@animalabs/agent-framework 0.30.0 → 0.32.0

package/dist/src/framework.js

@@ -8,6 +8,7 @@ import { appendFileSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync
 import { JsStore } from '@animalabs/chronicle';
 import { MembraneError } from '@animalabs/membrane';
 import { classifyFailure, retryDecision, MEMBRANE_RETRY_SETTINGS } from '@animalabs/membrane/retry';
+import { deadlineCut, isDeadlineExpiry, resolveInferenceBounds, wholeCallMs } from './inference-bounds.js';
 import { ContextManager, PassthroughStrategy, WindowedPassthroughStrategy, OverBudgetError, UncoveredDropError, stripUnpairedToolBlocks, continuesBody, MalformedContentError, malformedContentPlaces, CompressionWithdrawn } from '@animalabs/context-manager';
 import { SILENT_HEARTBEAT_SEPARATOR } from './silent-heartbeat.js';
 import { SUBCONSCIOUS_TOOLS, SUBCONSCIOUS_TOOL_NAMES, defaultReaderFraming, } from './tune-out/tools.js';
@@ -18,9 +19,9 @@ import { asModuleRow, heldHandle, heldWriteId, matchesMessageQuery } from './hel
 import { ProcessQueueImpl } from './queue.js';
 import { DEFAULT_SHUTDOWN_TIMEOUT_MS, validateShutdownTimeout, shutdownErrorMessage, waitForShutdown, ShutdownTimeoutError } from './shutdown.js';
 import { REFUSAL_REACTIONS, REFUSAL_REACTION_FALLBACK, REFUSAL_REACTION_BASELINE } from './refusal-reactions.js';
-import { Agent, assertAgentSwitches, dryCompileStatsOf } from './agent.js';
+import { Agent, assertAgentSwitches, assertThinkingBinding, dryCompileStatsOf } from './agent.js';
 import { assertBooleanSetting, holdsSettings, kindOf } from './config-checks.js';
-import { ModuleRegistry, checkedToolResult, ensureStateRegistered, storableToolResult, thrownResult } from './module-registry.js';
+import { ModuleRegistry, checkedToolResult, droppedToolResultLine, ensureStateRegistered, retiredPushLine, storableToolResult, thrownResult } from './module-registry.js';
 import { McplServerRegistry } from './mcpl/server-registry.js';
 import { prefixesMeet, prefixesMeetError } from './mcpl/prefix-rule.js';
 import { logDetail, logValue } from './mcpl/log-value.js';
@@ -66,7 +67,6 @@ import { cumulativeDelta } from './usage-accounting.js';
 import { stampThinkingTokenEstimates } from './thinking-token-stamp.js';
 import { splitThinkingDrops, ThinkingLossIncidents } from './thinking-drops.js';
 import { asNextRequestCarries, roundRows } from './sent-rows.js';
-import { ReasoningLossTeller } from './reasoning-loss.js';
 import { contentAsStored, nameAsStored } from './text-as-stored.js';
 import { STORED_INJECTION_KEY, STORED_INJECTION_KIND, asStoredRow, hasRenderedContent, isAnotherAgentsInjection, isOwnInjection, isStoredKind, storedInjectionMarkOf, unitHash } from './stored-injections.js';
 /** An MCPL tool call refused because its server isn't in the registry: one
@@ -627,6 +627,13 @@ export const BUILTIN_TOOLSET_TOOLS = new Set([
     'heartbeat--heartbeat_trigger',
     'workspace--status',
 ]);
+function agentsOwnVerbRefusal(toolName) {
+    return {
+        success: false,
+        error: `${toolName} is the agent's own, which a module's call can't make for it, so nothing was done.`,
+        isError: true,
+    };
+}
 const readExtensionSettings = (ext, agentName) => {
     const values = ext.get(agentName);
     return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, value === undefined ? 'undefined' : JSON.stringify(value)]));
@@ -669,7 +676,7 @@ import { EventGate, MCPL_GATE_EVENT_TYPES, checkToolInput, formatShadowWarning,
 import { ReplyJudge } from './gate/reply-judge.js';
 import { HEARTBEAT_CHANGING_TOOLS, Heartbeat, isHeartbeatMcplServer } from './heartbeat/heartbeat.js';
 import { EPHEMERAL_USAGE_NAME, UsageTracker, persistedUsageProblem } from './usage/usage-tracker.js';
-import { McplProtocolVersionError, McplRequestError, McplUnreapedLaunchError, stderrTailOf, toolsetDeclarationsOf, withStderr } from './mcpl/server-connection.js';
+import { McplRequestError, McplUnreapedLaunchError, stderrTailOf, toolsetDeclarationsOf, withStderr } from './mcpl/server-connection.js';
 import { ToolsetHub, TOOLSETS_MODULE, META_TOOL_NAMES } from './mcpl/toolset-host.js';
 import { HostPresentation, BUILTIN_TOOLSET } from './host-presentation.js';
 import { isEmptyChange } from './mcpl/tool-presence.js';
@@ -677,7 +684,7 @@ import { ToolsetsModule, resolveAct, withLookHint } from './mcpl/toolsets-module
 import { ModernMcpConnection } from './mcpl/modern-connection.js';
 import { MAX_TIMER_MS, WITHHELD_TEXT, asText, credentialRedactor, redactUrl, redactServerText, resolveServerBinding, serverConfigProblems, serverCredentialPatterns, serverTextRedactor } from './mcpl/protocol-family.js';
 import { MALFORMED_CONTENT_NOTICE, normalizeStandardToolResult } from './mcpl/tool-result-normalize.js';
-import { boundedForLog, describeCause } from './mcpl/errors.js';
+import { boundedForLog, describeCause, hostStoppedWhileHandling } from './mcpl/errors.js';
 import { assertServerConfigBooleans, buildWebSocketUrl, isWebSocketTransport } from './mcpl/transport.js';
 import { formatZonedDateTime, resolveTimeZone } from './timezone.js';
 import { CLOCK_ROW_KIND, clockStampOf, planClock, takesClockBefore } from './clock-rows.js';
@@ -826,8 +833,8 @@ function resumesLogicalTurn(reason) {
  */
 const TURN_RETRY = Symbol('turn-retry');
 /**
- * The batch a start that carries a turn on (continuesTurn) was merged from,
- * when the scheduler merged wakes that aren't the turn's into it: every
+ * The batch a start was merged from, when the scheduler merged more than
+ * one request into it and any of them isn't the turn's: every
  * request it took in, as each was. Until the start takes its turn token it
  * stands for them all. A scheduler pass that takes it back puts the batch in
  * its place, each request with its own identity and flags; a quiesce at the
@@ -847,14 +854,10 @@ function isRearmed(request) {
 function waitAlertsOnItsOwn(wait) {
     return wait.until === null || wait.until - wait.setAt > PROVIDER_WAIT_ALERT_MS;
 }
-// membrane 0.8.0 marks a deadline it reports as run out with this registered
-// symbol (on a sent request, or the Anthropic SDK's timeout, which covers its
-// connect timeout too), and doesn't export its reader.
-const MEMBRANE_DEADLINE_EXPIRY = Symbol.for('membrane.deadlineExpiry');
 function isTransientFailure(error) {
     if (!isMembraneError(error) || error.retryable !== true)
         return false;
-    if (error[MEMBRANE_DEADLINE_EXPIRY] === true)
+    if (isDeadlineExpiry(error))
         return false;
     return error.type === 'server' || error.type === 'network' || error.type === 'timeout' || error.type === 'rate_limit';
 }
@@ -949,6 +952,29 @@ function freshTurnRouting() {
         addressedElsewhere: new Set(),
     };
 }
+const TURN_INPUTS_SCAN = 64;
+function turnInputs(cm, floor, agentName, sees) {
+    let first;
+    let last;
+    scan: for (let end = cm.getMessageCount(); end > 0; end -= TURN_INPUTS_SCAN) {
+        const { messages } = cm.getMessageWindow(Math.max(0, end - TURN_INPUTS_SCAN), Math.min(TURN_INPUTS_SCAN, end), { resolveBlobs: false });
+        for (let i = messages.length - 1; i >= 0; i--) {
+            const message = messages[i];
+            if (message.sequence <= floor)
+                break scan;
+            if (!sees(message.metadata))
+                continue;
+            if (message.participant === agentName)
+                break scan;
+            last ??= message.id;
+            const answers = Array.isArray(message.content) && message.content.length > 0
+                && message.content.every((block) => block.type === 'tool_result');
+            if (!answers)
+                first = message.id;
+        }
+    }
+    return first !== undefined && last !== undefined ? { first, last } : undefined;
+}
 const sameReach = (a, b) => {
     if (!a || !b)
         return a === b;
@@ -1026,10 +1052,6 @@ const LIVE_SPEECH_UNRECEIPTED = `Plain speech its rounds routed live was handed
  *  had closed admission (endFailureAtStop). Its inference:failed came first,
  *  and this says no retry follows it. */
 const RETRY_CANCELLED_BY_STOP = 'a retry waiting while the framework was stopping is dropped before it sends anything';
-/** The reason on the inference:aborted that ends a turn whose start waited to
- *  retry a failed compile across a stop() and a start(): the retry would
- *  revive the earlier lifecycle's turn in the next one. */
-const RETRY_ACROSS_RESTART = 'a retry waiting while the framework was stopped and started again is dropped before it sends anything';
 /** The reason on the inference:aborted that ends a turn whose continuation
  *  was dropped before it started, other than by an abandon or a stop. */
 const CONTINUATION_DROPPED = "a turn's continuation was dropped before it started";
@@ -1075,6 +1097,24 @@ const MAX_TURN_CHECKPOINTS = 20;
 const DEFAULT_DISCORD_AWARENESS_DEADLINE_MS = 10_000;
 const MIN_DISCORD_AWARENESS_DEADLINE_MS = 50;
 const MAX_DISCORD_AWARENESS_DEADLINE_MS = 60_000;
+/** Whether a synthesized tool's nullable field is in use: omission, null and
+ *  the empty string all mean it isn't, so a caller whose provider presents
+ *  every property as required can still leave one unset. Any other value is
+ *  in use, and its field checks it. */
+function fieldInUse(value) {
+    return value !== undefined && value !== null && value !== '';
+}
+/** A synthesized tool's integer field: an integer number, or a string of ASCII
+ *  digits once trimmed (a model may write an integer as a string), within the
+ *  integers a number holds exactly; NaN for anything else. Number() would read
+ *  " ", false and [] as 0, and "2.0" or "+2" as 2, and a longer run of digits
+ *  as a different, rounded number. */
+function integerField(value) {
+    const n = typeof value === 'number' ? value
+        : typeof value === 'string' && /^[0-9]+$/.test(value.trim()) ? Number(value.trim())
+            : Number.NaN;
+    return Number.isSafeInteger(n) ? n : Number.NaN;
+}
 function normalizeDiscordAwarenessDeadline(value) {
     if (value === undefined || !Number.isFinite(value) || value <= 0) {
         return DEFAULT_DISCORD_AWARENESS_DEADLINE_MS;
@@ -1084,9 +1124,10 @@ function normalizeDiscordAwarenessDeadline(value) {
 /**
  * Refuse a config whose `subconscious`, `watchdog` or `processLogging` is
  * anything but an object, null or false (holdsSettings), or whose switch in
- * one holds anything but true or false (assertBooleanSetting). A subconscious
- * that isn't on has its `allowChannelSpeech` left unchecked, since nothing
- * reads it then.
+ * one holds anything but true or false (assertBooleanSetting), or whose
+ * subconscious's `thinkingBinding` assertThinkingBinding refuses, whichever
+ * its reader. A subconscious that isn't on has its `allowChannelSpeech` and
+ * `thinkingBinding` left unchecked, since nothing reads them then.
  */
 function assertFrameworkSwitches(config) {
     if (holdsSettings('subconscious', config.subconscious, '{ enabled: true }')) {
@@ -1094,6 +1135,7 @@ function assertFrameworkSwitches(config) {
             'and false or leaving it out doesn\'t');
         if (config.subconscious.enabled === true) {
             assertBooleanSetting('subconscious.allowChannelSpeech', config.subconscious.allowChannelSpeech, 'true lets the subconscious speak in channels with speak_in_channel, and false or leaving it out refuses it');
+            assertThinkingBinding('subconscious.thinkingBinding', config.subconscious.thinkingBinding);
         }
     }
     if (holdsSettings('watchdog', config.watchdog, '{ enabled: true }')) {
@@ -1454,9 +1496,15 @@ function hostCommandRequester(serverId, params) {
  *   schedule, jittered, 10 s doubling to 5 min (by default 13 tries, where
  *   membrane's settings have 7: about 30 min).
  * - rate limited (429): the base schedule with at least 5 tries.
- * - any other retryable failure, a stream deadline on a sent request
- *   included (membrane leaves those to its caller): the base schedule (by
- *   default 3 tries, 1 s then 2 s).
+ * - a deadline expiry, which membrane leaves to its caller: a progress
+ *   bound's cut (FrameworkConfig.inferenceBounds), the adapter's own
+ *   watchdogs, the SDK's request timeout or a runtime's fetch timeout. The
+ *   deadline schedule: by default 2 tries, 1 s apart, so one fresh call. For
+ *   one, the framework's `attempt` counts that call's consecutive expiries,
+ *   not the turn's other failures, so each call a deadline cuts gets its
+ *   fresh call. Settings with no deadline schedule give it their base one.
+ * - any other retryable failure: the base schedule (by default 3 tries, 1 s
+ *   then 2 s).
  * A provider's stated wait (`retryAfterMs`) is waited when it is longer than
  * the backoff, up to the schedule's ceiling, which by default is at least the
  * framework's own cap (PROVIDER_ACCELERATION_MAX_COOLDOWN_MS, ten minutes);
@@ -1476,6 +1524,10 @@ export class DefaultErrorPolicy {
         this.maxRetries = Math.max(0, ...Object.values(settings).map((s) => (s?.maxAttempts ?? 1) - 1));
     }
     onInferenceError(error, _agentName, attempt) {
+        if (isDeadlineExpiry(error)) {
+            const decision = retryDecision(this.settings.deadline ? 'deadline' : 'retryable', attempt + 1, undefined, this.settings);
+            return decision.retry ? { retry: true, delayMs: decision.delayMs } : { retry: false };
+        }
         if (!isMembraneError(error)) {
             // Not a provider failure membrane classified: retried as any other
             // retryable failure, on the base schedule.
@@ -1485,9 +1537,7 @@ export class DefaultErrorPolicy {
         if (error.retryable === false)
             return { retry: false };
         // The facts membrane classifies by, read off the error itself (from either
-        // copy of membrane, as isMembraneError takes one). No `deadline` fact: a
-        // stream deadline is a retryable timeout here, as it was before membrane
-        // 0.7, where membrane itself gives it no retry.
+        // copy of membrane, as isMembraneError takes one).
         const facts = error;
         // A failure that doesn't say is retried as an unknown one is; only false refuses (handled above).
         const cls = classifyFailure({ retryable: facts.retryable !== false, type: facts.type, httpStatus: facts.httpStatus, message: facts.message });
@@ -1516,18 +1566,37 @@ const MAINTENANCE_TICKS_PER_PASS = 8;
  *  together, and then on awareness drains still running, such as its
  *  startup's delivery. */
 const FAILED_CREATE_TEARDOWN_TIMEOUT_MS = 30_000;
+const ABANDON_GRACE_MS = 10_000;
+const testAbandonGraces = new WeakMap();
+/**
+ * For tests only: `framework`'s abandon takes `ms` as its grace in place of
+ * {@link ABANDON_GRACE_MS}. Set it only where the test holds every turn the
+ * abandon reaches past the grace, so no turn can end within it and a short
+ * grace only brings the abandon's report sooner.
+ */
+export function setAbandonGraceForTests(framework, ms) {
+    testAbandonGraces.set(framework, ms);
+}
 const PROVIDER_ACCELERATION_DEFAULT_COOLDOWN_MS = 65_000;
 /** Cap on waits the framework chooses itself. A provider's stated wait is
  *  never capped: it is a lower bound (see ProviderWaits). It is also the
  *  longest stated wait an ephemeral run sleeps in its turn: a longer one ends
  *  the run instead (nonOwningProviderWait). */
 const PROVIDER_ACCELERATION_MAX_COOLDOWN_MS = 10 * 60_000;
+const FAILURE_ADVICE = 'If this recurs with the same cause, change approach rather than retrying identically ' +
+    '(e.g. drop an oversized attachment or an unsupported setting).';
+const TIMEOUT_ADVICE = 'If a reply is still owed from that turn, you can give it now.';
+const MADE_AGAIN = 'The call was made again, and it timed out again.';
 const OVERLOADED_TURN_TRIES = 13;
-const TURN_RETRY_SETTINGS = Object.fromEntries(Object.entries(MEMBRANE_RETRY_SETTINGS).map(([cls, s]) => [cls, s && {
-        ...s,
-        ...(cls === 'overloaded' ? { maxAttempts: OVERLOADED_TURN_TRIES } : {}),
-        statedWaitCeilingMs: s.statedWaitCeilingMs === null ? null : Math.max(s.statedWaitCeilingMs, PROVIDER_ACCELERATION_MAX_COOLDOWN_MS),
-    }]));
+const DEADLINE_TURN_TRIES = 2;
+const TURN_RETRY_SETTINGS = {
+    ...Object.fromEntries(Object.entries(MEMBRANE_RETRY_SETTINGS).map(([cls, s]) => [cls, s && {
+            ...s,
+            ...(cls === 'overloaded' ? { maxAttempts: OVERLOADED_TURN_TRIES } : {}),
+            statedWaitCeilingMs: s.statedWaitCeilingMs === null ? null : Math.max(s.statedWaitCeilingMs, PROVIDER_ACCELERATION_MAX_COOLDOWN_MS),
+        }])),
+    deadline: { maxAttempts: DEADLINE_TURN_TRIES, firstDelayMs: 1_000, multiplier: 1, maxDelayMs: 1_000, statedWaitCeilingMs: null },
+};
 const PROVIDER_ACCELERATION_JITTER_MS = 5_000;
 /** Longest delay one setTimeout can represent (2^31-1 ms, about 24.8 days);
  *  a longer timer fires almost at once, so longer waits re-arm in steps. */
@@ -1577,6 +1646,11 @@ async function* turnStreamEvents(stream, agentName) {
                 console.error(`[stream] ${agentName}: the stream sent an event (${event.type}) after its ${decidedBy} event, which decided its turn; it and the rest of the stream decide nothing`);
                 return;
             }
+            if (event.type === 'aborted' && event.reason === 'timeout') {
+                decidedBy = 'error';
+                yield { type: 'error', error: deadlineCut(event.message) };
+                continue;
+            }
             if (event.type === 'complete' || event.type === 'error' || event.type === 'aborted')
                 decidedBy = event.type;
             yield event;
@@ -1822,6 +1896,30 @@ const isLowSurrogate = (text, index) => {
 };
 /** Whether a cut before `index` would separate the halves of a surrogate pair. */
 const splitsPair = (text, index) => index > 0 && index < text.length && isHighSurrogate(text, index - 1) && isLowSurrogate(text, index);
+/**
+ * Whether an MCPL server's child ended the way a server ends when it's asked
+ * to: exit 0, death by a signal that asks a process to end (SIGTERM, SIGINT,
+ * SIGHUP), or a shell's report of such a death by its convention, 128 plus the
+ * signal's number (143, 130, 129). A service manager's stop signals the host
+ * and its children together, so a child can go before the host's stop()
+ * closes it: its loss is that stop, not a failure, and raises no mcpl-down.
+ * A child the stdio transport ended itself, after a pipe error or a line on
+ * its stdout longer than the bound, was ended by that, whatever its code or
+ * signal. A WebSocket's close codes are 1000 and up, so they never match.
+ */
+function endedAsAsked(ended) {
+    if (ended.pipeFailed)
+        return false;
+    const { code, signal } = ended;
+    return code === 0 || code === 143 || code === 130 || code === 129 ||
+        signal === 'SIGTERM' || signal === 'SIGINT' || signal === 'SIGHUP';
+}
+/** A lost connection's words for an alert: the transport's reason, then its
+ *  exit or close code and signal, each when there is one. */
+function closeWords(reason, code, signal) {
+    const how = [reason ?? null, code != null ? `code ${code}` : null, signal ? `signal ${signal}` : null].filter((part) => part !== null);
+    return how.length > 0 ? ` (${how.join(', ')})` : '';
+}
 /**
  * `text` when it fits within `max` characters; otherwise its head and tail
  * around a marker stating how many of how many characters were omitted, the
@@ -2067,6 +2165,16 @@ export function shedMayHelp(errorType, httpStatus) {
         return errorType === 'invalid_request' || errorType === 'context_length';
     return errorType === 'invalid_request' && (httpStatus === undefined || httpStatus === 400 || httpStatus === 422);
 }
+function responseParts(response) {
+    return [
+        response?.addMessages?.length ? `${response.addMessages.length} message(s) to add` : '',
+        response?.editMessages?.length ? `${response.editMessages.length} edit(s)` : '',
+        response?.removeMessages?.length ? `${response.removeMessages.length} removal(s)` : '',
+        response?.stateUpdate !== undefined ? 'a state update' : '',
+        response?.requestInference ? 'an inference request' : '',
+        response?.toolsChanged ? 'a tools change' : '',
+    ].filter(Boolean).join(', ');
+}
 /**
  * What a thrown value says, safely and briefly, as boundedErrorMessage gives
  * it, with `recorded` applied before the cut, so no part of a credential
@@ -2168,6 +2276,12 @@ function wakeLineKey(line) {
     return JSON.stringify([eventType, serverId ?? null, channelId ?? null, messageId ?? null, eventId ?? null]);
 }
 const SUBCONSCIOUS_MODEL_FIELDS = ['physicalWindowTokens', 'thinkingBinding'];
+function readerModelFields(cfg) {
+    return {
+        ...(cfg.physicalWindowTokens != null ? { physicalWindowTokens: cfg.physicalWindowTokens } : {}),
+        ...(holdsSettings('subconscious.thinkingBinding', cfg.thinkingBinding, '{ binds: true, dropBlock: true }') ? { thinkingBinding: cfg.thinkingBinding } : {}),
+    };
+}
 const JUDGE_PARAMETER = {
     type: 'object',
     description: 'Ask the reply judge first: batch matching events like debounceMs, then a small, cheap model reads your ' +
@@ -2233,9 +2347,10 @@ export class AgentFramework {
     store;
     ownsStore;
     stopPromise = null;
-    stopCompleted = false;
+    // Nothing sets it back to 'none': a stop ends its instance (#315).
+    stopState = 'none';
+    closedStopFailure;
     ownedStoreClosed = false;
-    ownedStoreManagersClosed = false;
     /** Whether the latest stop() got through its teardown with nothing failed:
      * every step and every wait up to and including the one on awareness
      * drains, whatever failed after that, in the storage work that finishes
@@ -2251,8 +2366,8 @@ export class AgentFramework {
      * promise: a stream it cancelled or an event loop still in a call; and a
      * stream whose cancel threw, which stop() doesn't wait for. A later
      * stop() waits for each again, beside what it finds, whatever has happened
-     * since to the entry it was found under (a run's end removes its stream's,
-     * a start() replaces the loop), so neither a budget nor a cancel that
+     * since to the entry it was found under (a run's end removes its stream's),
+     * so neither a budget nor a cancel that
      * threw lets the store close under work still running. Each leaves once it
      * settles. */
     leftRunning = new Map();
@@ -2318,6 +2433,9 @@ export class AgentFramework {
     providerAccelerationLastRecovery = new Map();
     providerAccelerationDefaultCooldownMs = PROVIDER_ACCELERATION_DEFAULT_COOLDOWN_MS;
     providerAccelerationJitterMs = PROVIDER_ACCELERATION_JITTER_MS;
+    inferenceBounds = resolveInferenceBounds(undefined);
+    deadlineCuts = new Map();
+    freshCallsCut = new Set();
     providerHoldHook;
     /** Provider waits (stated retry-after) per (agent, model), kept across restarts. */
     providerWaits;
@@ -2325,8 +2443,6 @@ export class AgentFramework {
     retryWaitWakers = new Set();
     waitingTraceEveryMs = WAITING_TRACE_EVERY_MS;
     providerAdmissionClosed = false;
-    /** Invalidates framework turns still assembling when stop begins. */
-    lifecycleGeneration = 0;
     /** Last time we reported stale (busy-requeued) inference requests, per agent. */
     staleWarnAt = new Map();
     /** Per-agent last inference activity (epoch ms), for /healthz + doctor tooling. */
@@ -2379,7 +2495,6 @@ export class AgentFramework {
      * next turn.
      */
     turnRouting = new Map();
-    reasoningLoss = new ReasoningLossTeller();
     /**
      * The latest link of each agent's chain of queued prose deliveries. Every
      * stream queues its own behind it, a fresh turn's included, so the agent's
@@ -2467,6 +2582,7 @@ export class AgentFramework {
     turnRearmMs = DEFAULT_TURN_REARM_MS;
     turnRearms = new Map();
     exhaustingRearms = new Set();
+    rearmDeadlineCuts = new Set();
     statedWaitRuns = new Map();
     /** N consecutive failed inferences ⇒ the agent is treated as hard-down and
      *  escalated loudly to stderr. */
@@ -2747,7 +2863,7 @@ export class AgentFramework {
     collapseDerivationNoticesAfter = 10;
     /** The host's say over each derivation, ephemeral spawn and resume (config.dendrite.beforeDerive). */
     beforeDerive;
-    /** What a source is told of a derivation (config.dendrite.derivationNotice); absent, the default line. */
+    /** What a source is told of a derivation (config.dendrite.derivationNotice); absent, nothing. */
     derivationNoticeHook;
     /** Per source agent, per kind: how many derivations, since when, and at which count the last note went. */
     derivationTallies = new Map();
@@ -2999,6 +3115,7 @@ export class AgentFramework {
             getMessage: (id) => this.getMessage(id),
             queryMessages: (filter, opts) => this.queryMessages(filter, opts),
             pushEvent: (event, moduleName) => this.pushModuleEvent(event, moduleName, true),
+            dropRetiredPush: (event, moduleName) => this.dropRetiredModuleEvent(event, moduleName),
             onTrace: (listener) => this.onTrace(listener),
             // The ONLY entry that confers module origin — a private closure the
             // framework hands to its own module registry. The public
@@ -3022,6 +3139,7 @@ export class AgentFramework {
         // Before anything opens or starts: a refused config must leave nothing behind.
         if (config.codeExecution != null)
             validateCodeExecutionConfig(config.codeExecution);
+        resolveInferenceBounds(config.inferenceBounds);
         assertFrameworkSwitches(config);
         for (const agentConfig of config.agents)
             assertAgentSwitches(agentConfig);
@@ -3190,6 +3308,7 @@ export class AgentFramework {
         const framework = building.framework = new AgentFramework(store, ownsStore, config.membrane, config.inferencePolicy ?? new DefaultInferencePolicy(), config.errorPolicy ?? new DefaultErrorPolicy(), config.syncIntervalMs ?? DEFAULT_SYNC_INTERVAL_MS, config.maintenanceIntervalMs ?? DEFAULT_MAINTENANCE_INTERVAL_MS, processLoggingPersist, resolveTimeZone(config.timeZone), discordAwarenessOutbox, config.discordAwarenessEmoji ?? DEFAULT_DISCORD_AWARENESS_EMOJI, normalizeDiscordAwarenessDeadline(config.discordAwarenessDeadlineMs), new OperatorLog(operatorLogPath));
         framework.providerHoldHook = config.providerHold;
         framework.turnRearmMs = turnRearmDelays(config.exhaustedTurnRearmMs);
+        framework.inferenceBounds = resolveInferenceBounds(config.inferenceBounds);
         // Before any delivery.
         await framework.reconcileDiscordAwarenessAtStartup();
         // Restore persisted usage data (if any) from prior session. The names it
@@ -3671,9 +3790,7 @@ export class AgentFramework {
      * maintenance, event loop and operator operations, so a dump shows what
      * those waits are on, and before its modules and MCPL servers stop, so a
      * stop() whose teardown hangs, fails or times out doesn't keep it listed.
-     * With none in the set, one line says no framework is running. A framework
-     * started again after a completed stop() doesn't rejoin; whether that
-     * lifecycle is supported is #315.
+     * With none in the set, one line says no framework is running.
      *
      * One listener serves the process, installed by the first create() to
      * reach the join and kept: once a process's last SIGUSR2 listener is
@@ -3717,35 +3834,38 @@ export class AgentFramework {
     }
     /**
      * Start the event loop. A start() on a running framework does nothing.
-     * Refused, with an error, from a stop() call until that stop() settles,
-     * since that stop would wait on the lifecycle a start() begins, or tear it
-     * down under it. What a start() after a settled stop() should do is #315's
-     * question.
+     * A stop ends its instance (#315): once a stop() is admitted, start() and
+     * addModule() are refused with an error, for good. While that stop() runs,
+     * the error says the framework is stopping. Once it has settled, the error
+     * says what to do: create a new AgentFramework on the store, and after a
+     * failed stop(), call stop() again first, until one resolves. When a
+     * failed stop() left its owned store closed, so that it can't be tried
+     * again, the error carries that failure as its cause.
+     *
+     * A new instance on the store keeps what the store holds. With the
+     * heartbeat on and the same heartbeat state file (heartbeat.statePath, or
+     * its default), it keeps the heartbeat's schedule as it reads it from that
+     * file: a tick or a reminder that fell due meanwhile fires once, shortly
+     * after it starts. What an instance holds only in memory is lost with it,
+     * as on a process restart: an agent's sleep and its wake, a self-wake, the
+     * inference requests still queued (a budget restart, a heartbeat's wake, a
+     * nudge), a re-armed turn's wait and count, and the redo stack. #627 is
+     * about keeping a sleep and a self-wake across a restart. To pause and
+     * resume one framework in place, use quiesce() and resume().
      */
     start() {
         // Before the running check: stop() claims its attempt before it clears
         // running, so a start() made in its first steps, such as from a trace
         // listener, is refused too.
-        this.resetCompletedStop('start()');
+        this.refuseOnceStopped('start()');
         if (this.running) {
             return;
         }
         this.running = true;
-        this.providerAdmissionClosed = false;
         this.earlyTraces = null;
-        // A new lifecycle: a turn compiled before an earlier stop() never drives,
-        // and withheld spills, closed for the generation a stop ended, are open
-        // for this one.
-        this.lifecycleGeneration++;
-        // Its servers' addresses, which an earlier stop() took out of the
-        // reference registry, for its stubs.
         for (const config of this.mcplServerConfigs.values()) {
             referenceRegistry.setServerAddress(config.id, serverAddressOf(config), this);
         }
-        // A sleep kept through a stop() wakes this lifecycle at its end, or now
-        // if it ended while stopped. Before the loop's first pass, so that a wake
-        // owed now joins the requests already pending in one turn.
-        this.eventGate?.resumeSleep();
         this.heartbeat?.start();
         this.loopPromise = this.runLoop();
         // Start periodic sync timer (if enabled)
@@ -3770,11 +3890,14 @@ export class AgentFramework {
         }
     }
     /**
-     * Stop the event loop. Until it settles, start() and addModule() are
-     * refused. Each step of the teardown runs whatever an earlier one did: one
-     * that throws, such as a host stream's cancel(), fails the stop() once the
-     * rest has run. When a step or a wait up to and including
-     * the wait on awareness drains fails or times out, storage stays open and
+     * Stop the event loop, and with it this framework, for good: once a stop()
+     * is admitted, start() and addModule() are refused, as start() says. A
+     * stop() whose budget is refused, which it rejects with a RangeError, is
+     * not admitted and changes nothing. Each step of the teardown runs
+     * whatever an earlier one did: one that throws, such as a host stream's
+     * cancel(), fails the stop() once the rest has run. When a step or a wait
+     * up to and including the wait on awareness drains fails or times out,
+     * storage stays open and
      * stop() can be called again; one that fails after it, in the storage work
      * that finishes the stop, fails the stop() without keeping storage open.
      * A timed-out wait lets teardown go on while what it waited for may still
@@ -3782,7 +3905,10 @@ export class AgentFramework {
      * @param teardownTimeoutMs Optional budget for each of stop()'s waits, in
      * turn: on the streams it cancels, on maintenance in flight (a pass or an
      * over-budget drain kick), on the event loop, on an operator's operations
-     * already running, on modules and MCPL together, then on Discord awareness
+     * already running, on modules and MCPL (its servers and the inference
+     * requests they made) together, where a module whose start() is still
+     * running counts until that start() has settled and its stop() returned,
+     * then on Discord awareness
      * drains, which send nothing once stop() has begun, recording the call the
      * close ended. With a budget, a stop() can take up to six of them, besides
      * the withheld-spill deadline of a guard's write still under way. Omit to
@@ -3805,9 +3931,7 @@ export class AgentFramework {
      *   dropped, though a write the stream already had under way can still
      *   land in the run's namespace after them.
      * - an event loop still in a call, such as a module's onProcess, finishes
-     *   that call and the rest of its iteration, and then exits. A start()
-     *   made once that stop() has failed runs its own loop beside that last
-     *   iteration.
+     *   that call and the rest of its iteration, and then exits.
      * - a later stop() waits again, within its own budget, for any stream or
      *   loop this one left running, so the store never closes under it.
      *
@@ -3835,11 +3959,14 @@ export class AgentFramework {
         let settle;
         const attempt = new Promise((resolve, reject) => { settle = { resolve, reject }; });
         this.stopPromise = attempt;
-        void attempt.then(() => { this.stopCompleted = true; }, () => { });
-        // Failed cleanup can be retried while its original store is open. A
-        // terminal storage failure after successful close must remain a failure.
-        void attempt.catch(() => {
-            if (!this.ownedStoreClosed && this.stopPromise === attempt)
+        this.stopState = 'stopping';
+        void attempt.then(() => { this.stopState = 'completed'; }, (error) => {
+            this.stopState = 'failed';
+            // Failed cleanup can be retried while its original store is open. A
+            // terminal storage failure after successful close must remain a failure.
+            if (this.ownedStoreClosed)
+                this.closedStopFailure = { error };
+            else if (this.stopPromise === attempt)
                 this.stopPromise = null;
         });
         // The body still starts in this call, so its synchronous steps (closing
@@ -3847,24 +3974,28 @@ export class AgentFramework {
         this.stopOwned(teardownTimeoutMs).then(settle.resolve, settle.reject);
         return attempt;
     }
-    /** What start() and addModule() pass before either begins work of a
-     * lifecycle. A stop() still running refuses both, from the moment it
-     * claims its attempt until that attempt settles. A failed stop() has
-     * cleared its attempt, unless it closed an owned store, or the context
-     * managers it closes before that store, which are refused first. A
-     * completed stop() is cleared, and the call goes on as before;
-     * whether a lifecycle should begin after a stop() is #315's question. */
-    resetCompletedStop(verb) {
-        if (this.ownedStoreClosed)
-            throw new Error('Cannot start a new lifecycle: owned store is closed');
-        if (this.ownedStoreManagersClosed) {
-            throw new Error('Cannot start a new lifecycle: stop() closed its context managers, and then failed to close its owned store');
-        }
-        if (this.stopPromise && !this.stopCompleted)
-            throw new Error(`${verb} refused: the framework is stopping`);
-        if (this.stopCompleted) {
-            this.stopPromise = null;
-            this.stopCompleted = false;
+    refuseOnceStopped(verb) {
+        switch (this.stopState) {
+            case 'none':
+                return;
+            case 'stopping':
+                throw new Error(`${verb} refused: the framework is stopping`);
+            case 'completed':
+                throw new Error(`${verb} refused: this framework has stopped, and a stopped framework doesn't start again. ` +
+                    'Create a new AgentFramework on its store to go on, with its storePath if it opened the store itself.');
+            case 'failed': {
+                const closed = this.closedStopFailure;
+                if (closed) {
+                    throw new Error(`${verb} refused: this framework's stop() failed and its owned store is closed, so stop() can't be tried again: ` +
+                        `it rejects with that same failure, this error's cause: ${shutdownErrorMessage(closed.error)}. ` +
+                        "A stopped framework doesn't start again, and a new AgentFramework on its store doesn't finish what that stop() left unfinished.", { cause: closed.error });
+                }
+                throw new Error(`${verb} refused: this framework's stop() failed, and a stopped framework doesn't start again. ` +
+                    'A failed stop() may have left its cleanup or final persistence unfinished. ' +
+                    "Call stop() again: once a stop() of this one resolves, they're done, and only then should a new " +
+                    'AgentFramework use its store, with its storePath if this one opened the store itself, ' +
+                    'or another instance use anything this one shares.');
+            }
         }
     }
     /** Register before invoking the body, so the set holds the operation for
@@ -3995,6 +4126,15 @@ export class AgentFramework {
         // holding the wait for operator operations below until its handshake's
         // deadline.
         step(() => this.endConnectsInFlight());
+        // Nor does a server lost before or during the stop launch or dial again
+        // on its own: a retry already scheduled starts nothing, and none is
+        // scheduled after.
+        step(() => {
+            for (const connection of this.mcplServerRegistry?.getAllServers() ?? [])
+                connection.stopReconnecting();
+            for (const connection of this.modernServers().values())
+                connection.stopReconnecting();
+        });
         step(() => this.pushCoalescer?.suspend());
         step(() => this.flushCoalescingSnapshot());
         this.running = false;
@@ -4010,11 +4150,10 @@ export class AgentFramework {
         this.providerAdmissionClosed = true;
         for (const wake of [...this.retryWaitWakers])
             step(wake);
-        this.lifecycleGeneration++;
-        // The generation this stop ends; withheld spills close for it alone, so a
-        // start() after this stop has settled reopens them for its own.
-        const stoppingGeneration = this.lifecycleGeneration;
+        this.guardSpillsClosed = false;
         step(() => this.queue.close());
+        let inferences = [];
+        step(() => { inferences = this.inferenceRouter?.stopAll() ?? []; });
         step(() => this.tuneOutCoordinator?.stop());
         // Stop running code_execution scripts before cancelling streams: a
         // zombie script must not keep firing side-effectful tool calls into a
@@ -4027,9 +4166,8 @@ export class AgentFramework {
         // framework must not keep up to the whole ledger budget referenced.
         this.toolImageLedgers.clear();
         // A turn whose continuation is still on its way ends with the stop, as
-        // a turn's start a stop reaches does: the continuation would start only
-        // after a start(), in a lifecycle where its logical turn is gone
-        // (openLogical, below). Before the holds and the parks go, so the
+        // a turn's start a stop reaches does: the continuation never starts.
+        // Before the holds and the parks go, so the
         // continuation leaves them with its turn. Each drop is a step of its
         // own, so one that throws leaves the next agent's turn to end all the
         // same, as stop()'s other loops do.
@@ -4040,11 +4178,7 @@ export class AgentFramework {
         });
         // A stopped host must never hang behind its own cooldown.
         step(() => this.cancelProviderAdmission());
-        // An open logical turn doesn't survive a stop: a start after a restart
-        // on this instance opens a new one rather than continuing the old turn's
-        // routing (openLogical). A resume still continues its turn, with its
-        // routing state (turnRouting), since it carries that turn's own request
-        // on: beginAgentTurn opens the turn again for it.
+        // An open logical turn doesn't survive a stop.
         this.openLogical.clear();
         // Cancel the stream of every agent whose state holds one: streaming,
         // waiting on its tools, or ready at a tool boundary. Membrane reports
@@ -4152,9 +4286,11 @@ export class AgentFramework {
         // its idle watchdog. Its end stores its queue, as at any run's end; that
         // stream's late events are dropped once the run has left, and a later
         // stop() waits for the stream itself (leftRunning). (A start() is refused
-        // until this stop() settles, so no new lifecycle begins beside it.)
+        // once a stop() is admitted, so no new lifecycle begins beside it.)
         for (const [name, run] of this.ephemeralRuns)
             run.settle.reject(ephemeralRunStopped(name));
+        for (const agent of this.agents.values())
+            step(() => { agent.unpinTurnInputs(); });
         // Admission closed when stop() began. What admitted operations start now,
         // such as a surgery's config materialization, joins the set, so wait until
         // the set is empty. This comes after the streams and the event loop, which
@@ -4183,11 +4319,9 @@ export class AgentFramework {
         // generation and nothing reads the old fork's window again. So each live
         // fork ends here as a closing fork's end disposes it, and its release
         // passes on what it left unread, as any release does. Its channel unbinds
-        // first, as the idle sweep's does: a start() after this stop() would
-        // otherwise route a message still queued for it to a name that's gone. A
-        // fork whose spawn is still waiting for its creation to return has no
-        // binding yet, and its spawn binds nothing once it has ended
-        // (spawnConversationAgent).
+        // first, as the idle sweep's does. A fork whose spawn is still waiting
+        // for its creation to return has no binding yet, and its spawn binds
+        // nothing once it has ended (spawnConversationAgent).
         // Each is a step of its own, and each fork ends whatever its stream or
         // turn is doing, as each run does above: its end settles a tool-result
         // batch its stream still held and removes the stream's entries
@@ -4278,16 +4412,16 @@ export class AgentFramework {
         // workspace: its stub names the audit record. A write that was past its
         // deadline isn't waited for here, but the workspace's own stop waits for
         // the mount turn it holds, bounded only by teardownTimeoutMs.
-        this.guardSpillsClosedFor = stoppingGeneration;
+        this.guardSpillsClosed = true;
         // Stop modules and both engines' MCP servers in parallel
-        const shutdownPromises = [this.moduleRegistry.stopAll(teardownTimeoutMs)];
+        const shutdownPromises = [this.moduleRegistry.stopAll(teardownTimeoutMs), waitFor(inferences)];
         if (this.mcplServerRegistry) {
             shutdownPromises.push(this.mcplServerRegistry.closeAll(teardownTimeoutMs));
         }
         shutdownPromises.push(this.closeModernMcpConnections(teardownTimeoutMs));
         // A stopped framework's servers' addresses leave the reference registry,
         // so no other framework's stub reads them and the registry doesn't keep
-        // this one reachable. start() records them again.
+        // this one reachable.
         step(() => { for (const id of this.mcplServerConfigs.keys())
             referenceRegistry.forgetServerAddress(id, this); });
         // Timed-out or failed teardown retains its context and may still write.
@@ -4346,8 +4480,8 @@ export class AgentFramework {
         // No stream is left, unless its wait above ran out or its cancel threw:
         // from the start of stop() none registers and no agent turn starts
         // (providerAdmissionClosed, checked for every agent), and every stream
-        // registered before was cancelled and awaited above. (A start(), which
-        // would reopen admission, is refused until this stop() settles.)
+        // registered before was cancelled and awaited above. (A start() is
+        // refused once a stop() is admitted, so admission stays closed.)
         // What is still deferred (a message held for a turn's end whose flush
         // found the target busy again, or one deferred behind its target's own
         // state) would wait for a flush that may never come. Land each at its
@@ -4427,8 +4561,7 @@ export class AgentFramework {
             shutdownErrors.push(error);
         }
         if (this.ownsStore && teardownSucceeded) {
-            if (this.closeOpenManagers())
-                this.ownedStoreManagersClosed = true;
+            this.closeOpenManagers();
             try {
                 this.store.close();
                 this.ownedStoreClosed = true;
@@ -4889,7 +5022,6 @@ export class AgentFramework {
         const alive = [...this.openManagers].flatMap((ref) => ref.deref() ?? []);
         for (const contextManager of alive)
             this.closeManager(contextManager);
-        return alive.length > 0;
     }
     /** The framework's membrane, with each complete() call passed through
      *  `admit` along with the model it names. */
@@ -4899,8 +5031,17 @@ export class AgentFramework {
                 const value = Reflect.get(obj, prop, receiver);
                 if (prop === 'complete' && typeof value === 'function') {
                     return (...args) => {
-                        const model = args[0]?.config?.model;
-                        return admit(() => Reflect.apply(value, this.membrane, args), typeof model === 'string' ? model : undefined);
+                        const config = args[0]?.config;
+                        const model = config?.model;
+                        const options = args[1];
+                        const bounds = this.inferenceBounds;
+                        const sent = bounds !== null && options?.progressTimeoutMs === undefined
+                            ? [args[0], {
+                                    ...options,
+                                    progressTimeoutMs: wholeCallMs(bounds, typeof config?.maxTokens === 'number' ? config.maxTokens : undefined),
+                                }, ...args.slice(2)]
+                            : args;
+                        return admit(() => Reflect.apply(value, this.membrane, sent), typeof model === 'string' ? model : undefined);
                     };
                 }
                 return typeof value === 'function' ? value.bind(this.membrane) : value;
@@ -5038,7 +5179,7 @@ export class AgentFramework {
             // length: an operator release of it returns the hold to AF's own pacing.
             ...(pacing?.stated ? { statedWait: { model: agent.model, ownUntil: now + pacing.ownMs } } : {}),
             ...(auxiliary && (!existing || existing.auxiliaryOrigin) ? { auxiliaryOrigin: true } : {}),
-            ...(existing?.emptiedByDrop && held.length === 0 ? { emptiedByDrop: true } : {}) });
+            ...(existing?.emptiedBy && held.length === 0 ? { emptiedBy: existing.emptiedBy } : {}) });
         if (auxiliary && !existing) {
             console.error(`[provider-cooldown] agent=${agent.name} host hold (${hostHold.reason}) from an auxiliary call — ` +
                 `holding primary/auxiliary for ${delayMs}ms`);
@@ -5055,12 +5196,23 @@ export class AgentFramework {
             this.noteStatedWaitRun(agent.name, wait, now);
         return true;
     }
-    rearmExhaustedTurn(agent, error, trigger, ownsProviderGate, routing) {
+    takeAsTransient(agentName, error, trigger) {
+        if (isTransientFailure(error)) {
+            this.rearmDeadlineCuts.delete(agentName);
+            return true;
+        }
+        if (!isRearmed(trigger) || !isDeadlineExpiry(error))
+            return false;
+        const first = !this.rearmDeadlineCuts.has(agentName);
+        this.rearmDeadlineCuts.add(agentName);
+        return first;
+    }
+    rearmExhaustedTurn(agent, error, trigger, ownsProviderGate, routing, asTransient) {
         if (!ownsProviderGate || trigger === undefined || this.providerAdmissionClosed || this.turnRearmMs.length === 0)
             return;
         const done = this.turnRearms.get(agent.name) ?? 0;
         const notSent = (why) => console.error(`[inference-rearm] agent=${agent.name} turn not re-armed: ${why}`);
-        if (!isTransientFailure(error)) {
+        if (!asTransient) {
             if (done > 0)
                 notSent(`its failure isn't transient (${isMembraneError(error) ? error.type : boundFailureText(error.message, FAILURE_SUMMARY_MAX_CHARS)})`);
             return;
@@ -5207,12 +5359,15 @@ export class AgentFramework {
                     ? `no longer holds primary turns: the primary model is now ${model} (the wait stays recorded)`
                     : `primary hold ended after ${Date.now() - cooldown.startedAt}ms`));
         }
-        if ((cooldown.auxiliaryOrigin || cooldown.emptiedByDrop) && cooldown.heldRequests.length === 0) {
+        if ((cooldown.auxiliaryOrigin || cooldown.emptiedBy) && cooldown.heldRequests.length === 0) {
             // Nobody asked for an inference while parked, or what was held was a
-            // continuation since dropped with its turn: just reopen the gate. A
-            // primary the hold left pending won't run, so its recovery ends.
-            console.error(`[provider-cooldown] agent=${agentName} ${cooldown.auxiliaryOrigin ? 'auxiliary hold' : 'hold, its held continuation dropped,'} released after ${Date.now() - cooldown.startedAt}ms`);
-            if (cooldown.emptiedByDrop)
+            // continuation since dropped with its turn, or wakes since withdrawn:
+            // just reopen the gate. A primary the hold left pending won't run, so
+            // its recovery ends.
+            const which = cooldown.emptiedBy === 'drop' ? 'hold, its held continuation dropped,'
+                : cooldown.emptiedBy === 'withdrawal' ? 'hold, its held wakes withdrawn,' : 'auxiliary hold';
+            console.error(`[provider-cooldown] agent=${agentName} ${which} released after ${Date.now() - cooldown.startedAt}ms`);
+            if (cooldown.emptiedBy)
                 this.endPendingPrimary(agentName);
             this.flushAuxiliaryAdmission(agentName);
             return;
@@ -5862,12 +6017,7 @@ export class AgentFramework {
      */
     pushEvent(event) {
         if (event.type === 'tool-result' && this.queue?.isClosed) {
-            // What an operator reconciling a dropped result needs (the resident
-            // may run the tool again): which tool, and whether it succeeded.
-            const outcome = event.result.success && !event.result.isError
-                ? 'succeeded'
-                : `failed${event.result.error ? `: ${thrownText(event.result.error)}` : ''}`;
-            console.error(`[framework] ${event.agentName}: result of tool call ${event.callId} (${event.toolName ? `${event.toolName}, ` : ''}${event.moduleName}) arrived after stop — dropped; the tool ${outcome}`);
+            console.error(droppedToolResultLine(event, 'after stop'));
             return;
         }
         this.queue.push(event);
@@ -5897,6 +6047,13 @@ export class AgentFramework {
         else
             this.queue.push(event);
     }
+    dropRetiredModuleEvent(event, moduleName) {
+        if (this.queue.isClosed) {
+            this.pushModuleEvent(event, moduleName, true);
+            return;
+        }
+        console.error(retiredPushLine(event, moduleName));
+    }
     /**
      * Add a trace event listener for observability.
      */
@@ -5951,12 +6108,17 @@ export class AgentFramework {
             this.traceListeners.splice(index, 1);
     }
     /**
-     * Add a module at runtime. Refused, with a rejection, while a stop() is
-     * still running: a module added then would either be stopped by that stop
-     * or, once the stop has taken its list of modules to stop, stay started
-     * past it.
+     * Add a module at runtime. Refused, with a rejection, once a stop() has
+     * been admitted, before anything else is checked: while that stop() runs,
+     * a module added then would either be stopped by it or, once it has taken
+     * its list of modules to stop, stay started past it; once it has settled,
+     * the framework has stopped for good, as start() says. A stop() admitted
+     * while the module's start() runs stops the module once that start() has
+     * settled; if that start() fulfils, this rejects the same way then, with
+     * no `module:added`, and if it rejects, this rejects with its error.
      */
     async addModule(module) {
+        this.refuseOnceStopped('addModule()');
         // A server's tool prefix and a module's name share one namespace, as
         // create() checks at startup: a module isn't added under a prefix a
         // server holds, or one a restart is moving its server to.
@@ -5974,8 +6136,8 @@ export class AgentFramework {
                 throw new Error(`Module "${module.name}" collides with MCPL server "${id}"'s toolPrefix "${module.name}" (a closed tab)`);
             }
         }
-        this.resetCompletedStop('addModule()');
         await this.moduleRegistry.addModule(module);
+        this.refuseOnceStopped('addModule()');
         // The workspace judges whether an agent's history holds a message as the
         // framework judges its own notices, for its head-move notice
         // (noticeHeadMoves) and the writes it weighs against it. A module taken
@@ -5988,7 +6150,9 @@ export class AgentFramework {
         this.emitTrace({ type: 'module:added', moduleName: module.name });
     }
     /**
-     * Remove a module at runtime.
+     * Remove a module at runtime. A module whose start() is still running is
+     * stopped once that start() has settled; this waits for that and for its
+     * stop(), with no time limit.
      */
     async removeModule(name) {
         await this.moduleRegistry.removeModule(name);
@@ -6297,7 +6461,7 @@ export class AgentFramework {
                 : []),
         ];
     }
-    /** The registered workspace module, if any (used by save_image). */
+    /** The registered workspace module, if any (used by save_recent_image). */
     getWorkspaceModule() {
         const module = this.moduleRegistry.getAllModules().find((m) => m.name === 'workspace');
         return module && typeof module.writeBinary === 'function'
@@ -6770,15 +6934,11 @@ export class AgentFramework {
     stallSkips = 0;
     /** See WITHHELD_SPILL_DEADLINE_MS; an instance field so tests can shorten it. */
     withheldSpillDeadlineMs = WITHHELD_SPILL_DEADLINE_MS;
-    /** The lifecycle generation whose stop() has let the running annotations
-     *  finish: a withheld original is then no longer written to a workspace
-     *  that is stopping, and its stub names the audit record. A start() after
-     *  that stop() has finished has a generation of its own, so the spill gate
-     *  is open again for an instance kept with a store it doesn't own and that
-     *  is still open (start() doesn't restore stopped modules or MCPL
-     *  connections, and refuses an owned store that stop() closed). A start()
-     *  made while a stop() is still running is refused. */
-    guardSpillsClosedFor = null;
+    /** Set once a stop() has let the running annotations finish, and cleared
+     *  as each stop() begins: while set, a withheld original is no longer
+     *  written to a workspace that is stopping, and its stub names the audit
+     *  record. */
+    guardSpillsClosed = false;
     /** A new agent's guard: its persisted setting, the tool-results spill its
      *  withheld originals are written to, and the set stop() waits on
      *  (agent-framework #277). The setting is read from framework/state's
@@ -7453,7 +7613,7 @@ export class AgentFramework {
         // Bounded grace for cancelled streams. Stop cancels streams too; a turn
         // with no stream settles on its own. Report the abandon that already ran,
         // even if stop cuts its grace short.
-        const grace = Date.now() + 10_000;
+        const grace = Date.now() + (testAbandonGraces.get(this) ?? ABANDON_GRACE_MS);
         while (this.quiesced && !this.queue?.isClosed && this.activeTurnTokens.size > 0 && Date.now() < grace) {
             await new Promise((resolve) => setTimeout(resolve, 250));
         }
@@ -7876,8 +8036,9 @@ export class AgentFramework {
      * memory-only: they land within the turn, at a tool boundary or at its
      * end, and a crash before then loses them. That window runs to the turn's
      * end for a message held there and what is queued behind it, and, on a
-     * stream that declares it can't carry injected messages (membrane's XML
-     * prefill path, from 0.6.0), for every message deferred during the turn.
+     * stream that doesn't declare it carries injected messages (membrane's XML
+     * prefill path declares it can't), for every message deferred during the
+     * turn.
      *
      * A write that fails, or a queue over the cap, which writes nothing,
      * leaves the record as it last held it, except that store only, a write
@@ -7903,14 +8064,15 @@ export class AgentFramework {
         catch (err) {
             console.error('[host-mode] failed to persist deferred context writes:', err);
             this.deferredWritesFellBehind({ error: err });
-            return;
+            return false;
         }
         if (outcome === 'over-cap') {
             this.deferredWritesFellBehind('over-cap');
+            return false;
         }
-        else if (outcome !== 'nothing') {
+        if (outcome !== 'nothing')
             this.deferredWritesCaughtUp();
-        }
+        return true;
     }
     /**
      * Write the queue to its record as it stands, when the host is quiesced
@@ -9204,8 +9366,9 @@ export class AgentFramework {
      * **Inheritance.** `mode: 'shared'` (the default) gives the child the
      * parent's messages and fold state through shared storage: nothing is
      * copied, the child folds with the parent's memory tree, and neither can
-     * alter what the other reads. It needs branch-bound store handles and is
-     * refused, not silently downgraded, where they are missing. `mode: 'copy'`
+     * alter what the other reads. It needs a store that supports derivation
+     * (`ContextManager.supportsDerivation`), and is refused, not silently
+     * downgraded, without one. `mode: 'copy'`
      * is the historical mechanism — the parent's compiled context re-added as
      * the child's own messages — and works everywhere.
      *
@@ -9756,6 +9919,7 @@ export class AgentFramework {
         if (run) {
             run.endReason ??= 'stopped';
             run.endedBy ??= options.by;
+            run.endedFromOutside = true;
             // The awaiting caller is told who stopped the job and why, whether or
             // not a stream was in flight: settled first, so the aborted stream's own
             // settle ('Stream cancelled') finds the run already settled. The caller's
@@ -9978,13 +10142,14 @@ export class AgentFramework {
     /**
      * The creation ("consent") event: names what kind of agent this is, what
      * ends it and what happens to it when its spawner ends. A derived agent's
-     * creation is also told to the agent it was derived from (#270, Linn:
-     * "told when the body changes" as a property, not a courtesy): one
-     * host-framed line in the source's context, built from the same facts as
-     * the trace, with no wake; a host's derivationNotice can replace the line
-     * or send none. Both derivation paths announce after the
-     * fork's branch or copy exists, so a fork never inherits the notice about
-     * itself; a source that has ended is told nothing (lifecycleNotice).
+     * creation is told to the agent it was derived from only when the host
+     * asks for it with a derivationNotice and that returns text: one
+     * host-framed line in the source's context, with no wake, given the
+     * framework's line built from the same facts as the trace. Without one the
+     * source is told nothing; the trace is emitted either way. Both derivation
+     * paths announce after the fork's branch or copy exists, so a fork never
+     * inherits the notice about itself; a source that has ended is told
+     * nothing (lifecycleNotice).
      */
     announceAgentCreated(record) {
         this.emitTrace({
@@ -10001,8 +10166,9 @@ export class AgentFramework {
             ...(record.inherit ? { inherit: record.inherit } : {}),
         });
         const from = record.inherit?.from;
-        if (!from || from === record.name)
+        if (!from || from === record.name || !this.derivationNoticeHook)
             return;
+        const hook = this.derivationNoticeHook;
         const detail = {
             event: 'derived',
             agent: record.name,
@@ -10013,15 +10179,16 @@ export class AgentFramework {
             ...(record.relationships.resultTo ? { resultTo: record.relationships.resultTo } : {}),
             lifetime: record.lifetime,
         };
-        // A resumption is rare and always said. A first incarnation is tallied:
-        // past the threshold, a reader loop that forks a hundred times a session
-        // would fill its source's context with stamps (Linn, 2026-10-15), so
-        // the source hears a count line every `threshold` forks instead, with
-        // the latest described; every derivation still emits its trace.
+        // With the host's hook: a resumption is rare and always passed to it. A
+        // first incarnation is tallied: past the threshold, a reader loop that
+        // forks a hundred times a session would fill its source's context with
+        // stamps, so the hook is given a count line every `threshold` forks
+        // instead, with the latest described; every derivation still emits its
+        // trace.
         const threshold = this.collapseDerivationNoticesAfter;
         const tell = (defaultText, extra = {}) => {
             try {
-                const text = this.derivationNoticeHook ? this.derivationNoticeHook(record, from, defaultText) : defaultText;
+                const text = hook(record, from, defaultText);
                 if (text !== null)
                     this.lifecycleNotice(from, text, { ...detail, ...extra });
             }
@@ -10106,6 +10273,7 @@ export class AgentFramework {
         if (run) {
             run.endReason = reason;
             run.endedBy = record.ended?.by;
+            run.endedFromOutside = true;
             run.settle.reject(new AgentStoppedError(name, reason, record.ended?.by, detail));
             return;
         }
@@ -10114,6 +10282,15 @@ export class AgentFramework {
             return;
         this.releaseAgentRuntime(agent, this.channelOfHome(record.homeChannel), undefined, record.lifetime.kind === 'persistent');
     }
+    forgetFailureAccounting(name) {
+        this.consecutiveInferenceFailures.delete(name);
+        this.exhaustionRewinds.delete(name);
+        this.refusalStreak.delete(name);
+        this.refusalRewinds.delete(name);
+        this.rewindEpisode.delete(name);
+        if (this.forcedRewind.delete(name))
+            console.error(`[unstick] agent=${name} its /unstick session ended with its agent`);
+    }
     /**
      * Everything the process holds for a live, non-ephemeral agent that has
      * ended, released once, on every path an agent ends by — stopAgent, the
@@ -10159,8 +10336,10 @@ export class AgentFramework {
         this.eventGate?.agentGone(name);
         this.agents.delete(name);
         this.agentConfigs.delete(name);
+        this.deadlineCuts.delete(name);
+        this.freshCallsCut.delete(name);
+        this.forgetFailureAccounting(name);
         this.thinkingLossIncidents.forget(name);
-        this.reasoningLoss.forget(name);
         // main's manager release: the context manager an ephemeral run or a fork
         // opened is released with the agent (releaseManager).
         this.releaseManager(agent);
@@ -10201,6 +10380,7 @@ export class AgentFramework {
         // waits ends here as at a turn's end, alerted if it ran long
         // (endStatedWaitRun).
         this.turnRearms.delete(name);
+        this.rearmDeadlineCuts.delete(name);
         this.exhaustingRearms.delete(name);
         this.exhaustedTurns.delete(name);
         this.endStatedWaitRun(name);
@@ -10593,13 +10773,12 @@ export class AgentFramework {
     }
     /**
      * A start dropped before its stream sends anything (its agent was replaced,
-     * or stop() closed admission or ended the lifecycle the start began in)
-     * ends the logical turn it was running. stop() ends every open turn
-     * (openLogical), but a fresh start that awaited its batches' assembly
-     * across a stop() reaches its routing after it and opens its turn. That
-     * turn would then stay open, and the agent's first start after a restart
-     * would continue the dropped turn's routing. The identity check leaves any
-     * other turn open.
+     * or stop() closed admission) ends the logical turn it was running. stop()
+     * ends every open turn (openLogical), but a fresh start that awaited its
+     * batches' assembly across a stop() reaches its routing after it and opens
+     * its turn. That turn would then stay open, and the next start of the
+     * agent's name would continue the dropped turn's routing. The identity
+     * check leaves any other turn open.
      */
     endDroppedTurn(agentName, routing) {
         if (this.openLogical.get(agentName) === routing)
@@ -10610,8 +10789,36 @@ export class AgentFramework {
         // Its scripts take it as a settle's end of the turn: the start sent
         // nothing, so none of its own calls is waiting on a script.
         this.settledTurns.add(routing);
+        this.releaseTurnInputs(routing);
         this.codeExecution?.scripts.turnEnded(agentName, { id: routing.turnId, live: this.liveTurns(agentName, routing) }, false);
     }
+    pinTurnInputs(agent, routing) {
+        let range;
+        try {
+            const cm = agent.getContextManager();
+            const watermark = agent.getConsumedWatermark();
+            if (watermark && watermark.branch === cm.currentBranch().name) {
+                range = turnInputs(cm, watermark.sequence, agent.name, (metadata) => this.agentSees(agent, metadata));
+            }
+        }
+        catch (error) {
+            console.error(`[turn-inputs] ${agent.name}: could not read the turn's inputs, so none is pinned:`, error);
+        }
+        if (!range) {
+            agent.unpinTurnInputs();
+            return;
+        }
+        const id = agent.pinTurnInputs(range.first, range.last);
+        if (id !== undefined)
+            routing.inputsPin = { agent, id };
+    }
+    releaseTurnInputs(routing) {
+        const pin = routing.inputsPin;
+        if (!pin)
+            return;
+        routing.inputsPin = undefined;
+        pin.agent.unpinTurnInputs(pin.id);
+    }
     /** A logical turn's end, for every agent: it closes the agent's open
      *  logical turn when it is the settling stream's own (openLogical), and
      *  settles an active ephemeral run. The run's tool-call count comes from
@@ -10641,8 +10848,10 @@ export class AgentFramework {
         // or of the stream that now holds the agent, are left alone.
         if (stream) {
             // Ended, unless it's the logical turn this settle left open.
-            if (this.openLogical.get(agentName) !== stream)
+            if (this.openLogical.get(agentName) !== stream) {
                 this.settledTurns.add(stream);
+                this.releaseTurnInputs(stream);
+            }
             this.codeExecution?.scripts.turnEnded(agentName, { id: stream.turnId, live: this.liveTurns(agentName, stream) }, outcome.stopReason === 'exhausted', outcome.error);
         }
         const run = this.ephemeralRuns.get(agentName);
@@ -10897,8 +11106,11 @@ export class AgentFramework {
                 // deregistered, so disposal must release EventGate liveness itself.
                 this.eventGate?.onInferenceEnded(agent.name);
                 this.agents.delete(agent.name);
+                this.deadlineCuts.delete(agent.name);
+                this.freshCallsCut.delete(agent.name);
+                if (run.endedFromOutside)
+                    this.forgetFailureAccounting(agent.name);
                 this.thinkingLossIncidents.forget(agent.name);
-                this.reasoningLoss.forget(agent.name);
                 // Its pending self-wake ends with it, as a fork's does.
                 this.eventGate?.agentGone(agent.name);
                 this.releaseWindowNowOrAfterResume(agent);
@@ -11063,6 +11275,14 @@ export class AgentFramework {
             inputSchema: { type: 'object' },
         },
     ];
+    static WAKE_ADD_RULE_FIELDS = {
+        'behavior.debounce': 'debounceMs',
+        'behavior.rate_limit': 'rateLimit',
+        'behavior.passive_sample': 'passiveSample',
+        'behavior.judge': 'judge',
+        'position.before': 'insertBefore',
+        'position.after': 'insertAfter',
+    };
     /** Synthesized wake-rule tools: add/remove a gate.json policy at runtime.
      *  Present when a gate is wired. They write validated policies into the
      *  hot-reloaded gate.json (same validation as load), so a rule takes effect
@@ -11244,9 +11464,9 @@ export class AgentFramework {
     /** Synthesized drafts tool — present whenever MCPL channels are
      *  configured. A resident's held drafts (src/prose-drafts.ts): plain speech
      *  that was not sent, never published except by its resident's resend, and
-     *  kept as that module's retention says. Nullable
-     *  fields, cast like save_recent_image's: a caller whose provider presents
-     *  every property as required can still say "not in use". */
+     *  kept as that module's retention says. Its optional fields are nullable,
+     *  as save_recent_image's selectors are: a caller whose provider presents
+     *  every property as required can still say "not in use" (fieldInUse). */
     static DRAFTS_TOOL = {
         name: 'drafts',
         description: 'Your held drafts: plain speech of yours that was NOT sent — held back because an explicit send in its turn ' +
@@ -11285,10 +11505,10 @@ export class AgentFramework {
             required: ['action'],
         },
     };
-    /** Synthesized save_image tool — present when a workspace module is
+    /** Synthesized save_recent_image tool — present when a workspace module is
      *  registered. Lets the agent persist an image it has already seen in its
      *  own context (Discord attachments arrive inlined as base64 and are
-     *  otherwise unreachable as files). */
+     *  otherwise unreachable as files). Its three selectors are nullable. */
     static SAVE_IMAGE_TOOL = {
         name: 'save_recent_image',
         description: 'Save one or more recent images from your own context to workspace files. ' +
@@ -11303,7 +11523,8 @@ export class AgentFramework {
             'restart) the call fails and writes nothing — it never substitutes an older ' +
             'image. When other tool calls in the same batch are still running, the save ' +
             'waits for them so their images are counted. Receipts carry source tool call, MIME, byte size and SHA-256. Saved ' +
-            'files are visible via workspace tools.',
+            'files are visible via workspace tools. Select by `ref` or by ' +
+            '`index`/`count`; a selector you are not using may be omitted or passed as null.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -11311,18 +11532,24 @@ export class AgentFramework {
                     type: 'string',
                     description: 'Mount-prefixed destination path, e.g. "project/photos/name.png".',
                 },
+                // Nullable selectors: a caller whose provider presents every property
+                // as required must still be able to say "not this selector". Omission,
+                // null and "" all mean it isn't used (fieldInUse); any other value is
+                // checked. The descriptions name null, the form to ask for.
                 index: {
-                    type: 'number',
-                    description: 'Which image, counting back from the most recent (0 = most recent). Default 0.',
+                    type: ['integer', 'null'],
+                    description: 'Which image, counting back from the most recent (0 = most recent). Default 0. ' +
+                        'null, like omitting it, means the default.',
                 },
                 count: {
-                    type: 'number',
-                    description: 'How many images to save, starting at `index` and going further back. Default 1.',
+                    type: ['integer', 'null'],
+                    description: 'How many images to save, starting at `index` and going further back. Default 1. ' +
+                        'null, like omitting it, means the default.',
                 },
                 ref: {
-                    type: 'string',
+                    type: ['string', 'null'],
                     description: 'Save a specific tool-result image by its history ref (e.g. "img_k7x3q2_7", as shown in its placeholder in your context) instead of by position. ' +
-                        'Mutually exclusive with `index`/`count`.',
+                        'Mutually exclusive with `index`/`count`: pass null for the selector you are not using. null, like omitting it, means no ref.',
                 },
             },
             required: ['path'],
@@ -13797,8 +14024,9 @@ export class AgentFramework {
         // idiom): reasoning effort (thinking), provider params, token ceilings,
         // caching, refusal handling, timezone — a same-model side-process must
         // not silently run under different inference conditions than the
-        // resident it serves. Only identity- and surface-defining fields are
-        // overridden below.
+        // resident it serves. Below, identity- and surface-defining fields are
+        // overridden, and the window and thinking binding where the
+        // subconscious's config sets its own.
         const model = cfg.model ?? primaryConfig.model;
         const inherited = { ...primaryConfig };
         if (model !== primaryConfig.model) {
@@ -13807,6 +14035,7 @@ export class AgentFramework {
         }
         const agentConfig = {
             ...inherited,
+            ...readerModelFields(cfg),
             name,
             model,
             systemPrompt: cfg.systemPrompt,
@@ -13906,6 +14135,7 @@ export class AgentFramework {
                     config: {
                         model: cfg.model,
                         proseRouting: 'disabled',
+                        ...readerModelFields(cfg),
                     },
                     inheritRefusals: true,
                     onParentEnd: 'end',
@@ -14019,13 +14249,7 @@ export class AgentFramework {
         this.addMessage(reader, content, metadata);
     }
     async runLoop() {
-        // A loop ends with its lifecycle. A stop() whose budget ran out while
-        // this loop was in a call (a module's onProcess) returns before the call
-        // does, and a start() after it begins a lifecycle with a loop of its own;
-        // this one finishes its iteration and exits, rather than running beside
-        // that loop for good.
-        const lifecycle = this.lifecycleGeneration;
-        while (this.running && this.lifecycleGeneration === lifecycle) {
+        while (this.running) {
             try {
                 await this.processNextEvent();
             }
@@ -14287,18 +14511,21 @@ export class AgentFramework {
                     // compiled prefix and the live request still match without it
                     // (#232 gap 5).
                     //
-                    // A stream that declares it can't carry injected messages
-                    // (supportsInjectedMessages false: membrane's XML prefill path,
-                    // from membrane 0.6.0) gets none, so nothing is drained here.
-                    // Everything queued for the agent waits for the turn-end flush, as
-                    // a held message does, rather than sitting in the window between
-                    // rounds the stream never showed it.
+                    // Only a stream that declares it carries injected messages
+                    // (supportsInjectedMessages true: membrane's native path) gets
+                    // them. Membrane's XML prefill path declares false, and a stream
+                    // that doesn't say is taken as one that doesn't, so nothing is
+                    // drained for either: everything queued for the agent waits for
+                    // the turn-end flush, as a held message does, rather than sitting
+                    // in the window between rounds the stream never showed it. A
+                    // boundary with no stream, the direct API's, drains: its
+                    // re-inference compiles from the store.
                     const midTurnInjections = [];
                     // What this boundary stored for the agent to hear, in store order,
                     // for a boundary that leaves it to the turn's next start as
                     // arrivals: that start's compile sends it.
                     const heard = [];
-                    if (currentState.supportsInjectedMessages !== false) {
+                    if (currentState.supportsInjectedMessages === true || !currentState.stream) {
                         // A clock row due (storeDueClock) goes right after the round's
                         // results, ahead of what is drained below, and joins the stream
                         // the same way. A boundary that passed during the round can't
@@ -14397,12 +14624,10 @@ export class AgentFramework {
                     }
                     // A live stream handed these messages after the results follows
                     // them in its next round, not the tool loop of a reply to
-                    // [Continue]: that round's rows carry no prompt. One that doesn't
-                    // say whether it carries them (membrane 0.5.x, whose native path
-                    // carries them and whose XML path drops them) counts as carrying
-                    // them here, as at the drain above. A boundary that ends the turn,
-                    // restarts the stream or falls back to a new start below hands
-                    // them to no live stream, and a new start reads its own prompt from
+                    // [Continue]: that round's rows carry no prompt. A boundary that
+                    // ends the turn, restarts the stream or falls back to a new start
+                    // below hands them to no live stream, and a new start reads its own
+                    // prompt from
                     // what it sends. (The routing notice below rides only an injection
                     // already here.)
                     if (midTurnInjections.length > 0) {
@@ -14645,11 +14870,10 @@ export class AgentFramework {
                         }
                         // Streaming path: convert results and resume the stream.
                         // Mid-turn messages collected above ride along as injected user
-                        // messages. Membrane's native path (from 0.5.72) appends them
-                        // after the tool_result envelope, so the next round of THIS turn
-                        // hears them. Its XML prefill path drops them with a warning on
-                        // 0.5.x, and from 0.6.0 declares it can't carry them, so none are
-                        // collected for it. Each goes as its participant and content
+                        // messages. Membrane's native path appends them after the
+                        // tool_result envelope, so the next round of THIS turn hears
+                        // them. Its XML prefill path declares it can't carry them, so
+                        // none are collected for it. Each goes as its participant and content
                         // alone: a stored row's metadata is the host's record, not input
                         // for membrane. Each goes with its name and text as the store
                         // keeps them, whether it's a heard message, rendered or not, or a
@@ -14679,15 +14903,11 @@ export class AgentFramework {
                         // the watermark of the turn's compile and read as unread, so a
                         // coalesced replacement could remove a message the agent heard
                         // and answered (and that its later replies were minted after).
-                        // Only a stream that declares it carries them is marked read
-                        // (supportsInjectedMessages true: membrane's native path, from
-                        // membrane 0.6.0). One that doesn't say may be membrane 0.5.87's
-                        // XML path, which drops them with a warning, and a message marked
-                        // read there could no longer be replaced though the agent never
-                        // saw it. So without the declaration they stay unread, as before
-                        // this mark.
-                        // The shown mark moves at every boundary that injects, declared
-                        // or not, since there a doubt counts as shown.
+                        // Only a stream that declares it carries them gets them, and so
+                        // is marked read (supportsInjectedMessages true: membrane's native
+                        // path).
+                        // The shown mark moves at every boundary that injects into its
+                        // stream.
                         // The mark is the store's head, a scalar, as a compile's is: it
                         // also covers what was stored since the compile without being
                         // carried, such as another slot's messages, and a write that
@@ -14699,8 +14919,7 @@ export class AgentFramework {
                         // replies after it go without their thinking, whatever the mark
                         // says; deferring those writers is the fix.
                         if (midTurnInjections.length > 0) {
-                            // Possibly shown, whatever the stream declares: the first-view
-                            // mark (CoalescerHost.isUnshown) counts a doubt as shown.
+                            // Shown: the stream carries them (CoalescerHost.isUnshown).
                             agent.markContextShown();
                             if (currentState.supportsInjectedMessages === true)
                                 agent.markContextConsumed();
@@ -14749,15 +14968,23 @@ export class AgentFramework {
     async dispatchProcessEventToModules(event, startTime = Date.now()) {
         // Dispatch to all modules, tracking responses with module names
         const responses = [];
-        for (const module of this.moduleRegistry.getAllModules()) {
+        const registrations = new Map();
+        const stillRegistered = (entry) => this.moduleRegistry.registrationOf(entry.moduleName) === registrations.get(entry);
+        const dispatched = this.moduleRegistry.getAllModules()
+            .map((module) => ({ module, registration: this.moduleRegistry.registrationOf(module.name) }));
+        for (const { module, registration } of dispatched) {
             // The framework's own toolsets module answers no event; every agent has
             // it now, so it isn't listed beside the modules that do.
             if (module instanceof ToolsetsModule)
                 continue;
+            if (this.moduleRegistry.registrationOf(module.name) !== registration)
+                continue;
             try {
                 const processState = this.moduleRegistry.createProcessState(module.name);
                 const response = await module.onProcess(event, processState);
-                responses.push({ moduleName: module.name, response });
+                const entry = { moduleName: module.name, response };
+                responses.push(entry);
+                registrations.set(entry, registration);
             }
             catch (error) {
                 console.error(`Module ${module.name} error handling process event:`, error);
@@ -14783,7 +15010,16 @@ export class AgentFramework {
         // responses, a tool call's dispatch and the trace go on, since a module
         // can't catch a throw on this path, and one module's mustn't cost the
         // event.
-        const applying = responses.filter(({ moduleName, response }) => {
+        const dropUnregistered = (entry) => {
+            if (stillRegistered(entry))
+                return false;
+            const parts = responseParts(entry.response);
+            if (parts) {
+                console.error(`[process] module ${entry.moduleName} stopped before its response to ${event.type} was applied, so none of it was: ${parts}`);
+            }
+            return true;
+        };
+        const applying = responses.filter((entry) => !dropUnregistered(entry)).filter(({ moduleName, response }) => {
             const refusal = malformedResponseContent(response);
             if (refusal === null)
                 return true;
@@ -14804,7 +15040,7 @@ export class AgentFramework {
             const { moduleName, response } = entry;
             const step = { at: 'its start' };
             try {
-                await this.applyProcessResponse(response, event, moduleName, surface, step);
+                this.applyProcessResponse(response, event, moduleName, surface, step);
             }
             catch (error) {
                 entry.threw = { at: step.at, error: error instanceof Error ? error.message : String(error) };
@@ -14825,7 +15061,7 @@ export class AgentFramework {
             this.logProcessEvent(event, applying);
         }
     }
-    async applyProcessResponse(response, event, moduleName, 
+    applyProcessResponse(response, event, moduleName, 
     /** The event's surface envelope, when it is console/API input. */
     surface, 
     /** Names the operation under way, for the line when one throws. */
@@ -15576,8 +15812,10 @@ export class AgentFramework {
         else {
             // Nothing live under the name: only what the process keeps by name.
             this.closingConversationAgents.delete(agentName);
+            this.deadlineCuts.delete(agentName);
+            this.freshCallsCut.delete(agentName);
+            this.forgetFailureAccounting(agentName);
             this.thinkingLossIncidents.forget(agentName);
-            this.reasoningLoss.forget(agentName);
             // A continuation of its turn still on its way goes with it.
             this.dropContinuations(agentName, { kind: 'dropped', why: 'its agent was disposed' });
             this.turnRouting.delete(agentName);
@@ -16566,19 +16804,20 @@ export class AgentFramework {
             });
         }
     }
-    /** Withdraw unstarted wakes whose sole cause is this subject (§4.2). */
+    /** Withdraw unstarted wakes whose sole cause is this subject (§4.2), and
+     *  a merged start whose every request is withdrawn. */
     cancelCoalescedWakes(subject) {
-        this.pendingRequests = this.pendingRequests.filter((r) => r.coalescingSubject !== subject);
-        for (const cooldown of this.providerAccelerationCooldowns.values()) {
-            cooldown.heldRequests = cooldown.heldRequests.filter((r) => r.coalescingSubject !== subject);
-        }
-        // A wake of the subject's merged into a start that carries a turn on
+        // A wake of the subject's merged into a start
         // (MERGED_BATCH) is withdrawn from the start's batch, so no stop puts
         // it back and no pass unpacks it.
+        const emptied = new Set();
         const unrecord = (r) => {
             const batch = mergedBatch(r);
             if (batch?.some((w) => w.coalescingSubject === subject)) {
-                r[MERGED_BATCH] = batch.filter((w) => w.coalescingSubject !== subject);
+                const left = batch.filter((w) => w.coalescingSubject !== subject);
+                r[MERGED_BATCH] = left;
+                if (left.length === 0)
+                    emptied.add(r);
             }
         };
         for (const r of this.pendingRequests)
@@ -16590,6 +16829,29 @@ export class AgentFramework {
         for (const pass of this.passRequests ?? [])
             for (const requests of pass.values())
                 requests.forEach(unrecord);
+        const withdrawn = (r) => r.coalescingSubject === subject || emptied.has(r);
+        this.pendingRequests = this.pendingRequests.filter((r) => !withdrawn(r));
+        for (const cooldown of this.providerAccelerationCooldowns.values()) {
+            const held = cooldown.heldRequests.length;
+            cooldown.heldRequests = cooldown.heldRequests.filter((r) => !withdrawn(r));
+            if (held > 0 && cooldown.heldRequests.length === 0)
+                cooldown.emptiedBy = 'withdrawal';
+        }
+        for (const pass of this.passRequests ?? []) {
+            for (const requests of pass.values()) {
+                if (!requests.some((r) => emptied.has(r)))
+                    continue;
+                const left = requests.filter((r) => !emptied.has(r));
+                requests.length = 0;
+                requests.push(...left);
+            }
+        }
+        for (const start of emptied) {
+            if (!start.coalescingBatch || start.coalescingSubject !== undefined)
+                continue;
+            console.error(`[coalescing] ${start.agentName}: its deferred batches were withdrawn while its wake waited; turn not started (no wake cause left)`);
+            this.emitTrace({ type: 'mcpl:coalescing', kind: 'turn-withdrawn', agentName: start.agentName, subjects: start.coalescingBatchSubjects ?? [] });
+        }
     }
     /**
      * A placement in the deferred queue is upgraded in place once the flush has
@@ -17099,7 +17361,7 @@ export class AgentFramework {
                     recovery.releasedAt = now;
                 requests = [...providerCooldown.heldRequests, ...requests];
             }
-            // A start that carries a turn on and came back before it took its
+            // A start that came back before it took its
             // token stands for the batch it was merged from (MERGED_BATCH),
             // including one a hold released just now. The batch takes its place,
             // each request as it was, judged one by one from here: a wait holds
@@ -17501,10 +17763,10 @@ export class AgentFramework {
                 start[REARMED] = true;
             else
                 delete start[REARMED];
-            // A start that carries a turn on and took in wakes that don't records
-            // the batch it was merged from (MERGED_BATCH): until it takes its
-            // token it stands for them all.
-            if (continuesTurn(start) && requests.some((r) => !continuesTurn(r)))
+            // A start merged from more than one request, any of them not the
+            // turn's, records the batch it was merged from (MERGED_BATCH): until
+            // it takes its token it stands for them all.
+            if (requests.length > 1 && requests.some((r) => !continuesTurn(r)))
                 start[MERGED_BATCH] = [...requests];
             else
                 delete start[MERGED_BATCH];
@@ -18154,15 +18416,13 @@ export class AgentFramework {
         const refuse = (error) => ({ success: false, error, isError: true });
         // Plain text, not a JSON-quoted string: draft text must read exactly as held.
         const ok = (text) => ({ success: true, data: [{ type: 'text', text }] });
-        // null and omission mean the same thing: the field is not in use.
-        const present = (v) => v !== undefined && v !== null;
         const action = input.action;
         if (action !== 'list' && action !== 'read' && action !== 'resend' && action !== 'dismiss') {
             return refuse('action must be one of "list", "read", "resend" or "dismiss".');
         }
         const unused = (field) => refuse(`${field} is not used by action "${action}" — pass null or omit it.`);
         let ids = [];
-        if (present(input.draftIds)) {
+        if (fieldInUse(input.draftIds)) {
             if (action === 'list')
                 return unused('draftIds');
             if (!Array.isArray(input.draftIds) || input.draftIds.some((id) => typeof id !== 'string' || !id.trim())) {
@@ -18174,17 +18434,20 @@ export class AgentFramework {
             if (ids.length > 20)
                 return refuse('draftIds names more than 20 drafts; act on them in smaller groups.');
         }
-        if (present(input.destination) && action !== 'resend')
+        if (fieldInUse(input.destination) && action !== 'resend')
             return unused('destination');
-        if (present(input.confirmDuplicate) && action !== 'resend')
+        // false is "don't confirm", which every other action already does, so only
+        // true is a confirmDuplicate those actions refuse.
+        if (fieldInUse(input.confirmDuplicate) && input.confirmDuplicate !== false && action !== 'resend') {
             return unused('confirmDuplicate');
-        if (present(input.offset) && action !== 'list')
+        }
+        if (fieldInUse(input.offset) && action !== 'list')
             return unused('offset');
         if (action === 'list') {
             let offset = 0;
-            if (present(input.offset)) {
+            if (fieldInUse(input.offset)) {
                 const raw = input.offset;
-                const n = typeof raw === 'number' ? raw : typeof raw === 'string' && /^\d+$/.test(raw.trim()) ? Number(raw) : NaN;
+                const n = integerField(raw);
                 if (!Number.isInteger(n) || n < 0)
                     return refuse('offset must be a whole number of drafts to skip (0 or more), or null.');
                 offset = n;
@@ -18299,13 +18562,13 @@ export class AgentFramework {
             return refuse('No channels are configured, so there is nowhere to resend to.');
         const home = this.homeOf(agentName);
         let spec = typeof input.destination === 'string' ? input.destination.trim() : '';
-        if (present(input.destination) && typeof input.destination !== 'string') {
+        if (fieldInUse(input.destination) && typeof input.destination !== 'string') {
             return refuse('destination must be "#channel", "@person" or a channel id.');
         }
         if (!spec && !home)
             return refuse('resend needs a destination: "#channel", "@person" or a channel id.');
         let confirmDuplicate = false;
-        if (present(input.confirmDuplicate)) {
+        if (fieldInUse(input.confirmDuplicate)) {
             if (typeof input.confirmDuplicate !== 'boolean')
                 return refuse('confirmDuplicate must be true, false or null.');
             confirmDuplicate = input.confirmDuplicate;
@@ -19297,28 +19560,6 @@ export class AgentFramework {
             return;
         this.writeChannelNotices(this.channelOpenedNotices(agentName, serverId, channels, cause), `auto-open notice (${cause})`, 'recordChannelAutoOpenNotice');
     }
-    tellReasoningLoss(agent, make) {
-        if (this.agents.get(agent.name) !== agent)
-            return;
-        let line;
-        try {
-            line = make();
-        }
-        catch (err) {
-            console.error(`[reasoning] ${agent.name}: could not tell what reasoning was lost:`, err);
-            return;
-        }
-        if (!line)
-            return;
-        try {
-            this.addMessage('user', [{ type: 'text', text: line }], { system: true, kind: 'reasoning-loss' }, { forAgent: agent.name });
-        }
-        catch (err) {
-            console.error(`[reasoning] ${agent.name}: the line for lost reasoning could not be stored:`, err);
-            return;
-        }
-        console.error(`[reasoning] ${agent.name}: told of reasoning no longer in its context`);
-    }
     /**
      * Write a builder's channel notices in order, each on its own: one that
      * can't be written is logged, and the rest are still written. A reader's
@@ -20615,6 +20856,8 @@ export class AgentFramework {
         }
     }
     async startAgentStream(agent, trigger, attempt = 0, providerGateAlreadyHeld = false) {
+        if (attempt === 0)
+            this.deadlineCuts.delete(agent.name);
         const ownsProviderGate = this.registry.ownsProviderScheduling(agent.name);
         // A stopping framework starts no turn, whoever owns provider admission
         // (conversation agents and ephemeral runs do not take the gate).
@@ -20684,6 +20927,15 @@ export class AgentFramework {
                         console.error(`[provider-admission] ${agent.name}: host quiesced while parked — the merged start goes back as its ${batch.length} requests`);
                         return;
                     }
+                    if (this.providerAccelerationCooldowns.has(agent.name)) {
+                        this.releasePrimaryProviderGate(agent.name);
+                        this.eventGate?.onInferenceEnded(agent.name);
+                        this.pendingRequests.push(trigger ?? {
+                            agentName: agent.name, reason: 'provider-admission:requeue', source: 'scheduler', timestamp: Date.now(),
+                        });
+                        console.error(`[provider-admission] ${agent.name}: a provider hold stands — parked wake requeued for the scheduler, not started`);
+                        return;
+                    }
                     await this.startAgentStream(agent, trigger, attempt, true);
                 }).catch((error) => {
                     this.releasePrimaryProviderGate(agent.name);
@@ -20850,7 +21102,7 @@ export class AgentFramework {
             const held = hold.heldRequests.length;
             hold.heldRequests = take(hold.heldRequests);
             if (held > 0 && hold.heldRequests.length === 0)
-                hold.emptiedByDrop = true;
+                hold.emptiedBy = 'drop';
         }
         for (const parked of [...this.parkedContinuations]) {
             if (!isContinuation(parked))
@@ -20967,9 +21219,8 @@ export class AgentFramework {
      * gets inference:aborted with `reason`, and lastInference records its end
      * as driveStream's would, when the record is still this turn's. Nothing of
      * the kind when another turn of this agent's name holds the turn token (one
-     * begun after a stop and start, or by a replacement agent object): the
-     * event and the record carry only the name, so this frame's would end that
-     * newer turn instead.
+     * begun by a replacement agent object): the event and the record carry only
+     * the name, so this frame's would end that newer turn instead.
      */
     abortDroppedTurn(agentName, turnToken, reason, startedAt) {
         const owner = this.activeTurnTokens.get(agentName);
@@ -21144,7 +21395,6 @@ export class AgentFramework {
     /** This start's window (checkAhead), which its checks read for an
      *  operator's abandon. */
     checkWindow) {
-        const lifecycle = this.lifecycleGeneration;
         const resumesTurn = resumesLogicalTurn(trigger?.reason);
         let carry = turnCarryOf(trigger);
         const turnProseRouting = trigger?.suppressProse ? 'disabled' : agent.proseRouting;
@@ -21328,7 +21578,7 @@ export class AgentFramework {
         // everything the turn has decided about where its speech goes.
         //  - A resume (a budget restart, a tool-result-guard retry) carries its
         //    turn's request on and keeps the turn's object as it is, and the
-        //    turn stays, or after a stop() becomes again, the agent's open turn.
+        //    turn stays, or becomes again, the agent's open turn.
         //  - A silent start routes no prose. It gets an object of its own, with
         //    no locus, so it neither takes nor disturbs an open turn's. Its
         //    object is the agent's live routing while it runs, and the open
@@ -21353,8 +21603,6 @@ export class AgentFramework {
         let opensTurn = false;
         if (resumesTurn) {
             routing = this.routingOf(agent.name);
-            // The turn a resume continues is open, unless a stop() ended every
-            // open turn since: it opens again, so its later starts continue it.
             if (!trigger?.suppressProse && !this.openLogical.has(agent.name))
                 this.openLogical.set(agent.name, routing);
         }
@@ -21383,6 +21631,10 @@ export class AgentFramework {
             const head = agent.branchHead();
             if (head)
                 routing.start = head;
+            if (!routing.silent)
+                this.pinTurnInputs(agent, routing);
+            else
+                agent.unpinTurnInputs();
         }
         this.turnRouting.set(agent.name, routing);
         if (opensTurn)
@@ -21527,11 +21779,11 @@ export class AgentFramework {
         });
         // A budget restart continues the same logical inference window. The
         // predecessor keeps EventGate liveness until its successor terminates,
-        // and the successor takes it again if it ended in between: at a stop()
-        // (a restart left queued, which a start() then takes up), or at a
+        // and the successor takes it again if it ended in between: at a
         // provider hold that kept the successor from starting (a stated wait at
-        // its last admission check, or a cooldown after its own call failed),
-        // whose end queues it again.
+        // its last admission check, a hold standing when its park behind an
+        // auxiliary call ended, or a cooldown after its own call failed), whose
+        // end queues it again.
         if (!resumesTurn) {
             this.eventGate?.onInferenceStarted(agent.name);
         }
@@ -21575,9 +21827,6 @@ export class AgentFramework {
                 const name = agent.name;
                 agent.onCompiledToSend = (messages) => hub.observeCompile(name, messages);
             }
-            if (!agent.onThinkingStrip) {
-                agent.onThinkingStrip = (strip, branch) => this.tellReasoningLoss(agent, () => this.reasoningLoss.forStrip(agent.name, branch, strip, (this.activeTurnTokens.has(agent.name) && this.turnRouting.get(agent.name)) || {}, agent.getContextManager()));
-            }
             // Module gatherContext (fail-open, per-module timeout — the module's
             // contextTimeoutMs, else the registry default). Injections are
             // channel-scoped via scopeInjectionsForAgent, matching the MCPL hook
@@ -21608,13 +21857,11 @@ export class AgentFramework {
             // An ephemeral watchdog may dispose this Agent while hooks/compile await,
             // and stop() may close provider admission. Do not create a provider
             // stream after its generation lost ownership, or once admission closed,
-            // or once a stop() and a start() have begun another lifecycle, as after
-            // the compile: these come before a stop kept for the turn, which goes
-            // with it.
-            if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed || lifecycle !== this.lifecycleGeneration) {
+            // as after the compile: these come before a stop kept for the turn,
+            // which goes with it.
+            if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed) {
                 const why = this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
-                    : this.providerAdmissionClosed ? 'the framework was stopping'
-                        : 'the framework was stopped and started again';
+                    : 'the framework was stopping';
                 const reason = `a turn assembled while ${why} is dropped before it sends anything`;
                 console.error(`[turn] ${agent.name}: ${reason}`);
                 this.endDroppedTurn(agent.name, routing);
@@ -21655,6 +21902,7 @@ export class AgentFramework {
                 // This turn's retries are the framework's (errorPolicy below), not
                 // membrane's inside each attempt.
                 membraneRetries: false,
+                inferenceBounds: this.inferenceBounds,
             });
             // Each later round this stream sends is noted as it goes (noteRoundSent).
             if (noteRequestSent)
@@ -21662,18 +21910,16 @@ export class AgentFramework {
             if (carriedBodies)
                 this.streamCarried.set(stream, new Set(carriedBodies));
             // The compile can wait for annotations (each batch has one spill
-            // deadline), so check ownership, admission, and the lifecycle again.
-            // A stop followed by start must not revive this earlier turn.
+            // deadline), so check ownership and admission again.
             // Membrane's yielding stream starts its request when it is first
             // iterated, so cancelling it here, before driveStream, sends nothing.
             // A turn that was mid-compile when stop() cancelled every stream would
             // otherwise register after that pass and outlive stop(). The caller's
             // finally releases the turn token.
             const stopping = this.providerAdmissionClosed;
-            if (this.agents.get(agent.name) !== agent || stopping || lifecycle !== this.lifecycleGeneration) {
+            if (this.agents.get(agent.name) !== agent || stopping) {
                 const why = this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
-                    : stopping ? 'the framework was stopping'
-                        : 'the framework was stopped and started again';
+                    : 'the framework was stopping';
                 const reason = `a turn compiled while ${why} is dropped before it sends anything`;
                 console.error(`[turn] ${agent.name}: ${reason}`);
                 this.cancelUnsentStream(agent, stream, `compiled while ${why}`);
@@ -21794,14 +22040,12 @@ export class AgentFramework {
             // catch never holds a compiled request.) As at the checks after the
             // hooks and after the compile, a replaced agent or a stopping framework
             // comes first: the turn is dropped as theirs, and the stop goes with
-            // it, and so does a framework stopped and started again, as after the
-            // compile. A failed start with no stop goes on below as before.
+            // it. A failed start with no stop goes on below as before.
             const stopAtFailure = this.takeStartStop(agent, checkWindow);
             if (stopAtFailure) {
-                if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed || lifecycle !== this.lifecycleGeneration) {
+                if (this.agents.get(agent.name) !== agent || this.providerAdmissionClosed) {
                     const why = this.agents.get(agent.name) !== agent ? 'the agent was replaced or removed'
-                        : this.providerAdmissionClosed ? 'the framework was stopping'
-                            : 'the framework was stopped and started again';
+                        : 'the framework was stopping';
                     const reason = `a turn whose request couldn't be built while ${why} is dropped before it sends anything`;
                     console.error(`[turn] ${agent.name}: ${reason}`);
                     this.endDroppedTurn(agent.name, routing);
@@ -21813,6 +22057,7 @@ export class AgentFramework {
                 return false;
             }
             const retry = trigger && withTurnCarry(trigger, carry);
+            const asTransient = this.takeAsTransient(agent.name, err, trigger);
             if (ownsProviderGate && this.holdProviderAcceleration(agent, err, retry)) {
                 // Capacity scheduling is not poisoned history. The cooldown timer owns
                 // one later fresh compile; no immediate retry or exhaustion marker.
@@ -21828,23 +22073,28 @@ export class AgentFramework {
                 this.endHeldStart(agent, checkWindow, turnToken, turnStartedAt, routing);
                 return false;
             }
-            const action = statedWait === 'fail' || (isRearmed(trigger) && !gotPartway(routing))
-                ? { retry: false } : this.errorPolicy.onInferenceError(err, agent.name, attempt);
+            const cuts = isDeadlineExpiry(err) ? this.deadlineCuts.get(agent.name) ?? 0 : undefined;
+            const action = statedWait === 'fail' || (isRearmed(trigger) && (!gotPartway(routing) || (isDeadlineExpiry(err) && !asTransient)))
+                ? { retry: false } : this.errorPolicy.onInferenceError(err, agent.name, cuts ?? attempt);
+            if (action.retry && cuts !== undefined)
+                this.deadlineCuts.set(agent.name, cuts + 1);
+            else
+                this.deadlineCuts.delete(agent.name);
+            if (!action.retry && cuts !== undefined && cuts > 0)
+                this.freshCallsCut.add(agent.name);
             if (action.retry) {
                 // A policy's delay can be a provider's retry-after: wait all of it.
                 await this.waitForRetry(action.delayMs, checkWindow, agent);
-                if (this.providerAdmissionClosed || lifecycle !== this.lifecycleGeneration) {
+                if (this.providerAdmissionClosed) {
                     // stop() ended the wait: that cancels the retry, it does not hasten
-                    // it. A stop() and a start() since this start began cancel it too,
-                    // as after the compile: the retry would revive the earlier
-                    // lifecycle's turn in the next one, and a stop kept for the turn
-                    // goes with it. The turn ends as one dropped before it sends
-                    // anything does: a terminal event saying why, after the
-                    // inference:failed above, and its record's end. Nothing is written
+                    // it, and a stop kept for the turn goes with it. The turn ends as
+                    // one dropped before it sends anything does: a terminal event
+                    // saying why, after the inference:failed above, and its record's
+                    // end. Nothing is written
                     // but the [speech-not-posted] notice; this frame still owns its
                     // token, since no retry frame replaced it.
                     this.nameUnpostedSpeech(agent, routing);
-                    this.abortDroppedTurn(agent.name, turnToken, this.providerAdmissionClosed ? RETRY_CANCELLED_BY_STOP : RETRY_ACROSS_RESTART, turnStartedAt);
+                    this.abortDroppedTurn(agent.name, turnToken, RETRY_CANCELLED_BY_STOP, turnStartedAt);
                     if (this.activeTurnTokens.get(agent.name) === turnToken) {
                         this.activeTurnTokens.delete(agent.name);
                         this.activeTurnTriggers.delete(agent.name);
@@ -21890,7 +22140,7 @@ export class AgentFramework {
                     speech: '',
                     ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
                 }, routing);
-                if (isRearmed(trigger) && isTransientFailure(err))
+                if (isRearmed(trigger) && asTransient)
                     this.exhaustingRearms.add(agent.name);
                 this.emitTrace({
                     type: 'inference:exhausted',
@@ -21911,7 +22161,7 @@ export class AgentFramework {
                 if (action.emit) {
                     this.pushEvent(action.emit);
                 }
-                this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, routing);
+                this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, routing, asTransient);
             }
             // No handoff on either failure branch: the terminal branch deleted the
             // token above; the retry branch's recursive startAgentStream replaced
@@ -22527,7 +22777,7 @@ export class AgentFramework {
                             assistantBlocks = roundContent.filter((b) => b.type !== 'tool_result');
                         }
                         else {
-                            // Fallback (older membrane / XML tool mode): preamble + calls.
+                            // XML tool mode: this round's text and its calls.
                             // XML mode: persist the verbatim generation on each tool_use
                             // (membrane#36 round-trip fidelity). context.rawText is the
                             // parser's fullMatch — the exact <function_calls> block the
@@ -22539,14 +22789,12 @@ export class AgentFramework {
                             const rawXml = rawText && /^<(antml:)?function_calls>/.test(rawText)
                                 ? rawText
                                 : undefined;
-                            // Persist THIS round's text only. `roundPreamble` (membrane
-                            // ≥0.5.79) is the per-round delta; the legacy `preamble` is
-                            // CUMULATIVE in XML mode — persisting it per round stored each
-                            // round's text N times and re-persisted injected
-                            // <function_results> as the agent's own words (the Evander
-                            // 2026-08-08 scaffold-leak pyramid: r1 ×3, r2 ×2).
-                            const roundText = event.context.roundPreamble ??
-                                event.context.preamble;
+                            // Persist THIS round's text only: `roundPreamble` is the
+                            // per-round delta. The `preamble` beside it is CUMULATIVE in XML
+                            // mode: persisting it per round would store each round's text N
+                            // times and re-persist injected <function_results> as the
+                            // agent's own words.
+                            const roundText = event.context.roundPreamble;
                             assistantBlocks = [];
                             if (roundText) {
                                 assistantBlocks.push({ type: 'text', text: roundText });
@@ -22570,9 +22818,7 @@ export class AgentFramework {
                         this.roundTurns?.set(assistantBlocks, streamRouting);
                         // Whether this stream can carry messages injected with the round's
                         // results: true on membrane's native path and false on its XML
-                        // prefill path, from membrane 0.6.0, and absent on 0.5.x, which
-                        // doesn't declare it. The tool boundary reads it from the agent's
-                        // state.
+                        // prefill path. The tool boundary reads it from the agent's state.
                         agent.enterWaitingForTools(calls, stream, event.context.supportsInjectedMessages);
                         // Speak-while-acting: route THIS round's prose to the locus NOW
                         // instead of batching every segment to the end of the turn. Long
@@ -22610,12 +22856,10 @@ export class AgentFramework {
                             liveProseRouting = true;
                         // Whether this round's tool-result batch (and anything queued
                         // with it) will be presented to the model before it speaks
-                        // again: the producer says so when it can (membrane from 0.6.0).
-                        // Otherwise, as on membrane 0.5.x, every round counts as
-                        // presenting it. That holds for 0.5.x's native rounds, while its
-                        // XML path drops what's injected, so a 'now' notice there reaches
+                        // again: the stream declares it (true on membrane's native path).
+                        // On the XML path, which declares false, a 'now' notice reaches
                         // the agent at its next compile instead.
-                        const presentsInjections = event.context.supportsInjectedMessages ?? true;
+                        const presentsInjections = event.context.supportsInjectedMessages === true;
                         // Queued under this turn's routing, whenever it posts, and
                         // streamed by this stream once published.
                         // This round's request was answered: what it carried is heard.
@@ -23348,14 +23592,14 @@ export class AgentFramework {
                             // active (native roundContent), each mid-turn round's prose was
                             // already delivered when that round yielded — only the TRAILING
                             // prose (blocks after the last tool round) remains here. On the
-                            // fallback path (XML tool mode / older membrane: no roundContent,
-                            // so nothing was live-routed) the historical behavior applies:
+                            // XML tool path (no roundContent, so nothing was live-routed)
+                            // the historical behavior applies:
                             // route the whole turn's parsed segments, once, now. The global
                             // speech/thoughts split is left untouched (module/TUI rendering
                             // unaffected) — this only governs what reaches the channel.
                             //
                             // Native round routing uses the live sticky flag, which a fresh
-                            // injected message can reset. The legacy/fallback path has no
+                            // injected message can reset. The XML tool path has no
                             // reliable round boundaries, so retain its historical turn-wide
                             // scan to avoid double-posting.
                             const toolCalls = response.content
@@ -23582,6 +23826,7 @@ export class AgentFramework {
                             break;
                         this.abandonAgentScripts(agent.name, 'stream error', streamRouting);
                         const retry = retryOf(trigger);
+                        const asTransient = this.takeAsTransient(agent.name, err, trigger);
                         // A hold takes the turn's retry, or, once stop() has closed
                         // admission, the turn ends here (endFailureAtStop).
                         if (ownsProviderGate && this.holdProviderAcceleration(agent, err, retry)) {
@@ -23597,8 +23842,15 @@ export class AgentFramework {
                                 this.eventGate?.onInferenceEnded(agent.name);
                             break;
                         }
-                        const action = statedWait === 'fail' || (isRearmed(trigger) && !gotPartway(streamRouting))
-                            ? { retry: false } : this.errorPolicy.onInferenceError(err, agent.name, attempt);
+                        const cuts = isDeadlineExpiry(err) ? this.deadlineCuts.get(agent.name) ?? 0 : undefined;
+                        const action = statedWait === 'fail' || (isRearmed(trigger) && (!gotPartway(streamRouting) || (isDeadlineExpiry(err) && !asTransient)))
+                            ? { retry: false } : this.errorPolicy.onInferenceError(err, agent.name, cuts ?? attempt);
+                        if (action.retry && cuts !== undefined)
+                            this.deadlineCuts.set(agent.name, cuts + 1);
+                        else
+                            this.deadlineCuts.delete(agent.name);
+                        if (!action.retry && cuts !== undefined && cuts > 0)
+                            this.freshCallsCut.add(agent.name);
                         if (action.retry) {
                             // A stop made during the wait reaches no stream: the check after
                             // the wait ends the turn, as the guard's check after its wait
@@ -23660,7 +23912,7 @@ export class AgentFramework {
                                 speech: '',
                                 ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
                             }, this.agents.get(agent.name) === agent && agent.streamId === myStreamId ? streamRouting : undefined, streamRouting);
-                            if (isRearmed(trigger) && isTransientFailure(err))
+                            if (isRearmed(trigger) && asTransient)
                                 this.exhaustingRearms.add(agent.name);
                             this.emitTrace({
                                 type: 'inference:exhausted',
@@ -23680,7 +23932,7 @@ export class AgentFramework {
                             if (action.emit) {
                                 this.pushEvent(action.emit);
                             }
-                            this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, streamRouting);
+                            this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, streamRouting, asTransient);
                         }
                         break;
                     }
@@ -23755,7 +24007,7 @@ export class AgentFramework {
                                     agentName: agent.name,
                                     error: terminal,
                                 });
-                                this.rearmExhaustedTurn(agent, new Error(terminal), trigger, ownsProviderGate, streamRouting);
+                                this.rearmExhaustedTurn(agent, new Error(terminal), trigger, ownsProviderGate, streamRouting, false);
                                 // Postmortem 2026-05-28 P2 #7: persist the abort to the
                                 // inference log so future investigations can attribute the
                                 // terminal cause without relying on live in-memory reducer
@@ -23773,6 +24025,8 @@ export class AgentFramework {
                         break;
                     }
                     case 'usage': {
+                        this.rearmDeadlineCuts.delete(agent.name);
+                        this.deadlineCuts.delete(agent.name);
                         // Cumulative across the stream's rounds: replace, never sum.
                         latestUsage = event.usage;
                         // The stream's accumulated fresh input, which is what the
@@ -23859,9 +24113,6 @@ export class AgentFramework {
                         if (thinkingDrops?.recordedAfter !== undefined) {
                             this.noteThinkingLoss(agent.name, placedDrops, thinkingDrops.recordedAfter);
                         }
-                        if (thinkingDrops) {
-                            this.tellReasoningLoss(agent, () => this.reasoningLoss.forDrops(agent.name, thinkingDrops.branch ?? '', placedDrops, streamRouting, agent.getContextManager()));
-                        }
                         try {
                             if (!thinkingDroppedInStream) {
                                 strat?.reportRealInputTokens?.(realTotal, compiledRequest ? { system: compiledRequest.system, tools: compiledRequest.tools } : undefined);
@@ -23995,6 +24246,7 @@ export class AgentFramework {
             agent.reset();
             this.emitTrace({ type: 'inference:failed', agentName: agent.name, error: err.message, stack: err.stack });
             const retry = retryOf(trigger);
+            const asTransient = this.takeAsTransient(agent.name, err, trigger);
             if (ownsProviderGate && this.holdProviderAcceleration(agent, err, retry)) {
                 // Once stop() has closed admission, nothing is held, and the turn
                 // ends here (endFailureAtStop).
@@ -24032,7 +24284,7 @@ export class AgentFramework {
                 speech: '',
                 ...(statedWait === 'fail' ? this.statedWaitNotSlept(err) : { error: err.message }),
             }, streamRouting);
-            if (isRearmed(trigger) && isTransientFailure(err))
+            if (isRearmed(trigger) && asTransient)
                 this.exhaustingRearms.add(agent.name);
             this.emitTrace({
                 type: 'inference:exhausted',
@@ -24040,7 +24292,7 @@ export class AgentFramework {
                 error: err.message,
                 ...this.classifyInferenceError(err),
             });
-            this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, streamRouting);
+            this.rearmExhaustedTurn(agent, err, trigger, ownsProviderGate, streamRouting, asTransient);
             // Postmortem 2026-05-28 P2 #7: catch-path failures (stream itself
             // threw) were previously only visible via in-memory trace listeners.
             // Persist to inference log for forensic attribution.
@@ -24246,7 +24498,11 @@ export class AgentFramework {
     }
     /**
      * Execute a tool call and return the result.
-     * Routes to the appropriate handler (module registry or MCPL).
+     * Routes it where the agent's own call of the name goes: to the
+     * framework's own tools the agent has (agent_settings, the workspace and
+     * gate tools, think, journal, prose_help and the rest), the channel tools,
+     * MCPL or the module registry. skip_reply, which ends the turn it's called
+     * in, is refused, since this call isn't made in one.
      * Its one caller in the framework is the operator's puppet
      * (puppetToolCall), which puts the agent's inline cap on the call as
      * resultMaxChars; a host may call it as well.
@@ -24292,8 +24548,11 @@ export class AgentFramework {
      *   wire ordering. For its own duration the puppet HOLDS the turn-alive
      *   marker (wakes requeue, cross-turn writers defer), so a wake landing
      *   during the tool's execution cannot start a turn underneath the pair.
-     * - Refused for tools outside the agent's own surface (canUseTool): the
-     *   stored pair must be an act the agent could genuinely have taken.
+     * - Refused for tools outside the agent's own surface (the tools it may
+     *   call, availableToolsForPresentation), and for skip_reply, by name or
+     *   through a toolsets--act that reaches it, which ends the turn it's
+     *   called in: the stored pair must be an act the agent could genuinely
+     *   have taken.
      * - The call executes FOR REAL through the shared dispatch (MCPL,
      *   channel tools, utils, modules) with the agent's provenance — a
      *   puppeted walk_to actually moves the avatar.
@@ -24334,12 +24593,17 @@ export class AgentFramework {
                 : `puppet refused: agent ${agentName} is ${shown} (requires idle — ` +
                     `injecting a turn under an active stream corrupts wire ordering)`);
         }
-        const onSurface = this.getToolsForAgent(agentName)
-            .some((t) => t.name === toolName && agent.canUseTool(t.name));
+        const onSurface = this.availableToolsForPresentation(agentName).some((t) => t.name === toolName);
         if (!onSurface) {
             throw new Error(`puppet refused: tool ${toolName} is not on ${agentName}'s surface — ` +
                 `the stored pair must be an act the agent could genuinely have taken`);
         }
+        const route = this.toolRoute({ id: '', name: toolName, input }, agentName);
+        const acting = route.kind === 'host-act' && route.host.kind === 'call' ? route.host.name : toolName;
+        if (acting === 'skip_reply') {
+            throw new Error("puppet refused: skip_reply ends the turn it's called in, and a puppeted call isn't made in one, " +
+                'so nothing was run or stored');
+        }
         // Anthropic-shaped id so the stored pair is indistinguishable from a
         // provider-issued call.
         const alphabet = 'ABCDEFGHJKMNPQRSTVWXYZabcdefghjkmnpqrstvwxyz0123456789';
@@ -24471,96 +24735,119 @@ export class AgentFramework {
             this.emitTrace({ type: 'tool:failed', module: 'framework', tool: call.name, callId: call.id, error: marked });
             return { success: false, error: marked, isError: true };
         }
-        if (isPresentationTool(call.name))
-            return this.editToolPresentation(call.callerAgentName ?? '__ephemeral__', call);
-        // Client-side programmatic tool calling for callers that await a tool's
-        // result: the puppet and a host through executeToolCall, and a module
-        // through callTool. Keyed by callerAgentName, so each agent's scripts are
-        // its own.
-        if (call.name === CODE_EXECUTION_TOOL_NAME && this.codeExecution) {
-            return this.runCodeExecution(call.callerAgentName ?? '__ephemeral__', call);
-        }
-        // toolsets--act on a host toolset's tool (the built-in one, a server's
-        // tab) goes where a programmatic call of that tool goes, under its name.
-        if (call.name === META_TOOL_NAMES.act && call.callerAgentName !== undefined) {
-            const host = this.hostPresentation?.resolveAct(call.callerAgentName, call.input) ?? null;
-            if (host?.kind === 'refused')
-                return failed({ success: false, error: host.error, isError: true });
-            if (host?.kind === 'call')
-                return this.executeToolCallFrom({ ...call, name: host.name, input: host.args }, origin);
-        }
-        // RFC-014: toolsets--act, resolved to the dynamic tool it calls, goes
-        // where a programmatic call of that tool goes, with its instance.
-        if (call.name === META_TOOL_NAMES.act && this.toolsetHub && this.mcplServerRegistry) {
-            const target = this.resolveToolsetAct(call);
-            if (!target.ok)
-                return failed({ success: false, error: target.error, isError: true }, this.everyServerRedactor()(target.error));
-            if (origin.kind === 'agent') {
-                const failure = this.agentToolPermissionFailure(origin.agentName, target.call, false);
-                if (failure)
-                    return failed(failure, this.everyServerRedactor()(failure.error ?? ''));
-            }
-            return this.executeMcplToolCall(target.call, target.serverId, target.prefix);
-        }
-        // MCPL tools go where the model's own call of the name goes, by the same
-        // resolver and with the prefix it matched: to the server whose listing
-        // has the name, else the longest matching prefix.
-        if (this.mcplServerRegistry) {
-            const mcpl = this.resolveMcplTool(call.name);
-            if (mcpl)
-                return this.executeMcplToolCall(call, mcpl[0], mcpl[1]);
-        }
-        // Synthesized channel tools. This route was missing: when
-        // subscription-GC moved off the retired MCPL unsubscribe tool onto the
-        // generic channel_close (discord-mcpl b095a9f), module-originated
-        // closes started failing downstream as "Invalid tool name format" —
-        // the janitor had been silently broken since. `origin` is trusted
-        // dispatch context established at the call boundary above, not
-        // inferred from which method was used: only the ModuleRegistry closure
-        // carries module provenance (see handleToolClose). The agent-only
-        // synthesized verbs (think, skip_reply) are deliberately not routed
-        // here.
-        if (call.name.startsWith('channel_') && this.channelRegistry) {
-            const turn = call.name === 'channel_publish' && call.callerAgentName ? this.callingTurnOf(call.callerAgentName, call) : undefined;
-            const input = call.name === 'channel_publish' && call.callerAgentName
-                ? this.publishInputWithTurnLocus(call.input, call.callerAgentName, turn)
-                : call.input;
-            return this.channelRegistry.handleChannelToolCall(call.name, input, origin.kind === 'agent' && turn ? { ...origin, inTurn: true } : origin);
-        }
-        // drafts: the calling resident's own held drafts. A puppeted call has
-        // agent origin and acts on that resident's drafts, as the model's own
-        // call does through dispatchToolCall, but it isn't made inside the
-        // resident's turn, so it takes none of the turn's channels, engages none,
-        // and isn't noted as the resident's speech (callingTurnOf). A module
-        // holds no drafts.
-        if (call.name === 'drafts' && this.channelRegistry && origin.kind === 'agent') {
-            return this.draftsToolResult(origin.agentName, call.input);
-        }
-        // The heartbeat's tools, for callers that await a tool's result (an
-        // in-process call, a puppet, a module's callTool). A module is trusted;
-        // an agent is held to what dispatch holds it to.
-        if (this.heartbeat?.ownsTool(call.name)) {
-            const refusal = origin.kind === 'module' ? null : this.heartbeatRefusal(call.callerAgentName ?? '__ephemeral__', call);
-            return refusal ? { success: false, error: refusal, isError: true } : this.runHeartbeatTool(call);
-        }
-        // Module tools. The caller uses the result in process, so it gets the
-        // module's own result, as the module returned it, less a refusal it
-        // claims, which is the dispatcher's to say.
-        // The tune-out tool, in process: the same body the dispatcher runs, its
-        // answer awaited here (it can wait for the tune-out's transport).
-        if ((call.name === 'tune_out' || call.name === 'focus') && this.tuneOutCoordinator) {
-            const agentName = call.callerAgentName ?? this.primaryAgentName ?? '__ephemeral__';
-            const input = (call.input ?? {});
-            // The calling turn's own channels, as the channel tools read them here (origin.own).
-            const own = origin.kind === 'agent' ? origin.own ?? [] : [];
-            const turn = this.callingTurnOf(agentName, call);
-            return call.name === 'focus' ? this.handleFocusTool(agentName, input, own, turn) : this.handleTuneOutTool(agentName, input, own, turn);
-        }
-        if (SUBCONSCIOUS_TOOL_NAMES.includes(call.name)) {
-            const routed = this.readerToolCall(origin.kind === 'agent' ? origin.agentName : call.callerAgentName ?? '__ephemeral__', call);
-            return 'refused' in routed ? failed({ success: false, error: `${routed.refused}, so the call didn't run.`, isError: true }) : routed.result;
+        const subject = origin.kind === 'agent' ? origin.agentName : call.callerAgentName ?? '__ephemeral__';
+        const route = this.toolRoute(call, call.callerAgentName);
+        switch (route.kind) {
+            case 'presentation':
+                return this.editToolPresentation(call.callerAgentName ?? '__ephemeral__', call);
+            // toolsets--act on a host toolset's tool (the built-in one, a server's
+            // tab) goes where a programmatic call of that tool goes, under its name.
+            case 'host-act':
+                if (route.host.kind === 'refused')
+                    return failed({ success: false, error: route.host.error, isError: true });
+                return this.executeToolCallFrom({ ...call, name: route.host.name, input: route.host.args }, origin);
+            // RFC-014: toolsets--act, resolved to the dynamic tool it calls, goes
+            // where a programmatic call of that tool goes, with its instance.
+            case 'toolset-act': {
+                const target = this.resolveToolsetAct(call);
+                if (!target.ok)
+                    return failed({ success: false, error: target.error, isError: true }, this.everyServerRedactor()(target.error));
+                if (origin.kind === 'agent') {
+                    const failure = this.agentToolPermissionFailure(origin.agentName, target.call, false);
+                    if (failure)
+                        return failed(failure, this.everyServerRedactor()(failure.error ?? ''));
+                }
+                return this.executeMcplToolCall(target.call, target.serverId, target.prefix);
+            }
+            case 'mcpl':
+                return this.executeMcplToolCall(call, route.serverId, route.prefix);
+            // Synthesized channel tools. This route was missing: when
+            // subscription-GC moved off the retired MCPL unsubscribe tool onto the
+            // generic channel_close (discord-mcpl b095a9f), module-originated
+            // closes started failing downstream as "Invalid tool name format" —
+            // the janitor had been silently broken since. `origin` is trusted
+            // dispatch context established at the call boundary above, not
+            // inferred from which method was used: only the ModuleRegistry closure
+            // carries module provenance (see handleToolClose).
+            case 'channel': {
+                const turn = call.name === 'channel_publish' && call.callerAgentName ? this.callingTurnOf(call.callerAgentName, call) : undefined;
+                const input = call.name === 'channel_publish' && call.callerAgentName
+                    ? this.publishInputWithTurnLocus(call.input, call.callerAgentName, turn)
+                    : call.input;
+                return this.channelRegistry.handleChannelToolCall(call.name, input, origin.kind === 'agent' && turn ? { ...origin, inTurn: true } : origin);
+            }
+            case 'agent-settings':
+                return this.awaitedToolAnswer((deliver) => this.dispatchAgentSettingsToolCall(subject, call, deliver));
+            case 'save-image':
+                return this.awaitedToolAnswer((deliver) => this.dispatchSaveImageToolCall(subject, call, deliver));
+            case 'read-image':
+                return this.awaitedToolAnswer((deliver) => this.dispatchReadImageToolCall(subject, call, deliver));
+            case 'fetch-reference':
+                return this.awaitedToolAnswer((deliver) => this.dispatchFetchReferenceToolCall(subject, call, deliver));
+            case 'gate-status':
+                return this.awaitedToolAnswer((deliver) => this.dispatchGateToolCall(subject, call, deliver));
+            // The tune-out tool, in process: the same body the dispatcher runs, its
+            // answer awaited here (it can wait for the tune-out's transport).
+            case 'tune-out': {
+                const agentName = call.callerAgentName ?? this.primaryAgentName ?? '__ephemeral__';
+                const input = (call.input ?? {});
+                // The calling turn's own channels, as the channel tools read them here (origin.own).
+                const own = origin.kind === 'agent' ? origin.own ?? [] : [];
+                const turn = this.callingTurnOf(agentName, call);
+                return call.name === 'focus' ? this.handleFocusTool(agentName, input, own, turn) : this.handleTuneOutTool(agentName, input, own, turn);
+            }
+            case 'subconscious': {
+                const routed = this.readerToolCall(subject, call);
+                return 'refused' in routed ? failed({ success: false, error: `${routed.refused}, so the call didn't run.`, isError: true }) : routed.result;
+            }
+            case 'sleep':
+                return this.awaitedToolAnswer((deliver) => this.dispatchSleepToolCall(subject, call, deliver));
+            // The heartbeat's tools, for callers that await a tool's result (an
+            // in-process call, a puppet, a module's callTool). A module is trusted;
+            // an agent is held to what dispatch holds it to.
+            case 'heartbeat': {
+                const refusal = origin.kind === 'module' ? null : this.heartbeatRefusal(call.callerAgentName ?? '__ephemeral__', call);
+                return refusal ? { success: false, error: refusal, isError: true } : this.runHeartbeatTool(call);
+            }
+            case 'wake-rule':
+                return this.awaitedToolAnswer((deliver) => this.dispatchWakeRuleToolCall(subject, call, deliver));
+            case 'event-tags':
+                return this.awaitedToolAnswer((deliver) => this.dispatchEventTagsToolCall(subject, call, deliver));
+            case 'agent-verb':
+                if (origin.kind === 'module')
+                    return failed(agentsOwnVerbRefusal(call.name));
+                if (call.name === 'skip_reply') {
+                    return failed({
+                        success: false,
+                        error: "skip_reply ends the turn it's called in, and this call wasn't made in a turn, so nothing was done.",
+                        isError: true,
+                    });
+                }
+                return this.channelRegistry.handleChannelToolCall(call.name, call.input, origin);
+            // Client-side programmatic tool calling for callers that await a tool's
+            // result: the puppet and a host through executeToolCall, and a module
+            // through callTool. Keyed by callerAgentName, so each agent's scripts are
+            // its own.
+            case 'code-execution':
+                return this.runCodeExecution(call.callerAgentName ?? '__ephemeral__', call);
+            // drafts: the calling resident's own held drafts. A puppeted call has
+            // agent origin and acts on that resident's drafts, as the model's own
+            // call does through dispatchToolCall, but it isn't made inside the
+            // resident's turn, so it takes none of the turn's channels, engages none,
+            // and isn't noted as the resident's speech (callingTurnOf). A module
+            // holds no drafts.
+            case 'drafts':
+                if (origin.kind === 'module')
+                    return failed(agentsOwnVerbRefusal(call.name));
+                return this.draftsToolResult(origin.agentName, call.input);
+            case 'prose-help':
+                return { success: true, data: PROSE_ROUTING_HELP };
+            case 'module':
+                // Module tools. The caller uses the result in process, so it gets the
+                // module's own result, as the module returned it, less a refusal it
+                // claims, which is the dispatcher's to say.
+                return this.moduleRegistry.handleToolCall(call);
         }
-        return this.moduleRegistry.handleToolCall(call);
     }
     /**
      * RFC-014: the calls toolsets--act resolved to a server's dynamic tool,
@@ -25288,7 +25575,7 @@ export class AgentFramework {
         // this write's own, rather than a timer Node would cut to 1 ms.
         if (!Number.isFinite(deadline))
             deadline = Date.now() + this.withheldSpillDeadlineMs;
-        if (this.guardSpillsClosedFor === this.lifecycleGeneration)
+        if (this.guardSpillsClosed)
             return null;
         const place = this.toolResultFilePlace(label);
         if (!place)
@@ -26341,6 +26628,71 @@ export class AgentFramework {
         const refused = bareToolName(call.name) === 'skip_reply' && (!permitted || this.refusesSelfWake(call));
         return { name: call.name, cause: permitted || refused ? silenceCauseOf([call]) : null, refused, permitted };
     }
+    toolRoute(call, actor) {
+        const name = call.name;
+        if (isPresentationTool(name))
+            return { kind: 'presentation' };
+        if (name === META_TOOL_NAMES.act) {
+            const host = actor === undefined ? null : this.hostPresentation?.resolveAct(actor, call.input) ?? null;
+            if (host)
+                return { kind: 'host-act', host };
+            if (this.toolsetHub && this.mcplServerRegistry)
+                return { kind: 'toolset-act' };
+        }
+        const mcpl = this.mcplServerRegistry ? this.resolveMcplTool(name) : null;
+        if (mcpl)
+            return { kind: 'mcpl', serverId: mcpl[0], prefix: mcpl[1] };
+        if (name.startsWith('channel_') && this.channelRegistry)
+            return { kind: 'channel' };
+        if (name === 'agent_settings')
+            return { kind: 'agent-settings' };
+        if (name === 'save_recent_image')
+            return { kind: 'save-image' };
+        if (name === 'read_image')
+            return { kind: 'read-image' };
+        if (name === 'fetch_reference')
+            return { kind: 'fetch-reference' };
+        if (name === 'gate_status' && this.eventGate)
+            return { kind: 'gate-status' };
+        if ((name === 'tune_out' || name === 'focus') && this.tuneOutCoordinator)
+            return { kind: 'tune-out' };
+        if (SUBCONSCIOUS_TOOL_NAMES.includes(name))
+            return { kind: 'subconscious' };
+        if ((name === 'sleep' || name === 'wake') && this.eventGate)
+            return { kind: 'sleep' };
+        if (this.heartbeat?.ownsTool(name))
+            return { kind: 'heartbeat' };
+        if ((name === 'wake_add_rule' || name === 'wake_remove_rule') && this.eventGate)
+            return { kind: 'wake-rule' };
+        if (name === 'event_tags' && this.eventGate)
+            return { kind: 'event-tags' };
+        if ((name === 'think' || name === 'journal' || name === 'skip_reply') && this.channelRegistry)
+            return { kind: 'agent-verb' };
+        if (name === CODE_EXECUTION_TOOL_NAME && this.codeExecution)
+            return { kind: 'code-execution' };
+        if (name === 'drafts' && this.channelRegistry)
+            return { kind: 'drafts' };
+        if (name === PROSE_HELP_TOOL.name)
+            return { kind: 'prose-help' };
+        return { kind: 'module' };
+    }
+    pushToolResult(agentName, call, moduleName) {
+        return (result) => this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName, result });
+    }
+    awaitedToolAnswer(run) {
+        return new Promise((resolve) => {
+            try {
+                run((result) => {
+                    const answer = { ...result };
+                    delete answer.refused;
+                    resolve(answer);
+                });
+            }
+            catch (error) {
+                resolve({ success: false, error: thrownText(error), isError: true });
+            }
+        });
+    }
     /**
      * Dispatch a call the agent made. `turnId` is the turn it was made in
      * (TurnRouting.turnId), as its caller knows it: a model's call, the turn
@@ -26392,200 +26744,190 @@ export class AgentFramework {
             enrichedCall.callerTurnId = turnId;
         else
             delete enrichedCall.callerTurnId;
-        if (isPresentationTool(call.name)) {
-            const result = this.editToolPresentation(agentName, enrichedCall);
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tool-presentation', result });
-            return;
-        }
-        // toolsets--act on a host toolset's tool (the built-in one, a server's
-        // tab): the call of that tool, under its own name, down the path a
-        // direct call of it takes, permissions included.
-        if (enrichedCall.name === META_TOOL_NAMES.act) {
-            const host = this.hostPresentation?.resolveAct(agentName, enrichedCall.input) ?? null;
-            if (host) {
-                this.dispatchHostAct(agentName, call, host, turnId);
+        const route = this.toolRoute(enrichedCall, agentName);
+        switch (route.kind) {
+            case 'presentation': {
+                const result = this.editToolPresentation(agentName, enrichedCall);
+                this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tool-presentation', result });
                 return;
             }
-        }
-        // RFC-014: toolsets--act calls a server's dynamic tool, down the same
-        // path as a direct call of it (dispatchToolsetAct).
-        if (enrichedCall.name === META_TOOL_NAMES.act && this.toolsetHub && this.mcplServerRegistry) {
-            const scriptWaiter = this.scriptToolWaiters.get(enrichedCall.id);
-            if (scriptWaiter)
-                scriptWaiter.route.toServer = true;
-            this.dispatchToolsetAct(agentName, enrichedCall);
-            return;
-        }
-        // Route MCPL tool calls to the appropriate server via prefix map
-        const mcplMatch = this.resolveMcplTool(enrichedCall.name);
-        if (mcplMatch && this.mcplServerRegistry) {
-            // A script's call: its waiter keeps that it went to a server, for the
-            // script lane's exit (scriptToolWaiters).
-            const scriptWaiter = this.scriptToolWaiters.get(enrichedCall.id);
-            if (scriptWaiter)
-                scriptWaiter.route.toServer = true;
-            this.dispatchMcplToolCall(agentName, enrichedCall, mcplMatch[0], mcplMatch[1]);
-            return;
-        }
-        // Route synthesized channel tools
-        if (enrichedCall.name.startsWith('channel_') && this.channelRegistry) {
-            this.dispatchChannelToolCall(agentName, enrichedCall);
-            return;
-        }
-        if (enrichedCall.name === 'agent_settings') {
-            this.dispatchAgentSettingsToolCall(agentName, enrichedCall);
-            return;
-        }
-        if (enrichedCall.name === 'save_recent_image') {
-            this.dispatchSaveImageToolCall(agentName, enrichedCall);
-            return;
-        }
-        if (enrichedCall.name === 'read_image') {
-            this.dispatchReadImageToolCall(agentName, enrichedCall);
-            return;
-        }
-        if (enrichedCall.name === 'fetch_reference') {
-            this.dispatchFetchReferenceToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route gate_status tool
-        if (enrichedCall.name === 'gate_status' && this.eventGate) {
-            this.dispatchGateToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route the tune-out tool (residents) and the subconscious's surface
-        if ((enrichedCall.name === 'tune_out' || enrichedCall.name === 'focus') && this.tuneOutCoordinator) {
-            this.dispatchTuneOutToolCall(agentName, enrichedCall);
-            return;
-        }
-        if (SUBCONSCIOUS_TOOL_NAMES.includes(enrichedCall.name)) {
-            const routed = this.readerToolCall(agentName, enrichedCall);
-            if ('refused' in routed) {
-                const error = routed.refused;
-                const result = this.refusedResult(agentName, call.id, error);
-                this.emitTrace({ type: 'tool:failed', module: 'tune-out', tool: call.name, callId: call.id, error });
-                this.pushEvent({
-                    type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tune-out', result,
+            // toolsets--act on a host toolset's tool (the built-in one, a server's
+            // tab): the call of that tool, under its own name, down the path a
+            // direct call of it takes, permissions included.
+            case 'host-act':
+                this.dispatchHostAct(agentName, call, route.host, turnId);
+                return;
+            // RFC-014: toolsets--act calls a server's dynamic tool, down the same
+            // path as a direct call of it (dispatchToolsetAct).
+            case 'toolset-act': {
+                const scriptWaiter = this.scriptToolWaiters.get(enrichedCall.id);
+                if (scriptWaiter)
+                    scriptWaiter.route.toServer = true;
+                this.dispatchToolsetAct(agentName, enrichedCall);
+                return;
+            }
+            case 'mcpl': {
+                // A script's call: its waiter keeps that it went to a server, for the
+                // script lane's exit (scriptToolWaiters).
+                const scriptWaiter = this.scriptToolWaiters.get(enrichedCall.id);
+                if (scriptWaiter)
+                    scriptWaiter.route.toServer = true;
+                this.dispatchMcplToolCall(agentName, enrichedCall, route.serverId, route.prefix);
+                return;
+            }
+            case 'channel': {
+                this.dispatchChannelToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'agent-settings': {
+                this.dispatchAgentSettingsToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'save-image': {
+                this.dispatchSaveImageToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'read-image': {
+                this.dispatchReadImageToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'fetch-reference': {
+                this.dispatchFetchReferenceToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'gate-status': {
+                this.dispatchGateToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'tune-out': {
+                this.dispatchTuneOutToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'subconscious': {
+                const routed = this.readerToolCall(agentName, enrichedCall);
+                if ('refused' in routed) {
+                    const error = routed.refused;
+                    const result = this.refusedResult(agentName, call.id, error);
+                    this.emitTrace({ type: 'tool:failed', module: 'tune-out', tool: call.name, callId: call.id, error });
+                    this.pushEvent({
+                        type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'tune-out', result,
+                    });
+                    return;
+                }
+                void routed.result
+                    .then((result) => {
+                    // Through pushEvent, like every other tool's result, so one that
+                    // arrives after stop() is dropped rather than rejected unhandled.
+                    this.pushEvent({
+                        type: 'tool-result',
+                        callId: enrichedCall.id,
+                        toolName: enrichedCall.name,
+                        agentName,
+                        moduleName: 'tune-out',
+                        result,
+                    });
                 });
                 return;
             }
-            void routed.result
-                .then((result) => {
-                // Through pushEvent, like every other tool's result, so one that
-                // arrives after stop() is dropped rather than rejected unhandled.
+            case 'sleep': {
+                this.dispatchSleepToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'heartbeat': {
+                this.dispatchHeartbeatToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'wake-rule': {
+                this.dispatchWakeRuleToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'event-tags': {
+                this.dispatchEventTagsToolCall(agentName, enrichedCall);
+                return;
+            }
+            case 'agent-verb': {
+                // skip_reply(wake_in_seconds): arm a gate self-wake so "not replying
+                // NOW" can also mean "back in a moment" — ends the turn, then wakes
+                // the agent after N seconds unless something else wakes it first
+                // (any turn start cancels the pending self-wake). Armed here because
+                // the framework owns the EventGate; the registry only words the
+                // confirmation. A wake the host can't set is refused, so the model
+                // learns that its turn remains open and no wake was armed: any
+                // wake_in_seconds without a gate, and one that isn't a number of
+                // seconds with one.
+                if (enrichedCall.name === 'skip_reply') {
+                    const error = this.skipReplyRefusal(enrichedCall);
+                    if (error !== undefined) {
+                        const wakeValue = enrichedCall.input?.wake_in_seconds;
+                        console.error(`[self-wake] agent=${agentName} wake_in_seconds=${logValue(wakeValue)} skip_reply refused: ${logDetail(this.eventGate ? "wake_in_seconds isn't a number of seconds" : 'No EventGate configured (FrameworkConfig.gate is unset)')}`);
+                        const result = this.refusedResult(agentName, enrichedCall.id, error);
+                        this.emitTrace({ type: 'tool:failed', module: 'channels', tool: enrichedCall.name, callId: enrichedCall.id, error });
+                        this.pushEvent({ type: 'tool-result', callId: enrichedCall.id, toolName: enrichedCall.name, agentName, moduleName: 'channels', result });
+                        return;
+                    }
+                    const skipping = this.callingTurnOf(agentName, enrichedCall);
+                    if (skipping) {
+                        skipping.privateEnd = true;
+                        delete skipping.unpostedSpeech;
+                    }
+                    const wake = readSkipReplyWake(enrichedCall.input);
+                    if (wake.kind === 'wake' && this.eventGate) {
+                        const armedAt = Date.now();
+                        const { inMs, armed } = this.eventGate.armSelfWake(agentName, wake.seconds, 'skip_reply');
+                        // The heartbeat's tick or reminder due before the timer: if it wakes
+                        // the agent, its turn cancels the timer, so the confirmation names
+                        // it and the time the self-wake would have left.
+                        const earlierWake = armed ? this.heartbeatWakeBefore(agentName, armedAt + inMs) : undefined;
+                        console.error(armed
+                            ? `[self-wake] agent=${agentName} armed in ${Math.round(inMs / 1000)}s (skip_reply)`
+                                + (earlierWake ? `; due sooner, in ~${earlierWake.inSeconds}s: ${logDetail(earlierWake.what)}` : '')
+                            : `[self-wake] agent=${agentName} not armed: the framework has stopped (skip_reply)`);
+                        this.dispatchChannelToolCall(agentName, enrichedCall, earlierWake);
+                        return;
+                    }
+                }
+                this.dispatchChannelToolCall(agentName, enrichedCall);
+                return;
+            }
+            // Client-side programmatic tool calling: run a script that calls the
+            // agent's other tools in-process (script-inner calls come back through
+            // this very dispatcher with waiter-tracked call IDs).
+            case 'code-execution': {
+                this.dispatchCodeExecutionToolCall(agentName, enrichedCall);
+                return;
+            }
+            // drafts: the resident's own held drafts (list/read/resend/dismiss).
+            // Answered by the framework; resend publishes through the registry's
+            // publish executor, so the result arrives asynchronously.
+            case 'drafts': {
+                const startedAt = Date.now();
+                this.emitTrace({ type: 'tool:started', module: 'framework', tool: 'drafts', callId: enrichedCall.id, input: enrichedCall.input });
+                void this.draftsToolResult(agentName, enrichedCall.input, this.callingTurnOf(agentName, enrichedCall), enrichedCall.id)
+                    .then((result) => {
+                    this.emitTrace({ type: 'tool:completed', module: 'framework', tool: 'drafts', callId: enrichedCall.id, durationMs: Date.now() - startedAt });
+                    this.pushEvent({ type: 'tool-result', callId: enrichedCall.id, toolName: enrichedCall.name, agentName, moduleName: 'framework', result });
+                });
+                return;
+            }
+            // prose_help: on-demand routing reference for explicit-prose agents.
+            // Answered inline — the grammar is a tool RESULT (model-requested), never
+            // ambient context (see PROSE_ROUTING_HELP / teach-by-bounce).
+            case 'prose-help': {
+                this.emitTrace({ type: 'tool:completed', module: 'framework', tool: 'prose_help', callId: enrichedCall.id, durationMs: 0 });
                 this.pushEvent({
                     type: 'tool-result',
                     callId: enrichedCall.id,
                     toolName: enrichedCall.name,
                     agentName,
-                    moduleName: 'tune-out',
-                    result,
+                    moduleName: 'framework',
+                    result: { success: true, data: PROSE_ROUTING_HELP },
                 });
-            });
-            return;
-        }
-        // Route sleep / wake tools
-        if ((enrichedCall.name === 'sleep' || enrichedCall.name === 'wake') && this.eventGate) {
-            this.dispatchSleepToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route the heartbeat's tools (heartbeat--…)
-        if (this.heartbeat?.ownsTool(enrichedCall.name)) {
-            this.dispatchHeartbeatToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route wake-rule tools (runtime gate.json policy add/remove)
-        if ((enrichedCall.name === 'wake_add_rule' || enrichedCall.name === 'wake_remove_rule') && this.eventGate) {
-            this.dispatchWakeRuleToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route event_tags (tag/ontology discovery)
-        if (enrichedCall.name === 'event_tags' && this.eventGate) {
-            this.dispatchEventTagsToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Route synthesized 'think' (private reasoning), 'journal' (private
-        // long-form notes) and 'skip_reply' (deliberate stay-silent) tools — handled by the channel registry like the other
-        // synthesized channel tools, but they aren't `channel_`-prefixed so they
-        // need an explicit route here.
-        if ((enrichedCall.name === 'think' || enrichedCall.name === 'journal' || enrichedCall.name === 'skip_reply') && this.channelRegistry) {
-            // skip_reply(wake_in_seconds): arm a gate self-wake so "not replying
-            // NOW" can also mean "back in a moment" — ends the turn, then wakes
-            // the agent after N seconds unless something else wakes it first
-            // (any turn start cancels the pending self-wake). Armed here because
-            // the framework owns the EventGate; the registry only words the
-            // confirmation. A wake the host can't set is refused, so the model
-            // learns that its turn remains open and no wake was armed: any
-            // wake_in_seconds without a gate, and one that isn't a number of
-            // seconds with one.
-            if (enrichedCall.name === 'skip_reply') {
-                const error = this.skipReplyRefusal(enrichedCall);
-                if (error !== undefined) {
-                    const wakeValue = enrichedCall.input?.wake_in_seconds;
-                    console.error(`[self-wake] agent=${agentName} wake_in_seconds=${logValue(wakeValue)} skip_reply refused: ${logDetail(this.eventGate ? "wake_in_seconds isn't a number of seconds" : 'No EventGate configured (FrameworkConfig.gate is unset)')}`);
-                    const result = this.refusedResult(agentName, enrichedCall.id, error);
-                    this.emitTrace({ type: 'tool:failed', module: 'channels', tool: enrichedCall.name, callId: enrichedCall.id, error });
-                    this.pushEvent({ type: 'tool-result', callId: enrichedCall.id, toolName: enrichedCall.name, agentName, moduleName: 'channels', result });
-                    return;
-                }
-                const skipping = this.callingTurnOf(agentName, enrichedCall);
-                if (skipping) {
-                    skipping.privateEnd = true;
-                    delete skipping.unpostedSpeech;
-                }
-                const wake = readSkipReplyWake(enrichedCall.input);
-                if (wake.kind === 'wake' && this.eventGate) {
-                    const armedAt = Date.now();
-                    const { inMs, armed } = this.eventGate.armSelfWake(agentName, wake.seconds, 'skip_reply');
-                    // The heartbeat's tick or reminder due before the timer: if it wakes
-                    // the agent, its turn cancels the timer, so the confirmation names
-                    // it and the time the self-wake would have left.
-                    const earlierWake = armed ? this.heartbeatWakeBefore(agentName, armedAt + inMs) : undefined;
-                    console.error(armed
-                        ? `[self-wake] agent=${agentName} armed in ${Math.round(inMs / 1000)}s (skip_reply)`
-                            + (earlierWake ? `; due sooner, in ~${earlierWake.inSeconds}s: ${logDetail(earlierWake.what)}` : '')
-                        : `[self-wake] agent=${agentName} not armed: the framework has stopped (skip_reply)`);
-                    this.dispatchChannelToolCall(agentName, enrichedCall, earlierWake);
-                    return;
-                }
+                return;
             }
-            this.dispatchChannelToolCall(agentName, enrichedCall);
-            return;
-        }
-        // Client-side programmatic tool calling: run a script that calls the
-        // agent's other tools in-process (script-inner calls come back through
-        // this very dispatcher with waiter-tracked call IDs).
-        if (enrichedCall.name === CODE_EXECUTION_TOOL_NAME && this.codeExecution) {
-            this.dispatchCodeExecutionToolCall(agentName, enrichedCall);
-            return;
-        }
-        // drafts: the resident's own held drafts (list/read/resend/dismiss).
-        // Answered by the framework; resend publishes through the registry's
-        // publish executor, so the result arrives asynchronously.
-        if (enrichedCall.name === 'drafts' && this.channelRegistry) {
-            const startedAt = Date.now();
-            this.emitTrace({ type: 'tool:started', module: 'framework', tool: 'drafts', callId: enrichedCall.id, input: enrichedCall.input });
-            void this.draftsToolResult(agentName, enrichedCall.input, this.callingTurnOf(agentName, enrichedCall), enrichedCall.id)
-                .then((result) => {
-                this.emitTrace({ type: 'tool:completed', module: 'framework', tool: 'drafts', callId: enrichedCall.id, durationMs: Date.now() - startedAt });
-                this.pushEvent({ type: 'tool-result', callId: enrichedCall.id, toolName: enrichedCall.name, agentName, moduleName: 'framework', result });
-            });
-            return;
-        }
-        // prose_help: on-demand routing reference for explicit-prose agents.
-        // Answered inline — the grammar is a tool RESULT (model-requested), never
-        // ambient context (see PROSE_ROUTING_HELP / teach-by-bounce).
-        if (enrichedCall.name === 'prose_help') {
-            this.emitTrace({ type: 'tool:completed', module: 'framework', tool: 'prose_help', callId: enrichedCall.id, durationMs: 0 });
-            this.pushEvent({
-                type: 'tool-result',
-                callId: enrichedCall.id,
-                toolName: enrichedCall.name,
-                agentName,
-                moduleName: 'framework',
-                result: { success: true, data: PROSE_ROUTING_HELP },
-            });
-            return;
+            case 'module':
+                break;
+            default:
+                route;
         }
         const sepIndex = enrichedCall.name.indexOf('--');
         const moduleName = sepIndex >= 0 ? enrichedCall.name.substring(0, sepIndex) : 'unknown';
@@ -26936,6 +27278,7 @@ export class AgentFramework {
         const agent = this.agents.get(agentName);
         if ((agent && !this.agentSees(agent, metadata)) || isOwnScheduleWrite(metadata) || !isConversationalInjection(metadata))
             return;
+        this.rearmDeadlineCuts?.delete(agentName);
         if (this.turnRearms?.delete(agentName))
             console.error(`[inference-rearm] agent=${agentName} re-send count started again: a message was said to it`);
     }
@@ -27656,11 +27999,9 @@ export class AgentFramework {
      * at a tool boundary whose stream declares it carries the messages
      * injected there (markContextConsumed). So a notice such a stream carried
      * is under it. One a boundary stored without sending (a turn a tool ended,
-     * a budget restart) is above it, and so is one injected into a stream that
-     * doesn't declare it carries injections, which may have dropped it:
-     * counted as unread, it goes to the primary even if the agent heard it,
-     * rather than to no one where the stream dropped it. null when the window
-     * can't be read, which is logged.
+     * a budget restart, the direct API's boundary, which has no stream) is
+     * above it until a compile sends it, and counts as unread. null when the
+     * window can't be read, which is logged.
      */
     releasedWindow(agent, held) {
         try {
@@ -28765,6 +29106,7 @@ export class AgentFramework {
         const ended = this.exhaustedTurns?.get(agentName);
         this.exhaustedTurns?.delete(agentName);
         const rearmed = this.exhaustingRearms?.delete(agentName) === true;
+        const madeAgain = this.freshCallsCut?.delete(agentName) === true;
         // The reason is the failure's own message, and a provider can echo the
         // whole rejected request in it: one household's [inference-failed]
         // marker carried ~1.7 MB of its own request back into its context. Every
@@ -28815,24 +29157,25 @@ export class AgentFramework {
         // (2) Agent-facing chronicle marker (no inference triggered → no loop).
         const agent = this.agents.get(agentName);
         if (agent && !(rearmed && !ended) && process.env.SUPPRESS_INFERENCE_FAILED_MARKER !== '1') {
-            const cause = [errorType, httpStatus !== undefined ? `HTTP ${httpStatus}` : undefined]
-                .filter((part) => part !== undefined)
-                .join(', ');
+            const timedOut = errorType === 'timeout';
+            const causeParts = [errorType, httpStatus !== undefined ? `HTTP ${httpStatus}` : undefined]
+                .filter((part) => part !== undefined);
+            const cause = timedOut && causeParts.length === 1 ? '' : causeParts.join(', ');
             try {
                 agent.getContextManager().addMessage('user', [{
                         type: 'text',
                         text: (ended
-                            ? `[${NOTICE_TAG.inferenceFailed}] Your previous turn did not complete: it ` +
-                                `failed${cause ? ` (${suppliedValue(cause)})` : ''}.` +
+                            ? `[${NOTICE_TAG.inferenceFailed}] Your previous turn did not complete: ` +
+                                `${timedOut ? 'its last call timed out' : 'it failed'}${cause ? ` (${suppliedValue(cause)})` : ''}.` +
+                                `${madeAgain ? ` ${MADE_AGAIN}` : ''}` +
                                 `${ended.roundsRan ? ' Its earlier rounds ran, and their tool calls ran as their results show.' : ''}` +
                                 `${ended.callsCutOff ? ` ${CALLS_CUT_OFF}` : ''}` +
                                 `${ended.liveSpeech ? ` ${LIVE_SPEECH_UNRECEIPTED}` : ''}` +
                                 `${ended.speechRouting ? ` ${SPEECH_STILL_ROUTING}` : ''} Reason: `
-                            : `[${NOTICE_TAG.inferenceFailed}] Your previous turn did not complete: the model ` +
-                                `call failed${cause ? ` (${suppliedValue(cause)})` : ''} and produced no response, so nothing was sent. Reason: `) +
-                            `${failureShown(markerReason)}. If this recurs with the same cause, change approach ` +
-                            `rather than retrying identically (e.g. drop an oversized attachment ` +
-                            `or an unsupported setting).`,
+                            : `[${NOTICE_TAG.inferenceFailed}] Your previous turn did not complete: ` +
+                                `the model call ${timedOut ? 'timed out' : 'failed'}${cause ? ` (${suppliedValue(cause)})` : ''} ` +
+                                `and produced no response, so nothing was sent.${madeAgain ? ` ${MADE_AGAIN}` : ''} Reason: `) +
+                            `${failureShown(markerReason)}. ${timedOut ? TIMEOUT_ADVICE : FAILURE_ADVICE}`,
                     }], { system: true, kind: 'inference-failed', reason: markerReason, consecutive: streak, ...classification, ...cutAt(markerReason) });
             }
             catch (err) {
@@ -29043,7 +29386,7 @@ export class AgentFramework {
             return source;
         });
         // Server-initiated inference router (Step 6)
-        this.inferenceRouter = new InferenceRouter(this.membrane, this.hookOrchestrator, this.featureSetManager, inferenceRouting ?? null, (event) => this.emitTrace(event));
+        this.inferenceRouter = new InferenceRouter(this.membrane, this.hookOrchestrator, this.featureSetManager, inferenceRouting ?? null, (event) => this.emitTrace(event), () => this.inferenceBounds);
         // Checkpoint manager (Step 8), built and loaded at the top
         this.checkpointManager = checkpoints;
         // Channel registry (Step 7)
@@ -29076,7 +29419,15 @@ export class AgentFramework {
                 const scope = coordinator.getAllExcept();
                 if (!scope || scope.params.except.serverId !== serverId || scope.params.except.channelId !== channelId)
                     return undefined;
-                coordinator.cancelAllExcept('channel-close', 'the excepted channel was closed');
+                let released;
+                try {
+                    released = coordinator.cancelAllExcept('channel-close', 'the excepted channel was closed');
+                }
+                catch (err) {
+                    throw new Error(`The close wasn't recorded: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                if (!released.ok)
+                    throw new Error(`The close wasn't recorded: ${released.error}`);
                 return 'The focus on it ended all the same, and what the other channels held was delivered.';
             },
             focusChannelResolver: () => this.tuneOutCoordinator?.focusChannel() ?? null,
@@ -29248,13 +29599,11 @@ export class AgentFramework {
                     attempt: 0,
                     willRetry: !!left?.willReconnect,
                 });
-                // So the server doesn't vanish quietly: alert at once, since no
-                // attempt follows, for what needs the operator. That's a
-                // protocol-version verdict, as the reconnect path alerts for one, or
-                // a launch that couldn't be reaped, whose reap nothing retries on its
-                // own.
-                if (error instanceof McplProtocolVersionError || left?.holdsUnreapedChild) {
-                    this.opsAlert('mcpl-down', config.id, `MCPL server unreachable at startup: ${message}`);
+                // So the server doesn't vanish quietly: nothing connects it again on
+                // its own, so alert at once. One that connected before its setup
+                // threw is still connected, and gets no alert.
+                if (!left?.willReconnect && !left?.isConnected) {
+                    this.opsAlert('mcpl-down', config.id, `MCPL server not connected at startup, and this host won't retry it on its own: ${message}`);
                 }
             }
         }
@@ -31068,9 +31417,10 @@ export class AgentFramework {
     }
     /**
      * Restart an MCPL server at runtime: disconnect, then reconnect with the
-     * same (or an updated) config. This actually respawns a stdio child —
-     * unlike `reconnect: true`, which only retries after transport-level
-     * failures. Throws if the server has no stored config and none is given.
+     * same (or an updated) config. This respawns a stdio child at once,
+     * whatever its state; `reconnect: true` spawns a fresh child only after
+     * the connection fails or its child exits. Throws if the server has no
+     * stored config and none is given.
      * What its connect would refuse is refused before the running server is
      * torn down. Until the connect, a connect or a restart started meanwhile
      * is refused the id and the tool prefix the restart moves the server to,
@@ -31470,9 +31820,9 @@ export class AgentFramework {
                     // request turned away at stop gets, so it can send it again to
                     // the host's next run. Optional chaining: prototype-built
                     // harnesses leave the queue unset.
-                    const stopping = !!this.queue?.isClosed;
+                    const answer = this.queue?.isClosed ? hostStoppedWhileHandling() : { code: -32603, message: 'Internal error' };
                     try {
-                        tracked.respondError?.(stopping ? -32000 : -32603, stopping ? 'the host stopped while handling this request' : 'Internal error');
+                        tracked.respondError?.(answer.code, answer.message);
                     }
                     catch (sendError) {
                         responseError = recorded(describeCause(sendError));
@@ -31638,6 +31988,7 @@ export class AgentFramework {
                     // Chunks go out on the transport the request came on, as its
                     // answer does.
                     ...(responder.sendChunk ? { sendChunk: responder.sendChunk } : {}),
+                    ...(responder.signal ? { signal: responder.signal } : {}),
                 });
             }
         });
@@ -31905,14 +32256,15 @@ export class AgentFramework {
             // that next one (see refreshMcplTools).
             this.noteMcplServerClosed(connection.id);
             this.dropMcplToolClasses(connection.id);
+            // The transport's own words only: a WebSocket server's close text
+            // stays off the trace.
+            const reason = info?.reason !== undefined && !info.reasonFromPeer ? boundFailureText(info.reason) : null;
             this.emitTrace({
                 type: 'mcpl:server-closed',
                 serverId: connection.id,
                 code: code ?? null,
                 signal: signal ?? null,
-                // The transport's own words only: a WebSocket server's close text
-                // stays off the trace.
-                reason: info?.reason !== undefined && !info.reasonFromPeer ? boundFailureText(info.reason) : null,
+                reason,
                 willReconnect: connection.willReconnect,
             });
             this.emitTrace({ type: 'module:removed', moduleName: `mcpl:${connection.id}` });
@@ -31922,6 +32274,14 @@ export class AgentFramework {
                 // RFC-014: its toolsets go with it; a next connection reads them again.
                 this.toolsetHub?.get(connection.id)?.detach(connection);
                 this.handleToolsListChanged(connection.id);
+                // Lost on its own with no reconnect coming: nothing in this host
+                // connects it again on its own. A close the host made itself (stop(),
+                // a disconnect, a restart) is byHost, a loss once stop() has begun is
+                // part of the close the host is making, and a child that ended as
+                // asked was stopped: none of them gets an alert.
+                if (!info?.byHost && !this.stopHasBegun() && !endedAsAsked({ code, signal, pipeFailed: info?.pipeFailed })) {
+                    this.opsAlert('mcpl-down', connection.id, `MCPL server closed${closeWords(reason, code, signal)}, and this host won't reconnect it on its own`);
+                }
             }
         });
     }
@@ -31951,6 +32311,7 @@ export class AgentFramework {
                 type: 'mcpl:server-connect-failed',
                 serverId: connection.id,
                 error: recorded(params.error),
+                ...(params.stderrTail === undefined ? {} : { stderrTail: recorded(params.stderrTail) }),
                 attempt: params.attempt,
                 willRetry: connection.willReconnect,
             });
@@ -31969,7 +32330,7 @@ export class AgentFramework {
         connection.on('error', (err) => {
             this.emitTrace({ type: 'mcpl:server-error', serverId: connection.id, error: recorded(err.message) });
         });
-        connection.on('close', () => {
+        connection.on('close', (info) => {
             // A closed provider's class hints are stale (RFC-008), as for MCPL,
             // and so is a listing already under way.
             this.noteMcplServerClosed(connection.id);
@@ -31977,8 +32338,9 @@ export class AgentFramework {
             this.emitTrace({
                 type: 'mcpl:server-closed',
                 serverId: connection.id,
-                code: null,
-                signal: null,
+                code: info.code ?? null,
+                signal: info.signal ?? null,
+                reason: info.reason,
                 willReconnect: connection.willReconnect,
             });
             this.emitTrace({ type: 'module:removed', moduleName: `mcpl:${connection.id}` });
@@ -31999,6 +32361,13 @@ export class AgentFramework {
                     // Gone for good: its tools leave the agents' list, as a
                     // disconnect's do.
                     this.handleToolsListChanged(connection.id);
+                    // Lost on its own: nothing in this host connects it again on its
+                    // own. A loss once stop() has begun is part of the close the host
+                    // is making, and a child that ended as asked was stopped: neither
+                    // gets an alert.
+                    if (!this.stopHasBegun() && !endedAsAsked(info)) {
+                        this.opsAlert('mcpl-down', connection.id, `MCP server closed${closeWords(info.reason, info.code, info.signal)}, and this host won't reconnect it on its own`);
+                    }
                 });
             }
         });
@@ -33132,7 +33501,7 @@ export class AgentFramework {
      * (same path as gate.json load), so an invalid rule is surfaced as a tool
      * error and nothing is written.
      */
-    dispatchWakeRuleToolCall(agentName, call) {
+    dispatchWakeRuleToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'gate')) {
         this.emitTrace({ type: 'tool:started', module: 'gate', tool: call.name, callId: call.id, input: call.input });
         // What wake_add_rule's input held that does nothing, checkToolInput's notes and
         // then the gate's on a rule it saved: a refusal names it too, so the call that
@@ -33147,13 +33516,22 @@ export class AgentFramework {
                 module: 'gate', tool: call.name, callId: call.id, durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
+            deliver(result);
         };
         try {
             if (call.name === 'wake_remove_rule') {
                 const input = (call.input ?? {});
                 if (typeof input.name !== 'string' || !input.name) {
-                    finish({ success: false, error: 'wake_remove_rule: `name` (string) is required', isError: true });
+                    const edit = this.eventGate.ruleNamesForChange();
+                    const names = 'names' in edit ? edit.names.map((name) => quotedValue(name)) : [];
+                    finish({
+                        success: false,
+                        error: `wake_remove_rule: name is ${shownValue(input.name)}, where the name of a rule is needed, so nothing was removed. `
+                            + ('refused' in edit
+                                ? edit.refused
+                                : (names.length > 0 ? `The rules a change edits are ${names.join(', ')}.` : 'There is no rule to remove.') + edit.note),
+                        isError: true,
+                    });
                     return;
                 }
                 const removed = this.removeGatePolicy(input.name);
@@ -33183,9 +33561,8 @@ export class AgentFramework {
             if (behaviorSources.length === 0) {
                 finish({
                     success: false,
-                    error: this.judgeWired
-                        ? 'wake_add_rule: specify exactly one behavior — `behavior` ("always"/"defer"/"skip"), `debounceMs`, `rateLimit`, `passiveSample`, or `judge`.'
-                        : 'wake_add_rule: specify exactly one behavior — `behavior` ("always"/"defer"/"skip"), `debounceMs`, `rateLimit`, or `passiveSample`.',
+                    error: 'wake_add_rule got no behavior, so nothing was saved. Give one of behavior ("always", "defer" or "skip"), '
+                        + (this.judgeWired ? 'debounceMs, rateLimit, passiveSample or judge.' : 'debounceMs, rateLimit or passiveSample.'),
                     isError: true,
                 });
                 return;
@@ -33193,7 +33570,7 @@ export class AgentFramework {
             if (behaviorSources.length > 1) {
                 finish({
                     success: false,
-                    error: `wake_add_rule: give only one behavior, got [${behaviorSources.join(', ')}].`,
+                    error: `wake_add_rule got more than one behavior (${behaviorSources.join(', ')}), so nothing was saved. Give only one of them.`,
                     isError: true,
                 });
                 return;
@@ -33234,7 +33611,7 @@ export class AgentFramework {
             if (placementSources.length > 1) {
                 finish({
                     success: false,
-                    error: `wake_add_rule: give at most one placement, got [${placementSources.join(', ')}].`,
+                    error: `wake_add_rule got more than one placement (${placementSources.join(', ')}), so nothing was saved. Give only one of them.`,
                     isError: true,
                 });
                 return;
@@ -33254,10 +33631,18 @@ export class AgentFramework {
             for (const field of ['insertBefore', 'insertAfter']) {
                 const anchor = input[field];
                 if (anchor !== undefined && (typeof anchor !== 'string' || anchor.length === 0)) {
+                    const edit = this.eventGate.ruleNamesForChange();
+                    const names = 'names' in edit ? edit.names.filter((name) => name !== input.name).map((name) => quotedValue(name)) : [];
                     finish({
                         success: false,
-                        error: `wake_add_rule: ${field} must be the name of a rule, and it's ${shownValue(anchor)}, so nothing `
-                            + `was saved. The rules are: [${this.getGatePolicyNames().join(', ')}].`,
+                        error: `wake_add_rule: ${field} must be the name of a rule, and it's ${shownValue(anchor)}, so nothing was saved. `
+                            + ('refused' in edit
+                                ? edit.refused
+                                : (names.length > 0
+                                    ? `The other rules a change edits are ${names.join(', ')}. Give ${field} one of them to place the rule beside it, or leave it out`
+                                    : `There is no other rule to place it beside, so leave ${field} out`)
+                                    + ' to add the rule at the end, or, where a rule already has its name, to replace that rule where it is.'
+                                    + edit.note),
                         isError: true,
                     });
                     return;
@@ -33285,9 +33670,12 @@ export class AgentFramework {
             // (af#105 — a prepended catch-all sampler silently disabled the
             // addressed-message wakes for 12h before anyone could see why).
             const before = new Map(this.eventGate.probeTable().map((r) => [r.probe, r]));
-            const policy = this.addGatePolicy(rawPolicy, {
+            const fieldNames = Object.fromEntries(Object.entries(AgentFramework.WAKE_ADD_RULE_FIELDS)
+                .filter(([field]) => !(field.startsWith('behavior.') && typeof input.behavior === 'object')));
+            const policy = this.eventGate.addPolicy(rawPolicy, {
                 ...(position ? { position } : {}),
                 onIgnoredFields: (notes) => { ignored.push(...notes); },
+                fieldNames,
             });
             const after = this.eventGate.probeTable();
             const probes = after.map((r) => {
@@ -33589,22 +33977,20 @@ export class AgentFramework {
         });
         return decision;
     }
-    /**
-     * Make delivered messages durable now, including those the delivery left
-     * in the deferred queue: a tune-out release flips durable epoch state
-     * first, so its dump must not be lost to a crash in between (#232 gap 6).
-     */
     commitDeliveries() {
+        let durable = true;
         if (this.deferredMessages.length > 0) {
             this.deferredWritesPersisted = true;
-            this.persistDeferredWrites();
+            durable = this.persistDeferredWrites();
         }
         try {
             this.store.sync();
         }
         catch (err) {
             console.error('[tune-out] could not sync the store after a release:', err);
+            return false;
         }
+        return durable;
     }
     /** The history-reading tool the primary resident actually has, if any (#232 gap 11). */
     residentHistoryTool() {
@@ -33614,7 +34000,7 @@ export class AgentFramework {
         const names = this.getAllTools().map((t) => t.name).filter((n) => primary.canUseTool(n));
         return names.find((n) => /(^|--)(fetch_history|channel_read|read_history|history)$/.test(n)) ?? null;
     }
-    dispatchSleepToolCall(agentName, call) {
+    dispatchSleepToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'gate')) {
         // The gate's sleep quiets the whole agent, every conversation of it, so a
         // conversation fork or an ephemeral run neither sets one nor ends the
         // agent's own. Refused before the tool runs, as a fork's channel_open is.
@@ -33633,7 +34019,7 @@ export class AgentFramework {
                 ? `Nothing was set: a sleep quiets the whole agent, not one ${one}.${comeBack}`
                 : `Nothing was changed: a sleep is the agent's, so this ${one} can't end one.`;
             this.emitTrace({ type: 'tool:failed', module: 'gate', tool: call.name, callId: call.id, error: `${agentName}: ${error}` });
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result: this.refusedResult(agentName, call.id, error) });
+            deliver(this.refusedResult(agentName, call.id, error));
             return;
         }
         this.emitTrace({ type: 'tool:started', module: 'gate', tool: call.name, callId: call.id, input: call.input });
@@ -33641,7 +34027,7 @@ export class AgentFramework {
         const input = (call.input ?? {});
         const finish = (result) => {
             this.emitTrace({ type: 'tool:completed', module: 'gate', tool: call.name, callId: call.id, durationMs: 0 });
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
+            deliver(result);
         };
         if (call.name === 'wake') {
             const was = gate.clearSleep();
@@ -33762,31 +34148,36 @@ export class AgentFramework {
      */
     /** RFC-005 on-demand dereference: [ref id] → workspace file, via the
      *  origin-bound, ceiling-bounded, digest-verified host fetcher. */
-    dispatchFetchReferenceToolCall(agentName, call) {
+    dispatchFetchReferenceToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'workspace')) {
         this.emitTrace({ type: 'tool:started', module: 'workspace', tool: call.name, callId: call.id, input: call.input });
         const startTime = Date.now();
         void (async () => {
-            const args = (call.input ?? {});
-            const refId = String(args.ref_id ?? '');
-            const record = referenceRegistry.get(refId);
             let result;
-            if (!record) {
-                // Vector 20: a stale or unknown id is a defined miss, never a
-                // different record.
-                result = { success: false, isError: true,
-                    error: `unknown reference: ${refId || '(missing ref_id)'} — it may have been evicted; ids are never reused` };
+            try {
+                const args = (call.input ?? {});
+                const refId = String(args.ref_id ?? '');
+                const record = referenceRegistry.get(refId);
+                if (!record) {
+                    // Vector 20: a stale or unknown id is a defined miss, never a
+                    // different record.
+                    result = { success: false, isError: true,
+                        error: `unknown reference: ${refId || '(missing ref_id)'} — it may have been evicted; ids are never reused` };
+                }
+                else {
+                    const maxBytes = typeof args.max_bytes === 'number'
+                        ? Math.min(args.max_bytes, DEFAULT_FETCH_MAX_BYTES) : undefined;
+                    const outcome = await this.getReferenceFetcher().fetch(record, { maxBytes });
+                    result = outcome.ok
+                        ? { success: true, data: JSON.stringify({ path: outcome.path, bytes: outcome.bytes,
+                                mime_type: outcome.mimeType, digest_verified: outcome.digestVerified ?? 'no digest claimed' }) }
+                        // The fetcher says what happened as a clause about the reference,
+                        // and what calling again can do as a sentence of its own.
+                        : { success: false, isError: true,
+                            error: `fetch_reference couldn't fetch "${refId}": ${outcome.error}. ${outcome.remedy}` };
+                }
             }
-            else {
-                const maxBytes = typeof args.max_bytes === 'number'
-                    ? Math.min(args.max_bytes, DEFAULT_FETCH_MAX_BYTES) : undefined;
-                const outcome = await this.getReferenceFetcher().fetch(record, { maxBytes });
-                result = outcome.ok
-                    ? { success: true, data: JSON.stringify({ path: outcome.path, bytes: outcome.bytes,
-                            mime_type: outcome.mimeType, digest_verified: outcome.digestVerified ?? 'no digest claimed' }) }
-                    // The fetcher says what happened as a clause about the reference,
-                    // and what calling again can do as a sentence of its own.
-                    : { success: false, isError: true,
-                        error: `fetch_reference couldn't fetch "${refId}": ${outcome.error}. ${outcome.remedy}` };
+            catch (error) {
+                result = { success: false, isError: true, error: `fetch_reference couldn't answer: ${thrownText(error)}` };
             }
             this.emitTrace({
                 type: result.isError ? 'tool:failed' : 'tool:completed',
@@ -33794,13 +34185,10 @@ export class AgentFramework {
                 durationMs: Date.now() - startTime,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({
-                type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace',
-                result: { ...result, isError: result.isError ?? false },
-            });
+            deliver({ ...result, isError: result.isError ?? false });
         })();
     }
-    dispatchReadImageToolCall(agentName, call) {
+    dispatchReadImageToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'workspace')) {
         this.emitTrace({ type: 'tool:started', module: 'workspace', tool: call.name, callId: call.id, input: call.input });
         const finish = (result) => {
             this.emitTrace({
@@ -33811,7 +34199,7 @@ export class AgentFramework {
                 durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace', result });
+            deliver(result);
         };
         void (async () => {
             try {
@@ -33893,14 +34281,11 @@ export class AgentFramework {
      * every sibling in the round to settle; if one never does, fail closed
      * rather than trust an index the batch may still change. Sibling saves
      * produce no images and are not waited on (two saves in one batch would
-     * otherwise deadlock into a double timeout). A script's own calls
-     * (`pytc-…`) skip the barrier: the batch's pending siblings include the
-     * code_execution call running that script, so waiting on them would wait
-     * on itself.
+     * otherwise deadlock into a double timeout). Only the round's own calls
+     * wait: a call that isn't among its pending calls, a script's (`pytc-…`)
+     * or an awaited call's, counts the images the agent has now.
      */
     async awaitSiblingToolCalls(agent, call) {
-        if (call.id.startsWith('pytc-'))
-            return;
         const BARRIER_MS = 120_000;
         const POLL_MS = 20;
         const startedAt = Date.now();
@@ -33909,6 +34294,8 @@ export class AgentFramework {
             // Idle (puppet path) or the round was torn down: nothing to wait on.
             if (state.status !== 'waiting_for_tools')
                 return;
+            if (!state.pending.has(call.id))
+                return;
             const open = [...state.pending.values()].filter((p) => p.id !== call.id && p.name !== 'save_recent_image');
             if (open.length === 0)
                 return;
@@ -33935,7 +34322,7 @@ export class AgentFramework {
      * nothing. It never slides to an older image — a filename must not
      * authenticate bytes from another surface.
      */
-    dispatchSaveImageToolCall(agentName, call) {
+    dispatchSaveImageToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'workspace')) {
         this.emitTrace({ type: 'tool:started', module: 'workspace', tool: call.name, callId: call.id, input: call.input });
         const finish = (result) => {
             this.emitTrace({
@@ -33946,7 +34333,7 @@ export class AgentFramework {
                 durationMs: 0,
                 ...(result.isError ? { error: result.error } : {}),
             });
-            this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'workspace', result });
+            deliver(result);
         };
         void (async () => {
             try {
@@ -34057,21 +34444,36 @@ export class AgentFramework {
                 let count = 1;
                 /** Direct-ref mode: the one ref to find in the scannable context. */
                 let wantedRef = null;
-                if (input.ref !== undefined) {
+                // A selector is in use only when it carries a value (fieldInUse), so a
+                // caller whose provider presents every property as required can still
+                // choose one, whichever of the two it fills the other selector with.
+                // Any other value is checked, never read as absent: a whitespace or
+                // malformed ref, or an index that isn't an integer, is refused rather
+                // than turned into a different image than the one the caller named.
+                // A malformed ref beside an index or count in use says how to leave a
+                // selector unused, since the caller may have meant the positional one, as
+                // the conflict refusal below does for a well-formed ref. No refusal of one
+                // selector on its own says it: a ref alone is the caller's one selector,
+                // and dropping it would save the newest image; an index and a count are
+                // one selector, and dropping either changes which images are saved.
+                if (fieldInUse(input.ref)) {
                     if (typeof input.ref !== 'string' || !TOOL_IMAGE_REF_RE.test(input.ref)) {
-                        throw new Error('save_recent_image: `ref` must look like "img_k7x3q2_7" (copy it from the image placeholder in your context)');
+                        const positionalInUse = fieldInUse(input.index) || fieldInUse(input.count);
+                        throw new Error('save_recent_image: `ref` must look like "img_k7x3q2_7" (copy it from the image placeholder in your context)' +
+                            (positionalInUse ? ' (pass null, or leave it out, for a selector you are not using)' : ''));
                     }
-                    if (input.index !== undefined || input.count !== undefined) {
-                        throw new Error('save_recent_image: `ref` is mutually exclusive with `index`/`count`');
+                    if (fieldInUse(input.index) || fieldInUse(input.count)) {
+                        throw new Error('save_recent_image: `ref` is mutually exclusive with `index`/`count` — pass null (or omit) ' +
+                            'for the selector you are not using');
                     }
                     wantedRef = input.ref;
                 }
                 else {
-                    index = input.index === undefined ? 0 : Number(input.index);
+                    index = fieldInUse(input.index) ? integerField(input.index) : 0;
                     if (!Number.isInteger(index) || index < 0) {
                         throw new Error('save_recent_image: `index` must be a non-negative integer');
                     }
-                    count = input.count === undefined ? 1 : Number(input.count);
+                    count = fieldInUse(input.count) ? integerField(input.count) : 1;
                     const MAX_COUNT = 20;
                     if (!Number.isInteger(count) || count < 1 || count > MAX_COUNT) {
                         throw new Error(`save_recent_image: \`count\` must be an integer in 1..${MAX_COUNT}`);
@@ -34314,7 +34716,7 @@ export class AgentFramework {
             ? 'No setting reads differently after this call.'
             : `Changed before the refusal: ${changed.join(', ')}; no other setting reads differently.`;
     }
-    dispatchAgentSettingsToolCall(agentName, call) {
+    dispatchAgentSettingsToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'agent')) {
         this.emitTrace({
             type: 'tool:started',
             module: 'agent',
@@ -34502,14 +34904,7 @@ export class AgentFramework {
             durationMs: 0,
             ...(result.isError ? { error: result.error } : {}),
         });
-        this.pushEvent({
-            type: 'tool-result',
-            callId: call.id,
-            toolName: call.name,
-            agentName,
-            moduleName: 'agent',
-            result,
-        });
+        deliver(result);
     }
     /** Aggregate the event-tag vocabulary: reserved chat:* core + each connected
      *  server's declared tag ontology + gate.js status. */
@@ -34533,7 +34928,7 @@ export class AgentFramework {
                 'in gate.js. Unknown/undeclared tags are tolerated (open ontologies).',
         };
     }
-    dispatchEventTagsToolCall(agentName, call) {
+    dispatchEventTagsToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'gate')) {
         this.emitTrace({ type: 'tool:started', module: 'gate', tool: call.name, callId: call.id, input: call.input });
         let result;
         try {
@@ -34546,36 +34941,22 @@ export class AgentFramework {
             this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
             result = { success: false, error: err.message, isError: true };
         }
-        this.pushEvent({ type: 'tool-result', callId: call.id, toolName: call.name, agentName, moduleName: 'gate', result });
+        deliver(result);
     }
-    dispatchGateToolCall(agentName, call) {
+    dispatchGateToolCall(agentName, call, deliver = this.pushToolResult(agentName, call, 'gate')) {
         this.emitTrace({ type: 'tool:started', module: 'gate', tool: call.name, callId: call.id, input: call.input });
         const startTime = Date.now();
         this.eventGate.handleToolCall()
             .then((result) => {
             const durationMs = Date.now() - startTime;
             this.emitTrace({ type: 'tool:completed', module: 'gate', tool: call.name, callId: call.id, durationMs });
-            this.pushEvent({
-                type: 'tool-result',
-                callId: call.id,
-                toolName: call.name,
-                agentName,
-                moduleName: 'gate',
-                result,
-            });
+            deliver(result);
         })
             .catch((error) => {
             const err = error instanceof Error ? error : new Error(String(error));
             this.emitTrace({ type: 'tool:failed', module: 'gate', tool: call.name, callId: call.id, error: err.message });
             this.toolLifecycleEmitter?.markDispatchFailure(agentName, call.id);
-            this.pushEvent({
-                type: 'tool-result',
-                callId: call.id,
-                toolName: call.name,
-                agentName,
-                moduleName: 'gate',
-                result: { success: false, error: err.message, isError: true },
-            });
+            deliver({ success: false, error: err.message, isError: true });
         });
     }
     /** The channel context one server is told for an agent's inference