
+     *  the server holds open and adopt it. In the background: its notices are
+     *  written as they come. */
+    private reattachToolsets;
+    /**
+     * RFC-014 §8.3: a tool change with no result or event to ride on (a
+     * standalone tools/hints, a late result, a reconnect's adoption, a
+     * recovery) is told as a notice, which doesn't wake the agent. Like any
+     * delivery from a server into the conversation, it needs `pushEvents`
+     * (§6.1); without it the change is still tracked, and toolsets--look shows
+     * it. The text is the server's (its tool definitions, titles, reasons), so
+     * the notice names the server.
+     */
+    private recordToolsetNotice;
     /**
      * Connect a single MCPL server: register routing entries, open the
      * connection, wire events, and initialize feature sets / scopes /
@@ -4871,7 +5706,9 @@ export declare class AgentFramework {
      */
     private refreshMcplTools;
     /**
-     * Report operator tool-name patterns that match no model-facing tool:
+     * Report operator tool-name patterns that match no tool name: one the
+     * model is offered, or an RFC-014 dynamic tool's listed name, which its
+     * class rules and lifecycle selectors match as a direct call's would:
      * `toolClassOverrides` keys and each server's `toolLifecycle.observe.tools`
      * / `toolLifecycle.inputs.tools`. These match `<toolPrefix>--<tool>`, and
      * the default prefix is `mcpl--<serverId>`, so a pattern written against
@@ -4886,8 +5723,9 @@ export declare class AgentFramework {
     private checkToolPatterns;
     /** Every tool name the framework offers to anyone: the shared board plus
      *  each agent's own surface, before presentation visibility (a hidden tool
-     *  is still callable, so classes and lifecycle still apply to it). */
-    private modelFacingToolNames;
+     *  is still callable, so classes and lifecycle still apply to it), and
+     *  every name an MCPL server lists, a dynamic tool's included. */
+    private patternableToolNames;
     /**
      * Handle a tools/list_changed notification with collapse logic.
      * At most 2 refresh cycles can be in-flight: one running and one pending.
@@ -4983,8 +5821,8 @@ export declare class AgentFramework {
      * Handle the synthesized `read_image` tool: read image bytes from a
      * workspace mount and return them as a native MCP-shaped content array
      * (`[{type:'text'…},{type:'image', data, mimeType}]`). The live-turn
-     * converter (tryNativeToolResultContent → membrane tool_result image
-     * blocks) delivers the actual image to the model; history storage keeps
+     * converter (toMembraneToolResult's nativeContent → membrane tool_result
+     * image blocks) delivers the actual image to the model; history storage keeps
      * the standard compact `[image: …]` placeholder.
      */
     /** RFC-005 on-demand dereference: [ref id] → workspace file, via the
@@ -5021,17 +5859,24 @@ export declare class AgentFramework {
      */
     private dispatchSaveImageToolCall;
     /** The `utils` meta-tool: list/describe/run over module utilities
-     *  (Module.getUtilities). Shared by the model-facing dispatcher and the
-     *  programmatic path (executeToolCall), so code_execution scripts and
-     *  ephemerals reach utilities too. */
+     *  (Module.getUtilities). Shared by the model-facing dispatcher, which a
+     *  running code_execution script's calls take too, and executeToolCallFrom,
+     *  which the puppet and a host reach through executeToolCall and a module
+     *  through callTool. */
     private handleUtilsToolCall;
     private dispatchUtilsToolCall;
+    private readAgentSettings;
+    private settingsChangedSince;
     private dispatchAgentSettingsToolCall;
     /** Aggregate the event-tag vocabulary: reserved chat:* core + each connected
      *  server's declared tag ontology + gate.js status. */
     private buildEventTagsResult;
     private dispatchEventTagsToolCall;
     private dispatchGateToolCall;
+    /** The channel context one server is told for an agent's inference
+     *  (context/beforeInference, §14.4): only that server's own channels
+     *  (ChannelRegistry.buildChannelContext). */
+    private channelsForServer;
     private buildBeforeInferenceParams;
 }
 export {};