@basein/runner 0.3.19 → 0.3.20

package/dist/record/recorder.d.ts

@@ -197,8 +197,13 @@ export declare function isRecorderHealthReporter(r: Recorder): r is Recorder & R
  * callers must stop recording it. What the caller does *instead* of recording is
  * v2's subject (docs/calculatedReplay.md); stopping is mandatory either way.
  */
-/** Which of a segment's two keys scored against the live step (R-OUT-3). */
-export type MatchKey = "intent" | "firstStep";
+/**
+ * Which of a segment's two keys scored against the live step (R-OUT-3).
+ * `decision`: no score at all — one of the calculated scenarios that can follow
+ * a plan's decision, handed out for the agent's next call (the service's
+ * offer1.md O3).
+ */
+export type MatchKey = "intent" | "firstStep" | "decision";
 /** The cheap model's answer about one live step and one segment (R-VERIFY-1). */
 export interface MatchVerdict {
     model: string;
@@ -406,6 +411,36 @@ export interface IntentMatcher {
     matchIntent(req: IntentMatchRequest, opts?: IntentMatchOptions): Promise<IntentMatchAnswer | null>;
 }
 export declare function isIntentMatcher(r: Recorder): r is Recorder & IntentMatcher;
+/** What a turn sends when a plan of it has stopped at its decision (the service's offer1.md O3). */
+export interface NextScenariosRequest {
+    /** The turn's identity, as a probe sends it (R-HIT-6). */
+    turnId?: string;
+    /** Always true from this runner (R-CALL-28). */
+    supportsCalls?: boolean;
+}
+/**
+ * One calculated scenario that can follow a plan's decision: a hand-out in the
+ * shape of a match, with its own ticket, `key: "decision"`, and the tool of its
+ * first step. The service leaves withheld ones out.
+ */
+export interface NextHandOut extends RunMatch {
+    /** The tool its first served step calls; null when the service could not say. */
+    firstTool?: string | null;
+}
+/** The service's answer: the scenarios, and where the plan's decision is. */
+export interface NextScenariosAnswer {
+    next: NextHandOut[];
+    decisionStep: number | null;
+}
+/**
+ * Optional capability: the calculated scenarios that can follow a decision
+ * (offer1.md O3) need a service. `null` is "none" — an older service (404), a
+ * cool-down, or any failure: the agent then does the work itself, as before.
+ */
+export interface NextScenarioSource {
+    nextScenarios(planId: string, req: NextScenariosRequest, opts?: IntentMatchOptions): Promise<NextScenariosAnswer | null>;
+}
+export declare function isNextScenarioSource(r: Recorder): r is Recorder & NextScenarioSource;
 /**
  * What a matched turn actually cost, reported once per match
  * (docs/calculatedReplay.md §11).

package/dist/record/recorder.js

@@ -20,6 +20,9 @@ export function isServiceProber(r) {
 export function isIntentMatcher(r) {
     return typeof r.matchIntent === "function";
 }
+export function isNextScenarioSource(r) {
+    return typeof r.nextScenarios === "function";
+}
 export function isToolListReporter(r) {
     return typeof r.reportTools === "function";
 }

package/dist/record/remote-recorder.d.ts

@@ -50,7 +50,7 @@
  */
 import { type AuthSession } from "../auth/client.js";
 import { type ServiceHealth } from "../util/service-health.js";
-import type { AnswerCall, AttentionPlan, DisputeAnswer, ExecutionReport, FlushOptions, IntentMatchAnswer, IntentMatchOptions, IntentMatchRequest, Recorder, RecorderHealth, RecorderHealthReporter, RunCreation, RunMatch, RunMetrics, StartRunOptions, StepMetadata, ToolListEntry } from "./recorder.js";
+import type { AnswerCall, AttentionPlan, DisputeAnswer, ExecutionReport, FlushOptions, IntentMatchAnswer, IntentMatchOptions, IntentMatchRequest, NextScenariosAnswer, NextScenariosRequest, Recorder, RecorderHealth, RecorderHealthReporter, RunCreation, RunMatch, RunMetrics, StartRunOptions, StepMetadata, ToolListEntry } from "./recorder.js";
 /**
  * Caps for the free text this recorder sends, in UTF-8 bytes. Tool payloads
  * arrive capped at 64 KiB by their producers; text never passed through one,
@@ -206,6 +206,14 @@ export declare class RemoteRecorder implements Recorder, RecorderHealthReporter
      * waiting, so an abandoned probe does not hold a socket for minutes.
      */
     matchIntent(req: IntentMatchRequest, opts?: IntentMatchOptions): Promise<IntentMatchAnswer | null>;
+    /**
+     * The calculated scenarios that can follow a plan's decision (the service's
+     * offer1.md O3), each handed out with a ticket of its own. Asked once per
+     * decision hand-over, while the agent decides. An older service (404), a
+     * cool-down or any failure answers null: the agent then does the work
+     * itself, exactly as before.
+     */
+    nextScenarios(planId: string, req: NextScenariosRequest, opts?: IntentMatchOptions): Promise<NextScenariosAnswer | null>;
     /**
      * The similar-prompt match for a run's create call (null = fresh run). Like
      * {@link runCreated}, answers null at once while a failure is on record —

package/dist/record/remote-recorder.js

@@ -713,6 +713,36 @@ export class RemoteRecorder {
             return null;
         }
     }
+    /**
+     * The calculated scenarios that can follow a plan's decision (the service's
+     * offer1.md O3), each handed out with a ticket of its own. Asked once per
+     * decision hand-over, while the agent decides. An older service (404), a
+     * cool-down or any failure answers null: the agent then does the work
+     * itself, exactly as before.
+     */
+    async nextScenarios(planId, req, opts = {}) {
+        try {
+            if (!this.mayHotWait())
+                return null;
+            const answer = await this.request("POST", `/scenarios/${encodeURIComponent(planId)}/next`, JSON.stringify(req), { signal: opts.signal, timeoutMs: opts.timeoutMs ?? PROBE_TIMEOUT_MS });
+            const b = answer && typeof answer === "object" ? answer : {};
+            const next = Array.isArray(b.next)
+                ? b.next.filter((n) => !!n && typeof n === "object" && typeof n.scenarioId === "string")
+                : [];
+            return { next, decisionStep: typeof b.decisionStep === "number" ? b.decisionStep : null };
+        }
+        catch (err) {
+            if (!opts.signal?.aborted) {
+                logEvery("recorder.next_scenarios_failed", 30_000, "replay.next_failed", {
+                    error: errText(err),
+                    why: err instanceof ServiceError && err.status === 404
+                        ? "the service has no next scenarios — an older service, or not this account's plan"
+                        : "no next scenarios this time — the agent does the work after the decision",
+                });
+            }
+            return null;
+        }
+    }
     /**
      * The similar-prompt match for a run's create call (null = fresh run). Like
      * {@link runCreated}, answers null at once while a failure is on record —

package/dist/record/switchable-recorder.js

@@ -49,6 +49,8 @@ const NEUTRAL = {
     settledMatch: () => Promise.resolve(null),
     runCreated: () => Promise.resolve({ created: true }),
     matchIntent: () => Promise.resolve(null),
+    // Signed out: no scenario follows a decision (offer1.md O3); the agent goes on.
+    nextScenarios: () => Promise.resolve(null),
     reportExecution: () => undefined,
     backfillContext: () => undefined,
     probeIfFailing: () => undefined,

package/dist/replay/controller.js

@@ -538,7 +538,7 @@ export class ReplayController {
         // command nobody asked for.
         let deriveCtx = ctx;
         if (ctx.recentResults?.length && sinkOfPlan(planned, host?.sinks) === "command") {
-            deriveCtx = { liveCall: ctx.liveCall, agentDay: ctx.agentDay };
+            deriveCtx = { liveCall: ctx.liveCall, agentDay: ctx.agentDay, atDecision: ctx.atDecision };
             logLine("replay.derive_context", {
                 scenario: scenario.id,
                 shell: hasShellStep(planned, host?.sinks) || undefined,
@@ -2352,6 +2352,8 @@ export class ReplayController {
             fetchImpl: this.opts.fetchImpl,
             liveCall: ctx.liveCall,
             recentResults: ctx.recentResults,
+            // A reading for a scenario that follows a plan's decision (offer1.md O4).
+            ...(ctx.atDecision ? { atDecision: ctx.atDecision } : {}),
             // The request itself ends too. Without this a hung service or model held
             // the socket for up to 300 s after every wait on it had given up. Long
             // enough to cover both waits that can use its answer (the arm and the

package/dist/replay/derive.d.ts

@@ -53,6 +53,16 @@ export interface DeriveContext {
      * into the session only after the prompt hook (issue 1212).
      */
     agentDay?: () => AgentDay | undefined;
+    /**
+     * A reading for a scenario that can follow a plan's decision, made while the
+     * agent decides (the service's offer1.md O4): the plan, and its decision
+     * step. With it the service reads this turn's results without a live call,
+     * and the prompt as the user's request. Only the service reads it.
+     */
+    atDecision?: {
+        scenarioId: string;
+        stepIndex: number;
+    };
 }
 /**
  * The service, which derives when this runner has no key of its own

package/dist/replay/derive.js

@@ -347,6 +347,9 @@ async function deriveViaService(opts, service, schema, keys) {
                 // 2023-11-30 …"), which the service turns into the day it reads from
                 // (issue 1212). Older services ignore it.
                 ...(opts.todaySaid ? { todaySaid: opts.todaySaid } : {}),
+                // A reading made at a plan's decision (offer1.md O4): the service then
+                // takes this turn's results with no live call. Older services ignore it.
+                ...(opts.atDecision ? { atDecision: opts.atDecision } : {}),
             }),
             signal: opts.signal ?? timeoutSignal(),
         });

package/dist/replay/reads-only.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Whether a tool call may change something, judged by its name alone — the
+ * runner's copy of the service's own rule (BaseIn src/scenarios/correctionCheck.ts,
+ * `readsOnly`, `commandReadsOnly`, `callMayChange`), kept word for word so the
+ * two never disagree about the same call.
+ *
+ * Used where a call after a plan's decision is the agent starting a way of its
+ * own (the service's offer1.md O7), and where a plan started after a call
+ * would make it a second time (O8). When in doubt, a call is a change: that
+ * only ends a set of scenarios early or keeps a plan from starting, never lets
+ * a second write through.
+ */
+/**
+ * A tool that only reads: Claude Code's read-only tools, then the name — a
+ * reading word and no writing word (`calendar_search_events`, `getJiraIssue`;
+ * `run_sql` no: `run` writes). A name with both (`get_or_create_contact`)
+ * changes something.
+ */
+export declare function readsOnly(toolName: string): boolean;
+/** Whether a shell command only looks: every part of it is a looking command, and nothing is written to a file. */
+export declare function commandReadsOnly(command: string): boolean;
+/**
+ * Whether one call may change something. A Bash call changes nothing only
+ * when its command is there and only looks; any other tool is a change unless
+ * {@link readsOnly} says it only reads — a tool it cannot tell about counts as
+ * a change. `input` is the call's arguments, as an object or as JSON text.
+ */
+export declare function callMayChange(toolName: string, input: unknown): boolean;
+//# sourceMappingURL=reads-only.d.ts.map

package/dist/replay/reads-only.js

@@ -0,0 +1,261 @@
+/**
+ * Whether a tool call may change something, judged by its name alone — the
+ * runner's copy of the service's own rule (BaseIn src/scenarios/correctionCheck.ts,
+ * `readsOnly`, `commandReadsOnly`, `callMayChange`), kept word for word so the
+ * two never disagree about the same call.
+ *
+ * Used where a call after a plan's decision is the agent starting a way of its
+ * own (the service's offer1.md O7), and where a plan started after a call
+ * would make it a second time (O8). When in doubt, a call is a change: that
+ * only ends a set of scenarios early or keeps a plan from starting, never lets
+ * a second write through.
+ */
+/** Built-in tools that only read (Claude Code's). */
+const READ_TOOLS = new Set([
+    "Read",
+    "Grep",
+    "Glob",
+    "LS",
+    "WebFetch",
+    "WebSearch",
+    "NotebookRead",
+    "TodoWrite",
+    "TaskOutput",
+    "BashOutput",
+]);
+/** Built-in tools that change files or run commands (Claude Code's). */
+const CHANGING_BUILTINS = new Set([
+    "Write",
+    "Edit",
+    "MultiEdit",
+    "NotebookEdit",
+    "Bash",
+    "KillShell",
+]);
+// Not `query`, `select` or `check`: a database query, a selected option, a
+// check-in can change something.
+const READ_WORDS = new Set([
+    "list",
+    "get",
+    "search",
+    "find",
+    "read",
+    "fetch",
+    "lookup",
+    "count",
+    "view",
+    "show",
+    "describe",
+    "retrieve",
+    "browse",
+    "peek",
+    "inspect",
+    "snapshot",
+]);
+/**
+ * A word that may change something: a name holding one writes, whatever else
+ * it says (`get_or_create_contact`, `find_and_replace`).
+ */
+const WRITE_WORDS = new Set([
+    "create",
+    "add",
+    "set",
+    "update",
+    "upsert",
+    "insert",
+    "put",
+    "post",
+    "send",
+    "delete",
+    "remove",
+    "mark",
+    "replace",
+    "archive",
+    "move",
+    "assign",
+    "book",
+    "cancel",
+    "write",
+    "edit",
+    "modify",
+    "save",
+    "submit",
+    "approve",
+    "reject",
+    "close",
+    "open",
+    "merge",
+    "push",
+    "publish",
+    "upload",
+    "invite",
+    "schedule",
+    "reply",
+    "forward",
+    "transfer",
+    "pay",
+    "refund",
+    "notify",
+    "run",
+    "execute",
+    "exec",
+    "apply",
+    "reset",
+    "start",
+    "stop",
+    "kill",
+    "enable",
+    "disable",
+    "grant",
+    "revoke",
+    "rename",
+    "tag",
+    "label",
+    "comment",
+]);
+/** A tool name's words: `getJiraIssue` → get, jira, issue; `calendar_search_events` → calendar, search, events. */
+function nameWords(name) {
+    return name
+        .replace(/([a-z\d])([A-Z])/g, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z\d]+/)
+        .filter(Boolean);
+}
+/**
+ * A tool that only reads: Claude Code's read-only tools, then the name — a
+ * reading word and no writing word (`calendar_search_events`, `getJiraIssue`;
+ * `run_sql` no: `run` writes). A name with both (`get_or_create_contact`)
+ * changes something.
+ */
+export function readsOnly(toolName) {
+    if (READ_TOOLS.has(toolName))
+        return true;
+    if (CHANGING_BUILTINS.has(toolName))
+        return false;
+    const words = nameWords(toolName.replace(/^mcp__.+?__/, ""));
+    if (words.some((w) => WRITE_WORDS.has(w)))
+        return false;
+    return words.some((w) => READ_WORDS.has(w));
+}
+/** Commands that only look (`ls`, `git status`, `grep …`). */
+const READ_COMMANDS = new Set([
+    "ls",
+    "dir",
+    "cat",
+    "type",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "grep",
+    "rg",
+    "egrep",
+    "fgrep",
+    "find",
+    "wc",
+    "pwd",
+    "echo",
+    "printf",
+    "date",
+    "whoami",
+    "which",
+    "where",
+    "env",
+    "printenv",
+    "stat",
+    "file",
+    "du",
+    "df",
+    "tree",
+    "jq",
+    "sort",
+    "uniq",
+    "cut",
+    "awk",
+    "diff",
+    "cmp",
+    "basename",
+    "dirname",
+    "realpath",
+    "readlink",
+    "true",
+    "false",
+    "test",
+    "sleep",
+    "ps",
+    "uname",
+    "hostname",
+    "id",
+    "nproc",
+    "free",
+    "uptime",
+    "node --version",
+    "npm --version",
+]);
+const READ_GIT = new Set([
+    "status",
+    "log",
+    "diff",
+    "show",
+    "branch",
+    "rev-parse",
+    "ls-files",
+    "blame",
+    "remote",
+    "describe",
+    "config --get",
+    "grep",
+    "shortlog",
+    "tag --list",
+]);
+/** Whether a shell command only looks: every part of it is a looking command, and nothing is written to a file. */
+export function commandReadsOnly(command) {
+    const text = command.trim();
+    if (!text)
+        return true;
+    // A redirect into a file (not into /dev/null, not 2>&1), tee, or an in-place edit changes something.
+    if (/(^|[^0-9&])>{1,2}\s*(?!&|\/dev\/null)\S/.test(text) || /\btee\b/.test(text) || /\bsed\b[^|;&]*\s-i\b/.test(text)) {
+        return false;
+    }
+    if (/\bfind\b[^|;&]*\s-(delete|exec|execdir|ok)\b/.test(text))
+        return false;
+    const parts = text
+        .split(/\|\||&&|[|;\n]/)
+        .map((p) => p.trim())
+        .filter(Boolean);
+    return parts.every((part) => {
+        const words = part.replace(/^(\w+=\S+\s+)+/, "").split(/\s+/);
+        const cmd = (words[0] ?? "").replace(/^.*[\\/]/, "");
+        if (cmd === "git")
+            return READ_GIT.has(words[1] ?? "") || READ_GIT.has(`${words[1] ?? ""} ${words[2] ?? ""}`);
+        if (cmd === "sed" || cmd === "awk")
+            return !/\s-i\b/.test(part);
+        return READ_COMMANDS.has(cmd) || READ_COMMANDS.has(`${cmd} ${words[1] ?? ""}`);
+    });
+}
+/**
+ * Whether one call may change something. A Bash call changes nothing only
+ * when its command is there and only looks; any other tool is a change unless
+ * {@link readsOnly} says it only reads — a tool it cannot tell about counts as
+ * a change. `input` is the call's arguments, as an object or as JSON text.
+ */
+export function callMayChange(toolName, input) {
+    if (toolName === "Bash") {
+        let value = input;
+        if (typeof value === "string") {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                value = undefined;
+            }
+        }
+        const command = value && typeof value === "object" && typeof value.command === "string"
+            ? value.command
+            : "";
+        return command.trim() === "" || !commandReadsOnly(command);
+    }
+    return !readsOnly(toolName);
+}
+//# sourceMappingURL=reads-only.js.map

package/docs/calculatedReplayGuide.md

@@ -495,7 +495,10 @@ Everything replay decides is one line. `grep` for these:
 | `replay.step_not_taken` | A step's test said this request does not need it, and nothing was sent for it ([calculatedReplay.md](calculatedReplay.md) §9.2). `plan.armed … tests=` lists the tested steps by their place in the plan: `4:hand_over,11:skip` |
 | `replay.diverge` / `replay.compose` | Off-script, and the recovery |
 | `replay.handover` | The plan stopped and handed the rest of the task to the model; `kind=` and `step=` say where. `kind=decision` (0.3.19) is a plan that ran the steps before its decision and stopped there, as planned (`via=divergence` when a divergence's bundle ran up to it) |
-| `run.fragment … decision=true` / `run.fragment_dropped` | After a plan's decision: the agent's own work from its next call is recorded as a fragment, from which the service makes the other half / a plan the intent check armed took that call instead, so nothing is recorded as the other half |
+| `run.fragment … decision=true` / `run.fragment_dropped` | After a plan's decision: the agent's own work from its next call is recorded as a fragment, from which the service makes a calculated scenario of that way / a plan the intent check armed, or a next scenario, took that call instead, so nothing is recorded as the agent's own |
+| `replay.next_ready` / `replay.next_hit` / `replay.next_miss` | 0.3.20: the calculated scenarios that can follow a plan's decision, armed while the agent decided / the agent's call was one's first step, value for value, so it runs in the call's place / none was used: `reason=other_values` (the same first tool with other values), `own_way` (a call that may change something and starts none of them), `not_ready` (the one that starts with that tool was not armed in time), `calls_limit` (5 calls started none), `turn_ended`. A call that only reads ends nothing |
+| `run.fragment_closed` | 0.3.20: a scenario that follows the decision took over after the agent's own looks had opened the fragment; the fragment ends there, with what the agent did itself |
+| `replay.decision … code=would_repeat` | 0.3.20: a plan an intent match armed after the agent's call would have made that call again (the same tool that may change something, or for a shell the same command), so it was not started (never twice) |
 | `replay.vetoed` | A direct plan retired without running anything: `run_scenario` was not the first call, or never arrived |
 | `replay.run_ambiguous` | Two sessions had `run_scenario` pending and the request named neither; nothing ran |
 | `replay.cancelled` / `replay.note_kept` | A direct run's caller went away (Esc); no further step started, and the note is kept for the model's next call |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basein/runner",
-  "version": "0.3.19",
+  "version": "0.3.20",
   "description": "A recording MCP proxy: sits between any MCP client and its MCP servers, executes each call on the client's behalf, and records the run as a reusable BaseIn scenario.",
   "type": "module",
   "license": "MIT",

package/production.md

@@ -601,11 +601,24 @@ Truncation is always marked with the original size.
 - A plan whose chain has a decision keeps these protections when it stops earlier for another reason (a parked or failed step, a judgement, the budget). Its note has no intent line and no parameters, and lists the remaining steps only up to the decision. Its directive leaves the intent out. An agent sent on to the recorded half's steps would start that half's segment, and the plan would have decided after all.
 - The report is `fell_back` (or `failed` when no step ran) with `fallbackKind: "decision"` and `fallbackStepIndex` the decision step. The decision step gets no verdict, so nothing is counted against it.
 - When a step ran, the hand-over takes the plan's usage mark: the plan is billed up to the stop, and the agent's decision and the half it took are not on its bill. This holds for a plan the prompt started and for one an intent match started. Every other hand-over still takes no mark.
-- The agent's own next call opens the fragment, marked `metadata.decisionOf = {scenarioId, stepIndex}`: the service makes the other half of the task from it. When a plan the intent check armed takes that call instead (a segment of one half), the fragment is dropped (`run.fragment_dropped`): what follows is not the other half.
+- The agent's own next call opens the fragment, marked `metadata.decisionOf = {scenarioId, stepIndex, request}` (`request`, the turn's prompt, redacted and cut to 4,000 characters, from 0.3.20): the service makes a calculated scenario of that way from it, calculated with the request (the service's offer1.md O2). When a plan the intent check armed, or a next scenario (below), takes that call instead, the fragment is dropped (`run.fragment_dropped`).
 - `ranThrough` sends one entry per plan, with the plan's own position (the decision step itself for a decision). The service maps it onto the recording.
 - `bir replay` stops in front of a decision and says so (`stopped     before step N …: the plan's decision`).
 - A runner up to 0.3.18 reads the unknown kind as `known_bad_step`: it stops there too, but its note and report name a failure.
 
+**What can follow a decision (0.3.20, the service's offer1.md).** The first time a way is taken after a decision, the agent does it and its fragment becomes a calculated scenario of that decision. The next time:
+
+- When a plan stops at its decision, the runner asks the service once, in the background, which calculated scenarios can follow it (`POST /scenarios/:planId/next`, body `{turnId, supportsCalls}`; at most 4, each handed out with its own ticket and `key: "decision"`). An older service, a 404 or any failure is "none". It arms each one while the agent reads the note and decides: its values are read from the turn's request and this turn's results (the reading carries `atDecision: {scenarioId, stepIndex}`), and settled. `replay.next_ready` says how many are ready.
+- The agent's next calls are checked against them before the intent probe. A call that is a next scenario's first step, **value for value** (every argument the step's own; the pin guard's "plausibly the step" is not enough), is a hit: it is answered in its place with that scenario's directive (`replay.next_hit`), the agent calls `run_scenario`, and the scenario runs every step, that one included, once. It is booked on its own ticket. A scenario whose first step is inside a sub-task (a call row) can never be the agent's call in place: it is never compared.
+- Each scenario is checkable as soon as the service answers; its arm runs on its own. A call waits only for the arm of a scenario that starts with the call's own tool (at most 6 s, `BIR_NEXT_HIT_WAIT_MS`), and not at all for the others. While the service has not answered yet, a call waits for that answer only, at most 1 s.
+- When the background reading left a value of the first step empty, the call waits while it is read once more with the agent's call as `liveCall`; the service fills such a value from the call. A value read differently is never read again: an e-mail to carlos is never the recorded e-mail to olga.
+- **A call that only reads keeps the set** (by the service's own rule, mirrored in `src/replay/reads-only.ts`: Claude Code's read tools, a name with a reading word and no writing word, a Bash command that only looks). The set ends unused (`replay.next_miss`) at the agent's first call that may change something and is no hit: `other_values` when the call has a scenario's first tool with other values, `own_way` when it starts none of them — the agent is doing a way of its own, and no scenario may start in the middle of it — and `not_ready` when the scenario that starts with that tool was not armed in time. It also ends after 5 calls that start none (`calls_limit`), or at the turn's end. A scenario not armed in time for a call that only reads misses that call only. Unused ones never run and are never reported; the agent's own work is recorded as the fragment, as before.
+- A later decision in the same turn starts a new set: what could follow the earlier one is dropped, never checked again.
+- A hit after the agent's own looks had opened the fragment ends that fragment there (`run.fragment_closed`, finished with what the agent did itself): the scenario's own calls, pinned in steer mode, are never recorded into it.
+- `/health` shows the set per session: `next: {entries, armed, calls, ended}`.
+
+**Never twice (0.3.20, offer1.md O8).** A plan an intent match arms after the agent's call — not in its place — whose steps call the same tool is not started: it would make that call a second time (issue fx2: the agent's e-mail, then the plan's own). `replay.decision code=would_repeat`. A tool that only reads, by the same rule as above (`crm_search_customers`, `Read`), may repeat. For Bash and PowerShell the call is its command: only a step that would run that very command counts.
+
 **Measured cost.**
 
 - A turn's cost is measured only when tokens were found and every model of the turn has a price in the runner's table. This holds for every host, Claude Code too. A model outside the table used to cost $0, and that zero was called measured.