@animalabs/agent-framework 0.8.0 → 0.9.0

package/dist/src/framework.js

@@ -4,11 +4,13 @@ import { JsStore } from '@animalabs/chronicle';
 import { MembraneError } from '@animalabs/membrane';
 import { ContextManager, PassthroughStrategy } from '@animalabs/context-manager';
 import { ProcessQueueImpl } from './queue.js';
+import { REFUSAL_REACTIONS, REFUSAL_REACTION_FALLBACK } from './refusal-reactions.js';
 import { Agent } from './agent.js';
 import { ModuleRegistry, isStateExistsError } from './module-registry.js';
 import { McplServerRegistry } from './mcpl/server-registry.js';
 import { FeatureSetManager } from './mcpl/feature-set-manager.js';
-import { ScopeManager } from './mcpl/scope-manager.js';
+import { computeGrant, CapabilityGrant, expandAdvertisementShorthand } from './mcpl/capability-grant.js';
+import { maskNegotiatedCapabilities } from './mcpl/capability-mask.js';
 import { HookOrchestrator } from './mcpl/hook-orchestrator.js';
 import { PushHandler } from './mcpl/push-handler.js';
 import { parseProsePrefix } from './mcpl/prose-grammar.js';
@@ -17,7 +19,7 @@ import { InferenceRouter } from './mcpl/inference-router.js';
 import { ChannelRegistry } from './mcpl/channel-registry.js';
 import { ConversationRouter } from './mcpl/conversation-router.js';
 import { safeSlice } from './safe-slice.js';
-import { toolResultDataToHistoryString } from './tool-result-history.js';
+import { toolResultDataToHistoryString, truncateForHistory, DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS, } from './tool-result-history.js';
 import { randomUUID } from 'node:crypto';
 import { PyRunner, buildInjectedTools } from './code-execution/py-runner.js';
 import { buildCodeExecutionToolDefinition, CODE_EXECUTION_TOOL_NAME, } from './code-execution/tool-definition.js';
@@ -79,6 +81,39 @@ const isConversationalInjection = (metadata) => {
         return false;
     return true;
 };
+/**
+ * Rough token estimate for the blocks a continuation round is about to
+ * append to the live wire (issue #92 physical-window projection): the
+ * spilled tool-result strings at chars/4, a flat per-image cost for native
+ * image blocks the wire path preserves (provider vision tokens are
+ * resolution-dependent; 1600 ≈ a max-size Anthropic tile), mid-turn injected
+ * text at chars/4, and a small per-block envelope allowance. Deliberately a
+ * ceiling-ish heuristic — the cost of overestimating is one early recompile;
+ * the cost of underestimating is the 400 this projection exists to prevent.
+ */
+function estimateAppendedRoundTokens(toolResults, spilled, injections) {
+    let chars = 0;
+    let images = 0;
+    for (const tc of toolResults) {
+        chars += spilled.get(tc.id)?.text.length ?? 0;
+        if (Array.isArray(tc.result.data)) {
+            for (const raw of tc.result.data) {
+                const b = raw;
+                if (b && typeof b === 'object' && b.type === 'image')
+                    images += 1;
+            }
+        }
+    }
+    for (const inj of injections) {
+        for (const block of inj.content) {
+            if (block.type === 'text' && typeof block.text === 'string') {
+                chars += block.text.length;
+            }
+        }
+    }
+    const blockCount = toolResults.length + injections.length;
+    return Math.ceil(chars / 4) + images * 1600 + blockCount * 20;
+}
 /**
  * Explicit delivery tools whose successful use into a closed channel OPENS
  * it (send implies engagement — see openIfClosedForSend). Bare tool names,
@@ -369,8 +404,45 @@ export class AgentFramework {
      *  plain prose lands (2026-07-21 Cairn lounge misroute). Lives here — not in
      *  driveStream locals — so the pin survives a context-budget stream restart,
      *  which continues the same logical turn in a fresh driveStream. Cleared or
-     *  re-set at the start of every non-restart turn. */
+     *  re-set at the start of every non-restart turn. Since 2026-07-31 the pin
+     *  is no longer fully frozen: an ADDRESSED conversational injection — or a
+     *  conversational follow-up in a channel the agent itself explicitly sent
+     *  into this turn (turnEngagedChannels) — re-pins it at the boundary (see
+     *  the addressed re-pin block in the tool-result handler). Ambient chatter
+     *  elsewhere, reactions, and system markers still cannot move it. */
     turnLocusPins = new Map();
+    /** Channels the agent EXPLICITLY sent into during the CURRENT turn
+     *  (SEND_ENGAGEMENT_TOOLS, successful calls), per agent. Second re-pin
+     *  signal: a conversational reply in a channel the agent just engaged is
+     *  addressed by context even without a mention (2026-07-31 n=7: q's
+     *  #portables follow-up — no @mention — was answered in trailing prose
+     *  that followed the stale pin into repligate's DM). No author-kind
+     *  filter: agent-residents are full participants, and the bot flag
+     *  tracks nothing that matters (antra). Reactions/system markers are
+     *  excluded by isConversationalInjection; the engaged-this-turn scope
+     *  keeps unrelated channels from moving the pin. Cleared at every fresh
+     *  turn's start; budget restarts keep it. */
+    turnEngagedChannels = new Map();
+    /** Channels this turn's PLAIN PROSE was actually delivered to, in delivery
+     *  order (deduped at render). Feeds the `[delivered]` receipt appended at
+     *  logical turn end: explicit sends receipt themselves via their
+     *  tool_result, but auto-routed prose previously vanished into the router
+     *  with no in-window record — the agent could never see where its own
+     *  words landed (2026-07-31 misroute series; antra: minimal receipts).
+     *  Cleared at every fresh turn's start; budget restarts keep it (same
+     *  logical turn, receipt covers the whole turn). */
+    turnProseDeliveries = new Map();
+    /** Count of plain-prose segments SUPPRESSED this turn by sticky
+     *  explicit-send silencing. The suppression rule itself is untouched
+     *  (antra, 2026-07-31: visibility is enough) — but it must never be a
+     *  silent black hole: Mythos multiplexed two threads in one round (prose
+     *  for the lane + explicit send for another channel, textbook per the
+     *  routing doc), the silencing ate the prose reply, and his own record
+     *  ("scene delivered to #mythos via plain speech — routing confirmed")
+     *  believed it delivered. The receipt now reports suppression, so the
+     *  author sees the segment's fate one turn later. Cleared each fresh
+     *  turn; budget restarts keep it. */
+    turnProseSuppressed = new Map();
     /** A tool boundary injected fresh CONVERSATIONAL input (a real message —
      *  not a reaction or a system marker) into the live stream. Tells
      *  driveStream to clear sticky explicit-send suppression before handling
@@ -479,7 +551,6 @@ export class AgentFramework {
     // MCPL subsystems (null when no mcplServers configured)
     mcplServerRegistry = null;
     featureSetManager = null;
-    scopeManager = null;
     hookOrchestrator = null;
     pushHandler = null;
     inferenceRouter = null;
@@ -516,11 +587,17 @@ export class AgentFramework {
      *  provenance envelope + payload and requests inference. Keyed by script id. */
     backgroundScripts = new Map();
     backgroundScriptCounter = 0;
-    /** Ephemeral per-agent override of the tool-result inline cap (chars).
-     *  Set via agent_settings `tool_result_inline_max_chars`; NOT persisted —
-     *  the lift is meant as a temporary gate, reverts on restart/reset. */
+    /** Resident-set per-agent tool-result inline cap (chars), via
+     *  agent_settings `tool_result_inline_max_chars`. DURABLE: persisted in
+     *  framework state like the core runtime settings and restored at create
+     *  (antra + Sol, 08-06); reset clears it back to the residence default. */
     toolResultInlineMaxCharsOverride = new Map();
+    /** Durable residence-configured inline cap from
+     *  FrameworkConfig.toolResultInlineMaxChars; null → house default. */
+    toolResultInlineMaxCharsConfig = null;
     mcplTools = [];
+    /** Namespaced tool name → stateful feature-set attribution from tools/list. */
+    mcplToolFeatureSets = new Map();
     mcplToolRefreshInFlight = false;
     mcplToolRefreshPending = false;
     /** Maps tool prefix → serverId for dispatch routing. */
@@ -745,6 +822,18 @@ export class AgentFramework {
         // Client-side programmatic tool calling (code_execution). Config is only
         // retained when enabled — everything downstream gates on the field.
         framework.codeExecutionConfig = config.codeExecution?.enabled ? config.codeExecution : null;
+        if (config.toolResultInlineMaxChars !== undefined) {
+            const cap = config.toolResultInlineMaxChars;
+            if (!Number.isFinite(cap) || cap < 1000) {
+                throw new Error('FrameworkConfig.toolResultInlineMaxChars must be a number >= 1000');
+            }
+            framework.toolResultInlineMaxCharsConfig = Math.floor(cap);
+        }
+        // Restore resident-set inline caps (agent_settings) — durable like the
+        // core runtime settings, same framework/state slot (antra + Sol, 08-06).
+        for (const [agentName, cap] of Object.entries(framework.readPersistedToolResultInlineCaps())) {
+            framework.toolResultInlineMaxCharsOverride.set(agentName, cap);
+        }
         // Initialize MCPL subsystems if configured
         if (config.mcplServers && config.mcplServers.length > 0) {
             // Validate tool prefixes: no collisions with module names or between servers
@@ -1138,10 +1227,11 @@ export class AgentFramework {
     collectAgentSettingsExtensions() {
         const result = new Map();
         const taken = new Set(AgentFramework.AGENT_SETTINGS_CORE_KEYS);
-        // Framework-owned extension: the tool-result inline cap lift. Registered
-        // through the same extension surface modules use so get/update/reset all
-        // work with zero extra plumbing. EPHEMERAL by design (a temporary gate —
-        // reverts on restart), unlike module extensions which persist their own.
+        // Framework-owned extension: the resident's tool-result inline cap.
+        // Registered through the same extension surface modules use so
+        // get/update/reset all work with zero extra plumbing. DURABLE: persisted
+        // in framework state and restored at create, like the core runtime
+        // settings (antra + Sol, 08-06); reset returns to the residence default.
         {
             const ext = this.spillSettingsExtension();
             ext.keys.forEach((k) => taken.add(k));
@@ -1167,28 +1257,40 @@ export class AgentFramework {
             properties: {
                 tool_result_inline_max_chars: {
                     type: 'number',
-                    description: 'Inline size cap (chars) for tool results and background-script wake payloads. ' +
-                        'Content over the cap is written to a workspace file under tool-results/ and ' +
-                        'replaced by a truncated preview + file reference. Raise it temporarily when you ' +
-                        'genuinely want a large result inline; reset restores the default (derived from ' +
-                        'your strategy). Ephemeral — reverts on host restart.',
+                    description: 'Inline size cap (chars) for tool results (successes and errors) and ' +
+                        'background-script wake payloads. Content over the cap is written to a workspace ' +
+                        'file under tool-results/ and replaced by a truncated preview + file reference. ' +
+                        'This is YOUR durable setting: it persists across restarts, like your other ' +
+                        'agent_settings. Update it when you want a different inline size; reset restores ' +
+                        'the residence default. The effective cap is min(your value, your strategy\'s ' +
+                        'per-message bound) — the bound is a safety ceiling, and the full content is ' +
+                        'always in the spill file. get reports desired/_effective/_source/_clamped_by.',
                 },
             },
             keys: ['tool_result_inline_max_chars'],
-            get: (agentName) => ({
-                tool_result_inline_max_chars: this.toolResultInlineMaxCharsOverride.get(agentName) ?? null,
-            }),
+            get: (agentName) => {
+                const agent = this.agents.get(agentName);
+                const resolved = agent ? this.resolveToolResultInlineCap(agent) : null;
+                return {
+                    tool_result_inline_max_chars: this.toolResultInlineMaxCharsOverride.get(agentName) ?? null,
+                    tool_result_inline_max_chars_effective: resolved?.cap ?? null,
+                    tool_result_inline_max_chars_source: resolved?.source ?? null,
+                    tool_result_inline_max_chars_clamped_by: resolved?.clampedBy ?? null,
+                };
+            },
             update: (agentName, patch) => {
                 const n = Number(patch.tool_result_inline_max_chars);
                 if (!Number.isFinite(n) || n < 1000) {
                     throw new Error('tool_result_inline_max_chars must be a number >= 1000');
                 }
                 this.toolResultInlineMaxCharsOverride.set(agentName, Math.floor(n));
+                this.persistToolResultInlineCap(agentName, Math.floor(n));
                 return { tool_result_inline_max_chars: Math.floor(n) };
             },
             reset: (agentName, keys) => {
                 if (!keys || keys.includes('tool_result_inline_max_chars')) {
                     this.toolResultInlineMaxCharsOverride.delete(agentName);
+                    this.persistToolResultInlineCap(agentName, null);
                 }
                 return { tool_result_inline_max_chars: null };
             },
@@ -1544,6 +1646,44 @@ export class AgentFramework {
         }
         return overrides;
     }
+    /** Load resident-set inline caps from framework state, dropping (loudly)
+     *  anything that fails the same validation the live update enforces. */
+    readPersistedToolResultInlineCaps() {
+        try {
+            const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+            const out = {};
+            for (const [name, value] of Object.entries(data?.toolResultInlineCaps ?? {})) {
+                const n = Number(value);
+                if (Number.isFinite(n) && n >= 1000) {
+                    out[name] = Math.floor(n);
+                }
+                else {
+                    console.error(`[agent-settings] dropping invalid persisted tool_result_inline_max_chars for '${name}': ${JSON.stringify(value)}`);
+                }
+            }
+            return out;
+        }
+        catch {
+            return {};
+        }
+    }
+    /** Write (cap) or clear (null) one agent's resident-set inline cap. */
+    persistToolResultInlineCap(agentName, cap) {
+        const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
+        const state = (data && typeof data === 'object' ? data : {});
+        const all = {
+            ...(state.toolResultInlineCaps ?? {}),
+        };
+        if (cap === null)
+            delete all[agentName];
+        else
+            all[agentName] = cap;
+        if (Object.keys(all).length === 0)
+            delete state.toolResultInlineCaps;
+        else
+            state.toolResultInlineCaps = all;
+        this.store.setStateJson(FRAMEWORK_STATE_ID, state);
+    }
     persistAgentRuntimeSettings(agentName, overrides) {
         const data = this.store.getStateJson(FRAMEWORK_STATE_ID);
         const state = (data && typeof data === 'object' ? data : {});
@@ -1982,14 +2122,6 @@ export class AgentFramework {
         'chat:group': 'Group (multi-party) conversation',
         'chat:thread': 'Occurred in a thread',
     };
-    /** Refusal category → Discord reaction emoji. Unknown categories get 🛑. */
-    static REFUSAL_REACTIONS = {
-        bio: '☣️',
-        chem: '🧪',
-        nuclear: '☢️',
-        cyber: '💻',
-        reasoning_extraction: '🧠',
-    };
     /**
      * Mark an inference refusal visibly: react on the message that holds the
      * conversational locus (the most recent incoming channel message) with a
@@ -2008,7 +2140,7 @@ export class AgentFramework {
             if (parts[0] !== 'discord')
                 return;
             const channelId = parts[parts.length - 1];
-            const emoji = AgentFramework.REFUSAL_REACTIONS[category] ?? '🛑';
+            const emoji = REFUSAL_REACTIONS[category] ?? REFUSAL_REACTION_FALLBACK;
             // Resolve the MCPL server that owns the locus channel and call
             // tools/call directly on its connection (bare tool name — no prefix
             // games), bypassing the agent event queue so no synthetic tool-result
@@ -2204,6 +2336,38 @@ export class AgentFramework {
             console.error('[unstick] report post failed:', err instanceof Error ? err.message : err);
         }
     }
+    /**
+     * Admin-level nudge: run an inference turn on the agent's CURRENT context
+     * without adding any message, event, or other context mutation. The turn
+     * compiles exactly what the agent already sees — useful after an /undo,
+     * a /hide, or whenever an operator wants the agent to take another look
+     * (or another swing) at where it stands, with zero context pollution.
+     *
+     * Queues a normal inference request (same path as gate wakes): if the
+     * agent is mid-turn it runs when the turn settles; a pending skip_reply
+     * self-wake is superseded like any other wake. Deliberately NOT gated on
+     * idle — "run when you're free" is the useful semantic. No suppression
+     * interplay: gate sleep filters events, not queued requests, so a nudge
+     * wakes even a sleeping agent (it's an admin override, like /unstick).
+     */
+    nudgeAgent(agentName, requestedBy) {
+        const name = agentName ?? [...this.agents.keys()][0];
+        const agent = name ? this.agents.get(name) : undefined;
+        if (!name || !agent) {
+            return { ok: false, error: `Unknown agent: ${String(agentName ?? '(none registered)')}` };
+        }
+        const agentStatus = this.activeTurnTokens.has(name) && agent.state.status === 'idle'
+            ? 'idle+turn-alive'
+            : agent.state.status;
+        this.pendingRequests.push({
+            agentName: name,
+            reason: requestedBy ? `admin-nudge (${requestedBy})` : 'admin-nudge',
+            source: 'admin',
+            timestamp: Date.now(),
+        });
+        console.error(`[nudge] agent=${name} queued by=${requestedBy ?? 'unknown'} status=${agentStatus}`);
+        return { ok: true, agentName: name, agentStatus };
+    }
     /**
      * Handle a `host/command` request from an MCPL surface server (e.g. a
      * Discord slash command). Currently supports:
@@ -2212,15 +2376,27 @@ export class AgentFramework {
      *   `undoLastTurn`). The response includes the last message the agent
      *   would see in its context after the undo, obtained via the transparent
      *   `previewActivation` render (no inference, no Chronicle writes).
+     *
+     *   nudge — run inference on the current context with NO new events
+     *   (see `nudgeAgent`).
      */
     async handleHostCommand(serverId, params) {
-        if (params.command !== 'undo' && params.command !== 'hide' && params.command !== 'unstick') {
+        if (params.command !== 'undo' &&
+            params.command !== 'hide' &&
+            params.command !== 'unstick' &&
+            params.command !== 'nudge') {
             return { ok: false, error: `Unknown host command: ${String(params.command)}` };
         }
         const agentName = params.agentName ?? [...this.agents.keys()][0];
         if (!agentName || !this.agents.has(agentName)) {
             return { ok: false, error: `Unknown agent: ${String(agentName)}` };
         }
+        // nudge: queue an inference on the current context — no message, no
+        // event, no context mutation (see nudgeAgent).
+        if (params.command === 'nudge') {
+            const r = this.nudgeAgent(agentName, params.requesterName ?? params.requesterId ?? `mcpl:${serverId}`);
+            return { ok: r.ok, error: r.error, agentStatus: r.agentStatus };
+        }
         // unstick: force the refusal-rewind loop on demand (even if the agent's
         // autoRewind toggle is off). Redacts the turn that fed the refusal and
         // re-runs, up to `cap` times, until the model stops refusing. Kicks the
@@ -2993,32 +3169,16 @@ export class AgentFramework {
                         agent.addAssistantResponse(pendingBlocks);
                         this.pendingAssistantBlocks.delete(agent.name);
                     }
-                    // Compute truncation limit from agent's strategy (maxMessageTokens * 4 chars)
-                    const maxChars = this.getMaxToolResultChars(agent);
-                    // Oversized results spill to a workspace file (truncated preview +
-                    // file reference) instead of being blind-truncated. Computed ONCE
-                    // per call and reused for both the history copy and the live wire
-                    // copy below — the two must stay byte-matched (the window stores
-                    // what the membrane sends; divergence breaks the compile prefix).
-                    const spilled = new Map();
-                    const dateLabel = new Date().toISOString().slice(0, 10);
-                    for (const tc of currentState.toolResults) {
-                        if (tc.result.isError)
-                            continue;
-                        spilled.set(tc.id, await this.spillOrTruncate(toolResultDataToHistoryString(tc.result.data, undefined), maxChars, `${dateLabel}-${tc.id}`, agent.name));
-                    }
-                    // Store tool results as a user message (tool_result blocks).
-                    // Use the history serializer so MCP image blocks become a short
-                    // `[image: type, size]` placeholder instead of megabytes of base64
-                    // that would corrupt under truncation.
-                    const toolResultContent = currentState.toolResults.map(tc => ({
-                        type: 'tool_result',
-                        toolUseId: tc.id,
-                        content: tc.result.isError
-                            ? tc.result.error ?? 'Unknown error'
-                            : spilled.get(tc.id) ?? toolResultDataToHistoryString(tc.result.data, maxChars),
-                        isError: tc.result.isError,
-                    }));
+                    // Effective inline cap: agent_settings override → durable config →
+                    // house default, clamped to the strategy bound (see resolver).
+                    const maxChars = this.resolveToolResultInlineCap(agent).cap;
+                    // Oversized results — successes AND errors — spill to a workspace
+                    // file (truncated preview + file reference) instead of being
+                    // blind-truncated. Computed ONCE per call and reused for both the
+                    // history copy and the live wire copy below — the two must stay
+                    // byte-matched (the window stores what the membrane sends;
+                    // divergence breaks the compile prefix).
+                    const { blocks: toolResultContent, spilled } = await this.buildStoredToolResultContent(currentState.toolResults, maxChars);
                     agent.getContextManager().addMessage('user', toolResultContent);
                     // Flush any messages that were deferred while this turn was in
                     // flight. Route to the PRIMARY agent — deferred messages are
@@ -3083,6 +3243,29 @@ export class AgentFramework {
                     const overBudget = currentState.stream
                         && agent.lastStreamInputTokens > 0
                         && agent.lastStreamInputTokens > agent.maxStreamTokens;
+                    // Physical-window projection (issue #92): a turn's continuation
+                    // rounds append to the compiled request without recompiling, so a
+                    // turn that starts near the compile target can walk past the
+                    // provider's HARD cap mid-turn and take a wire 400 — the compile
+                    // was legal, the growth wasn't. Project the next round's real size
+                    // (cache-inclusive input of the prior round + the blocks about to
+                    // be appended + reserve for the response) and, when it would cross
+                    // the physical window, break the stream through the same
+                    // budget-restart path — a fresh compile folds the history back
+                    // under budget instead of dispatching a doomed request.
+                    // Projection terms: prior round's real input + prior round's
+                    // OUTPUT (the just-generated thinking/text/tool_use joins the next
+                    // round's input — omitting it is a systematic underestimate) +
+                    // blocks about to be appended + reserve for the next response.
+                    const projectedRealTokens = currentState.stream
+                        && agent.physicalWindowTokens !== undefined
+                        && agent.lastStreamRealInputTokens > 0
+                        ? agent.lastStreamRealInputTokens
+                            + agent.lastStreamOutputTokens
+                            + estimateAppendedRoundTokens(currentState.toolResults, spilled, midTurnInjections)
+                            + agent.maxTokens
+                        : 0;
+                    const overPhysical = projectedRealTokens > (agent.physicalWindowTokens ?? Infinity);
                     // Addressed re-pin (2026-07-31 Mythos misroutes, antra-ratified):
                     // when someone ADDRESSES the agent mid-turn from another channel
                     // (mention / reply / DM — the same chat:addressed signal the
@@ -3109,13 +3292,34 @@ export class AgentFramework {
                     // diffs against what the agent was actually last told.
                     if (agent.proseRouting !== 'explicit' &&
                         !shouldEndTurn && !overBudget && currentState.stream) {
-                        const lastAddressed = [...midTurnInjections].reverse().find((inj) => {
+                        // Two signals qualify an injection to move the pin (n=6 + n=7):
+                        //  - chat:addressed — someone explicitly spoke TO the agent
+                        //    (mention / reply / DM);
+                        //  - a conversational follow-up in a channel the agent itself
+                        //    explicitly sent into THIS turn (turnEngagedChannels) —
+                        //    conversation the agent just engaged continues without
+                        //    re-mentioning it (2026-07-31: q's #portables reply, no @,
+                        //    answered in prose that followed the stale pin into
+                        //    repligate's DM). Deliberately NO author-kind filter: this
+                        //    fleet's participants include agent-residents whose speech
+                        //    is as conversational as anyone's — the Discord bot flag
+                        //    tracks nothing that matters here (antra, 2026-07-31).
+                        //    Reactions and system markers are already excluded by
+                        //    isConversationalInjection, and the engaged-this-turn scope
+                        //    keeps unrelated channels from moving the pin.
+                        const engaged = this.turnEngagedChannels.get(agent.name);
+                        const lastQualifying = [...midTurnInjections].reverse().find((inj) => {
                             const m = inj.metadata;
-                            return (isConversationalInjection(inj.metadata) &&
-                                typeof m?.channelId === 'string' &&
-                                isAddressedMessage(m.tags, m));
+                            if (!isConversationalInjection(inj.metadata))
+                                return false;
+                            if (typeof m?.channelId !== 'string')
+                                return false;
+                            const tags = m.tags;
+                            if (isAddressedMessage(tags, m))
+                                return true;
+                            return engaged?.has(m.channelId) === true;
                         });
-                        const newLocus = lastAddressed?.metadata
+                        const newLocus = lastQualifying?.metadata
                             ?.channelId;
                         if (newLocus && this.turnLocusPins.get(agent.name) !== newLocus) {
                             const prevPin = this.turnLocusPins.get(agent.name) ?? null;
@@ -3127,7 +3331,7 @@ export class AgentFramework {
                                 : newLocus;
                             const noticeContent = [{
                                     type: 'text',
-                                    text: `[routing] You were just addressed from ${shown} — your plain ` +
+                                    text: `[routing] The conversation moved to ${shown} — your plain ` +
                                         'speech now lands there for the rest of this turn. Other ' +
                                         'channels need an explicit send tool.',
                                 }];
@@ -3158,7 +3362,7 @@ export class AgentFramework {
                         this.settleAgent(agent.name, { stopReason: 'turn_ended', speech: '' });
                         this.emitTrace({ type: 'inference:turn_ended', agentName: agent.name });
                     }
-                    else if (overBudget) {
+                    else if (overBudget || overPhysical) {
                         // Context budget exceeded: break the stream, let compile() compress.
                         // Mark the cancel as framework-initiated BEFORE cancelling: the
                         // membrane delivers `aborted` before the restart bumps streamId,
@@ -3183,9 +3387,12 @@ export class AgentFramework {
                         this.emitTrace({
                             type: 'inference:stream_restarted',
                             agentName: agent.name,
-                            reason: 'context_budget',
-                            inputTokens: agent.lastStreamInputTokens,
-                            budget: agent.maxStreamTokens,
+                            // 'physical_window' only when the budget check alone would
+                            // have let the doomed request through — overBudget keeps its
+                            // established label for existing consumers.
+                            reason: overBudget ? 'context_budget' : 'physical_window',
+                            inputTokens: overBudget ? agent.lastStreamInputTokens : projectedRealTokens,
+                            budget: overBudget ? agent.maxStreamTokens : (agent.physicalWindowTokens ?? 0),
                         });
                         this.pendingRequests.push({
                             agentName: agent.name,
@@ -3353,6 +3560,12 @@ export class AgentFramework {
                     ? event.metadata.guildName
                     : undefined,
                 tags: event.tags,
+                missedMessages: typeof event.metadata?.missedMessages === 'number'
+                    ? event.metadata.missedMessages
+                    : undefined,
+                missedCharacters: typeof event.metadata?.missedCharacters === 'number'
+                    ? event.metadata.missedCharacters
+                    : undefined,
             });
             if (invitation) {
                 incomingContent.push(invitation.block);
@@ -3623,6 +3836,17 @@ export class AgentFramework {
      * this should see WHO addressed it WHERE, not a wall of snowflake ids. Raw
      * ids remain only inside the tool-argument instructions, where they are the
      * literal values to pass.
+     *
+     * 2026-08-05 accuracy pass: the old "you won't receive more from it unless
+     * you join" was wrong in both directions — direct addresses (mentions,
+     * replies to the agent) DO still arrive, and nothing warned that answering
+     * via option 1 leaves the human's natural un-@'d follow-up invisible (Sol
+     * answered four #architecture mentions over four days while the follow-ups
+     * to her own replies were silently dropped). The wording now states the
+     * actual delivery model, and option 1 carries the consequence inline. When
+     * the surface tracks a missed-ambient tally (discord-mcpl sends
+     * `missedMessages`/`missedCharacters` in push origin), the invitation shows
+     * the count — the cost of staying out, as a number, at decision time.
      */
     buildClosedChannelInvitation(opts) {
         if (!this.channelRegistry)
@@ -3636,12 +3860,21 @@ export class AgentFramework {
         const label = opts.channelLabel ?? descriptor?.label;
         const channelLabel = label ? `#${label}` : `"${opts.channelId}"`;
         const place = opts.guildName ? `${channelLabel} in "${opts.guildName}"` : channelLabel;
+        const missedCount = opts.missedMessages ?? 0;
+        const missedNote = missedCount > 0
+            ? `While closed, ${missedCount} message${missedCount === 1 ? '' : 's'}` +
+                (opts.missedCharacters ? ` (~${opts.missedCharacters} chars)` : '') +
+                ` have passed there without you. `
+            : '';
         const block = {
             type: 'text',
             text: `\n[Channel invitation] ${opts.authorName} addressed you in ${place} — ` +
-                `a channel you haven't joined. You're seeing this one message; you won't receive more from it unless you join. ` +
+                `a channel you haven't joined. Only messages that address you directly (an @-mention or ` +
+                `a reply to one of your messages) reach you from it; the rest of its traffic is invisible to you. ` +
+                missedNote +
                 `Your options:\n` +
-                `1. Reply without joining — write your reply this turn prefixed with ">>${channelLabel}"; it will be delivered there.\n` +
+                `1. Reply without joining — write your reply this turn prefixed with ">>${channelLabel}"; it will be delivered there. ` +
+                `Note: follow-ups to your reply will NOT reach you unless they @-mention you or use the reply feature on your message.\n` +
                 `2. Join the channel — call channel_open with channelId "${opts.channelId}" and serverId "${opts.serverId}"` +
                 (maxBackscroll > 0
                     ? `; to also read recent history, add backscroll (a number up to ${maxBackscroll}) and beforeMessageId "${opts.messageId}".\n`
@@ -3696,6 +3929,8 @@ export class AgentFramework {
                 authorName: typeof origin.authorName === 'string' && origin.authorName ? origin.authorName : 'Someone',
                 guildName: typeof origin.guildName === 'string' && origin.guildName ? origin.guildName : undefined,
                 tags: event.tags,
+                missedMessages: typeof origin.missedMessages === 'number' ? origin.missedMessages : undefined,
+                missedCharacters: typeof origin.missedCharacters === 'number' ? origin.missedCharacters : undefined,
             });
             if (invitation) {
                 content.push(invitation.block);
@@ -3893,6 +4128,68 @@ export class AgentFramework {
             });
         }
     }
+    /** Record prose segments suppressed by explicit-send silencing. */
+    recordProseSuppression(agentName, count) {
+        if (count <= 0)
+            return;
+        this.turnProseSuppressed.set(agentName, (this.turnProseSuppressed.get(agentName) ?? 0) + count);
+    }
+    /** Record a successful plain-prose delivery for this turn's receipt. */
+    recordProseDelivery(agentName, outcome) {
+        if (!outcome?.delivered)
+            return;
+        let list = this.turnProseDeliveries.get(agentName);
+        if (!list) {
+            list = [];
+            this.turnProseDeliveries.set(agentName, list);
+        }
+        list.push(outcome.channelId);
+    }
+    /**
+     * Append the turn's `[delivered]` receipt: one compact system message
+     * naming where this turn's plain prose actually landed (channels in
+     * delivery order, deduped). Explicit sends receipt themselves via their
+     * tool_result; auto-routed prose previously left no in-window trace, so
+     * the agent could never see where its own words went — misroutes were
+     * invisible to it until a human reported them (2026-07-31 series).
+     * Called ONLY at logical turn end (stream 'complete', or the endTurn
+     * cancel path after the speech chain settles) — never mid-stream, where a
+     * window-only insert would diverge from the wire. No-op when the turn
+     * delivered nothing. Failures are already marked separately
+     * ([discord-send-failed]); this is the success half.
+     */
+    appendProseDeliveryReceipt(agent) {
+        const list = this.turnProseDeliveries.get(agent.name);
+        const suppressed = this.turnProseSuppressed.get(agent.name) ?? 0;
+        if ((!list || list.length === 0) && suppressed === 0)
+            return;
+        this.turnProseDeliveries.delete(agent.name);
+        this.turnProseSuppressed.delete(agent.name);
+        const seen = new Set();
+        const shown = [];
+        for (const id of list ?? []) {
+            if (seen.has(id))
+                continue;
+            seen.add(id);
+            const label = this.channelRegistry?.getDescriptor(id)?.label;
+            shown.push(label && label !== id
+                ? `${label.startsWith('#') ? label : `#${label}`} (${id})`
+                : id);
+        }
+        const suppressedNote = suppressed > 0
+            ? `${suppressed} plain-speech segment(s) suppressed (explicit send in the same round — resend with a send tool if it was meant to be heard)`
+            : '';
+        const text = shown.length > 0
+            ? `[delivered] plain speech → ${shown.join(' · ')}${suppressedNote ? ` · ${suppressedNote}` : ''}`
+            : `[delivered] nothing — ${suppressedNote}`;
+        try {
+            const mid = agent.getContextManager().addMessage('user', [{ type: 'text', text }], { system: true, kind: 'delivery-receipt' });
+            this.emitTrace({ type: 'message:added', messageId: mid, source: 'delivery-receipt' });
+        }
+        catch (err) {
+            console.error('delivery receipt append failed:', err);
+        }
+    }
     /**
      * Announce-on-change locus notice (turn-frozen routing). Appends a durable
      * `[routing]` window message when the turn's effective outbound locus
@@ -4260,6 +4557,12 @@ export class AgentFramework {
         if (trigger?.reason !== 'context_budget_restart') {
             if (attempt === 0)
                 this.maybePrimeProseMode(agent);
+            // Fresh turn: forget the previous turn's explicit-send engagements and
+            // prose deliveries — both are strictly turn-scoped (a restart continues
+            // the same logical turn and keeps them).
+            this.turnEngagedChannels.delete(agent.name);
+            this.turnProseDeliveries.delete(agent.name);
+            this.turnProseSuppressed.delete(agent.name);
             if (agent.proseRouting === 'explicit') {
                 // Explicit prose routing: there is no locus. The model names every
                 // destination in-band (`>>` prefixes); the only turn state is the
@@ -4438,7 +4741,8 @@ export class AgentFramework {
         const enqueueSpeech = (text, locus) => {
             turnSpeechChain = turnSpeechChain
                 .then(async () => {
-                await this.channelRegistry.routeSpeech(agent.name, text, locus);
+                const outcome = await this.channelRegistry.routeSpeech(agent.name, text, locus);
+                this.recordProseDelivery(agent.name, outcome);
             })
                 .catch((err) => console.error('mid-turn speech routing failed:', err));
         };
@@ -4476,8 +4780,25 @@ export class AgentFramework {
         // streams that delivery would refuse), emission is capability-gated in
         // the registry (`channels.streaming`), and delivery via deliverProse
         // remains the sole authoritative send.
-        const outgoingInferenceId = `inf_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+        const newOutgoingInferenceId = () => `inf_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
+        // NOT const: a membrane refusal retry abandons everything streamed so
+        // far, and the surface must not concatenate two attempts. Re-minting the
+        // id makes the discarded attempt's chunk buffer orphaned (never
+        // finalized) instead of being appended to — see the 'retrying' case.
+        let outgoingInferenceId = newOutgoingInferenceId();
         let outgoingIndex = 0;
+        // §10.5 inference/lifecycle: `started` now, exactly one terminal in the
+        // finally below (the one block every exit path shares). Which terminal
+        // is decided by the paths themselves: default completed, catch sets
+        // failed, a framework-cancelled stream sets aborted. Best-effort
+        // notifications — consumers dedupe by inferenceId and keep a timeout.
+        let lifecyclePhase = 'completed';
+        this.hookOrchestrator?.emitLifecycle({
+            inferenceId: outgoingInferenceId,
+            conversationId: agent.name,
+            turnIndex: 0,
+            phase: 'started',
+        });
         const proseStream = this.channelRegistry
             ? new ProseStreamRouter({
                 mode: agent.proseRouting === 'explicit' ? 'explicit' : 'locus',
@@ -4522,6 +4843,35 @@ export class AgentFramework {
                             emitOutgoing(proseStream.feed(event.content));
                         }
                         break;
+                    case 'retrying': {
+                        // Membrane is re-issuing after a content-policy refusal. Per the
+                        // RetryingEvent contract we must DISCARD everything this call has
+                        // emitted: the tokens above were already streamed to the surface
+                        // as outgoing chunks, and appending a second attempt to them
+                        // would show the human two half-answers spliced together.
+                        //
+                        // Re-mint the outgoing id so the partial buffer is orphaned
+                        // rather than continued (delivery is authoritative via
+                        // deliverProse and has not happened yet — nothing has been
+                        // *sent*, only previewed), and reset the prose router so its
+                        // destination bookkeeping starts clean for the new attempt.
+                        console.error(`[refusal-retry] agent=${agent.name} membrane retry ` +
+                            `${event.attempt}/${event.maxAttempts}` +
+                            (event.category ? ` category=${event.category}` : '') +
+                            ' — discarding the refused attempt');
+                        outgoingInferenceId = newOutgoingInferenceId();
+                        outgoingIndex = 0;
+                        proseStream?.reset();
+                        this.emitTrace({
+                            type: 'inference:tokens',
+                            agentName: agent.name,
+                            content: '',
+                            blockType: 'text',
+                            blockIndex: 0,
+                            channelId: typingChannel ?? undefined,
+                        });
+                        break;
+                    }
                     case 'block': {
                         const { event: phase, index, block } = event.event;
                         this.emitTrace({
@@ -4628,6 +4978,9 @@ export class AgentFramework {
                                     }
                                     else if (turnSilenced) {
                                         console.error(`[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (turn silenced)`);
+                                        // Visible in the turn-end receipt — silencing must never
+                                        // be a silent black hole (n=8: the flying-scene reply).
+                                        this.recordProseSuppression(agent.name, roundSegments.length);
                                     }
                                     else if (hasSameRoundPrivateThink) {
                                         console.error(`[routing] ${agent.name}: mid-turn round [${roundToolNames.join(', ')}] -> prose NOT routed (same_round_think_text_policy=private)`);
@@ -4669,17 +5022,12 @@ export class AgentFramework {
                                 agent.addAssistantResponse(pending);
                                 this.pendingAssistantBlocks.delete(agent.name);
                             }
-                            // Store tool results
+                            // Store tool results — same bounded spill policy as the
+                            // ordinary path (issue #89: this guard path must not become the
+                            // one door a giant blob still walks through).
                             const readyState = agent.state;
                             if (readyState.status === 'ready') {
-                                const toolResultContent = readyState.toolResults.map(tc => ({
-                                    type: 'tool_result',
-                                    toolUseId: tc.id,
-                                    content: tc.result.isError
-                                        ? (tc.result.error ?? 'Unknown error')
-                                        : toolResultDataToHistoryString(tc.result.data),
-                                    isError: tc.result.isError,
-                                }));
+                                const { blocks: toolResultContent } = await this.buildStoredToolResultContent(readyState.toolResults, this.resolveToolResultInlineCap(agent).cap);
                                 agent.getContextManager().addMessage('user', toolResultContent);
                             }
                         }
@@ -4703,39 +5051,10 @@ export class AgentFramework {
                         else {
                             agent.addAssistantResponse(terminalContent);
                         }
-                        // Run afterInference hooks (no-op if no MCPL servers)
-                        if (this.hookOrchestrator) {
-                            try {
-                                const speechText = response.content
-                                    .filter((block) => block.type === 'text')
-                                    .map((b) => b.text)
-                                    .join('\n');
-                                const afterParams = {
-                                    inferenceId: requestId,
-                                    conversationId: agent.name,
-                                    turnIndex: 0,
-                                    userMessage: null,
-                                    assistantMessage: speechText,
-                                    model: {
-                                        id: agent.model,
-                                        vendor: 'unknown',
-                                        contextWindow: 200000,
-                                        capabilities: ['tools'],
-                                    },
-                                    usage: {
-                                        inputTokens: response.usage?.inputTokens ?? 0,
-                                        outputTokens: response.usage?.outputTokens ?? 0,
-                                        cacheCreationTokens: response.details?.usage?.cacheCreationTokens,
-                                        cacheReadTokens: response.details?.usage?.cacheReadTokens,
-                                    },
-                                };
-                                await this.hookOrchestrator.afterInference(afterParams);
-                            }
-                            catch (error) {
-                                // Fail-open: continue with speech dispatch
-                                console.error('afterInference hook error:', error);
-                            }
-                        }
+                        // §10.5: context/afterInference is removed in 0.5.0 — no
+                        // content leaves the host here. Turn boundaries are announced
+                        // by the metadata-only inference/lifecycle notifications
+                        // emitted in driveStream's start/exit paths.
                         // Separate speech from thoughts — for MODULE dispatch only
                         // (dispatchSpeech / TUI rendering below). This split does NOT
                         // decide what reaches the channel: mid-turn prose is routed live
@@ -4817,6 +5136,17 @@ export class AgentFramework {
                             let handledByRewind = false;
                             const rh = agent.refusalHandling;
                             const forced = this.forcedRewind.get(agent.name);
+                            // NOTE: plain retries are NOT done here. `refusalHandling.retries`
+                            // is handed to membrane (see Agent.startActivation), which
+                            // replays the SAME request at the provider seam — immediately,
+                            // cache-warm, and without recompiling into a different window.
+                            // A framework-level requeue was tried first and is strictly
+                            // worse: it recompiles, so attempts are correlated rather than
+                            // fresh draws against a probabilistic threshold, and it cannot
+                            // tell a streaming consumer to discard the abandoned attempt.
+                            // By the time a refusal reaches here, membrane's retries are
+                            // already spent — so this path is the escalation: rewind (if
+                            // enabled), then the reaction.
                             // Shed exactly one more (newest, in-sequence) turn and keep the
                             // single episode marker current. `budgetLeft` bounds the loop.
                             const doRewind = (budgetLeft, onStep, onGiveUp) => {
@@ -4862,8 +5192,16 @@ export class AgentFramework {
                                     this.rewindEpisode.delete(agent.name);
                                 });
                             }
-                            if (!handledByRewind)
+                            // The reaction is the LAST resort: retries spent, rewind not
+                            // applicable. That makes it an honest signal to humans that the
+                            // border is close, rather than noise on every near-threshold
+                            // flip. (It must not re-enter any agent's context — the emoji
+                            // is suppressed at the surface via
+                            // DISCORD_SUPPRESS_REACTION_EMOJIS; without that, marking a
+                            // refusal feeds the next one.)
+                            if (!handledByRewind) {
                                 void this.reactToRefusal(agent.name, category);
+                            }
                         }
                         else {
                             // A turn that completed WITHOUT a refusal ends the rewind episode:
@@ -4924,7 +5262,8 @@ export class AgentFramework {
                                     const locus = resolveTurnLocus();
                                     console.error(`[routing] ${agent.name}: text-only turn -> routing speech -> ${locus ?? '(none)'}`);
                                     try {
-                                        await this.channelRegistry.routeSpeech(agent.name, speechText, locus);
+                                        const outcome = await this.channelRegistry.routeSpeech(agent.name, speechText, locus);
+                                        this.recordProseDelivery(agent.name, outcome);
                                     }
                                     catch (err) {
                                         console.error('speech routing failed:', err);
@@ -4975,6 +5314,9 @@ export class AgentFramework {
                             else if (silenced || segments.length === 0) {
                                 console.error(`[routing] ${agent.name}: tool-call turn [${toolNames.join(', ') || 'none'}] -> trailing prose NOT routed ` +
                                     `(${silenced ? 'silencing tool / explicit send' : 'no trailing prose'})`);
+                                if (silenced && segments.length > 0) {
+                                    this.recordProseSuppression(agent.name, segments.length);
+                                }
                             }
                             else {
                                 // Reuse the locus pinned at the turn's first live-routed
@@ -4989,7 +5331,8 @@ export class AgentFramework {
                                 // Deliver sequentially (await each) so the segments land in order.
                                 for (const seg of segments) {
                                     try {
-                                        await this.channelRegistry.routeSpeech(agent.name, seg, locus);
+                                        const outcome = await this.channelRegistry.routeSpeech(agent.name, seg, locus);
+                                        this.recordProseDelivery(agent.name, outcome);
                                     }
                                     catch (err) {
                                         console.error('speech routing failed:', err);
@@ -5000,6 +5343,14 @@ export class AgentFramework {
                         // NOTE: agent.reset() + onInferenceEnded() already ran above,
                         // BEFORE dispatchSpeech. Locus routing is speech dispatch and
                         // doesn't depend on the status field, so it correctly runs after.
+                        // Logical turn end (normal completion): drop the `[delivered]`
+                        // receipt. All deliveries are settled — the live chain was
+                        // awaited before trailing dispatch, and trailing/text-only
+                        // segments were awaited in-loop. Locus mode only; explicit-mode
+                        // envelopes acknowledge themselves through the prose gateway.
+                        if (agent.proseRouting !== 'explicit') {
+                            this.appendProseDeliveryReceipt(agent);
+                        }
                         // Explicit-prose `!` continuation: a prose segment this turn asked
                         // to keep going (`>>#x !` / `>>private !`) — start another turn
                         // now instead of pausing until the next external event. This gives
@@ -5075,9 +5426,26 @@ export class AgentFramework {
                         // reset, no settle, no spurious inference:exhausted (which would
                         // reject an ephemeral's promise mid-run and bump the failure
                         // streak). Gate release + stream teardown happen in `finally`.
-                        if (this.frameworkCancelledStreams.delete(`${agent.name}:${myStreamId}`)) {
-                            this.eventGate?.onInferenceEnded(agent.name);
-                            return;
+                        {
+                            const cancelKey = `${agent.name}:${myStreamId}`;
+                            const cancelKind = this.frameworkCancelledStreams.get(cancelKey);
+                            if (cancelKind !== undefined) {
+                                this.frameworkCancelledStreams.delete(cancelKey);
+                                lifecyclePhase = 'aborted'; // §10.5 — terminal emitted in finally
+                                this.eventGate?.onInferenceEnded(agent.name);
+                                // endTurn IS a logical turn end — earlier rounds may have
+                                // live-routed prose (narrate → skip_reply is a real shape),
+                                // so settle the delivery chain and drop the receipt. A
+                                // budget restart continues the same logical turn: the
+                                // deliveries map persists (cleared only at fresh turn
+                                // start) and the continuation stream's end writes ONE
+                                // receipt for the whole turn.
+                                if (cancelKind === 'turn_ended' && agent.proseRouting !== 'explicit') {
+                                    await turnSpeechChain;
+                                    this.appendProseDeliveryReceipt(agent);
+                                }
+                                return;
+                            }
                         }
                         const reason = event.reason ?? 'unknown';
                         // Only reset if this is still the active stream (a budget restart
@@ -5117,6 +5485,11 @@ export class AgentFramework {
                     }
                     case 'usage': {
                         agent.lastStreamInputTokens = event.usage.inputTokens;
+                        agent.lastStreamRealInputTokens =
+                            (event.usage.inputTokens ?? 0) +
+                                (event.usage.cacheCreationTokens ?? 0) +
+                                (event.usage.cacheReadTokens ?? 0);
+                        agent.lastStreamOutputTokens = event.usage.outputTokens ?? 0;
                         // Closed-loop estimator calibration (2026-07-12). Sample the REAL
                         // prefix size of THIS API call (fresh + cache write + cache read)
                         // and hand it to the context strategy, which accepts exactly one
@@ -5184,10 +5557,22 @@ export class AgentFramework {
                 durationMs,
             });
             this.abortAgentScript(agent.name, 'stream threw');
+            lifecyclePhase = 'failed'; // §10.5 — terminal emitted in finally
             agent.reset();
             this.eventGate?.onInferenceEnded(agent.name);
         }
         finally {
+            // §10.5: exactly one terminal per `started`, on every exit path the
+            // host controls. Which one was decided by the path taken (default
+            // completed; catch → failed; framework-cancel → aborted). A host
+            // crash emits nothing — that is the documented best-effort limit, and
+            // why consumers keep their safety timeout.
+            this.hookOrchestrator?.emitLifecycle({
+                inferenceId: outgoingInferenceId,
+                conversationId: agent.name,
+                turnIndex: 0,
+                phase: lifecyclePhase,
+            });
             // Clear the gate's inference flag on EVERY exit path (paired with the
             // onInferenceStarted in startAgentStream). The branch-level calls above
             // are kept but are best-effort; if any exit path bypassed them the agent
@@ -5594,8 +5979,12 @@ export class AgentFramework {
             ? 'null'
             : JSON.stringify(payload, null, 1) ?? String(payload);
         const agent = this.agents.get(record.agentName);
-        const maxChars = agent ? this.getMaxToolResultChars(agent) : undefined;
-        const payloadText = await this.spillOrTruncate(payloadJson, maxChars, `${record.id}-wake${record.wakes}`);
+        // Same resolved cap as tool results (override applies here too); an
+        // unknown agent still gets the bounded house default, never unbounded.
+        const maxChars = agent
+            ? this.resolveToolResultInlineCap(agent).cap
+            : DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS;
+        const { text: payloadText } = await this.spillOrTruncate(payloadJson, maxChars, `${record.id}-wake${record.wakes}`);
         const envelope = `[background script ${record.id}] Woke you: wake_agent() called at line ${line} of your script, ` +
             `${elapsedMin}m after you started it (wake ${record.wakes} of ${maxWakes}).\n` +
             `Arguments:\n${payloadText}\n` +
@@ -5664,41 +6053,89 @@ export class AgentFramework {
         }
     }
     /**
-     * Oversized content policy (antra, 2026-07-31): never hit the agent in
-     * the face with a huge blob, never silently destroy it either. Content
-     * over the inline cap is materialized to a workspace file (readable with
-     * the agent's own tools) and replaced by a truncated head + a trailing
-     * file reference. Falls back to plain truncation when there is no
-     * writable workspace. The cap can be lifted temporarily via
-     * agent_settings `tool_result_inline_max_chars`.
+     * Oversized content policy (antra, 2026-07-31; completed for issue #89):
+     * never hit the agent in the face with a huge blob, never silently destroy
+     * it either. Content over the inline cap is materialized to a workspace
+     * file (readable with the agent's own tools — deterministic name, kept
+     * until the workspace owner deletes it) and replaced by a truncated head +
+     * a trailing file reference. Falls back to EXPLICIT plain truncation when
+     * there is no writable workspace. Cap resolution lives in
+     * resolveToolResultInlineCap; callers pass the resolved cap.
      */
-    async spillOrTruncate(content, maxChars, label, agentName) {
-        const override = agentName !== undefined
-            ? this.toolResultInlineMaxCharsOverride.get(agentName)
-            : undefined;
-        const cap = override ?? maxChars;
+    /**
+     * One spill policy for every stored tool_result block: serialize (history
+     * serializer — image blocks become placeholders), then spill/truncate at
+     * the resolved cap. Errors follow the same policy as successes — a giant
+     * error string is exactly as context-hostile as a giant success (issue
+     * #89). Returns the stored blocks plus the per-call spill outcomes so the
+     * live wire copy can reuse the identical strings.
+     */
+    async buildStoredToolResultContent(toolResults, maxChars) {
+        const spilled = new Map();
+        const dateLabel = new Date().toISOString().slice(0, 10);
+        for (const tc of toolResults) {
+            const raw = tc.result.isError
+                ? tc.result.error ?? 'Unknown error'
+                : toolResultDataToHistoryString(tc.result.data, undefined);
+            spilled.set(tc.id, await this.spillOrTruncate(raw, maxChars, `${dateLabel}-${tc.id}`));
+        }
+        const blocks = toolResults.map(tc => ({
+            type: 'tool_result',
+            toolUseId: tc.id,
+            content: spilled.get(tc.id).text,
+            isError: tc.result.isError,
+        }));
+        return { blocks, spilled };
+    }
+    async spillOrTruncate(content, cap, label) {
         if (!cap || content.length <= cap)
-            return content;
+            return { text: content, filePath: null };
         const workspace = this.getWorkspaceModule();
         const mountName = workspace ? this.firstWritableMountName(workspace) : null;
         if (workspace && mountName) {
             const safeLabel = label.replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 80);
             const path = `${mountName}/tool-results/${safeLabel}.txt`;
+            let failure;
             try {
                 const result = await workspace.writeBinary(path, Buffer.from(content, 'utf8'), 'text/plain');
                 if (result.success) {
-                    return safeSlice(content, 0, cap)
-                        + `\n\n[truncated — showing ${cap} of ${content.length} chars; full content: workspace file ${path}. `
-                        + 'Read/grep it with your file tools, or raise the inline cap temporarily via '
-                        + 'agent_settings update tool_result_inline_max_chars.]';
+                    return {
+                        text: safeSlice(content, 0, cap)
+                            + `\n\n[truncated — showing ${cap} of ${content.length} chars; full content: workspace file ${path}. `
+                            + 'Read/grep it with your file tools, or raise the inline cap via '
+                            + 'agent_settings update tool_result_inline_max_chars.]',
+                        filePath: path,
+                    };
                 }
+                failure = result.error ?? 'write refused';
             }
-            catch {
-                // fall through to plain truncation
+            catch (err) {
+                failure = err instanceof Error ? err.message : String(err);
             }
+            // A workspace was there and the write FAILED — say that, loudly and
+            // distinctly. Telling the agent "no writable workspace" would teach
+            // them their residence lacks a capability it actually has.
+            failure = failure.slice(0, 200);
+            this.emitTrace({
+                type: 'tool:spill_failed',
+                label: safeLabel,
+                path,
+                contentLength: content.length,
+                error: failure,
+            });
+            console.error(`[spill] workspace write failed for ${path} (${content.length} chars): ${failure}`);
+            return {
+                text: safeSlice(content, 0, cap)
+                    + `\n\n[truncated — showing ${cap} of ${content.length} chars; spill to workspace file ${path} FAILED`
+                    + ` (${failure}); content over the cap was not retained]`,
+                filePath: null,
+            };
         }
-        return safeSlice(content, 0, cap)
-            + '\n\n[truncated — original was ' + content.length + ' chars]';
+        return {
+            text: safeSlice(content, 0, cap)
+                + '\n\n[truncated — original was ' + content.length + ' chars; no writable workspace, full content not retained]',
+            filePath: null,
+        };
     }
     getOrCreateScriptRunner(agentName) {
         let runner = this.codeExecutionRunners.get(agentName);
@@ -5793,22 +6230,28 @@ export class AgentFramework {
         }
     }
     toMembraneToolResult(callId, afResult, maxChars, 
-    /** Pre-spilled string from the history path — used for the non-image
+    /** Pre-spilled outcome from the history path — used for the non-image
      *  path so the live wire copy byte-matches what the window stored. */
     precomputed) {
         if (afResult.isError) {
-            return { toolUseId: callId, content: afResult.error ?? 'Unknown error', isError: true };
+            // Same spill policy as successes: reuse the history copy so a giant
+            // error string stays bounded on the wire too (byte-matched).
+            return {
+                toolUseId: callId,
+                content: precomputed?.text ?? truncateForHistory(afResult.error ?? 'Unknown error', DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS),
+                isError: true,
+            };
         }
         // MCPL tool results arrive as `data: McpToolResultContent[]` — preserve image
         // blocks natively rather than JSON-stringifying them away. Anything else
         // (objects, scalars) falls through to JSON. The error path was handled
         // above, so isError is always false on these return paths.
-        const blocks = this.tryNativeToolResultContent(afResult.data, maxChars);
+        const blocks = this.tryNativeToolResultContent(afResult.data, maxChars, precomputed?.filePath ?? null);
         if (blocks) {
             return { toolUseId: callId, content: blocks, isError: false };
         }
         if (precomputed !== undefined) {
-            return { toolUseId: callId, content: precomputed, isError: false };
+            return { toolUseId: callId, content: precomputed.text, isError: false };
         }
         // JSON.stringify returns the VALUE undefined (not a string) for undefined
         // input — a module tool returning `{ success: true }` with no data would
@@ -5827,7 +6270,10 @@ export class AgentFramework {
      * `maxChars`, when provided, caps each accompanying text block so an image
      * inlined alongside an enormous text payload can't blow the context.
      */
-    tryNativeToolResultContent(data, maxChars) {
+    tryNativeToolResultContent(data, maxChars, 
+    /** Spill file written by the history path — referenced from truncation
+     *  notices so an image-adjacent giant text block stays recoverable. */
+    spillPath = null) {
         if (!Array.isArray(data))
             return null;
         let hasImage = false;
@@ -5840,7 +6286,9 @@ export class AgentFramework {
                 let text = b.text;
                 if (maxChars && text.length > maxChars) {
                     text = safeSlice(text, 0, maxChars)
-                        + '\n\n[truncated — original was ' + text.length + ' chars]';
+                        + '\n\n[truncated — original was ' + text.length + ' chars'
+                        + (spillPath ? `; full serialized result: workspace file ${spillPath}` : '')
+                        + ']';
                 }
                 blocks.push({ type: 'text', text });
             }
@@ -5857,13 +6305,39 @@ export class AgentFramework {
         }
         return hasImage ? blocks : null;
     }
-    getMaxToolResultChars(agent) {
+    /** Strategy-derived per-message bound (maxMessageTokens * 4 chars). */
+    strategyDerivedToolResultChars(agent) {
         const strategy = agent.getContextManager().getStrategy();
         const maxTokens = strategy.maxMessageTokens;
         if (maxTokens && maxTokens > 0)
             return maxTokens * 4;
         return undefined;
     }
+    /**
+     * Effective tool-result inline cap for an agent, with provenance. Desired
+     * value: resident's durable agent_settings value → residence
+     * FrameworkConfig.toolResultInlineMaxChars → house default (5000).
+     * Effective value: min(desired, strategy bound) for EVERY source — the
+     * strategy's per-message safety limit is a ceiling, not a suggestion
+     * (Sol's #94 ruling: a durable preference must not be a durable path for
+     * one tool result to exceed maxMessageTokens; the way to see the whole
+     * result is the spill file, not an over-bound blob in live context).
+     */
+    resolveToolResultInlineCap(agent) {
+        const override = this.toolResultInlineMaxCharsOverride.get(agent.name);
+        const configured = this.toolResultInlineMaxCharsConfig;
+        const desired = override ?? configured ?? DEFAULT_TOOL_RESULT_INLINE_MAX_CHARS;
+        const source = override !== undefined
+            ? 'agent-settings-override'
+            : configured !== null ? 'framework-config' : 'default';
+        const strategyBound = this.strategyDerivedToolResultChars(agent);
+        const clamped = strategyBound !== undefined && strategyBound < desired;
+        return {
+            cap: clamped ? strategyBound : desired,
+            source,
+            clampedBy: clamped ? 'strategy-bound' : null,
+        };
+    }
     approximateDecodedBase64Bytes(base64) {
         const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
         return Math.max(0, Math.floor(base64.length * 3 / 4) - padding);
@@ -6017,6 +6491,26 @@ export class AgentFramework {
         // synthesized channel tools, but they aren't `channel_`-prefixed so they
         // need an explicit route here.
         if ((enrichedCall.name === 'think' || enrichedCall.name === 'skip_reply') && this.channelRegistry) {
+            // skip_reply(wake_in_seconds): arm a gate self-wake so "not replying
+            // NOW" can also mean "back in a moment" — ends the turn, then wakes
+            // the agent after N seconds unless something else wakes it first
+            // (any turn start cancels the pending self-wake). Armed here because
+            // the framework owns the EventGate; the registry only words the
+            // confirmation. Without a gate the field is stripped so that
+            // confirmation never claims a wake that can't happen.
+            if (enrichedCall.name === 'skip_reply') {
+                const inputObj = (enrichedCall.input ?? {});
+                const secs = Number(inputObj.wake_in_seconds);
+                const wants = inputObj.wake_in_seconds !== undefined && Number.isFinite(secs) && secs > 0;
+                if (wants && this.eventGate) {
+                    const { inMs } = this.eventGate.armSelfWake(agentName, secs, 'skip_reply');
+                    console.error(`[self-wake] agent=${agentName} armed in ${Math.round(inMs / 1000)}s (skip_reply)`);
+                }
+                else if (inputObj.wake_in_seconds !== undefined && !this.eventGate) {
+                    delete inputObj.wake_in_seconds;
+                    console.error(`[self-wake] agent=${agentName} wake_in_seconds requested but no EventGate — ignored`);
+                }
+            }
             this.dispatchChannelToolCall(agentName, enrichedCall);
             return;
         }
@@ -6539,7 +7033,6 @@ export class AgentFramework {
     async initializeMcpl(serverConfigs, inferenceRouting) {
         this.mcplServerRegistry = new McplServerRegistry();
         this.featureSetManager = new FeatureSetManager();
-        this.scopeManager = new ScopeManager();
         this.hookOrchestrator = new HookOrchestrator(this.mcplServerRegistry, this.featureSetManager);
         // Build prefix map and store configs for tool routing
         for (const config of serverConfigs) {
@@ -6625,12 +7118,32 @@ export class AgentFramework {
         });
         // Host capabilities advertised during the MCP handshake — stored so
         // servers can also be connected later at runtime (connectMcplServer).
+        // §5.2: the host advertises what it actually implements. 0.5.0-draft:
+        // afterInference is GONE (replaced by inference/lifecycle, §10.5), and
+        // the previously under-advertised inferenceRequest + channels — both
+        // implemented for years — are declared (AUDIT-001/issue #76 item 12).
         this.mcplHostCapabilities = {
-            version: '0.4',
+            version: '0.5',
             pushEvents: true,
             contextHooks: {
                 beforeInference: true,
-                afterInference: { blocking: true },
+            },
+            inferenceLifecycle: true,
+            // modelInfo is NOT advertised: §12.2's result requires all four of
+            // {id, vendor, contextWindow, capabilities} and the host has no
+            // truthful source for contextWindow/capabilities (grep: none exists).
+            // Advertising a capability answered with a malformed partial response
+            // is worse than honest unsupported (Sol, PR #79 re-review). The
+            // handler below answers an explicit error rather than hanging (§6.6).
+            inferenceRequest: { streaming: true },
+            channels: {
+                register: true,
+                lifecycle: true,
+                publish: true,
+                incoming: true,
+                streaming: true,
+                acknowledge: true,
+                typing: true,
             },
             featureSets: true,
         };
@@ -6963,27 +7476,210 @@ export class AgentFramework {
         // Wire listeners before either startup staging or the runtime global gate
         // releases control traffic needed for registration and marker service.
         this.wireMcplEvents(connection);
-        // Initialize feature sets if server advertises MCPL capabilities
-        this.registerMcplServerFeatures(config, connection);
         if (deferAwareness) {
+            // Staged startup: both planes are closed, so the §5.3 policy
+            // round-trip cannot let any buffered traffic slip — establish the
+            // grant now, before staging ever releases.
+            await this.registerMcplServerFeatures(config, connection);
             this.emitTrace({ type: 'module:added', moduleName: `mcpl:${config.id}` });
             return;
         }
         const awarenessBarrier = this.installMcplDataPlaneGate();
-        this.releaseMcplDataPlaneGate(awarenessBarrier);
+        // NO early release: both planes stay closed through accounting AND the
+        // §5.3 policy round-trip below (PR #79 review blocker 3 — the early
+        // control flush released channels-register/changed before any grant
+        // existed). The awareness drain rides tools/call RESPONSES, which are
+        // never event-buffered, so it needs no plane release to make progress.
         try {
             await awarenessBarrier.promise;
-            this.completeMcplDataPlaneGate(awarenessBarrier);
         }
         catch (error) {
             // Startup cannot fail open on a broken awareness ledger. Disable the
             // reconnecting stub/connection before propagating the distinct error to
             // initializeMcpl, which tears down any other servers and aborts create().
+            // Ordering matters: awareness accounting settles BEFORE the §5.3
+            // policy round-trip below, so an accounting failure aborts with the
+            // grant still empty and every buffered event still behind the gate —
+            // a failed startup never reports a released data plane. (The reverse
+            // order let a push arrive during the policy await and get flushed by
+            // teardown.)
             await connection.close().catch(() => { });
             throw error;
         }
+        // §5.3 initial policy handshake — after accounting, before the gate
+        // completes: the grant is established (or knowingly left empty) before
+        // ANY buffered traffic (control or data) flows. complete() then
+        // ready()s both planes through the admission gate.
+        await this.registerMcplServerFeatures(config, connection);
+        this.completeMcplDataPlaneGate(awarenessBarrier);
         this.emitTrace({ type: 'module:added', moduleName: `mcpl:${config.id}` });
     }
+    /** Per-connection §17.8 fetch limiter: at most one in-flight fetch, at
+     *  most one queued behind it (announcements coalesce), floor between
+     *  completed fetches. Exceeding the floor drops the excess with a
+     *  diagnostic — the host bounds the rate; it never depends on server
+     *  coalescing. */
+    manifestRefreshState = new Map();
+    static MANIFEST_FETCH_FLOOR_MS = 5_000;
+    /**
+     * §17.5 host processing: fetch the complete manifest, validate exactly as
+     * at initialize, diff, apply §6.7 consequences (removals eagerly even
+     * when other declarations are invalid; additions only through
+     * tell→receipt→activate), emit ONE change receipt (§17.6).
+     */
+    async handleManifestChanged(connection, announce) {
+        const st = this.manifestRefreshState.get(connection.id)
+            ?? { inFlight: false, queued: false, lastCompletedAt: 0 };
+        this.manifestRefreshState.set(connection.id, st);
+        if (st.inFlight) {
+            // Coalesce: one queued refresh re-runs after the current fetch — the
+            // fetch is always of the CURRENT manifest, so N announcements need at
+            // most one trailing fetch (§17.8).
+            st.queued = true;
+            return;
+        }
+        const sinceLast = Date.now() - st.lastCompletedAt;
+        if (sinceLast < AgentFramework.MANIFEST_FETCH_FLOOR_MS) {
+            if (!st.queued) {
+                st.queued = true;
+                setTimeout(() => {
+                    const cur = this.manifestRefreshState.get(connection.id);
+                    if (cur?.queued && !cur.inFlight) {
+                        cur.queued = false;
+                        void this.handleManifestChanged(connection, announce).catch(() => { });
+                    }
+                }, AgentFramework.MANIFEST_FETCH_FLOOR_MS - sinceLast).unref?.();
+            }
+            return;
+        }
+        st.inFlight = true;
+        try {
+            const config = this.mcplServerConfigs.get(connection.id);
+            if (!config)
+                return;
+            // §17.4 fetch. A server that cannot answer keeps its previous
+            // manifest in force — an unparseable/failed fetch teaches nothing and
+            // narrows nothing (§17.5 step 1).
+            let fetched;
+            try {
+                fetched = await connection.sendManifestRequest();
+            }
+            catch (err) {
+                console.error(`[mcpl] ${connection.id}: mcpl/manifest fetch failed — previous manifest stands (§17.5): ${err instanceof Error ? err.message : err}`);
+                return;
+            }
+            if (!fetched || typeof fetched !== 'object') {
+                console.error(`[mcpl] ${connection.id}: mcpl/manifest returned no object — previous manifest stands (§17.5)`);
+                return;
+            }
+            // Validate exactly as at initialize: expand §5.1 shorthand, apply the
+            // config mask, recompute the grant. Unknown names mint nothing;
+            // invalid declarations fail closed in derivation — and REMOVALS still
+            // apply, because the new grant/derivation simply lacks whatever no
+            // longer validates (§17.5 step 1's partial-invalid rule falls out of
+            // computing forward from the fetched content).
+            const expanded = expandAdvertisementShorthand(fetched);
+            const { capabilities: masked, dropped } = maskNegotiatedCapabilities(expanded, config);
+            const newGrant = computeGrant(masked, config, { mcpToolsAdvertised: connection.mcpToolsAdvertised });
+            const oldEffective = new Set(connection.grant.effectiveList());
+            const newEffective = new Set(newGrant.effectiveList());
+            const revoked = [...oldEffective].filter((p) => !newEffective.has(p)).sort();
+            const added = [...newEffective].filter((p) => !oldEffective.has(p)).sort();
+            const oldDeclared = Object.keys(this.featureSetManager?.getDeclaredFeatureSets(connection.id) ?? {});
+            const oldEnabled = oldDeclared.filter((n) => this.featureSetManager?.isEnabled(connection.id, n));
+            // §6.7 REDUCTION FIRST, atomically, before the server is told:
+            // security cannot wait on consent. The interim grant is new∩old — no
+            // revoked path survives, no added path activates yet.
+            const hadReduction = revoked.length > 0;
+            if (hadReduction) {
+                const interim = new CapabilityGrant(new Set([...newEffective].filter((p) => oldEffective.has(p))), [...newGrant.deniedPaths]);
+                connection.establishGrant(interim);
+            }
+            // PHASE 1 — pre-receipt: live feature state derives from ACTIVE
+            // authority (the interim grant when reduced, the standing grant
+            // otherwise), never from the unactivated full grant. Feature state
+            // must obey the same §6.7 ordering the grant does: a newly added
+            // capability-backed feature set cannot be host-enabled while its
+            // capability is still absent from the active grant (Sol, PR #84
+            // review). Declarations come from the fetched manifest either way —
+            // a set absent from the new manifest is gone regardless.
+            const cfg = { enabledFeatureSets: config.enabledFeatureSets, disabledFeatureSets: config.disabledFeatureSets };
+            const maskedOrEmpty = masked ?? { version: '0.5' };
+            this.featureSetManager.initializeServer(connection.id, maskedOrEmpty, cfg, connection.grant);
+            // The Request DESCRIBES the proposed new policy — derived from the
+            // full new grant on a scratch manager, installing nothing.
+            const updateParams = new FeatureSetManager().initializeServer(connection.id, maskedOrEmpty, cfg, newGrant);
+            updateParams.effectiveCapabilities = newGrant.effectiveList();
+            if (newGrant.deniedPaths.length > 0)
+                updateParams.deniedCapabilities = [...newGrant.deniedPaths];
+            // Tell → receipt → activate (§6.7). PHASE 2 by outcome:
+            //  accepted  → full grant + full-derived feature state;
+            //  refused   → honor fallback: 'close' closes the transport;
+            //              'mcp-only' (or absent) = empty grant + empty-derived
+            //              feature state, mirroring the §5.3 initial path;
+            //  unanswered → interim grant and interim-derived state stand.
+            let negotiated = false;
+            try {
+                const receipt = await connection.sendFeatureSetsUpdateRequest(updateParams);
+                if (receipt && receipt.accepted === false) {
+                    const fallback = receipt.fallback ?? 'mcp-only';
+                    console.error(`[mcpl] ${connection.id} refused post-manifest policy — fallback: ${fallback}`);
+                    if (fallback === 'close') {
+                        await connection.close();
+                        return;
+                    }
+                    connection.establishGrant(CapabilityGrant.empty());
+                    this.featureSetManager.initializeServer(connection.id, maskedOrEmpty, cfg, CapabilityGrant.empty());
+                }
+                else {
+                    connection.establishGrant(newGrant);
+                    this.featureSetManager.initializeServer(connection.id, maskedOrEmpty, cfg, newGrant);
+                    connection.manifestState.lastNegotiatedAt = Date.now();
+                    negotiated = true;
+                }
+            }
+            catch {
+                console.error(`[mcpl] ${connection.id} did not answer post-manifest policy — expansion does not activate (§6.7); interim state stands`);
+            }
+            // Adopt the validated manifest + tracking. droppedCapabilities is
+            // REPLACED unconditionally — an empty new mask must clear stale paths
+            // (Sol, PR #84 review).
+            connection.capabilities = masked;
+            connection.manifestState.lastValidatedRevision =
+                typeof fetched.revision === 'string'
+                    ? fetched.revision : null;
+            connection.manifestState.lastFetchedAt = Date.now();
+            connection.droppedCapabilities = new Set(dropped);
+            const newDeclared = Object.keys(this.featureSetManager?.getDeclaredFeatureSets(connection.id) ?? {});
+            const newEnabled = newDeclared.filter((n) => this.featureSetManager?.isEnabled(connection.id, n));
+            const degraded = oldEnabled.filter((n) => !newEnabled.includes(n)).sort();
+            const restored = newEnabled.filter((n) => !oldEnabled.includes(n)).sort();
+            // §17.6: ONE receipt per manifest change, closed host-derived impact
+            // vocabulary, never a server-authored flag.
+            const impacts = [
+                ...revoked.map((p) => ({ impact: 'capability-revoked', subject: p, disposition: 'applied' })),
+                ...added.map((p) => ({ impact: 'capability-expansion-pending', subject: p, disposition: negotiated ? 'applied' : 'decision-needed' })),
+                ...degraded.map((n) => ({ impact: 'feature-degraded', subject: n, disposition: 'applied' })),
+                ...restored.map((n) => ({ impact: 'feature-restored', subject: n, disposition: negotiated ? 'applied' : 'decision-needed' })),
+            ];
+            this.emitTrace({
+                type: 'mcpl:manifest-change-receipt',
+                serverId: connection.id,
+                revision: connection.manifestState.lastValidatedRevision,
+                announcedDomains: announce.domains ?? [],
+                impacts,
+            });
+            this.handleToolsListChanged(connection.id);
+        }
+        finally {
+            st.inFlight = false;
+            st.lastCompletedAt = Date.now();
+            if (st.queued) {
+                st.queued = false;
+                setTimeout(() => { void this.handleManifestChanged(connection, announce).catch(() => { }); }, AgentFramework.MANIFEST_FETCH_FLOOR_MS).unref?.();
+            }
+        }
+    }
     /**
      * (Re-)establish a server's host-side MCPL registration: feature-set state
      * (plus the featureSets/update sent to the server), scope patterns, and
@@ -6999,20 +7695,62 @@ export class AgentFramework {
      * already has a tree), so checkpoint trees preserved across a transient
      * disconnect are resumed, not reset.
      */
-    registerMcplServerFeatures(config, connection) {
+    async registerMcplServerFeatures(config, connection) {
         if (!connection.capabilities)
             return;
+        // §5.4: compute the effective grant from the (config-masked)
+        // advertisement. Not yet active — expansion activates only after the
+        // receipt (§6.7); until then the connection's grant is empty and every
+        // privileged inbound method is rejected.
+        const grant = computeGrant(connection.capabilities, config, { mcpToolsAdvertised: connection.mcpToolsAdvertised });
         const updateParams = this.featureSetManager.initializeServer(config.id, connection.capabilities, {
             enabledFeatureSets: config.enabledFeatureSets,
             disabledFeatureSets: config.disabledFeatureSets,
-        });
-        // Inform server which feature sets are enabled/disabled
-        if (updateParams.enabled?.length || updateParams.disabled?.length) {
-            connection.sendFeatureSetsUpdate(updateParams);
+        }, grant);
+        // §5.3: initial policy MUST be a Request, MUST precede first fan-out,
+        // and MUST be sent even when nothing is enabled or disabled — a server
+        // defaulted to fully disabled has to be told. The response is a
+        // degradation receipt (§6.7): consequence testimony, never policy
+        // authority — nothing in it may widen the grant.
+        updateParams.effectiveCapabilities = grant.effectiveList();
+        if (grant.deniedPaths.length > 0) {
+            updateParams.deniedCapabilities = [...grant.deniedPaths];
+        }
+        try {
+            const receipt = await connection.sendFeatureSetsUpdateRequest(updateParams);
+            if (receipt && receipt.accepted === false) {
+                const fallback = receipt.fallback ?? 'mcp-only';
+                console.error(`[mcpl] ${config.id} refused initial policy (${receipt.reason ?? 'no reason'}) — fallback: ${fallback}`);
+                if (fallback === 'close') {
+                    await connection.close();
+                    return;
+                }
+                // mcp-only (§3.2): grant stays empty, MCPL privileged surface stays
+                // dark, plain MCP tools keep working. MUST NOT widen in response to
+                // the refusal — a human can change config; the policy engine cannot.
+                return;
+            }
+            // Expansion activates on receipt (§6.7).
+            connection.establishGrant(grant);
+            if (receipt?.accepted === true && receipt.mode === 'degraded') {
+                for (const uf of receipt.unavailableFeatures ?? []) {
+                    console.error(`[mcpl] ${config.id} degraded: ${uf.featureSet} (${uf.effect}; missing ${uf.missingCapabilities.join(', ')})`);
+                }
+            }
+        }
+        catch (err) {
+            // A pre-0.5 server treats the Request as a notification and never
+            // answers. §6.7: an unanswered expansion simply does not activate —
+            // grant stays empty, connection is effectively MCP-only. This WILL
+            // dark every un-migrated MCPL server's privileged surface; accepted
+            // deliberately for the single-release rollout (issue #76 item 9).
+            console.error(`[mcpl] ${config.id} did not answer the initial policy Request — ` +
+                `MCPL privileged surface stays disabled (§6.7 unanswered expansion): ` +
+                (err instanceof Error ? err.message : String(err)));
+            return;
         }
-        // Configure scope whitelist/blacklist patterns
         if (config.scopes) {
-            this.scopeManager.configureAll(config.scopes);
+            console.error(`[mcpl] ${config.id}: config \`scopes\` is ignored — §7 Scoped Access removed in 0.5.0`);
         }
         // Register stateful feature sets with checkpoint manager (Step 8)
         if (this.checkpointManager) {
@@ -7109,11 +7847,21 @@ export class AgentFramework {
         for (const [id, config] of this.mcplServerConfigs) {
             const prefix = config.toolPrefix ?? `mcpl--${id}`;
             const connection = this.mcplServerRegistry?.getServer(id) ?? null;
+            const connected = connection?.isConnected ?? false;
             result.push({
                 id,
-                connected: connection?.isConnected ?? false,
+                connected,
+                retrying: !connected && (connection?.willReconnect ?? false),
                 toolPrefix: prefix,
                 toolCount: this.mcplTools.filter(t => t.name.startsWith(`${prefix}--`)).length,
+                policyEstablished: connection?.policyEstablished ?? false,
+                effectiveGrant: connection?.grant.effectiveList() ?? [],
+                maskedCapabilities: [...(connection?.droppedCapabilities ?? [])].sort(),
+                deniedCapabilities: [...(connection?.grant.deniedPaths ?? [])].sort(),
+                allowHostCommands: config.allowHostCommands === true,
+                manifestState: connection
+                    ? { ...connection.manifestState }
+                    : { lastValidatedRevision: null, lastFetchedAt: null, lastNegotiatedAt: null },
                 command: config.command,
                 url: config.url,
             });
@@ -7130,23 +7878,14 @@ export class AgentFramework {
         connection.on('stderr', (params) => {
             this.emitTrace({ type: 'mcpl:server-stderr', serverId: connection.id, line: params.line });
         });
-        // Handle dynamic feature set changes from server
-        connection.on('feature-sets-changed', (params) => {
-            this.featureSetManager?.handleFeatureSetsChanged(connection.id, params);
-        });
+        // featureSets/changed is REMOVED in 0.5.0 — the connection answers it
+        // -32601 (superseded by SPEC §17's host-diffed manifest fetch); no
+        // listener, and nothing mutates declarations off a server-authored
+        // change payload.
         // Handle scope elevation requests
-        connection.on('scope-elevate', async (params, responder) => {
-            if (this.scopeManager && responder) {
-                try {
-                    const result = await this.scopeManager.handleElevation(params);
-                    responder.respond(result);
-                }
-                catch (error) {
-                    const err = error instanceof Error ? error : new Error(String(error));
-                    responder.respondError(-32603, err.message);
-                }
-            }
-        });
+        // §7 Scoped Access is removed in 0.5.0. scope/elevate is answered
+        // -32601 at the connection (server-connection.ts) and never reaches the
+        // framework; the ScopeManager and config `scopes` wiring went with it.
         // Handle push events (Step 6)
         connection.on('push-event', async (params, responder) => {
             const barrier = this.discordAwarenessBarrier;
@@ -7171,9 +7910,36 @@ export class AgentFramework {
         connection.on('channels-register', async (params, responder) => {
             await this.channelRegistry?.handleRegister(connection.id, params, responder);
         });
-        // Handle channel changes (Step 7)
-        connection.on('channels-changed', async (params) => {
-            await this.channelRegistry?.handleChanged(connection.id, params);
+        // Handle channel changes (Step 7) — §14.5 dual-mode: the responder is
+        // present for the Request form and carries itemized added-descriptor
+        // results; absent for Notifications, where rejection is itemwise
+        // filtering plus a diagnostic trace.
+        connection.on('channels-changed', async (params, responder) => {
+            await this.channelRegistry?.handleChanged(connection.id, params, responder);
+        });
+        // §6.6/§12: requests that previously had no handler and hung forever
+        // (AUDIT-001 item 4). The connection-level grant gate has already run.
+        // §17.3: a manifest-change announcement. Rate-limited re-fetch → diff
+        // → §6.7 consequences → one receipt. The announcement itself carries no
+        // payload and no authority; everything below acts on FETCHED content.
+        connection.on('manifest-changed', (params) => {
+            void this.handleManifestChanged(connection, params).catch((err) => {
+                console.error(`[mcpl] ${connection.id} manifest refresh failed:`, err instanceof Error ? err.message : err);
+            });
+        });
+        connection.on('channels-list', (_params, responder) => {
+            responder?.respond({
+                channels: this.channelRegistry?.descriptorsForServer(connection.id) ?? [],
+            });
+        });
+        connection.on('model-info', (_params, responder) => {
+            // §12.2 requires ALL FOUR of {id, vendor, contextWindow, capabilities}
+            // in the DIRECT result shape, and numeric contextWindow cannot express
+            // "unknown". The host has no truthful source for it, so modelInfo is
+            // not advertised and this answers an explicit error instead of a
+            // malformed partial (§6.6: a method that will never be answered
+            // truthfully MUST error, not fabricate).
+            responder?.respondError?.(-32601, 'model/info unavailable: host does not advertise modelInfo (no truthful contextWindow source)');
         });
         // Handle incoming channel messages (Step 7)
         connection.on('channels-incoming', async (params, responder) => {
@@ -7222,17 +7988,23 @@ export class AgentFramework {
             // reconnect observes it before doing work that could wake an agent. The
             // connection paused its data plane before wiring the fresh transport.
             const awarenessBarrier = this.installMcplDataPlaneGate();
-            try {
-                const config = this.mcplServerConfigs.get(connection.id);
-                if (config) {
-                    this.registerMcplServerFeatures(config, connection);
+            // Async: the §5.3 policy Request must be answered (re-establishing the
+            // grant) before the data-plane barrier releases — otherwise the first
+            // post-reconnect events land while the grant is still empty and are
+            // rejected fail-closed instead of delivered.
+            void (async () => {
+                try {
+                    const config = this.mcplServerConfigs.get(connection.id);
+                    if (config) {
+                        await this.registerMcplServerFeatures(config, connection);
+                    }
                 }
-            }
-            catch (error) {
-                console.error(`MCPL server "${connection.id}" re-registration after reconnect failed:`, error instanceof Error ? error.message : error);
-            }
-            this.releaseMcplDataPlaneGate(awarenessBarrier);
-            this.handleToolsListChanged(connection.id);
+                catch (error) {
+                    console.error(`MCPL server "${connection.id}" re-registration after reconnect failed:`, error instanceof Error ? error.message : error);
+                }
+                this.releaseMcplDataPlaneGate(awarenessBarrier);
+                this.handleToolsListChanged(connection.id);
+            })();
             void awarenessBarrier.promise.then(() => {
                 if (awarenessBarrier.requiresBarrier
                     && !this.completeMcplDataPlaneGate(awarenessBarrier))
@@ -7328,6 +8100,7 @@ export class AgentFramework {
         if (!this.mcplServerRegistry)
             return;
         const tools = [];
+        const toolFeatureSets = new Map();
         for (const server of this.mcplServerRegistry.getAllServers()) {
             const config = this.mcplServerConfigs.get(server.id);
             const prefix = config?.toolPrefix ?? `mcpl--${server.id}`;
@@ -7336,13 +8109,23 @@ export class AgentFramework {
                 for (const tool of result.tools) {
                     if (!isToolAllowed(tool.name, config))
                         continue;
+                    const namespacedName = `${prefix}--${tool.name}`;
+                    const attributedTool = tool;
+                    const featureSet = typeof attributedTool.featureSet === 'string'
+                        ? attributedTool.featureSet
+                        : typeof attributedTool._meta?.featureSet === 'string'
+                            ? attributedTool._meta.featureSet
+                            : undefined;
                     // MCP tool schemas are generic JSON Schema; cast to membrane's ToolDefinition format
                     const schema = tool.inputSchema;
                     tools.push({
-                        name: `${prefix}--${tool.name}`,
+                        name: namespacedName,
                         description: tool.description ?? '',
                         inputSchema: schema,
                     });
+                    if (featureSet !== undefined) {
+                        toolFeatureSets.set(namespacedName, featureSet);
+                    }
                 }
             }
             catch {
@@ -7350,6 +8133,7 @@ export class AgentFramework {
             }
         }
         this.mcplTools = tools;
+        this.mcplToolFeatureSets = toolFeatureSets;
     }
     /**
      * Handle a tools/list_changed notification with collapse logic.
@@ -7436,21 +8220,41 @@ export class AgentFramework {
         const startTime = Date.now();
         const args = (call.input && typeof call.input === 'object') ? call.input : {};
         // Build state params for stateful tools (Step 8).
-        // Host-managed state is single-valued per server, so inject the host-managed
-        // set's `state` for any call; otherwise fall back to a server-managed set's
-        // opaque `checkpoint`. Never blindly pick "first stateful" — when a server
-        // mixes host-managed (e.g. a feed) and server-managed (e.g. post/undo) sets,
-        // that misattributes the feed's state.
+        // A tools/list attribution selects that exact stateful set. Untagged tools
+        // retain the host-managed or unique server-managed fallback, but never guess
+        // between multiple server-managed sets.
         let stateParams;
+        let attributedFeatureSet = null;
         if (this.checkpointManager) {
-            const hostFs = this.checkpointManager.getHostManagedFeatureSet(serverId);
-            if (hostFs) {
-                stateParams = { state: this.checkpointManager.getCurrentState(serverId, hostFs) };
+            const toolFeatureSet = this.mcplToolFeatureSets.get(call.name);
+            if (toolFeatureSet !== undefined) {
+                if (this.checkpointManager.isHostManaged(serverId, toolFeatureSet)
+                    || this.checkpointManager.getStatefulFeatureSet(serverId, toolFeatureSet) !== null) {
+                    attributedFeatureSet = toolFeatureSet;
+                }
+                else {
+                    console.warn(`[mcpl] Tool "${call.name}" declares unknown or non-stateful feature set ` +
+                        `"${toolFeatureSet}"; skipping state exchange.`);
+                }
             }
             else {
-                const fs = this.checkpointManager.getStatefulFeatureSet(serverId);
-                if (fs) {
-                    const cp = this.checkpointManager.getCurrentCheckpoint(serverId, fs);
+                attributedFeatureSet = this.checkpointManager.getHostManagedFeatureSet(serverId)
+                    ?? this.checkpointManager.getStatefulFeatureSet(serverId);
+                if (attributedFeatureSet === null
+                    && this.checkpointManager.hasAmbiguousServerManagedFeatureSets(serverId)) {
+                    console.warn(`[mcpl] Tool "${call.name}" has no feature-set attribution and server ` +
+                        `"${serverId}" has multiple server-managed stateful feature sets; ` +
+                        'skipping state exchange.');
+                }
+            }
+            if (attributedFeatureSet !== null) {
+                if (this.checkpointManager.isHostManaged(serverId, attributedFeatureSet)) {
+                    stateParams = {
+                        state: this.checkpointManager.getCurrentState(serverId, attributedFeatureSet),
+                    };
+                }
+                else {
+                    const cp = this.checkpointManager.getCurrentCheckpoint(serverId, attributedFeatureSet);
                     if (cp)
                         stateParams = { checkpoint: cp };
                 }
@@ -7461,15 +8265,10 @@ export class AgentFramework {
             const durationMs = Date.now() - startTime;
             this.emitTrace({ type: 'tool:completed', module: `mcpl:${serverId}`, tool: toolName, callId: call.id, durationMs });
             // Record checkpoint from stateful tool response (Step 8).
-            // Attribute to the set the server tagged (result.state.featureSet) first;
-            // else the host-managed set (host-managed checkpoints carry data/patch);
-            // else the single stateful set. Avoids recording a feed checkpoint onto a
-            // server-managed set just because it registered first.
+            // Explicit response attribution is authoritative. Otherwise use the
+            // tool-derived (or safe single-set) attribution chosen before the call.
             if (result.state && this.checkpointManager) {
-                const tagged = result.state.featureSet;
-                const fs = tagged
-                    ?? this.checkpointManager.getHostManagedFeatureSet(serverId)
-                    ?? this.checkpointManager.getStatefulFeatureSet(serverId);
+                const fs = result.state.featureSet ?? attributedFeatureSet;
                 if (fs && this.checkpointManager.isStateful(serverId, fs)) {
                     this.checkpointManager.recordCheckpoint(serverId, fs, result.state);
                 }
@@ -7490,6 +8289,23 @@ export class AgentFramework {
                     this.channelRegistry
                         .openIfClosedForSend(target, serverId)
                         .then(({ status, channelId, label }) => {
+                        // Turn-scoped engagement record (mid-turn re-pin, 2026-07-31
+                        // n=7): a human follow-up in a channel the agent explicitly
+                        // sent into this turn counts as conversationally addressed.
+                        // Recorded here — not eagerly — because injection metadata
+                        // carries the CANONICAL channel id (descriptor form), while
+                        // send args often carry the raw provider id; this callback
+                        // has the resolved form. The already-open path resolves on
+                        // the microtask queue, i.e. before the tool-result event
+                        // that evaluates injections.
+                        if (status !== 'unknown-channel' && status !== 'ambiguous') {
+                            let engaged = this.turnEngagedChannels.get(agentName);
+                            if (!engaged) {
+                                engaged = new Set();
+                                this.turnEngagedChannels.set(agentName, engaged);
+                            }
+                            engaged.add(channelId ?? target);
+                        }
                         if (status === 'opened') {
                             console.error(`[channel] ${agentName}: explicit ${toolName} into closed channel ${target} — opened (send implies engagement)`);
                             this.recordChannelAutoOpenNotice(agentName, [{ channelId: channelId ?? target, label }], 'opened-by-reply');
@@ -7592,17 +8408,37 @@ export class AgentFramework {
             const durationMs = Date.now() - startTime;
             this.emitTrace({ type: 'tool:completed', module: 'channels', tool: call.name, callId: call.id, durationMs });
             // A successful channel_open plants the agent's feet in the opened
-            // channel: pin it as this turn's reply locus so plain-text speech
-            // written right after opening routes THERE. Found live 2026-07-21
-            // (Aria bring-up): open → plain-text reply → "no locus (no
-            // home/active channel, defaultPublishChannel null)" on a turn with
-            // no channel trigger (post-restart continuation). Next turn start
-            // re-resolves the locus as usual (startAgentStream set/delete).
+            // channel. The agent's own deliberate open is the strongest "my next
+            // words go here" signal in the system — stronger than any injection —
+            // so it MOVES the current turn's prose pin (turnLocusPins), not just
+            // the next turn's trigger state. (The original 2026-07-21 Aria fix
+            // set only activeTriggerChannels, which resolveLocus reads at the
+            // NEXT turn's freeze — the turn-frozen refactor had silently
+            // regressed the "reply right after opening" case; found while
+            // mapping the routing logic 2026-07-31, antra-ratified fix.) The
+            // announcement rides THIS TOOL RESULT — model-requested content,
+            // distance zero, the safest role there is — instead of a separate
+            // window notice. lastAnnouncedLocus tracks it so announce-on-change
+            // stays coherent. Locus-mode agents only: explicit mode has no pin.
             if (call.name === 'channel_open' && result?.success) {
                 const opened = result.data?.channelId
                     ?? call.input?.channelId;
-                if (opened)
+                if (opened) {
                     this.activeTriggerChannels.set(agentName, opened);
+                    const openerAgent = this.agents.get(agentName);
+                    if (openerAgent && openerAgent.proseRouting !== 'explicit') {
+                        this.turnLocusPins.set(agentName, opened);
+                        this.lastAnnouncedLocus.set(agentName, opened);
+                        result = {
+                            ...result,
+                            data: {
+                                ...result.data,
+                                routing: 'Your plain speech now lands in this channel. Other channels need an explicit send tool.',
+                            },
+                        };
+                        console.error(`[routing] ${agentName}: channel_open -> pin moved to ${opened} (announced in tool result)`);
+                    }
+                }
             }
             this.pushEvent({
                 type: 'tool-result',
@@ -8314,12 +9150,11 @@ export class AgentFramework {
             conversationId: agent.name,
             turnIndex: 0, // Simplified; needs per-conversation counter TODO
             userMessage: null, // Could extract from trigger context
-            model: {
-                id: agent.model,
-                vendor: 'unknown',
-                contextWindow: 200000,
-                capabilities: ['tools'],
-            },
+            // Truthful fields only (§10.1 honesty over completeness): id is real,
+            // vendor/contextWindow/capabilities have no source in this host and
+            // are omitted rather than fabricated — the hardcoded 200000 was false
+            // for residents configured at 300k/600k.
+            model: { id: agent.model },
             channels: this.channelRegistry?.buildChannelContext(agent.name),
         };
     }