@animalabs/agent-framework 0.27.0 → 0.29.0

package/dist/src/framework.d.ts

@@ -9,6 +9,13 @@ import { Agent, type RenderStats } from './agent.js';
 import { type ToolClass, type ToolClassSource } from './mcpl/tool-classes.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
+/**
+ * The framework's own tools that belong to the host's built-in toolset
+ * ("settings", host-presentation.ts) rather than the tool list: the ones an
+ * agent reaches for rarely. Modules place theirs with Module.toolPlacement,
+ * and every module utility is there too.
+ */
+export declare const BUILTIN_TOOLSET_TOOLS: ReadonlySet<string>;
 import type { SessionUsageSnapshot } from './usage/types.js';
 import { type DiscordAwarenessView, type DiscordAwarenessCancelReceipt, type DiscordAwarenessMarks, type DiscordAwarenessRetractReceipt } from './recovery/discord-awareness-outbox.js';
 import { type SurgeryMarkerReceipt, type SurgeryMarksPreview, type OperatorLogEntry, type OperatorLogInput, type OperatorRequester } from './operator-log.js';
@@ -88,11 +95,15 @@ export interface HostModeStatus {
      * is false until it has. A parked continuation of a turn is counted here
      * and, as a turn alive, in `activeTurns` and `activeTurnAgents`. */
     parkedAdmissions: number;
-    /** Inference requests parked by the quiesce wake gate (while quiesced), or
-     * simply queued (while serving — non-zero right after a resume until the
-     * scheduler's next pass consumes them). Continuations of a held turn
-     * (budget restart, tool results) and a held turn's retry, which a quiesce
-     * lets through, are never counted. */
+    /** Inference requests waiting to start: queued (parked by the quiesce wake
+     * gate while quiesced, or, while serving, until the scheduler's next pass
+     * takes them), in a scheduler pass's hands, or held by a provider hold (an
+     * acceleration or host hold, or a provider's stated wait). There, a start
+     * that carries a turn on counts as the wakes merged into it. A start parked
+     * on provider admission behind an auxiliary call counts once in
+     * `parkedAdmissions` instead, however many wakes are merged into it.
+     * Continuations of a turn (budget restart, tool results) and a held turn's
+     * retry, which a quiesce lets through, are never counted. */
     gatedRequests: number;
     /** code_execution scripts still running that no call is waiting on: left
      * running after a yield, outside any turn. Quiesce does NOT stop them —
@@ -106,11 +117,12 @@ export interface HostModeStatus {
      * turn token held with no stream to cancel and no check ahead to stop it
      * at (a puppet tool turn, a store surgery's reservation, a turn finishing
      * its last delivery), or a turn with no stream that hasn't reached its
-     * next check, such as one in a hook that hasn't returned. A turn whose
-     * stream the abandon cancelled isn't listed, even one still running when
-     * the grace runs out, as one whose tool-result guard waits on its speech
-     * may be. Present only after an abandon that left such turns behind, while
-     * the host stays quiesced. */
+     * next check, such as one in a hook that hasn't returned, or a turn whose
+     * stream's cancel threw with no check ahead, so that its stream goes on.
+     * A turn whose stream the abandon cancelled isn't listed, even one still
+     * running when the grace runs out, as one whose tool-result guard waits on
+     * its speech may be. Present only after an abandon that left such turns
+     * behind, while the host stays quiesced. */
     unabandonable?: string[];
 }
 /**
@@ -168,25 +180,27 @@ interface InferenceToolSnapshot {
  * this policy after one send, and the framework is the one retry layer: each
  * retry is a fresh compile, a stop cancels its wait, and the wait is seen.
  * The decision is membrane's (`@animalabs/membrane/retry`), on the settings
- * given (membrane's defaults unless a host passes its own, e.g. from a
- * recipe's retry config):
+ * given: membrane's, with the two changes below for the turn path, unless a
+ * host passes its own (e.g. from a recipe's retry config), which are taken as
+ * they are:
  * - not retryable (400 invalid_request, 401 auth, context_length, safety,
  *   a caller-code error): terminal on the first failure. Retrying them burns
  *   API quota without any chance of success; production traces showed clerk +
  *   reviewer wasting 4 inferences on each 400 due to blind retries.
  * - overloaded (a 529, or an overloaded error mid-stream): the overloaded
- *   schedule, jittered (by default 7 tries, 10 s doubling to 5 min, ~10 min).
+ *   schedule, jittered, 10 s doubling to 5 min (by default 13 tries, where
+ *   membrane's settings have 7: about 30 min).
  * - rate limited (429): the base schedule with at least 5 tries.
  * - any other retryable failure, a stream deadline on a sent request
  *   included (membrane leaves those to its caller): the base schedule (by
  *   default 3 tries, 1 s then 2 s).
  * A provider's stated wait (`retryAfterMs`) is waited when it is longer than
- * the backoff, up to the framework's own cap (PROVIDER_ACCELERATION_MAX_
- * COOLDOWN_MS, ten minutes) where a schedule's ceiling is lower; past it the
- * turn ends here. (Before this policy runs, the framework holds a resident
- * for a stated wait or an acceleration 429 itself, and ends an ephemeral run
- * on a wait past that cap; see holdProviderAcceleration and
- * nonOwningProviderWait.)
+ * the backoff, up to the schedule's ceiling, which by default is at least the
+ * framework's own cap (PROVIDER_ACCELERATION_MAX_COOLDOWN_MS, ten minutes);
+ * past it the turn ends here. A host's own settings keep their ceilings.
+ * (Before this policy runs, the framework holds a resident for a stated wait
+ * or an acceleration 429 itself, and ends an ephemeral run on a wait past
+ * that cap; see holdProviderAcceleration and nonOwningProviderWait.)
  * An error that isn't a MembraneError is retried as a retryable failure, on
  * the base schedule.
  */
@@ -197,6 +211,40 @@ export declare class DefaultErrorPolicy implements ErrorPolicy {
     constructor(settings?: RetrySettings);
     onInferenceError(error: Error, _agentName: string, attempt: number): ErrorAction;
 }
+export interface ReinitAlertText {
+    opening: string;
+    message: string;
+}
+export declare const REINIT_MOVES: readonly ['undo', 'redo', 'rollback', 'suppression', 'branch switch'];
+export type ReinitMove = (typeof REINIT_MOVES)[number];
+export declare function refusedWorkAlert(move: ReinitMove, cause: string): ReinitAlertText;
+export declare function restoreAlert(restore: {
+    source: string;
+    now: string;
+    selected: boolean;
+    cause: string;
+} & ({
+    move: 'rollback';
+    managerCurrent?: false;
+} | {
+    move: 'suppression';
+    managerCurrent: boolean;
+})): ReinitAlertText;
+export declare function disposalAlert(disposal: {
+    move: ReinitMove;
+    heldWrites?: number;
+    reinitFailed?: string;
+    cleanupFailed?: string;
+}): ReinitAlertText;
+export declare function longHoldAlert(hold: {
+    move: string;
+    agentName: string;
+    heldSeconds: number;
+    queued: number;
+    reinitializing?: string;
+    waitingForMaintenance: boolean;
+}): ReinitAlertText;
+export declare function opsWebhookText(message: string): string;
 /**
  * Whether the poison-history breaker may shed the newest exchange for a
  * failure: an `invalid_request` at HTTP 400, 413 or 422 or with no status, or
@@ -287,6 +335,7 @@ export declare class AgentFramework {
     private stopPromise;
     private stopCompleted;
     private ownedStoreClosed;
+    private ownedStoreManagersClosed;
     /** Whether the latest stop() got through its teardown with nothing failed:
      * every step and every wait up to and including the one on awareness
      * drains, whatever failed after that, in the storage work that finishes
@@ -314,6 +363,8 @@ export declare class AgentFramework {
     private inferencePolicy;
     private errorPolicy;
     private pendingRequests;
+    private readonly exhaustedTurns;
+    private readonly roundTurns;
     private running;
     private loopPromise;
     /** Quiesce/maintenance mode (issue #122). DELIBERATELY separate from
@@ -365,6 +416,7 @@ export declare class AgentFramework {
     private providerWaits;
     /** Wakers for error-policy retry waits in progress: stop() ends them. */
     private retryWaitWakers;
+    private waitingTraceEveryMs;
     private providerAdmissionClosed;
     /** Invalidates framework turns still assembling when stop begins. */
     private lifecycleGeneration;
@@ -379,6 +431,7 @@ export declare class AgentFramework {
      *  framework, and tests set it by cast. */
     private inboundAcceptanceObserver?;
     private streamBoundaryEnds;
+    private streamCarries;
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message,
      *  or an edit the coalescer marks as the agent's first view; not a system
      *  marker or a reaction, reaction removal, edit or deletion marker) into
@@ -409,6 +462,7 @@ export declare class AgentFramework {
      * next turn.
      */
     private turnRouting;
+    private readonly reasoningLoss;
     /**
      * The latest link of each agent's chain of queued prose deliveries. Every
      * stream queues its own behind it, a fresh turn's included, so the agent's
@@ -478,8 +532,6 @@ export declare class AgentFramework {
      *  by the object, not the run's record (ephemeralRuns), which its cleanup
      *  drops before a cancelled stream may count its last usage. */
     private ephemeralAgents;
-    /** Warn only once per Agent instance after utilities are registered. */
-    private emptyUtilityPermissionWarnings;
     /** Physical ephemeral frames deliberately disposed by their run watchdog/caller.
      * The name is single-generation, so these frames still own their terminal
      * typing/outgoing close even after runEphemeralToCompletion deregisters them. */
@@ -488,6 +540,10 @@ export declare class AgentFramework {
      *  completes (inference:completed), not when a call answers mid-turn.
      *  Drives hard-down escalation — see noteInferenceExhausted. */
     private consecutiveInferenceFailures;
+    private turnRearmMs;
+    private turnRearms;
+    private exhaustingRearms;
+    private statedWaitRuns;
     /** N consecutive failed inferences ⇒ the agent is treated as hard-down and
      *  escalated loudly to stderr. */
     private readonly inferenceFailureEscalationThreshold;
@@ -707,6 +763,12 @@ export declare class AgentFramework {
      *  queued, and clears them. While a name is here, no other flush drains
      *  its queue (drainDeferredFor). */
     private readonly releasesAfterResume;
+    private readonly managerReleases;
+    private readonly releasedByCleanup;
+    private readonly openManagers;
+    private readonly openManagerRefs;
+    private readonly storeSees;
+    private readonly collectedManagers;
     /** The coalescing commit in flight, if any (see commitCoalescingDurable). */
     private coalescingCommit;
     private inferenceRouter;
@@ -743,12 +805,13 @@ export declare class AgentFramework {
     private readonly thinkingLossIncidents;
     /** Per live stream that can be noted, its rows so far after the compiled messages (noteRoundSent). */
     private readonly streamRequestNotes;
+    private readonly streamCarried;
     /** Per pending round's blocks (pendingAssistantBlocks' value), what membrane held as that round's reply
      *  (`roundContent`, its results left out); null where the round has no `roundContent` (XML or fallback). Keyed by
      *  the blocks themselves, so it goes wherever they go. */
     private readonly pendingRoundSent;
-    /** Per agent, a round that called code_execution and waits for those calls'
-     *  results before its prose is routed (ScriptRound). */
+    /** Per agent, a round that called code_execution or sent, and waits for
+     *  those calls' results before its prose is routed (ScriptRound). */
     private scriptRounds;
     /** Each code_execution result, by the round that dispatched its call: it
      *  settles only that round, even if a newer round reuses its call id. */
@@ -829,10 +892,15 @@ export declare class AgentFramework {
     /** Host capabilities advertised during the MCP handshake — stored so servers
      *  can be connected at runtime (connectMcplServer) after initialization. */
     private mcplHostCapabilities;
-    /** MCPL RFC-014: every toolHints server's tool presence, for the
+    /** MCPL RFC-014: every hinted server's tool presence, for the
      *  `toolsets` module's meta-tools and reminders. Made when the first
-     *  server configured with `toolHints: true` is set up; null until then. */
+     *  server with tool hints (any not configured `toolHints: false`) is set
+     *  up; null until then. */
     private toolsetHub;
+    /** The host's own toolsets: the built-in "settings" and MCPL server tabs. */
+    private hostPresentation;
+    /** MCPL servers kept disconnected as closed tabs, with the configuration an open connects them with. */
+    private closedTabConfigMap?;
     /** Inference routing policy from FrameworkConfig — stored so the MCPL
      *  subsystem can be lazily initialized by connectMcplServer when the
      *  framework started with zero configured servers. */
@@ -852,6 +920,9 @@ export declare class AgentFramework {
      * scheduler, ephemeral admission and puppet entry points.
      */
     private surgeryHold;
+    private readonly conversationSpawnsInFlight;
+    private syncMoveReinit;
+    private holdAlertMs;
     /** Serialize per-server drains so reconnect and an online undo cannot race. */
     private discordAwarenessDrains;
     /** The servers whose running pass a later trigger joined
@@ -859,9 +930,10 @@ export declare class AgentFramework {
      *  more what it had already tried. */
     private discordAwarenessDrainsJoined;
     private eventGate;
+    private judgeWired;
+    /** The heartbeat (FrameworkConfig.heartbeat), when the host turns it on. */
+    private heartbeat;
     private usageTracker;
-    /** Explicit-send or private suppression carried into a tool-result-guard retry. */
-    private guardRetryTurnSilenced;
     /** Presentation-only wall-clock zone; persistence remains UTC/epoch. */
     private readonly timeZone;
     private constructor();
@@ -879,8 +951,9 @@ export declare class AgentFramework {
     /**
      * The error a failed create() rejects with, once what it acquired is
      * released: the framework it had begun is stopped, with
-     * FAILED_CREATE_TEARDOWN_TIMEOUT_MS as stop()'s teardownTimeoutMs, and a
-     * store create() opened is closed even when that stop failed or timed out.
+     * FAILED_CREATE_TEARDOWN_TIMEOUT_MS as stop()'s teardownTimeoutMs, the
+     * context managers it opened are closed, and a store create() opened is
+     * closed even when that stop failed or timed out.
      * stop() keeps an owned store open when any of its waits fails or times
      * out, so that it can be called again, but no one can call it on a
      * framework that create() never returned. When the release doesn't finish
@@ -979,8 +1052,9 @@ export declare class AgentFramework {
     /** What start() and addModule() pass before either begins work of a
      * lifecycle. A stop() still running refuses both, from the moment it
      * claims its attempt until that attempt settles. A failed stop() has
-     * cleared its attempt, unless it closed an owned store, which is refused
-     * first. A completed stop() is cleared, and the call goes on as before;
+     * cleared its attempt, unless it closed an owned store, or the context
+     * managers it closes before that store, which are refused first. A
+     * completed stop() is cleared, and the call goes on as before;
      * whether a lifecycle should begin after a stop() is #315's question. */
     private resetCompletedStop;
     /** Register before invoking the body, so the set holds the operation for
@@ -1052,7 +1126,77 @@ export declare class AgentFramework {
      * under a surgery's hold, and no failure is reported for it.
      */
     private withdrawMaintenanceWhenStopping;
+    /**
+     * Wakes the framework holds for `agentName` that need no new event: a
+     * request already queued for it (it runs as soon as the agent is free) and
+     * turns a provider cooldown holds until its end. The reply judge is told of
+     * them beside the gate's own timers, so it can weigh what waiting costs.
+     */
+    private upcomingWakesFor;
+    /**
+     * The heartbeat's ticks and reminders for `agentName`, soonest first, which
+     * the agent's rules decide as they decide a heartbeat push: one the rules
+     * would hold back is only a "maybe" (`certain` false). Each is probed as
+     * the event its delivery is judged by (deliverHeartbeat): a silent tick as
+     * silent, with the text it will bring, so a rule on the content or the
+     * silent flag decides the probe as it will decide the wake. None for an
+     * agent the heartbeat doesn't wake. `whose` words them for the judge ("its
+     * heartbeat") or for the agent ("your heartbeat").
+     */
+    private heartbeatWakesFor;
+    /**
+     * The heartbeat's wake due before a self-wake due at `selfWakeAt` (ms), for
+     * the skip_reply that armed it: the soonest of its ticks and reminders that
+     * the agent's rules, as they stand, let wake it. The confirmation says when
+     * it's due, not that it will wake the agent (skipReplyNote), so a probe
+     * that can't foresee the gate at the wake's time (a gate.js, a rate limit's
+     * tokens then) leaves it true. A failure here costs only that line: the
+     * self-wake is armed already, and the confirmation goes out without it.
+     */
+    private heartbeatWakeBefore;
+    /** The agents the heartbeat wakes: the residents, not conversation forks,
+     *  ephemeral runs or the subconscious, which keep windows of their own. */
+    private heartbeatTargets;
+    /**
+     * The event a heartbeat wake is to the gate: a push from the server id
+     * `heartbeat`, as heartbeat-mcpl's ticks and reminders were. So the
+     * agent's rules govern it as they governed those (a rule matching
+     * `source: "heartbeat"`, a `defer` default), and its sleep lets it through,
+     * as it lets that server id through.
+     */
+    private heartbeatGateEvent;
+    /**
+     * Deliver one of the heartbeat's wakes, as heartbeat-mcpl's push events
+     * were: a message-mode tick's or a reminder's text is stored, and the gate
+     * decides the wake by the agent's rules (heartbeatGateEvent), a sleep
+     * letting it through as it lets that server's pushes through. A silent
+     * tick stores no prompt: its turn, when the gate triggers one, is a silent
+     * heartbeat (silent-heartbeat.ts), prose suppressed. As for a stored push,
+     * the wake of the agent the text was delivered to is dropped once a
+     * request of its own has carried and answered the text (readsWriteFor);
+     * another resident's isn't tied to it.
+     */
+    private deliverHeartbeat;
+    /** Handle a call to one of the heartbeat's tools. */
+    private dispatchHeartbeatToolCall;
+    /**
+     * Why `agentName` may not make this heartbeat call, or null when it may.
+     * The heartbeat is the agent's, and wakes its residents: a conversation
+     * fork, an ephemeral run or the subconscious may look at it, but not
+     * change it or set a reminder that would wake someone else. Refused before
+     * the tool runs, as a fork's sleep is.
+     */
+    private heartbeatRefusal;
+    /** Run a heartbeat call, its throw an error result. */
+    private runHeartbeatTool;
     private auxiliaryMembraneFor;
+    /**
+     * The reply judge's calls. None waits: under the agent's holds a call is
+     * refused without being made, and the agent's turn stops the judge. A call
+     * that fails records the wait its provider states, if any, and holds
+     * nothing else.
+     */
+    private judgeMembraneFor;
     /**
      * A conversation agent's auxiliary calls (its context manager's
      * compression). A conversation agent takes no provider gate: admission
@@ -1061,13 +1205,20 @@ export declare class AgentFramework {
      * as a resident's are, so they bind its auxiliary calls too: a held model
      * is refused without a call, and an auxiliary call's own stated wait is
      * recorded for it. (An ephemeral run records nothing, its name being
-     * single-use, so its context manager keeps the plain membrane.) Its
+     * single-use, so its context manager's calls are only withdrawn, as below,
+     * through ephemeralAuxiliaryMembraneFor.) Its
      * compression is the background work a resident's is, whether a
      * maintenance tick or a drain after a message starts it, so it is withdrawn
      * as a resident's is: a call made while a surgery holds the store, or once
      * stop() has closed provider admission, is withdrawn without being sent.
      */
     private conversationAuxiliaryMembraneFor;
+    private ephemeralAuxiliaryMembraneFor;
+    private withdrawnOnceReleased;
+    private releaseManager;
+    private trackManager;
+    private closeManager;
+    private closeOpenManagers;
     /** The framework's membrane, with each complete() call passed through
      *  `admit` along with the model it names. */
     private membraneAdmitting;
@@ -1094,6 +1245,7 @@ export declare class AgentFramework {
      *  inference on it. True = extended in place (held requests stay held). */
     private extendHostProviderHold;
     private holdProviderAcceleration;
+    private rearmExhaustedTurn;
     /**
      * A provider's stated wait on a turn that doesn't own provider admission:
      * a conversation agent's or an ephemeral run's. Left to the error policy,
@@ -1108,7 +1260,8 @@ export declare class AgentFramework {
      * - An ephemeral run's name is single-use, so a wait recorded for it would
      *   bind nothing, and its caller is waiting on it. A retryable stated wait
      *   up to PROVIDER_ACCELERATION_MAX_COOLDOWN_MS is left to the error policy,
-     *   slept and retried. A longer one, or one that can't be represented, ends
+     *   which sleeps and retries it unless it declines, as a host's own ceiling
+     *   can. A longer one, or one that can't be represented, ends
      *   the run now ('fail'): it is never retried before the provider's time,
      *   and the caller hears why at once.
      * Anything else is the error policy's.
@@ -1142,6 +1295,9 @@ export declare class AgentFramework {
      * ops alert.
      */
     private recordProviderWait;
+    private noteStatedWaitRun;
+    private alertStatedWaitRun;
+    private endStatedWaitRun;
     /**
      * Hold this agent's primary turns for a provider wait on its model. The
      * requests are kept and released together, into one fresh compile, when
@@ -1496,7 +1652,6 @@ export declare class AgentFramework {
     private buildThinkTool;
     /** agent_settings tool definition with module extension fields merged in. */
     private buildAgentSettingsTool;
-    private warnEmptyUtilityPermissions;
     private getToolsForAgent;
     /** Available is independent of presentation visibility; execution callers keep this surface. */
     private availableToolsForPresentation;
@@ -1552,6 +1707,7 @@ export declare class AgentFramework {
     cancelAgentRuntimeSettingsTransition(agentName: string, opts?: {
         requester?: OperatorRequester;
     }): AgentRuntimeSettingsSnapshot;
+    private refuseRuntimeSettingsChangeUnderHold;
     /**
      * Wakes that passed the scheduler and now own provider admission while
      * waiting for an in-flight auxiliary call to settle — no turn token yet,
@@ -1627,8 +1783,10 @@ export declare class AgentFramework {
      * CURRENT settings — maintenance may have moved the folded floor and the
      * branch generation, so verdicts are computed at resume time, never reused.
      * Throws ResumeBlockedError (with all failing verdicts) unless `force`.
-     * Unavailable previews warn and pass — refusing to resume because the
-     * strategy cannot preview would hold hosts hostage to a diagnostic.
+     * Unavailable previews pass, with a warning naming the reason unless it is
+     * `no_preview_support`, a strategy with nothing to preview — refusing to
+     * resume because the strategy cannot preview would hold hosts hostage to a
+     * diagnostic.
      */
     resume(opts?: {
         force?: boolean;
@@ -1876,7 +2034,13 @@ export declare class AgentFramework {
      * see `AutobiographicalStrategy.previewContext` and
      * `Agent.compileWithInjections`.
      *
-     * Returns null when the agent's strategy has no fold plan (non-adaptive).
+     * Returns null when the agent's strategy has nothing to preview: one without
+     * `previewContext`, or a non-adaptive `AutobiographicalStrategy` whose select
+     * fits the budget, built from the framework's own copy of context-manager.
+     * Built from another copy, such a strategy throws its `previewContext
+     * requires adaptiveResolution` error here instead, since the manager
+     * recognises only its own copy's `NoFoldPlanToPreviewError`. Over the
+     * budget, a non-adaptive strategy's preview is an infeasible one.
      */
     previewContextSettings(agentName: string, budgetTokens: number, overrides?: Record<string, unknown>, opts?: {
         render?: boolean;
@@ -1897,9 +2061,9 @@ export declare class AgentFramework {
      *
      * Never throws for preview-layer reasons: strategy without previewContext,
      * preview overlap, stale branch generation, the hierarchical (non-
-     * adaptive) path, and a context manager that refuses its queries (its
-     * strategy's initialization pending or failed) all come back as
-     * `{available: false, reason}`. Unknown agent still throws, matching the
+     * adaptive) path within its budget, and a context manager that refuses its
+     * queries (its strategy's initialization pending or failed) all come back
+     * as `{available: false, reason}`. Unknown agent still throws, matching the
      * sibling accessors, and so does a patch whose values the agent refuses,
      * whatever its context manager's state. Whether the strategy takes live
      * tail and pace settings is the manager's to say, so while it refuses, a
@@ -1991,7 +2155,7 @@ export declare class AgentFramework {
     private readAgentRuntimeSettings;
     private validatePersistedAgentRuntimeSettings;
     /** Load resident-set inline caps from framework state, dropping (loudly)
-     *  anything that fails the same validation the live update enforces. A
+     *  anything Number() doesn't read as a finite number of at least 1000. A
      *  failed read is logged and boot goes on without them: nothing is lost,
      *  since persistToolResultInlineCap reads the stored caps again before it
      *  writes one. */
@@ -2076,7 +2240,13 @@ export declare class AgentFramework {
      * `{namespace}/messages`, context log to `{namespace}/context`.
      *
      * Data persists after cleanup for investigation and cross-revert.
-     * Call cleanup() when done to release the ContextManager.
+     * Call cleanup() when done with the agent: the agent can't run again. From
+     * the run's end, or from cleanup(), its ContextManager makes no provider
+     * call, and the calls it has out are aborted. It starts no new call while a
+     * surgery holds the store or once stop() has begun, either; one already out
+     * then runs on until stop(), with a store the framework owns, closes the
+     * ContextManager, before the store. Until then the ContextManager stays
+     * open.
      */
     createEphemeralAgent(config: AgentConfig): Promise<{
         agent: Agent;
@@ -2114,8 +2284,9 @@ export declare class AgentFramework {
      * framework drives the stream (emitting traces, logging, dispatching tools).
      * Returns the agent's speech output when it finishes (no more tool calls).
      * Rejects with ProviderWaitNotSleptError when the run ends rather than sleep
-     * a retryable failure's stated wait, and with a plain Error for any other
-     * ending.
+     * a retryable failure's stated wait longer than the framework's ten-minute
+     * cap, or one it can't represent, and with a plain Error for any other
+     * ending, a stated wait its error policy declines among them.
      *
      * The caller provides a pre-created agent + contextManager (from createEphemeralAgent).
      * The task message should already be in the context manager.
@@ -2146,6 +2317,7 @@ export declare class AgentFramework {
      *  hot-reloaded gate.json (same validation as load), so a rule takes effect
      *  immediately and survives restart. */
     private static readonly WAKE_RULE_TOOLS;
+    private static readonly JUDGED_WAKE_RULE_TOOLS;
     /** Discoverability for event tags (MCPL RFC-001): the reserved chat:* core,
      *  each connected server's declared tag ontology, and gate.js status. */
     private static readonly EVENT_TAGS_TOOL;
@@ -2179,26 +2351,13 @@ export declare class AgentFramework {
      * Mark an inference refusal visibly: react on the message that holds the
      * refused agent's conversational locus (the most recent incoming channel
      * message that isn't a reaction, reaction removal, edit or deletion
-     * marker, apart from an edit the coalescer delivers on acceptance as the
+     * marker or a chat:system notice, apart from an edit the coalescer delivers on acceptance as the
      * agent's first view; an ephemeral run has none, so a subagent's refusal
      * marks no message) with a category-specific emoji. Best-effort —
      * failures are logged, never thrown, and non-Discord loci are silently
      * skipped.
      */
     private reactToRefusal;
-    /**
-     * Shed the newest turn: remove the newest message that isn't a system
-     * message, whoever wrote it, with the rest of its exchange (the tool_use
-     * turn paired with a tool result, and the whole of a body stored in
-     * shards). It adds no marker; the caller keeps one consolidated marker for
-     * the episode (updateRewindMarker). The returned record's descriptor says
-     * what was removed and its size, never the content, while the raw record
-     * survives in the chronicle log for forensics. Returns null when only
-     * system messages remain.
-     *
-     * Shared by the refusal rewind, automatic or forced by `/unstick`, and by
-     * the shed after inference exhaustion (quarantinePoisonedHistory).
-     */
     private shedNewestTurn;
     /**
      * Maintain exactly ONE consolidated marker for the current rewind episode,
@@ -2242,8 +2401,11 @@ export declare class AgentFramework {
         ok: boolean;
         error?: string;
         agentName?: string;
-        /** Agent state at queue time — 'idle' means the turn starts on the next
-         *  scheduler pass; anything else means it runs after the current turn. */
+        /** Agent state at queue time — 'idle' means no turn holds the agent, so
+         *  the turn starts on the next scheduler pass unless a provider hold (a
+         *  provider's stated wait, or a capacity cooldown) holds it until the hold
+         *  ends, or a start of the agent's that waits for an auxiliary call to
+         *  finish goes first; anything else means it runs after the current turn. */
         agentStatus?: string;
         /** True when the host is quiesced: the wake is PARKED, not running, until resume(). */
         quiesced?: boolean;
@@ -2271,7 +2433,7 @@ export declare class AgentFramework {
      *   return the snapshot; the operator lever for draining quarantine or
      *   advancing merges during a quiesce window.
      *
-     *   host-status — report the quiesce state (drained / parked wakes /
+     *   host-status — report the quiesce state (drained / waiting wakes /
      *   scripts left running).
      *
      *   release-provider-wait — end an agent's provider wait (a provider's
@@ -2326,6 +2488,14 @@ export declare class AgentFramework {
      * turn alive (no continuation or held retry of one on its way), or it is
      * refused (OperatorActionError 'agent-busy'), and no turn starts until the
      * switch is done.
+     *
+     * Every agent's context manager is re-initialized for the branch before
+     * the store is released (reinitializeManagers). One whose
+     * re-initialization fails raises an ops alert naming its agent
+     * (`context-reinit-failed`), and the switch still resolves. A switch to the
+     * branch the store is already on re-initializes them too, which is how a
+     * manager left refusing by a failed re-initialization is recovered without
+     * a restart.
      */
     switchBranch(name: string): Promise<void>;
     /**
@@ -2337,12 +2507,30 @@ export declare class AgentFramework {
      *
      * The undone branch is saved so `redo()` can restore it.
      * Returns the checkpoint that was undone, or null if nothing to undo.
+     *
+     * The branch moves under every agent sharing the store, so an undo
+     * reserves the store as a surgery does: every agent must be idle, or it is
+     * refused (OperatorActionError 'agent-busy'). It returns once the store has
+     * moved, and the store stays reserved until every agent's context manager
+     * is re-initialized for the new branch, so no turn starts before then. One
+     * whose re-initialization fails raises an ops alert naming its agent
+     * (`context-reinit-failed`). An undo or redo made before the managers are
+     * done moves the store again under the same reservation, and they are
+     * re-initialized for the branch the last one leaves.
+     *
+     * `settled`, present when the store moved, settles once that reservation
+     * is released, every manager re-initialized or its failure alerted, and
+     * never rejects. Await it before work that needs the store free: a
+     * compile on an agent's own context manager, or a write meant to land at
+     * once, which the reservation would defer. An undo or redo that moves the
+     * store again under the same reservation settles with it.
      */
     undoLastTurn(agentName: string, requester?: OperatorRequester): {
         undone: boolean;
         turnIndex?: number;
         fromBranch?: string;
         toBranch?: string;
+        settled?: Promise<void>;
     };
     /** undoLastTurn's work, for a host/command undo already admitted: a stop()
      *  begun by a trace of one of its turns doesn't refuse the next. */
@@ -2352,11 +2540,15 @@ export declare class AgentFramework {
      *
      * Switches back to the branch that was active before the last undo.
      * Returns false if there's nothing to redo.
+     *
+     * It reserves the store and re-initializes every agent's context manager
+     * as undoLastTurn() does, and its result's `settled` is undoLastTurn()'s.
      */
     redo(agentName: string, requester?: OperatorRequester): {
         redone: boolean;
         fromBranch?: string;
         toBranch?: string;
+        settled?: Promise<void>;
     };
     /**
      * Append a record to the operator action log and broadcast it as an
@@ -2396,6 +2588,13 @@ export declare class AgentFramework {
      * does. Always release in `finally`: a token nobody clears wedges the fleet.
      */
     private reserveStoreForSurgery;
+    private reinitializeManagers;
+    private reportLongHold;
+    private disposeEmptiedForks;
+    private reportReinitFailures;
+    private reportReinitFailure;
+    private beginSyncMove;
+    private reinitializeAfterSyncMove;
     /**
      * A surgery's marker batch, recorded before its body change. If it can't
      * be recorded, the surgery doesn't start, and the error says what the
@@ -2704,6 +2903,7 @@ export declare class AgentFramework {
      * the template ("trunk") is a dormant warm checkpoint, not a listener.
      */
     private routeConversationIncoming;
+    private writeToFork;
     /**
      * Spawn a persistent per-channel conversation agent ("fork") from the
      * template agent: own ContextManager under `conversations/{name}`, seeded
@@ -2736,13 +2936,15 @@ export declare class AgentFramework {
      * Store the router's counters with the spawn's generation, create the fork
      * the decision names and bind its channel to it, registered in
      * conversationSpawns under the channel until it settles. The store runs
-     * inside the spawn's promise, still in routeConversation's synchronous
-     * step, so a store that throws rejects the spawn, which each caller reports
-     * as a failed spawn, rather than throwing out of routeConversation before
-     * the caller's try. routeConversation registers a spawn only when none is
-     * in flight for the channel, and only this spawn's settlement removes it,
-     * so the entry it removes is its own. It's removed before anyone waiting
-     * on it resumes, so a waiter that decides again doesn't find it.
+     * inside the spawn's promise, after it waits out a move's hold, so the
+     * counter lands on the branch the fork is created on; with no hold up, it
+     * runs in routeConversation's synchronous step. Either way a store that
+     * throws rejects the spawn, which each caller reports as a failed spawn,
+     * rather than throwing out of routeConversation before the caller's try.
+     * routeConversation registers a spawn only when none is in flight for the
+     * channel, and only this spawn's settlement removes it, so the entry it
+     * removes is its own. It's removed before anyone waiting on it resumes, so
+     * a waiter that decides again doesn't find it.
      *
      * It binds only while the fork it created is still the agent registered
      * under its name. stop() ends each live fork and unbinds the channels
@@ -2810,11 +3012,6 @@ export declare class AgentFramework {
      * explicit-prose agent's natural plain reply bounced with nowhere to go
      * (Rhys's first portal mention: a 2,320-char reply stranded).
      *
-     * Wording: option 1 teaches the `>>` destination prefix, which delivers for
-     * BOTH legacy (host-inferred) and explicit prose-routing agents. The
-     * previous "simply write your reply as normal text" was a false promise
-     * under explicit routing (the metadata flags it set had no consumers).
-     *
      * Human-readable names wherever the surface provided them — a mind reading
      * this should see WHO addressed it WHERE, not a wall of snowflake ids. Raw
      * ids remain only inside the tool-argument instructions, where they are the
@@ -3053,7 +3250,10 @@ export declare class AgentFramework {
     /** Record plain-prose segments this turn suppressed without drafts (proseRouting=disabled, or a round withheld before its scripts returned). */
     private recordProseSuppression;
     /**
-     * Silenced plain speech: an explicit send holds it as resendable drafts; a
+     * Silenced plain speech: an explicit send that may have posted where it was
+     * going holds it as resendable drafts (in a round that calls `drafts` and
+     * sends nothing else, 'kept', its plain speech is kept and counted
+     * instead); a
      * deliberate silence (skip_reply, a silent turn, or a private think in
      * the same native round, where that policy applies: an XML-mode round has
      * no verbatim content to route live, so its prose is routed at the turn's
@@ -3061,9 +3261,12 @@ export declare class AgentFramework {
      * counted for the receipt, never drafted. `segments` are the runs exactly
      * as written (splitProseRuns), so a draft keeps the resident's words byte
      * for byte. What it holds, keeps or moves is the round's turn's
-     * (round.routing), whenever the hold runs.
+     * (round.routing), whenever the hold runs. Hybrid speech under a send goes
+     * through routeSilencedHybrid.
      */
     private holdSilencedProse;
+    private routeSilencedHybrid;
+    private sendHoldText;
     /**
      * Hold plain speech as drafts (src/prose-drafts.ts) instead of
      * letting it vanish: journaled durably and recorded for the receipt of the
@@ -3172,6 +3375,21 @@ export declare class AgentFramework {
     /** Why a draft can't be resent now (dismissed, or possibly already posted
      *  without the resident's confirmation), or undefined when it can. */
     private resendRefusal;
+    /** Why a heartbeat's turn holds its plain speech, in a held-draft notice ("because …"). */
+    private static readonly HEARTBEAT_HOLD_BECAUSE;
+    /**
+     * Locus mode's delivery of plain speech to the turn's frozen locus. A
+     * heartbeat's turn with no locus of its own (TurnRouting.heartbeat) holds
+     * the words as a draft instead of failing the delivery: nobody was waiting
+     * for them, and the agent may send them where it chooses.
+     */
+    private routeLocusSpeech;
+    /** The mark a framework wake takes from a heartbeat's turn with no locus
+     *  of its own (InferenceRequest.heartbeatTurn), so the turn it opens is a
+     *  heartbeat's too; nothing for any other turn. */
+    private heartbeatTurnMark;
+    /** Hold a heartbeat turn's plain speech as drafts ('no-destination'), named by `round`'s notice. */
+    private holdHeartbeatProse;
     /** Record a successful plain-prose delivery for this turn's receipt. */
     private recordProseDelivery;
     /**
@@ -3188,6 +3406,8 @@ export declare class AgentFramework {
      * ([discord-send-failed]); this is the success half.
      */
     private appendProseDeliveryReceipt;
+    private nameUnpostedSpeech;
+    private noteFailedTurnEnd;
     /**
      * The closed-channel note alone, in a send's words, at explicit mode's turn
      * end, which has no `[delivered]` receipt since the agent named every
@@ -3199,6 +3419,13 @@ export declare class AgentFramework {
      * mid-turn. No-op otherwise.
      */
     private appendClosedChannelNoteAlone;
+    /**
+     * Tell a heartbeat's turn, before it compiles, that its plain speech has
+     * no destination (TurnRouting.heartbeat): the last `[routing]` notice may
+     * name a channel, and this turn's words won't go there. It leaves the
+     * announced baseline alone (announceLocusIfChanged).
+     */
+    private noticeHeartbeatTurn;
     /**
      * Announce-on-change locus notice (turn-frozen routing). Appends a durable
      * `[routing]` window message when the turn's effective outbound locus
@@ -3312,12 +3539,13 @@ export declare class AgentFramework {
      *  more rows than that have come since the last clock; a window with no
      *  clock row is read whole once, and then takes one (planClock). */
     private lastClockOf;
+    private agentSees;
     /**
      * Weigh a message that no tool boundary of the agent's open logical turn
      * will weigh: one that would re-pin the locus becomes one of the turn's
-     * arrivals (TurnRouting.arrivals). A message tune-out diverted
-     * (metadata.tuneOut) never enters a resident's compiled view, so the agent
-     * won't see it, and it moves nothing.
+     * arrivals (TurnRouting.arrivals). A message the agent's own view leaves
+     * out, such as one a tune-out diverted (metadata.tuneOut), never enters
+     * its compiled view, so the agent won't see it, and it moves nothing.
      */
     private noteArrival;
     /**
@@ -3340,6 +3568,7 @@ export declare class AgentFramework {
      * left running when it handed the turn on.
      */
     private showTurnTyping;
+    private heardSince;
     /**
      * The channel of the turn's newest arrival whose message is still in the
      * agent's store (TurnRouting.arrivals). A message removed since it was
@@ -3387,6 +3616,7 @@ export declare class AgentFramework {
      * locus-eligible.
      */
     private recordChannelAutoOpenNotice;
+    private tellReasoningLoss;
     /**
      * Write a builder's channel notices in order, each on its own: one that
      * can't be written is logged, and the rest are still written. A reader's
@@ -3637,6 +3867,7 @@ export declare class AgentFramework {
     private draftStateNow;
     /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
     private deliverHybridProse;
+    private deliverHybridEnvelope;
     /** `>>skip_reply {{unsent}}` and its hybrid form: set the latest bounce
      *  draft aside — unless it is being sent right now, which a dismissal
      *  can't call back: the resident is told instead. So are a dismissal whose
@@ -3693,7 +3924,8 @@ export declare class AgentFramework {
      * abandon or a stop of a registered agent settles the turn as it settles a
      * turn's start (endStoppedStart: one inference:aborted, the turn settled,
      * the gate released). Any other drop ends it as a start dropped before it
-     * sends anything ends. That frame, if it hasn't let go of its token yet,
+     * sends anything ends, and settles a registered ephemeral run's turn with
+     * the drop's reason. That frame, if it hasn't let go of its token yet,
      * ends on its own and settles nothing. What was deferred for the agent
      * lands now, or at that frame's end.
      */
@@ -3703,8 +3935,9 @@ export declare class AgentFramework {
      * admission, the hold installs nothing (holdForProviderWait,
      * holdProviderAcceleration), so no retry follows the turn's
      * inference:failed, and the turn ends as a retry a stop cancelled ends, with
-     * an inference:aborted saying so. Nothing is written. True when it ended
-     * the turn.
+     * an inference:aborted saying so. Nothing is written but the
+     * [speech-not-posted] notice, for speech the turn's rounds left unposted.
+     * True when it ended the turn.
      */
     private endFailureAtStop;
     /**
@@ -3739,6 +3972,42 @@ export declare class AgentFramework {
      * terminal, and the caller's goes with it.
      */
     private takeStartStop;
+    /**
+     * Cancel a stream the framework stops, under `kind`, the mark that tells
+     * the stream's end apart from a caller's stop (frameworkCancelledStreams).
+     * A mark records a cancel that happened, so a cancel that throws takes its
+     * mark back, leaving an earlier mark of the same stream as it was, and the
+     * throw goes on to the caller. With no `kind` (the agent holds no stream),
+     * nothing is marked.
+     */
+    private cancelUnderMark;
+    /**
+     * Cancel a live stream the framework ends at a tool boundary (`site` says
+     * where), under its mark. A cancel that throws leaves the stream going: its
+     * mark is taken back (cancelUnderMark), `onFailed` undoes what the site
+     * did ahead of the cancel, and the failure is logged. The stream waits for
+     * the round's results, which the boundary doesn't send, and the turn holds
+     * its token until the stream ends, as an abort does when its own cancel
+     * goes through. Only an operator's abort or stop, or an ephemeral run's
+     * idle watchdog, comes back to it, so an operator alert says so too.
+     * Returns whether the cancel went through.
+     */
+    private cancelLiveStream;
+    /**
+     * Cancel a stream a start compiled and won't send (`site` says why).
+     * Membrane's yielding stream starts its request when it is first iterated,
+     * and this one never is, so it has sent nothing: a cancel that throws is
+     * logged, and the start's cleanup goes on as if it had worked.
+     */
+    private cancelUnsentStream;
+    /**
+     * Cancel a stream that no longer owns its agent: the agent was replaced or
+     * removed, or a newer stream took it. Its frame settles nothing and is
+     * leaving, so a cancel that throws is logged and the frame leaves all the
+     * same. Thrown on, it would reject driveStream's promise, which nothing
+     * awaits but stop().
+     */
+    private cancelSupersededStream;
     /**
      * End a start that a stop reached before it sent anything, through the
      * terminal the same stop gets on a live stream: a caller's stop as
@@ -3771,8 +4040,7 @@ export declare class AgentFramework {
      * exists only through the private closure handed to ModuleRegistry
      * (ctx.callTool → executeToolCallFrom with {kind:'module'}), which is exempt
      * from agent allowlists. Registered agents' allowedTools is enforced at
-     * dispatch, including namespaced utility names; utils only grants the
-     * list/describe/run slot. Genuinely unidentified public callers (including
+     * dispatch, including namespaced utility names. Genuinely unidentified public callers (including
      * unknown legacy names) remain unrestricted. Framework-created identities
      * are refused while unregistered, even if their configured list allows it.
      */
@@ -3830,10 +4098,19 @@ export declare class AgentFramework {
      * assembled field by field (as unit tests do) needs no setup for it.
      */
     private toolsetActCalls?;
+    private puppetChanges?;
+    /** RFC-014 §6.1: a change reaches the agent once, so it goes with a result
+     *  only where the result is stored in an agent's window (the puppet's) or
+     *  handed to an agent awaiting it; null where it may not reach one. */
+    private changeTaker;
     /** A toolsets--act call resolved (resolveAct) to the call of the server's
      *  tool it makes, under that tool's model-facing name and with its
      *  arguments, its id kept; or the reason it can't be sent. */
     private resolveToolsetAct;
+    /** A toolsets--act call a host toolset resolved (HostPresentation.resolveAct):
+     *  its refusal answered, or the tool's own call dispatched in its place,
+     *  with the act's id, so its result is the act's. */
+    private dispatchHostAct;
     /**
      * RFC-014 §8.2: a toolsets--act call from the agent (the model's, or a
      * script's) goes down the path a direct call of the server's tool takes
@@ -3845,27 +4122,26 @@ export declare class AgentFramework {
      * before anything is sent.
      */
     private dispatchToolsetAct;
-    /**
-     * RFC-014 §6.2: a tool result that goes to the agent, with the tool change
-     * its hints made (applied as the result was read) told after the server's
-     * content; taking it means it isn't told again as a notice. The result
-     * itself when there's none, as for every server without toolHints.
-     */
-    private withToolsetChange;
     /** A programmatic call of an MCPL tool: `serverId` and `prefix` as
      *  resolveMcplTool matched them, or as toolsets--act resolved them
-     *  (toolsetActCalls). Its RFC-014 tool change isn't shown with its result,
-     *  which goes to its caller, not necessarily to the agent: it's told as a
-     *  notice (ToolsetController.tellUnlessClaimed). */
+     *  (toolsetActCalls). Its RFC-014 tool change goes with its result only
+     *  where the result is stored in an agent's window or handed to an agent
+     *  awaiting it (changeTaker); any other caller's
+     *  result may never reach one, so its change is told as a notice
+     *  (ToolsetController.tellUnlessClaimed). */
     private executeMcplToolCall;
+    private withWholeChange;
+    private withActStateHint;
     /** Event-pushing wrapper for the model-driven dispatch path. */
     private dispatchCodeExecutionToolCall;
+    private decideWaitingRound;
     /**
      * A model-issued tool's result has arrived. When it answers the last of
-     * the code_execution calls a round waits on (ScriptRound), the round's
-     * prose is routed now, its scripts' calls counted.
+     * the code_execution calls and sends a round waits on (ScriptRound), the
+     * round's prose is routed now, its scripts' calls counted.
      */
     private settleScriptRound;
+    private sendReachOf;
     /**
      * Whether a code_execution call watches a script that can change its
      * round's routing, so the round waits for the call (ScriptRound): a run's
@@ -4169,8 +4445,9 @@ export declare class AgentFramework {
     }>;
     /**
      * Find the MCPL server for a tool: [serverId, prefix], or null.
-     * The tool listing decides: the server whose tools/list offered the
-     * name, after its tool policy, as of the last tool refresh (a server that
+     * The tool listing decides: the server whose tools/list listed the name
+     * (offered to the model, or an RFC-014 dynamic tool, which dispatch then
+     * refuses by that name unless the published list or the server's latest tools/list puts it as static), after its tool policy, as of the last tool refresh (a server that
      * closed since keeps its names until the next one). A name the listing
      * doesn't hold (invented by the model, or no longer listed) goes to the
      * longest matching prefix. Prefixes that meet, such as `foo` and
@@ -4183,10 +4460,13 @@ export declare class AgentFramework {
      * while unregistered. Genuine legacy caller names retain their surface. */
     private canAgentUseTool;
     private agentToolPermissionFailure;
+    private markedInputFailure;
+    private cutOffResults;
     /**
-     * A dispatched call answered without running its tool. RFC-007's lifecycle
-     * forgets it, and its result says it was refused (`ToolResult.refused`), both
-     * from here, so the two can't disagree.
+     * A call answered without running its tool: one the dispatcher refused, or
+     * one in the last round of a response the output limit cut off. RFC-007's
+     * lifecycle forgets it, and its result says it was refused
+     * (`ToolResult.refused`), both from here, so the two can't disagree.
      */
     private refusedResult;
     /**
@@ -4207,7 +4487,8 @@ export declare class AgentFramework {
      * A call as its round's routing counts it, made directly, or by a script
      * and reaching the host while a run or wait call of the round watches it
      * (ScriptRound). A skip_reply refused, because the agent's allowedTools
-     * doesn't name it or because this host can't set the wake it asks for, is
+     * doesn't name it, because its arguments are refused (markedInputRefusal)
+     * or because this host can't set the wake it asks for, is
      * marked refused: it keeps its own round private and silences nothing after
      * it. A refusal withholds the call's effect, not the model's choice to keep
      * its words private. Any other call the list refuses posted nothing, so it
@@ -4275,14 +4556,16 @@ export declare class AgentFramework {
      */
     private placeWakeLines;
     /** Whether `entry`'s own stored entry is the newest in `agent`'s window,
-     *  clock rows and stored context injections after it aside: a channel
-     *  message by its server, channel and message id, a push event by its
-     *  server and event id, and never one a tune-out holds. Past
+     *  clock rows, stored context injections and rows the agent's own view
+     *  leaves out after it aside: a channel message by its server, channel and
+     *  message id, a push event by its server and event id, and never one the
+     *  agent's view leaves out, such as one a tune-out holds. Past
      *  NEWEST_SCAN_ROWS such rows, it answers no. */
     private isNewestIn;
     /** Where addMessage delivers: the named agent, else the primary, else the
      *  first registered agent. Undefined when there is no such agent. */
     private deliveryAgent;
+    private noteSpokenTo;
     /** The notes addMessage takes for a message it stored: an arrival for the
      *  agent when none of its turns is alive or the message was assembled for
      *  the start now beginning (no tool boundary will weigh it), and one for
@@ -4804,12 +5087,9 @@ export declare class AgentFramework {
      *  nothing new costs less than a write no wake brings the agent to read
      *  or answer. */
     private deferredWriteDone;
-    /** The mark a wake for `agentName` takes for the write it was queued with
-     *  (`placement`, addMessage's out-param): set only when that write was
-     *  deferred for that agent, since a stored write's wake starts the turn
-     *  that reads it. The scheduler drops the wake once the write needs
-     *  nothing more of the agent (deferredWriteDone). */
-    private readsDeferredFor;
+    private storedMessageDone;
+    private writeAnswered;
+    private readsWriteFor;
     private editMessage;
     private removeMessage;
     private getMessage;
@@ -4979,6 +5259,7 @@ export declare class AgentFramework {
     /** The restarts' claims (mcpRestartClaims), created on first use, as the
      *  modern connections are. */
     private restartClaims;
+    private closedTabConfigs;
     private legacyConnectAborts;
     /**
      * Hold a server id for one connect or disconnect, until `release()`.
@@ -5160,17 +5441,78 @@ export declare class AgentFramework {
      * logged here rather than replacing the failure the connect reports.
      */
     private closeFailedRuntimeConnect;
+    /** RFC-014: who held the name `toolsets` at startup (a module given to
+     *  create(); a server's toolPrefix of it is refused), so a server that
+     *  leaves toolHints out has none for the life of this framework; null when
+     *  the name was free. */
+    private toolsetsNameHeldAtStart;
+    /** At startup: note who holds the name the meta-tools need, and say which
+     *  servers that leaves without hints. */
+    private reserveToolsetsName;
+    /**
+     * RFC-014: whether a server has tool hints. Only an MCPL (legacy-family)
+     * server can: a modern MCP server never has them. `true` and `false` are
+     * as configured. Left out (or null) they're on, wherever the name
+     * `toolsets` the meta-tools need is free: no other module holds it and no
+     * server's prefix is it, now or at startup. So a configuration that loaded
+     * when hints were opt-in still loads. A name held at startup stays held
+     * for the framework's life.
+     */
+    private hintsFor;
     /**
      * The host capabilities offered to one server: the host's own, plus
-     * RFC-014's `toolHints` where its configuration asks for them. Without it,
-     * the very object every server is offered.
+     * RFC-014's `toolHints` unless its configuration turns them off
+     * (`toolHints: false`). With them off, the very object every server is
+     * offered.
      */
     private mcplHostCapabilitiesFor;
     /** RFC-014: every toolHints server's presence, made on first use. */
     private toolsets;
-    /** RFC-014: the `toolsets` module (toolsets--open, --act, --look,
-     *  --close), registered once, by the first server configured with
-     *  toolHints. Its tools don't change after that. */
+    /**
+     * The host's own toolsets (host-presentation.ts): the built-in "settings"
+     * toolset and each MCPL server's tab. State is kept beside the store, in
+     * `config/toolsets.json`; with no store path, in memory only.
+     */
+    private makeHostPresentation;
+    /** Whether a name is a module utility (and not a tool of its module, which takes the name). */
+    private isModuleUtility;
+    /** Whether an agent has the host's own toolsets: the meta-tools registered, and
+     *  usable by it (the subconscious keeps its own small surface). */
+    /**
+     * What a call of the removed `utils` is answered: where utilities went, as
+     * this agent can reach them. One that can't use the built-in toolset is
+     * told to call a utility by its own name and which ones it may call.
+     */
+    private utilsRemoved;
+    private hostToolsetsFor;
+    /**
+     * Whether a host tool belongs to the built-in toolset: the framework's own
+     * rarely-used ones (BUILTIN_TOOLSET_TOOLS), a module's that it places there
+     * (Module.toolPlacement), and every module utility.
+     */
+    private placedInBuiltin;
+    /**
+     * The tool list an agent's requests carry, from the tools it may call: its
+     * host presentation applied (the built-in toolset's tools, the servers it
+     * has as tabs and its hidden tools left out; a utility never in it), as
+     * every request of a registered agent has it (with its own tool
+     * presentation, hidden tools and descriptions, applied first). For a stream that isn't
+     * registered yet, such as a fork whose orientation is written before its
+     * run starts, the host says whether it will be able to call
+     * `toolsets--open` and `toolsets--act` (`canUseMeta`); left out, the agent
+     * registered under that name is asked. Presentation it chose itself (open
+     * toolsets, tabs) is read under that name, so a new name starts from the
+     * configured presentation.
+     */
+    presentedTools(agentName: string, tools: import('./types/index.js').ToolDefinition[], canUseMeta?: boolean): import('./types/index.js').ToolDefinition[];
+    /** The host presentation of a server's tools, for the tool list: the agent's
+     *  view, less the built-in toolset and the servers it has as tabs. */
+    private headerTools;
+    /** The `toolsets` module (toolsets--open, --act, --look, --close): the
+     *  meta-tools of the host's own toolsets and of RFC-014 servers' toolsets.
+     *  Registered once, at create(), unless a module given to create() holds
+     *  the name; a server with toolHints: true then can't have hints, and its
+     *  connect is refused here. Its tools don't change after that. */
     private ensureToolsetsModule;
     /** RFC-014 §5.3: after a (re)connect whose policy has settled, read what
      *  the server holds open and adopt it. In the background: its notices are
@@ -5394,6 +5736,9 @@ export declare class AgentFramework {
     listMcplServers(): Array<{
         id: string;
         connected: boolean;
+        /** Kept disconnected as a closed tab (host-presentation.ts) until an
+         *  agent's toolsets--open, an operator's connect or a restart connects it. */
+        closedTab: boolean;
         retrying: boolean;
         /** Which engine serves it: `legacy` (MCP 2024-11-05 + MCPL) or `modern`
          *  (MCP 2026-07-28), as its configuration selects; null when the
@@ -5496,7 +5841,9 @@ export declare class AgentFramework {
      */
     private refreshMcplTools;
     /**
-     * Report operator tool-name patterns that match no model-facing tool:
+     * Report operator tool-name patterns that match no tool name: one the
+     * model is offered, or an RFC-014 dynamic tool's listed name, which its
+     * class rules and lifecycle selectors match as a direct call's would:
      * `toolClassOverrides` keys and each server's `toolLifecycle.observe.tools`
      * / `toolLifecycle.inputs.tools`. These match `<toolPrefix>--<tool>`, and
      * the default prefix is `mcpl--<serverId>`, so a pattern written against
@@ -5511,8 +5858,9 @@ export declare class AgentFramework {
     private checkToolPatterns;
     /** Every tool name the framework offers to anyone: the shared board plus
      *  each agent's own surface, before presentation visibility (a hidden tool
-     *  is still callable, so classes and lifecycle still apply to it). */
-    private modelFacingToolNames;
+     *  is still callable, so classes and lifecycle still apply to it), and
+     *  every name an MCPL server lists, a dynamic tool's included. */
+    private patternableToolNames;
     /**
      * Handle a tools/list_changed notification with collapse logic.
      * At most 2 refresh cycles can be in-flight: one running and one pending.
@@ -5645,13 +5993,8 @@ export declare class AgentFramework {
      * authenticate bytes from another surface.
      */
     private dispatchSaveImageToolCall;
-    /** The `utils` meta-tool: list/describe/run over module utilities
-     *  (Module.getUtilities). Shared by the model-facing dispatcher, which a
-     *  running code_execution script's calls take too, and executeToolCallFrom,
-     *  which the puppet and a host reach through executeToolCall and a module
-     *  through callTool. */
-    private handleUtilsToolCall;
-    private dispatchUtilsToolCall;
+    private readAgentSettings;
+    private settingsChangedSince;
     private dispatchAgentSettingsToolCall;
     /** Aggregate the event-tag vocabulary: reserved chat:* core + each connected
      *  server's declared tag ontology + gate.js status. */