@animalabs/agent-framework 0.8.0 → 0.10.0

package/src/framework.ts

@@ -37,6 +37,7 @@ import type {
   ToolCall,
   ToolCallEvent,
   ToolResult,
+  CompletedToolCall,
   AgentConfig,
   InferenceRequest,
   AgentState,
@@ -52,21 +53,27 @@ import type {
   SameRoundThinkTextPolicy,
 } from './types/index.js';
 import { ProcessQueueImpl } from './queue.js';
+import { REFUSAL_REACTIONS, REFUSAL_REACTION_FALLBACK } from './refusal-reactions.js';
 import { Agent } from './agent.js';
 import { ModuleRegistry, isStateExistsError } from './module-registry.js';
 import { McplServerRegistry } from './mcpl/server-registry.js';
 import { FeatureSetManager } from './mcpl/feature-set-manager.js';
-import { ScopeManager } from './mcpl/scope-manager.js';
+import { computeGrant, CapabilityGrant, expandAdvertisementShorthand } from './mcpl/capability-grant.js';
+import { maskNegotiatedCapabilities } from './mcpl/capability-mask.js';
 import { HookOrchestrator } from './mcpl/hook-orchestrator.js';
 import { PushHandler, type McplPushEvent } from './mcpl/push-handler.js';
-import { parseProsePrefix } from './mcpl/prose-grammar.js';
+import { parseProsePrefix, parseHybridProsePrefix } from './mcpl/prose-grammar.js';
 import { ProseStreamRouter } from './mcpl/prose-stream-router.js';
 import { InferenceRouter } from './mcpl/inference-router.js';
 import { ChannelRegistry, type ChannelToolOrigin } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
 import { safeSlice } from './safe-slice.js';
 import type { WorkspaceModule } from './modules/workspace/index.js';
-import { toolResultDataToHistoryString } from './tool-result-history.js';
+import {
+  toolResultDataToHistoryString,
+  truncateForHistory,
+  DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS,
+} from './tool-result-history.js';
 import { randomUUID } from 'node:crypto';
 import { PyRunner, buildInjectedTools } from './code-execution/py-runner.js';
 import {
@@ -119,6 +126,9 @@ const SILENCING_TOOLS = new Set([
   'skip_reply', 'channel_publish', 'send_message', 'reply_message', 'send_dm',
 ]);
 
+/** World-surface publication names that outrank hybrid prose envelopes. */
+const HYBRID_PUBLICATION_TOOLS = new Set(['say', 'whisper']);
+
 /**
  * True when an injected message is real conversational input — something the
  * agent might actually be replying to — rather than ambient machinery.
@@ -134,6 +144,43 @@ const isConversationalInjection = (metadata?: MessageMetadata): boolean => {
   return true;
 };
 
+/**
+ * Rough token estimate for the blocks a continuation round is about to
+ * append to the live wire (issue #92 physical-window projection): the
+ * spilled tool-result strings at chars/4, a flat per-image cost for native
+ * image blocks the wire path preserves (provider vision tokens are
+ * resolution-dependent; 1600 ≈ a max-size Anthropic tile), mid-turn injected
+ * text at chars/4, and a small per-block envelope allowance. Deliberately a
+ * ceiling-ish heuristic — the cost of overestimating is one early recompile;
+ * the cost of underestimating is the 400 this projection exists to prevent.
+ */
+function estimateAppendedRoundTokens(
+  toolResults: CompletedToolCall[],
+  spilled: Map<string, { text: string; filePath: string | null }>,
+  injections: Array<{ content: ContentBlock[] }>,
+): number {
+  let chars = 0;
+  let images = 0;
+  for (const tc of toolResults) {
+    chars += spilled.get(tc.id)?.text.length ?? 0;
+    if (Array.isArray(tc.result.data)) {
+      for (const raw of tc.result.data) {
+        const b = raw as { type?: unknown };
+        if (b && typeof b === 'object' && b.type === 'image') images += 1;
+      }
+    }
+  }
+  for (const inj of injections) {
+    for (const block of inj.content) {
+      if (block.type === 'text' && typeof (block as { text?: unknown }).text === 'string') {
+        chars += (block as { text: string }).text.length;
+      }
+    }
+  }
+  const blockCount = toolResults.length + injections.length;
+  return Math.ceil(chars / 4) + images * 1600 + blockCount * 20;
+}
+
 /**
  * Explicit delivery tools whose successful use into a closed channel OPENS
  * it (send implies engagement — see openIfClosedForSend). Bare tool names,
@@ -181,11 +228,18 @@ const isAddressedMessage = (
 // envelopes can never disagree on what is a prefix.
 
 /** One-time primer appended when an agent's proseRouting mode changes. */
-function proseModePrimer(mode: 'explicit' | 'locus'): string {
+function proseModePrimer(mode: 'explicit' | 'hybrid' | 'locus'): string {
   if (mode === 'locus') {
     return '[prose-routing] Mode change: your plain text auto-routes to the ' +
       'conversational locus again. `>>` destination prefixes are no longer needed.';
   }
+  if (mode === 'hybrid') {
+    return '[prose-routing] Hybrid routing enabled: unprefixed text still lands in the ' +
+      'current conversational locus. A leading `>>>destination` envelope instead routes ' +
+      'that prose to one uniquely resolved authorized Discord or Eidoverse channel. The ' +
+      'envelope remains in your memory but recipients see only its body; delivery or failure ' +
+      'is reported back to you.';
+  }
   // Deliberately terse: a short event-style notice is classifier-safe from
   // the user role (ablation D, 2026-07-24), while the full grammar as a user
   // message drew a deterministic reasoning_extraction refusal (ablation A/B).
@@ -285,7 +339,7 @@ function validateUtilityArgs(
 }
 import { CheckpointManager } from './mcpl/checkpoint-manager.js';
 import { isToolAllowed } from './mcpl/tool-policy.js';
-import { EventGate } from './gate/event-gate.js';
+import { EventGate, formatShadowWarning } from './gate/event-gate.js';
 import { UsageTracker, type PersistedUsageState } from './usage/usage-tracker.js';
 import type { SessionUsageSnapshot, UsageUpdatedEvent } from './usage/types.js';
 import type { McplServerConnection } from './mcpl/server-connection.js';
@@ -293,10 +347,7 @@ import type {
   McplServerConfig,
   McplHostCapabilities,
   FeatureSetsChangedParams,
-  ScopeElevateParams,
-  ScopeElevateResult,
   BeforeInferenceParams,
-  AfterInferenceParams,
   PushEventParams,
   McplInferenceRequestParams,
   ChannelsRegisterParams,
@@ -587,8 +638,45 @@ export class AgentFramework {
    *  plain prose lands (2026-07-21 Cairn lounge misroute). Lives here — not in
    *  driveStream locals — so the pin survives a context-budget stream restart,
    *  which continues the same logical turn in a fresh driveStream. Cleared or
-   *  re-set at the start of every non-restart turn. */
+   *  re-set at the start of every non-restart turn. Since 2026-07-31 the pin
+   *  is no longer fully frozen: an ADDRESSED conversational injection — or a
+   *  conversational follow-up in a channel the agent itself explicitly sent
+   *  into this turn (turnEngagedChannels) — re-pins it at the boundary (see
+   *  the addressed re-pin block in the tool-result handler). Ambient chatter
+   *  elsewhere, reactions, and system markers still cannot move it. */
   private turnLocusPins: Map<string, string> = new Map();
+  /** Channels the agent EXPLICITLY sent into during the CURRENT turn
+   *  (SEND_ENGAGEMENT_TOOLS, successful calls), per agent. Second re-pin
+   *  signal: a conversational reply in a channel the agent just engaged is
+   *  addressed by context even without a mention (2026-07-31 n=7: q's
+   *  #portables follow-up — no @mention — was answered in trailing prose
+   *  that followed the stale pin into repligate's DM). No author-kind
+   *  filter: agent-residents are full participants, and the bot flag
+   *  tracks nothing that matters (antra). Reactions/system markers are
+   *  excluded by isConversationalInjection; the engaged-this-turn scope
+   *  keeps unrelated channels from moving the pin. Cleared at every fresh
+   *  turn's start; budget restarts keep it. */
+  private turnEngagedChannels: Map<string, Set<string>> = new Map();
+  /** Channels this turn's PLAIN PROSE was actually delivered to, in delivery
+   *  order (deduped at render). Feeds the `[delivered]` receipt appended at
+   *  logical turn end: explicit sends receipt themselves via their
+   *  tool_result, but auto-routed prose previously vanished into the router
+   *  with no in-window record — the agent could never see where its own
+   *  words landed (2026-07-31 misroute series; antra: minimal receipts).
+   *  Cleared at every fresh turn's start; budget restarts keep it (same
+   *  logical turn, receipt covers the whole turn). */
+  private turnProseDeliveries: Map<string, string[]> = new Map();
+  /** Count of plain-prose segments SUPPRESSED this turn by sticky
+   *  explicit-send silencing. The suppression rule itself is untouched
+   *  (antra, 2026-07-31: visibility is enough) — but it must never be a
+   *  silent black hole: Mythos multiplexed two threads in one round (prose
+   *  for the lane + explicit send for another channel, textbook per the
+   *  routing doc), the silencing ate the prose reply, and his own record
+   *  ("scene delivered to #mythos via plain speech — routing confirmed")
+   *  believed it delivered. The receipt now reports suppression, so the
+   *  author sees the segment's fate one turn later. Cleared each fresh
+   *  turn; budget restarts keep it. */
+  private turnProseSuppressed: Map<string, number> = new Map();
   /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
    *  not a reaction or a system marker) into the live stream. Tells
    *  driveStream to clear sticky explicit-send suppression before handling
@@ -606,6 +694,8 @@ export class AgentFramework {
   /** Sticky per-TURN delivery target set by the turn's first `>>` prefix.
    *  Cleared at every non-restart turn start; survives context restarts. */
   private proseTargetPins: Map<string, string> = new Map();
+  /** Hybrid router is fail-closed after a malformed/unresolved envelope until a new valid target. */
+  private proseHybridSuppressed: Set<string> = new Set();
   /** Agents whose current turn requested `!` continuation — re-woken when the
    *  turn completes instead of pausing until the next external event. */
   private proseContinuations: Set<string> = new Set();
@@ -708,7 +798,6 @@ export class AgentFramework {
   // MCPL subsystems (null when no mcplServers configured)
   private mcplServerRegistry: McplServerRegistry | null = null;
   private featureSetManager: FeatureSetManager | null = null;
-  private scopeManager: ScopeManager | null = null;
   private hookOrchestrator: HookOrchestrator | null = null;
   private pushHandler: PushHandler | null = null;
   private inferenceRouter: InferenceRouter | null = null;
@@ -746,12 +835,18 @@ export class AgentFramework {
    *  provenance envelope + payload and requests inference. Keyed by script id. */
   private backgroundScripts: Map<string, BackgroundScriptRecord> = new Map();
   private backgroundScriptCounter = 0;
-  /** Ephemeral per-agent override of the tool-result inline cap (chars).
-   *  Set via agent_settings `tool_result_inline_max_chars`; NOT persisted —
-   *  the lift is meant as a temporary gate, reverts on restart/reset. */
+  /** Resident-set per-agent tool-result inline cap (chars), via
+   *  agent_settings `tool_result_inline_max_chars`. DURABLE: persisted in
+   *  framework state like the core runtime settings and restored at create
+   *  (antra + Sol, 08-06); reset clears it back to the residence default. */
   private toolResultInlineMaxCharsOverride: Map<string, number> = new Map();
+  /** Durable residence-configured inline cap from
+   *  FrameworkConfig.toolResultInlineMaxChars; null → house default. */
+  private toolResultInlineMaxCharsConfig: number | null = null;
 
   private mcplTools: import('./types/index.js').ToolDefinition[] = [];
+  /** Namespaced tool name → stateful feature-set attribution from tools/list. */
+  private mcplToolFeatureSets: Map<string, string> = new Map();
   private mcplToolRefreshInFlight = false;
   private mcplToolRefreshPending = false;
   /** Maps tool prefix → serverId for dispatch routing. */
@@ -1027,6 +1122,20 @@ export class AgentFramework {
     // retained when enabled — everything downstream gates on the field.
     framework.codeExecutionConfig = config.codeExecution?.enabled ? config.codeExecution : null;
 
+    if (config.toolResultInlineMaxChars !== undefined) {
+      const cap = config.toolResultInlineMaxChars;
+      if (!Number.isFinite(cap) || cap < 1000) {
+        throw new Error('FrameworkConfig.toolResultInlineMaxChars must be a number >= 1000');
+      }
+      framework.toolResultInlineMaxCharsConfig = Math.floor(cap);
+    }
+
+    // Restore resident-set inline caps (agent_settings) — durable like the
+    // core runtime settings, same framework/state slot (antra + Sol, 08-06).
+    for (const [agentName, cap] of Object.entries(framework.readPersistedToolResultInlineCaps())) {
+      framework.toolResultInlineMaxCharsOverride.set(agentName, cap);
+    }
+
     // Initialize MCPL subsystems if configured
     if (config.mcplServers && config.mcplServers.length > 0) {
       // Validate tool prefixes: no collisions with module names or between servers
@@ -1468,10 +1577,11 @@ export class AgentFramework {
   private collectAgentSettingsExtensions(): Map<string, AgentSettingsExtension> {
     const result = new Map<string, AgentSettingsExtension>();
     const taken = new Set<string>(AgentFramework.AGENT_SETTINGS_CORE_KEYS);
-    // Framework-owned extension: the tool-result inline cap lift. Registered
-    // through the same extension surface modules use so get/update/reset all
-    // work with zero extra plumbing. EPHEMERAL by design (a temporary gate —
-    // reverts on restart), unlike module extensions which persist their own.
+    // Framework-owned extension: the resident's tool-result inline cap.
+    // Registered through the same extension surface modules use so
+    // get/update/reset all work with zero extra plumbing. DURABLE: persisted
+    // in framework state and restored at create, like the core runtime
+    // settings (antra + Sol, 08-06); reset returns to the residence default.
     {
       const ext = this.spillSettingsExtension();
       ext.keys.forEach((k) => taken.add(k));
@@ -1500,29 +1610,41 @@ export class AgentFramework {
         tool_result_inline_max_chars: {
           type: 'number',
           description:
-            'Inline size cap (chars) for tool results and background-script wake payloads. ' +
-            'Content over the cap is written to a workspace file under tool-results/ and ' +
-            'replaced by a truncated preview + file reference. Raise it temporarily when you ' +
-            'genuinely want a large result inline; reset restores the default (derived from ' +
-            'your strategy). Ephemeral — reverts on host restart.',
+            'Inline size cap (chars) for tool results (successes and errors) and ' +
+            'background-script wake payloads. Content over the cap is written to a workspace ' +
+            'file under tool-results/ and replaced by a truncated preview + file reference. ' +
+            'This is YOUR durable setting: it persists across restarts, like your other ' +
+            'agent_settings. Update it when you want a different inline size; reset restores ' +
+            'the residence default. The effective cap is min(your value, your strategy\'s ' +
+            'per-message bound) — the bound is a safety ceiling, and the full content is ' +
+            'always in the spill file. get reports desired/_effective/_source/_clamped_by.',
         },
       },
       keys: ['tool_result_inline_max_chars'],
-      get: (agentName: string) => ({
-        tool_result_inline_max_chars:
-          this.toolResultInlineMaxCharsOverride.get(agentName) ?? null,
-      }),
+      get: (agentName: string) => {
+        const agent = this.agents.get(agentName);
+        const resolved = agent ? this.resolveToolResultInlineCap(agent) : null;
+        return {
+          tool_result_inline_max_chars:
+            this.toolResultInlineMaxCharsOverride.get(agentName) ?? null,
+          tool_result_inline_max_chars_effective: resolved?.cap ?? null,
+          tool_result_inline_max_chars_source: resolved?.source ?? null,
+          tool_result_inline_max_chars_clamped_by: resolved?.clampedBy ?? null,
+        };
+      },
       update: (agentName: string, patch: Record<string, unknown>) => {
         const n = Number(patch.tool_result_inline_max_chars);
         if (!Number.isFinite(n) || n < 1000) {
           throw new Error('tool_result_inline_max_chars must be a number >= 1000');
         }
         this.toolResultInlineMaxCharsOverride.set(agentName, Math.floor(n));
+        this.persistToolResultInlineCap(agentName, Math.floor(n));
         return { tool_result_inline_max_chars: Math.floor(n) };
       },
       reset: (agentName: string, keys?: string[]) => {
         if (!keys || keys.includes('tool_result_inline_max_chars')) {
           this.toolResultInlineMaxCharsOverride.delete(agentName);
+          this.persistToolResultInlineCap(agentName, null);
         }
         return { tool_result_inline_max_chars: null };
       },
@@ -1858,12 +1980,14 @@ export class AgentFramework {
   /**
    * Add or replace (upsert) a gate policy at runtime. Validated and persisted
    * to gate.json; hot-applied in memory. Throws if no gate is configured or the
-   * policy is invalid. `position: 'prepend'` puts a wake rule ahead of broad
-   * defer/debounce rules (first match wins).
+   * policy is invalid. Placement: `'prepend'` puts a rule ahead of EVERYTHING
+   * (including addressed-message wake rules — see EventGate.lintShadows);
+   * `{before: name}` / `{after: name}` anchor it against a specific rule,
+   * which is usually what a sampler or debounce actually wants.
    */
   addGatePolicy(
     rawPolicy: unknown,
-    options?: { position?: 'append' | 'prepend' },
+    options?: { position?: 'append' | 'prepend' | { before: string } | { after: string } },
   ): import('./gate/types.js').GatePolicy {
     if (!this.eventGate) {
       throw new Error('No EventGate configured (FrameworkConfig.gate is unset).');
@@ -1952,6 +2076,44 @@ export class AgentFramework {
     return overrides;
   }
 
+  /** Load resident-set inline caps from framework state, dropping (loudly)
+   *  anything that fails the same validation the live update enforces. */
+  private readPersistedToolResultInlineCaps(): Record<string, number> {
+    try {
+      const data = this.store.getStateJson(FRAMEWORK_STATE_ID) as {
+        toolResultInlineCaps?: Record<string, unknown>;
+      } | null;
+      const out: Record<string, number> = {};
+      for (const [name, value] of Object.entries(data?.toolResultInlineCaps ?? {})) {
+        const n = Number(value);
+        if (Number.isFinite(n) && n >= 1000) {
+          out[name] = Math.floor(n);
+        } else {
+          console.error(
+            `[agent-settings] dropping invalid persisted tool_result_inline_max_chars for '${name}': ${JSON.stringify(value)}`,
+          );
+        }
+      }
+      return out;
+    } catch {
+      return {};
+    }
+  }
+
+  /** Write (cap) or clear (null) one agent's resident-set inline cap. */
+  private persistToolResultInlineCap(agentName: string, cap: number | null): void {
+    const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+    const state = (data && typeof data === 'object' ? data : {}) as Record<string, unknown>;
+    const all = {
+      ...((state.toolResultInlineCaps as Record<string, number> | undefined) ?? {}),
+    };
+    if (cap === null) delete all[agentName];
+    else all[agentName] = cap;
+    if (Object.keys(all).length === 0) delete state.toolResultInlineCaps;
+    else state.toolResultInlineCaps = all;
+    this.store.setStateJson(FRAMEWORK_STATE_ID, state);
+  }
+
   private persistAgentRuntimeSettings(
     agentName: string,
     overrides: AgentRuntimeSettingsOverrides,
@@ -2202,9 +2364,17 @@ export class AgentFramework {
       description:
         'Add or replace a wake rule (a gate.json policy) at runtime — no need to ' +
         'hand-edit the file. The rule is validated and hot-applied immediately. ' +
-        'A rule with the same `name` replaces the existing one in place. Use ' +
-        '`position: "prepend"` to put a wake rule ahead of broad defer/debounce ' +
-        'rules (first match wins). Two common shapes:\n' +
+        'A rule with the same `name` replaces the existing one in place (add a ' +
+        'position to move it). ⚠️ ORDERING IS SEMANTICS: first match wins, and a ' +
+        'matched rule CONSUMES the event — a broad rule placed early makes every ' +
+        'later rule unreachable for its scope, including your addressed-message ' +
+        '(DM/mention) wake rules. Prefer `insertBefore`/`insertAfter` to place a ' +
+        'rule relative to a specific existing rule; use `position: "prepend"` only ' +
+        'when the rule really must beat EVERYTHING. For "additionally wake me ' +
+        'every Nth event / at most N per hour" governors, set `passthrough: true` ' +
+        'so non-firing matches fall through to your normal rules instead of ' +
+        'swallowing them. The result includes a before/after probe table and any ' +
+        'shadow warnings — READ THEM before ending the turn. Two common shapes:\n' +
         '• Watch a FILE/workspace path: match on `mount` + `pathGlob`, e.g. ' +
         '`{ name: "watch-notes", match: { scope: ["workspace:modified"], mount: "project", pathGlob: "notes/*.md" }, behavior: "always" }`.\n' +
         '• Watch a CHANNEL: match on `source` + `channel` (and/or `tagsAny: ["chat:ambient"]`), ' +
@@ -2272,7 +2442,30 @@ export class AgentFramework {
           position: {
             type: 'string',
             enum: ['append', 'prepend'],
-            description: 'Where to insert a NEW rule (ignored when replacing by name). Default "append".',
+            description:
+              'Coarse placement. "append" (default) adds at the end; "prepend" puts the rule ' +
+              'ahead of EVERYTHING — including addressed-message wake rules — so prefer ' +
+              'insertBefore/insertAfter unless the rule really must beat every other rule. ' +
+              'When replacing an existing name, giving any placement MOVES the rule there; ' +
+              'omit all placement fields to update it in place.',
+          },
+          insertBefore: {
+            type: 'string',
+            description:
+              'Insert the rule immediately BEFORE the named existing rule (error if absent). ' +
+              'The safe way to order against a specific catch-all, e.g. insertBefore: "discord-ambient".',
+          },
+          insertAfter: {
+            type: 'string',
+            description: 'Insert the rule immediately AFTER the named existing rule (error if absent).',
+          },
+          passthrough: {
+            type: 'boolean',
+            description:
+              'Observer semantics for rateLimit/passiveSample rules: when the rule matches but ' +
+              'does not fire (below N, bucket empty), the event FALLS THROUGH to later rules ' +
+              'instead of being consumed. Use for "additionally wake me every Nth event" ' +
+              'governors so they never swallow DM/mention wakes.',
           },
           resets: {
             type: 'array',
@@ -2434,15 +2627,6 @@ export class AgentFramework {
     'chat:thread': 'Occurred in a thread',
   };
 
-  /** Refusal category → Discord reaction emoji. Unknown categories get 🛑. */
-  private static readonly REFUSAL_REACTIONS: Record<string, string> = {
-    bio: '☣️',
-    chem: '🧪',
-    nuclear: '☢️',
-    cyber: '💻',
-    reasoning_extraction: '🧠',
-  };
-
   /**
    * Mark an inference refusal visibly: react on the message that holds the
    * conversational locus (the most recent incoming channel message) with a
@@ -2459,7 +2643,7 @@ export class AgentFramework {
       const parts = incoming.channelId.split(':');
       if (parts[0] !== 'discord') return;
       const channelId = parts[parts.length - 1];
-      const emoji = AgentFramework.REFUSAL_REACTIONS[category] ?? '🛑';
+      const emoji = REFUSAL_REACTIONS[category] ?? REFUSAL_REACTION_FALLBACK;
       // Resolve the MCPL server that owns the locus channel and call
       // tools/call directly on its connection (bare tool name — no prefix
       // games), bypassing the agent event queue so no synthetic tool-result
@@ -2673,6 +2857,46 @@ export class AgentFramework {
     }
   }
 
+  /**
+   * Admin-level nudge: run an inference turn on the agent's CURRENT context
+   * without adding any message, event, or other context mutation. The turn
+   * compiles exactly what the agent already sees — useful after an /undo,
+   * a /hide, or whenever an operator wants the agent to take another look
+   * (or another swing) at where it stands, with zero context pollution.
+   *
+   * Queues a normal inference request (same path as gate wakes): if the
+   * agent is mid-turn it runs when the turn settles; a pending skip_reply
+   * self-wake is superseded like any other wake. Deliberately NOT gated on
+   * idle — "run when you're free" is the useful semantic. No suppression
+   * interplay: gate sleep filters events, not queued requests, so a nudge
+   * wakes even a sleeping agent (it's an admin override, like /unstick).
+   */
+  nudgeAgent(agentName?: string, requestedBy?: string): {
+    ok: boolean;
+    error?: string;
+    agentName?: string;
+    /** Agent state at queue time — 'idle' means the turn starts on the next
+     *  scheduler pass; anything else means it runs after the current turn. */
+    agentStatus?: string;
+  } {
+    const name = agentName ?? [...this.agents.keys()][0];
+    const agent = name ? this.agents.get(name) : undefined;
+    if (!name || !agent) {
+      return { ok: false, error: `Unknown agent: ${String(agentName ?? '(none registered)')}` };
+    }
+    const agentStatus = this.activeTurnTokens.has(name) && agent.state.status === 'idle'
+      ? 'idle+turn-alive'
+      : agent.state.status;
+    this.pendingRequests.push({
+      agentName: name,
+      reason: requestedBy ? `admin-nudge (${requestedBy})` : 'admin-nudge',
+      source: 'admin',
+      timestamp: Date.now(),
+    });
+    console.error(`[nudge] agent=${name} queued by=${requestedBy ?? 'unknown'} status=${agentStatus}`);
+    return { ok: true, agentName: name, agentStatus };
+  }
+
   /**
    * Handle a `host/command` request from an MCPL surface server (e.g. a
    * Discord slash command). Currently supports:
@@ -2681,6 +2905,9 @@ export class AgentFramework {
    *   `undoLastTurn`). The response includes the last message the agent
    *   would see in its context after the undo, obtained via the transparent
    *   `previewActivation` render (no inference, no Chronicle writes).
+   *
+   *   nudge — run inference on the current context with NO new events
+   *   (see `nudgeAgent`).
    */
   private async handleHostCommand(
     serverId: string,
@@ -2703,8 +2930,16 @@ export class AgentFramework {
      *  outcome report is posted to the channel asynchronously. */
     started?: boolean;
     cap?: number;
+    /** For `nudge`: agent state at queue time ('idle' = runs immediately,
+     *  else it runs once the current turn settles). */
+    agentStatus?: string;
   }> {
-    if (params.command !== 'undo' && params.command !== 'hide' && params.command !== 'unstick') {
+    if (
+      params.command !== 'undo' &&
+      params.command !== 'hide' &&
+      params.command !== 'unstick' &&
+      params.command !== 'nudge'
+    ) {
       return { ok: false, error: `Unknown host command: ${String(params.command)}` };
     }
 
@@ -2713,6 +2948,16 @@ export class AgentFramework {
       return { ok: false, error: `Unknown agent: ${String(agentName)}` };
     }
 
+    // nudge: queue an inference on the current context — no message, no
+    // event, no context mutation (see nudgeAgent).
+    if (params.command === 'nudge') {
+      const r = this.nudgeAgent(
+        agentName,
+        params.requesterName ?? params.requesterId ?? `mcpl:${serverId}`,
+      );
+      return { ok: r.ok, error: r.error, agentStatus: r.agentStatus };
+    }
+
     // unstick: force the refusal-rewind loop on demand (even if the agent's
     // autoRewind toggle is off). Redacts the turn that fed the refusal and
     // re-runs, up to `cap` times, until the model stops refusing. Kicks the
@@ -3616,38 +3861,18 @@ export class AgentFramework {
             this.pendingAssistantBlocks.delete(agent.name);
           }
 
-          // Compute truncation limit from agent's strategy (maxMessageTokens * 4 chars)
-          const maxChars = this.getMaxToolResultChars(agent);
-
-          // Oversized results spill to a workspace file (truncated preview +
-          // file reference) instead of being blind-truncated. Computed ONCE
-          // per call and reused for both the history copy and the live wire
-          // copy below — the two must stay byte-matched (the window stores
-          // what the membrane sends; divergence breaks the compile prefix).
-          const spilled = new Map<string, string>();
-          const dateLabel = new Date().toISOString().slice(0, 10);
-          for (const tc of currentState.toolResults) {
-            if (tc.result.isError) continue;
-            spilled.set(tc.id, await this.spillOrTruncate(
-              toolResultDataToHistoryString(tc.result.data, undefined),
-              maxChars,
-              `${dateLabel}-${tc.id}`,
-              agent.name,
-            ));
-          }
-
-          // Store tool results as a user message (tool_result blocks).
-          // Use the history serializer so MCP image blocks become a short
-          // `[image: type, size]` placeholder instead of megabytes of base64
-          // that would corrupt under truncation.
-          const toolResultContent: ContentBlock[] = currentState.toolResults.map(tc => ({
-            type: 'tool_result' as const,
-            toolUseId: tc.id,
-            content: tc.result.isError
-              ? tc.result.error ?? 'Unknown error'
-              : spilled.get(tc.id) ?? toolResultDataToHistoryString(tc.result.data, maxChars),
-            isError: tc.result.isError,
-          }));
+          // Effective inline cap: agent_settings override → durable config →
+          // house default, clamped to the strategy bound (see resolver).
+          const maxChars = this.resolveToolResultInlineCap(agent).cap;
+
+          // Oversized results — successes AND errors — spill to a workspace
+          // file (truncated preview + file reference) instead of being
+          // blind-truncated. Computed ONCE per call and reused for both the
+          // history copy and the live wire copy below — the two must stay
+          // byte-matched (the window stores what the membrane sends;
+          // divergence breaks the compile prefix).
+          const { blocks: toolResultContent, spilled } =
+            await this.buildStoredToolResultContent(currentState.toolResults, maxChars);
           agent.getContextManager().addMessage('user', toolResultContent);
 
           // Flush any messages that were deferred while this turn was in
@@ -3719,6 +3944,30 @@ export class AgentFramework {
             && agent.lastStreamInputTokens > 0
             && agent.lastStreamInputTokens > agent.maxStreamTokens;
 
+          // Physical-window projection (issue #92): a turn's continuation
+          // rounds append to the compiled request without recompiling, so a
+          // turn that starts near the compile target can walk past the
+          // provider's HARD cap mid-turn and take a wire 400 — the compile
+          // was legal, the growth wasn't. Project the next round's real size
+          // (cache-inclusive input of the prior round + the blocks about to
+          // be appended + reserve for the response) and, when it would cross
+          // the physical window, break the stream through the same
+          // budget-restart path — a fresh compile folds the history back
+          // under budget instead of dispatching a doomed request.
+          // Projection terms: prior round's real input + prior round's
+          // OUTPUT (the just-generated thinking/text/tool_use joins the next
+          // round's input — omitting it is a systematic underestimate) +
+          // blocks about to be appended + reserve for the next response.
+          const projectedRealTokens = currentState.stream
+            && agent.physicalWindowTokens !== undefined
+            && agent.lastStreamRealInputTokens > 0
+            ? agent.lastStreamRealInputTokens
+              + agent.lastStreamOutputTokens
+              + estimateAppendedRoundTokens(currentState.toolResults, spilled, midTurnInjections)
+              + agent.maxTokens
+            : 0;
+          const overPhysical = projectedRealTokens > (agent.physicalWindowTokens ?? Infinity);
+
           // Addressed re-pin (2026-07-31 Mythos misroutes, antra-ratified):
           // when someone ADDRESSES the agent mid-turn from another channel
           // (mention / reply / DM — the same chat:addressed signal the
@@ -3747,15 +3996,31 @@ export class AgentFramework {
             agent.proseRouting !== 'explicit' &&
             !shouldEndTurn && !overBudget && currentState.stream
           ) {
-            const lastAddressed = [...midTurnInjections].reverse().find((inj) => {
+            // Two signals qualify an injection to move the pin (n=6 + n=7):
+            //  - chat:addressed — someone explicitly spoke TO the agent
+            //    (mention / reply / DM);
+            //  - a conversational follow-up in a channel the agent itself
+            //    explicitly sent into THIS turn (turnEngagedChannels) —
+            //    conversation the agent just engaged continues without
+            //    re-mentioning it (2026-07-31: q's #portables reply, no @,
+            //    answered in prose that followed the stale pin into
+            //    repligate's DM). Deliberately NO author-kind filter: this
+            //    fleet's participants include agent-residents whose speech
+            //    is as conversational as anyone's — the Discord bot flag
+            //    tracks nothing that matters here (antra, 2026-07-31).
+            //    Reactions and system markers are already excluded by
+            //    isConversationalInjection, and the engaged-this-turn scope
+            //    keeps unrelated channels from moving the pin.
+            const engaged = this.turnEngagedChannels.get(agent.name);
+            const lastQualifying = [...midTurnInjections].reverse().find((inj) => {
               const m = inj.metadata as Record<string, unknown> | undefined;
-              return (
-                isConversationalInjection(inj.metadata) &&
-                typeof m?.channelId === 'string' &&
-                isAddressedMessage(m.tags as string[] | undefined, m)
-              );
+              if (!isConversationalInjection(inj.metadata)) return false;
+              if (typeof m?.channelId !== 'string') return false;
+              const tags = m.tags as string[] | undefined;
+              if (isAddressedMessage(tags, m)) return true;
+              return engaged?.has(m.channelId as string) === true;
             });
-            const newLocus = (lastAddressed?.metadata as Record<string, unknown> | undefined)
+            const newLocus = (lastQualifying?.metadata as Record<string, unknown> | undefined)
               ?.channelId as string | undefined;
             if (newLocus && this.turnLocusPins.get(agent.name) !== newLocus) {
               const prevPin = this.turnLocusPins.get(agent.name) ?? null;
@@ -3768,7 +4033,7 @@ export class AgentFramework {
               const noticeContent: ContentBlock[] = [{
                 type: 'text',
                 text:
-                  `[routing] You were just addressed from ${shown} — your plain ` +
+                  `[routing] The conversation moved to ${shown} — your plain ` +
                   'speech now lands there for the rest of this turn. Other ' +
                   'channels need an explicit send tool.',
               }];
@@ -3800,7 +4065,7 @@ export class AgentFramework {
             this.eventGate?.onInferenceEnded(agent.name);
             this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' });
             this.emitTrace({ type: 'inference:turn_ended', agentName: agent.name });
-          } else if (overBudget) {
+          } else if (overBudget || overPhysical) {
             // Context budget exceeded: break the stream, let compile() compress.
             // Mark the cancel as framework-initiated BEFORE cancelling: the
             // membrane delivers `aborted` before the restart bumps streamId,
@@ -3825,9 +4090,12 @@ export class AgentFramework {
             this.emitTrace({
               type: 'inference:stream_restarted',
               agentName: agent.name,
-              reason: 'context_budget',
-              inputTokens: agent.lastStreamInputTokens,
-              budget: agent.maxStreamTokens,
+              // 'physical_window' only when the budget check alone would
+              // have let the doomed request through — overBudget keeps its
+              // established label for existing consumers.
+              reason: overBudget ? 'context_budget' : 'physical_window',
+              inputTokens: overBudget ? agent.lastStreamInputTokens : projectedRealTokens,
+              budget: overBudget ? agent.maxStreamTokens : (agent.physicalWindowTokens ?? 0),
             });
             this.pendingRequests.push({
               agentName: agent.name,
@@ -4040,6 +4308,12 @@ export class AgentFramework {
           ? (event.metadata.guildName as string)
           : undefined,
         tags: event.tags,
+        missedMessages: typeof event.metadata?.missedMessages === 'number'
+          ? event.metadata.missedMessages
+          : undefined,
+        missedCharacters: typeof event.metadata?.missedCharacters === 'number'
+          ? event.metadata.missedCharacters
+          : undefined,
       });
       if (invitation) {
         incomingContent.push(invitation.block);
@@ -4347,6 +4621,17 @@ export class AgentFramework {
    * this should see WHO addressed it WHERE, not a wall of snowflake ids. Raw
    * ids remain only inside the tool-argument instructions, where they are the
    * literal values to pass.
+   *
+   * 2026-08-05 accuracy pass: the old "you won't receive more from it unless
+   * you join" was wrong in both directions — direct addresses (mentions,
+   * replies to the agent) DO still arrive, and nothing warned that answering
+   * via option 1 leaves the human's natural un-@'d follow-up invisible (Sol
+   * answered four #architecture mentions over four days while the follow-ups
+   * to her own replies were silently dropped). The wording now states the
+   * actual delivery model, and option 1 carries the consequence inline. When
+   * the surface tracks a missed-ambient tally (discord-mcpl sends
+   * `missedMessages`/`missedCharacters` in push origin), the invitation shows
+   * the count — the cost of staying out, as a number, at decision time.
    */
   private buildClosedChannelInvitation(opts: {
     serverId: string;
@@ -4356,6 +4641,10 @@ export class AgentFramework {
     authorName: string;
     guildName?: string;
     tags?: string[];
+    /** Ambient messages dropped in this channel while closed (surface-tracked). */
+    missedMessages?: number;
+    /** Characters across those dropped messages. */
+    missedCharacters?: number;
   }): { block: ContentBlock; metadataPatch: Record<string, unknown> } | null {
     if (!this.channelRegistry) return null;
     if (!opts.tags?.includes('chat:addressed')) return null;
@@ -4365,13 +4654,23 @@ export class AgentFramework {
     const label = opts.channelLabel ?? descriptor?.label;
     const channelLabel = label ? `#${label}` : `"${opts.channelId}"`;
     const place = opts.guildName ? `${channelLabel} in "${opts.guildName}"` : channelLabel;
+    const missedCount = opts.missedMessages ?? 0;
+    const missedNote =
+      missedCount > 0
+        ? `While closed, ${missedCount} message${missedCount === 1 ? '' : 's'}` +
+          (opts.missedCharacters ? ` (~${opts.missedCharacters} chars)` : '') +
+          ` have passed there without you. `
+        : '';
     const block: ContentBlock = {
       type: 'text',
       text:
         `\n[Channel invitation] ${opts.authorName} addressed you in ${place} — ` +
-        `a channel you haven't joined. You're seeing this one message; you won't receive more from it unless you join. ` +
+        `a channel you haven't joined. Only messages that address you directly (an @-mention or ` +
+        `a reply to one of your messages) reach you from it; the rest of its traffic is invisible to you. ` +
+        missedNote +
         `Your options:\n` +
-        `1. Reply without joining — write your reply this turn prefixed with ">>${channelLabel}"; it will be delivered there.\n` +
+        `1. Reply without joining — write your reply this turn prefixed with ">>${channelLabel}"; it will be delivered there. ` +
+        `Note: follow-ups to your reply will NOT reach you unless they @-mention you or use the reply feature on your message.\n` +
         `2. Join the channel — call channel_open with channelId "${opts.channelId}" and serverId "${opts.serverId}"` +
         (maxBackscroll > 0
           ? `; to also read recent history, add backscroll (a number up to ${maxBackscroll}) and beforeMessageId "${opts.messageId}".\n`
@@ -4434,6 +4733,9 @@ export class AgentFramework {
         authorName: typeof origin.authorName === 'string' && origin.authorName ? origin.authorName : 'Someone',
         guildName: typeof origin.guildName === 'string' && origin.guildName ? origin.guildName : undefined,
         tags: event.tags,
+        missedMessages: typeof origin.missedMessages === 'number' ? origin.missedMessages : undefined,
+        missedCharacters:
+          typeof origin.missedCharacters === 'number' ? origin.missedCharacters : undefined,
       });
       if (invitation) {
         content.push(invitation.block);
@@ -4653,6 +4955,77 @@ export class AgentFramework {
     }
   }
 
+  /** Record prose segments suppressed by explicit-send silencing. */
+  private recordProseSuppression(agentName: string, count: number): void {
+    if (count <= 0) return;
+    this.turnProseSuppressed.set(agentName, (this.turnProseSuppressed.get(agentName) ?? 0) + count);
+  }
+
+  /** Record a successful plain-prose delivery for this turn's receipt. */
+  private recordProseDelivery(
+    agentName: string,
+    outcome: { delivered: boolean; channelId: string } | null | undefined,
+  ): void {
+    if (!outcome?.delivered) return;
+    let list = this.turnProseDeliveries.get(agentName);
+    if (!list) {
+      list = [];
+      this.turnProseDeliveries.set(agentName, list);
+    }
+    list.push(outcome.channelId);
+  }
+
+  /**
+   * Append the turn's `[delivered]` receipt: one compact system message
+   * naming where this turn's plain prose actually landed (channels in
+   * delivery order, deduped). Explicit sends receipt themselves via their
+   * tool_result; auto-routed prose previously left no in-window trace, so
+   * the agent could never see where its own words went — misroutes were
+   * invisible to it until a human reported them (2026-07-31 series).
+   * Called ONLY at logical turn end (stream 'complete', or the endTurn
+   * cancel path after the speech chain settles) — never mid-stream, where a
+   * window-only insert would diverge from the wire. No-op when the turn
+   * delivered nothing. Failures are already marked separately
+   * ([discord-send-failed]); this is the success half.
+   */
+  private appendProseDeliveryReceipt(agent: Agent): void {
+    const list = this.turnProseDeliveries.get(agent.name);
+    const suppressed = this.turnProseSuppressed.get(agent.name) ?? 0;
+    if ((!list || list.length === 0) && suppressed === 0) return;
+    this.turnProseDeliveries.delete(agent.name);
+    this.turnProseSuppressed.delete(agent.name);
+    const seen = new Set<string>();
+    const shown: string[] = [];
+    for (const id of list ?? []) {
+      if (seen.has(id)) continue;
+      seen.add(id);
+      const label = this.channelRegistry?.getDescriptor(id)?.label;
+      shown.push(
+        label && label !== id
+          ? `${label.startsWith('#') ? label : `#${label}`} (${id})`
+          : id,
+      );
+    }
+    const suppressedNote =
+      suppressed > 0
+        ? `${suppressed} plain-speech segment(s) suppressed (explicit send in the same round — resend with a send tool if it was meant to be heard)`
+        : '';
+    const text =
+      shown.length > 0
+        ? `[delivered] plain speech → ${shown.join(' · ')}${suppressedNote ? ` · ${suppressedNote}` : ''}`
+        : `[delivered] nothing — ${suppressedNote}`;
+    try {
+      const mid = agent.getContextManager().addMessage(
+        'user',
+        [{ type: 'text', text }],
+        { system: true, kind: 'delivery-receipt' } as MessageMetadata,
+      );
+      this.emitTrace({ type: 'message:added', messageId: mid, source: 'delivery-receipt' });
+    } catch (err) {
+      console.error('delivery receipt append failed:', err);
+    }
+  }
+
   /**
    * Announce-on-change locus notice (turn-frozen routing). Appends a durable
    * `[routing]` window message when the turn's effective outbound locus
@@ -4782,6 +5155,97 @@ export class AgentFramework {
     }
   }
 
+  /** Locus-preserving explicit publication. Source remains byte-identical in Chronicle. */
+  private async deliverHybridProse(
+    agent: Agent,
+    rawText: string,
+    locus: string | null,
+    allowLocus: boolean,
+  ): Promise<void> {
+    const lines = rawText.split('\n');
+    const envelopes: string[] = [];
+    let current: string[] = [];
+    for (const line of lines) {
+      if (line.trimStart().startsWith('>>>') && current.length > 0) {
+        envelopes.push(current.join('\n'));
+        current = [];
+      }
+      current.push(line);
+    }
+    if (current.length > 0) envelopes.push(current.join('\n'));
+
+    for (const envelope of envelopes) {
+      if (!envelope.trim()) continue;
+      const normalized = envelope.replace(/^\s+(?=>>>)/, '');
+      const attempted = normalized.startsWith('>>>');
+      const parsed = parseHybridProsePrefix(normalized);
+      if (parsed.continueTurn) this.proseContinuations.add(agent.name);
+      if (parsed.kind === 'private') {
+        this.proseTargetPins.delete(agent.name);
+        this.proseHybridSuppressed.add(agent.name);
+        console.error(`[prose] ${agent.name}: >>>skip_reply — ${parsed.body.length} chars kept in context (not sent)`);
+        continue;
+      }
+      if (parsed.kind === 'target') {
+        const resolved = this.channelRegistry!.resolveProseTarget(parsed.target!);
+        if ('error' in resolved) {
+          this.proseTargetPins.delete(agent.name);
+          this.proseHybridSuppressed.add(agent.name);
+          this.bounceProse(agent, parsed.body, resolved.error, resolved.candidates, '>>>');
+          continue;
+        }
+        let body = parsed.body;
+        const usedClipboard = body.includes('{{unsent}}');
+        if (usedClipboard) body = body.replaceAll('{{unsent}}', this.proseClipboards.get(agent.name) ?? '');
+        this.proseTargetPins.set(agent.name, resolved.channelId);
+        this.proseHybridSuppressed.delete(agent.name);
+        if (!body.trim()) {
+          console.error(`[prose] ${agent.name}: >>>${parsed.target} established target; empty body — nothing sent yet`);
+          continue;
+        }
+        try {
+          const outcome = await this.channelRegistry!.routeSpeech(agent.name, body, resolved.channelId);
+          this.recordProseDelivery(agent.name, outcome);
+          if (outcome?.delivered) {
+            this.proseBounceStreaks.delete(agent.name);
+            if (usedClipboard) this.proseClipboards.delete(agent.name);
+          } else {
+            this.proseTargetPins.delete(agent.name);
+            this.proseHybridSuppressed.add(agent.name);
+            this.bounceProse(agent, parsed.body, `delivery to ${resolved.channelId} was not confirmed`, undefined, '>>>');
+          }
+        } catch (err) {
+          this.proseTargetPins.delete(agent.name);
+          this.proseHybridSuppressed.add(agent.name);
+          this.bounceProse(agent, parsed.body, `delivery to ${resolved.channelId} failed: ${err instanceof Error ? err.message : String(err)}`, undefined, '>>>');
+        }
+        continue;
+      }
+      if (attempted) {
+        this.proseTargetPins.delete(agent.name);
+        this.proseHybridSuppressed.add(agent.name);
+        this.bounceProse(agent, normalized, 'malformed >>> routing envelope: destination is missing', undefined, '>>>');
+        continue;
+      }
+      if (this.proseHybridSuppressed.has(agent.name)) {
+        this.recordProseSuppression(agent.name, 1);
+        continue;
+      }
+      const sticky = this.proseTargetPins.get(agent.name);
+      if (!allowLocus && !sticky) {
+        this.recordProseSuppression(agent.name, 1);
+        continue;
+      }
+      const target = sticky ?? locus;
+      try {
+        const outcome = await this.channelRegistry!.routeSpeech(agent.name, envelope, target);
+        this.recordProseDelivery(agent.name, outcome);
+      } catch (err) {
+        console.error('hybrid locus delivery failed:', err);
+      }
+    }
+  }
+
   private async deliverProseEnvelope(agent: Agent, rawText: string): Promise<void> {
     const name = agent.name;
     const parsed = parseProsePrefix(rawText);
@@ -4841,7 +5305,7 @@ export class AgentFramework {
   /** Cap on consecutive bounce-triggered wakes (notices still append after). */
   private static readonly PROSE_BOUNCE_WAKE_CAP = 2;
 
-  private bounceProse(agent: Agent, text: string, reason: string, candidates?: string[]): void {
+  private bounceProse(agent: Agent, text: string, reason: string, candidates?: string[], prefix: '>>' | '>>>' = '>>'): void {
     const name = agent.name;
     this.proseClipboards.set(name, text);
     const streak = (this.proseBounceStreaks.get(name) ?? 0) + 1;
@@ -4850,8 +5314,9 @@ export class AgentFramework {
     const notice =
       `[prose-routing] Your text (${text.length} chars) was not delivered — ${reason}.${cand} ` +
       'The text is retained; nothing is lost. To deliver it unchanged, reply with a ' +
-      'destination plus the token {{unsent}}, e.g. ">>#channel {{unsent}}" or ">>@person {{unsent}}". ' +
-      '">>skip_reply {{unsent}}" keeps it in context only. The prose_help tool shows the full syntax.';
+      `destination plus the token {{unsent}}, e.g. "${prefix}#channel {{unsent}}" or "${prefix}@person {{unsent}}". ` +
+      `"${prefix}skip_reply {{unsent}}" keeps it in context only.` +
+      (prefix === '>>' ? ' The prose_help tool shows the full syntax.' : '');
     try {
       // Through framework.addMessage, NOT the context manager directly: while
       // the turn is still streaming this defers the notice to the next tool
@@ -5047,6 +5512,14 @@ export class AgentFramework {
     // KV stability).
     if (trigger?.reason !== 'context_budget_restart') {
       if (attempt === 0) this.maybePrimeProseMode(agent);
+      // Fresh turn: forget the previous turn's explicit-send engagements and
+      // prose deliveries — both are strictly turn-scoped (a restart continues
+      // the same logical turn and keeps them).
+      this.turnEngagedChannels.delete(agent.name);
+      this.turnProseDeliveries.delete(agent.name);
+      this.turnProseSuppressed.delete(agent.name);
+      this.proseHybridSuppressed.delete(agent.name);
+      if (agent.proseRouting === 'hybrid') this.proseTargetPins.delete(agent.name);
       if (agent.proseRouting === 'explicit') {
         // Explicit prose routing: there is no locus. The model names every
         // destination in-band (`>>` prefixes); the only turn state is the
@@ -5249,7 +5722,8 @@ export class AgentFramework {
     const enqueueSpeech = (text: string, locus: string | null): void => {
       turnSpeechChain = turnSpeechChain
         .then(async () => {
-          await this.channelRegistry!.routeSpeech(agent.name, text, locus);
+          const outcome = await this.channelRegistry!.routeSpeech(agent.name, text, locus);
+          this.recordProseDelivery(agent.name, outcome);
         })
         .catch((err) => console.error('mid-turn speech routing failed:', err));
     };
@@ -5291,11 +5765,30 @@ export class AgentFramework {
     // streams that delivery would refuse), emission is capability-gated in
     // the registry (`channels.streaming`), and delivery via deliverProse
     // remains the sole authoritative send.
-    const outgoingInferenceId = `inf_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+    const newOutgoingInferenceId = (): string =>
+      `inf_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+    // NOT const: a membrane refusal retry abandons everything streamed so
+    // far, and the surface must not concatenate two attempts. Re-minting the
+    // id makes the discarded attempt's chunk buffer orphaned (never
+    // finalized) instead of being appended to — see the 'retrying' case.
+    let outgoingInferenceId = newOutgoingInferenceId();
     let outgoingIndex = 0;
+
+    // §10.5 inference/lifecycle: `started` now, exactly one terminal in the
+    // finally below (the one block every exit path shares). Which terminal
+    // is decided by the paths themselves: default completed, catch sets
+    // failed, a framework-cancelled stream sets aborted. Best-effort
+    // notifications — consumers dedupe by inferenceId and keep a timeout.
+    let lifecyclePhase: 'completed' | 'aborted' | 'failed' = 'completed';
+    this.hookOrchestrator?.emitLifecycle({
+      inferenceId: outgoingInferenceId,
+      conversationId: agent.name,
+      turnIndex: 0,
+      phase: 'started',
+    });
     const proseStream = this.channelRegistry
       ? new ProseStreamRouter({
-          mode: agent.proseRouting === 'explicit' ? 'explicit' : 'locus',
+          mode: agent.proseRouting === 'explicit' ? 'explicit' : agent.proseRouting === 'hybrid' ? 'hybrid' : 'locus',
           initialTarget: typingChannel,
           resolve: (spec) => {
             const r = this.channelRegistry!.resolveProseTarget(spec);
@@ -5342,6 +5835,38 @@ export class AgentFramework {
             }
             break;
 
+          case 'retrying': {
+            // Membrane is re-issuing after a content-policy refusal. Per the
+            // RetryingEvent contract we must DISCARD everything this call has
+            // emitted: the tokens above were already streamed to the surface
+            // as outgoing chunks, and appending a second attempt to them
+            // would show the human two half-answers spliced together.
+            //
+            // Re-mint the outgoing id so the partial buffer is orphaned
+            // rather than continued (delivery is authoritative via
+            // deliverProse and has not happened yet — nothing has been
+            // *sent*, only previewed), and reset the prose router so its
+            // destination bookkeeping starts clean for the new attempt.
+            console.error(
+              `[refusal-retry] agent=${agent.name} membrane retry ` +
+                `${event.attempt}/${event.maxAttempts}` +
+                (event.category ? ` category=${event.category}` : '') +
+                ' — discarding the refused attempt',
+            );
+            outgoingInferenceId = newOutgoingInferenceId();
+            outgoingIndex = 0;
+            proseStream?.reset();
+            this.emitTrace({
+              type: 'inference:tokens',
+              agentName: agent.name,
+              content: '',
+              blockType: 'text',
+              blockIndex: 0,
+              channelId: typingChannel ?? undefined,
+            });
+            break;
+          }
+
           case 'block': {
             const { event: phase, index, block } = event.event;
             this.emitTrace({
@@ -5390,9 +5915,18 @@ export class AgentFramework {
               const rawXml = rawText && /^<(antml:)?function_calls>/.test(rawText)
                 ? rawText
                 : undefined;
+              // Persist THIS round's text only. `roundPreamble` (membrane
+              // ≥0.5.79) is the per-round delta; the legacy `preamble` is
+              // CUMULATIVE in XML mode — persisting it per round stored each
+              // round's text N times and re-persisted injected
+              // <function_results> as the agent's own words (the Evander
+              // 2026-08-08 scaffold-leak pyramid: r1 ×3, r2 ×2).
+              const roundText =
+                (event.context as { roundPreamble?: string }).roundPreamble ??
+                event.context.preamble;
               assistantBlocks = [];
-              if (event.context.preamble) {
-                assistantBlocks.push({ type: 'text', text: event.context.preamble });
+              if (roundText) {
+                assistantBlocks.push({ type: 'text', text: roundText });
               }
               for (const c of event.calls) {
                 assistantBlocks.push({
@@ -5434,14 +5968,28 @@ export class AgentFramework {
               const hasSameRoundPrivateThink =
                 roundToolNames.includes('think') &&
                 requestSnapshot.sameRoundThinkTextPolicy === 'private';
-              if (roundToolNames.some((n) => SILENCING_TOOLS.has(bareToolName(n)))) {
+              if (roundToolNames.some((n) =>
+                SILENCING_TOOLS.has(bareToolName(n)) ||
+                (agent.proseRouting === 'hybrid' && HYBRID_PUBLICATION_TOOLS.has(bareToolName(n)))
+              )) {
                 turnSilenced = true;
               }
               if (roundContent && roundContent.length > 0) {
                 liveProseRouting = true;
                 const roundSegments = splitProseSegments(assistantBlocks);
                 if (roundSegments.length > 0) {
-                  if (agent.proseRouting === 'explicit') {
+                  if (agent.proseRouting === 'hybrid') {
+                    if (turnSilenced) {
+                      this.recordProseSuppression(agent.name, roundSegments.length);
+                    } else if (!hasSameRoundPrivateThink) {
+                      const locus = resolveTurnLocus();
+                      for (const seg of roundSegments) {
+                        turnSpeechChain = turnSpeechChain
+                          .then(() => this.deliverHybridProse(agent, seg, locus, true))
+                          .catch((err) => console.error('mid-turn hybrid prose delivery failed:', err));
+                      }
+                    }
+                  } else if (agent.proseRouting === 'explicit') {
                     // Explicit mode: every segment through the prose gateway.
                     // Silencing does not apply — unprefixed prose bounces and
                     // prefixed prose is deliberate; think-privacy still holds.
@@ -5459,6 +6007,9 @@ export class AgentFramework {
                     console.error(
                       `[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (turn silenced)`,
                     );
+                    // Visible in the turn-end receipt — silencing must never
+                    // be a silent black hole (n=8: the flying-scene reply).
+                    this.recordProseSuppression(agent.name, roundSegments.length);
                   } else if (hasSameRoundPrivateThink) {
                     console.error(
                       `[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (same_round_think_text_policy=private)`,
@@ -5506,17 +6057,15 @@ export class AgentFramework {
                 agent.addAssistantResponse(pending);
                 this.pendingAssistantBlocks.delete(agent.name);
               }
-              // Store tool results
+              // Store tool results — same bounded spill policy as the
+              // ordinary path (issue #89: this guard path must not become the
+              // one door a giant blob still walks through).
               const readyState = agent.state as AgentState;
               if (readyState.status === 'ready') {
-                const toolResultContent: ContentBlock[] = readyState.toolResults.map(tc => ({
-                  type: 'tool_result' as const,
-                  toolUseId: tc.id,
-                  content: tc.result.isError
-                    ? (tc.result.error ?? 'Unknown error')
-                    : toolResultDataToHistoryString(tc.result.data),
-                  isError: tc.result.isError,
-                }));
+                const { blocks: toolResultContent } = await this.buildStoredToolResultContent(
+                  readyState.toolResults,
+                  this.resolveToolResultInlineCap(agent).cap,
+                );
                 agent.getContextManager().addMessage('user', toolResultContent);
               }
             }
@@ -5545,40 +6094,10 @@ export class AgentFramework {
               agent.addAssistantResponse(terminalContent);
             }
 
-            // Run afterInference hooks (no-op if no MCPL servers)
-            if (this.hookOrchestrator) {
-              try {
-                const speechText = response.content
-                  .filter((block: ContentBlock): block is ContentBlock & { type: 'text' } => block.type === 'text')
-                  .map((b) => b.text)
-                  .join('\n');
-
-                const afterParams: AfterInferenceParams = {
-                  inferenceId: requestId,
-                  conversationId: agent.name,
-                  turnIndex: 0,
-                  userMessage: null,
-                  assistantMessage: speechText,
-                  model: {
-                    id: agent.model,
-                    vendor: 'unknown',
-                    contextWindow: 200000,
-                    capabilities: ['tools'],
-                  },
-                  usage: {
-                    inputTokens: response.usage?.inputTokens ?? 0,
-                    outputTokens: response.usage?.outputTokens ?? 0,
-                    cacheCreationTokens: response.details?.usage?.cacheCreationTokens,
-                    cacheReadTokens: response.details?.usage?.cacheReadTokens,
-                  },
-                };
-
-                await this.hookOrchestrator.afterInference(afterParams);
-              } catch (error) {
-                // Fail-open: continue with speech dispatch
-                console.error('afterInference hook error:', error);
-              }
-            }
+            // §10.5: context/afterInference is removed in 0.5.0 — no
+            // content leaves the host here. Turn boundaries are announced
+            // by the metadata-only inference/lifecycle notifications
+            // emitted in driveStream's start/exit paths.
 
             // Separate speech from thoughts — for MODULE dispatch only
             // (dispatchSpeech / TUI rendering below). This split does NOT
@@ -5675,6 +6194,18 @@ export class AgentFramework {
               let handledByRewind = false;
               const rh = agent.refusalHandling;
               const forced = this.forcedRewind.get(agent.name);
+
+              // NOTE: plain retries are NOT done here. `refusalHandling.retries`
+              // is handed to membrane (see Agent.startActivation), which
+              // replays the SAME request at the provider seam — immediately,
+              // cache-warm, and without recompiling into a different window.
+              // A framework-level requeue was tried first and is strictly
+              // worse: it recompiles, so attempts are correlated rather than
+              // fresh draws against a probabilistic threshold, and it cannot
+              // tell a streaming consumer to discard the abandoned attempt.
+              // By the time a refusal reaches here, membrane's retries are
+              // already spent — so this path is the escalation: rewind (if
+              // enabled), then the reaction.
               // Shed exactly one more (newest, in-sequence) turn and keep the
               // single episode marker current. `budgetLeft` bounds the loop.
               const doRewind = (
@@ -5732,7 +6263,16 @@ export class AgentFramework {
                 );
               }
 
-              if (!handledByRewind) void this.reactToRefusal(agent.name, category);
+              // The reaction is the LAST resort: retries spent, rewind not
+              // applicable. That makes it an honest signal to humans that the
+              // border is close, rather than noise on every near-threshold
+              // flip. (It must not re-enter any agent's context — the emoji
+              // is suppressed at the surface via
+              // DISCORD_SUPPRESS_REACTION_EMOJIS; without that, marking a
+              // refusal feeds the next one.)
+              if (!handledByRewind) {
+                void this.reactToRefusal(agent.name, category);
+              }
             } else {
               // A turn that completed WITHOUT a refusal ends the rewind episode:
               // the model responded. Leave the consolidated marker in place as
@@ -5779,7 +6319,15 @@ export class AgentFramework {
                 .join('\n')
                 .trim();
               if (speechText) {
-                if (agent.proseRouting === 'explicit') {
+                if (agent.proseRouting === 'hybrid') {
+                  const locus = resolveTurnLocus();
+                  console.error(`[prose] ${agent.name}: text-only turn -> hybrid prose gateway`);
+                  try {
+                    await this.deliverHybridProse(agent, speechText, locus, true);
+                  } catch (err) {
+                    console.error('text-only hybrid prose delivery failed:', err);
+                  }
+                } else if (agent.proseRouting === 'explicit') {
                   console.error(`[prose] ${agent.name}: text-only turn -> prose gateway`);
                   try {
                     await this.deliverProse(agent, speechText);
@@ -5798,7 +6346,8 @@ export class AgentFramework {
                     `[routing] ${agent.name}: text-only turn -> routing speech -> ${locus ?? '(none)'}`,
                   );
                   try {
-                    await this.channelRegistry.routeSpeech(agent.name, speechText, locus);
+                    const outcome = await this.channelRegistry.routeSpeech(agent.name, speechText, locus);
+                    this.recordProseDelivery(agent.name, outcome);
                   } catch (err) {
                     console.error('speech routing failed:', err);
                   }
@@ -5825,7 +6374,10 @@ export class AgentFramework {
                 .filter((n): n is string => typeof n === 'string');
               const silenced = liveProseRouting
                 ? turnSilenced
-                : turnSilenced || toolNames.some((n) => SILENCING_TOOLS.has(bareToolName(n)));
+                : turnSilenced || toolNames.some((n) =>
+                  SILENCING_TOOLS.has(bareToolName(n)) ||
+                  (agent.proseRouting === 'hybrid' && HYBRID_PUBLICATION_TOOLS.has(bareToolName(n)))
+                );
 
               const segments = splitProseSegments(liveProseRouting ? terminalContent : response.content);
 
@@ -5834,7 +6386,20 @@ export class AgentFramework {
               // the chain may still be flushing earlier rounds' posts.
               await turnSpeechChain;
 
-              if (agent.proseRouting === 'explicit') {
+              if (agent.proseRouting === 'hybrid') {
+                if (silenced && segments.length > 0) {
+                  this.recordProseSuppression(agent.name, segments.length);
+                } else if (segments.length > 0) {
+                  const locus = resolveTurnLocus();
+                  for (const seg of segments) {
+                    try {
+                      await this.deliverHybridProse(agent, seg, locus, true);
+                    } catch (err) {
+                      console.error('trailing hybrid prose delivery failed:', err);
+                    }
+                  }
+                }
+              } else if (agent.proseRouting === 'explicit') {
                 if (segments.length > 0) {
                   console.error(
                     `[prose] ${agent.name}: tool-call turn [${toolNames.join(', ')}] -> ${segments.length} trailing segment(s) via prose gateway`,
@@ -5852,6 +6417,9 @@ export class AgentFramework {
                   `[routing] ${agent.name}: tool-call turn [${toolNames.join(', ') || 'none'}] -> trailing prose NOT routed ` +
                   `(${silenced ? 'silencing tool / explicit send' : 'no trailing prose'})`,
                 );
+                if (silenced && segments.length > 0) {
+                  this.recordProseSuppression(agent.name, segments.length);
+                }
               } else {
                 // Reuse the locus pinned at the turn's first live-routed
                 // segment (or resolve it now for a turn whose only prose is
@@ -5867,7 +6435,8 @@ export class AgentFramework {
                 // Deliver sequentially (await each) so the segments land in order.
                 for (const seg of segments) {
                   try {
-                    await this.channelRegistry.routeSpeech(agent.name, seg, locus);
+                    const outcome = await this.channelRegistry.routeSpeech(agent.name, seg, locus);
+                    this.recordProseDelivery(agent.name, outcome);
                   } catch (err) {
                     console.error('speech routing failed:', err);
                   }
@@ -5878,6 +6447,15 @@ export class AgentFramework {
             // BEFORE dispatchSpeech. Locus routing is speech dispatch and
             // doesn't depend on the status field, so it correctly runs after.
 
+            // Logical turn end (normal completion): drop the `[delivered]`
+            // receipt. All deliveries are settled — the live chain was
+            // awaited before trailing dispatch, and trailing/text-only
+            // segments were awaited in-loop. Locus mode only; explicit-mode
+            // envelopes acknowledge themselves through the prose gateway.
+            if (agent.proseRouting !== 'explicit') {
+              this.appendProseDeliveryReceipt(agent);
+            }
+
             // Explicit-prose `!` continuation: a prose segment this turn asked
             // to keep going (`>>#x !` / `>>private !`) — start another turn
             // now instead of pausing until the next external event. This gives
@@ -5958,9 +6536,26 @@ export class AgentFramework {
             // reset, no settle, no spurious inference:exhausted (which would
             // reject an ephemeral's promise mid-run and bump the failure
             // streak). Gate release + stream teardown happen in `finally`.
-            if (this.frameworkCancelledStreams.delete(`${agent.name}:${myStreamId}`)) {
-              this.eventGate?.onInferenceEnded(agent.name);
-              return;
+            {
+              const cancelKey = `${agent.name}:${myStreamId}`;
+              const cancelKind = this.frameworkCancelledStreams.get(cancelKey);
+              if (cancelKind !== undefined) {
+                this.frameworkCancelledStreams.delete(cancelKey);
+                lifecyclePhase = 'aborted'; // §10.5 — terminal emitted in finally
+                this.eventGate?.onInferenceEnded(agent.name);
+                // endTurn IS a logical turn end — earlier rounds may have
+                // live-routed prose (narrate → skip_reply is a real shape),
+                // so settle the delivery chain and drop the receipt. A
+                // budget restart continues the same logical turn: the
+                // deliveries map persists (cleared only at fresh turn
+                // start) and the continuation stream's end writes ONE
+                // receipt for the whole turn.
+                if (cancelKind === 'turn_ended' && agent.proseRouting !== 'explicit') {
+                  await turnSpeechChain;
+                  this.appendProseDeliveryReceipt(agent);
+                }
+                return;
+              }
             }
             const reason = event.reason ?? 'unknown';
             // Only reset if this is still the active stream (a budget restart
@@ -6001,6 +6596,11 @@ export class AgentFramework {
 
           case 'usage': {
             agent.lastStreamInputTokens = event.usage.inputTokens;
+            agent.lastStreamRealInputTokens =
+              (event.usage.inputTokens ?? 0) +
+              (event.usage.cacheCreationTokens ?? 0) +
+              (event.usage.cacheReadTokens ?? 0);
+            agent.lastStreamOutputTokens = event.usage.outputTokens ?? 0;
 
             // Closed-loop estimator calibration (2026-07-12). Sample the REAL
             // prefix size of THIS API call (fresh + cache write + cache read)
@@ -6073,9 +6673,21 @@ export class AgentFramework {
         durationMs,
       });
       this.abortAgentScript(agent.name, 'stream threw');
+      lifecyclePhase = 'failed'; // §10.5 — terminal emitted in finally
       agent.reset();
       this.eventGate?.onInferenceEnded(agent.name);
     } finally {
+      // §10.5: exactly one terminal per `started`, on every exit path the
+      // host controls. Which one was decided by the path taken (default
+      // completed; catch → failed; framework-cancel → aborted). A host
+      // crash emits nothing — that is the documented best-effort limit, and
+      // why consumers keep their safety timeout.
+      this.hookOrchestrator?.emitLifecycle({
+        inferenceId: outgoingInferenceId,
+        conversationId: agent.name,
+        turnIndex: 0,
+        phase: lifecyclePhase,
+      });
       // Clear the gate's inference flag on EVERY exit path (paired with the
       // onInferenceStarted in startAgentStream). The branch-level calls above
       // are kept but are best-effort; if any exit path bypassed them the agent
@@ -6527,8 +7139,12 @@ export class AgentFramework {
       ? 'null'
       : JSON.stringify(payload, null, 1) ?? String(payload);
     const agent = this.agents.get(record.agentName);
-    const maxChars = agent ? this.getMaxToolResultChars(agent) : undefined;
-    const payloadText = await this.spillOrTruncate(
+    // Same resolved cap as tool results (override applies here too); an
+    // unknown agent still gets the bounded house default, never unbounded.
+    const maxChars = agent
+      ? this.resolveToolResultInlineCap(agent).cap
+      : DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS;
+    const { text: payloadText } = await this.spillOrTruncate(
       payloadJson, maxChars, `${record.id}-wake${record.wakes}`,
     );
 
@@ -6610,45 +7226,104 @@ export class AgentFramework {
   }
 
   /**
-   * Oversized content policy (antra, 2026-07-31): never hit the agent in
-   * the face with a huge blob, never silently destroy it either. Content
-   * over the inline cap is materialized to a workspace file (readable with
-   * the agent's own tools) and replaced by a truncated head + a trailing
-   * file reference. Falls back to plain truncation when there is no
-   * writable workspace. The cap can be lifted temporarily via
-   * agent_settings `tool_result_inline_max_chars`.
+   * Oversized content policy (antra, 2026-07-31; completed for issue #89):
+   * never hit the agent in the face with a huge blob, never silently destroy
+   * it either. Content over the inline cap is materialized to a workspace
+   * file (readable with the agent's own tools — deterministic name, kept
+   * until the workspace owner deletes it) and replaced by a truncated head +
+   * a trailing file reference. Falls back to EXPLICIT plain truncation when
+   * there is no writable workspace. Cap resolution lives in
+   * resolveToolResultInlineCap; callers pass the resolved cap.
+   */
+  /**
+   * One spill policy for every stored tool_result block: serialize (history
+   * serializer — image blocks become placeholders), then spill/truncate at
+   * the resolved cap. Errors follow the same policy as successes — a giant
+   * error string is exactly as context-hostile as a giant success (issue
+   * #89). Returns the stored blocks plus the per-call spill outcomes so the
+   * live wire copy can reuse the identical strings.
    */
+  private async buildStoredToolResultContent(
+    toolResults: CompletedToolCall[],
+    maxChars: number | undefined,
+  ): Promise<{
+    blocks: ContentBlock[];
+    spilled: Map<string, { text: string; filePath: string | null }>;
+  }> {
+    const spilled = new Map<string, { text: string; filePath: string | null }>();
+    const dateLabel = new Date().toISOString().slice(0, 10);
+    for (const tc of toolResults) {
+      const raw = tc.result.isError
+        ? tc.result.error ?? 'Unknown error'
+        : toolResultDataToHistoryString(tc.result.data, undefined);
+      spilled.set(tc.id, await this.spillOrTruncate(raw, maxChars, `${dateLabel}-${tc.id}`));
+    }
+    const blocks: ContentBlock[] = toolResults.map(tc => ({
+      type: 'tool_result' as const,
+      toolUseId: tc.id,
+      // Persisted so XML replay can reconstruct the legacy <tool_name>
+      // element byte-identically to the live injection.
+      toolName: tc.name,
+      content: spilled.get(tc.id)!.text,
+      isError: tc.result.isError,
+    }));
+    return { blocks, spilled };
+  }
+
   private async spillOrTruncate(
     content: string,
-    maxChars: number | undefined,
+    cap: number | undefined,
     label: string,
-    agentName?: string,
-  ): Promise<string> {
-    const override = agentName !== undefined
-      ? this.toolResultInlineMaxCharsOverride.get(agentName)
-      : undefined;
-    const cap = override ?? maxChars;
-    if (!cap || content.length <= cap) return content;
+  ): Promise<{ text: string; filePath: string | null }> {
+    if (!cap || content.length <= cap) return { text: content, filePath: null };
 
     const workspace = this.getWorkspaceModule();
     const mountName = workspace ? this.firstWritableMountName(workspace) : null;
     if (workspace && mountName) {
       const safeLabel = label.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80);
       const path = `${mountName}/tool-results/${safeLabel}.txt`;
+      let failure: string;
       try {
         const result = await workspace.writeBinary(path, Buffer.from(content, 'utf8'), 'text/plain');
         if (result.success) {
-          return safeSlice(content, 0, cap)
-            + `\n\n[truncated — showing ${cap} of ${content.length} chars; full content: workspace file ${path}. `
-            + 'Read/grep it with your file tools, or raise the inline cap temporarily via '
-            + 'agent_settings update tool_result_inline_max_chars.]';
+          return {
+            text: safeSlice(content, 0, cap)
+              + `\n\n[truncated — showing ${cap} of ${content.length} chars; full content: workspace file ${path}. `
+              + 'Read/grep it with your file tools, or raise the inline cap via '
+              + 'agent_settings update tool_result_inline_max_chars.]',
+            filePath: path,
+          };
         }
-      } catch {
-        // fall through to plain truncation
+        failure = result.error ?? 'write refused';
+      } catch (err) {
+        failure = err instanceof Error ? err.message : String(err);
       }
+      // A workspace was there and the write FAILED — say that, loudly and
+      // distinctly. Telling the agent "no writable workspace" would teach
+      // them their residence lacks a capability it actually has.
+      failure = failure.slice(0, 200);
+      this.emitTrace({
+        type: 'tool:spill_failed',
+        label: safeLabel,
+        path,
+        contentLength: content.length,
+        error: failure,
+      });
+      console.error(
+        `[spill] workspace write failed for ${path} (${content.length} chars): ${failure}`,
+      );
+      return {
+        text: safeSlice(content, 0, cap)
+          + `\n\n[truncated — showing ${cap} of ${content.length} chars; spill to workspace file ${path} FAILED`
+          + ` (${failure}); content over the cap was not retained]`,
+        filePath: null,
+      };
     }
-    return safeSlice(content, 0, cap)
-      + '\n\n[truncated — original was ' + content.length + ' chars]';
+    return {
+      text: safeSlice(content, 0, cap)
+        + '\n\n[truncated — original was ' + content.length + ' chars; no writable workspace, full content not retained]',
+      filePath: null,
+    };
   }
 
   private getOrCreateScriptRunner(agentName: string): PyRunner {
@@ -6759,23 +7434,30 @@ export class AgentFramework {
     callId: string,
     afResult: ToolResult,
     maxChars?: number,
-    /** Pre-spilled string from the history path — used for the non-image
+    /** Pre-spilled outcome from the history path — used for the non-image
      *  path so the live wire copy byte-matches what the window stored. */
-    precomputed?: string,
+    precomputed?: { text: string; filePath: string | null },
   ): MembraneToolResult {
     if (afResult.isError) {
-      return { toolUseId: callId, content: afResult.error ?? 'Unknown error', isError: true };
+      // Same spill policy as successes: reuse the history copy so a giant
+      // error string stays bounded on the wire too (byte-matched).
+      return {
+        toolUseId: callId,
+        content: precomputed?.text ?? truncateForHistory(
+          afResult.error ?? 'Unknown error', DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS),
+        isError: true,
+      };
     }
     // MCPL tool results arrive as `data: McpToolResultContent[]` — preserve image
     // blocks natively rather than JSON-stringifying them away. Anything else
     // (objects, scalars) falls through to JSON. The error path was handled
     // above, so isError is always false on these return paths.
-    const blocks = this.tryNativeToolResultContent(afResult.data, maxChars);
+    const blocks = this.tryNativeToolResultContent(afResult.data, maxChars, precomputed?.filePath ?? null);
     if (blocks) {
       return { toolUseId: callId, content: blocks, isError: false };
     }
     if (precomputed !== undefined) {
-      return { toolUseId: callId, content: precomputed, isError: false };
+      return { toolUseId: callId, content: precomputed.text, isError: false };
     }
     // JSON.stringify returns the VALUE undefined (not a string) for undefined
     // input — a module tool returning `{ success: true }` with no data would
@@ -6795,7 +7477,13 @@ export class AgentFramework {
    * `maxChars`, when provided, caps each accompanying text block so an image
    * inlined alongside an enormous text payload can't blow the context.
    */
-  private tryNativeToolResultContent(data: unknown, maxChars?: number): ToolResultContentBlock[] | null {
+  private tryNativeToolResultContent(
+    data: unknown,
+    maxChars?: number,
+    /** Spill file written by the history path — referenced from truncation
+     *  notices so an image-adjacent giant text block stays recoverable. */
+    spillPath: string | null = null,
+  ): ToolResultContentBlock[] | null {
     if (!Array.isArray(data)) return null;
     let hasImage = false;
     const blocks: ToolResultContentBlock[] = [];
@@ -6806,7 +7494,9 @@ export class AgentFramework {
         let text = b.text;
         if (maxChars && text.length > maxChars) {
           text = safeSlice(text, 0, maxChars)
-            + '\n\n[truncated — original was ' + text.length + ' chars]';
+            + '\n\n[truncated — original was ' + text.length + ' chars'
+            + (spillPath ? `; full serialized result: workspace file ${spillPath}` : '')
+            + ']';
         }
         blocks.push({ type: 'text', text });
       } else if (b.type === 'image' && typeof b.data === 'string' && typeof b.mimeType === 'string') {
@@ -6822,13 +7512,45 @@ export class AgentFramework {
     return hasImage ? blocks : null;
   }
 
-  private getMaxToolResultChars(agent: Agent): number | undefined {
+  /** Strategy-derived per-message bound (maxMessageTokens * 4 chars). */
+  private strategyDerivedToolResultChars(agent: Agent): number | undefined {
     const strategy = agent.getContextManager().getStrategy();
     const maxTokens = strategy.maxMessageTokens;
     if (maxTokens && maxTokens > 0) return maxTokens * 4;
     return undefined;
   }
 
+  /**
+   * Effective tool-result inline cap for an agent, with provenance. Desired
+   * value: resident's durable agent_settings value → residence
+   * FrameworkConfig.toolResultInlineMaxChars → house default (24000).
+   * Effective value: min(desired, strategy bound) for EVERY source — the
+   * strategy's per-message safety limit is a ceiling, not a suggestion
+   * (Sol's #94 ruling: a durable preference must not be a durable path for
+   * one tool result to exceed maxMessageTokens; the way to see the whole
+   * result is the spill file, not an over-bound blob in live context).
+   */
+  private resolveToolResultInlineCap(agent: Agent): {
+    cap: number;
+    source: 'agent-settings-override' | 'framework-config' | 'default';
+    /** Set when the desired value was reduced to the strategy bound. */
+    clampedBy: 'strategy-bound' | null;
+  } {
+    const override = this.toolResultInlineMaxCharsOverride.get(agent.name);
+    const configured = this.toolResultInlineMaxCharsConfig;
+    const desired = override ?? configured ?? DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS;
+    const source = override !== undefined
+      ? 'agent-settings-override' as const
+      : configured !== null ? 'framework-config' as const : 'default' as const;
+    const strategyBound = this.strategyDerivedToolResultChars(agent);
+    const clamped = strategyBound !== undefined && strategyBound < desired;
+    return {
+      cap: clamped ? strategyBound : desired,
+      source,
+      clampedBy: clamped ? 'strategy-bound' : null,
+    };
+  }
+
   private approximateDecodedBase64Bytes(base64: string): number {
     const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
     return Math.max(0, Math.floor(base64.length * 3 / 4) - padding);
@@ -7005,6 +7727,25 @@ export class AgentFramework {
     // synthesized channel tools, but they aren't `channel_`-prefixed so they
     // need an explicit route here.
     if ((enrichedCall.name === 'think' || enrichedCall.name === 'skip_reply') && this.channelRegistry) {
+      // skip_reply(wake_in_seconds): arm a gate self-wake so "not replying
+      // NOW" can also mean "back in a moment" — ends the turn, then wakes
+      // the agent after N seconds unless something else wakes it first
+      // (any turn start cancels the pending self-wake). Armed here because
+      // the framework owns the EventGate; the registry only words the
+      // confirmation. Without a gate the field is stripped so that
+      // confirmation never claims a wake that can't happen.
+      if (enrichedCall.name === 'skip_reply') {
+        const inputObj = (enrichedCall.input ?? {}) as Record<string, unknown>;
+        const secs = Number(inputObj.wake_in_seconds);
+        const wants = inputObj.wake_in_seconds !== undefined && Number.isFinite(secs) && secs > 0;
+        if (wants && this.eventGate) {
+          const { inMs } = this.eventGate.armSelfWake(agentName, secs, 'skip_reply');
+          console.error(`[self-wake] agent=${agentName} armed in ${Math.round(inMs / 1000)}s (skip_reply)`);
+        } else if (inputObj.wake_in_seconds !== undefined && !this.eventGate) {
+          delete inputObj.wake_in_seconds;
+          console.error(`[self-wake] agent=${agentName} wake_in_seconds requested but no EventGate — ignored`);
+        }
+      }
       this.dispatchChannelToolCall(agentName, enrichedCall);
       return;
     }
@@ -7632,7 +8373,6 @@ export class AgentFramework {
   ): Promise<void> {
     this.mcplServerRegistry = new McplServerRegistry();
     this.featureSetManager = new FeatureSetManager();
-    this.scopeManager = new ScopeManager();
     this.hookOrchestrator = new HookOrchestrator(this.mcplServerRegistry, this.featureSetManager);
 
     // Build prefix map and store configs for tool routing
@@ -7750,15 +8490,35 @@ export class AgentFramework {
 
     // Host capabilities advertised during the MCP handshake — stored so
     // servers can also be connected later at runtime (connectMcplServer).
+    // §5.2: the host advertises what it actually implements. 0.5.0-draft:
+    // afterInference is GONE (replaced by inference/lifecycle, §10.5), and
+    // the previously under-advertised inferenceRequest + channels — both
+    // implemented for years — are declared (AUDIT-001/issue #76 item 12).
     this.mcplHostCapabilities = {
-      version: '0.4',
+      version: '0.5',
       pushEvents: true,
       contextHooks: {
         beforeInference: true,
-        afterInference: { blocking: true },
+      },
+      inferenceLifecycle: true,
+      // modelInfo is NOT advertised: §12.2's result requires all four of
+      // {id, vendor, contextWindow, capabilities} and the host has no
+      // truthful source for contextWindow/capabilities (grep: none exists).
+      // Advertising a capability answered with a malformed partial response
+      // is worse than honest unsupported (Sol, PR #79 re-review). The
+      // handler below answers an explicit error rather than hanging (§6.6).
+      inferenceRequest: { streaming: true },
+      channels: {
+        register: true,
+        lifecycle: true,
+        publish: true,
+        incoming: true,
+        streaming: true,
+        acknowledge: true,
+        typing: true,
       },
       featureSets: true,
-    };
+    } as McplHostCapabilities;
 
     for (const config of serverConfigs) {
       try {
@@ -8171,30 +8931,228 @@ export class AgentFramework {
     // releases control traffic needed for registration and marker service.
     this.wireMcplEvents(connection);
 
-    // Initialize feature sets if server advertises MCPL capabilities
-    this.registerMcplServerFeatures(config, connection);
-
     if (deferAwareness) {
+      // Staged startup: both planes are closed, so the §5.3 policy
+      // round-trip cannot let any buffered traffic slip — establish the
+      // grant now, before staging ever releases.
+      await this.registerMcplServerFeatures(config, connection);
       this.emitTrace({ type: 'module:added', moduleName: `mcpl:${config.id}` });
       return;
     }
 
     const awarenessBarrier = this.installMcplDataPlaneGate();
-    this.releaseMcplDataPlaneGate(awarenessBarrier);
+    // NO early release: both planes stay closed through accounting AND the
+    // §5.3 policy round-trip below (PR #79 review blocker 3 — the early
+    // control flush released channels-register/changed before any grant
+    // existed). The awareness drain rides tools/call RESPONSES, which are
+    // never event-buffered, so it needs no plane release to make progress.
     try {
       await awarenessBarrier.promise;
-      this.completeMcplDataPlaneGate(awarenessBarrier);
     } catch (error) {
       // Startup cannot fail open on a broken awareness ledger. Disable the
       // reconnecting stub/connection before propagating the distinct error to
       // initializeMcpl, which tears down any other servers and aborts create().
+      // Ordering matters: awareness accounting settles BEFORE the §5.3
+      // policy round-trip below, so an accounting failure aborts with the
+      // grant still empty and every buffered event still behind the gate —
+      // a failed startup never reports a released data plane. (The reverse
+      // order let a push arrive during the policy await and get flushed by
+      // teardown.)
       await connection.close().catch(() => {});
       throw error;
     }
 
+    // §5.3 initial policy handshake — after accounting, before the gate
+    // completes: the grant is established (or knowingly left empty) before
+    // ANY buffered traffic (control or data) flows. complete() then
+    // ready()s both planes through the admission gate.
+    await this.registerMcplServerFeatures(config, connection);
+    this.completeMcplDataPlaneGate(awarenessBarrier);
+
     this.emitTrace({ type: 'module:added', moduleName: `mcpl:${config.id}` });
   }
 
+  /** Per-connection §17.8 fetch limiter: at most one in-flight fetch, at
+   *  most one queued behind it (announcements coalesce), floor between
+   *  completed fetches. Exceeding the floor drops the excess with a
+   *  diagnostic — the host bounds the rate; it never depends on server
+   *  coalescing. */
+  private manifestRefreshState: Map<string, { inFlight: boolean; queued: boolean; lastCompletedAt: number }> = new Map();
+  private static readonly MANIFEST_FETCH_FLOOR_MS = 5_000;
+
+  /**
+   * §17.5 host processing: fetch the complete manifest, validate exactly as
+   * at initialize, diff, apply §6.7 consequences (removals eagerly even
+   * when other declarations are invalid; additions only through
+   * tell→receipt→activate), emit ONE change receipt (§17.6).
+   */
+  private async handleManifestChanged(
+    connection: McplServerConnection,
+    announce: { revision?: string; domains?: string[] },
+  ): Promise<void> {
+    const st = this.manifestRefreshState.get(connection.id)
+      ?? { inFlight: false, queued: false, lastCompletedAt: 0 };
+    this.manifestRefreshState.set(connection.id, st);
+    if (st.inFlight) {
+      // Coalesce: one queued refresh re-runs after the current fetch — the
+      // fetch is always of the CURRENT manifest, so N announcements need at
+      // most one trailing fetch (§17.8).
+      st.queued = true;
+      return;
+    }
+    const sinceLast = Date.now() - st.lastCompletedAt;
+    if (sinceLast < AgentFramework.MANIFEST_FETCH_FLOOR_MS) {
+      if (!st.queued) {
+        st.queued = true;
+        setTimeout(() => {
+          const cur = this.manifestRefreshState.get(connection.id);
+          if (cur?.queued && !cur.inFlight) {
+            cur.queued = false;
+            void this.handleManifestChanged(connection, announce).catch(() => {});
+          }
+        }, AgentFramework.MANIFEST_FETCH_FLOOR_MS - sinceLast).unref?.();
+      }
+      return;
+    }
+
+    st.inFlight = true;
+    try {
+      const config = this.mcplServerConfigs.get(connection.id);
+      if (!config) return;
+
+      // §17.4 fetch. A server that cannot answer keeps its previous
+      // manifest in force — an unparseable/failed fetch teaches nothing and
+      // narrows nothing (§17.5 step 1).
+      let fetched: import('./mcpl/types.js').McplCapabilities | null;
+      try {
+        fetched = await connection.sendManifestRequest();
+      } catch (err) {
+        console.error(`[mcpl] ${connection.id}: mcpl/manifest fetch failed — previous manifest stands (§17.5): ${err instanceof Error ? err.message : err}`);
+        return;
+      }
+      if (!fetched || typeof fetched !== 'object') {
+        console.error(`[mcpl] ${connection.id}: mcpl/manifest returned no object — previous manifest stands (§17.5)`);
+        return;
+      }
+
+      // Validate exactly as at initialize: expand §5.1 shorthand, apply the
+      // config mask, recompute the grant. Unknown names mint nothing;
+      // invalid declarations fail closed in derivation — and REMOVALS still
+      // apply, because the new grant/derivation simply lacks whatever no
+      // longer validates (§17.5 step 1's partial-invalid rule falls out of
+      // computing forward from the fetched content).
+      const expanded = expandAdvertisementShorthand(fetched);
+      const { capabilities: masked, dropped } = maskNegotiatedCapabilities(expanded, config);
+      const newGrant = computeGrant(masked, config, { mcpToolsAdvertised: connection.mcpToolsAdvertised });
+
+      const oldEffective = new Set(connection.grant.effectiveList());
+      const newEffective = new Set(newGrant.effectiveList());
+      const revoked = [...oldEffective].filter((p) => !newEffective.has(p)).sort();
+      const added = [...newEffective].filter((p) => !oldEffective.has(p)).sort();
+
+      const oldDeclared = Object.keys(this.featureSetManager?.getDeclaredFeatureSets(connection.id) ?? {});
+      const oldEnabled = oldDeclared.filter((n) => this.featureSetManager?.isEnabled(connection.id, n));
+
+      // §6.7 REDUCTION FIRST, atomically, before the server is told:
+      // security cannot wait on consent. The interim grant is new∩old — no
+      // revoked path survives, no added path activates yet.
+      const hadReduction = revoked.length > 0;
+      if (hadReduction) {
+        const interim = new CapabilityGrant(
+          new Set([...newEffective].filter((p) => oldEffective.has(p))),
+          [...newGrant.deniedPaths],
+        );
+        connection.establishGrant(interim);
+      }
+
+      // PHASE 1 — pre-receipt: live feature state derives from ACTIVE
+      // authority (the interim grant when reduced, the standing grant
+      // otherwise), never from the unactivated full grant. Feature state
+      // must obey the same §6.7 ordering the grant does: a newly added
+      // capability-backed feature set cannot be host-enabled while its
+      // capability is still absent from the active grant (Sol, PR #84
+      // review). Declarations come from the fetched manifest either way —
+      // a set absent from the new manifest is gone regardless.
+      const cfg = { enabledFeatureSets: config.enabledFeatureSets, disabledFeatureSets: config.disabledFeatureSets };
+      const maskedOrEmpty = masked ?? ({ version: '0.5' } as import('./mcpl/types.js').McplCapabilities);
+      this.featureSetManager!.initializeServer(connection.id, maskedOrEmpty, cfg, connection.grant);
+
+      // The Request DESCRIBES the proposed new policy — derived from the
+      // full new grant on a scratch manager, installing nothing.
+      const updateParams = new FeatureSetManager().initializeServer(connection.id, maskedOrEmpty, cfg, newGrant);
+      updateParams.effectiveCapabilities = newGrant.effectiveList();
+      if (newGrant.deniedPaths.length > 0) updateParams.deniedCapabilities = [...newGrant.deniedPaths];
+
+      // Tell → receipt → activate (§6.7). PHASE 2 by outcome:
+      //  accepted  → full grant + full-derived feature state;
+      //  refused   → honor fallback: 'close' closes the transport;
+      //              'mcp-only' (or absent) = empty grant + empty-derived
+      //              feature state, mirroring the §5.3 initial path;
+      //  unanswered → interim grant and interim-derived state stand.
+      let negotiated = false;
+      try {
+        const receipt = await connection.sendFeatureSetsUpdateRequest(updateParams);
+        if (receipt && receipt.accepted === false) {
+          const fallback = receipt.fallback ?? 'mcp-only';
+          console.error(`[mcpl] ${connection.id} refused post-manifest policy — fallback: ${fallback}`);
+          if (fallback === 'close') {
+            await connection.close();
+            return;
+          }
+          connection.establishGrant(CapabilityGrant.empty());
+          this.featureSetManager!.initializeServer(connection.id, maskedOrEmpty, cfg, CapabilityGrant.empty());
+        } else {
+          connection.establishGrant(newGrant);
+          this.featureSetManager!.initializeServer(connection.id, maskedOrEmpty, cfg, newGrant);
+          connection.manifestState.lastNegotiatedAt = Date.now();
+          negotiated = true;
+        }
+      } catch {
+        console.error(`[mcpl] ${connection.id} did not answer post-manifest policy — expansion does not activate (§6.7); interim state stands`);
+      }
+
+      // Adopt the validated manifest + tracking. droppedCapabilities is
+      // REPLACED unconditionally — an empty new mask must clear stale paths
+      // (Sol, PR #84 review).
+      connection.capabilities = masked;
+      connection.manifestState.lastValidatedRevision =
+        typeof (fetched as { revision?: unknown }).revision === 'string'
+          ? (fetched as { revision: string }).revision : null;
+      connection.manifestState.lastFetchedAt = Date.now();
+      connection.droppedCapabilities = new Set(dropped);
+
+      const newDeclared = Object.keys(this.featureSetManager?.getDeclaredFeatureSets(connection.id) ?? {});
+      const newEnabled = newDeclared.filter((n) => this.featureSetManager?.isEnabled(connection.id, n));
+      const degraded = oldEnabled.filter((n) => !newEnabled.includes(n)).sort();
+      const restored = newEnabled.filter((n) => !oldEnabled.includes(n)).sort();
+
+      // §17.6: ONE receipt per manifest change, closed host-derived impact
+      // vocabulary, never a server-authored flag.
+      const impacts: Array<{ impact: string; subject: string; disposition: string }> = [
+        ...revoked.map((p) => ({ impact: 'capability-revoked', subject: p, disposition: 'applied' })),
+        ...added.map((p) => ({ impact: 'capability-expansion-pending', subject: p, disposition: negotiated ? 'applied' : 'decision-needed' })),
+        ...degraded.map((n) => ({ impact: 'feature-degraded', subject: n, disposition: 'applied' })),
+        ...restored.map((n) => ({ impact: 'feature-restored', subject: n, disposition: negotiated ? 'applied' : 'decision-needed' })),
+      ];
+      this.emitTrace({
+        type: 'mcpl:manifest-change-receipt',
+        serverId: connection.id,
+        revision: connection.manifestState.lastValidatedRevision,
+        announcedDomains: announce.domains ?? [],
+        impacts,
+      });
+      this.handleToolsListChanged(connection.id);
+    } finally {
+      st.inFlight = false;
+      st.lastCompletedAt = Date.now();
+      if (st.queued) {
+        st.queued = false;
+        setTimeout(() => { void this.handleManifestChanged(connection, announce).catch(() => {}); },
+          AgentFramework.MANIFEST_FETCH_FLOOR_MS).unref?.();
+      }
+    }
+  }
+
   /**
    * (Re-)establish a server's host-side MCPL registration: feature-set state
    * (plus the featureSets/update sent to the server), scope patterns, and
@@ -8210,12 +9168,18 @@ export class AgentFramework {
    * already has a tree), so checkpoint trees preserved across a transient
    * disconnect are resumed, not reset.
    */
-  private registerMcplServerFeatures(
+  private async registerMcplServerFeatures(
     config: import('./mcpl/types.js').McplServerConfig,
     connection: McplServerConnection,
-  ): void {
+  ): Promise<void> {
     if (!connection.capabilities) return;
 
+    // §5.4: compute the effective grant from the (config-masked)
+    // advertisement. Not yet active — expansion activates only after the
+    // receipt (§6.7); until then the connection's grant is empty and every
+    // privileged inbound method is rejected.
+    const grant = computeGrant(connection.capabilities, config, { mcpToolsAdvertised: connection.mcpToolsAdvertised });
+
     const updateParams = this.featureSetManager!.initializeServer(
       config.id,
       connection.capabilities,
@@ -8223,16 +9187,60 @@ export class AgentFramework {
         enabledFeatureSets: config.enabledFeatureSets,
         disabledFeatureSets: config.disabledFeatureSets,
       },
+      grant,
     );
 
-    // Inform server which feature sets are enabled/disabled
-    if (updateParams.enabled?.length || updateParams.disabled?.length) {
-      connection.sendFeatureSetsUpdate(updateParams);
+    // §5.3: initial policy MUST be a Request, MUST precede first fan-out,
+    // and MUST be sent even when nothing is enabled or disabled — a server
+    // defaulted to fully disabled has to be told. The response is a
+    // degradation receipt (§6.7): consequence testimony, never policy
+    // authority — nothing in it may widen the grant.
+    updateParams.effectiveCapabilities = grant.effectiveList();
+    if (grant.deniedPaths.length > 0) {
+      updateParams.deniedCapabilities = [...grant.deniedPaths];
+    }
+
+    try {
+      const receipt = await connection.sendFeatureSetsUpdateRequest(updateParams);
+      if (receipt && receipt.accepted === false) {
+        const fallback = receipt.fallback ?? 'mcp-only';
+        console.error(
+          `[mcpl] ${config.id} refused initial policy (${receipt.reason ?? 'no reason'}) — fallback: ${fallback}`,
+        );
+        if (fallback === 'close') {
+          await connection.close();
+          return;
+        }
+        // mcp-only (§3.2): grant stays empty, MCPL privileged surface stays
+        // dark, plain MCP tools keep working. MUST NOT widen in response to
+        // the refusal — a human can change config; the policy engine cannot.
+        return;
+      }
+      // Expansion activates on receipt (§6.7).
+      connection.establishGrant(grant);
+      if (receipt?.accepted === true && receipt.mode === 'degraded') {
+        for (const uf of receipt.unavailableFeatures ?? []) {
+          console.error(
+            `[mcpl] ${config.id} degraded: ${uf.featureSet} (${uf.effect}; missing ${uf.missingCapabilities.join(', ')})`,
+          );
+        }
+      }
+    } catch (err) {
+      // A pre-0.5 server treats the Request as a notification and never
+      // answers. §6.7: an unanswered expansion simply does not activate —
+      // grant stays empty, connection is effectively MCP-only. This WILL
+      // dark every un-migrated MCPL server's privileged surface; accepted
+      // deliberately for the single-release rollout (issue #76 item 9).
+      console.error(
+        `[mcpl] ${config.id} did not answer the initial policy Request — ` +
+          `MCPL privileged surface stays disabled (§6.7 unanswered expansion): ` +
+          (err instanceof Error ? err.message : String(err)),
+      );
+      return;
     }
 
-    // Configure scope whitelist/blacklist patterns
     if (config.scopes) {
-      this.scopeManager!.configureAll(config.scopes);
+      console.error(`[mcpl] ${config.id}: config \`scopes\` is ignored — §7 Scoped Access removed in 0.5.0`);
     }
 
     // Register stateful feature sets with checkpoint manager (Step 8)
@@ -8348,23 +9356,62 @@ export class AgentFramework {
   listMcplServers(): Array<{
     id: string;
     connected: boolean;
+    retrying: boolean;
     toolPrefix: string;
     toolCount: number;
+    /** True only after the §5.3 policy receipt activated the grant. */
+    policyEstablished: boolean;
+    /** Sole normative authorization allowlist for the connection (§5.4). */
+    effectiveGrant: string[];
+    /** Advertised paths removed by host enabled/disabled capability config. */
+    maskedCapabilities: string[];
+    /** Advertised paths removed by a host deny-by-default rule (§13.4). */
+    deniedCapabilities: string[];
+    /** Host-owned authority; deliberately separate from the portable grant. */
+    allowHostCommands: boolean;
+    /**
+     * Per-transport §17 facts about the last manifest this host fetched and
+     * acted on. The revision is server-authored and equality-only; these are
+     * not the server's manifestChanged announcements.
+     */
+    manifestState: {
+      lastValidatedRevision: string | null;
+      lastFetchedAt: number | null;
+      lastNegotiatedAt: number | null;
+    };
     command?: string;
     url?: string;
   }> {
     const result: Array<{
-      id: string; connected: boolean; toolPrefix: string; toolCount: number;
+      id: string; connected: boolean; retrying: boolean;
+      toolPrefix: string; toolCount: number; policyEstablished: boolean;
+      effectiveGrant: string[]; maskedCapabilities: string[];
+      deniedCapabilities: string[]; allowHostCommands: boolean;
+      manifestState: {
+        lastValidatedRevision: string | null;
+        lastFetchedAt: number | null;
+        lastNegotiatedAt: number | null;
+      };
       command?: string; url?: string;
     }> = [];
     for (const [id, config] of this.mcplServerConfigs) {
       const prefix = config.toolPrefix ?? `mcpl--${id}`;
       const connection = this.mcplServerRegistry?.getServer(id) ?? null;
+      const connected = connection?.isConnected ?? false;
       result.push({
         id,
-        connected: connection?.isConnected ?? false,
+        connected,
+        retrying: !connected && (connection?.willReconnect ?? false),
         toolPrefix: prefix,
         toolCount: this.mcplTools.filter(t => t.name.startsWith(`${prefix}--`)).length,
+        policyEstablished: connection?.policyEstablished ?? false,
+        effectiveGrant: connection?.grant.effectiveList() ?? [],
+        maskedCapabilities: [...(connection?.droppedCapabilities ?? [])].sort(),
+        deniedCapabilities: [...(connection?.grant.deniedPaths ?? [])].sort(),
+        allowHostCommands: config.allowHostCommands === true,
+        manifestState: connection
+          ? { ...connection.manifestState }
+          : { lastValidatedRevision: null, lastFetchedAt: null, lastNegotiatedAt: null },
         command: config.command,
         url: config.url,
       });
@@ -8383,26 +9430,15 @@ export class AgentFramework {
       this.emitTrace({ type: 'mcpl:server-stderr', serverId: connection.id, line: params.line });
     });
 
-    // Handle dynamic feature set changes from server
-    connection.on('feature-sets-changed', (params: FeatureSetsChangedParams) => {
-      this.featureSetManager?.handleFeatureSetsChanged(connection.id, params);
-    });
+    // featureSets/changed is REMOVED in 0.5.0 — the connection answers it
+    // -32601 (superseded by SPEC §17's host-diffed manifest fetch); no
+    // listener, and nothing mutates declarations off a server-authored
+    // change payload.
 
     // Handle scope elevation requests
-    connection.on('scope-elevate', async (
-      params: ScopeElevateParams,
-      responder?: { respond: (result: unknown) => void; respondError: (code: number, message: string) => void },
-    ) => {
-      if (this.scopeManager && responder) {
-        try {
-          const result: ScopeElevateResult = await this.scopeManager.handleElevation(params);
-          responder.respond(result);
-        } catch (error) {
-          const err = error instanceof Error ? error : new Error(String(error));
-          responder.respondError(-32603, err.message);
-        }
-      }
-    });
+    // §7 Scoped Access is removed in 0.5.0. scope/elevate is answered
+    // -32601 at the connection (server-connection.ts) and never reaches the
+    // framework; the ScopeManager and config `scopes` wiring went with it.
 
     // Handle push events (Step 6)
     connection.on('push-event', async (
@@ -8438,9 +9474,51 @@ export class AgentFramework {
       await this.channelRegistry?.handleRegister(connection.id, params, responder as never);
     });
 
-    // Handle channel changes (Step 7)
-    connection.on('channels-changed', async (params: ChannelsChangedParams) => {
-      await this.channelRegistry?.handleChanged(connection.id, params);
+    // Handle channel changes (Step 7) — §14.5 dual-mode: the responder is
+    // present for the Request form and carries itemized added-descriptor
+    // results; absent for Notifications, where rejection is itemwise
+    // filtering plus a diagnostic trace.
+    connection.on('channels-changed', async (
+      params: ChannelsChangedParams,
+      responder?: { respond: (result: unknown) => void },
+    ) => {
+      await this.channelRegistry?.handleChanged(connection.id, params, responder as never);
+    });
+
+    // §6.6/§12: requests that previously had no handler and hung forever
+    // (AUDIT-001 item 4). The connection-level grant gate has already run.
+    // §17.3: a manifest-change announcement. Rate-limited re-fetch → diff
+    // → §6.7 consequences → one receipt. The announcement itself carries no
+    // payload and no authority; everything below acts on FETCHED content.
+    connection.on('manifest-changed', (params: { revision?: string; domains?: string[] }) => {
+      void this.handleManifestChanged(connection, params).catch((err) => {
+        console.error(`[mcpl] ${connection.id} manifest refresh failed:`, err instanceof Error ? err.message : err);
+      });
+    });
+
+    connection.on('channels-list', (
+      _params: unknown,
+      responder?: { respond: (result: unknown) => void },
+    ) => {
+      responder?.respond({
+        channels: this.channelRegistry?.descriptorsForServer(connection.id) ?? [],
+      });
+    });
+
+    connection.on('model-info', (
+      _params: unknown,
+      responder?: { respond: (result: unknown) => void; respondError?: (code: number, message: string, data?: unknown) => void },
+    ) => {
+      // §12.2 requires ALL FOUR of {id, vendor, contextWindow, capabilities}
+      // in the DIRECT result shape, and numeric contextWindow cannot express
+      // "unknown". The host has no truthful source for it, so modelInfo is
+      // not advertised and this answers an explicit error instead of a
+      // malformed partial (§6.6: a method that will never be answered
+      // truthfully MUST error, not fabricate).
+      responder?.respondError?.(
+        -32601,
+        'model/info unavailable: host does not advertise modelInfo (no truthful contextWindow source)',
+      );
     });
 
     // Handle incoming channel messages (Step 7)
@@ -8499,19 +9577,25 @@ export class AgentFramework {
       // reconnect observes it before doing work that could wake an agent. The
       // connection paused its data plane before wiring the fresh transport.
       const awarenessBarrier = this.installMcplDataPlaneGate();
-      try {
-        const config = this.mcplServerConfigs.get(connection.id);
-        if (config) {
-          this.registerMcplServerFeatures(config, connection);
+      // Async: the §5.3 policy Request must be answered (re-establishing the
+      // grant) before the data-plane barrier releases — otherwise the first
+      // post-reconnect events land while the grant is still empty and are
+      // rejected fail-closed instead of delivered.
+      void (async () => {
+        try {
+          const config = this.mcplServerConfigs.get(connection.id);
+          if (config) {
+            await this.registerMcplServerFeatures(config, connection);
+          }
+        } catch (error) {
+          console.error(
+            `MCPL server "${connection.id}" re-registration after reconnect failed:`,
+            error instanceof Error ? error.message : error,
+          );
         }
-      } catch (error) {
-        console.error(
-          `MCPL server "${connection.id}" re-registration after reconnect failed:`,
-          error instanceof Error ? error.message : error,
-        );
-      }
-      this.releaseMcplDataPlaneGate(awarenessBarrier);
-      this.handleToolsListChanged(connection.id);
+        this.releaseMcplDataPlaneGate(awarenessBarrier);
+        this.handleToolsListChanged(connection.id);
+      })();
       void awarenessBarrier.promise.then(() => {
         if (
           awarenessBarrier.requiresBarrier
@@ -8626,6 +9710,7 @@ export class AgentFramework {
     if (!this.mcplServerRegistry) return;
 
     const tools: import('./types/index.js').ToolDefinition[] = [];
+    const toolFeatureSets = new Map<string, string>();
 
     for (const server of this.mcplServerRegistry.getAllServers()) {
       const config = this.mcplServerConfigs.get(server.id);
@@ -8634,13 +9719,26 @@ export class AgentFramework {
         const result = await server.sendToolsList();
         for (const tool of result.tools) {
           if (!isToolAllowed(tool.name, config)) continue;
+          const namespacedName = `${prefix}--${tool.name}`;
+          const attributedTool = tool as typeof tool & {
+            featureSet?: unknown;
+            _meta?: { featureSet?: unknown };
+          };
+          const featureSet = typeof attributedTool.featureSet === 'string'
+            ? attributedTool.featureSet
+            : typeof attributedTool._meta?.featureSet === 'string'
+              ? attributedTool._meta.featureSet
+              : undefined;
           // MCP tool schemas are generic JSON Schema; cast to membrane's ToolDefinition format
           const schema = tool.inputSchema as import('./types/index.js').ToolDefinition['inputSchema'];
           tools.push({
-            name: `${prefix}--${tool.name}`,
+            name: namespacedName,
             description: tool.description ?? '',
             inputSchema: schema,
           });
+          if (featureSet !== undefined) {
+            toolFeatureSets.set(namespacedName, featureSet);
+          }
         }
       } catch {
         // Server may not support tools/list — skip silently
@@ -8648,6 +9746,7 @@ export class AgentFramework {
     }
 
     this.mcplTools = tools;
+    this.mcplToolFeatureSets = toolFeatureSets;
   }
 
   /**
@@ -8745,20 +9844,47 @@ export class AgentFramework {
     const args = (call.input && typeof call.input === 'object') ? call.input as Record<string, unknown> : {};
 
     // Build state params for stateful tools (Step 8).
-    // Host-managed state is single-valued per server, so inject the host-managed
-    // set's `state` for any call; otherwise fall back to a server-managed set's
-    // opaque `checkpoint`. Never blindly pick "first stateful" — when a server
-    // mixes host-managed (e.g. a feed) and server-managed (e.g. post/undo) sets,
-    // that misattributes the feed's state.
+    // A tools/list attribution selects that exact stateful set. Untagged tools
+    // retain the host-managed or unique server-managed fallback, but never guess
+    // between multiple server-managed sets.
     let stateParams: { state?: unknown; checkpoint?: string } | undefined;
+    let attributedFeatureSet: string | null = null;
     if (this.checkpointManager) {
-      const hostFs = this.checkpointManager.getHostManagedFeatureSet(serverId);
-      if (hostFs) {
-        stateParams = { state: this.checkpointManager.getCurrentState(serverId, hostFs) };
+      const toolFeatureSet = this.mcplToolFeatureSets.get(call.name);
+      if (toolFeatureSet !== undefined) {
+        if (
+          this.checkpointManager.isHostManaged(serverId, toolFeatureSet)
+          || this.checkpointManager.getStatefulFeatureSet(serverId, toolFeatureSet) !== null
+        ) {
+          attributedFeatureSet = toolFeatureSet;
+        } else {
+          console.warn(
+            `[mcpl] Tool "${call.name}" declares unknown or non-stateful feature set ` +
+            `"${toolFeatureSet}"; skipping state exchange.`,
+          );
+        }
       } else {
-        const fs = this.checkpointManager.getStatefulFeatureSet(serverId);
-        if (fs) {
-          const cp = this.checkpointManager.getCurrentCheckpoint(serverId, fs);
+        attributedFeatureSet = this.checkpointManager.getHostManagedFeatureSet(serverId)
+          ?? this.checkpointManager.getStatefulFeatureSet(serverId);
+        if (
+          attributedFeatureSet === null
+          && this.checkpointManager.hasAmbiguousServerManagedFeatureSets(serverId)
+        ) {
+          console.warn(
+            `[mcpl] Tool "${call.name}" has no feature-set attribution and server ` +
+            `"${serverId}" has multiple server-managed stateful feature sets; ` +
+            'skipping state exchange.',
+          );
+        }
+      }
+
+      if (attributedFeatureSet !== null) {
+        if (this.checkpointManager.isHostManaged(serverId, attributedFeatureSet)) {
+          stateParams = {
+            state: this.checkpointManager.getCurrentState(serverId, attributedFeatureSet),
+          };
+        } else {
+          const cp = this.checkpointManager.getCurrentCheckpoint(serverId, attributedFeatureSet);
           if (cp) stateParams = { checkpoint: cp };
         }
       }
@@ -8770,15 +9896,10 @@ export class AgentFramework {
         this.emitTrace({ type: 'tool:completed', module: `mcpl:${serverId}`, tool: toolName, callId: call.id, durationMs });
 
         // Record checkpoint from stateful tool response (Step 8).
-        // Attribute to the set the server tagged (result.state.featureSet) first;
-        // else the host-managed set (host-managed checkpoints carry data/patch);
-        // else the single stateful set. Avoids recording a feed checkpoint onto a
-        // server-managed set just because it registered first.
+        // Explicit response attribution is authoritative. Otherwise use the
+        // tool-derived (or safe single-set) attribution chosen before the call.
         if (result.state && this.checkpointManager) {
-          const tagged = result.state.featureSet;
-          const fs = tagged
-            ?? this.checkpointManager.getHostManagedFeatureSet(serverId)
-            ?? this.checkpointManager.getStatefulFeatureSet(serverId);
+          const fs = result.state.featureSet ?? attributedFeatureSet;
           if (fs && this.checkpointManager.isStateful(serverId, fs)) {
             this.checkpointManager.recordCheckpoint(serverId, fs, result.state);
           }
@@ -8803,6 +9924,23 @@ export class AgentFramework {
             this.channelRegistry
               .openIfClosedForSend(target, serverId)
               .then(({ status, channelId, label }) => {
+                // Turn-scoped engagement record (mid-turn re-pin, 2026-07-31
+                // n=7): a human follow-up in a channel the agent explicitly
+                // sent into this turn counts as conversationally addressed.
+                // Recorded here — not eagerly — because injection metadata
+                // carries the CANONICAL channel id (descriptor form), while
+                // send args often carry the raw provider id; this callback
+                // has the resolved form. The already-open path resolves on
+                // the microtask queue, i.e. before the tool-result event
+                // that evaluates injections.
+                if (status !== 'unknown-channel' && status !== 'ambiguous') {
+                  let engaged = this.turnEngagedChannels.get(agentName);
+                  if (!engaged) {
+                    engaged = new Set();
+                    this.turnEngagedChannels.set(agentName, engaged);
+                  }
+                  engaged.add(channelId ?? target);
+                }
                 if (status === 'opened') {
                   console.error(
                     `[channel] ${agentName}: explicit ${toolName} into closed channel ${target} — opened (send implies engagement)`,
@@ -8918,17 +10056,40 @@ export class AgentFramework {
         const durationMs = Date.now() - startTime;
         this.emitTrace({ type: 'tool:completed', module: 'channels', tool: call.name, callId: call.id, durationMs });
         // A successful channel_open plants the agent's feet in the opened
-        // channel: pin it as this turn's reply locus so plain-text speech
-        // written right after opening routes THERE. Found live 2026-07-21
-        // (Aria bring-up): open → plain-text reply → "no locus (no
-        // home/active channel, defaultPublishChannel null)" on a turn with
-        // no channel trigger (post-restart continuation). Next turn start
-        // re-resolves the locus as usual (startAgentStream set/delete).
+        // channel. The agent's own deliberate open is the strongest "my next
+        // words go here" signal in the system — stronger than any injection —
+        // so it MOVES the current turn's prose pin (turnLocusPins), not just
+        // the next turn's trigger state. (The original 2026-07-21 Aria fix
+        // set only activeTriggerChannels, which resolveLocus reads at the
+        // NEXT turn's freeze — the turn-frozen refactor had silently
+        // regressed the "reply right after opening" case; found while
+        // mapping the routing logic 2026-07-31, antra-ratified fix.) The
+        // announcement rides THIS TOOL RESULT — model-requested content,
+        // distance zero, the safest role there is — instead of a separate
+        // window notice. lastAnnouncedLocus tracks it so announce-on-change
+        // stays coherent. Locus-mode agents only: explicit mode has no pin.
         if (call.name === 'channel_open' && result?.success) {
           const opened =
             (result.data as { channelId?: string } | undefined)?.channelId
             ?? (call.input as { channelId?: string } | undefined)?.channelId;
-          if (opened) this.activeTriggerChannels.set(agentName, opened);
+          if (opened) {
+            this.activeTriggerChannels.set(agentName, opened);
+            const openerAgent = this.agents.get(agentName);
+            if (openerAgent && openerAgent.proseRouting !== 'explicit') {
+              this.turnLocusPins.set(agentName, opened);
+              this.lastAnnouncedLocus.set(agentName, opened);
+              result = {
+                ...result,
+                data: {
+                  ...(result.data as Record<string, unknown> | undefined),
+                  routing: 'Your plain speech now lands in this channel. Other channels need an explicit send tool.',
+                },
+              };
+              console.error(
+                `[routing] ${agentName}: channel_open -> pin moved to ${opened} (announced in tool result)`,
+              );
+            }
+          }
         }
         this.pushEvent({
           type: 'tool-result',
@@ -8988,6 +10149,7 @@ export class AgentFramework {
       // range/shape checks.
       const input = (call.input ?? {}) as {
         name?: unknown; match?: unknown; resets?: unknown; position?: unknown;
+        insertBefore?: unknown; insertAfter?: unknown; passthrough?: unknown;
         behavior?: unknown; debounceMs?: unknown; rateLimit?: unknown; passiveSample?: unknown;
       };
       const behaviorSources = [
@@ -9018,17 +10180,72 @@ export class AgentFramework {
         : input.passiveSample !== undefined ? { passive_sample: input.passiveSample }
         : input.behavior;
 
-      const position = input.position === 'prepend' ? 'prepend' : 'append';
+      // Placement: at most one of position / insertBefore / insertAfter.
+      // With none given, a replaced rule stays where it was and a new rule
+      // appends (addPolicy's contract).
+      const placementSources = [
+        input.position !== undefined ? 'position' : null,
+        input.insertBefore !== undefined ? 'insertBefore' : null,
+        input.insertAfter !== undefined ? 'insertAfter' : null,
+      ].filter((s): s is string => s !== null);
+      if (placementSources.length > 1) {
+        finish({
+          success: false,
+          error: `wake_add_rule: give at most one placement, got [${placementSources.join(', ')}].`,
+          isError: true,
+        });
+        return;
+      }
+      let position: 'append' | 'prepend' | { before: string } | { after: string } | undefined;
+      if (typeof input.insertBefore === 'string' && input.insertBefore) {
+        position = { before: input.insertBefore };
+      } else if (typeof input.insertAfter === 'string' && input.insertAfter) {
+        position = { after: input.insertAfter };
+      } else if (input.position === 'prepend' || input.position === 'append') {
+        position = input.position;
+      }
+
       const rawPolicy = {
         name: input.name,
         match: input.match ?? {},
         behavior,
+        ...(input.passthrough !== undefined ? { passthrough: input.passthrough } : {}),
         ...(input.resets !== undefined ? { resets: input.resets } : {}),
       };
-      const policy = this.addGatePolicy(rawPolicy, { position });
+
+      // Before/after probe table + shadow lint: the moment a rule changes the
+      // evaluation order is the moment its real semantics must be legible
+      // (af#105 — a prepended catch-all sampler silently disabled the
+      // addressed-message wakes for 12h before anyone could see why).
+      const before = new Map(
+        this.eventGate!.probeTable().map((r) => [r.probe, r]),
+      );
+      const policy = this.addGatePolicy(rawPolicy, position ? { position } : undefined);
+      const after = this.eventGate!.probeTable();
+      const probes = after.map((r) => {
+        const prev = before.get(r.probe);
+        const changed = !!prev && (prev.policy !== r.policy || prev.wouldWake !== r.wouldWake);
+        return {
+          probe: r.probe,
+          rule: r.policy ?? '(default)',
+          behavior: r.behavior,
+          wouldWake: r.wouldWake,
+          ...(changed ? { changed: true, was: `${prev!.policy ?? '(default)'} (wouldWake=${prev!.wouldWake})` } : {}),
+        };
+      });
+      const shadowWarnings = this.eventGate!.lintShadows()
+        .map((w) => formatShadowWarning(w));
       finish({
         success: true,
-        data: { added: policy.name, policies: this.getGatePolicyNames() },
+        data: {
+          added: policy.name,
+          policies: this.getGatePolicyNames(),
+          ...(shadowWarnings.length > 0 ? { shadowWarnings } : {}),
+          probes,
+          ...(probes.some((p) => 'changed' in p)
+            ? {}
+            : { note: 'No canonical probe changed its winning rule — the new rule affects none of the common chat/heartbeat shapes, or only channel/path-specific events the probes do not model.' }),
+        },
       });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -9681,12 +10898,11 @@ export class AgentFramework {
       conversationId: agent.name,
       turnIndex: 0, // Simplified; needs per-conversation counter TODO
       userMessage: null, // Could extract from trigger context
-      model: {
-        id: agent.model,
-        vendor: 'unknown',
-        contextWindow: 200000,
-        capabilities: ['tools'],
-      },
+      // Truthful fields only (§10.1 honesty over completeness): id is real,
+      // vendor/contextWindow/capabilities have no source in this host and
+      // are omitted rather than fabricated — the hardcoded 200000 was false
+      // for residents configured at 300k/600k.
+      model: { id: agent.model },
       channels: this.channelRegistry?.buildChannelContext(agent.name),
     };
   }