@animalabs/agent-framework 0.29.0 → 0.30.0

package/dist/src/framework.js

@@ -1,4 +1,5 @@
 import { ToolPresentation, presentationTools, isPresentationTool, renderCatalogue } from "./tool-presentation.js";
+import { presentAuthor } from './author-presentation.js';
 import { constants as bufferConstants } from 'node:buffer';
 import { dirname, join } from 'node:path';
 import { EXPIRY_REASON, REFERENCE_LIMITS, claimedExpiry, classifyBlock, isReferenceExpired, referenceBlockForScript, referenceRegistry, sanitizeLabel } from './mcpl/references.js';
@@ -9,8 +10,9 @@ import { MembraneError } from '@animalabs/membrane';
 import { classifyFailure, retryDecision, MEMBRANE_RETRY_SETTINGS } from '@animalabs/membrane/retry';
 import { ContextManager, PassthroughStrategy, WindowedPassthroughStrategy, OverBudgetError, UncoveredDropError, stripUnpairedToolBlocks, continuesBody, MalformedContentError, malformedContentPlaces, CompressionWithdrawn } from '@animalabs/context-manager';
 import { SILENT_HEARTBEAT_SEPARATOR } from './silent-heartbeat.js';
-import { SUBCONSCIOUS_TOOLS, SUBCONSCIOUS_TOOL_NAMES } from './tune-out/tools.js';
+import { SUBCONSCIOUS_TOOLS, SUBCONSCIOUS_TOOL_NAMES, defaultReaderFraming, } from './tune-out/tools.js';
 import { TuneOutCoordinator, TUNE_OUT_DEFAULTS, alreadyTunedOutText } from './tune-out/coordinator.js';
+import { admit } from './admission/admit.js';
 import { bodyGroupRun, bodyRangeIn, locateMessageIndex, locateMessageIndices, removeStoredMessage, removeStoredMessages, } from './stored-removal.js';
 import { asModuleRow, heldHandle, heldWriteId, matchesMessageQuery } from './held-writes.js';
 import { ProcessQueueImpl } from './queue.js';
@@ -41,6 +43,7 @@ import { InferenceRouter } from './mcpl/inference-router.js';
 import { ChannelRegistry, TUNE_OUT_REPLACED, connectorText, desiredStateInLog, destinationKey, journalToolDescription, NON_HOLDER_CHANNEL_DESCRIPTIONS, NO_CHANNEL_EXAMPLE, NO_PERSON_EXAMPLE, qualifiedChannelName, sameChannel } from './mcpl/channel-registry.js';
 import { KEEP_IDLE_MS, KEEP_NEWEST, ProseDraftStore, draftState, uncertainAttempt } from './prose-drafts.js';
 import { ConversationRouter, CONVERSATION_ROUTING_DEPRECATION_NOTICE } from './mcpl/conversation-router.js';
+import { AgentRegistry, conversationForkSpec, residentSpec, subconsciousSpec, taskForkSpec, workerSpec, } from './dendrite/index.js';
 import { INBOUND_SOURCE_KEY, sourceBodyDigest } from './mcpl/inbound-source.js';
 import { markNoticeOpenings, nameToTypeBack, quotedValue, showsAsItself, suppliedValue } from './supplied-text.js';
 import { NOTICE_TAG } from './notice-tags.js';
@@ -65,7 +68,7 @@ import { splitThinkingDrops, ThinkingLossIncidents } from './thinking-drops.js';
 import { asNextRequestCarries, roundRows } from './sent-rows.js';
 import { ReasoningLossTeller } from './reasoning-loss.js';
 import { contentAsStored, nameAsStored } from './text-as-stored.js';
-import { STORED_INJECTION_KEY, STORED_INJECTION_KIND, asStoredRow, hasRenderedContent, isAnotherAgentsInjection, isStoredKind, storedInjectionMarkOf, unitHash } from './stored-injections.js';
+import { STORED_INJECTION_KEY, STORED_INJECTION_KIND, asStoredRow, hasRenderedContent, isAnotherAgentsInjection, isOwnInjection, isStoredKind, storedInjectionMarkOf, unitHash } from './stored-injections.js';
 /** An MCPL tool call refused because its server isn't in the registry: one
  *  closed for good, one removed, or one whose connect failed without
  *  reconnect, which this host doesn't bring back on its own. A server that's
@@ -244,10 +247,11 @@ const PRIMARY_IF_UNREAD_KEY = 'primaryIfUnread';
  * a deferred write, `external` a module's own row for an outside message,
  * `openaiResponsesItems` membrane's mark of an imported Responses
  * history, `contextInjection` an agent's stored context injection
- * (stored-injections.ts), which every other agent's view leaves out, and
+ * (stored-injections.ts), which every other agent's view leaves out,
  * `primaryIfUnread` a module's write for an ephemeral run or a
  * conversation fork, which goes to the primary if its target never read it
- * (passesToPrimary). A
+ * (passesToPrimary), and `dendrite` the stamp of delivered agent mail, whose
+ * `mailId` releases that held mail once the row lands (releaseLandedMail). A
  * server's metadata, a channel message's `metadata` or a
  * push event's `origin`, is stored without them, and the host writes its own
  * after it: MCPL SPEC §16.6 makes metadata the producer's untrusted claims,
@@ -258,7 +262,7 @@ const PRIMARY_IF_UNREAD_KEY = 'primaryIfUnread';
  */
 const HOST_METADATA_KEYS = [
     'system', 'kind', 'draftOwner', 'draftIds', 'tuneOut', 'coalescingSubject', 'firstView',
-    'deferredWriteId', 'external', 'openaiResponsesItems', STORED_INJECTION_KEY, PRIMARY_IF_UNREAD_KEY,
+    'deferredWriteId', 'external', 'openaiResponsesItems', STORED_INJECTION_KEY, PRIMARY_IF_UNREAD_KEY, 'dendrite',
 ];
 /**
  * True when an injected message is real conversational input — something the
@@ -510,13 +514,15 @@ function mcplToolNoWordsText(serverId, callName) {
         'Whether it did anything is unknown: check before calling it again.';
 }
 /**
- * True when an incoming channel message explicitly addressed the agent.
- * Primary signal is the MCPL RFC-001 `chat:addressed` tag (mention / reply /
- * DM, as classified by the server); the metadata booleans are the fallback
- * for servers that predate tags. Addressed messages outrank ambient chatter
+ * True when an incoming channel message explicitly addressed the agent: the
+ * MCPL RFC-001 `chat:addressed` tag (mention / reply / DM, as classified by
+ * the server). Tag-only — there is no metadata fallback, so a server that
+ * does not tag never addresses. Addressed messages outrank ambient chatter
  * when picking a turn's frozen speech locus.
  */
-const isAddressedMessage = (tags, _metadata) => Array.isArray(tags) && tags.includes('chat:addressed');
+const isAddressedMessage = (tags) => Array.isArray(tags) && tags.includes('chat:addressed');
+/** The author a channel message names, for a notice about it. */
+const authorName = (metadata) => metadata?.author?.name ?? 'Someone';
 /** A wake's `ambient` mark: only a message its server tagged `chat:ambient`
  *  (RFC-001) is known to ask nothing of the agent. */
 const ambientMark = (tags) => Array.isArray(tags) && tags.includes('chat:ambient') ? { ambient: true } : {};
@@ -669,7 +675,7 @@ import { HostPresentation, BUILTIN_TOOLSET } from './host-presentation.js';
 import { isEmptyChange } from './mcpl/tool-presence.js';
 import { ToolsetsModule, resolveAct, withLookHint } from './mcpl/toolsets-module.js';
 import { ModernMcpConnection } from './mcpl/modern-connection.js';
-import { WITHHELD_TEXT, asText, credentialRedactor, redactUrl, redactServerText, resolveServerBinding, serverConfigProblems, serverCredentialPatterns, serverTextRedactor } from './mcpl/protocol-family.js';
+import { MAX_TIMER_MS, WITHHELD_TEXT, asText, credentialRedactor, redactUrl, redactServerText, resolveServerBinding, serverConfigProblems, serverCredentialPatterns, serverTextRedactor } from './mcpl/protocol-family.js';
 import { MALFORMED_CONTENT_NOTICE, normalizeStandardToolResult } from './mcpl/tool-result-normalize.js';
 import { boundedForLog, describeCause } from './mcpl/errors.js';
 import { assertServerConfigBooleans, buildWebSocketUrl, isWebSocketTransport } from './mcpl/transport.js';
@@ -679,6 +685,12 @@ import { firstFreeBranchName } from './branch-names.js';
 import { DEFAULT_DISCORD_AWARENESS_EMOJI, DiscordAwarenessOutbox, DiscordAwarenessRefusal, defaultDiscordAwarenessOutboxPath, extractDiscordAwarenessRefs, selectDiscordAwarenessRefs, checkedDiscordAwarenessMarks, boundDiscordAwarenessText, discordChannelOf, isPermanentDiscordReactionFailure, unsyncedWriteText, } from './recovery/discord-awareness-outbox.js';
 import { OperatorActionError, OperatorLog, capIds, defaultOperatorLogPath, } from './operator-log.js';
 const FRAMEWORK_STATE_ID = 'framework/state';
+/** Dendrite agent registry: live records, incarnation counters, held mail. */
+const AGENT_REGISTRY_STATE_ID = 'framework/dendrite';
+/** Dendrite agent registry: append-only history of ended agent records. */
+const AGENT_REGISTRY_ENDED_ID = 'framework/dendrite/ended';
+/** How many ended agent records are reloaded for inspection at boot. */
+const AGENT_REGISTRY_ENDED_RELOAD = 256;
 /** Snapshot slot mirroring context writes deferred while quiesced (#122). */
 const DEFERRED_WRITES_ID = 'framework/deferred-writes';
 /** RFC-006 coalescing bookkeeping: receipts (retry window) + subject history. */
@@ -750,11 +762,12 @@ function describeDeferredWrite(msg) {
 /** Whether a deferred message can join a live stream at a tool boundary:
  *  no tool blocks (the membrane's tool cycle) and not named as the agent
  *  itself (it would render as an assistant turn, a prefill). */
-function isInjectableMidTurn(msg, agentName) {
-    // Exact, as membrane's role test is: only a participant equal to the
-    // request's assistantParticipant (Agent's name) renders as the assistant.
-    // It's the name as sent, which the boundary takes as the store keeps it.
-    return nameAsStored(msg.participant) !== agentName
+function isInjectableMidTurn(msg, agent) {
+    // Exact, as membrane's role test is: a participant the request assigns
+    // the assistant role (the agent's name, and for a derived agent the
+    // voice it inherited) renders as the assistant. It's the name as sent,
+    // which the boundary takes as the store keeps it.
+    return !agent.isOwnParticipant(nameAsStored(msg.participant))
         && !msg.content.some((b) => b.type === 'tool_use' || b.type === 'tool_result');
 }
 /**
@@ -933,6 +946,7 @@ function freshTurnRouting() {
         engaged: new Set(),
         wasIn: [],
         continuation: false, deliveries: [], suppressed: 0, drafts: [], keptPrivate: 0, arrivals: [], heard: new Map(),
+        addressedElsewhere: new Set(),
     };
 }
 const sameReach = (a, b) => {
@@ -1618,6 +1632,33 @@ function extractGateFields(event) {
         : undefined;
     return { content, metadata, mount, paths };
 }
+/**
+ * The admission record on a stored message: it was held from the residents
+ * by a policy epoch (`metadata.tuneOut = { epochId }`). ONE predicate for
+ * "held from the resident", read by the compiled-view filter and by the
+ * mid-turn injection alike (#232 H1), so the window and the wire agree.
+ */
+export const heldFromResidents = (metadata) => !!metadata?.tuneOut;
+/**
+ * What a reader of the residents' shared message slot does not see: held
+ * messages. Used by every resident, and by a context derived from one when
+ * it is reopened.
+ */
+const RESIDENT_VIEW_FILTER = (message) => !heldFromResidents(message.metadata);
+/** Rejection delivered to the caller awaiting a bounded run that was ended from outside. */
+export class AgentStoppedError extends Error {
+    agentName;
+    reason;
+    by;
+    constructor(agentName, reason, by, detail) {
+        super(`Agent "${agentName}" was ended (${reason}${by ? ` by ${by}` : ''})` +
+            (detail ? `: ${detail}` : ''));
+        this.agentName = agentName;
+        this.reason = reason;
+        this.by = by;
+        this.name = 'AgentStoppedError';
+    }
+}
 export const REINIT_MOVES = ['undo', 'redo', 'rollback', 'suppression', 'branch switch'];
 const RECOVERY = 're-initializes it and stores its queued writes, at resume on a quiesced host; a restart can lose them.';
 export function refusedWorkAlert(move, cause) {
@@ -2248,6 +2289,13 @@ export class AgentFramework {
     quiesceReason;
     quiescedAt;
     traceListeners = [];
+    /** Traces emitted before start() — registry restore, interrupted work,
+     *  resumed epochs — replayed to listeners that attach afterwards, since a
+     *  host attaches its sinks after create() returns. Dropped at start().
+     *  It keeps the first 1,000, the start of the stream, and counts the rest
+     *  (earlyTracesDropped), which a replay ends by naming. */
+    earlyTraces = [];
+    earlyTracesDropped = 0;
     syncIntervalMs;
     syncTimer = null;
     maintenanceIntervalMs;
@@ -2308,8 +2356,9 @@ export class AgentFramework {
     midTurnInputSignals = new Set();
     /** Last outbound locus announced to each agent as a durable `[routing]`
      *  window message. Announce-on-change only: steady state emits nothing
-     *  (KV-safe, no per-turn chatter). In-memory — after a process restart the
-     *  first turn's locus is announced once to re-establish the baseline. */
+     *  (KV-safe, no per-turn chatter). Kept in the store as well
+     *  (rememberAnnouncedLocus), so a restart compares with what the agent was
+     *  last told rather than with nothing. */
     lastAnnouncedLocus = new Map();
     // ---- Held prose drafts (src/prose-drafts.ts) ---------------------------
     /** Every resident's held drafts: plain speech that was suppressed, bounced
@@ -2395,6 +2444,13 @@ export class AgentFramework {
     usedEphemeralAgentNames = new Map();
     /** One-shot generation tickets minted by createEphemeralAgent. */
     ephemeralCandidates = new WeakMap();
+    /**
+     * Derived agent → the agent whose tool presentation it shows. A derived
+     * agent that inherits its parent's tools must advertise the identical
+     * tool block (it is the front of the shared request prefix), including
+     * the parent's resident-edited visibility and descriptions.
+     */
+    toolSurfaceOwners = new Map();
     /** Every agent createEphemeralAgent made, for as long as the object lives:
      *  its usage counts in the usage record's one shared ephemeral entry. Kept
      *  by the object, not the run's record (ephemeralRuns), which its cleanup
@@ -2465,8 +2521,25 @@ export class AgentFramework {
     subconsciousStrategy = null;
     /** Its config (speak_in_channel gate, voice block provenance). */
     subconsciousConfig = null;
-    /** Tune-out coordinator (issue #77); non-null iff subconscious + channels. */
+    /** Tune-out coordinator (issue #77); non-null iff a reader is configured + channels. */
     tuneOutCoordinator = null;
+    /** Residents are offered `tune_out` (a reader is configured, or `tuneOut.enabled`). */
+    tuneOutOffered = false;
+    /**
+     * The reply anchor a coalesced delivery would set, parked until the
+     * acceptance is acknowledged to the server (handleCoalescedIncoming): an
+     * acceptance whose commit fails after its delivery moves no anchor, and the
+     * retry the receipt answers, which delivers nothing again, commits the one
+     * its first attempt parked. Keyed by server and event id; bounded.
+     */
+    parkedAnchors = new Map();
+    /** `tuneOut.announce`: the excepted channel hears the all-except scope open and close. */
+    tuneOutAnnounce = true;
+    /** `speech.locus`: where prose goes when nothing names a destination (see FrameworkConfig). */
+    speechLocus = 'delivery';
+    /** `subconscious.reader: 'forks'`: the reader is a succession of forks (Dendrite). */
+    readerForks = false;
+    readerForkCounter = 0;
     /** Agents an abandon could not cancel (token held, no stream) — surfaced
      *  in HostModeStatus until the next quiesce/resume. */
     lastUnabandonable = [];
@@ -2484,6 +2557,24 @@ export class AgentFramework {
     /** True once the cap has been met in the current run, so its line is
      *  logged once a run, whatever began the run. */
     deferredWritesCapLogged = false;
+    /** The agent registry and its ended log, as recovery files beside the store
+     *  (nissa's #546 finding 3): Chronicle state follows the store's branch, and
+     *  an undo or an operator's surgery must not erase a result held for
+     *  delivery or the record of work that ran. The file wins where it exists;
+     *  the branch-local state is read only for stores that predate it. */
+    agentRegistryPath;
+    agentRegistryEndedPath;
+    /** The ended log as the recovery file keeps it: the newest records, bounded. */
+    endedRecovery = [];
+    /** The branch-local ended log by name (its newest entry for each), and how far it is indexed (findEndedAgentRecord). */
+    endedLogIndex = new Map();
+    /** The ended log's entries by the namespace their context holds (the latest for each). */
+    endedLogNamespaceIndex = new Map();
+    /** Namespaces this process opened for an ephemeral agent's context, by owner: candidates not yet registered included. */
+    namespaceOwners = new Map();
+    endedLogIndexed = 0;
+    /** The last indexed entry's mark, so a log that changed under the index is seen. */
+    endedLogTail = '';
     /** Branch-independent recovery files (see FrameworkConfig.hostModePath /
      *  deferredWritesPath). Undefined → branch-local slot fallback. */
     hostModePath;
@@ -2634,12 +2725,32 @@ export class AgentFramework {
     coalescingSnapshotDirty = null;
     coalescingRecentReceipts = [];
     /**
-     * Agents that read the residents' shared un-namespaced message slot: every
-     * ordinary resident (their context managers are not isolated) and the
-     * subconscious (isolated, but merging that slot read-only). A message in
-     * that slot is unread only if NONE of them has compiled past it. Forks and
-     * ephemeral agents have isolated slots and are their own only readers.
-     */
+     * Dendrite agent registry — every agent this framework runs, with its
+     * roles, lifetime and relationships. `agents` stays the map of live Agent
+     * OBJECTS (the generation identity streams are checked against); the
+     * registry is what says what each of them is for. Selection sites read
+     * roles from here instead of excluding kinds by hand.
+     */
+    registry = new AgentRegistry({
+        persist: (snapshot) => this.persistAgentRegistry(snapshot),
+        appendEnded: (record) => this.appendEndedAgentRecord(record),
+        onRollback: () => this.rewriteAgentRegistryAfterRollback(),
+        findEnded: (name) => this.findEndedAgentRecord(name),
+    });
+    /** Tell the first adoption candidate when task work is orphaned (config.dendrite.announceOrphans). */
+    announceOrphans = true;
+    /**
+     * After this many derivations of one kind from one agent, that agent hears
+     * a count line every so many instead of a line per fork
+     * (config.dendrite.collapseDerivationNoticesAfter; 0 = never collapse).
+     */
+    collapseDerivationNoticesAfter = 10;
+    /** The host's say over each derivation, ephemeral spawn and resume (config.dendrite.beforeDerive). */
+    beforeDerive;
+    /** What a source is told of a derivation (config.dendrite.derivationNotice); absent, the default line. */
+    derivationNoticeHook;
+    /** Per source agent, per kind: how many derivations, since when, and at which count the last note went. */
+    derivationTallies = new Map();
     sharedSlotAgents = new Set();
     /** The batched-wake lines already written (placeWakeLines), so every agent a
      *  wake was for, and every later start of it, writes each at most once. */
@@ -2648,6 +2759,7 @@ export class AgentFramework {
      *  in the round counted by their share of the bound: such a round is
      *  stored by its share whether or not it fits (buildStoredToolResultContent). */
     toolRoundsByShare = new WeakSet();
+    /** Group commit: one fsync per event-loop turn, shared by every waiter. */
     /** The windows of forks and runs deregistered while the host was quiesced,
      *  by agent name (releaseWindowNowOrAfterResume); resume() releases them
      *  (runReleasesAfterResume), or stop() passes on what they left, unread or
@@ -2656,6 +2768,7 @@ export class AgentFramework {
     releasesAfterResume = new Map();
     managerReleases = new WeakMap();
     releasedByCleanup = new WeakSet();
+    resumesPending = new Map();
     // context-manager 0.23.1: a strategy that keeps its context, as
     // AutobiographicalStrategy does (hostContext, autobiographical.ts:2897),
     // keeps its manager reachable while its work is pending, since the
@@ -2676,19 +2789,17 @@ export class AgentFramework {
     conversationRouter = null;
     /** Agent configs by name — fork agents are built from the template's config. */
     agentConfigs = new Map();
-    /**
-     * Fork agent → its home channel. Permanent (unlike router bindings, which
-     * expire): publish/injection scoping must survive unbinding so the closure
-     * turn still lands in the right channel.
-     */
-    conversationAgentHomes = new Map();
+    // A fork agent's home channel is its registry record's `homeChannel`
+    // (homeOf). Permanent (unlike router bindings, which expire):
+    // publish/injection scoping must survive unbinding so the closure turn
+    // still lands in the right channel.
     /** Forks being spawned, by channel id, each until its spawn settles (see
      *  routeConversation). The promise never rejects. */
     conversationSpawns = new Map();
     /** Last idle-TTL sweep timestamp. */
     lastConversationSweep = 0;
     /** Forks whose TTL closure turn has been queued — disposed (removed from
-     * agents/agentConfigs/conversationAgentHomes) when their stream ends. */
+     * agents/agentConfigs and ended in the registry) when their stream ends. */
     closingConversationAgents = new Set();
     // Client-side programmatic tool calling (`code_execution`). Null unless
     // config.codeExecution.enabled: its settings, and every agent's scripts,
@@ -2991,7 +3102,7 @@ export class AgentFramework {
         // Register framework states
         ensureStateRegistered(store, { id: FRAMEWORK_STATE_ID, strategy: 'snapshot' });
         ensureStateRegistered(store, { id: DEFERRED_WRITES_ID, strategy: 'snapshot' });
-        for (const id of [COALESCING_STATE_ID, COALESCING_RECENT_ID]) {
+        for (const id of [COALESCING_STATE_ID, COALESCING_RECENT_ID, AGENT_REGISTRY_STATE_ID]) {
             ensureStateRegistered(store, { id, strategy: 'snapshot' });
         }
         ensureStateRegistered(store, {
@@ -3019,6 +3130,12 @@ export class AgentFramework {
                 throw new Error(`the conversation router's generation counters (${CONVERSATION_ROUTER_STATE_ID}) could not be read: ${thrownText(error)}`, { cause: error });
             }
         }
+        ensureStateRegistered(store, {
+            id: AGENT_REGISTRY_ENDED_ID,
+            strategy: 'append_log',
+            deltaSnapshotEvery: 100,
+            fullSnapshotEvery: 20,
+        });
         // Process logging config (default: disabled)
         const processLoggingPersist = config.processLogging?.persist === true;
         // Register process log state only if persistence is enabled
@@ -3081,8 +3198,36 @@ export class AgentFramework {
         // subconscious disabled now may have run and left its own entry.
         framework.restoreUsageState([
             ...config.agents.map((agent) => String(agent.name)),
-            ...(config.subconscious ? [String(config.subconscious.name ?? 'Subconscious')] : []),
+            // A forks reader has no agent of its own; its forks are bounded jobs.
+            ...(config.subconscious && config.subconscious.reader !== 'forks' ? [String(config.subconscious.name ?? 'Subconscious')] : []),
         ]);
+        framework.announceOrphans = config.dendrite?.announceOrphans ?? true;
+        framework.collapseDerivationNoticesAfter = Math.max(0, Math.floor(config.dendrite?.collapseDerivationNoticesAfter ?? 10));
+        framework.beforeDerive = config.dendrite?.beforeDerive;
+        framework.derivationNoticeHook = config.dendrite?.derivationNotice;
+        framework.speechLocus = config.speech?.locus ?? 'delivery';
+        framework.tuneOutOffered = !!config.subconscious?.enabled || config.tuneOut?.enabled === true;
+        framework.tuneOutAnnounce = config.tuneOut?.announce !== false;
+        // What the previous process left in the agent registry. Read before any
+        // agent is declared so a restored persistent agent becomes a new
+        // incarnation of the same identity rather than a stranger. The registry
+        // lives in recovery files beside the store (see agentRegistryPath).
+        framework.agentRegistryPath = config.agentRegistryPath
+            ?? (config.storePath ? join(config.storePath, 'recovery', 'dendrite-registry.json') : undefined);
+        framework.agentRegistryEndedPath = config.agentRegistryEndedPath
+            ?? (config.storePath ? join(config.storePath, 'recovery', 'dendrite-ended.json') : undefined);
+        if (!framework.agentRegistryPath || !framework.agentRegistryEndedPath) {
+            const missing = [
+                ...(framework.agentRegistryPath ? [] : ['agentRegistryPath']),
+                ...(framework.agentRegistryEndedPath ? [] : ['agentRegistryEndedPath']),
+            ];
+            console.error(`[dendrite] no storePath / ${missing.join(' / ')}: the agent registry's ` +
+                (framework.agentRegistryPath
+                    ? 'ended log persists only in the branch-local store, where a branch switch or historical rollback can erase it'
+                    : 'records and held results persist only in the branch-local store, where a branch switch or historical rollback can erase them') +
+                ', and a crash can lose what wasn\'t synced; configure the recovery paths');
+        }
+        const interruptedAgents = framework.restoreAgentRegistry();
         // Create agents
         for (const agentConfig of config.agents) {
             await framework.createAgent(agentConfig);
@@ -3092,8 +3237,13 @@ export class AgentFramework {
         // The subconscious resident (issue #77) registers after the residents so
         // it can never become primary; it is excluded from every broadcast
         // fan-out and woken only by the tune-out coordinator's explicit pushes.
-        if (config.subconscious?.enabled === true) {
-            await framework.createSubconsciousAgent(config.subconscious);
+        if (config.subconscious?.enabled) {
+            if (config.subconscious.reader === 'forks') {
+                framework.configureReaderForks(config.subconscious);
+            }
+            else {
+                await framework.createSubconsciousAgent(config.subconscious);
+            }
         }
         // Finish any branch-local suppression interrupted after Chronicle switched
         // branches. This runs before modules, MCPL connections, or inbound traffic.
@@ -3218,7 +3368,8 @@ export class AgentFramework {
                         })(),
                     });
                 },
-                getAgentNames: () => [...framework.agents.keys()].filter((n) => n !== framework.subconsciousAgentName),
+                getAgentNames: () => framework.registry.gateRecipients(),
+                isHeld: (serverId, channelId) => !!(serverId && channelId && framework.tuneOutCoordinator?.holdFor(serverId, channelId)),
                 // Push events reach the gate with the adapter's raw channel id; map
                 // them to the registered composite id the same way ingestion does
                 // (handleMcplPushEvent registers that channel on arrival, before any
@@ -3372,6 +3523,14 @@ export class AgentFramework {
         // and each MCPL server's tab, per agent, kept beside the store.
         framework.hostPresentation = framework.makeHostPresentation(config.storePath);
         // Initialize MCPL subsystems if configured
+        // Configuration has now declared its agents, and host mode and the
+        // deferred-write queue are restored: settle what the previous process
+        // left unfinished (interrupted bounded work, persistent agents no longer
+        // configured, results still held for delivery). After the restore, so a
+        // quiesced host holds the restart notices and redelivered mail as it
+        // holds any write, and mail an entry of the restored queue carries is
+        // left to that entry's landing (nissa's #546 finding 4).
+        framework.reconcileAgentRegistry(interruptedAgents);
         if (config.mcplServers && config.mcplServers.length > 0) {
             // Check every server's config before any is brought up: its boolean
             // settings, and its tool prefix, which mustn't collide with a module
@@ -3422,21 +3581,34 @@ export class AgentFramework {
             // MCPL or none.
             await framework.ensureToolsetsModule();
         }
-        // Tune-out coordinator (issue #77): needs both the subconscious resident
-        // and the MCPL channel subsystem; created after both exist.
-        if (framework.subconsciousAgentName && framework.channelRegistry) {
+        // Tune-out coordinator (issue #77, #232 §3.3): the hold machinery exists
+        // wherever tune_out is offered — with a reader (persistent subconscious
+        // or reader forks) it summarizes and wakes; with `tuneOut.enabled` alone
+        // it is a silent hold, and a persisted epoch is resumed and released
+        // (#232 gap 10). Where neither is configured nothing could ever cancel a
+        // tune-out on record, so each one ends at the start instead
+        // (endTuneOutsWithoutCoordinator), as main has it.
+        if (framework.channelRegistry && framework.tuneOutOffered) {
             framework.tuneOutCoordinator = new TuneOutCoordinator(framework.channelRegistry, framework.mcplServerRegistry, {
                 addMessage: (participant, content, metadata, forAgent) => framework.addMessage(participant, content, metadata, forAgent ? { forAgent } : undefined),
                 requestInference: (agentName, reason, source) => {
                     framework.pendingRequests.push({ agentName, reason, source, timestamp: Date.now() });
                 },
                 subconsciousName: () => framework.subconsciousAgentName,
+                ...(framework.readerForks
+                    ? {
+                        invokeReader: (invocation) => framework.invokeReaderFork(invocation),
+                        deliverFromReader: (reader, content, metadata) => framework.deliverFromReader(reader, content, metadata),
+                    }
+                    : {}),
                 primaryName: () => framework.primaryAgentName,
                 getStoredMessages: () => {
                     const primary = framework.primaryAgentName
                         ? framework.agents.get(framework.primaryAgentName) : undefined;
                     return primary ? primary.getContextManager().getAllMessages() : [];
                 },
+                commitDeliveries: () => framework.commitDeliveries(),
+                historyTool: () => framework.residentHistoryTool(),
                 getDeferredMessages: () => {
                     const forPrimary = (m) => (m.forAgent ?? framework.primaryAgentName) === framework.primaryAgentName;
                     // Settled first, so a write that landed is in the stored rows
@@ -3444,7 +3616,7 @@ export class AgentFramework {
                     framework.settleUnknownLandings(forPrimary);
                     return framework.deferredMessages.filter(forPrimary)
                         .sort(bySeq)
-                        .map((m) => ({ participant: m.participant, content: m.content, metadata: m.metadata }));
+                        .map((m) => ({ participant: m.participant, content: m.content, metadata: m.metadata, writeId: m.id, heldAt: m.heldAt }));
                 },
                 // Every reader of the shared slot compiles the dump with its own
                 // strategy, so the dump fits the smallest of their bounds.
@@ -3459,9 +3631,20 @@ export class AgentFramework {
                 },
                 currentSequence: () => framework.store.currentSequence(),
                 setSubconsciousAnchor: (sequence) => framework.subconsciousStrategy?.setAnchor(sequence),
-                isForkBound: (channel) => [...framework.conversationAgentHomes.values()].some((home) => sameChannel(home, channel)),
+                isForkBound: (channel) => framework.registry.list().some((record) => sameChannel(framework.homeOf(record.name), channel)),
                 isPrivilegedAuthor: (authorId) => framework.eventGate?.isPrivilegedUser(authorId) ?? false,
                 allowChannelSpeech: () => framework.subconsciousConfig?.allowChannelSpeech === true,
+                holdWithoutReader: () => framework.tuneOutOffered,
+                ...(framework.tuneOutAnnounce
+                    ? {
+                        // The excepted channel on its server: a bare id two servers
+                        // register is refused (publishForAgent).
+                        announce: async (serverId, channelId, text) => {
+                            const r = await framework.channelRegistry.publishForAgent({ serverId, channelId }, text, framework.primaryAgentName ?? 'resident');
+                            return { success: r.success, ...(r.error ? { error: r.error } : {}) };
+                        },
+                    }
+                    : {}),
                 emitTrace: (e) => framework.emitTrace(e),
             });
             framework.tuneOutCoordinator.resumeActiveEpochs();
@@ -3549,6 +3732,7 @@ export class AgentFramework {
         }
         this.running = true;
         this.providerAdmissionClosed = false;
+        this.earlyTraces = null;
         // A new lifecycle: a turn compiled before an earlier stop() never drives,
         // and withheld spills, closed for the generation a stop ended, are open
         // for this one.
@@ -3814,6 +3998,12 @@ export class AgentFramework {
         step(() => this.pushCoalescer?.suspend());
         step(() => this.flushCoalescingSnapshot());
         this.running = false;
+        // Bounded work this stop cuts off is neither finished nor failed. Its
+        // record stays live in the snapshot, so the next boot ends it as
+        // `host-restart` and tells its result recipient — the same as a crash
+        // (first live run, 2026-10-12, finding D: a reader fork ended silently).
+        for (const run of this.ephemeralRuns.values())
+            run.endReason ??= 'host-stop';
         // Flushed-but-unsynced deferred writes: sync and ack now, while the
         // store is still open, rather than leaving them to a reboot replay.
         step(() => this.ackDeferredWrites());
@@ -4009,12 +4199,12 @@ export class AgentFramework {
         // since the name is never used again. These releases, and the pass after
         // them, come before the registry forgets its channels, since a notice
         // names its channel by the label the registry holds (channelForNotice).
-        for (const name of [...this.conversationAgentHomes.keys()]) {
+        // The registry names the conversation forks and their home channels.
+        for (const { name, home } of this.listAgents().filter((r) => r.kind === 'conversation-fork').map((r) => ({ name: r.name, home: this.homeOf(r.name) }))) {
             step(() => {
-                const home = this.conversationAgentHomes.get(name);
-                if (this.conversationRouter?.getBinding(home)?.agentName === name)
+                if (home !== undefined && this.conversationRouter?.getBinding(home)?.agentName === name)
                     this.conversationRouter.unbind(home);
-                this.disposeConversationAgent(name);
+                this.disposeConversationAgent(name, 'host-stop');
             });
         }
         // A window release the quiesce postponed (releasesAfterResume) never runs
@@ -4452,10 +4642,12 @@ export class AgentFramework {
         }
     }
     /** The agents the heartbeat wakes: the residents, not conversation forks,
-     *  ephemeral runs or the subconscious, which keep windows of their own. */
+     *  ephemeral runs or the subconscious, which keep windows of their own.
+     *  Read from the registry by role, as an untargeted push's recipients are
+     *  (the heartbeat's wakes were heartbeat-mcpl's pushes): the agents whose
+     *  spec takes untargeted inbound, in registration order. */
     heartbeatTargets() {
-        return [...this.agents.keys()].filter((n) => !this.conversationAgentHomes.has(n)
-            && !this.ephemeralRuns.has(n) && n !== this.subconsciousAgentName);
+        return this.registry.untargetedRecipients().filter((n) => this.agents.has(n));
     }
     /**
      * The event a heartbeat wake is to the gate: a push from the server id
@@ -4552,7 +4744,7 @@ export class AgentFramework {
         const tool = call.name.replace(/^(mcpl--)?heartbeat--/, '');
         if (!HEARTBEAT_CHANGING_TOOLS.includes(tool) || this.heartbeatTargets().includes(agentName))
             return null;
-        const one = this.conversationAgentHomes.has(agentName) ? 'conversation'
+        const one = this.registry.homeChannel(agentName) !== undefined ? 'conversation'
             : this.ephemeralRuns.has(agentName) ? 'run' : 'side agent';
         return `Nothing was changed: the heartbeat and its reminders are the agent's, and wake its residents, so this ${one} can't `
             + 'change them. heartbeat--heartbeat_status and heartbeat--reminder_list show them.';
@@ -4801,7 +4993,7 @@ export class AgentFramework {
         return true;
     }
     holdProviderAcceleration(agent, error, trigger, auxiliary = false) {
-        if (this.ephemeralRuns.has(agent.name) || this.conversationAgentHomes.has(agent.name))
+        if (!this.registry.ownsProviderScheduling(agent.name))
             return false;
         // A provider's stated wait binds later calls to the primary model, across
         // restarts. (An auxiliary call records its own model's wait at the gate.)
@@ -4941,7 +5133,7 @@ export class AgentFramework {
         // as a number, as the default error policy reads it.
         if (!isMembraneError(error) || typeof error.retryAfterMs !== 'number')
             return undefined;
-        if (this.conversationAgentHomes.has(agent.name)) {
+        if (this.registry.homeChannel(agent.name) !== undefined) {
             const wait = this.recordProviderWait(agent.name, agent.model, error);
             return error.retryable === true && wait !== undefined && this.holdForProviderWait(agent, wait, trigger ? [asTurnRetry(trigger)] : [], true)
                 ? 'held'
@@ -5175,6 +5367,15 @@ export class AgentFramework {
         // outlives the stop as a turn still alive. Nothing is started either.
         if (this.providerAdmissionClosed)
             return true;
+        // A listener of the failure reported here (`report`) may have ended the
+        // agent (stopAgent): its end dropped what of its turn was on its way,
+        // and nothing is held for an agent that's gone, so no retry outlives it
+        // as a turn still alive. (A caller that reports a failure before calling
+        // here checks the agent first: nonOwningProviderWait holds only for an
+        // agent whose registry record is still live, and the scheduler and the
+        // last boundary pass this.agents' own Agent.)
+        if (this.agents.get(agent.name) !== agent)
+            return true;
         // A listener of the report may have released the wait
         // (releaseProviderWait) before anything was held: nothing binds now, so
         // the requests start, as the release of an installed hold starts them.
@@ -5699,9 +5900,26 @@ export class AgentFramework {
     /**
      * Add a trace event listener for observability.
      */
-    onTrace(listener) {
+    onTrace(listener, options) {
         const registration = { listener, active: true };
         this.traceListeners.push(registration);
+        // A host attaches its sinks after create() returns, so the traces
+        // create() emitted (registry restore, interrupted work, resumed epochs)
+        // are replayed to a listener that asks; dropped at start().
+        if (options?.replay) {
+            const replayed = [...(this.earlyTraces ?? [])];
+            if (this.earlyTraces && this.earlyTracesDropped > 0) {
+                replayed.push({ type: 'dendrite:early-traces-dropped', dropped: this.earlyTracesDropped, timestamp: Date.now() });
+            }
+            for (const event of replayed) {
+                try {
+                    registration.listener(event);
+                }
+                catch (error) {
+                    console.error('Trace listener error (replay):', error);
+                }
+            }
+        }
         // Return an unsubscribe so callers with a bounded lifetime (e.g. modules
         // that get torn down and recreated on session switch) don't leak
         // listeners. Existing callers that ignore the return value are unaffected.
@@ -6048,8 +6266,8 @@ export class AgentFramework {
         if (this.channelRegistry) {
             channelTools.push(AgentFramework.DRAFTS_TOOL);
         }
-        if (this.tuneOutCoordinator) {
-            channelTools.push(AgentFramework.TUNE_OUT_TOOL);
+        if (this.tuneOutCoordinator && this.tuneOutOffered) {
+            channelTools.push(AgentFramework.TUNE_OUT_TOOL, AgentFramework.FOCUS_TOOL);
         }
         const gateTools = this.eventGate
             ? [
@@ -6438,7 +6656,7 @@ export class AgentFramework {
     tunedOutSendNote(agentName, channel) {
         try {
             const registry = this.channelRegistry;
-            if (!registry || this.conversationAgentHomes.has(agentName))
+            if (!registry || this.registry.homeChannel(agentName) !== undefined)
                 return undefined;
             if (registry.getDesiredState(channel.serverId, channel.channelId) !== 'tuned-out')
                 return undefined;
@@ -6473,7 +6691,7 @@ export class AgentFramework {
      *  delivered, so that's logged and nothing is added. */
     closedChannelNotes(agentName, channels) {
         try {
-            if (this.conversationAgentHomes.has(agentName))
+            if (this.registry.homeChannel(agentName) !== undefined)
                 return [];
             const notes = [...channels].flatMap((channel) => this.closedChannelNoteFor(agentName, channel) ?? []);
             // The setting is read only when there's a note to give.
@@ -6694,7 +6912,13 @@ export class AgentFramework {
                 : t);
             return [...SUBCONSCIOUS_TOOLS, ...basics];
         }
-        return [...this.getAllTools(), ...(this.toolPresentations.has(agentName) ? presentationTools(this.toolPresentations.get(agentName).config.cataloguePath) : [])]
+        const surfaceOwner = this.toolSurfaceOwners.get(agentName) ?? agentName;
+        // Reader forks (subconscious.reader: 'forks') share the resident's
+        // provider prefix, and the tool block is the front of it: the reader's
+        // four tools are therefore in every agent's block and refused at
+        // dispatch for everyone but a reader (see dispatchToolCall).
+        const readerTools = this.readerForks ? SUBCONSCIOUS_TOOLS : [];
+        return [...this.getAllTools(), ...readerTools, ...(this.toolPresentations.has(surfaceOwner) ? presentationTools(this.toolPresentations.get(surfaceOwner).config.cataloguePath) : [])]
             .map((tool) => {
             if (tool.name === 'think') {
                 return this.buildThinkTool(snapshot?.sameRoundThinkTextPolicy
@@ -6720,7 +6944,9 @@ export class AgentFramework {
         return tools;
     }
     inspectToolPresentation(agentName, snapshot) {
-        const presentation = this.toolPresentations.get(agentName);
+        // A derived agent shows its parent's presentation (see toolSurfaceOwners);
+        // only the owner can edit it (editToolPresentation looks up by own name).
+        const presentation = this.toolPresentations.get(this.toolSurfaceOwners.get(agentName) ?? agentName);
         if (!presentation)
             return null;
         const tools = this.availableToolsForPresentation(agentName, snapshot);
@@ -8017,6 +8243,16 @@ export class AgentFramework {
         }
         this.deferredMessages.push(...restored);
         this.deferredWritesPersisted = true;
+        // A tune-out release that was still deferred at the crash owes the
+        // resident the wake its cancel requested (#232 gap 6).
+        for (const m of restored) {
+            if (m.metadata?.kind !== 'tune-out-cancel')
+                continue;
+            const target = m.forAgent ?? this.primaryAgentName;
+            if (target) {
+                this.pendingRequests.push({ agentName: target, reason: 'tune-out released (restored)', source: 'tune-out', timestamp: Date.now() });
+            }
+        }
         // Rewrite the durable queue without the already-landed entries so a
         // second interrupted boot does not re-scan them, without the malformed
         // and repeated ones, and with a seq for each entry that came without a
@@ -8847,7 +9083,16 @@ export class AgentFramework {
      * ContextManager, before the store. Until then the ContextManager stays
      * open.
      */
-    async createEphemeralAgent(config) {
+    async createEphemeralAgent(config, 
+    /**
+     * How the registry should describe this agent. Omitted: an independent
+     * fresh worker with no spawner and no result route, which is what every
+     * caller of this method got before the registry existed. Supplying a
+     * spec (see the presets in `dendrite/`) declares who spawned it, where
+     * its result goes and what it inherited, so lifecycle rules — orphan
+     * notice, reparenting, held results — apply to it.
+     */
+    spec) {
         // Checked before anything happens: the constructor checks too, but only
         // after the name is reserved and ContextManager.open has registered the
         // agent's message and context states in the store.
@@ -8860,22 +9105,76 @@ export class AgentFramework {
         }
         this.usedEphemeralAgentNames.set(config.name, 'run');
         const release = { released: false, calls: new Set() };
+        let opened;
         try {
-            const namespace = `subagent/${config.name}`;
-            const contextManager = await ContextManager.open({
-                store: this.store,
-                namespace,
-                isolate: true,
-                strategy: config.strategy ?? new PassthroughStrategy(),
-                membrane: this.ephemeralAuxiliaryMembraneFor(config.name, release),
-                debugLogContext: !!process.env.DEBUG_CONTEXT,
-            });
+            // A namespace the spec names is where the context opens, as it is what
+            // the record says and what inspection and resumption open later.
+            let namespace = spec?.namespace ?? `subagent/${config.name}`;
+            let contextManager;
+            // The host's say, on the spec of what is about to exist.
+            if (this.beforeDerive) {
+                const effective = spec
+                    ? { ...spec, name: config.name, model: config.model }
+                    : { ...workerSpec(config.name, { namespace }), model: config.model };
+                const verdict = this.beforeDerive(effective);
+                if (verdict && typeof verdict === 'object' && 'refuse' in verdict) {
+                    throw new Error(`${config.name} was not created: ${verdict.refuse}`);
+                }
+            }
+            let inherit = spec?.inherit;
+            if (inherit?.mode === 'shared') {
+                // Shared reads, separate writes: the child's context is the parent's
+                // at a checkpoint, on a branch of its own. Nothing is copied.
+                const derived = await this.deriveSharedContext(config, inherit, release);
+                contextManager = derived.contextManager;
+                inherit = derived.inherit;
+                namespace = derived.namespace;
+            }
+            else {
+                // A namespace belongs to the agent that opened it: another agent's
+                // turns there would be read as its own by inspection and by its
+                // resumption, which reopens "its own namespace". So one another
+                // agent's context holds (live, a candidate, awaiting re-declaration
+                // or ended) is refused; an agent's own reopens in a new incarnation.
+                const holder = this.namespaceHolder(namespace, config.name);
+                if (holder) {
+                    // The default is offered only where it isn't the namespace refused.
+                    const fallback = `subagent/${config.name}`;
+                    throw new Error(`Ephemeral agent "${config.name}" refused: namespace "${namespace}" holds the context of agent ` +
+                        `"${holder}"; name another${namespace === fallback ? '' : `, or none for ${fallback}`}`);
+                }
+                this.namespaceOwners.set(namespace, config.name);
+                opened = namespace;
+                contextManager = await ContextManager.open({
+                    store: this.store,
+                    namespace,
+                    isolate: true,
+                    strategy: config.strategy ?? new PassthroughStrategy(),
+                    membrane: this.ephemeralAuxiliaryMembraneFor(config.name, release),
+                    debugLogContext: !!process.env.DEBUG_CONTEXT,
+                });
+            }
+            // Either manager is the run's to release (main's manager release), the derived one included.
             this.trackManager(contextManager);
             release.manager = contextManager;
             const agent = new Agent(config, contextManager, this.membrane);
             this.adoptToolResultGuard(agent);
             agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
-            this.ephemeralCandidates.set(agent, contextManager);
+            this.ephemeralCandidates.set(agent, {
+                contextManager,
+                config,
+                spec: spec
+                    ? {
+                        ...spec,
+                        name: config.name,
+                        model: config.model,
+                        // A shared fork's context lives under its parent's namespace,
+                        // on the fork's own branch — not in a namespace of its own.
+                        namespace: inherit?.mode === 'shared' ? namespace : spec.namespace ?? namespace,
+                        ...(inherit ? { inherit } : {}),
+                    }
+                    : { ...workerSpec(config.name, { namespace }), model: config.model },
+            });
             this.ephemeralAgents.add(agent);
             this.managerReleases.set(agent, release);
             const cleanup = () => {
@@ -8888,8 +9187,1371 @@ export class AgentFramework {
             if (release.manager)
                 this.closeManager(release.manager);
             this.usedEphemeralAgentNames.delete(config.name);
+            if (opened !== undefined)
+                this.namespaceOwners.delete(opened);
+            throw error;
+        }
+    }
+    /**
+     * Derive a new agent from a live one: the parent's context at a
+     * checkpoint, a private continuation, and — unless overridden — the
+     * parent's whole configuration (model, thinking, cache TTL, provider
+     * params, prompt, tools). The parent keeps running.
+     *
+     * The returned agent is a bounded job, driven with
+     * `runEphemeralToCompletion` exactly like one from `createEphemeralAgent`.
+     *
+     * **Inheritance.** `mode: 'shared'` (the default) gives the child the
+     * parent's messages and fold state through shared storage: nothing is
+     * copied, the child folds with the parent's memory tree, and neither can
+     * alter what the other reads. It needs branch-bound store handles and is
+     * refused, not silently downgraded, where they are missing. `mode: 'copy'`
+     * is the historical mechanism — the parent's compiled context re-added as
+     * the child's own messages — and works everywhere.
+     *
+     * **Rendering.** With `solve: 'reuse'` (the default) and nothing
+     * overridden, the child's first request is the parent's request plus the
+     * child's framing: the same system prompt and tool block, the parent's
+     * turns presented as the child's own, and a cache marker on the end of
+     * the parent's request so the prefix it wrote is read back. `solve:
+     * 'fresh'` deliberately re-solves, e.g. at another budget; so does any
+     * override that changes what is rendered. Those are operating choices —
+     * the presentation changes and the provider cache misses.
+     *
+     * **Framing** is ordinary messages appended to the child before it runs:
+     * the task, and whatever tells it which stream it is. The parent's turn
+     * in flight is not in its store yet (see `getPendingAssistantRound`), so
+     * a fork made from inside a tool call starts from the message before the
+     * turn that made it.
+     *
+     * Context isolation is not process or filesystem isolation: parent and
+     * child share tools, any shell and the workspace.
+     */
+    async deriveAgent(options) {
+        const parent = this.agents.get(options.from);
+        const parentConfig = this.agentConfigs.get(options.from);
+        if (!parent || !parentConfig) {
+            throw new Error(`deriveAgent: "${options.from}" is not a registered agent`);
+        }
+        const mode = options.mode ?? 'shared';
+        const shared = mode === 'shared';
+        if (!shared && options.inheritRefusals === true) {
+            throw new Error(`deriveAgent: "${options.name}" was not created: inheritRefusals is for mode 'shared', and a copy brings no refusal ledger`);
+        }
+        if (!shared && options.solve !== undefined) {
+            throw new Error(`deriveAgent: "${options.name}" was not created: solve is for mode 'shared', and a copy is not solved`);
+        }
+        const config = {
+            ...parentConfig,
+            // The parent's LIVE settings, not just its recipe: a runtime budget or
+            // think-policy override changes what it renders.
+            ...(parent.contextBudgetTokens !== undefined ? { contextBudgetTokens: parent.contextBudgetTokens } : {}),
+            sameRoundThinkTextPolicy: parent.getEffectiveSameRoundThinkTextPolicy(),
+            ...options.config,
+            name: options.name,
+            strategy: options.strategy,
+            // A shared inheritance has no copy step to rename the parent's turns,
+            // so the mapping is declared: the parent's voice is the child's own,
+            // presented under the name the parent's own requests use.
+            ...(shared
+                ? {
+                    selfParticipants: [...new Set([
+                            parent.name,
+                            ...(parentConfig.selfParticipants ?? []),
+                            ...(options.config?.selfParticipants ?? []),
+                        ])],
+                    presentAs: options.config?.presentAs ?? parent.presentAs,
+                }
+                : { selfParticipants: options.config?.selfParticipants, presentAs: options.config?.presentAs }),
+        };
+        const spec = taskForkSpec(options.name, {
+            parent: options.from,
+            spawnedBy: options.spawnedBy ?? options.from,
+            ...(options.resultTo ? { resultTo: options.resultTo } : {}),
+            ...(options.deadlineMs !== undefined ? { deadlineMs: options.deadlineMs } : {}),
+            ...(options.idleTimeoutMs !== undefined ? { idleTimeoutMs: options.idleTimeoutMs } : {}),
+            ...(options.maxTurns !== undefined ? { maxTurns: options.maxTurns } : {}),
+            ...(options.metadata ? { metadata: options.metadata } : {}),
+            inherit: {
+                mode,
+                ...(options.solve ? { solve: options.solve } : {}),
+                ...(options.inheritRefusals !== undefined ? { refusals: options.inheritRefusals } : {}),
+            },
+        });
+        const { name: _name, ...specBody } = {
+            ...spec,
+            // The record states the mapping the agent's requests actually use.
+            ...(config.selfParticipants?.length ? { selfParticipants: config.selfParticipants } : {}),
+            ...(config.presentAs && config.presentAs !== config.name ? { presentAs: config.presentAs } : {}),
+            ...(options.kind ? { kind: options.kind } : {}),
+            ...(options.onParentEnd ? { onParentEnd: options.onParentEnd } : {}),
+        };
+        const created = await this.createEphemeralAgent(config, specBody);
+        try {
+            if (this.agents.get(options.from) !== parent) {
+                throw new Error(`deriveAgent: "${options.from}" ended while "${options.name}" was being derived from it`);
+            }
+            if (options.config?.allowedTools === undefined) {
+                this.toolSurfaceOwners.set(options.name, this.toolSurfaceOwners.get(options.from) ?? options.from);
+            }
+            if (!shared) {
+                // The historical copy: the parent's compiled view, its turns renamed
+                // so the child reads its inheritance as its own history.
+                const { messages } = await parent.getContextManager().compile();
+                for (const message of messages) {
+                    created.contextManager.addMessage(parent.isOwnParticipant(message.participant) ? options.name : message.participant, message.content);
+                }
+                created.agent.markContextConsumed();
+            }
+            await this.framePendingRound(parent, created.contextManager, options, shared);
+            for (const message of options.framing ?? []) {
+                created.contextManager.addMessage(message.participant, message.content, message.metadata);
+            }
+            return created;
+        }
+        catch (error) {
+            this.discardEphemeralCandidate(created.agent, created.contextManager);
+            throw error;
+        }
+    }
+    discardEphemeralCandidate(agent, contextManager) {
+        this.ephemeralCandidates.delete(agent);
+        this.ephemeralAgents.delete(agent);
+        if (this.toolSurfaceOwners.has(agent.name) && !this.agents.has(agent.name))
+            this.toolSurfaceOwners.delete(agent.name);
+        this.releaseManager(agent);
+        this.managerReleases.delete(agent);
+        this.closeManager(contextManager);
+    }
+    /**
+     * The default wording for the call that derived a child: who it is, what
+     * kind, and how long — the fields the consent event names, so the fork
+     * never has to infer its own lifetime from context (Linn, 10-09).
+     */
+    derivedNote(parentName, options) {
+        const record = this.registry.inspect(options.name);
+        const kind = record?.kind ?? options.kind ?? 'task-fork';
+        const onParentEnd = record?.onParentEnd ?? options.onParentEnd ?? 'orphan';
+        const route = record?.relationships.resultTo ?? options.resultTo;
+        const returns = route
+            ? route.as === 'message'
+                ? `your report returns to ${route.to} as mail under your own name`
+                : `your result returns to ${route.to} as this call's result`
+            : null;
+        const lifetime = onParentEnd === 'end'
+            ? `You end when ${parentName} does${returns ? `; ${returns}` : ''}; nothing you do speaks as ${parentName}.`
+            : `You finish your task and then end${returns ? `; ${returns}` : ''}; if ${parentName} ends first you keep running, as an orphan with the same return address.`;
+        return (`[This call derived ${options.name}. You are ${options.name}, a ${kind}, continuing from here on your own branch. ` +
+            `${lifetime} ${parentName} receives this call's result, not you.]`);
+    }
+    /**
+     * The parent's in-flight tool round, reproduced on the child's branch so
+     * the child sees the call that made it (see `DeriveAgentOptions.pendingRound`).
+     */
+    async framePendingRound(parent, child, options, shared) {
+        const round = options.pendingRound ?? {};
+        if (round.include === false)
+            return;
+        const pending = this.pendingAssistantBlocks.get(parent.name);
+        if (!pending)
+            return;
+        const calls = pending.filter((b) => b.type === 'tool_use');
+        if (calls.length === 0)
+            return;
+        const state = parent.state;
+        const completed = state.status === 'waiting_for_tools' ? state.completed : [];
+        const cap = this.resolveToolResultInlineCap(parent).cap;
+        const { blocks: received } = await this.buildStoredToolResultContent(options.name, completed, cap);
+        const byId = new Map(received.map((b) => [b.toolUseId, b]));
+        const open = calls.filter((c) => !byId.has(c.id));
+        const madeBy = round.madeBy?.toolUseId ?? (open.length === 1 ? open[0].id : undefined);
+        const results = calls.map((call) => {
+            const stored = byId.get(call.id);
+            if (stored)
+                return stored;
+            const content = call.id === madeBy
+                ? round.madeBy?.result ?? this.derivedNote(parent.name, options)
+                : round.results?.[call.id] ??
+                    `[No result yet: this call was still running in ${parent.name} when ${options.name} was derived.]`;
+            return { type: 'tool_result', toolUseId: call.id, toolName: call.name, content, isError: false };
+        });
+        const metadata = { kind: 'dendrite-pending-round', from: parent.name };
+        child.addMessage(shared ? parent.name : options.name, structuredClone(pending), metadata);
+        child.addMessage('user', results, metadata);
+    }
+    /**
+     * The assistant turn an agent has produced but not yet stored: its tool
+     * calls and any text before them, held until every tool result is in so
+     * the pair lands adjacently. A host deriving an agent from inside one of
+     * those tool calls can reproduce the turn in the child's framing.
+     */
+    getPendingAssistantRound(agentName) {
+        const blocks = this.pendingAssistantBlocks.get(agentName);
+        return blocks ? structuredClone(blocks) : undefined;
+    }
+    /**
+     * Bring an ended bounded job back as a new incarnation of the same
+     * identity, on the context it left: an isolated agent's own namespace, or
+     * a derived agent's own branch. Nothing is re-derived and nothing is
+     * re-seeded — the agent continues from its last stored message, which is
+     * the end of its last complete round (a round whose tool results never
+     * all arrived was never stored).
+     *
+     * Use it for a job that was stopped, failed, or was interrupted by a
+     * restart. Configuration is not persisted with an agent, so the caller
+     * supplies it again; the role mapping a derived agent used is restored
+     * from its record unless the config sets one. Relationships are kept
+     * where the other agent still exists; a job whose spawner or result
+     * recipient is gone resumes without that edge and can be reparented.
+     *
+     * External effects are not replayed and not undone: a tool the previous
+     * incarnation ran before it ended has had its effect, and a call it never
+     * received a result for may be made again by the model. Drive the result
+     * with `runEphemeralToCompletion`.
+     */
+    async resumeAgent(name, config) {
+        if (this.resumesPending.has(name)) {
+            throw new Error(`resumeAgent: "${name}" is already being resumed`);
+        }
+        if (this.registry.has(name) || this.agents.has(name) || this.ephemeralRuns.has(name)) {
+            throw new Error(`resumeAgent: "${name}" is still registered; only an ended agent resumes`);
+        }
+        const record = this.registry.inspect(name);
+        if (!record?.ended)
+            throw new Error(`resumeAgent: "${name}" is not a known ended agent`);
+        if (record.lifetime.kind !== 'task') {
+            throw new Error(`resumeAgent: "${name}" has a ${record.lifetime.kind} lifetime; only bounded jobs resume this way`);
+        }
+        const fullConfig = {
+            ...config,
+            name,
+            ...(config.selfParticipants === undefined && record.selfParticipants
+                ? { selfParticipants: record.selfParticipants }
+                : {}),
+            ...(config.presentAs === undefined && record.presentAs ? { presentAs: record.presentAs } : {}),
+        };
+        const spawnedBy = record.relationships.spawnedBy;
+        const resultTo = record.relationships.resultTo;
+        const keepSpawner = spawnedBy !== undefined && this.registry.has(spawnedBy);
+        const spec = {
+            name,
+            kind: record.kind,
+            model: fullConfig.model,
+            roles: record.roles,
+            lifetime: record.lifetime,
+            ...(record.activation ? { activation: record.activation } : {}),
+            ...(keepSpawner ? { spawnedBy, onParentEnd: record.onParentEnd } : {}),
+            ...(resultTo && this.registry.has(resultTo.to) ? { resultTo } : {}),
+            ...(record.inherit ? { inherit: record.inherit } : {}),
+            ...(fullConfig.selfParticipants?.length ? { selfParticipants: fullConfig.selfParticipants } : {}),
+            ...(fullConfig.presentAs && fullConfig.presentAs !== name ? { presentAs: fullConfig.presentAs } : {}),
+            ...(record.namespace ? { namespace: record.namespace } : {}),
+            ...(record.metadata ? { metadata: record.metadata } : {}),
+        };
+        if (this.beforeDerive) {
+            const verdict = this.beforeDerive(spec);
+            if (verdict && typeof verdict === 'object' && 'refuse' in verdict) {
+                throw new Error(`${name} was not resumed: ${verdict.refuse}`);
+            }
+        }
+        this.resumesPending.set(name, undefined);
+        const release = { released: false, calls: new Set() };
+        let contextManager;
+        try {
+            contextManager = await this.reopenAgentContext(record, config.strategy, this.ephemeralAuxiliaryMembraneFor(name, release));
+        }
+        catch (error) {
+            this.resumesPending.delete(name);
             throw error;
         }
+        this.trackManager(contextManager);
+        release.manager = contextManager;
+        let agent;
+        try {
+            if (this.registry.has(name) || this.agents.has(name) || this.ephemeralRuns.has(name)) {
+                throw new Error(`resumeAgent: "${name}" was registered while it was being resumed`);
+            }
+            agent = new Agent(fullConfig, contextManager, this.membrane);
+            this.adoptToolResultGuard(agent);
+            agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
+        }
+        catch (error) {
+            this.resumesPending.delete(name);
+            this.closeManager(contextManager);
+            throw error;
+        }
+        this.usedEphemeralAgentNames.set(name, 'run'); // a resumed job is an ephemeral run: no global fallback (takesGlobalFallback)
+        this.ephemeralAgents.add(agent); // and its usage counts in the shared ephemeral entry (#558)
+        this.ephemeralCandidates.set(agent, { contextManager, config: fullConfig, resume: true, after: record.incarnation, spec });
+        this.managerReleases.set(agent, release);
+        this.resumesPending.set(name, agent);
+        const cleanup = () => {
+            if (this.resumesPending.get(name) === agent)
+                this.resumesPending.delete(name);
+            this.releasedByCleanup.add(agent);
+            this.releaseManager(agent);
+        };
+        return { agent, contextManager, cleanup };
+    }
+    /**
+     * A context to read an agent's history from, without changing the live
+     * system.
+     *
+     * - A live agent: a snapshot derived from its context — at the head, or
+     *   at `atSequence` for an earlier state. The snapshot is its own branch;
+     *   the agent keeps running and is not affected by anything done to it.
+     * - An ended agent: the context it left, reopened where it lives.
+     *
+     * The returned manager uses a passthrough strategy: it shows what is
+     * stored, raw. An ended agent's context is the real one — treat it as
+     * read-only unless you mean to change what a later resume starts from.
+     */
+    async inspectAgentContext(name, options = {}) {
+        const live = this.registry.has(name) ? this.agents.get(name) : undefined;
+        if (live) {
+            const source = live.getContextManager();
+            if (typeof source.derive !== 'function') {
+                throw new Error('inspectAgentContext: a snapshot of a live agent needs a @animalabs/context-manager that provides ContextManager.derive');
+            }
+            const taken = new Set(this.store.listBranches().map((branch) => branch.name));
+            let n = 1;
+            while (taken.has(`dendrite/inspect/${name}/${n}`))
+                n++;
+            return source.derive({
+                branch: `dendrite/inspect/${name}/${n}`,
+                strategy: new PassthroughStrategy(),
+                membrane: this.membrane,
+                solve: 'fresh',
+                ...(options.atSequence !== undefined ? { atSequence: options.atSequence } : {}),
+            });
+        }
+        const record = this.registry.inspect(name);
+        if (!record)
+            throw new Error(`inspectAgentContext: "${name}" is not a known agent`);
+        if (options.atSequence !== undefined) {
+            throw new Error('inspectAgentContext: atSequence applies to a live agent; an ended agent is read as it was left');
+        }
+        return this.reopenAgentContext(record, new PassthroughStrategy());
+    }
+    /** Open the context an ended agent left, wherever it lives. */
+    async reopenAgentContext(record, strategy, membrane = this.membrane) {
+        // The residents' view as createAgent gives it: held rows out, and another
+        // agent's stored context injections out, since those are that agent's
+        // context, not conversation (Weft's ninth-round probe: an ended reader
+        // reopened for inspection showed a co-resident's injection it never saw live).
+        const residentSees = (name) => (metadata) => RESIDENT_VIEW_FILTER({ metadata }) && !isAnotherAgentsInjection(metadata, name);
+        // A context derived from a reader of the shared slot sees, as it did live
+        // (deriveSharedContext, #291), what its source saw and its own stored
+        // injections; its source's view is composed the same way, up the shared
+        // sources the registry names, to the reader the first was derived from.
+        const derivedSees = (from, walked = new Set()) => {
+            const source = from.inherit?.mode === 'shared' ? from.inherit.from : undefined;
+            if (source === undefined || walked.has(from.name))
+                return residentSees(from.name);
+            walked.add(from.name);
+            const sourceRecord = this.registry.inspect(source);
+            const sourceSees = sourceRecord ? derivedSees(sourceRecord, walked) : residentSees(source);
+            return (metadata) => sourceSees(metadata) || isOwnInjection(metadata, from.name);
+        };
+        // The predicate is the manager's view filter, and is recorded beside it,
+        // so main's checks of whether an agent sees a row (agentSees) ask what its
+        // view holds when the reopened context is live.
+        const seen = (contextManager, sees) => {
+            this.storeSees.set(contextManager, sees);
+            return contextManager;
+        };
+        if (record.inherit?.mode === 'shared') {
+            const derivation = record.inherit.derivation;
+            const reopen = ContextManager.reopenDerived;
+            if (!derivation || typeof reopen !== 'function') {
+                throw new Error(`Agent "${record.name}": its context is a derived branch, which this ` +
+                    '@animalabs/context-manager cannot reopen (ContextManager.reopenDerived)');
+            }
+            // A context derived from a reader of the shared slot keeps the view it had.
+            const sees = derivation.slots?.messageNamespace === null ? derivedSees(record) : undefined;
+            const reopened = await reopen.call(ContextManager, {
+                store: this.store,
+                derivation,
+                strategy: strategy ?? new PassthroughStrategy(),
+                membrane,
+                ...(sees ? { viewFilter: (message) => sees(message.metadata) } : {}),
+                debugLogContext: !!process.env.DEBUG_CONTEXT,
+            });
+            return sees ? seen(reopened, sees) : reopened;
+        }
+        if (!record.namespace) {
+            throw new Error(`Agent "${record.name}": its record names no context to reopen`);
+        }
+        // A reader of the residents' shared slot (a resident dropped from the
+        // configuration, say) is reopened as createAgent opened it: on the
+        // shared slot, through the residents' view. Isolated, its namespace
+        // holds none of what it read (nissa's #546 review, round 2).
+        const sees = record.readsSharedSlot === true ? residentSees(record.name) : undefined;
+        const opened = await ContextManager.open({
+            store: this.store,
+            namespace: record.namespace,
+            ...(sees ? { viewFilter: (message) => sees(message.metadata) } : { isolate: true }),
+            strategy: strategy ?? new PassthroughStrategy(),
+            membrane,
+            debugLogContext: !!process.env.DEBUG_CONTEXT,
+        });
+        return sees ? seen(opened, sees) : opened;
+    }
+    /** Open a derived agent's context on a branch of its own (see deriveAgent). */
+    async deriveSharedContext(config, inherit, release) {
+        const parent = this.agents.get(inherit.from);
+        if (!parent) {
+            throw new Error(`Agent "${config.name}": context source "${inherit.from}" is not a registered agent`);
+        }
+        if (this.surgeryHold) {
+            throw new Error(`Agent "${config.name}" refused: the store is under live ${this.surgeryHold.verb} ` +
+                `for ${this.surgeryHold.agentName} — retry when it completes`);
+        }
+        const source = parent.getContextManager();
+        if (typeof source.derive !== 'function') {
+            throw new Error(`Agent "${config.name}": shared context inheritance needs a @animalabs/context-manager ` +
+                'that provides ContextManager.derive; use inherit.mode "copy" with this version');
+        }
+        // The branch is the child's durable state and outlives it. Names from an
+        // earlier process may still own a branch of the same name.
+        const taken = new Set(this.store.listBranches().map((branch) => branch.name));
+        let ownBranch = `dendrite/${config.name}`;
+        for (let n = 2; taken.has(ownBranch); n++)
+            ownBranch = `dendrite/${config.name}~${n}`;
+        // The fork's view: what its source sees, and its own stored context
+        // injections. context-manager's derive would give it the source's filter
+        // alone, which is tied to the source's name (isAnotherAgentsInjection), so
+        // the fork's own injections were hidden from its compile while its
+        // parent's showed (#291; Weft's eleventh note, on the real compile path).
+        // The composed predicate goes to derive, so the first compile already
+        // reads through it, and is recorded beside the manager (storeSees), so
+        // main's checks of whether an agent sees a row (agentSees: a tool
+        // boundary's injection, an arrival, a reader of an unread message) ask
+        // what its compile shows. A source with no view recorded has no filter
+        // (an isolated run's): it sees every row, so its fork keeps none, and
+        // sees its own.
+        const sourceSees = this.storeSees.get(source);
+        const sees = sourceSees
+            ? (metadata) => sourceSees(metadata) || isOwnInjection(metadata, config.name)
+            : undefined;
+        const contextManager = await source.derive({
+            branch: ownBranch,
+            strategy: config.strategy ?? new PassthroughStrategy(),
+            // The run's auxiliary membrane, as the copy path's: its compression calls
+            // are withdrawn once the run is released (Weft's ninth-round reading).
+            membrane: this.ephemeralAuxiliaryMembraneFor(config.name, release),
+            solve: inherit.solve ?? 'reuse',
+            inherit: { refusals: inherit.refusals === true },
+            ...(inherit.atSequence !== undefined ? { atSequence: inherit.atSequence } : {}),
+            ...(sees ? { viewFilter: (message) => sees(message.metadata) } : {}),
+            debugLogContext: !!process.env.DEBUG_CONTEXT,
+        });
+        if (sees)
+            this.storeSees.set(contextManager, sees);
+        const derivation = contextManager.getDerivation?.();
+        return {
+            contextManager,
+            inherit: {
+                ...inherit,
+                solve: inherit.solve ?? 'reuse',
+                refusals: inherit.refusals === true,
+                ownBranch,
+                ...(derivation
+                    ? { branch: derivation.parentBranch, atSequence: derivation.atSequence, derivation }
+                    : {}),
+            },
+            namespace: this.registry.get(inherit.from)?.namespace ?? `subagent/${config.name}`,
+        };
+    }
+    // ==========================================================================
+    // Dendrite: agent registry, lifecycle and attributed communication
+    // ==========================================================================
+    //
+    // One trust domain: there is no permission check on any of this. Any
+    // caller may list, cancel, stop or reparent any agent. Context isolation
+    // between agents is not process or filesystem isolation — agents sharing
+    // tools, a shell or a workspace can affect the same external state.
+    /** Flat list of registered agents with their roles, lifetime and relationships. */
+    listAgents(options = {}) {
+        return structuredClone(this.registry.list(options));
+    }
+    /** One agent's record: the live one, else its most recent ended one. */
+    getAgentRecord(name) {
+        const record = this.registry.inspect(name);
+        return record ? structuredClone(record) : null;
+    }
+    /** The agent that owns default delivery, or null before any is declared. */
+    getPrimaryAgentName() {
+        return this.registry.primary();
+    }
+    /**
+     * Activations in flight, each with the agent that owns the work. Derived
+     * from the live turn state, so it cannot disagree with what is running.
+     */
+    listActivations() {
+        const activations = [];
+        for (const [name, token] of this.activeTurnTokens) {
+            const record = this.registry.get(name);
+            if (!record)
+                continue;
+            const trigger = this.activeTurnTriggers.get(name);
+            activations.push({
+                id: `${name}#${record.incarnation}:${token}`,
+                owner: { agent: name, incarnation: record.incarnation },
+                ...(trigger?.timestamp !== undefined ? { requestedAt: trigger.timestamp } : {}),
+                ...(trigger?.reason ? { reason: trigger.reason } : {}),
+                ...(trigger?.source ? { source: trigger.source } : {}),
+                ...(trigger?.channelId ? { channelId: trigger.channelId } : {}),
+            });
+        }
+        return activations;
+    }
+    /**
+     * Policy epochs currently in force (tune-out holds), read from the
+     * coordinator's own durable state — not mirrored. An epoch is neither an
+     * agent nor a task: ending one leaves both running.
+     */
+    listPolicyEpochs() {
+        if (!this.channelRegistry)
+            return [];
+        const owner = this.registry.primary();
+        const epochs = [];
+        for (const entry of this.channelRegistry.listChannelsRaw()) {
+            const state = this.channelRegistry.getTuneOutState(entry.serverId, entry.descriptor.id);
+            if (!state)
+                continue;
+            epochs.push({
+                id: state.params.epochId,
+                kind: 'tune-out',
+                scope: { serverId: entry.serverId, channelId: entry.descriptor.id },
+                ...(owner ? { owner } : {}),
+                ...(this.subconsciousAgentName ? { reader: this.subconsciousAgentName } : {}),
+                startedAtSequence: state.params.startedAtSequence,
+                ...(state.params.expiresAtMs !== undefined ? { expiresAtMs: state.params.expiresAtMs } : {}),
+            });
+        }
+        const scope = this.tuneOutCoordinator?.getAllExcept();
+        if (scope) {
+            epochs.push({
+                id: scope.params.epochId,
+                kind: 'tune-out',
+                scope: { kind: 'all-except', except: scope.params.except },
+                ...(owner ? { owner } : {}),
+                ...(this.subconsciousAgentName ? { reader: this.subconsciousAgentName } : {}),
+                startedAtSequence: scope.params.startedAtSequence,
+                expiresAtMs: scope.params.expiresAtMs,
+            });
+        }
+        return epochs;
+    }
+    /**
+     * Cancel an agent's activation in flight, leaving the agent registered.
+     * For a bounded job, whose lifetime is that one run, this ends the job.
+     * Returns false when nothing was running.
+     */
+    cancelActivation(name, options = {}) {
+        if (!this.registry.has(name))
+            throw new Error(`cancelActivation: "${name}" is not a registered agent`);
+        const run = this.ephemeralRuns.get(name);
+        if (run) {
+            run.endReason ??= 'stopped';
+            run.endedBy ??= options.by;
+            // The awaiting caller is told who stopped the job and why, whether or
+            // not a stream was in flight: settled first, so the aborted stream's own
+            // settle ('Stream cancelled') finds the run already settled. The caller's
+            // teardown runs after this call, as for stopAgent.
+            run.settle.reject(new AgentStoppedError(name, 'stopped', options.by, options.reason));
+        }
+        const cancelled = this.abortInference(name, options.reason ?? 'cancelled');
+        if (cancelled || run) {
+            this.emitTrace({
+                type: 'dendrite:activation-cancelled',
+                agentName: name,
+                ...(options.by ? { by: options.by } : {}),
+                ...(options.reason ? { reason: options.reason } : {}),
+            });
+        }
+        return cancelled || run !== undefined;
+    }
+    /**
+     * End an agent: cancel its run, remove it from the framework, and settle
+     * what it spawned — attention tenants end with it; task work is orphaned,
+     * notified and offered for reparenting, and keeps running.
+     *
+     * The default-delivery owner cannot be stopped (the framework needs
+     * exactly one); cancel its activation instead. A persistent agent stopped
+     * here is declared by configuration and returns at the next boot.
+     */
+    stopAgent(name, options = {}) {
+        const record = this.registry.get(name);
+        if (!record)
+            throw new Error(`stopAgent: "${name}" is not a registered agent`);
+        if (record.roles.defaultDelivery) {
+            throw new Error(`stopAgent: "${name}" owns default delivery and cannot be stopped; use cancelActivation to end its current run`);
+        }
+        const outcome = this.registry.end(name, 'stopped', options.by);
+        this.teardownEndedAgent(outcome.ended, options.reason);
+        this.settleEndedAgent(outcome);
+        return structuredClone(outcome);
+    }
+    /**
+     * Give an agent a new parent. Clears its orphan state; a result route
+     * whose recipient is gone follows the new parent, and the mail it already
+     * produced for the lost recipient, results and messages, is delivered to
+     * the new one.
+     */
+    reparentAgent(name, newParent, options = {}) {
+        // An orphan that finished before it was adopted: its record stays as it
+        // ended, and the mail it held for a recipient that is gone goes to the
+        // new parent.
+        if (!this.registry.has(name) && this.registry.inspect(name)?.ended) {
+            const ended = this.registry.readdressHeldMail(name, newParent);
+            this.emitTrace({
+                type: 'dendrite:agent-reparented',
+                agentName: name,
+                parent: newParent,
+                ...(options.by ? { by: options.by } : {}),
+            });
+            for (const mail of ended.deliverable)
+                this.attemptMailDelivery(mail);
+            return structuredClone(ended.record);
+        }
+        const { record, deliverable } = this.registry.reparent(name, newParent);
+        this.emitTrace({
+            type: 'dendrite:agent-reparented',
+            agentName: name,
+            parent: newParent,
+            ...(options.by ? { by: options.by } : {}),
+        });
+        this.lifecycleNotice(name, `[${NOTICE_TAG.agentLifecycle}: ${newParent} is now your parent` +
+            (record.relationships.resultTo?.to === newParent ? ' and will receive your result' : '') +
+            '.]', { event: 'reparented', parent: newParent });
+        for (const mail of deliverable)
+            this.attemptMailDelivery(mail);
+        return structuredClone(record);
+    }
+    /**
+     * An explicit message from one agent to another: the sender's verbatim
+     * content, in the recipient's context under the SENDER's name, with the
+     * sender's identity and incarnation and the causal chain in metadata.
+     * Never an unmarked insertion into the recipient's own voice.
+     */
+    sendAgentMessage(from, to, content, options = {}) {
+        if (!this.registry.inspect(from))
+            throw new Error(`sendAgentMessage: sender "${from}" is not a known agent`);
+        if (!this.registry.inspect(to))
+            throw new Error(`sendAgentMessage: recipient "${to}" is not a known agent`);
+        this.registry.noteMessagePath(from, to);
+        const mail = this.registry.holdMail({
+            kind: 'message',
+            from: this.registry.ref(from),
+            to,
+            content,
+            ...(options.causedBy?.length ? { causedBy: options.causedBy } : {}),
+        });
+        return { mailId: mail.id, delivered: this.attemptMailDelivery(mail, options.wake ?? true) };
+    }
+    /**
+     * Return a bounded job's result along the agent's declared result route.
+     * The result is recorded durably before delivery is attempted, so it is
+     * neither lost nor delivered twice across a restart; if the recipient is
+     * gone it is held as attributed mail until the agent is reparented.
+     *
+     * May be called after the agent's run has ended — its record stays
+     * inspectable. Refused for a `tool-result` route: there the awaiting
+     * caller already holds the result and delivers it itself.
+     */
+    deliverAgentResult(from, content, options = {}) {
+        const record = this.registry.inspect(from);
+        if (!record)
+            throw new Error(`deliverAgentResult: "${from}" is not a known agent`);
+        const route = record.relationships.resultTo;
+        if (!route)
+            throw new Error(`deliverAgentResult: "${from}" has no result route`);
+        if (route.as !== 'message') {
+            throw new Error(`deliverAgentResult: "${from}" returns its result as a ${route.as}; the caller awaiting the run delivers it`);
+        }
+        const mail = this.registry.holdMail({
+            kind: 'result',
+            from: { agent: from, incarnation: record.incarnation },
+            to: route.to,
+            content,
+            ...(options.causedBy?.length ? { causedBy: options.causedBy } : {}),
+        });
+        // A finished job's output survives a hard exit from here on: the hold is
+        // in the registry's recovery file as it is written (persistAgentRegistry),
+        // and holdMail failed this call if it couldn't be. The release, once the
+        // message has landed, waits for the store's sync (releaseLandedMail).
+        return { mailId: mail.id, delivered: this.attemptMailDelivery(mail), to: route.to };
+    }
+    /** Communications not yet handed to their recipient, and why. */
+    listHeldMail(filter = {}) {
+        return structuredClone(this.registry.listMail(filter));
+    }
+    /**
+     * Try to hand one held item to its recipient. True when the message is in
+     * (or queued for) the recipient's context; false when it stays held
+     * because nobody can receive it. The held copy is released by
+     * `addMessage` at the moment the message enters the store.
+     */
+    attemptMailDelivery(mail, wake = true) {
+        const recipient = this.registry.has(mail.to) ? this.agents.get(mail.to) : undefined;
+        if (!recipient) {
+            const newlyHeld = mail.heldBecause !== 'recipient-gone';
+            this.registry.markMailHeld(mail.id, 'recipient-gone');
+            // A result its sender delivered after it had ended (one delivered while
+            // it ran is told of when it ends, settleEndedAgent).
+            const sender = this.registry.inspect(mail.from.agent);
+            if (newlyHeld && mail.kind === 'result' && sender?.ended)
+                this.tellResultHeld(sender, mail.id);
+            this.emitTrace({
+                type: 'dendrite:mail-held',
+                mailId: mail.id,
+                kind: mail.kind,
+                from: mail.from.agent,
+                to: mail.to,
+                reason: 'recipient-gone',
+            });
+            return false;
+        }
+        const placement = {};
+        this.addMessage(
+        // The sender's own name: its words stay its own.
+        recipient.isOwnParticipant(mail.from.agent) && mail.from.agent !== recipient.name
+            ? `${mail.from.agent} (mail)`
+            : mail.from.agent, mail.content, {
+            kind: `agent-${mail.kind}`,
+            dendrite: {
+                mailId: mail.id,
+                kind: mail.kind,
+                from: mail.from,
+                // When the sender produced it — distinct from when it is read. A
+                // result held across a restart arrives later than it was made,
+                // and the reader should be able to tell.
+                producedAt: mail.createdAt,
+                ...(mail.causedBy?.length ? { causedBy: mail.causedBy } : {}),
+            },
+        }, { forAgent: mail.to, placement });
+        if (!placement.messageId) {
+            // Queued for the recipient's next boundary. `mail-delivered` fires
+            // when the message actually enters its store (releaseLandedMail):
+            // published is not delivered.
+            this.emitTrace({
+                type: 'dendrite:mail-deferred',
+                mailId: mail.id,
+                kind: mail.kind,
+                from: mail.from.agent,
+                to: mail.to,
+            });
+        }
+        if (wake) {
+            this.pendingRequests.push({
+                agentName: mail.to,
+                reason: `agent-${mail.kind}:${mail.from.agent}`,
+                source: 'dendrite',
+                timestamp: Date.now(),
+            });
+        }
+        return true;
+    }
+    /**
+     * An ended orphan's result held for a recipient that is gone: its first
+     * adoption candidate is told it exists and how it arrives, since nothing
+     * else would surface it (reparentAgent delivers it).
+     */
+    tellResultHeld(sender, mailId) {
+        const candidate = sender.orphaned?.candidates[0];
+        if (!candidate || !this.announceOrphans)
+            return;
+        this.lifecycleNotice(candidate, `[${NOTICE_TAG.agentLifecycle}: "${sender.name}" has ended after ${sender.orphaned.formerParent.agent} did, ` +
+            `so its result has nowhere to go. The result is held; reparenting "${sender.name}" to you delivers it.]`, 
+        // `heldMailId`, not `mailId`: a row carrying dendrite.mailId is read
+        // as that mail having landed, which would release it.
+        { event: 'result-held', agent: sender.name, heldMailId: mailId, formerParent: sender.orphaned.formerParent });
+    }
+    /** A host-framed lifecycle fact in an agent's context. Never voiced as anyone. */
+    lifecycleNotice(agentName, text, detail) {
+        if (!this.agents.has(agentName))
+            return;
+        this.addMessage('user', [{ type: 'text', text }], { system: true, kind: 'agent-lifecycle', dendrite: detail }, { forAgent: agentName });
+    }
+    /**
+     * The creation ("consent") event: names what kind of agent this is, what
+     * ends it and what happens to it when its spawner ends. A derived agent's
+     * creation is also told to the agent it was derived from (#270, Linn:
+     * "told when the body changes" as a property, not a courtesy): one
+     * host-framed line in the source's context, built from the same facts as
+     * the trace, with no wake; a host's derivationNotice can replace the line
+     * or send none. Both derivation paths announce after the
+     * fork's branch or copy exists, so a fork never inherits the notice about
+     * itself; a source that has ended is told nothing (lifecycleNotice).
+     */
+    announceAgentCreated(record) {
+        this.emitTrace({
+            type: 'dendrite:agent-created',
+            agentName: record.name,
+            kind: record.kind,
+            ...(record.model ? { model: record.model } : {}),
+            incarnation: record.incarnation,
+            lifetime: record.lifetime,
+            ...(record.relationships.spawnedBy
+                ? { spawnedBy: record.relationships.spawnedBy, onParentEnd: record.onParentEnd }
+                : {}),
+            ...(record.relationships.resultTo ? { resultTo: record.relationships.resultTo } : {}),
+            ...(record.inherit ? { inherit: record.inherit } : {}),
+        });
+        const from = record.inherit?.from;
+        if (!from || from === record.name)
+            return;
+        const detail = {
+            event: 'derived',
+            agent: record.name,
+            kind: record.kind,
+            incarnation: record.incarnation,
+            ...(record.model ? { model: record.model } : {}),
+            inherit: record.inherit,
+            ...(record.relationships.resultTo ? { resultTo: record.relationships.resultTo } : {}),
+            lifetime: record.lifetime,
+        };
+        // A resumption is rare and always said. A first incarnation is tallied:
+        // past the threshold, a reader loop that forks a hundred times a session
+        // would fill its source's context with stamps (Linn, 2026-10-15), so
+        // the source hears a count line every `threshold` forks instead, with
+        // the latest described; every derivation still emits its trace.
+        const threshold = this.collapseDerivationNoticesAfter;
+        const tell = (defaultText, extra = {}) => {
+            try {
+                const text = this.derivationNoticeHook ? this.derivationNoticeHook(record, from, defaultText) : defaultText;
+                if (text !== null)
+                    this.lifecycleNotice(from, text, { ...detail, ...extra });
+            }
+            catch (error) {
+                console.error(`[dendrite] ${record.name} was created, but ${from} could not be told:`, error);
+            }
+        };
+        if (record.incarnation > 1 || threshold <= 0) {
+            tell(this.derivationNotice(record, from));
+            return;
+        }
+        let byKind = this.derivationTallies.get(from);
+        if (!byKind)
+            this.derivationTallies.set(from, (byKind = new Map()));
+        let tally = byKind.get(record.kind);
+        if (!tally)
+            byKind.set(record.kind, (tally = { count: 0, since: Date.now() }));
+        tally.count++;
+        if (tally.count <= threshold) {
+            tell(this.derivationNotice(record, from));
+        }
+        else if ((tally.count - threshold) % threshold === 0) {
+            const since = new Date(tally.since).toISOString().slice(11, 16) + ' UTC';
+            tell(`[${NOTICE_TAG.agentLifecycle}: ${tally.count} ${record.kind}s have been derived from you since ${since} ` +
+                `(${threshold} since the last note); the latest, ${record.name}, is ${this.derivationDescription(record, from)}.]`, { collapsed: { count: tally.count, sinceLastNote: threshold } });
+        }
+    }
+    /** The derivation notice's text, addressed to the agent `from` the record was derived. */
+    derivationNotice(record, from) {
+        const made = record.incarnation > 1
+            ? `was resumed (incarnation ${record.incarnation}) as`
+            : 'was derived from you as';
+        return `[${NOTICE_TAG.agentLifecycle}: ${record.name} ${made} ${this.derivationDescription(record, from)}.]`;
+    }
+    /** What a derived agent is, to the agent it was derived from: "a task-fork on your weights, …; …; …". */
+    derivationDescription(record, from) {
+        const sourceModel = this.agentConfigs.get(from)?.model ?? this.registry.get(from)?.model;
+        const weights = !record.model
+            ? ''
+            : record.model === sourceModel
+                ? ` on your weights (${record.model})`
+                : ` on ${record.model}`;
+        const inherited = record.inherit?.mode === 'shared'
+            ? 'reading your context up to this point'
+            : 'with a copy of your context';
+        const route = record.relationships.resultTo;
+        const home = this.channelOfHome(record.homeChannel);
+        const result = !route
+            ? home
+                ? `it speaks for itself in ${this.channelShown(home)}`
+                : 'it returns nothing to you'
+            : route.to === from
+                ? `its result returns to you as ${route.as === 'message' ? 'a message' : 'a tool result'}`
+                : `its result goes to ${route.to}`;
+        const lifetime = record.lifetime;
+        const minutes = (ms) => (ms < 60_000 ? `${Math.round(ms / 1_000)} s` : `${Math.round(ms / 60_000)} min`);
+        const ends = lifetime.kind === 'task'
+            ? 'it ends when its task does' +
+                (lifetime.deadlineMs !== undefined || lifetime.idleTimeoutMs !== undefined
+                    ? ` (${[
+                        lifetime.deadlineMs !== undefined ? `deadline ${minutes(lifetime.deadlineMs)}` : '',
+                        lifetime.idleTimeoutMs !== undefined ? `idle ${minutes(lifetime.idleTimeoutMs)}` : '',
+                    ].filter(Boolean).join(', ')})`
+                    : '')
+            : lifetime.kind === 'idle'
+                ? `it ends after ${minutes(lifetime.idleTtlMs)} idle`
+                : 'it persists';
+        const parentEnd = record.relationships.spawnedBy === from
+            ? record.onParentEnd === 'end' ? ', and ends with you' : ', and is orphaned if you end'
+            : '';
+        return `a ${record.kind}${weights}, ${inherited}; ${result}; ${ends}${parentEnd}`;
+    }
+    /**
+     * Remove an ended agent's live object from the framework. A bounded run
+     * is ended through its awaiting caller (whose teardown owns the
+     * name-keyed state); any other agent is torn down here.
+     */
+    teardownEndedAgent(record, detail) {
+        const name = record.name;
+        const reason = record.ended?.reason ?? 'stopped';
+        const run = this.ephemeralRuns.get(name);
+        if (run) {
+            run.endReason = reason;
+            run.endedBy = record.ended?.by;
+            run.settle.reject(new AgentStoppedError(name, reason, record.ended?.by, detail));
+            return;
+        }
+        const agent = this.agents.get(name);
+        if (!agent)
+            return;
+        this.releaseAgentRuntime(agent, this.channelOfHome(record.homeChannel), undefined, record.lifetime.kind === 'persistent');
+    }
+    /**
+     * Everything the process holds for a live, non-ephemeral agent that has
+     * ended, released once, on every path an agent ends by — stopAgent, the
+     * idle reap of a conversation fork, an end that cascades from a parent's
+     * (nissa's #546 finding 5: a stop that skipped the window release dropped a
+     * write queued for the agent at the next flush, and a failure notice it
+     * never read reached no one). The window release delivers what the agent
+     * never read to the primary, now or after a resume, as the idle reap did.
+     */
+    releaseAgentRuntime(agent, home, why = 'its agent ended', declared = false) {
+        const name = agent.name;
+        if (home && this.conversationRouter?.getBinding(home)?.agentName === name) {
+            this.conversationRouter.unbind(home);
+        }
+        this.closingConversationAgents.delete(name);
+        // A continuation of its turn still on its way goes with it.
+        this.dropContinuations(name, { kind: 'dropped', why });
+        // A batch its guard still holds is settled as `aborted`: the stream's
+        // own finally does neither once the agent has gone.
+        if (agent.toolResultGuard.hasPending) {
+            try {
+                agent.toolResultGuard.abandon('aborted');
+            }
+            catch (error) {
+                console.error(`[tool-result-guard] agent=${name} failed to record a batch the fork left:`, error);
+            }
+        }
+        // Cancel before deregistration: a late stream event is discarded by
+        // driveStream's Agent-identity check once the name no longer maps to it.
+        if (this.activeStreams.has(name)) {
+            try {
+                agent.cancelStream();
+            }
+            catch (error) {
+                console.error(`[dendrite] agent=${name} its stream's cancel failed as it ended; it is released all the same:`, error);
+            }
+        }
+        this.activeStreams.delete(name);
+        this.pendingAssistantBlocks.delete(name);
+        this.eventGate?.onInferenceEnded(name);
+        // Its sleep and self-wake end with it (the gate's sleep holds back every
+        // agent's wakes), and neither wake goes to a name that's gone.
+        this.eventGate?.agentGone(name);
+        this.agents.delete(name);
+        this.agentConfigs.delete(name);
+        this.thinkingLossIncidents.forget(name);
+        this.reasoningLoss.forget(name);
+        // main's manager release: the context manager an ephemeral run or a fork
+        // opened is released with the agent (releaseManager).
+        this.releaseManager(agent);
+        this.toolImageLedgers.delete(name);
+        this.evictTurnCheckpoints(name);
+        this.activeTurnTokens.delete(name);
+        this.activeTurnTriggers.delete(name);
+        this.logicalTurnToolCalls.delete(agent);
+        this.pendingRequests = this.pendingRequests.filter((request) => request.agentName !== name);
+        this.releaseWindowNowOrAfterResume(agent);
+        this.turnRouting.delete(name);
+        this.proseSpeechChains.delete(name);
+        this.openLogical.delete(name);
+        // What it was last told of where its speech goes goes with it, kept
+        // only for an agent declared by configuration, which comes back under
+        // its name at the next boot: so the stored baselines are those of
+        // agents that are live or come back.
+        if (!declared)
+            this.forgetAnnouncedLocus(name);
+        // Its scripts go with it, and leave the map once they've ended: no later
+        // run of the name trims them.
+        this.codeExecution?.scripts.agentGone(name);
+        // A provider-wait hold (nonOwningProviderWait) goes with the agent: left,
+        // its timer would requeue held wakes for an agent that is gone, and a wait
+        // held until released would re-arm for the name indefinitely. The recorded
+        // wait stays, and binds the name if its channel binds again.
+        const cooldown = this.providerAccelerationCooldowns.get(name);
+        if (cooldown) {
+            clearTimeout(cooldown.timer);
+            this.providerAccelerationCooldowns.delete(name);
+            console.error(`[provider-wait] agent=${name} ended while held` +
+                `${cooldown.waitModel !== undefined ? ` on ${cooldown.waitModel}` : ''}: ` +
+                `${cooldown.heldRequests.length} held request(s) dropped with it (the recorded wait stays)`);
+        }
+        // main's per-name turn state goes too (#846's re-arm count and run of
+        // stated waits, #840's exhausted turn), so a name bound again (a
+        // channel's next conversation, a resume) starts afresh; a run of stated
+        // waits ends here as at a turn's end, alerted if it ran long
+        // (endStatedWaitRun).
+        this.turnRearms.delete(name);
+        this.exhaustingRearms.delete(name);
+        this.exhaustedTurns.delete(name);
+        this.endStatedWaitRun(name);
+        if (name === this.subconsciousAgentName) {
+            this.tuneOutCoordinator?.stopReader();
+            this.subconsciousAgentName = null;
+        }
+    }
+    /**
+     * Carry out what the registry decided when an agent ended: tear down the
+     * attention tenants that end with it, and tell each orphan — and the
+     * first agent that could adopt it — what happened.
+     */
+    settleEndedAgent(outcome) {
+        if (!outcome)
+            return;
+        for (const record of [...outcome.cascaded, outcome.ended]) {
+            this.emitTrace({
+                type: 'dendrite:agent-ended',
+                agentName: record.name,
+                kind: record.kind,
+                incarnation: record.incarnation,
+                reason: record.ended?.reason ?? 'stopped',
+                ...(record.ended?.by ? { by: record.ended.by } : {}),
+                ...(record.relationships.spawnedBy ? { spawnedBy: record.relationships.spawnedBy } : {}),
+            });
+        }
+        for (const record of outcome.cascaded)
+            this.teardownEndedAgent(record);
+        // An orphan that ends with a result it delivered while it ran still held
+        // for a recipient that is gone: its first candidate hears of it now.
+        for (const record of [...outcome.cascaded, outcome.ended]) {
+            if (!record.orphaned)
+                continue;
+            const held = this.registry.listMail({ from: record.name })
+                .find((mail) => mail.kind === 'result' && mail.heldBecause === 'recipient-gone');
+            if (held)
+                this.tellResultHeld(record, held.id);
+        }
+        const parent = outcome.ended;
+        for (const { record, candidates } of outcome.orphaned) {
+            this.announceOrphaned(record, candidates, record.orphaned?.formerParent.agent ?? parent.name, record.orphaned?.reason ?? parent.ended?.reason ?? 'stopped');
+        }
+    }
+    /** An agent whose spawner has ended, and its first adoption candidate, are told; the trace says so. */
+    announceOrphaned(record, candidates, former, reason) {
+        this.emitTrace({
+            type: 'dendrite:agent-orphaned',
+            agentName: record.name,
+            formerParent: former,
+            reason,
+            candidates,
+        });
+        const route = record.relationships.resultTo;
+        const resultHeld = route?.as === 'message' && !this.registry.has(route.to);
+        this.lifecycleNotice(record.name, `[${NOTICE_TAG.agentLifecycle}: ${former}, the agent that started you, has ended (${reason}). ` +
+            'Your own work is not cancelled.' +
+            (resultHeld ? ' Your result will be held until another agent becomes its recipient.' : '') +
+            ']', { event: 'orphaned', formerParent: record.orphaned?.formerParent, reason, candidates });
+        const candidate = candidates[0];
+        if (candidate && this.announceOrphans) {
+            this.lifecycleNotice(candidate, `[${NOTICE_TAG.agentLifecycle}: ${former} has ended (${reason}) while its ${record.kind} agent ` +
+                `"${record.name}" was still running. "${record.name}" now has no parent` +
+                (resultHeld ? ' and nowhere to return its result' : '') +
+                '; it can be reparented to you.]', { event: 'adoption-offered', agent: record.name, formerParent: record.orphaned?.formerParent, reason });
+        }
+    }
+    /** The registry's snapshot: the recovery file first (atomic, fsynced; it
+     *  wins at the next boot), then the branch-local state, kept for inspection
+     *  and for stores read by older code. Either write failing fails the call
+     *  that changed the registry (nissa's #546 finding 2): a change that isn't
+     *  durable isn't a success. */
+    persistAgentRegistry(snapshot) {
+        if (this.agentRegistryPath)
+            this.writeRecoveryFile(this.agentRegistryPath, snapshot);
+        this.store.setStateJson(AGENT_REGISTRY_STATE_ID, snapshot);
+    }
+    /** An ended record: appended to the branch-local log, and the recovery
+     *  file rewritten with the newest records (as many as a restart reads). */
+    appendEndedAgentRecord(record) {
+        this.rewriteEndedRecovery([...this.endedRecovery, record]);
+        this.store.appendToStateJson(AGENT_REGISTRY_ENDED_ID, record);
+    }
+    /**
+     * A requested change was put back in the registry's memory: the recovery
+     * files, each written before the branch-local store, are rewritten from it
+     * (the snapshot's and the ended log's), so neither keeps the change the
+     * caller was told failed. The branch-local snapshot needs no rewrite: it is
+     * the last write a change makes, so a change that failed never reached it.
+     * The branch-local ended log is append-only, so an end appended before the
+     * failure stays there. It is read at boot only where no ended recovery
+     * file exists (or the rewrite of that file failed too); the restore then
+     * drops a bounded agent it lists as ended for the reason recorded, with no
+     * restart notice to its recipient, while a persistent agent waits to be
+     * re-declared as it would anyway. A rewrite that fails is reported, the
+     * next is still made, and the caller's own error goes on.
+     */
+    rewriteAgentRegistryAfterRollback() {
+        const rewrites = [
+            ['the ended log recovery file', 'the next end written', () => this.rewriteEndedRecovery(this.registry.endedHistory())],
+            ...(this.agentRegistryPath
+                ? [['the registry recovery file', 'the next registry write', () => this.writeRecoveryFile(this.agentRegistryPath, this.registry.snapshot())]]
+                : []),
+        ];
+        for (const [what, next, rewrite] of rewrites) {
+            try {
+                rewrite();
+            }
+            catch (error) {
+                console.error(`[dendrite] after a registry change failed and was put back in memory, ${what} could not be rewritten to match; ${next} rewrites it:`, error);
+            }
+        }
+    }
+    /**
+     * An ended record past the registry's memory, from the branch-local ended
+     * log. A scan of the whole log takes tens of milliseconds at a few thousand
+     * ends, and a name nobody used (a tool call's typo) is a miss, so the log is
+     * indexed by name once, at the first lookup, and each later lookup indexes
+     * only what was appended since. A log that changed under the index (a
+     * branch switch) is indexed again: one that shrank, one whose last indexed
+     * entry is no longer the one indexed, or one whose entry no longer carries
+     * the name indexed for it.
+     */
+    findEndedAgentRecord(name) {
+        return this.findInEndedLog('name', name);
+    }
+    /**
+     * The ended log's latest record whose own context a namespace holds. A
+     * shared fork's record names its parent's namespace, where it owns only a
+     * branch, so it is indexed by name alone.
+     */
+    findInEndedLog(by, value) {
+        const byKey = by === 'name' ? this.endedLogIndex : this.endedLogNamespaceIndex;
+        const reset = () => {
+            this.endedLogIndex.clear();
+            this.endedLogNamespaceIndex.clear();
+            this.endedLogIndexed = 0;
+        };
+        const read = (index) => this.store.getStateItemJson(AGENT_REGISTRY_ENDED_ID, index);
+        const mark = (record) => (record ? `${record.name}#${record.incarnation}@${record.ended?.at}` : '');
+        // A store that can't be read fails the lookup rather than answering
+        // "never ended", which would let a namespace check pass.
+        const length = this.store.getStateLen(AGENT_REGISTRY_ENDED_ID) ?? 0;
+        for (let attempt = 0; attempt < 2; attempt++) {
+            if (length < this.endedLogIndexed
+                || (this.endedLogIndexed > 0 && mark(read(this.endedLogIndexed - 1)) !== this.endedLogTail)) {
+                reset();
+            }
+            for (let index = this.endedLogIndexed; index < length; index++) {
+                const record = read(index);
+                if (!record?.ended || typeof record.name !== 'string')
+                    continue;
+                this.endedLogIndex.set(record.name, index);
+                if (typeof record.namespace === 'string' && record.inherit?.mode !== 'shared') {
+                    this.endedLogNamespaceIndex.set(record.namespace, index);
+                }
+            }
+            this.endedLogIndexed = length;
+            this.endedLogTail = length > 0 ? mark(read(length - 1)) : '';
+            const at = byKey.get(value);
+            if (at === undefined)
+                return undefined;
+            const record = read(at);
+            if (record?.ended && record[by] === value)
+                return record;
+            reset();
+        }
+        return undefined;
+    }
+    /** Another agent whose context a namespace holds: opened in this process, in the registry, or in the ended log. */
+    namespaceHolder(namespace, except) {
+        const opened = this.namespaceOwners.get(namespace);
+        if (opened !== undefined && opened !== except)
+            return opened;
+        const held = this.registry.namespaceHolder(namespace, except);
+        if (held)
+            return held;
+        const ended = this.findInEndedLog('namespace', namespace);
+        return ended && ended.name !== except ? ended.name : undefined;
+    }
+    /** The ended log's recovery file, rewritten as the newest records (as many as a restart reads). */
+    rewriteEndedRecovery(ended) {
+        this.endedRecovery = ended.slice(-AGENT_REGISTRY_ENDED_RELOAD);
+        if (this.agentRegistryEndedPath)
+            this.writeRecoveryFile(this.agentRegistryEndedPath, { version: 1, ended: this.endedRecovery });
+    }
+    /**
+     * Load the previous process's registry. Returns the bounded work it
+     * interrupted. A registry that can't be read, or that reads as anything
+     * but a version-1 registry, refuses the start and names the state (nissa's
+     * #546 finding 1, main's rule for the framework's own state): taken as
+     * empty, the results it holds for delivery and the records of the work it
+     * ran would be overwritten by this boot's first registration.
+     */
+    restoreAgentRegistry() {
+        const refuse = (what, problem, cause) => new Error(`the agent registry (${what}) ${problem}. The framework doesn't start without it: taken as empty, the results ` +
+            'it holds for delivery and the records of the work it ran would be overwritten at this boot. ' +
+            (cause === undefined
+                ? "It's unchanged, and the framework starts once it holds a version-1 registry, such as " +
+                    '{"version":1,"records":[],"mail":[],"incarnations":{}} for an empty one.'
+                : "It's unchanged, and the framework starts once it can be read."), cause === undefined ? undefined : { cause });
+        let snapshot;
+        let snapshotFrom = this.agentRegistryPath ?? AGENT_REGISTRY_STATE_ID;
+        // Only a registry that was never written is absent: a recovery file that
+        // exists is the registry, whatever it holds, so one that reads as `null`
+        // is refused like any other that isn't a version-1 registry.
+        let absent = false;
+        try {
+            snapshot = this.agentRegistryPath ? this.readRecoveryFile(this.agentRegistryPath) : undefined;
+            if (snapshot === undefined) {
+                snapshotFrom = AGENT_REGISTRY_STATE_ID;
+                snapshot = this.store.getStateJson(AGENT_REGISTRY_STATE_ID) ?? null;
+                absent = snapshot === null;
+            }
+        }
+        catch (error) {
+            throw refuse(snapshotFrom, "can't be read", error);
+        }
+        if (!absent && (snapshot === null || typeof snapshot !== 'object' || snapshot.version !== 1)) {
+            const read = snapshot === null ? 'null' : `version ${JSON.stringify(snapshot.version)}`;
+            throw refuse(snapshotFrom, `reads as something other than a version-1 registry (${read})`);
+        }
+        if (!absent) {
+            const { records, mail, incarnations } = snapshot;
+            if (!Array.isArray(records) || !Array.isArray(mail)) {
+                throw refuse(snapshotFrom, 'reads as a version-1 registry whose records or mail are not lists');
+            }
+            if (incarnations === null || typeof incarnations !== 'object' || Array.isArray(incarnations)) {
+                throw refuse(snapshotFrom, 'reads as a version-1 registry with no map of incarnations, without which every agent it names would start again at incarnation 1');
+            }
+        }
+        let ended;
+        let endedFrom = this.agentRegistryEndedPath ?? AGENT_REGISTRY_ENDED_ID;
+        try {
+            const file = this.agentRegistryEndedPath ? this.readRecoveryFile(this.agentRegistryEndedPath) : undefined;
+            if (file !== undefined) {
+                ended = file?.ended;
+            }
+            else {
+                endedFrom = AGENT_REGISTRY_ENDED_ID;
+                const tail = this.store.getStateTail(AGENT_REGISTRY_ENDED_ID, AGENT_REGISTRY_ENDED_RELOAD);
+                ended = tail ? JSON.parse(tail.toString('utf8')) : [];
+            }
+        }
+        catch (error) {
+            throw refuse(endedFrom, "has an ended log that can't be read", error);
+        }
+        if (!Array.isArray(ended))
+            throw refuse(endedFrom, 'has an ended log that reads as something other than a list of records');
+        this.endedRecovery = ended.slice(-AGENT_REGISTRY_ENDED_RELOAD);
+        return this.registry.restore(snapshot, ended).interrupted;
+    }
+    /**
+     * Boot reconciliation, once configuration has declared its agents.
+     * Restart behaviour follows from lifetime: persistent agents were just
+     * re-created; everything else that was live was interrupted, and the
+     * recipient of an interrupted job's result is told so. Results held from
+     * before the restart are delivered now, exactly once.
+     */
+    reconcileAgentRegistry(interrupted) {
+        for (const outcome of this.registry.reconcile().unconfigured)
+            this.settleEndedAgent(outcome);
+        const byRecipient = new Map();
+        for (const record of interrupted) {
+            this.emitTrace({
+                type: 'dendrite:agent-ended',
+                agentName: record.name,
+                kind: record.kind,
+                incarnation: record.incarnation,
+                reason: 'host-restart',
+                ...(record.relationships.spawnedBy ? { spawnedBy: record.relationships.spawnedBy } : {}),
+            });
+            const route = record.relationships.resultTo;
+            if (route?.as !== 'message' || !this.agents.has(route.to))
+                continue;
+            // A result it had already handed over needs no apology.
+            if (this.registry.listMail({ from: record.name }).some((mail) => mail.kind === 'result'))
+                continue;
+            byRecipient.set(route.to, [...(byRecipient.get(route.to) ?? []), record]);
+        }
+        for (const [recipient, all] of byRecipient) {
+            // The interrupted records stay in the snapshot until this notice is
+            // durable and their ends are written (settleInterrupted below), so a
+            // crash after it landed, or an end whose write failed, comes here
+            // again: a record an earlier interrupted notice to this recipient names
+            // (its key lists each name, incarnation and creation time, since a
+            // single-use name that aged out of memory starts again at incarnation
+            // 1), in the recipient's store or the restored deferred queue, has been
+            // told, however many of that notice's records have ended since.
+            const toldKeys = new Set();
+            const noteTold = (metadata) => {
+                const key = metadata?.dendrite?.noticeKey;
+                if (typeof key === 'string')
+                    for (const one of key.split(','))
+                        toldKeys.add(one);
+            };
+            for (const message of this.agents.get(recipient).getContextManager()
+                .queryMessages({ metadata: { 'dendrite.event': 'interrupted' } }).messages)
+                noteTold(message.metadata);
+            for (const message of this.deferredMessages)
+                noteTold(message.metadata);
+            const keyOf = (record) => `${record.name}#${record.incarnation}@${record.createdAt}`;
+            const records = all.filter((record) => !toldKeys.has(keyOf(record)));
+            if (records.length === 0)
+                continue;
+            const noticeKey = records.map(keyOf).sort().join(',');
+            const names = records.map((record) => `"${record.name}"`).join(', ');
+            this.lifecycleNotice(recipient, `[${NOTICE_TAG.agentLifecycle}: the host restarted while ${names} ${records.length === 1 ? 'was' : 'were'} ` +
+                `still working for you. ${records.length === 1 ? 'It was' : 'They were'} ended without a result.]`, { event: 'interrupted', agents: records.map((record) => record.name), reason: 'host-restart', noticeKey });
+            this.pendingRequests.push({
+                agentName: recipient,
+                reason: 'agent-interrupted',
+                source: 'dendrite',
+                timestamp: Date.now(),
+            });
+        }
+        // The notices are durable once the store has synced (a quiesced host's
+        // are in the deferred queue's recovery file already); only then are the
+        // interrupted records' ends written and the snapshot let go of them.
+        if (interrupted.length > 0) {
+            try {
+                this.store.sync();
+                this.registry.settleInterrupted();
+            }
+            catch (error) {
+                console.error('[dendrite] the restart notices could not be synced; the interrupted records stay in the registry, and the next boot tells their recipients again unless the notice is found:', error);
+            }
+        }
+        for (const mail of this.registry.listMail())
+            this.deliverHeldMail(mail);
+    }
+    /**
+     * Deliver held mail that hasn't landed. Its copy may have reached the
+     * recipient's store in the same sync that the release missed, and then it
+     * is released instead; and a write the deferred queue still holds for it
+     * lands at the next flush and releases it then (releaseLandedMail). Either
+     * way a second delivery would put it in the window twice under one mail id.
+     */
+    deliverHeldMail(mail, wake = true) {
+        const recipient = this.agents.get(mail.to);
+        if (recipient) {
+            const already = recipient.getContextManager().queryMessages({ metadata: { 'dendrite.mailId': mail.id } });
+            if (already.messages.length > 0) {
+                this.registry.releaseMail(mail.id);
+                return;
+            }
+        }
+        const queued = this.deferredMessages.some((m) => m.metadata?.dendrite?.mailId === mail.id);
+        if (queued)
+            return;
+        this.attemptMailDelivery(mail, wake);
     }
     createDeferred() {
         let resolve;
@@ -9037,7 +10699,8 @@ export class AgentFramework {
         // Only a fresh object returned by createEphemeralAgent may enter this path.
         // Never overwrite a resident/conversation owner or a concurrent run: their
         // cleanup is name-keyed and could cancel/deregister the legitimate owner.
-        if (this.ephemeralCandidates.get(agent) !== contextManager) {
+        const candidate = this.ephemeralCandidates.get(agent);
+        if (!candidate || candidate.contextManager !== contextManager) {
             throw new Error(`Ephemeral agent "${agent.name}" has no fresh generation ticket from this framework`);
         }
         // A live surgery holds the whole store: an agent admitted now would
@@ -9050,11 +10713,29 @@ export class AgentFramework {
         // Consume before any await/registration: the exact (Agent, ContextManager)
         // generation is one-shot even if startup later fails.
         this.ephemeralCandidates.delete(agent);
+        if (candidate.resume && this.resumesPending.get(agent.name) === agent)
+            this.resumesPending.delete(agent.name);
         if (this.agents.has(agent.name) || this.ephemeralRuns.has(agent.name)) {
             throw new Error(`Ephemeral agent "${agent.name}" is already registered or running`);
         }
+        // Admit it to the registry first: a spec the registry refuses (spawner
+        // or result recipient gone since creation) must not leave a live agent.
+        const registered = this.registry.register(candidate.spec, { resume: candidate.resume === true, after: candidate.after });
+        this.announceAgentCreated(registered);
         // Register temporarily so the event loop can drive it
         this.agents.set(agent.name, agent);
+        // Kept while the run is live so the agent can itself be derived from.
+        this.agentConfigs.set(agent.name, candidate.config);
+        // A spawner that ended after creating it: it registered as that
+        // spawner's orphan, and is told so, as is its first candidate.
+        if (registered.orphaned) {
+            this.announceOrphaned(registered, registered.orphaned.candidates, registered.orphaned.formerParent.agent, registered.orphaned.reason);
+        }
+        // Mail held for this name (a resumed incarnation's, sent while it was
+        // ended) reaches it now rather than at the next boot. Its run is
+        // starting, so it wakes nothing.
+        for (const mail of this.registry.listMail({ to: agent.name }))
+            this.deliverHeldMail(mail, false);
         const run = {
             settle: this.createDeferred(),
             inferenceStarted: false,
@@ -9062,14 +10743,39 @@ export class AgentFramework {
             toolCallsCount: 0,
         };
         this.ephemeralRuns.set(agent.name, run);
+        const lifetime = candidate.spec.lifetime;
         const STARTUP_TIMEOUT_MS = watchdogs?.startupTimeoutMs ?? 30_000;
         // After inference has started, give it 15 minutes of activity-bounded
         // life. The stream driver refreshes the deadline as it makes progress;
-        // sustained silence trips it.
-        const COMPLETION_IDLE_TIMEOUT_MS = watchdogs?.idleTimeoutMs ?? 15 * 60_000;
+        // sustained silence trips it. An explicit watchdog wins; otherwise the
+        // spec's task lifetime is the bound.
+        const COMPLETION_IDLE_TIMEOUT_MS = watchdogs?.idleTimeoutMs
+            ?? (lifetime.kind === 'task' ? lifetime.idleTimeoutMs : undefined)
+            ?? 15 * 60_000;
         const IDLE_POLL_MS = watchdogs?.idlePollMs ?? 30_000;
         let startupWatchdog = null;
         let completionWatchdog = null;
+        let deadlineWatchdog = null;
+        // A task lifetime's wall-clock deadline: the identity must end, however
+        // lively its stream is.
+        // A timer holds at most MAX_TIMER_MS, so a longer deadline waits in
+        // steps, each re-armed until the deadline is due.
+        const deadline = new Promise((_, reject) => {
+            if (lifetime.kind !== 'task' || lifetime.deadlineMs === undefined)
+                return;
+            const deadlineMs = lifetime.deadlineMs;
+            const dueAt = Date.now() + deadlineMs;
+            const arm = () => {
+                deadlineWatchdog = setTimeout(() => {
+                    if (Date.now() < dueAt)
+                        return arm();
+                    run.endReason = 'deadline';
+                    reject(new AgentStoppedError(agent.name, 'deadline', undefined, `${deadlineMs}ms elapsed`));
+                }, Math.max(0, Math.min(dueAt - Date.now(), MAX_TIMER_MS)));
+                deadlineWatchdog.unref?.();
+            };
+            arm();
+        });
         // Whether the completion watchdog ended the run as stalled, for a
         // tool-result batch the run leaves behind (see the finally).
         let stalled = false;
@@ -9115,7 +10821,9 @@ export class AgentFramework {
                 run.settle.promise,
                 startupTimeout,
                 completionIdleTimeout,
+                deadline,
             ]);
+            run.endReason ??= 'completed';
             return { speech: result.speech, toolCallsCount: result.toolCallsCount };
         }
         finally {
@@ -9123,6 +10831,8 @@ export class AgentFramework {
                 clearTimeout(startupWatchdog);
             if (completionWatchdog)
                 clearInterval(completionWatchdog);
+            if (deadlineWatchdog)
+                clearTimeout(deadlineWatchdog);
             // A batch still pending here has nothing left to settle it: once the
             // run is deregistered, driveStream's finally abandons nothing (it does
             // only while the agent is registered), and no later turn comes. The
@@ -9182,6 +10892,7 @@ export class AgentFramework {
                 this.turnRouting.delete(agent.name);
                 this.proseSpeechChains.delete(agent.name);
                 this.openLogical.delete(agent.name);
+                this.forgetAnnouncedLocus(agent.name);
                 // The late stream finalizer intentionally refuses name-keyed cleanup once
                 // deregistered, so disposal must release EventGate liveness itself.
                 this.eventGate?.onInferenceEnded(agent.name);
@@ -9193,6 +10904,9 @@ export class AgentFramework {
                 this.releaseWindowNowOrAfterResume(agent);
             }
             this.toolImageLedgers.delete(agent.name);
+            if (this.agentConfigs.get(agent.name) === candidate.config)
+                this.agentConfigs.delete(agent.name);
+            this.toolSurfaceOwners.delete(agent.name);
             // Its scripts end with it: no turn of its is left for them to outlive.
             this.codeExecution?.scripts.agentGone(agent.name);
             // Spawn-and-dispose bookkeeping (main, d453165/fee96a7): without this,
@@ -9210,6 +10924,22 @@ export class AgentFramework {
             // A continuation of its turn still on its way goes too: the run, and
             // with it the turn, has ended above.
             this.dropContinuations(agent.name, null);
+            if (run.endReason === 'host-stop') {
+                // Cut off by stop(): left live for the next boot to end as interrupted.
+                const record = this.registry.inspect(agent.name);
+                this.emitTrace({
+                    type: 'dendrite:agent-interrupted',
+                    agentName: agent.name,
+                    kind: record?.kind ?? candidate.spec.kind,
+                    incarnation: record?.incarnation ?? 0,
+                    reason: 'host-stop',
+                });
+            }
+            else {
+                // The identity ends with its run. Whatever it spawned is settled by
+                // the registry's rules (attention tenants end, task work is orphaned).
+                this.settleEndedAgent(this.registry.end(agent.name, run.endReason ?? 'failed', run.endedBy, { record: true }));
+            }
         }
     }
     /**
@@ -9240,12 +10970,22 @@ export class AgentFramework {
             'its messages will reach your subconscious where that\'s known. ' +
             'Calling tune_out again for a channel already tuned out keeps its ' +
             'settings, and, where this host can open the channel, tries the open ' +
-            'again if it isn\'t open.',
+            'again if it isn\'t open. Without a subconscious it is a silent hold: ' +
+            'nothing summarizes or wakes you; the backlog is delivered when you ' +
+            'cancel. scope "all-except" holds EVERY channel (DMs and new channels ' +
+            'included) except channelId, for durationSeconds (required); your plain ' +
+            'speech lands in that channel meanwhile; the reader pauses rather than ' +
+            'cancels when its wake budget is spent. mode "check" reports what is ' +
+            'held without releasing it (`peek` shows one channel\'s newest held lines).',
         inputSchema: {
             type: 'object',
             properties: {
-                channelId: { type: 'string' },
-                mode: { type: 'string', enum: ['enter', 'cancel'], description: 'Default: enter.' },
+                channelId: { type: 'string', description: 'The channel to tune out — or, with scope "all-except", the one channel to keep.' },
+                serverId: { type: 'string', description: 'The channel\'s server, where the channel id exists on several servers; channelId also takes its server-qualified id ("serverId:channelId").' },
+                mode: { type: 'string', enum: ['enter', 'cancel', 'check'], description: 'Default: enter.' },
+                scope: { type: 'string', enum: ['channel', 'all-except'], description: 'Default: channel.' },
+                peek: { type: 'string', description: 'mode "check": a held channel whose newest held lines to show (nothing is released).' },
+                peekLimit: { type: 'number', description: 'mode "check": how many lines to peek (default 5, max 50).' },
                 cadenceSeconds: {
                     type: 'number',
                     description: `Summary cadence in seconds (default ${TUNE_OUT_DEFAULTS.cadenceSeconds}; floors at 30).`,
@@ -9265,7 +11005,31 @@ export class AgentFramework {
                         'delivered) after this many seconds; floors at 60. Unset = until cancelled.',
                 },
             },
-            required: ['channelId'],
+            required: [],
+        },
+    };
+    /** `focus`: the resident-facing alias for `tune_out` with scope "all-except" (#232 decision 2). */
+    static FOCUS_TOOL = {
+        name: 'focus',
+        description: 'Focus on one channel for a bounded time: every other channel — DMs ' +
+            'and channels that appear later included — is held and stops waking ' +
+            'you; your plain speech lands in the focused channel. The same hold as ' +
+            'tune_out with scope "all-except". mode "cancel" releases the held ' +
+            'backlog per channel; mode "check" reports what is held.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                channelId: { type: 'string', description: 'The one channel to keep.' },
+                serverId: { type: 'string' },
+                durationSeconds: { type: 'number', description: 'Required to enter; floors at 60.' },
+                mode: { type: 'string', enum: ['enter', 'cancel', 'check'], description: 'Default: enter.' },
+                cadenceSeconds: { type: 'number' },
+                backlogCap: { type: 'number', description: 'Per held channel, at release.' },
+                maxWakes: { type: 'number' },
+                peek: { type: 'string' },
+                peekLimit: { type: 'number' },
+            },
+            required: [],
         },
     };
     /** Synthesized sleep/wake tool definitions (present when a gate is wired). */
@@ -11053,17 +12817,20 @@ export class AgentFramework {
     }
     disposeEmptiedForks(failures) {
         const disposals = [];
-        for (const [agentName, channelId] of [...this.conversationAgentHomes]) {
+        // The forks are the registry's conversation-fork records; a fork's home is
+        // the channel on its server (homeOf), which the router's binding is keyed by.
+        const forks = this.listAgents().filter((r) => r.kind === 'conversation-fork').map((r) => ({ agentName: r.name, home: this.homeOf(r.name) }));
+        for (const { agentName, home } of forks) {
             const agent = this.agents.get(agentName);
             if (!agent || agent.getContextManager().getMessageCount() > 0)
                 continue;
             const heldWrites = this.deferredMessages.filter((msg) => (msg.forAgent ?? this.primaryAgentName) === agentName).length;
             let cleanupFailed;
             try {
-                if (this.conversationRouter?.getBinding(channelId)?.agentName === agentName) {
-                    this.conversationRouter.unbind(channelId);
+                if (home && this.conversationRouter && this.conversationRouter.getBinding(home)?.agentName === agentName) {
+                    this.conversationRouter.unbind(home);
                 }
-                this.disposeConversationAgent(agentName);
+                this.disposeConversationAgent(agentName, 'context-emptied');
             }
             catch (error) {
                 cleanupFailed = failureDescription(error);
@@ -11918,7 +13685,12 @@ export class AgentFramework {
         }
     }
     async createAgent(config) {
-        const sees = (metadata) => !metadata?.tuneOut
+        // The residents' view (RESIDENT_VIEW_FILTER: held rows out, read by
+        // heldFromResidents) composed with this agent's own: another agent's
+        // stored context injections out. Main's boundary and arrival checks read
+        // the same predicate (storeSees, agentSees), so they and the compiled
+        // view agree.
+        const sees = (metadata) => !heldFromResidents(metadata)
             && !isAnotherAgentsInjection(metadata, config.name);
         // Create context manager for this agent
         const contextManager = await ContextManager.open({
@@ -11939,7 +13711,8 @@ export class AgentFramework {
             // fetch_history, and audit.
             // Another agent's stored context injections (stored-injections.ts) are
             // that agent's context, not conversation: they stay out of this view,
-            // and so out of its folds, as the residents share this slot.
+            // and so out of its folds, as the residents share this slot. The
+            // resident filter keeps held (tuned-out) rows out as before (`sees`).
             viewFilter: (message) => sees(message.metadata),
         });
         this.trackManager(contextManager);
@@ -11948,6 +13721,8 @@ export class AgentFramework {
         this.adoptToolResultGuard(agent);
         agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
         this.sharedSlotAgents.add(agent);
+        // The first resident declared owns default delivery.
+        this.announceAgentCreated(this.registry.register({ ...residentSpec(config.name, { primary: !this.primaryAgentName }), model: config.model }));
         let restoredSettings;
         try {
             restoredSettings = this.readAgentRuntimeSettings(config.name);
@@ -12050,6 +13825,10 @@ export class AgentFramework {
         this.adoptToolResultGuard(agent);
         agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
         this.sharedSlotAgents.add(agent); // reads the shared slot through its merged view
+        // An attention tenant of the resident it serves: reads the shared slot
+        // through its merged view (held traffic included), never a broadcast
+        // recipient, and outlives policy epochs.
+        this.announceAgentCreated(this.registry.register({ ...subconsciousSpec(name, primaryName), model: agentConfig.model }));
         this.agents.set(name, agent);
         this.agentConfigs.set(name, agentConfig);
         this.subconsciousAgentName = name;
@@ -12057,6 +13836,188 @@ export class AgentFramework {
         this.subconsciousConfig = cfg;
         return agent;
     }
+    /**
+     * `subconscious.reader: 'forks'`: no persistent agent. The coordinator
+     * asks for a fork per invocation (see invokeReaderFork); the config is
+     * kept for the voice block, the speech switch and the strategy factory.
+     */
+    configureReaderForks(cfg) {
+        const primaryName = this.primaryAgentName;
+        const primaryConfig = primaryName ? this.agentConfigs.get(primaryName) : undefined;
+        if (!primaryName || !primaryConfig) {
+            throw new Error('subconscious requires a primary agent to attend to');
+        }
+        const strategy = primaryConfig.strategy;
+        if (!cfg.strategyFactory && strategy && !(strategy instanceof PassthroughStrategy)) {
+            throw new Error(`subconscious.reader "forks": the primary agent "${primaryName}" runs a ${strategy.name} strategy, ` +
+                'so a reader fork needs `subconscious.strategyFactory` returning a fresh instance of the same ' +
+                'class and configuration to reuse its fold state and rendering');
+        }
+        // Whose weights read the resident's prefix is never defaulted. The
+        // resident's own model is the copy; another is allowed when stated, so
+        // the resident's consent can name it (architecture channel, 10-09).
+        if (typeof cfg.model !== 'string' || cfg.model.length === 0) {
+            throw new Error(`subconscious.reader "forks": a reader fork holds the whole prefix of "${primaryName}", so \`model\` ` +
+                `must say whose weights run it — "${primaryConfig.model}" for a copy of the resident, or another model ` +
+                'by name. It is not defaulted');
+        }
+        if (typeof cfg.voice !== 'string' || cfg.voice.length === 0) {
+            throw new Error('subconscious.reader "forks": `voice` (the reader\'s framing block) is required');
+        }
+        this.readerForks = true;
+        this.subconsciousConfig = cfg;
+    }
+    /**
+     * One reader invocation: derive a fork of the resident at its head with
+     * the resident's refusals, hand it the held traffic since the last look
+     * as ordinary framing, and run it. It reports through `deliver_summary`
+     * (attributed mail), may cancel the hold, and ends when its turn ends.
+     */
+    invokeReaderFork(invocation) {
+        const primary = this.primaryAgentName;
+        const cfg = this.subconsciousConfig;
+        if (!primary || cfg?.reader !== 'forks' || !this.agents.has(primary))
+            return;
+        const name = `reader/${primary}/${invocation.epochId.slice(0, 8)}/${++this.readerForkCounter}`;
+        void (async () => {
+            try {
+                // The queued messages are rows of the backlog a framing reads, after
+                // the stored ones, so any framing that shows `backlog` shows them.
+                const backlog = [...invocation.backlog, ...this.queuedReaderRows(primary, invocation.queued)];
+                const content = (cfg.framing ?? defaultReaderFraming)({
+                    resident: primary,
+                    fork: name,
+                    voice: cfg.voice,
+                    channelId: invocation.channelId,
+                    epochId: invocation.epochId,
+                    trigger: invocation.trigger,
+                    notice: invocation.notice,
+                    dispositions: invocation.dispositions,
+                    backlog,
+                    queuedCount: invocation.queued.length,
+                });
+                const fork = await this.deriveAgent({
+                    name,
+                    from: primary,
+                    kind: 'subconscious-fork',
+                    ...(cfg.strategyFactory ? { strategy: cfg.strategyFactory() } : {}),
+                    // Whose weights, as the configuration states it; its report is a
+                    // tool call, so bare prose never routes anywhere.
+                    config: {
+                        model: cfg.model,
+                        proseRouting: 'disabled',
+                    },
+                    inheritRefusals: true,
+                    onParentEnd: 'end',
+                    resultTo: { to: primary, as: 'message' },
+                    idleTimeoutMs: cfg.forkIdleTimeoutMs ?? 10 * 60_000,
+                    framing: [{
+                            participant: 'user',
+                            content,
+                            metadata: {
+                                system: true,
+                                kind: 'tune-out-reader-framing',
+                                channelId: invocation.channelId,
+                                epochId: invocation.epochId,
+                                trigger: invocation.trigger,
+                                heldMessageIds: backlog.map((m) => m.id),
+                            },
+                        }],
+                    metadata: { epochId: invocation.epochId, channelId: invocation.channelId, trigger: invocation.trigger },
+                });
+                this.emitTrace({
+                    type: 'tune-out:reader-fork',
+                    agentName: name,
+                    serverId: invocation.serverId,
+                    channelId: invocation.channelId,
+                    epochId: invocation.epochId,
+                    trigger: invocation.trigger,
+                    held: invocation.backlog.length + invocation.queued.length,
+                    queued: invocation.queued.length,
+                });
+                const outcome = await this.runEphemeralToCompletion(fork.agent, fork.contextManager);
+                // The report is the fork's whole job. A reader that ends in prose
+                // without `deliver_summary` has still reported — its final prose is
+                // delivered as its report, under its own name, instead of vanishing
+                // into proseRouting=disabled (first live run, 2026-10-12, finding A).
+                const prose = outcome.speech.trim();
+                if (prose && !this.tuneOutCoordinator?.readerReported(name)) {
+                    this.deliverFromReader(name, [{ type: 'text', text: prose }], {
+                        kind: 'subconscious-summary',
+                        channelId: invocation.channelId,
+                        epochId: invocation.epochId,
+                        report: 'prose',
+                    });
+                    this.emitTrace({
+                        type: 'tune-out:reader-prose-delivered',
+                        agentName: name,
+                        serverId: invocation.serverId,
+                        channelId: invocation.channelId,
+                        epochId: invocation.epochId,
+                        chars: prose.length,
+                    });
+                }
+            }
+            catch (error) {
+                console.error(`[tune-out] reader fork ${name} failed:`, error instanceof Error ? error.message : error);
+                // A fork that failed before it reported never read what it was
+                // handed: those messages go back to the channel's backlog, so the
+                // next reader for it is handed them instead of no reader ever being.
+                const reported = this.tuneOutCoordinator?.readerReported(name) ?? false;
+                const returned = reported ? 0 : (this.tuneOutCoordinator?.readerFailed(invocation) ?? 0);
+                this.emitTrace({
+                    type: 'tune-out:reader-fork-failed',
+                    agentName: name,
+                    serverId: invocation.serverId,
+                    channelId: invocation.channelId,
+                    epochId: invocation.epochId,
+                    trigger: invocation.trigger,
+                    error: error instanceof Error ? error.message : String(error),
+                    reported,
+                    returned,
+                });
+            }
+            finally {
+                this.tuneOutCoordinator?.forgetReader(name);
+            }
+        })();
+    }
+    /**
+     * Held messages still queued behind the resident's turn, as rows of a
+     * reader fork's backlog: each named by its held handle, as module rows name
+     * it until it lands (heldRows), at a provisional sequence past the
+     * resident's last stored message, and timed when it was first held.
+     */
+    queuedReaderRows(primary, queued) {
+        if (queued.length === 0)
+            return [];
+        const cm = this.agents.get(primary).getContextManager();
+        const count = cm.getMessageCount();
+        const last = count > 0 ? cm.getMessageWindow(count - 1, 1, { resolveBlobs: false }).messages[0]?.sequence ?? 0 : 0;
+        return queued.map((m, i) => ({
+            id: heldHandle(m.writeId),
+            sequence: last + 1 + i,
+            participant: m.participant,
+            content: m.content,
+            metadata: m.metadata,
+            timestamp: new Date(m.heldAt ?? Date.now()),
+        }));
+    }
+    /** A reader fork's own words to the resident: attributed mail when it has a route, else under its name. */
+    deliverFromReader(reader, content, metadata) {
+        const route = this.registry.inspect(reader)?.relationships.resultTo;
+        if (route?.as === 'message') {
+            const mail = this.registry.holdMail({
+                kind: 'result',
+                from: this.registry.ref(reader),
+                to: route.to,
+                content,
+            });
+            this.attemptMailDelivery(mail);
+            return;
+        }
+        this.addMessage(reader, content, metadata);
+    }
     async runLoop() {
         // A loop ends with its lifecycle. A stop() whose budget ran out while
         // this loop was in a call (a module's onProcess) returns before the call
@@ -12344,7 +14305,7 @@ export class AgentFramework {
                         // stand between a tool's call and its results, so this clock
                         // reads the time it's written (clock-rows.ts).
                         const clock = this.storeDueClock(agent, 'tool-boundary');
-                        const deferred = this.drainDeferredFor(agent.name, (msg) => !isInjectableMidTurn(msg, agent.name));
+                        const deferred = this.drainDeferredFor(agent.name, (msg) => !isInjectableMidTurn(msg, agent));
                         // Stored in queue order, cut at the first that can't be stored: it
                         // and what follows wait for the turn's end, and only what was
                         // stored is injected (the round's results go on either way). One
@@ -12356,10 +14317,17 @@ export class AgentFramework {
                         // counts as stored, as what landed of it (writeDrainedInOrder).
                         const stored = this.writeDrainedInOrder(deferred, `tool boundary for ${agent.name}`, (msg) => agent.getContextManager().addMessage(msg.participant, msg.content, withDeferredWriteId(msg.metadata, msg.id)));
                         for (const [msg, { id, content }] of stored) {
+                            this.releaseLandedMail(msg.metadata, agent.name);
                             this.noteSpokenTo(agent.name, msg.metadata);
                             // Every other resident reads what this boundary stores; for its
                             // own agent, the boundary weighs what it injects below.
                             this.noteForOtherResidents(agent, msg.metadata, id);
+                            // A message the agent's own view leaves out is stored and not
+                            // injected: a held message (the reader has it; admission's
+                            // predicate, heldFromResidents, is in every resident's view
+                            // filter) or another agent's stored context injection. Injecting
+                            // it here would put in the live turn what the next compile
+                            // hides (#232 gap 5; main's #853 reads the view itself).
                             if (!this.agentSees(agent, msg.metadata))
                                 continue;
                             heard.push({ msg, id, content });
@@ -12481,6 +14449,38 @@ export class AgentFramework {
                             + agent.maxTokens
                         : 0;
                     const overPhysical = projectedRealTokens > (agent.physicalWindowTokens ?? Infinity);
+                    // Under `speech.locus: 'delivery'` incoming traffic never moves the
+                    // pin — so when someone addresses the agent mid-turn from another
+                    // channel, the agent must be told who and from where, or a neutral
+                    // message reads as part of the conversation it landed in and gets
+                    // answered there (first live run, 2026-10-12, finding C). One
+                    // notice per channel per turn; it rides the same injection batch.
+                    // The turn's own mode: a silent turn routes no prose, whatever the
+                    // agent's mode, so its boundary neither notices nor re-pins. The
+                    // trigger is this stream's: its start holds the agent's turn token
+                    // while the agent waits on this round's tools.
+                    const routesLocus = (agent.proseRouting === 'locus' || agent.proseRouting === 'hybrid')
+                        && !this.activeTurnTriggers.get(agent.name)?.suppressProse;
+                    if (this.speechLocus === 'delivery' && routesLocus && !shouldEndTurn && !overBudget && currentState.stream) {
+                        const routing = this.routingOf(agent.name);
+                        for (const inj of [...midTurnInjections]) {
+                            const m = inj.metadata;
+                            if (!isConversationalInjection(inj.metadata))
+                                continue;
+                            if (typeof m?.channelId !== 'string')
+                                continue;
+                            if (!isAddressedMessage(m.tags))
+                                continue;
+                            // Its channel as a re-pin reads it (repinChannel): on the
+                            // message's own server.
+                            const channel = this.channelNamed(m.channelId, typeof m.serverId === 'string' ? m.serverId : undefined);
+                            if (!channel)
+                                continue;
+                            const notice = this.addressedElsewhereNotice(agent, routing, channel, authorName(m));
+                            if (notice)
+                                midTurnInjections.push(notice);
+                        }
+                    }
                     // Addressed re-pin (2026-07-31 Mythos misroutes, antra-ratified):
                     // when someone ADDRESSES the agent mid-turn from another channel
                     // (mention / reply / DM — the same chat:addressed signal the
@@ -12511,9 +14511,7 @@ export class AgentFramework {
                     // agent's mode, so its boundary neither re-pins nor notes. The
                     // trigger is this stream's: its start holds the agent's turn token
                     // while the agent waits on this round's tools.
-                    const routesLocus = (agent.proseRouting === 'locus' || agent.proseRouting === 'hybrid')
-                        && !this.activeTurnTriggers.get(agent.name)?.suppressProse;
-                    if (routesLocus && !shouldEndTurn && !overBudget && currentState.stream) {
+                    if (this.speechLocus === 'latest-inbound' && routesLocus && !shouldEndTurn && !overBudget && currentState.stream) {
                         // Two signals qualify an injection to move the pin (n=6 + n=7):
                         //  - chat:addressed — someone explicitly spoke TO the agent
                         //    (mention / reply / DM);
@@ -12893,10 +14891,11 @@ export class AgentFramework {
                 if (!decision.trigger)
                     return;
             }
-            // Broadcast requests exclude conversation forks — they are driven by
-            // their own channel's messages, not by framework-wide events.
+            // A broadcast request reaches the agents whose role says they take
+            // untargeted inbound; channel-bound and bounded-job agents are driven
+            // by their own channel or task, not by framework-wide events.
             const targetAgents = response.requestInference === true
-                ? Array.from(this.agents.keys()).filter((n) => !this.conversationAgentHomes.has(n) && n !== this.subconsciousAgentName)
+                ? this.registry.untargetedRecipients()
                 : response.requestInference;
             for (const agentName of targetAgents) {
                 const agent = this.agents.get(agentName);
@@ -12942,6 +14941,24 @@ export class AgentFramework {
      * Convert an incoming MCPL channel message to a context message.
      * This replaces the old MCPLModule.onProcess() message conversion.
      */
+    /**
+     * A delivered inbound message becomes the latest delivered inbound (the
+     * channel context's reply anchor; the legacy speech fallback) through the
+     * registry's noteDelivered — at once for a plain channels/incoming, whose
+     * acceptance the registry answers synchronously; parked for a coalesced one
+     * until its acceptance is acknowledged (see parkedAnchors).
+     */
+    noteDeliveredOrPark(event) {
+        // On the server the message came from (noteDelivered).
+        const anchor = { channel: { serverId: event.serverId, channelId: event.channelId }, messageId: event.messageId, threadId: event.threadId, tags: event.tags, firstView: event.firstView === true };
+        if (event.coalescingSubject && typeof event.eventId === 'string') {
+            this.parkedAnchors.set(`${event.serverId}:${event.eventId}`, anchor);
+            if (this.parkedAnchors.size > 1000)
+                this.parkedAnchors.delete(this.parkedAnchors.keys().next().value);
+            return;
+        }
+        this.channelRegistry?.noteDelivered(anchor.channel, anchor.messageId, anchor.threadId, anchor.tags, anchor.firstView);
+    }
     async handleMcplChannelIncoming(event) {
         // context-manager won't store content that doesn't match ContentBlock
         // (malformedContentPlaces names where). Content from the wire can't be
@@ -13007,6 +15024,49 @@ export class AgentFramework {
         // before any host decoration. The stored copy's own digest is taken at
         // each storage site below, over exactly the blocks stored there.
         metadata.sourceBodyDigest = sourceBodyDigest(event.content);
+        // Stored as the model reads it: `author: body`. The wire formatter
+        // writes the participant, and channel traffic is stored under the
+        // anonymous `user`, so a body stored bare reaches the model as
+        // `user: <text>` with the author nowhere (Weft's rig, 2026-10-13). A
+        // server that renders the name into the text itself is left as is.
+        const content = presentAuthor({ participant: 'user', content: event.content, metadata }).content;
+        // Admission (Dendrite §D, #232 root cause A): decided once, here, before
+        // anything downstream acts — the hold, the wake gate, who may be woken,
+        // whether this counts as the latest delivered inbound. Every path below
+        // consumes `decision`; none re-asks the policy.
+        const addressed = isAddressedMessage(event.tags);
+        const decision = this.admitInbound({
+            lane: 'channel',
+            serverId: event.serverId,
+            channelId: event.channelId,
+            messageId: event.messageId,
+            authorId: event.author?.id,
+            tags: event.tags,
+            addressed,
+            vetoed: event.triggerInference === false,
+            targetAgents: event.targetAgents,
+            gateContent: event.content
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text)
+                .join('\n'),
+            gateMetadata: {
+                ...event.metadata,
+                eventType: 'mcpl:channel-incoming',
+                serverId: event.serverId,
+                channelId: event.channelId,
+                messageId: event.messageId,
+                threadId: event.threadId,
+                author: event.author,
+                ...(event.tags ? { tags: event.tags } : {}),
+            },
+        });
+        metadata.triggered = decision.wake;
+        if (decision.held) {
+            // The admission record rides the message; the hold's own bookkeeping
+            // (cadence tally, suppressed-mention ack, reader wake) follows.
+            metadata.tuneOut = { epochId: decision.held.epochId };
+            this.tuneOutCoordinator?.recordHeld(event.serverId, event.channelId, event.messageId, event.tags, event.author?.id, decision.gatePass);
+        }
         // Per-channel conversation routing: messages go to the channel's fork
         // agent (spawned from the template on first qualifying message), never
         // to the primary conversation.
@@ -13017,14 +15077,20 @@ export class AgentFramework {
             const target = this.agents.get(event.deliverTo);
             if (!target)
                 return undefined;
-            if (this.conversationRouter && this.conversationAgentHomes.has(target.name)) {
+            if (this.conversationRouter && this.registry.homeChannel(target.name) !== undefined) {
                 metadata.triggered = event.triggerInference ?? false;
                 // A fork's channel messages are stored past its deferral; a clock goes
                 // ahead of one only while the fork has no turn alive (storeDueClock).
                 if (!this.turnAlive(target) && takesClockBefore('user', event.content, metadata, target.name)) {
                     this.storeDueClock(target, 'event');
                 }
-                const placement = this.writeToFork(target, event.content, AgentFramework.withStoredDigest(metadata, event.content));
+                // The stored copy carries the author as the fork reads them (presentAuthor), and its digest is of that copy.
+                const placement = this.writeToFork(target, content, AgentFramework.withStoredDigest(metadata, content));
+                // Delivered to the fork, so it is the latest delivered inbound too
+                // (the channel context's `incoming`; the fallback locus under the
+                // legacy rule), as a resident's delivery is below.
+                if (decision.locus)
+                    this.noteDeliveredOrPark(event);
                 // A correction may target an older engagement. Refresh only the
                 // binding whose agent actually received the message.
                 const channel = { serverId: event.serverId, channelId: event.channelId };
@@ -13032,12 +15098,12 @@ export class AgentFramework {
                     this.conversationRouter.touch(channel);
                 }
                 this.emitTrace({ type: 'message:added', messageId: placement.messageId ?? '', source: 'mcpl:channel-incoming' });
-                if (event.triggerInference) {
+                if (decision.wake) {
                     this.pendingRequests.push({
                         agentName: target.name, reason: 'mcpl:channel-incoming', source: event.serverId, timestamp: Date.now(),
                         channelId: event.channelId, channelServerId: event.serverId,
                         counterparty: event.author?.id ? `${event.serverId}:user:${event.author.id}` : undefined,
-                        addressed: isAddressedMessage(event.tags, event.metadata),
+                        addressed,
                         ...systemNoticeMark(event.tags),
                         ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
                     });
@@ -13046,14 +15112,14 @@ export class AgentFramework {
             }
             if (this.conversationRouter)
                 return undefined; // the trunk never holds channel traffic
-            event = { ...event, targetAgents: [target.name] };
+            decision.recipients = [target.name];
         }
         else if (this.conversationRouter) {
-            return this.routeConversationIncoming(event, metadata);
+            return this.routeConversationIncoming({ ...event, content }, metadata, decision);
         }
         // Addressed-while-closed invitation — parity with the push-event path
         // (channels.publish surfaces like portal-mcpl deliver mentions here).
-        const incomingContent = [...event.content];
+        const incomingContent = [...content];
         {
             const invitation = this.buildClosedChannelInvitation({
                 serverId: event.serverId,
@@ -13070,37 +15136,28 @@ export class AgentFramework {
                 missedCharacters: typeof event.metadata?.missedCharacters === 'number'
                     ? event.metadata.missedCharacters
                     : undefined,
-                targetAgents: event.targetAgents,
+                // A correction's one agent (deliverTo) is the agent whose window the
+                // invitation goes into, so its mode is the one read (main's #852):
+                // admission recorded it as the recipients, where main's code
+                // rewrites the event's targetAgents.
+                targetAgents: event.deliverTo ? decision.recipients : event.targetAgents,
             });
             if (invitation) {
                 incomingContent.push(invitation.block);
                 Object.assign(metadata, invitation.metadataPatch);
             }
         }
-        // Tune-out divert (issue #77): stamped, stored, no resident wake. The
-        // coordinator has already handled wake bookkeeping (coalesced
-        // subconscious invocation, durable count, suppression ack) before we
-        // stamp; the subconscious reads the message through its merged view.
-        const divert = this.tuneOutCoordinator?.onIncoming(event.serverId, event.channelId, event.messageId, event.tags, event.author?.id, 
-        // The resident's gate verdict rides the event; it preconditions
-        // subconscious wakes (gate composes, it is not replaced).
-        event.triggerInference !== false) ?? null;
-        if (divert) {
-            metadata.tuneOut = { epochId: divert.epochId };
-        }
+        // Captured where it arrived: a held message is stored with its admission
+        // record and never enters a resident's view; a delivered one is also
+        // the latest delivered inbound (the channel context's `incoming`, and
+        // the fallback locus under the legacy rule) — a held one never is.
         const placement = { agent: '' };
         const id = this.addMessage('user', incomingContent, AgentFramework.withStoredDigest(metadata, incomingContent), { placement, bypassDeferralFor: event.assemblingFor });
         this.emitTrace({ type: 'message:added', messageId: id, source: 'mcpl:channel-incoming' });
-        if (event.triggerInference && !divert) {
-            const addressed = isAddressedMessage(event.tags, event.metadata);
-            // Honor explicit targeting, mirroring the push-event path: an event
-            // that names its agents wakes exactly those; an untargeted event
-            // keeps the historical broadcast. (targetAgents was declared on
-            // McplChannelIncomingEvent from the start but never honored here —
-            // tune-out's wake routing is the first setter.)
-            const targetAgents = event.targetAgents
-                ?? [...this.agents.keys()].filter((n) => n !== this.subconsciousAgentName);
-            for (const agentName of targetAgents) {
+        if (decision.locus)
+            this.noteDeliveredOrPark(event);
+        if (decision.wake) {
+            for (const agentName of decision.recipients) {
                 if (!this.agents.has(agentName))
                     continue;
                 this.pendingRequests.push({
@@ -13131,7 +15188,7 @@ export class AgentFramework {
      * agent first when the bind policy matches. Unrouted messages are dropped —
      * the template ("trunk") is a dormant warm checkpoint, not a listener.
      */
-    async routeConversationIncoming(event, messageMetadata) {
+    async routeConversationIncoming(event, messageMetadata, admission) {
         const router = this.conversationRouter;
         const channel = { serverId: event.serverId, channelId: event.channelId };
         const descriptor = this.channelRegistry?.getDescriptor(channel);
@@ -13191,15 +15248,20 @@ export class AgentFramework {
                 return;
             }
         }
-        // Respect an explicit server-config-level veto (shouldTriggerInference)
-        // on top of the router's own trigger policy.
-        const trigger = decision.trigger && event.triggerInference !== false;
+        // The admission decision (server veto, wake gate) composes with the
+        // router's own trigger policy.
+        const trigger = decision.trigger && admission.wake;
         messageMetadata.triggered = trigger;
         // As for a correction above: a clock ahead only while no turn is alive.
         if (!this.turnAlive(agent) && takesClockBefore('user', event.content, messageMetadata, agent.name)) {
             this.storeDueClock(agent, 'event');
         }
         const placement = this.writeToFork(agent, event.content, AgentFramework.withStoredDigest(messageMetadata, event.content));
+        // Delivered to the channel's fork: the latest delivered inbound, as for a
+        // resident (the channel context's `incoming`; the fallback locus under
+        // the legacy rule). A held or dropped message never is.
+        if (admission.locus)
+            this.noteDeliveredOrPark(event);
         router.touch(channel);
         this.emitTrace({ type: 'message:added', messageId: placement.messageId ?? '', source: 'mcpl:channel-incoming' });
         if (trigger) {
@@ -13212,7 +15274,7 @@ export class AgentFramework {
                 // triggering channel too so the trunk/active path stays consistent.
                 channelId: event.channelId, channelServerId: event.serverId,
                 counterparty: event.author?.id ? `${event.serverId}:user:${event.author.id}` : undefined,
-                addressed: isAddressedMessage(event.tags, event.metadata),
+                addressed: isAddressedMessage(event.tags),
                 ...systemNoticeMark(event.tags),
                 ...(event.coalescingSubject ? { coalescingSubject: event.coalescingSubject } : {}),
             });
@@ -13350,10 +15412,17 @@ export class AgentFramework {
             const agent = new Agent(config, contextManager, this.membrane);
             this.adoptToolResultGuard(agent);
             agent.markContextConsumed(); // RFC-006: nothing stored before now is replaceable
+            this.announceAgentCreated(this.registry.register({
+                ...conversationForkSpec(name, {
+                    template: router.templateAgent,
+                    homeChannel: home,
+                    idleTtlMs: router.idleTtlMs,
+                }),
+                model: config.model,
+            }));
             this.managerReleases.set(agent, release);
             this.agents.set(name, agent);
             this.agentConfigs.set(name, config);
-            this.conversationAgentHomes.set(name, home);
             return agent;
         }
         catch (error) {
@@ -13496,63 +15565,28 @@ export class AgentFramework {
      * stop() has ended binds nothing (spawnConversationAgent). The fork's
      * context stays in Chronicle for investigation.
      */
-    disposeConversationAgent(agentName) {
-        this.closingConversationAgents.delete(agentName);
-        // A continuation of its turn still on its way goes with it.
-        this.dropContinuations(agentName, { kind: 'dropped', why: 'its agent was disposed' });
-        const home = this.conversationAgentHomes.get(agentName);
+    disposeConversationAgent(agentName, reason = 'idle-ttl') {
+        const home = this.homeOf(agentName);
         const agent = this.agents.get(agentName);
-        // A fork stop() ends can still be running: its stream, its tool round.
-        // Its name is never used again, so its end takes the stream's
-        // activeStreams and pendingAssistantBlocks entries, as a run's end does
-        // (runEphemeralToCompletion), and settles a batch its guard still holds,
-        // withheld as `aborted`: the stream's own finally does neither once the
-        // fork has gone. A fork the idle sweep ends has no stream entries left,
-        // and a batch still pending there is one whose successor never ran,
-        // which a run's end settles too.
-        if (agent?.toolResultGuard.hasPending) {
-            try {
-                agent.toolResultGuard.abandon('aborted');
-            }
-            catch (error) {
-                console.error(`[tool-result-guard] agent=${agentName} failed to record a batch the fork left:`, error);
-            }
-        }
-        this.activeStreams.delete(agentName);
-        this.pendingAssistantBlocks.delete(agentName);
-        this.agents.delete(agentName);
-        this.thinkingLossIncidents.forget(agentName);
-        this.reasoningLoss.forget(agentName);
-        // Its pending self-wake ends with it, rather than wake a name that's gone.
-        this.eventGate?.agentGone(agentName);
+        // The one release every ended agent gets (releaseAgentRuntime), then the
+        // registry's end, whose outcome settles what the fork spawned.
         if (agent) {
-            this.releaseManager(agent);
-            this.releaseWindowNowOrAfterResume(agent);
-        }
-        this.turnRouting.delete(agentName);
-        this.proseSpeechChains.delete(agentName);
-        this.openLogical.delete(agentName);
-        this.toolImageLedgers.delete(agentName);
-        this.agentConfigs.delete(agentName);
-        this.conversationAgentHomes.delete(agentName);
-        this.evictTurnCheckpoints(agentName);
-        if (agent)
-            this.logicalTurnToolCalls.delete(agent);
-        // Its scripts go with it, and leave the map once they've ended: no later
-        // run of a fork's name trims them.
-        this.codeExecution?.scripts.agentGone(agentName);
-        // A provider-wait hold (nonOwningProviderWait) goes with the agent: left,
-        // its timer would requeue held wakes for an agent that is gone, and a wait
-        // held until released would re-arm for the name indefinitely. The recorded
-        // wait stays, and binds the name if its channel binds again.
-        const cooldown = this.providerAccelerationCooldowns.get(agentName);
-        if (cooldown) {
-            clearTimeout(cooldown.timer);
-            this.providerAccelerationCooldowns.delete(agentName);
-            console.error(`[provider-wait] agent=${agentName} disposed while held` +
-                `${cooldown.waitModel !== undefined ? ` on ${cooldown.waitModel}` : ''}: ` +
-                `${cooldown.heldRequests.length} held request(s) dropped with it (the recorded wait stays)`);
+            this.releaseAgentRuntime(agent, home, 'its agent was disposed');
+        }
+        else {
+            // Nothing live under the name: only what the process keeps by name.
+            this.closingConversationAgents.delete(agentName);
+            this.thinkingLossIncidents.forget(agentName);
+            this.reasoningLoss.forget(agentName);
+            // A continuation of its turn still on its way goes with it.
+            this.dropContinuations(agentName, { kind: 'dropped', why: 'its agent was disposed' });
+            this.turnRouting.delete(agentName);
+            this.proseSpeechChains.delete(agentName);
+            this.openLogical.delete(agentName);
+            this.forgetAnnouncedLocus(agentName);
+            this.codeExecution?.scripts.agentGone(agentName);
         }
+        this.settleEndedAgent(this.registry.end(agentName, reason, 'framework', { record: true }));
         this.emitTrace({
             type: 'mcpl:conversation-disposed',
             agentName,
@@ -13570,7 +15604,7 @@ export class AgentFramework {
      * its own fork.
      */
     scopeInjectionsForAgent(agentName, injections) {
-        const home = this.conversationAgentHomes.get(agentName);
+        const home = this.homeOf(agentName);
         const registry = this.channelRegistry;
         if (!home || !registry || injections.length === 0) {
             return injections;
@@ -13614,7 +15648,7 @@ export class AgentFramework {
                 // Agent vanished (external reset) — nothing to close, just make sure
                 // its bookkeeping doesn't linger.
                 this.agentConfigs.delete(binding.agentName);
-                this.conversationAgentHomes.delete(binding.agentName);
+                this.settleEndedAgent(this.registry.end(binding.agentName, 'idle-ttl', 'framework', { record: true }));
                 continue;
             }
             this.writeToFork(agent, [{ type: 'text', text: this.conversationRouter.closurePrompt }], { channelId: binding.channelId, conversationClosure: true });
@@ -13640,7 +15674,7 @@ export class AgentFramework {
             if (!this.hasTurn(agentName) &&
                 !this.activeStreams.has(agentName) &&
                 !this.pendingRequests.some((r) => r.agentName === agentName)) {
-                this.disposeConversationAgent(agentName);
+                this.disposeConversationAgent(agentName, 'idle-ttl');
             }
         }
     }
@@ -14111,8 +16145,11 @@ export class AgentFramework {
             this.coalescingRecentReceipts = restored.recent;
         this.pushCoalescer = restored.coalescer;
         // Batches restored from a snapshot still owe the agent a wake (§14 v41).
-        for (const occ of restored.coalescer.pendingBatchOccurrences())
-            void this.wakeForCoalescedBatch(occ);
+        for (const occ of restored.coalescer.pendingBatchOccurrences()) {
+            void this.wakeForCoalescedBatch(occ).catch((error) => {
+                console.error(`[coalescing] ${occ.serverId}: the wake a restored batch (${occ.eventId}) owes its agent failed:`, error);
+            });
+        }
     }
     /**
      * Durability barrier for coalescing (RFC-006 §3.1/§3.2): everything
@@ -14225,6 +16262,13 @@ export class AgentFramework {
             // counts what was stored before a restart as shown: every agent's
             // shown watermark starts at the head at boot.
             const firstView = this.pushCoalescer.receiptFirstView(serverId, this.coalescingBinding(serverId), message.eventId);
+            // Acknowledged: the anchor the delivery parked is committed now (and a
+            // retry answered from the receipt commits its first attempt's).
+            const parked = this.parkedAnchors.get(`${serverId}:${message.eventId}`);
+            if (parked) {
+                this.parkedAnchors.delete(`${serverId}:${message.eventId}`);
+                this.channelRegistry?.noteDelivered(parked.channel, parked.messageId, parked.threadId, parked.tags, parked.firstView || firstView === true);
+            }
             return { messageId: message.messageId, accepted: true, coalesce: result.coalesce, ...(firstView ? { firstView: true } : {}) };
         });
     }
@@ -14367,7 +16411,7 @@ export class AgentFramework {
                 return [];
             }
         }
-        return [...this.agents.keys()].filter((n) => !this.conversationAgentHomes.has(n) && n !== this.subconsciousAgentName);
+        return this.registry.untargetedRecipients();
     }
     /** Deliver through the lane's ordinary path; report where it landed. */
     async deliverCoalesced(occ, materialized, assemblingFor) {
@@ -14448,11 +16492,59 @@ export class AgentFramework {
         const subject = coalescingSubjectKey(occ.serverId, occ.binding, occ.scope, occ.key);
         if (occ.event.lane !== 'push' || !occ.event.event.triggerInference)
             return;
-        const origin = occ.event.event.origin;
+        const push = occ.event.event;
+        const origin = push.origin;
         // The wake carries the batch's channel so the turn freezes its reply
         // locus there (the materialized delivery at assembly wakes nobody).
         const channelId = occ.scope.kind === 'channel' ? occ.scope.id : this.derivePushEventChannel(origin)?.channelId;
         const authorId = occ.identity?.author?.id ?? (typeof origin?.authorId === 'string' ? origin.authorId : undefined);
+        // A deferred batch is admitted when it asks for its wake: the hold and
+        // the gate decide now; its materialized delivery at assembly is vetoed
+        // (`triggerInference: false`) and so is not shown to the gate again.
+        const decision = this.admitInbound({
+            lane: 'push',
+            serverId: occ.serverId,
+            channelId,
+            messageId: occ.eventId,
+            authorId,
+            tags: occ.tags,
+            addressed: isAddressedMessage(occ.tags),
+            vetoed: false,
+            targetAgents: push.targetAgents,
+            gateContent: (push.content ?? [])
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text)
+                .join('\n'),
+            gateMetadata: {
+                ...(origin ?? {}),
+                serverId: occ.serverId,
+                featureSet: push.featureSet,
+                eventId: occ.eventId,
+                eventType: 'mcpl:push-event',
+                ...(occ.tags ? { tags: occ.tags } : {}),
+            },
+        });
+        if (decision.held && !plain && this.pushCoalescer) {
+            // A held batch wakes nobody, so no turn's assembly would store it while
+            // the hold lasts, and readers of held traffic and the release would
+            // never see it. It's stored now, stamped with its hold as a plain push
+            // under the hold is, and consumed, so the turn after the hold doesn't
+            // take it again. Outside the coalescer's lock: this runs inside it.
+            // A hold that ended before the batch was stored left it stored unheld:
+            // it then takes the wake an unheld push gets, every recipient's.
+            const coalescer = this.pushCoalescer;
+            void this.coalescedAudience(occ)
+                .then((audience) => (audience[0] !== undefined ? coalescer.materializeNow(audience[0], subject) : false))
+                .then(async (stored) => {
+                if (stored && !(channelId !== undefined && this.tuneOutCoordinator?.holdFor(occ.serverId, channelId))) {
+                    await this.queueCoalescedWakes(occ, true);
+                }
+            })
+                .catch((err) => console.error(`[coalescing] a held batch for ${logValue(subject)} could not be stored:`, err));
+            return;
+        }
+        if (!decision.wake)
+            return;
         for (const agentName of await this.coalescedAudience(occ)) {
             this.pendingRequests.push({
                 agentName,
@@ -14461,7 +16553,7 @@ export class AgentFramework {
                 timestamp: Date.now(),
                 channelId, ...(channelId !== undefined ? { channelServerId: occ.serverId } : {}),
                 counterparty: authorId ? `${occ.serverId}:user:${authorId}` : undefined,
-                addressed: isAddressedMessage(occ.tags, origin),
+                addressed: isAddressedMessage(occ.tags),
                 // No systemNotice mark here: a render folds the batch's every
                 // occurrence, and only its latest's tags are at hand, so marking it
                 // would hide a folded message's channel whenever a notice came last.
@@ -14562,9 +16654,13 @@ export class AgentFramework {
         // not the agent that happened to be asked). A reader is one whose view
         // filter keeps the message: a tune-out-diverted message never enters a
         // resident's compiled view, and only the subconscious reads it through
-        // its merged view — no subconscious, nobody reads it.
-        const readers = (this.sharedSlotAgents.has(agent)
-            ? [...this.sharedSlotAgents].filter((a) => this.agents.get(a.name) === a)
+        // its merged view — no subconscious, nobody reads it. The slot's readers
+        // are the registry's (residents and the subconscious), each asked its own
+        // view (agentSees, main's #853).
+        const readers = (this.registry.readsSharedSlot(agent.name)
+            ? this.registry.sharedSlotReaders()
+                .map((name) => this.agents.get(name))
+                .filter((reader) => reader !== undefined)
             : [agent]).filter((a) => this.agentSees(a, message.metadata));
         const branch = cm.currentBranch().name;
         const ts = message.timestamp instanceof Date ? message.timestamp.getTime() : Number(message.timestamp);
@@ -14715,6 +16811,37 @@ export class AgentFramework {
         // marker with an empty payload — arbitrary MCPL servers cannot hide
         // content merely by setting `origin.silent`.
         const silentHeartbeat = isSilentHeartbeatMarker({ ...event, content });
+        // Admission (Dendrite §D): the same decision as the channel lane. A DM
+        // arrives here, so this is where tuning out a DM takes effect (#232 gap
+        // 1). An event with no channel provenance cannot be held.
+        const decision = this.admitInbound({
+            lane: 'push',
+            serverId: event.serverId,
+            channelId: triggerChannel?.channelId,
+            messageId: event.eventId,
+            authorId: typeof event.origin?.authorId === 'string' ? event.origin.authorId : undefined,
+            tags: event.tags,
+            addressed: isAddressedMessage(event.tags),
+            vetoed: event.triggerInference === false,
+            targetAgents: event.targetAgents,
+            gateContent: content
+                .filter((b) => b.type === 'text')
+                .map((b) => b.text)
+                .join('\n'),
+            gateMetadata: {
+                ...(event.origin ?? {}),
+                serverId: event.serverId,
+                featureSet: event.featureSet,
+                eventId: event.eventId,
+                eventType: 'mcpl:push-event',
+                ...(event.tags ? { tags: event.tags } : {}),
+            },
+        });
+        metadata.triggered = decision.wake;
+        if (decision.held && triggerChannel) {
+            metadata.tuneOut = { epochId: decision.held.epochId };
+            this.tuneOutCoordinator?.recordHeld(event.serverId, triggerChannel.channelId, event.eventId, event.tags, typeof event.origin?.authorId === 'string' ? event.origin.authorId : undefined, decision.gatePass);
+        }
         const placement = { agent: '' };
         if (!silentHeartbeat) {
             const id = this.addMessage('user', content, AgentFramework.withStoredDigest(metadata, content), { placement, bypassDeferralFor: event.assemblingFor });
@@ -14723,11 +16850,8 @@ export class AgentFramework {
         else {
             console.error(`[heartbeat] ${event.serverId}: accepted silent scheduled wake ${logValue(event.eventId ?? '')}`);
         }
-        if (event.triggerInference) {
-            // Default broadcast excludes conversation forks (channel-driven).
-            const targetAgents = event.targetAgents
-                ?? [...this.agents.keys()].filter((n) => !this.conversationAgentHomes.has(n) && n !== this.subconsciousAgentName);
-            for (const agentName of targetAgents) {
+        if (decision.wake) {
+            for (const agentName of decision.recipients) {
                 this.pendingRequests.push({
                     agentName,
                     reason: 'mcpl:push-event',
@@ -14737,7 +16861,7 @@ export class AgentFramework {
                     // DMs and addressed-while-closed messages arrive as push events;
                     // they must outrank ambient chatter in a batched wake's locus
                     // selection just like their channels/incoming counterparts.
-                    addressed: isAddressedMessage(event.tags, event.origin),
+                    addressed: isAddressedMessage(event.tags),
                     ...ambientMark(event.tags),
                     ...systemNoticeMark(event.tags),
                     ...(silentHeartbeat ? {
@@ -14763,11 +16887,11 @@ export class AgentFramework {
      * a fork is that fork's conversation, so no other agent takes it.
      */
     mayTakeGateRoute(agentName, route) {
-        const home = this.conversationAgentHomes.get(agentName);
+        const home = this.homeOf(agentName);
         if (home !== undefined)
             return sameChannel(home, route);
-        for (const boundChannel of this.conversationAgentHomes.values()) {
-            if (sameChannel(boundChannel, route))
+        for (const record of this.registry.list()) {
+            if (sameChannel(this.channelOfHome(record.homeChannel), route))
                 return false;
         }
         return true;
@@ -14786,6 +16910,35 @@ export class AgentFramework {
         const named = this.channelRegistry?.channelsNamed(channelId) ?? [];
         return named.length === 1 ? named[0] : undefined;
     }
+    /**
+     * A live agent's home channel, from its registry record (channelOfHome):
+     * defined for a conversation fork, and only for one. Undefined for an agent
+     * with none, and for one that has ended.
+     */
+    homeOf(agentName) {
+        return this.channelOfHome(this.registry.homeChannel(agentName));
+    }
+    /**
+     * The channel a registry record's `homeChannel` names: the channel on its
+     * server. A bare channel id, as a record written before homes carried
+     * their server keeps, is read as a wake that names its channel without its
+     * server is (channelNamed): the one registered channel it names, read when
+     * it's used, since the servers registered at that moment are what it can
+     * mean. An id that names no one registered channel, as one no server
+     * registers now or two servers do, is the home on no server (an empty
+     * serverId, which channelNamed reads as none given), so the agent keeps a
+     * home. A path that reads the pair finds no server registering it, and
+     * refuses it; one that reads the name reads what the name means then: none
+     * or two channels, which it refuses, or, once one server alone registers
+     * the id, that server's channel.
+     */
+    channelOfHome(home) {
+        if (home === undefined)
+            return undefined;
+        if (typeof home !== 'string')
+            return home;
+        return this.channelNamed(home) ?? { serverId: '', channelId: home };
+    }
     /**
      * Explicit mode's typing channel for one start of a turn, which has no
      * locus, read once as the start opens (driveStream then shows what the
@@ -15358,6 +17511,43 @@ export class AgentFramework {
             await this.startAgentStream(agent, start);
         }
     }
+    /**
+     * `channel_publish` with no channel goes where the turn's plain speech
+     * would: the frozen turn locus (the waking delivery's channel, or one
+     * opened this turn), then the registry's own resolution. Under
+     * `speech.locus: 'delivery'` the registry alone has no default, and the
+     * tool failed on the very turn its own delivery woke (first live run,
+     * 2026-10-12). Both dispatch paths — the stream driver's and
+     * executeToolCall's — pass through here. Only a call made inside the turn
+     * (callingTurnOf) takes the turn's locus: one made outside it, as a script
+     * left running after its turn makes or a host's executeToolCall naming the
+     * agent, takes none of the turn's channels. A conversation fork's home
+     * isn't the turn's but the fork's own, so such a call from a fork naming
+     * no channel still goes there (homeOf), as the fork's dispatched calls do
+     * (dispatchChannelToolCall); anyone else's takes the registry's own
+     * default.
+     */
+    publishInputWithTurnLocus(input, agentName, callingTurn) {
+        const given = input?.channelId;
+        if (typeof given === 'string')
+            return input;
+        const locus = callingTurn
+            ? callingTurn.locus ?? this.channelRegistry?.resolveLocus(agentName) ?? null
+            : this.homeOf(agentName) ?? null;
+        if (!locus)
+            return input;
+        // The pair: a serverId beside a channelId names that server's channel.
+        // A serverId given with no channelId names the locus's id on that
+        // server, as the registry reads one given beside its own default: the
+        // default's id on the server given (handleToolPublish). So a fork's call
+        // naming another server and no channel reaches that server's channel
+        // with its home's id, where one is registered: its dispatched calls are
+        // refused that (dispatchChannelToolCall), and executeToolCall applies
+        // none of that guard, on main as here.
+        const record = input ?? {};
+        const serverId = typeof record.serverId === 'string' && record.serverId ? record.serverId : locus.serverId;
+        return { ...record, channelId: locus.channelId, serverId };
+    }
     /**
      * Stamps for the rows the agent's reply stores in its current turn: its
      * assistant responses, its tool_result rows (through `storeResults`), and
@@ -16107,7 +18297,7 @@ export class AgentFramework {
         const registry = this.channelRegistry;
         if (!registry)
             return refuse('No channels are configured, so there is nowhere to resend to.');
-        const home = this.conversationAgentHomes.get(agentName);
+        const home = this.homeOf(agentName);
         let spec = typeof input.destination === 'string' ? input.destination.trim() : '';
         if (present(input.destination) && typeof input.destination !== 'string') {
             return refuse('destination must be "#channel", "@person" or a channel id.');
@@ -16525,17 +18715,58 @@ export class AgentFramework {
             console.error('noticeHeartbeatTurn: failed to record the notice:', err);
         }
     }
+    rememberAnnouncedLocus(agentName, locus) {
+        this.lastAnnouncedLocus.set(agentName, locus);
+        this.writeAnnouncedLocus(agentName, locus ? { serverId: locus.serverId, channelId: locus.channelId } : null);
+    }
+    forgetAnnouncedLocus(agentName) {
+        this.lastAnnouncedLocus.delete(agentName);
+        this.writeAnnouncedLocus(agentName, undefined);
+    }
+    /** The stored baseline's entry for the agent set (rememberAnnouncedLocus),
+     *  or removed (undefined) when the agent ends without coming back. */
+    writeAnnouncedLocus(agentName, locus) {
+        try {
+            const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+            const state = (data && typeof data === 'object' ? data : {});
+            const loci = { ...(state.announcedLoci ?? {}) };
+            if (locus === undefined) {
+                if (!Object.hasOwn(loci, agentName))
+                    return;
+                delete loci[agentName];
+            }
+            else {
+                loci[agentName] = locus;
+            }
+            state.announcedLoci = loci;
+            this.store.setStateJson(FRAMEWORK_STATE_ID, state);
+        }
+        catch (err) {
+            console.error(`[routing] ${agentName}: the announced locus wasn't ${locus === undefined ? 'removed from' : 'written to'} the store:`, err);
+        }
+    }
     /**
      * Announce-on-change locus notice (turn-frozen routing). Appends a durable
      * `[routing]` window message when the turn's effective outbound locus
      * differs from the last one announced — the agent must never have to guess
      * where its plain prose lands. Durable append (never retracted) keeps the
-     * KV prefix stable; change-only keeps it out of steady-state turns. The
-     * first resolution after boot announces only a non-null locus ("prose has
-     * no destination" is the unremarkable boot default). Never triggers
+     * KV prefix stable; change-only keeps it out of steady-state turns. An
+     * agent never told of a locus, here or before a restart, hears only of a
+     * non-null one ("prose has no destination" is the unremarkable start).
+     * Never triggers
      * inference; never locus-eligible itself (system + no channel metadata).
      */
     announceLocusIfChanged(agentName, locus) {
+        if (!this.lastAnnouncedLocus.has(agentName)) {
+            try {
+                const stored = this.store.getStateJson(FRAMEWORK_STATE_ID)?.announcedLoci;
+                if (stored && Object.hasOwn(stored, agentName))
+                    this.lastAnnouncedLocus.set(agentName, stored[agentName] ?? null);
+            }
+            catch (err) {
+                console.error(`[routing] ${agentName}: the announced locus couldn't be read back, so this turn compares with none:`, err);
+            }
+        }
         const hasBaseline = this.lastAnnouncedLocus.has(agentName);
         const prev = this.lastAnnouncedLocus.get(agentName) ?? null;
         if (hasBaseline ? sameChannel(prev, locus) : locus === null) {
@@ -16565,7 +18796,7 @@ export class AgentFramework {
             const id = agent.getContextManager().addMessage('user', [{ type: 'text', text }], { system: true, kind: 'routing-notice' });
             // The baseline is what the agent was told: it moves once the notice is
             // stored, so a notice that fails is announced again at the next turn.
-            this.lastAnnouncedLocus.set(agentName, locus);
+            this.rememberAnnouncedLocus(agentName, locus);
             this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
             console.error(`[routing] ${agentName}: locus ${prev ? qualifiedChannelName(prev) : '(none)'} -> ${locus ? qualifiedChannelName(locus) : '(none)'} (announced in window)`);
         }
@@ -16581,7 +18812,11 @@ export class AgentFramework {
      * as the agent's first view) that addressed the agent, or that follows up
      * in a channel the turn sent into (TurnRouting.engaged). Undefined for any
      * other message. A tool boundary weighs the messages it injects by it,
-     * and noteArrival the ones no boundary of the turn weighs.
+     * and noteArrival the ones no boundary of the turn weighs. The rule is
+     * pure; what is done with its answer is `speech.locus`'s: under
+     * `'latest-inbound'` the locus moves, under `'delivery'` (the default) the
+     * agent is told it was addressed from elsewhere and the locus stays
+     * (addressedElsewhereNotice).
      */
     repinChannel(metadata, routing) {
         if (!isConversationalInjection(metadata))
@@ -16595,7 +18830,7 @@ export class AgentFramework {
         const channel = this.channelNamed(m.channelId, typeof m.serverId === 'string' ? m.serverId : undefined);
         if (!channel)
             return undefined;
-        if (isAddressedMessage(m.tags, m))
+        if (isAddressedMessage(m.tags))
             return channel;
         return routing.engaged.has(destinationKey(channel)) ? channel : undefined;
     }
@@ -16839,8 +19074,10 @@ export class AgentFramework {
      * Weigh a message that no tool boundary of the agent's open logical turn
      * will weigh: one that would re-pin the locus becomes one of the turn's
      * arrivals (TurnRouting.arrivals). A message the agent's own view leaves
-     * out, such as one a tune-out diverted (metadata.tuneOut), never enters
-     * its compiled view, so the agent won't see it, and it moves nothing.
+     * out (agentSees), such as one held from the residents (heldFromResidents,
+     * the admission stage's one predicate, which every resident's view filter
+     * reads) or another agent's stored context injection, never enters its
+     * compiled view, so the agent won't see it, and it moves nothing.
      */
     noteArrival(agentName, metadata, messageId) {
         const open = this.openLogical.get(agentName);
@@ -16852,17 +19089,19 @@ export class AgentFramework {
         if (isConversationalInjection(metadata))
             (open.heard ??= new Map()).set(messageId, ++lastHeardAt);
         const channel = this.repinChannel(metadata, open);
-        if (channel)
-            open.arrivals.push({ messageId, channel });
+        if (!channel)
+            return;
+        const tags = metadata?.tags;
+        open.arrivals.push({ messageId, channel, addressed: isAddressedMessage(tags) });
     }
     /**
      * Whether `agent`'s store is the residents' one message slot, which every
-     * ordinary resident reads (sharedSlotAgents). The subconscious reads that
+     * ordinary resident reads (`readsSharedSlot` in the registry). The subconscious reads that
      * slot through a merged view, but its own store is isolated, as a fork's
      * or an ephemeral agent's is.
      */
     isOrdinaryResident(agent) {
-        return this.sharedSlotAgents.has(agent) && agent.name !== this.subconsciousAgentName;
+        return this.registry.readsSharedSlot(agent.name) && agent.name !== this.subconsciousAgentName;
     }
     /**
      * Weigh a message just stored in an ordinary resident's store for every
@@ -16873,8 +19112,9 @@ export class AgentFramework {
     noteForOtherResidents(agent, metadata, messageId) {
         if (!this.isOrdinaryResident(agent))
             return;
-        for (const reader of this.sharedSlotAgents) {
-            if (reader !== agent && this.agents.get(reader.name) === reader && this.isOrdinaryResident(reader)) {
+        for (const name of this.registry.sharedSlotReaders()) {
+            const reader = this.agents.get(name);
+            if (reader && reader !== agent && this.isOrdinaryResident(reader)) {
                 this.noteSpokenTo(reader.name, metadata);
                 this.noteArrival(reader.name, metadata, messageId);
             }
@@ -16951,7 +19191,7 @@ export class AgentFramework {
         const metadata = { system: true, kind: 'routing-notice' };
         try {
             const id = agent.getContextManager().addMessage('user', content, metadata);
-            this.lastAnnouncedLocus.set(agent.name, channel);
+            this.rememberAnnouncedLocus(agent.name, channel);
             this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
             console.error(`[routing] ${agent.name}: ${cause} re-pin ${prevPin ? qualifiedChannelName(prevPin) : '(none)'} -> ${qualifiedChannelName(channel)}`);
             return { participant: 'user', content, metadata, id };
@@ -16961,6 +19201,73 @@ export class AgentFramework {
             return undefined;
         }
     }
+    /**
+     * Under `speech.locus: 'delivery'`: tell the agent that someone addressed
+     * it from another channel while its turn was busy, since incoming traffic
+     * never moves the locus and a neutral message carries nothing that names
+     * its channel (first live run, 2026-10-12, finding C). Once per channel
+     * per turn (TurnRouting.addressedElsewhere); nothing for the turn's own
+     * locus. Stored durably; returned as stored for a live stream to inject
+     * with its boundary's other messages. Undefined when nothing was stored.
+     */
+    addressedElsewhereNotice(agent, routing, channel, who, when = 'while you were busy') {
+        const pin = routing.locus ?? null;
+        const key = destinationKey(channel);
+        if (sameChannel(channel, pin) || routing.addressedElsewhere.has(key))
+            return undefined;
+        const where = pin ? `still lands in ${this.channelShown(pin)}` : 'stays in your archive (no channel)';
+        const content = [{
+                type: 'text',
+                text: 
+                // The author's name is a value someone supplied (main's #852: one
+                // line, its notice openings marked); the channel is shown as
+                // channelShown gives it.
+                `[${NOTICE_TAG.routing}] ${suppliedValue(who)} addressed you from ${this.channelShown(channel)} ${when}. ` +
+                    `Your plain speech ${where} this turn; reaching them takes an explicit send.`,
+            }];
+        const metadata = { system: true, kind: 'routing-notice' };
+        const before = this.storedCountOf(agent);
+        try {
+            const id = agent.getContextManager().addMessage('user', content, metadata);
+            routing.addressedElsewhere.add(key);
+            this.emitTrace({ type: 'message:added', messageId: id, source: 'routing-notice' });
+            return { participant: 'user', content, metadata };
+        }
+        catch (err) {
+            // A write can throw after its row landed, as storeInjections' can: a
+            // notice that landed is the turn's notice for the channel, as one
+            // stored without a throw is.
+            const text = content[0].text;
+            const landed = before === undefined ? undefined : this.storedSince(agent, before, (m) => m.metadata?.kind === 'routing-notice'
+                && m.content.some((b) => b.type === 'text' && b.text === text), 'routing', 'the addressed-elsewhere notice');
+            if (landed && landed.length > 0) {
+                routing.addressedElsewhere.add(key);
+                console.error(`addressed-elsewhere notice: ${agent.name}: the notice landed though its write threw:`, err);
+                return { participant: 'user', content, metadata };
+            }
+            console.error(`addressed-elsewhere notice: failed to record routing notice${landed ? '' : ' (whether it landed is unknown)'}:`, err);
+            return undefined;
+        }
+    }
+    /**
+     * The arrivals a start of the turn consumes under `speech.locus:
+     * 'delivery'`: each one that addressed the agent, whose message is still
+     * in the store, gets the addressed-elsewhere notice, oldest first. A
+     * follow-up in an engaged channel addressed nobody and is not announced.
+     */
+    noticeAddressedArrivals(agent, routing, arrivals, when) {
+        if (arrivals.length === 0)
+            return;
+        const cm = agent.getContextManager();
+        for (const { messageId, channel, addressed } of arrivals) {
+            if (!addressed)
+                continue;
+            const message = cm.getMessage(messageId);
+            if (!message)
+                continue;
+            this.addressedElsewhereNotice(agent, routing, channel, authorName(message.metadata), when);
+        }
+    }
     /**
      * Durable window notice for a channel the agent did not ask to open: a
      * subscription-policy admission, announced as the decision before its
@@ -17142,7 +19449,7 @@ export class AgentFramework {
     canCloseChannels(who, channels) {
         if (who === undefined)
             return false;
-        const home = this.conversationAgentHomes.get(who);
+        const home = this.homeOf(who);
         return channels.every((channel) => !home || sameChannel(home, channel)) && this.canAgentUseTool(who, 'channel_close');
     }
     /**
@@ -17165,7 +19472,7 @@ export class AgentFramework {
     holdsChannelTraffic(who, channels) {
         if (who === undefined)
             return false;
-        const home = this.conversationAgentHomes.get(who);
+        const home = this.homeOf(who);
         if (home !== undefined) {
             return channels.every((channel) => sameChannel(channel, home) && this.conversationRouter?.getBinding(channel)?.agentName === who);
         }
@@ -17182,8 +19489,14 @@ export class AgentFramework {
      * otherwise the delivery agent and the readers of the residents' shared slot do. An ephemeral run holds none.
      */
     holdsChannelTrafficForTools(who) {
-        if (this.conversationAgentHomes.has(who))
+        if (this.registry.homeChannel(who) !== undefined)
             return true;
+        // An agent that shares its source's context (a reader fork) shares its
+        // source's words too: its tool block is the source's prefix, and a
+        // sentence that differed would send the whole window uncached.
+        const inherit = this.registry.get(who)?.inherit;
+        if (inherit?.mode === 'shared' && inherit.from !== who)
+            return this.holdsChannelTrafficForTools(inherit.from);
         if (this.conversationRouter)
             return false;
         return this.residentHoldsTraffic(who);
@@ -17206,7 +19519,7 @@ export class AgentFramework {
      * notice passed on later, at resume or at boot, names it by its name.
      */
     agentForPrimary(agentName) {
-        const home = this.conversationAgentHomes.get(agentName);
+        const home = this.homeOf(agentName);
         if (home === undefined)
             return { first: agentName, again: agentName };
         const label = this.channelRegistry?.getDescriptor(home)?.label;
@@ -17227,7 +19540,7 @@ export class AgentFramework {
     /** Whether `agentName` is a conversation fork made from the primary: the
      *  router's template is the primary (connectome-host's is). */
     forkOfPrimary(agentName) {
-        return this.conversationAgentHomes.has(agentName) && this.primaryAgentName !== null &&
+        return this.registry.homeChannel(agentName) !== undefined && this.primaryAgentName !== null &&
             this.conversationRouter?.templateAgent === this.primaryAgentName;
     }
     /**
@@ -17287,7 +19600,7 @@ export class AgentFramework {
             return [];
         }
         const who = ended ? primary : agentName || this.deliveryAgent()?.name;
-        const canOpen = who !== undefined && !this.conversationAgentHomes.has(who) && this.canAgentUseTool(who, 'channel_open');
+        const canOpen = who !== undefined && this.registry.homeChannel(who) === undefined && this.canAgentUseTool(who, 'channel_open');
         const canClose = this.canCloseChannels(who, [{ serverId, channelId: channel.channelId }]);
         const selected = selectedForOpening === 'unrecorded'
             ? " It stays selected for opening, because the host couldn't record undoing that: a later delivery or reconnect tries again"
@@ -17329,7 +19642,7 @@ export class AgentFramework {
         };
         const notices = [];
         if (tellPrimary) {
-            const primaryCanOpen = !this.conversationAgentHomes.has(primary) && this.canAgentUseTool(primary, 'channel_open');
+            const primaryCanOpen = this.registry.homeChannel(primary) === undefined && this.canAgentUseTool(primary, 'channel_open');
             const reader = this.agentForPrimary(who);
             notices.push({
                 text: `[${NOTICE_TAG.channels}] Not open: ${shown}. A reply from ${reader.first} went out there, but opening the channel failed, and ${reader.again} can't close it.` +
@@ -17408,7 +19721,7 @@ export class AgentFramework {
             return;
         // A subagent's run ends with its result; a conversation fork answers
         // its home channel's message.
-        if (this.ephemeralRuns.has(name) || this.conversationAgentHomes.has(name))
+        if (this.ephemeralRuns.has(name) || this.registry.homeChannel(name) !== undefined)
             return;
         if (this.providerAdmissionClosed || this.agents.get(name) !== agent) {
             console.error(`[continue] ${name}: not continued — ${this.providerAdmissionClosed ? 'the framework is stopping' : 'the agent is no longer registered'}`);
@@ -18302,7 +20615,7 @@ export class AgentFramework {
         }
     }
     async startAgentStream(agent, trigger, attempt = 0, providerGateAlreadyHeld = false) {
-        const ownsProviderGate = !this.ephemeralRuns.has(agent.name) && !this.conversationAgentHomes.has(agent.name);
+        const ownsProviderGate = this.registry.ownsProviderScheduling(agent.name);
         // A stopping framework starts no turn, whoever owns provider admission
         // (conversation agents and ephemeral runs do not take the gate).
         if (this.providerAdmissionClosed) {
@@ -19175,12 +21488,29 @@ export class AgentFramework {
             // A turn in a mode with a locus reads its arrivals' messages, a turn
             // with no channel (noChannel) included: an addressed message, or a
             // follow-up where the turn sent, gives it its channel, as a re-pin does.
-            const arrival = turnProseRouting === 'locus' || turnProseRouting === 'hybrid'
+            // Under `speech.locus: 'delivery'` an arrival moves nothing; one that
+            // addressed the agent from another channel is announced instead, as a
+            // boundary would have announced it (addressedElsewhereNotice).
+            const routesLocus = turnProseRouting === 'locus' || turnProseRouting === 'hybrid';
+            const arrivals = routing.arrivals;
+            const arrival = routesLocus && this.speechLocus === 'latest-inbound'
                 ? this.remainingArrival(agent, routing)
                 : undefined;
             routing.arrivals = [];
             if (arrival)
                 this.repinTurnLocus(agent, routing, arrival, 'arrival');
+            else if (routesLocus && this.speechLocus === 'delivery') {
+                // Which start this is, since from inside they look alike and the
+                // reason says whether the earlier prose landed (Linn, 2026-10-14).
+                const when = attempt > 0
+                    ? 'while your turn was retried'
+                    : trigger?.reason === 'context_budget_restart'
+                        ? 'at your budget restart'
+                        : isTurnContinuation(trigger?.reason ?? '')
+                            ? 'before this re-inference on your tool results'
+                            : 'while your turn waited on a provider hold';
+                this.noticeAddressedArrivals(agent, routing, arrivals, when);
+            }
         }
         // A silent start, or a disabled agent's, has no locus to show, whatever a
         // channel_open in a silent turn left on its object.
@@ -19379,7 +21709,7 @@ export class AgentFramework {
             // can record a wait while this turn compiles, after the last boundary
             // checked. Check its waits again here, where nothing has been sent, and
             // hold the turn as the boundary would rather than send it into the wait.
-            if (this.conversationAgentHomes.has(agent.name)) {
+            if (this.registry.homeChannel(agent.name) !== undefined) {
                 const wait = this.providerWaits?.active(agent.name, agent.model);
                 // The turn has begun (inference:started), so the hold keeps its retry.
                 if (wait && this.holdForProviderWait(agent, wait, trigger ? [asTurnRetry(withTurnCarry(trigger, carry))] : [], false, () => {
@@ -19401,8 +21731,9 @@ export class AgentFramework {
                 })) {
                     console.error(`[provider-wait] agent=${agent.name} model=${agent.model} binds after the compile ` +
                         `(recorded while the turn compiled); ${this.providerAdmissionClosed ? 'the framework is stopping, so nothing is held'
-                            : this.providerAccelerationCooldowns.get(agent.name)?.heldRequests.some(isTurnRetry) ? 'turn held'
-                                : 'the wait was released as the failure was reported, so the retry is queued'}, nothing sent`);
+                            : this.agents.get(agent.name) !== agent ? 'the agent ended as the failure was reported, so nothing is held'
+                                : this.providerAccelerationCooldowns.get(agent.name)?.heldRequests.some(isTurnRetry) ? 'turn held'
+                                    : 'the wait was released as the failure was reported, so the retry is queued'}, nothing sent`);
                     this.endFailureAtStop(agent.name, turnToken, turnStartedAt, routing);
                     this.activeStreams.delete(agent.name);
                     this.pendingAssistantBlocks.delete(agent.name);
@@ -21032,7 +23363,7 @@ export class AgentFramework {
                                 .map((b) => b)
                                 .filter((c) => typeof c.name === 'string' && !cutIds.has(c.id)
                                 && markedInputRefusal({ ...c, name: c.name }) === undefined
-                                && this.canAgentUseTool(agent.name, c.name));
+                                && this.mayCallTool(agent.name, c.name));
                             const toolNames = toolCalls.map((c) => c.name);
                             // A refused skip_reply isn't a silencing call; a plain one is.
                             const fallbackCause = liveProseRouting
@@ -21909,7 +24240,7 @@ export class AgentFramework {
             // turn isn't over (pendingContinuationAgents).
             if (frameReachedTerminal && ownsPhysicalStream && this.closingConversationAgents.has(agent.name)
                 && !this.pendingContinuationAgents().has(agent.name)) {
-                this.disposeConversationAgent(agent.name);
+                this.disposeConversationAgent(agent.name, 'idle-ttl');
             }
         }
     }
@@ -21929,8 +24260,10 @@ export class AgentFramework {
      * (ctx.callTool → executeToolCallFrom with {kind:'module'}), which is exempt
      * from agent allowlists. Registered agents' allowedTools is enforced at
      * dispatch, including namespaced utility names. Genuinely unidentified public callers (including
-     * unknown legacy names) remain unrestricted. Framework-created identities
-     * are refused while unregistered, even if their configured list allows it.
+     * unknown legacy names) remain unrestricted. A name the framework made in
+     * this process is refused while it isn't registered, even if its configured
+     * list allows the tool; after a restart, such a name is a host's caller name
+     * like any other.
      */
     async executeToolCall(call) {
         return this.executeToolCallFrom(call, {
@@ -22188,7 +24521,11 @@ export class AgentFramework {
         // synthesized verbs (think, skip_reply) are deliberately not routed
         // here.
         if (call.name.startsWith('channel_') && this.channelRegistry) {
-            return this.channelRegistry.handleChannelToolCall(call.name, call.input, origin);
+            const turn = call.name === 'channel_publish' && call.callerAgentName ? this.callingTurnOf(call.callerAgentName, call) : undefined;
+            const input = call.name === 'channel_publish' && call.callerAgentName
+                ? this.publishInputWithTurnLocus(call.input, call.callerAgentName, turn)
+                : call.input;
+            return this.channelRegistry.handleChannelToolCall(call.name, input, origin.kind === 'agent' && turn ? { ...origin, inTurn: true } : origin);
         }
         // drafts: the calling resident's own held drafts. A puppeted call has
         // agent origin and acts on that resident's drafts, as the model's own
@@ -22209,6 +24546,20 @@ export class AgentFramework {
         // Module tools. The caller uses the result in process, so it gets the
         // module's own result, as the module returned it, less a refusal it
         // claims, which is the dispatcher's to say.
+        // The tune-out tool, in process: the same body the dispatcher runs, its
+        // answer awaited here (it can wait for the tune-out's transport).
+        if ((call.name === 'tune_out' || call.name === 'focus') && this.tuneOutCoordinator) {
+            const agentName = call.callerAgentName ?? this.primaryAgentName ?? '__ephemeral__';
+            const input = (call.input ?? {});
+            // The calling turn's own channels, as the channel tools read them here (origin.own).
+            const own = origin.kind === 'agent' ? origin.own ?? [] : [];
+            const turn = this.callingTurnOf(agentName, call);
+            return call.name === 'focus' ? this.handleFocusTool(agentName, input, own, turn) : this.handleTuneOutTool(agentName, input, own, turn);
+        }
+        if (SUBCONSCIOUS_TOOL_NAMES.includes(call.name)) {
+            const routed = this.readerToolCall(origin.kind === 'agent' ? origin.agentName : call.callerAgentName ?? '__ephemeral__', call);
+            return 'refused' in routed ? failed({ success: false, error: `${routed.refused}, so the call didn't run.`, isError: true }) : routed.result;
+        }
         return this.moduleRegistry.handleToolCall(call);
     }
     /**
@@ -22249,6 +24600,39 @@ export class AgentFramework {
         (this.toolsetActCalls ??= new WeakMap()).set(inner, target.instance !== undefined ? { instance: target.instance } : {});
         return { ok: true, call: inner, serverId: target.serverId, prefix, ...(target.instance !== undefined ? { instance: target.instance } : {}) };
     }
+    /**
+     * A reader reads and reports: a reader fork (registry kind
+     * 'subconscious-fork', in every incarnation) may call only its own tools,
+     * and speak_in_channel where allowChannelSpeech allows it. Every other
+     * tool the resident has stays in its block (the shared prefix) and is
+     * refused here, so with speech off a fork can post nowhere (scout's
+     * condition, 2026-10-19). It's decided at each call from what the reader
+     * may call, not from what it is shown, so a tool added or moved out of
+     * the block later is refused too.
+     */
+    readerRefuses(agentName, toolName) {
+        if (this.registry.get(agentName)?.kind !== 'subconscious-fork')
+            return false;
+        return !this.readerMayCall(agentName, toolName);
+    }
+    /**
+     * What a reader fork may call: exactly its own tools and the speech its
+     * configuration allows, never widened or narrowed by its resident's
+     * allowedTools. The resident's list bounds the resident's own surface;
+     * the reader's tools are the framework's, for reading on its behalf. A
+     * denyToolsAtDispatch entry the fork takes from its resident that names
+     * one of them still refuses it (mayCallTool checks the deny first): a
+     * resident never holds a reader tool, so such an entry is about readers.
+     * The fork still shows its resident's block (the shared prefix): what it
+     * may call is decided here, at each call, apart from what it is shown.
+     */
+    readerMayCall(agentName, toolName) {
+        if (this.registry.get(agentName)?.kind !== 'subconscious-fork')
+            return false;
+        if (toolName === 'speak_in_channel')
+            return this.subconsciousConfig?.allowChannelSpeech === true;
+        return SUBCONSCIOUS_TOOL_NAMES.includes(toolName);
+    }
     /** A toolsets--act call a host toolset resolved (HostPresentation.resolveAct):
      *  its refusal answered, or the tool's own call dispatched in its place,
      *  with the act's id, so its result is the act's. */
@@ -23857,24 +26241,40 @@ export class AgentFramework {
         }
         return best;
     }
-    /** Registered policy; framework-created identities have no dispatch authority
-     * while unregistered. Genuine legacy caller names retain their surface. */
+    /** Registered policy. Within this process, a name the framework made has no
+     * dispatch authority while it isn't registered; after a restart, a host call names
+     * its caller as any host call does. Genuine legacy caller names retain
+     * their surface. */
     canAgentUseTool(agentName, toolName) {
         const agent = this.agents.get(agentName);
         return agent ? agent.canUseTool(toolName) : !this.usedEphemeralAgentNames.has(agentName);
     }
+    /** Whether a call of `toolName` as `agentName` is refused at dispatch (AgentConfig.denyToolsAtDispatch, or a reader's own rule). */
+    deniedAtDispatch(agentName, toolName) {
+        return this.agents.get(agentName)?.deniesAtDispatch(toolName) === true || this.readerRefuses(agentName, toolName);
+    }
+    /** Whether `agentName` may call `toolName`: the one rule dispatch applies (agentToolPermissionFailure), for whatever else judges a call. */
+    mayCallTool(agentName, toolName) {
+        return !this.deniedAtDispatch(agentName, toolName)
+            && (this.canAgentUseTool(agentName, toolName) || this.readerMayCall(agentName, toolName));
+    }
     agentToolPermissionFailure(agentName, call, reportRefusal = true) {
-        if (this.canAgentUseTool(agentName, call.name))
+        // A tool refused at dispatch is refused on every path that runs the
+        // agent's call (a toolset's act, executeToolCall), not only the stream's.
+        if (this.mayCallTool(agentName, call.name))
             return undefined;
-        const why = !this.agents.has(agentName) && this.usedEphemeralAgentNames.has(agentName)
-            ? `Caller '${agentName}' is not a running agent; framework-created agents have tool authority only while registered`
-            : `Tool '${call.name}' is not permitted by this agent's allowedTools`;
+        const denied = this.deniedAtDispatch(agentName, call.name);
+        const why = denied
+            ? `${call.name} is not available to ${agentName}`
+            : !this.agents.has(agentName) && this.usedEphemeralAgentNames.has(agentName)
+                ? `Caller '${agentName}' is not a running agent; framework-created agents have tool authority only while registered`
+                : `Tool '${call.name}' is not permitted by this agent's allowedTools`;
         // Off the dispatcher, nothing opened the call to refuse it in RFC-007's
         // lifecycle, so it's a failure, not a refusal (ToolResult.refused), whose
         // text says the call didn't run.
         if (!reportRefusal)
             return { success: false, error: `${why}, so the call didn't run.`, isError: true };
-        const error = `${why}.`;
+        const error = denied ? why : `${why}.`;
         const refusal = this.refusedResult(agentName, call.id, error);
         this.emitTrace({
             type: 'tool:failed', module: 'framework', tool: call.name, callId: call.id, error,
@@ -23937,7 +26337,7 @@ export class AgentFramework {
      * (`refusedHere`) counts as one the list refuses.
      */
     roundCallOf(agentName, call, refusedHere = false) {
-        const permitted = !refusedHere && markedInputRefusal(call) === undefined && this.canAgentUseTool(agentName, call.name);
+        const permitted = !refusedHere && markedInputRefusal(call) === undefined && this.mayCallTool(agentName, call.name);
         const refused = bareToolName(call.name) === 'skip_reply' && (!permitted || this.refusesSelfWake(call));
         return { name: call.name, cause: permitted || refused ? silenceCauseOf([call]) : null, refused, permitted };
     }
@@ -23960,6 +26360,23 @@ export class AgentFramework {
             });
             return;
         }
+        // Dispatch-time deny (AgentConfig.denyToolsAtDispatch): the tool stays
+        // advertised so the agent's request prefix is unchanged; the call is
+        // refused here, before anything runs.
+        if (this.deniedAtDispatch(agentName, call.name)) {
+            const error = `${call.name} is not available to ${agentName}`;
+            const result = this.refusedResult(agentName, call.id, error);
+            this.emitTrace({ type: 'tool:failed', module: 'dendrite', tool: call.name, callId: call.id, error });
+            this.pushEvent({
+                type: 'tool-result',
+                callId: call.id,
+                toolName: call.name,
+                agentName,
+                moduleName: 'dendrite',
+                result,
+            });
+            return;
+        }
         const refusal = this.agentToolPermissionFailure(agentName, call) ?? this.markedInputFailure(agentName, call);
         if (refusal) {
             this.pushEvent({
@@ -24037,18 +26454,22 @@ export class AgentFramework {
             return;
         }
         // Route the tune-out tool (residents) and the subconscious's surface
-        if (enrichedCall.name === 'tune_out' && this.tuneOutCoordinator) {
+        if ((enrichedCall.name === 'tune_out' || enrichedCall.name === 'focus') && this.tuneOutCoordinator) {
             this.dispatchTuneOutToolCall(agentName, enrichedCall);
             return;
         }
-        if (this.tuneOutCoordinator &&
-            agentName === this.subconsciousAgentName &&
-            SUBCONSCIOUS_TOOL_NAMES.includes(enrichedCall.name)) {
-            void this.tuneOutCoordinator
-                .handleSubconsciousTool(enrichedCall.name, enrichedCall.input, this.callOwnChannels(agentName, enrichedCall))
-                // A rejection is answered with a failed result, as a framework tool's
-                // dispatch failure is (dispatchAgentSettingsToolCall), never left unhandled.
-                .catch((err) => ({ success: false, error: thrownText(err), isError: true }))
+        if (SUBCONSCIOUS_TOOL_NAMES.includes(enrichedCall.name)) {
+            const routed = this.readerToolCall(agentName, enrichedCall);
+            if ('refused' in routed) {
+                const error = routed.refused;
+                const result = this.refusedResult(agentName, call.id, error);
+                this.emitTrace({ type: 'tool:failed', module: 'tune-out', tool: call.name, callId: call.id, error });
+                this.pushEvent({
+                    type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tune-out', result,
+                });
+                return;
+            }
+            void routed.result
                 .then((result) => {
                 // Through pushEvent, like every other tool's result, so one that
                 // arrives after stop() is dropped rather than rejected unhandled.
@@ -24369,6 +26790,7 @@ export class AgentFramework {
             opts.placement.agent = agent.name;
             opts.placement.messageId = stored;
         }
+        this.releaseLandedMail(metadata, agent.name);
         this.noteStored(agent, metadata, stored, opts?.bypassDeferralFor);
         return stored;
     }
@@ -24528,6 +26950,38 @@ export class AgentFramework {
         }
         this.noteForOtherResidents(agent, metadata, stored);
     }
+    /**
+     * Held agent mail is released only when its message has actually entered
+     * the recipient's store — never on a deferral. Called at every site that
+     * writes a message into a context: the direct path above and the two
+     * deferred-write flushes (turn start, tool boundary). Both writes reach
+     * disk in the same sync, so a crash keeps either both or neither.
+     */
+    releaseLandedMail(metadata, recipient) {
+        const stamp = metadata?.dendrite;
+        if (typeof stamp?.mailId !== 'string')
+            return;
+        // The message is in the recipient's store; the release is written only
+        // once the store has synced it, so a hard exit between the two leaves
+        // the mail held and the next boot's check of the recipient's store
+        // settles it — never a release on disk for a message that isn't (nissa's
+        // #546 review, round 2, K). A sync that fails leaves it held the same way.
+        try {
+            this.store.sync();
+        }
+        catch (error) {
+            console.error(`[dendrite] mail ${stamp.mailId} landed for ${recipient} but the store did not sync, so it stays held until the next boot settles it:`, error);
+            return;
+        }
+        this.registry.releaseMail(stamp.mailId);
+        this.emitTrace({
+            type: 'dendrite:mail-delivered',
+            mailId: stamp.mailId,
+            kind: String(stamp.kind ?? 'message'),
+            from: String(stamp.from?.agent ?? ''),
+            to: recipient,
+        });
+    }
     /**
      * Splice out the deferred messages addressed to `agentName` (explicitly
      * via forAgent, or implicitly when it is the primary), leaving other
@@ -24968,6 +27422,8 @@ export class AgentFramework {
     flushForStart(agent, occasion) {
         const stored = this.writeDrainedInOrder(this.drainDeferredFor(agent.name), `${occasion} flush for ${agent.name}`, (msg) => agent.getContextManager().addMessage(msg.participant, msg.content, withDeferredWriteId(msg.metadata, msg.id)));
         for (const [msg, { id }] of stored) {
+            // Held mail whose message just landed is released (Dendrite).
+            this.releaseLandedMail(msg.metadata, agent.name);
             this.emitTrace({ type: 'message:added', messageId: id, source: `deferred-flush:${occasion}` });
             this.noteSpokenTo(agent.name, msg.metadata);
             this.noteArrival(agent.name, msg.metadata, id);
@@ -25540,7 +27996,7 @@ export class AgentFramework {
         // target never read it (passesToPrimary); addMessage takes it off any
         // other write.
         const forRun = opts?.forAgent !== undefined
-            && (this.ephemeralRuns.has(opts.forAgent) || this.conversationAgentHomes.has(opts.forAgent));
+            && (this.ephemeralRuns.has(opts.forAgent) || this.registry.homeChannel(opts.forAgent) !== undefined);
         const placement = {};
         const id = this.addMessage(participant, content, forRun ? { ...metadata, [PRIMARY_IF_UNREAD_KEY]: true } : metadata, {
             placement, ...(opts?.forAgent !== undefined ? { forAgent: opts.forAgent } : {}), ...(forRun ? { markedForRun: true } : {}),
@@ -25551,7 +28007,7 @@ export class AgentFramework {
      * The writes the framework holds for the store `reader` reads, in queue
      * order: those addressed to it and, when it's an ordinary resident, those
      * addressed to any ordinary resident, since residents share one message
-     * slot (sharedSlotAgents). A write whose target is gone isn't among them:
+     * slot (`readsSharedSlot` in the registry). A write whose target is gone isn't among them:
      * no module reads that agent's store, and the write waits for its window's
      * release (drainDeferredFor) or, at its flush, is dropped (addMessage), a
      * failed reply, or a channel notice its reader could act on, passing to the
@@ -25944,6 +28400,12 @@ export class AgentFramework {
             bounded.error = boundFailureText(bounded.error);
         if (typeof bounded.stack === 'string')
             bounded.stack = boundFailureText(bounded.stack);
+        if (this.earlyTraces) {
+            if (this.earlyTraces.length < 1000)
+                this.earlyTraces.push(traceEvent);
+            else
+                this.earlyTracesDropped++;
+        }
         // An event goes to the subscriptions present when its delivery starts,
         // each one only if it is still active when its turn comes, as the DOM's
         // EventTarget delivers: a subscription made during delivery waits for the
@@ -26565,10 +29027,11 @@ export class AgentFramework {
             this.mcplPrefixMap.set(prefix, config.id);
             this.setMcplServerConfig(config);
         }
-        // Find shouldTriggerInference callback:
-        // Per-server callback takes precedence; fall back to EventGate; fall back to no filter.
-        const triggerFilter = serverConfigs.find(c => c.shouldTriggerInference)?.shouldTriggerInference
-            ?? (this.eventGate ? this.eventGate.asShouldTriggerCallback() : undefined);
+        // The server-level veto on waking (a per-server shouldTriggerInference).
+        // The wake gate is deliberately NOT wired into the inbound lanes any
+        // more: it runs in the admission stage, after the hold decision, so a
+        // held message never forms a gate batch (#232 gap 3, root cause A).
+        const triggerFilter = serverConfigs.find(c => c.shouldTriggerInference)?.shouldTriggerInference;
         // Push events handler (Step 6)
         this.installPushCoalescer(coalescing);
         this.pushHandler = new PushHandler(this.featureSetManager, (event) => this.pushEvent(event), (event) => this.emitTrace(event), triggerFilter, (serverId, params, event) => this.handleCoalescedPush(serverId, params, event), 
@@ -26601,13 +29064,29 @@ export class AgentFramework {
                 }
             },
             shouldTriggerInference: triggerFilter,
+            latestInboundLocus: this.speechLocus === 'latest-inbound',
+            // A tool close of the channel an all-except hold excepts ends that
+            // hold through the cancel flow, since there is nothing left to speak
+            // into. A tool close of a tuned-out channel is refused
+            // before this hook is called (ChannelRegistry.tunedOutRefusal).
+            onToolClose: (serverId, channelId) => {
+                const coordinator = this.tuneOutCoordinator;
+                if (!coordinator)
+                    return undefined;
+                const scope = coordinator.getAllExcept();
+                if (!scope || scope.params.except.serverId !== serverId || scope.params.except.channelId !== channelId)
+                    return undefined;
+                coordinator.cancelAllExcept('channel-close', 'the excepted channel was closed');
+                return 'The focus on it ended all the same, and what the other channels held was delivered.';
+            },
+            focusChannelResolver: () => this.tuneOutCoordinator?.focusChannel() ?? null,
             // Route a conversation fork's plain-text speech to its HOME channel, not
             // the process-global most-recent-inbound locus (item 3). The trunk agent
             // has no home entry, so this returns undefined and routeSpeech falls back
-            // to defaultPublishChannel. `conversationAgentHomes` is the permanent
+            // to defaultPublishChannel. The registry's `homeChannel` is the permanent
             // spawn-time binding; `channelForAgent` is the router's live binding as a
             // belt-and-suspenders fallback.
-            homeChannelResolver: (agentName) => this.conversationAgentHomes.get(agentName)
+            homeChannelResolver: (agentName) => this.homeOf(agentName)
                 ?? this.conversationRouter?.channelForAgent(agentName),
             // A single TRUNK agent's channel for its CURRENT turn (item-3 redux):
             // its locus once the turn has one, a re-pin's or a channel_open's
@@ -27436,6 +29915,9 @@ export class AgentFramework {
      */
     makeHostPresentation(storePath) {
         return new HostPresentation({
+            // A derived agent showing its parent's tool list (toolSurfaceOwners) is
+            // shown its parent's presentation too, so the two blocks stay one.
+            ownerOf: (agentName) => this.toolSurfaceOwners.get(agentName) ?? agentName,
             // As the agent is shown them: its description overrides applied.
             available: (agentName) => (this.agents.has(agentName) ? this.compressionToolsForAgent(agentName) : this.getAllTools()),
             placedInBuiltin: (name) => this.placedInBuiltin(name),
@@ -30445,7 +32927,7 @@ export class AgentFramework {
         // ones; channel_open is rejected outright — opening channels mutates
         // framework-global state (the open-channel set every agent's channel
         // context is built from), which is not a fork's call to make.
-        const home = this.conversationAgentHomes.get(agentName);
+        const home = this.homeOf(agentName);
         if (home) {
             const reject = (error) => {
                 // RFC-007: the guard refuses before the tool runs — no lifecycle events.
@@ -30547,8 +33029,11 @@ export class AgentFramework {
         const publisher = call.name === 'channel_publish' && callingTurn ? this.agents.get(agentName) : undefined;
         const readThrough = publisher ? this.publishReadThrough(publisher, call.id) : null;
         const published = {};
-        this.channelRegistry.handleChannelToolCall(call.name, call.input, {
-            kind: 'agent', agentName, own: callingTurn ? this.ownChannels(callingTurn) : [], ...(earlierWake ? { earlierWake } : {}),
+        const channelInput = call.name === 'channel_publish'
+            ? this.publishInputWithTurnLocus(call.input, agentName, callingTurn)
+            : call.input;
+        this.channelRegistry.handleChannelToolCall(call.name, channelInput, {
+            kind: 'agent', agentName, own: callingTurn ? this.ownChannels(callingTurn) : [], ...(callingTurn ? { inTurn: true } : {}), ...(earlierWake ? { earlierWake } : {}),
         }, published)
             .then((result) => {
             const destination = published.outcome?.status === 'delivered' ? published.outcome.destination : undefined;
@@ -30597,7 +33082,7 @@ export class AgentFramework {
                         && this.openLogical.get(agentName) === callingTurn) {
                         callingTurn.locus = opened;
                         noteTurnChannel(callingTurn, opened);
-                        this.lastAnnouncedLocus.set(agentName, opened);
+                        this.rememberAnnouncedLocus(agentName, opened);
                         const inboundOnlyServer = this.channelRegistry?.inboundOnlyServer(opened);
                         // The routing word comes first, ahead of any backscroll, so a
                         // result cut to its head for being long keeps it.
@@ -30847,6 +33332,26 @@ export class AgentFramework {
             finish({ success: false, error: msg, isError: true });
         }
     }
+    /**
+     * A reader's own tool (SUBCONSCIOUS_TOOL_NAMES), for both entries that run
+     * an agent's call: the dispatcher's, for the model's call, and
+     * executeToolCallFrom's, for a host's or the puppet's. The tools are
+     * advertised to residents so reader forks share their prefix, and only a
+     * registered reader may use them. A rejection is answered with a failed
+     * result, never left unhandled.
+     */
+    readerToolCall(agentName, call) {
+        const isReader = agentName === this.subconsciousAgentName || this.registry.get(agentName)?.kind === 'subconscious-fork';
+        if (!this.tuneOutCoordinator || !isReader)
+            return { refused: `${call.name} is available to the resident's reader, not to ${agentName}` };
+        const epoch = this.registry.get(agentName)?.metadata?.epochId;
+        const fork = agentName === this.subconsciousAgentName ? undefined : { epochId: typeof epoch === 'string' ? epoch : undefined };
+        return {
+            result: this.tuneOutCoordinator
+                .handleSubconsciousTool(call.name, call.input, this.callOwnChannels(agentName, call), agentName, fork)
+                .catch((err) => ({ success: false, error: thrownText(err), isError: true })),
+        };
+    }
     /**
      * Handle the synthesized `sleep` / `wake` tools. `sleep` arms the gate's
      * suppression window, optionally announces in the sticky channel, and ends
@@ -30854,123 +33359,266 @@ export class AgentFramework {
      */
     /** tune_out tool (residents): enter or cancel a channel tune-out. */
     dispatchTuneOutToolCall(agentName, call) {
-        const coordinator = this.tuneOutCoordinator;
         const input = (call.input ?? {});
-        const name = String(input.channelId ?? '');
         // Inside the calling turn, a name one of the turn's own channels answers
         // to by its id means that channel, as for the channel tools
-        // (ChannelRegistry.ownChannelFor). Otherwise the one channel the name
-        // means, which may be server-qualified; a name two servers' channels
-        // answer to is refused with them as candidates, never taken to be the
-        // first registered.
-        const mine = this.channelRegistry?.ownChannelFor(name, this.callOwnChannels(agentName, call));
-        const named = mine ? ('channel' in mine ? [mine.channel] : []) : this.channelRegistry?.channelsNamed(name) ?? [];
-        const shared = mine && 'error' in mine ? mine.error
-            : named.length > 1 ? this.channelRegistry?.sharedNameRefusalFor(name) : undefined;
-        const channel = named.length === 1 ? named[0] : undefined;
-        const channelId = channel?.channelId ?? name;
+        // (ChannelRegistry.ownChannelFor): read here, while the call is the
+        // turn's, before the answer can wait.
+        const own = this.callOwnChannels(agentName, call);
+        const turn = this.callingTurnOf(agentName, call);
+        // The answer can wait for the tune-out's transport (openForTuneOut), so
+        // the result goes through pushEvent when it is known, as every other
+        // tool's does; a rejection is answered too, never left unhandled.
+        void (call.name === 'focus' ? this.handleFocusTool(agentName, input, own, turn) : this.handleTuneOutTool(agentName, input, own, turn))
+            .catch((err) => ({ success: false, error: thrownText(err), isError: true }))
+            .then((result) => {
+            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tune-out', result });
+        });
+    }
+    /** `focus` is `tune_out` with scope "all-except". */
+    handleFocusTool(agentName, input, own = [], turn) {
+        return this.handleTuneOutTool(agentName, { ...input, scope: 'all-except' }, own, turn);
+    }
+    /**
+     * A tune-out call's refusal for a channel it can't resolve: main's words
+     * for a name no registered channel, and none of the calling turn's own,
+     * answers to, and the registry's own otherwise, as for an id that is
+     * ambiguous across servers (#232 gap 8).
+     */
+    unknownChannelWords(channelId, resolution, own) {
+        const known = (this.channelRegistry?.channelsNamed(channelId).length ?? 0) > 0
+            || own.some((c) => c.channelId === channelId);
+        return known ? resolution : `unknown channel: ${channelId}`;
+    }
+    /**
+     * The tune_out tool's body. Channel resolution is server-qualified
+     * (ChannelRegistry.resolveChannel): with a `serverId`, that server's
+     * channel with the id; inside the calling turn, a name one of the turn's
+     * own channels answers to by its id means that channel; otherwise the one
+     * channel the name means, which may be server-qualified, and a name two
+     * servers' channels answer to is refused with them as candidates (#232
+     * gap 8). `turn` is the turn that made the call (callingTurnOf), the only
+     * one whose speech an all-except entry moves.
+     */
+    async handleTuneOutTool(agentName, input, own = [], turn) {
+        const coordinator = this.tuneOutCoordinator;
+        const channelRegistry = this.channelRegistry;
+        if (!coordinator || !channelRegistry) {
+            return { success: false, error: 'tune-out is not available (no MCPL channels)', isError: true };
+        }
+        // An open that throws is answered too, never left unhandled.
+        const openThrew = (err) => 'The tune-out is recorded, but its messages may not reach the subconscious, since opening its channel ' +
+            `failed: ${thrownText(err)}`;
+        const serverId = typeof input.serverId === 'string' && input.serverId ? input.serverId : undefined;
+        const allExcept = input.scope === 'all-except';
+        if (input.mode === 'check') {
+            // A peek's name means what the other modes' names mean: the one
+            // channel it picks, by its id or the server-qualified name the agent
+            // is shown where another server shares the id, or inside the turn one
+            // of the turn's own channels (resolveChannel), and its lines are that
+            // channel's, on its server.
+            let peek;
+            if (typeof input.peek === 'string' && input.peek) {
+                const resolved = channelRegistry.resolveChannel(input.peek, serverId, own);
+                if ('error' in resolved)
+                    return { success: false, error: this.unknownChannelWords(input.peek, resolved.error, own), isError: true };
+                peek = { serverId: resolved.serverId, channelId: resolved.channelId };
+            }
+            // Read as the other options are (readOptions): a numeric string is its
+            // number, and a value that gives none is refused, named.
+            const peekLimit = input.peekLimit == null ? undefined : Number(input.peekLimit);
+            if (peekLimit !== undefined && !Number.isFinite(peekLimit)) {
+                const got = typeof input.peekLimit === 'string' ? `the string ${JSON.stringify(input.peekLimit)}` : `the value ${JSON.stringify(input.peekLimit)}`;
+                return { success: false, error: `Nothing was checked: peekLimit must be a finite number of lines, and it was ${got}. Leave it out for 5.`, isError: true };
+            }
+            return { success: true, data: coordinator.check({ ...(peek ? { peek } : {}), ...(peekLimit !== undefined ? { peekLimit } : {}) }) };
+        }
+        if (input.mode === 'cancel' && (allExcept || (!input.channelId && coordinator.getAllExcept()))) {
+            const r = coordinator.cancelAllExcept('agent-tool', 'agent request');
+            return r.ok ? { success: true, data: { cancelled: 'all-except' } } : { success: false, error: r.error, isError: true };
+        }
+        const channelId = String(input.channelId ?? '');
+        const resolved = channelRegistry.resolveChannel(channelId, serverId, own);
+        if ('error' in resolved)
+            return { success: false, error: this.unknownChannelWords(channelId, resolved.error, own), isError: true };
         // The name the agent knows the channel by: its id, or where another
         // server shares the id, its server-qualified name. An answer that waits
         // for the transport reads it again then, since a registration meanwhile
         // can change which name picks the channel.
-        const shownNow = () => (channel ? this.channelRegistry?.nameShown(channel) ?? channelId : name);
-        const shown = shownNow();
-        let result;
-        // An open that throws is answered too, never left unhandled.
-        const openThrew = (err) => 'The tune-out is recorded, but its messages may not reach the subconscious, since opening its channel ' +
-            `failed: ${thrownText(err)}`;
-        if (shared) {
-            result = { success: false, error: shared, isError: true };
-        }
-        else if (!channel) {
-            result = { success: false, error: `unknown channel: ${name}`, isError: true };
-        }
-        else if (input.mode === 'cancel') {
-            const r = coordinator.cancel(channel.serverId, channelId, 'agent-tool', 'agent request');
-            result = r.ok
-                ? { success: true, data: { cancelled: shown } }
+        const shownNow = () => channelRegistry.nameShown(resolved);
+        if (input.mode === 'cancel') {
+            const r = coordinator.cancel(resolved.serverId, resolved.channelId, 'agent-tool', 'agent request');
+            return r.ok
+                ? { success: true, data: { cancelled: shownNow() } }
                 : { success: false, error: r.error, isError: true };
         }
-        else {
-            const r = coordinator.enter(channel.serverId, channelId, {
+        if (allExcept) {
+            const r = coordinator.enterAllExcept(resolved, {
                 cadenceSeconds: input.cadenceSeconds,
                 backlogCap: input.backlogCap,
                 maxWakes: input.maxWakes,
                 durationSeconds: input.durationSeconds,
             }, 'agent-tool');
-            if (r.ok) {
-                const data = {
+            if (!r.ok)
+                return { success: false, error: r.error, isError: true };
+            const speaker = this.agents.get(agentName);
+            const home = this.homeOf(agentName);
+            const open = turn && this.openLogical.get(agentName) === turn ? turn : undefined;
+            if (open && open.locus == null && !open.noChannel && !open.heartbeat && !home
+                && (speaker?.proseRouting === 'locus' || speaker?.proseRouting === 'hybrid')) {
+                open.locus = resolved;
+                noteTurnChannel(open, resolved);
+                this.rememberAnnouncedLocus(agentName, resolved);
+            }
+            const speech = home
+                ? `Your plain speech stays in ${this.channelShown(home)}, your conversation's channel.`
+                : open?.locus && !sameChannel(open.locus, resolved)
+                    ? `This turn's plain speech still lands in ${this.channelShown(open.locus)}; from your next turn it lands in the excepted channel while this holds, except on a turn that has no channel, such as a heartbeat's.`
+                    : open && (open.noChannel || open.heartbeat)
+                        ? "This turn has no channel, so its plain speech goes to none; from your next turn it lands in the excepted channel while this holds, except on a turn that has no channel, such as a heartbeat's."
+                        : "Your plain speech lands in the excepted channel while this holds, except on a turn that has no channel, such as a heartbeat's.";
+            return {
+                success: true,
+                data: {
+                    scope: 'all-except',
+                    except: shownNow(),
+                    announcedIn: coordinator.announces() ? shownNow() : null,
+                    expiresAtMs: r.params.expiresAtMs,
                     cadenceSeconds: r.params.cadenceSeconds,
                     backlogCap: r.params.backlogCap,
                     maxWakes: r.params.maxWakes,
-                };
-                // A tuned-out channel's traffic must keep arriving for the
-                // subconscious, so the answer waits for its transport (openForTuneOut).
-                // The tune-out is recorded either way, so it's a success, and where
-                // the transport isn't open, openError says why its messages don't or
-                // may not reach the subconscious, and when they will where that's
-                // known, or that the tune-out isn't in effect any more. A rejection is
-                // answered too, never left unhandled, and the result goes through
-                // pushEvent, as every other tool's does.
-                void this.channelRegistry.openForTuneOut(channel.serverId, channelId)
-                    .catch(openThrew)
-                    .then((openError) => {
-                    this.pushEvent({
-                        type: 'tool-result',
-                        callId: call.id,
-                        toolName: call.name,
-                        agentName,
-                        moduleName: 'tune-out',
-                        result: { success: true, data: { tunedOut: shownNow(), ...data, ...(openError ? { openError } : {}) } },
-                    });
-                });
-                return;
-            }
+                    note: coordinator.hasReader()
+                        ? `${speech} Reader wakes pause, not cancel, when the budget is spent.`
+                        : `No subconscious is configured: this is a silent hold. ${speech} The backlog is delivered per channel when you cancel or the duration ends.`,
+                },
+            };
+        }
+        const r = coordinator.enter(resolved.serverId, resolved.channelId, {
+            cadenceSeconds: input.cadenceSeconds,
+            backlogCap: input.backlogCap,
+            maxWakes: input.maxWakes,
+            durationSeconds: input.durationSeconds,
+        }, 'agent-tool');
+        if (!r.ok) {
             // tune_out repeated on a channel already tuned out is where an agent
             // retries a transport the first open left closed, so where it isn't
             // open, or work is queued for it, the repeat goes through
             // openForTuneOut, which joins the open in flight or waits and, where
             // this host can open the channel, opens it again; the refusal says
             // what its transport is now.
-            const tuneOut = this.channelRegistry.getTuneOutState(channel.serverId, channelId);
-            if (r.alreadyTunedOut && tuneOut && !this.channelRegistry.tuneOutTransportOpen(channel.serverId, channelId)) {
-                void this.channelRegistry.openForTuneOut(channel.serverId, channelId)
-                    .catch(openThrew)
-                    .then((openError) => {
-                    // The tune-out is read again: one that ended or was replaced while
-                    // the open was out isn't described as standing, whatever the open
-                    // answered for it.
-                    const now = this.channelRegistry.getTuneOutState(channel.serverId, channelId);
-                    const error = now?.params.epochId === tuneOut.params.epochId
-                        ? alreadyTunedOutText(this.channelRegistry.quotedShown(channel), now.params, openError ?? 'Its transport is open now, so its messages reach the subconscious.')
-                        : TUNE_OUT_REPLACED;
-                    this.pushEvent({
-                        type: 'tool-result',
-                        callId: call.id,
-                        toolName: call.name,
-                        agentName,
-                        moduleName: 'tune-out',
-                        result: { success: false, error, isError: true },
-                    });
-                });
-                return;
-            }
-            result = { success: false, error: r.error, isError: true };
-        }
-        this.pushEvent({
-            type: 'tool-result',
-            callId: call.id,
-            toolName: call.name,
-            agentName,
-            moduleName: 'tune-out',
-            result,
+            const tuneOut = channelRegistry.getTuneOutState(resolved.serverId, resolved.channelId);
+            if (r.alreadyTunedOut && tuneOut && !channelRegistry.tuneOutTransportOpen(resolved.serverId, resolved.channelId)) {
+                const openError = await channelRegistry.openForTuneOut(resolved.serverId, resolved.channelId).catch(openThrew);
+                // The tune-out is read again: one that ended or was replaced while
+                // the open was out isn't described as standing, whatever the open
+                // answered for it.
+                const now = channelRegistry.getTuneOutState(resolved.serverId, resolved.channelId);
+                const error = now?.params.epochId === tuneOut.params.epochId
+                    // A name in a sentence is quoted as tune_out takes it back (main's #852).
+                    ? alreadyTunedOutText(channelRegistry.quotedShown(resolved), now.params, openError ?? 'Its transport is open now, so its messages reach the subconscious.')
+                    : TUNE_OUT_REPLACED;
+                return { success: false, error, isError: true };
+            }
+            return { success: false, error: r.error, isError: true };
+        }
+        // A tuned-out channel's traffic must keep arriving for its reader, so the
+        // answer waits for its transport (openForTuneOut). The tune-out is
+        // recorded either way, so it's a success, and where the transport isn't
+        // open, openError says why its messages don't or may not reach the
+        // reader, and when they will where that's known, or that the tune-out
+        // isn't in effect any more.
+        const openError = await channelRegistry.openForTuneOut(resolved.serverId, resolved.channelId).catch(openThrew);
+        return {
+            success: true,
+            data: {
+                tunedOut: shownNow(),
+                cadenceSeconds: r.params.cadenceSeconds,
+                backlogCap: r.params.backlogCap,
+                maxWakes: r.params.maxWakes,
+                ...(openError ? { openError } : {}),
+                ...(coordinator.hasReader()
+                    ? {}
+                    : { note: 'No subconscious is configured: this is a silent hold. Nothing summarizes or wakes you; the backlog is delivered when you cancel.' }),
+            },
+        };
+    }
+    /**
+     * The admission stage for one inbound event: the pure decision over the
+     * framework's policy inputs (recipients, the hold in force, the wake
+     * gate), traced. Callers apply it; nothing downstream re-asks.
+     */
+    admitInbound(env) {
+        const gateInfo = (e) => ({
+            content: e.gateContent,
+            eventType: String(e.gateMetadata.eventType ?? 'unknown'),
+            serverId: String(e.gateMetadata.serverId ?? e.serverId),
+            channelId: typeof e.gateMetadata.channelId === 'string' ? e.gateMetadata.channelId : '',
+            metadata: e.gateMetadata,
+            tags: Array.isArray(e.gateMetadata.tags) ? e.gateMetadata.tags : undefined,
+        });
+        const decision = admit(env, {
+            untargetedRecipients: () => this.registry.untargetedRecipients(),
+            holdFor: (serverId, channelId) => {
+                const hold = this.tuneOutCoordinator?.holdFor(serverId, channelId) ?? null;
+                return hold ? { kind: 'tune-out', epochId: hold.epochId, serverId, channelId } : null;
+            },
+            ...(this.eventGate
+                ? {
+                    gate: {
+                        evaluate: (e) => this.eventGate.evaluate(gateInfo(e)).trigger,
+                        // "Would the gate have woken them": a debounce policy says yes,
+                        // later — for the hold's reader that is a pass, not a mute.
+                        probe: (e) => {
+                            const d = this.eventGate.probe(gateInfo(e));
+                            return d.trigger || (typeof d.behavior === 'object' && d.behavior !== null && 'debounce' in d.behavior);
+                        },
+                    },
+                }
+                : {}),
         });
+        this.emitTrace({
+            type: 'admission:decided',
+            lane: env.lane,
+            serverId: env.serverId,
+            channelId: env.channelId,
+            messageId: env.messageId,
+            recipients: decision.recipients,
+            held: decision.held ? decision.held.epochId : null,
+            wake: decision.wake,
+            gatePass: decision.gatePass,
+        });
+        return decision;
+    }
+    /**
+     * Make delivered messages durable now, including those the delivery left
+     * in the deferred queue: a tune-out release flips durable epoch state
+     * first, so its dump must not be lost to a crash in between (#232 gap 6).
+     */
+    commitDeliveries() {
+        if (this.deferredMessages.length > 0) {
+            this.deferredWritesPersisted = true;
+            this.persistDeferredWrites();
+        }
+        try {
+            this.store.sync();
+        }
+        catch (err) {
+            console.error('[tune-out] could not sync the store after a release:', err);
+        }
+    }
+    /** The history-reading tool the primary resident actually has, if any (#232 gap 11). */
+    residentHistoryTool() {
+        const primary = this.primaryAgentName ? this.agents.get(this.primaryAgentName) : undefined;
+        if (!primary)
+            return null;
+        const names = this.getAllTools().map((t) => t.name).filter((n) => primary.canUseTool(n));
+        return names.find((n) => /(^|--)(fetch_history|channel_read|read_history|history)$/.test(n)) ?? null;
     }
     dispatchSleepToolCall(agentName, call) {
         // The gate's sleep quiets the whole agent, every conversation of it, so a
         // conversation fork or an ephemeral run neither sets one nor ends the
         // agent's own. Refused before the tool runs, as a fork's channel_open is.
-        const fork = this.conversationAgentHomes.has(agentName);
+        const fork = this.registry.homeChannel(agentName) !== undefined;
         if (fork || this.ephemeralRuns.has(agentName)) {
             const one = fork ? 'conversation' : 'run';
             // Only where the fork can follow it: skip_reply needs the channel