@buoy-gg/agent-core 7.0.41 → 7.0.43

package/lib/module/engine/runAgentTurn.js

@@ -1,1831 +1,12 @@
-"use strict";
+"use strict";import{CATALOG as Ge}from"../catalog/catalog.g";import{applyDefaults as ae,validateParams as de}from"../catalog/validateParams";import{normalizeParams as le,aliasNote as ct}from"../catalog/normalizeParams";import{fromProviderToolName as X,toProviderTools as ft}from"../catalog/toProviderTools";import{hashQueryKey as ut}from"../catalog/normalizeParams";import{projectSnapshot as pt,SNAPSHOT_ACTION as Je}from"../catalog/snapshotReads";import{isReversible as ht}from"../effects/ledger";import{describeCall as we,decide as G}from"../policy/policy";import{redact as mt,stripSelfTraffic as yt}from"../policy/redact";import{effectFor as Ye}from"./effectFor";import{digestOf as ve}from"../effects/digest";import{buildUiBlock as gt,UI_TOOL_NAME as Z,uiProviderTool as kt}from"../blocks/uiTool";import{projectReceipt as bt}from"../blocks/receipts";import{isAskBlock as wt}from"../blocks/types";import{ACQUISITION_CALLS as vt,synthesizeAskBlock as Rt,synthesizeShortfallBlock as Tt}from"./askGate";import{couldBeToolCallEnvelope as It,parseTextToolCalls as St,SALVAGE_NOTE as At}from"./textToolCalls";import{budgetForRequest as Ke,MAX_HISTORY_TOKENS as Et,messageSize as Re}from"./historyBudget";import{promptTokensOf as $t,TokenCalibration as Ct}from"./tokenCalibration";import{truncationMarker as Nt}from"./evidence";import{retrieveEvidence as _t}from"./retrieve";import{verificationTrailer as Ot,verifyOutcome as xt}from"./verify";import{realClearTimeout as Mt,realNow as I,realSetTimeout as Lt}from"../realNow";const Ve=24e3;const Qe=2e3;const Xe=3;function Pt(t){const n=r=>{if(r===null||typeof r!=="object")return r;if(Array.isArray(r))return r.map(n);const l=r;return Object.keys(l).sort().reduce((c,k)=>(c[k]=n(l[k]),c),{})};return t.map(r=>`${r.name}:${JSON.stringify(n(r.input??{}))}`).join("|")}const Ut="[Buoy] You have now made this exact call three times in a row and gotten the same thing back. Repeating it again will not change the answer. Read the result you already have, then either try a different tool or different arguments, or tell the user plainly what you could not get and what you tried.";const Dt=12;const Ze=18e4;const qt=2;const jt=1;const Bt=1e3;const Ft=250;const Ht=3e4;function zt(t,n){return new Promise(r=>{if(n?.aborted)return r();const l=Lt(c,t);function c(){Mt(l);n?.removeEventListener("abort",c);r()}n?.addEventListener("abort",c,{once:true})})}function et(t){if(typeof t==="boolean")return{approved:t,trust:false};const n=t.reason?.trim();return{approved:t.approved,...n?{reason:n}:{},trust:t.trust===true&&t.approved}}function tt(t){return t?`The user declined this change and said: "${t}". Do not retry it as proposed; take their note into account and, if a different change would fit, propose that instead.`:"The user declined this change. Do not retry it; ask what they would prefer."}function D(t,n,r){return t.find(l=>l.toolId===n)?.actions.find(l=>l.action===r)}const Wt="Rejected: every image URL must be one you read from a tool result in THIS conversation (images.list, a storage value, a response body). Never invent or remember URLs \u2014 read them first, then show them.";const Gt=t=>` NOTE: ${t} image ${t===1?"URL was":"URLs were"} dropped \u2014 they were not read from a tool result in this conversation, so the card the user is looking at has no picture there. Do not tell them it does; read the URLs and show it again, or say the artwork is missing.`;function Jt(t){try{return JSON.stringify(t??null)}catch{return String(t)}}function Yt(t,n){if(t.length<=Ve)return t;return`${t.slice(0,Ve)}${Nt(t.length,n)}`}function Kt(t){if(t===null||t===void 0)return"Done";if(Array.isArray(t))return Te(t.length);if(typeof t==="boolean")return t?"Done":"Failed";if(typeof t==="object"){const n=t;if(n.ok===false)return typeof n.error==="string"?n.error:"Failed";if(n.found===false)return"Not found";if(n.tapped===false)return"Nothing to tap";if(n.active===false)return"Saved, but inactive in this build";for(const l of["returned","count","total"]){const c=n[l];if(typeof c==="number")return Te(c)}const r=Object.values(n).filter(Array.isArray);if(r.length===1)return Te(r[0].length);return"Done"}return String(t).slice(0,80)}function Te(t){return t===1?"1 item":`${t} items`}function ot(t){return typeof t==="object"&&t!==null&&t.ok===false}export async function*runAgentTurn(t){const{provider:n,catalog:r,system:l,systemVolatile:c,model:k,maxTokens:y,dispatch:f,readSnapshot:m,storeKeyOwners:J,ledger:w,policy:M,isRelease:L,requestApproval:q,signal:N,evidence:j,trusted:v,procedures:B}=t;const F=new Map;const _=t.calibration??new Ct;const p=[...t.messages];const ce=ft(r,{availableToolIds:t.availableToolIds,availableActions:t.availableActions,isRelease:L});ce.push(kt());const Se=M.maxSteps??Dt;const rt=w.generation;const Ae=l.length+(c?.length??0)+ce.reduce((ne,O)=>ne+O.description.length+JSON.stringify(O.inputSchema).length,0);const Ee=()=>Ae+_.chars(y);let te=I()+Ze;const fe={throttled:0,overflow:0};let oe=Et;const ue=t.seenUrls??new Set;const it=/https?:\/\/[^\s"'\\)\]}>]+/g;let $e=false;const H=[];let Ce=false;const Ne=[];let _e=false;let Oe=false;for(let ne=0;ne<Se;ne++){if(N?.aborted){yield{type:"done",stopReason:"stopped"};return p}if(I()>te){yield{type:"block",block:{id:`cap${I()}`,kind:"notice",tone:"warning",text:`This is taking too long \u2014 stopped after ${Math.round(Ze/1e3)}s. What it found so far is above.`,actions:[{label:"Continue",primary:true,send:"Continue where you left off."}]}};yield{type:"done",stopReason:"time-cap"};return p}const O=Ke(p,Ee(),_.chars(oe),_.charsPerToken,w.liveCallIds());if(O.droppedRounds>0){p.length=0;p.push(...O.messages);yield{type:"history-trimmed",droppedRounds:O.droppedRounds,droppedPinned:O.droppedPinned}}else if(O.messages!==p){p.length=0;p.push(...O.messages)}let $="";let xe=false;const z=e=>{const o=$e&&!xe;xe=true;$e=true;return o?{type:"text",delta:e,breakBefore:true}:{type:"text",delta:e}};let b=[];const Me=new Set;let C="";let pe=true;let Y=[];let re=false;let ie;let W;for(;;){$="";b=[];C="";pe=true;Y=[];re=false;ie=void 0;W=void 0;let e;const o=Ae+p.reduce((s,A)=>s+Re(A),0);for await(const s of n.send({messages:p,system:l,systemVolatile:c,tools:ce,model:k,maxTokens:y,signal:N})){if(s.type==="text"){$+=s.delta;if(!pe){yield z(s.delta)}else if(It($)){C+=s.delta}else{pe=false;C="";yield z($)}}else if(s.type==="tool-call"){b.push(s.call)}else if(s.type==="thinking"){Y.push(s.block);if(s.block.type==="thinking"&&s.block.thinking.trim()){yield{type:"reasoning",text:s.block.thinking}}}else if(s.type==="error"){if(s.kind==="truncated"||s.kind==="timeout"){W={message:s.message}}else if(s.problem&&(s.problem.kind==="throttled"||s.problem.kind==="overflow")&&$===""&&b.length===0&&Y.length===0){e={problem:s.problem,message:s.message}}else{yield{type:"error",message:s.message};re=true}}else if(s.type==="done"){ie=s.outcome;if(s.usage){_.observe(o,$t(s.usage,n.protocol));yield{type:"usage",...s.usage,model:s.model}}}}if(!e)break;const i=e.problem.kind;const u=1+(i==="throttled"?qt:jt);const d=fe[i];let S=i==="throttled"?Math.min(e.problem.retryAfterMs??Bt*2**d,Ht)+Math.floor(Math.random()*Ft):0;let E=d>=u-1||N?.aborted===true||I()+S>te;if(!E&&i==="overflow"){oe=Math.floor(oe/2);const s=p.reduce((U,x)=>U+Re(x),0);const A=Ke(p,Ee(),_.chars(oe),_.charsPerToken,w.liveCallIds());const K=A.messages.reduce((U,x)=>U+Re(x),0);if(K>=s){E=true}else{p.length=0;p.push(...A.messages);if(A.droppedRounds>0)yield{type:"history-trimmed",droppedRounds:A.droppedRounds,droppedPinned:A.droppedPinned}}}if(E){const s=i==="throttled"?d>0?`The AI endpoint is rate-limiting requests \u2014 tried ${d+1} times.`:"The AI endpoint is rate-limiting requests.":"This conversation is too large for the AI endpoint and there was nothing older to trim. Start a new conversation, or ask a shorter question.";yield{type:"error",message:`${s} (${e.message})`};re=true;break}fe[i]+=1;yield{type:"retrying",reason:i,attempt:fe[i]+1,maxAttempts:u,inMs:S};if(S>0)await zt(S,N);if(N?.aborted){yield{type:"done",stopReason:"stopped"};return p}}if(re){if(C)yield z(C);yield{type:"done",stopReason:"error"};return p}if(!W&&ie!=="completed"){W={message:ie==="output-limited"?b.length?"The model ran out of room mid-plan, so nothing was run. What it found so far is above.":"The model ran out of room before finishing this answer.":"The answer ended before the endpoint said it was finished, so nothing was run."}}if(W){if(C)yield z(C);if($.trim())p.push({role:"assistant",text:$});yield{type:"block",block:{id:`cut${I()}`,kind:"notice",tone:"warning",text:W.message,actions:[{label:"Continue",primary:true,send:"Continue where you left off."}]}};yield{type:"done",stopReason:"incomplete"};return p}if(C){const e=b.length===0?St(C,r):void 0;if(e){for(const o of e.calls){b.push(o);Me.add(o.id)}$=e.reply;if(e.reply)yield z(e.reply)}else{yield z(C)}C=""}p.push({role:"assistant",text:$,toolCalls:b.length?b:void 0,thinking:Y.length?Y:void 0});if($.trim())Ne.push($.trim());if(b.length===0){const e=Ne.join("\n\n");const o=Tt({text:e,attempted:Oe});if(o)yield{type:"block",block:o};const i=_e||o?null:Rt(e);if(i){yield{type:"block",block:i};yield{type:"awaiting-user",blockId:i.id}}yield{type:"done",stopReason:i?"awaiting-user":"answered"};return p}const g=[];let Le=false;const Pe=new Map;if(b.length>1){const e=b.every(o=>{if(o.name===Z)return false;const i=X(o.name,r);if(!i||i==="ask-buoy")return false;const u=o.input?.action;if(typeof u!=="string"||u===Je)return false;const d=D(r,i,u);if(!d||d.effect!=="read")return false;return G({descriptor:d,toolId:i,policy:M,isRelease:L}).verdict==="allow"});if(e){for(const o of b){const i=X(o.name,r);const u=String(o.input.action);const d={...o.input.params??{}};const S=D(r,i,u);const E=le(i,u,d);const s=ae(E.params,S.params);if(!de(s,S.params).ok)continue;const A=Promise.resolve(f(i,u,s)).catch(K=>{throw K});A.catch(()=>{});Pe.set(o.id,A)}}}let he=null;const st=e=>{const o=X(e.name,r)??e.name;const i=typeof e.input?.action==="string"?e.input.action:"";const u=i?D(r,o,i):void 0;const d=e.input?.params??{};return[{type:"tool-start",id:e.id,toolId:o,action:i,label:u?we(o,u,d):`${o}.${i}`,description:u?.summary??"",params:d,effect:u?.effect??"read"},{type:"tool-end",id:e.id,ok:false,summary:"stopped",durationMs:0}]};const Ue=b.map(e=>{if(e.name===Z)return void 0;const o=X(e.name,r);const i=typeof e.input?.action==="string"?e.input.action:void 0;if(!o||!i)return void 0;const u=D(r,o,i);if(!u)return void 0;const d=e.input.params??{};const S=ae(le(o,i,d).params,u.params);if(!de(S,u.params).ok)return void 0;const E=G({descriptor:u,toolId:o,policy:M,isRelease:L});return{call:e,toolId:o,action:i,descriptor:u,params:S,label:we(o,u,S),mutates:u.effect!=="read",gated:E.verdict==="needs-approval",reason:E.verdict==="needs-approval"?E.reason:""}});const at=Ue.some(e=>e?.gated);const P=new Map;let De=false;let qe=false;async function*dt(){De=true;for(const e of Ue){if(!e?.gated||P.has(e.call.id))continue;if(v?.has(`${e.toolId}.${e.action}`)){P.set(e.call.id,true);continue}yield{type:"approval-required",id:e.call.id,toolId:e.toolId,action:e.action,label:e.label,description:e.descriptor.summary,reason:e.reason};const o=I();const i=await readTargetDigest({toolId:e.toolId,action:e.action,params:e.params,dispatch:f,catalog:r});const u=et(v?.has(`${e.toolId}.${e.action}`)?true:q?await q({id:e.call.id,toolId:e.toolId,action:e.action,label:e.label,description:e.descriptor.summary,reason:e.reason,params:e.params,targetDigest:i}):false);te+=I()-o;const d=u.approved;P.set(e.call.id,d);if(u.trust)v?.add(`${e.toolId}.${e.action}`);if(u.reason)F.set(e.call.id,u.reason);if(!d){qe=true;return}}}for(const e of b){if(N?.aborted){if(e.name!==Z){for(const a of st(e))yield a}g.push({toolCallId:e.id,content:"Not run \u2014 the user pressed Stop before this call started.",isError:true});continue}if(e.name===Z){const a=gt(e.input);if(!a.ok||!a.block){g.push({toolCallId:e.id,content:`Invalid ${Z} block:
+${a.errors.join("\n")}
 
-/**
- * One turn: user sentence in, tool calls and an answer out.
- *
- * The loop is deliberately explicit rather than clever, because every step of
- * it encodes something that bites otherwise:
- *
- * - Validation happens BEFORE dispatch and a failure comes back as a readable
- *   tool_result, not an exception. Buoy's adapters validate nothing, so a
- *   wrong shape becomes an undefined read deep inside a tool — and an LLM
- *   omitting `replace` on `zustand.setState` replaces the entire store.
- * - `app.reloadApp` is TERMINAL. It returns before the reload fires and then
- *   kills the JS realm; anything queued behind it dies with the conversation.
- * - Results are truncated before they are sent. `dispatchToolAction` bypasses
- *   the 8MB wire cap that protects the broker path, so an in-app agent can
- *   receive a 50MB object and then try to feed it to a token-metered model.
- * - Steps and wall-clock are capped, because a model that misreads a result
- *   will otherwise retry the same call until the user closes the sheet.
- */
+Resend ONLY the corrected block. Do not rewrite your answer \u2014 whatever you already said this turn has been shown to the user, and saying it again repeats it on their screen.`,isError:true});continue}let h=0;if(a.block.kind==="imageGrid"){const R=a.block.images.filter(T=>ue.has(T.url));h=a.block.images.length-R.length;if(R.length===0){g.push({toolCallId:e.id,content:Wt,isError:true});continue}a.block={...a.block,images:R}}if(a.block.kind==="list"){const R=a.block.items.map(T=>{if(!T.image||ue.has(T.image))return T;h+=1;return{...T,image:void 0}});a.block={...a.block,items:R}}yield{type:"block",block:a.block,forToolCallId:e.id};if(a.block.kind==="actions"||a.block.kind==="suggestions")_e=true;if(wt(a.block)){he=a.block.id;g.push({toolCallId:e.id,content:"Shown. Waiting for the user's answer \u2014 it will arrive as their next message. Do not guess it."})}else{g.push({toolCallId:e.id,content:"Shown to the user. Don't repeat its contents in text."+(h>0?Gt(h):"")})}continue}const o=X(e.name,r);const i=e.input.action;const u=(a,h)=>[{type:"tool-start",id:e.id,toolId:o??e.name,action:i??"",label:a,description:"",params:e.input.params??{},effect:"read"},{type:"tool-end",id:e.id,ok:false,summary:h,durationMs:0}];if(!o){for(const a of u(e.name,"No such tool"))yield a;g.push({toolCallId:e.id,content:`There is no tool called "${e.name}". Use one of the tools you were given.`,isError:true});continue}if(!i){for(const a of u(e.name,"No action given"))yield a;g.push({toolCallId:e.id,content:`"${e.name}" needs an "action" \u2014 it is required, and it names which of this tool's actions to run. See the action list in the tool's description.`,isError:true});continue}const d=D(r,o,i);if(!d){const a=r.find(h=>h.toolId===o)?.actions.map(h=>h.action).join(", ");for(const h of u(`${o}.${i}`,"No such action"))yield h;g.push({toolCallId:e.id,content:`"${i}" is not an action on ${o}.${a?` Valid actions: ${a}.`:""}`,isError:true});continue}const S=e.input.params??{};const E=le(o,i,S);const s=ae(E.params,d.params);const A=de(s,d.params);if(!A.ok){g.push({toolCallId:e.id,content:`Invalid parameters for ${o}.${i}:
+${A.errors.join("\n")}
 
-import { CATALOG } from "../catalog/catalog.g";
-import { applyDefaults, validateParams } from "../catalog/validateParams";
-import { normalizeParams, aliasNote } from "../catalog/normalizeParams";
-import { fromProviderToolName, toProviderTools } from "../catalog/toProviderTools";
-import { hashQueryKey } from "../catalog/normalizeParams";
-import { projectSnapshot, SNAPSHOT_ACTION } from "../catalog/snapshotReads";
-import { isReversible } from "../effects/ledger";
-import { describeCall, decide } from "../policy/policy";
-import { redact, stripSelfTraffic } from "../policy/redact";
-import { effectFor } from "./effectFor";
-import { digestOf } from "../effects/digest";
-import { buildUiBlock, UI_TOOL_NAME, uiProviderTool } from "../blocks/uiTool";
-import { projectReceipt } from "../blocks/receipts";
-import { isAskBlock } from "../blocks/types";
-import { ACQUISITION_CALLS, synthesizeAskBlock, synthesizeShortfallBlock } from "./askGate";
-import { couldBeToolCallEnvelope, parseTextToolCalls, SALVAGE_NOTE } from "./textToolCalls";
-import { budgetForRequest, MAX_HISTORY_TOKENS, messageSize } from "./historyBudget";
-import { promptTokensOf, TokenCalibration } from "./tokenCalibration";
-import { truncationMarker } from "./evidence";
-import { retrieveEvidence } from "./retrieve";
-import { verificationTrailer, verifyOutcome } from "./verify";
-/** Beyond this a tool result costs more in tokens than it can possibly be worth. */
-const MAX_RESULT_CHARS = 24_000;
-/**
- * The result kept for the trace. Far smaller than what the MODEL gets — this
- * one is read by a person in a chat bubble or a pasted JSON file, and a 24k
- * store dump per step makes the trace unreadable rather than more useful.
- */
-const MAX_TRACE_RESULT_CHARS = 2_000;
-/**
- * How many identical rounds before the model is told it is looping.
- *
- * `maxSteps` alone was the whole answer, and it is the wrong shape: a model
- * that misread a result retries the same call until the cap, then the turn
- * ends with nothing — the user watches twelve identical rows go by and gets
- * no answer. The cap is a backstop, not feedback. Telling the model what it
- * is doing gives it the chance to change approach, and costs one sentence.
- *
- * Signature is name + action + arguments, key-sorted so `{b,a}` and `{a,b}`
- * are the same call. Three, not two: a legitimate retry after a transient
- * failure is normal, and warning on it would be noise.
- */
-const LOOP_REPEATS = 3;
-function callSignature(calls) {
-  const sort = v => {
-    if (v === null || typeof v !== "object") return v;
-    if (Array.isArray(v)) return v.map(sort);
-    const o = v;
-    return Object.keys(o).sort().reduce((a, k) => (a[k] = sort(o[k]), a), {});
-  };
-  return calls.map(c => `${c.name}:${JSON.stringify(sort(c.input ?? {}))}`).join("|");
-}
-const LOOP_WARNING = "[Buoy] You have now made this exact call three times in a row and gotten the same thing back. Repeating it again will not change the answer. Read the result you already have, then either try a different tool or different arguments, or tell the user plainly what you could not get and what you tried.";
-const DEFAULT_MAX_STEPS = 12;
-const DEFAULT_TURN_MS = 180_000;
+Expected schema:
+${JSON.stringify(d.params)}`,isError:true});continue}const K=ct(E.notes);const U=we(o,d,s);const x=G({descriptor:d,toolId:o,policy:M,isRelease:L});const V=a=>[{type:"tool-start",id:e.id,toolId:o,action:i,label:U,description:d.summary,params:s,effect:d.effect},{type:"tool-end",id:e.id,ok:false,summary:a,durationMs:0}];if(x.verdict==="refuse"){for(const a of V("refused"))yield a;g.push({toolCallId:e.id,content:x.reason,isError:true});continue}const me=x.verdict==="needs-approval";if(at&&!De&&(d.effect!=="read"||me)){yield*dt()}if(qe&&(d.effect!=="read"||me)){for(const a of V("declined"))yield a;g.push({toolCallId:e.id,content:P.get(e.id)===false?tt(F.get(e.id)):"Not run \u2014 the user declined another change in this same batch, so none of it was applied. Ask what they would prefer before proposing it again.",isError:true});continue}if(me){let a;if(P.has(e.id)){a=P.get(e.id)}else if(v?.has(`${o}.${i}`)){a=true;P.set(e.id,true)}else{yield{type:"approval-required",id:e.id,toolId:o,action:i,label:U,description:d.summary,reason:x.reason};const h=I();const R=await readTargetDigest({toolId:o,action:i,params:s,dispatch:f,catalog:r});const T=et(q?await q({id:e.id,toolId:o,action:i,label:U,description:d.summary,reason:x.reason,params:s,targetDigest:R}):false);te+=I()-h;a=T.approved;P.set(e.id,a);if(T.trust)v?.add(`${o}.${i}`);if(T.reason)F.set(e.id,T.reason)}if(!a){for(const h of V("declined"))yield h;g.push({toolCallId:e.id,content:tt(F.get(e.id)),isError:true});continue}}if(vt.has(`${o}.${i}`))Oe=true;yield{type:"tool-start",id:e.id,toolId:o,action:i,label:U,description:d.summary,params:s,effect:d.effect};const je=I();const Be=await Ie(d,o,s,f);const ye=await ee(d,o,s,f);if(N?.aborted){for(const a of V("stopped"))yield a;g.push({toolCallId:e.id,content:"Not run \u2014 the user pressed Stop before this call started.",isError:true});continue}const Fe=G({descriptor:d,toolId:o,policy:M,isRelease:L});if(Fe.verdict==="refuse"){for(const a of V("refused"))yield a;g.push({toolCallId:e.id,content:Fe.reason,isError:true});continue}try{const a=i===Je?pt(o,await Qt(m,o),s):o==="ask-buoy"?await nt(i,w,f,j,s,B):await(Pe.get(e.id)??f(o,i,s));const h=mt(yt(a));const R=ot(a);const T=Jt(h);const ge=j&&!R&&!(o==="ask-buoy"&&i==="retrieve")?j.stash({toolId:o,action:i,params:s,capturedAt:I(),text:T}):void 0;const Q=Yt(T,ge);const lt=Q.length>Qe?`${Q.slice(0,Qe)}\u2026`:Q;yield{type:"tool-end",id:e.id,ok:!R,summary:Kt(a),durationMs:I()-je,result:lt};const ke=ye===void 0||R?void 0:await ee(d,o,s,f);if(d.effect!=="read"&&o!=="ask-buoy"&&!R){const be=w.noteExternalRevert(o,i,s);const ze=Ye(o,d,s,a,Be,{before:ye,after:ke});if(ze&&!be){const We=w.record(o,i,ze,rt);if(We)We.callId=e.id}}const He=R?void 0:bt({toolId:o,action:i,params:s,result:h,before:ye??Be,after:ke,effect:d.effect});if(He)yield{type:"block",block:He,forToolCallId:e.id};const se=d.effect!=="read"&&!R?await xt({toolId:o,action:i,params:s,result:a,dispatch:f,signal:N,after:ke}):void 0;if(se)yield{type:"tool-verified",id:e.id,verification:se};for(const be of Q.match(it)??[])ue.add(be);g.push({toolCallId:e.id,content:Q+Vt(o,d,s,J)+K+(se?Ot(se):"")+(Me.has(e.id)?At:""),...ge?{ref:ge}:{}});if(o==="app"&&(i==="reloadApp"||i==="reload")){Le=true}}catch(a){const h=a instanceof Error?a.message:String(a);yield{type:"tool-end",id:e.id,ok:false,summary:h,durationMs:I()-je};g.push({toolCallId:e.id,content:`Failed: ${h}`,isError:true})}}if(b.length){H.push(Pt(b));if(H.length>Xe)H.shift();const e=!Ce&&H.length===Xe&&H.every(o=>o===H[0]);if(e){Ce=true;const o=g[g.length-1];if(o)o.content=`${o.content}
 
-/**
- * Retrying a model request — narrowly.
- *
- * A 429 from a shared gateway, a 529 / `overloaded_error` from Anthropic, or
- * a "prompt is too long" 400 used to end the turn with an error card and Try
- * again — and Try again re-sends the QUESTION, restarting an investigation
- * that may already have written things. All three fail before a model has
- * generated anything, so asking again is safe: nothing runs twice, nothing
- * is billed twice. The rule that makes it safe is enforced, not assumed —
- * a request is only retried when its stream produced NO text, tool call or
- * thinking; once anything has come back, the existing no-replay handling
- * stands (see providers/transport.ts on consumed-exactly-once).
- *
- * Throttled: up to two retries, 1 s then 2 s (plus jitter), a `Retry-After`
- * winning when the endpoint sent one. Overflow: one retry, with the history
- * ceiling halved first — the proactive budget is chars ÷ 4 and the provider
- * just said that was optimistic. Both wait inside the turn deadline and stop
- * on the user's Stop. Small numbers on purpose: this is a phone, not a
- * server queue.
- */
-const THROTTLE_RETRIES = 2;
-const OVERFLOW_RETRIES = 1;
-const RETRY_BASE_MS = 1_000;
-const RETRY_JITTER_MS = 250;
-const RETRY_AFTER_CAP_MS = 30_000;
-function sleep(ms, signal) {
-  return new Promise(resolve => {
-    if (signal?.aborted) return resolve();
-    const t = setTimeout(done, ms);
-    function done() {
-      clearTimeout(t);
-      signal?.removeEventListener("abort", done);
-      resolve();
-    }
-    signal?.addEventListener("abort", done, {
-      once: true
-    });
-  });
-}
+${Ut}`}}p.push({role:"tool-results",results:g});if(he){yield{type:"awaiting-user",blockId:he};yield{type:"done",stopReason:"awaiting-user"};return p}if(Le){yield{type:"done",stopReason:"realm-died"};return p}}yield{type:"block",block:{id:`cap${I()}`,kind:"notice",tone:"warning",text:`Stopped after ${Se} steps to avoid looping.`,actions:[{label:"Continue",primary:true,send:"Continue where you left off."}]}};yield{type:"done",stopReason:"step-cap"};return p}function Vt(t,n,r,l){if(t!=="storage"||n.effect==="read")return"";if(!l||typeof r.key!=="string")return"";const c=l[r.key];if(!c)return"";return`
 
-/**
- * Why the turn ended — the machine-readable half of the notices. The text in
- * the notice blocks is unchanged (the eval classifier pins it); this is for a
- * host, the bank and the desktop, which used to have to grep the prose.
- */
-
-/** Normalise an answer to its parts, so both call sites read one shape. */
-function readAnswer(answer) {
-  if (typeof answer === "boolean") return {
-    approved: answer,
-    trust: false
-  };
-  const reason = answer.reason?.trim();
-  return {
-    approved: answer.approved,
-    ...(reason ? {
-      reason
-    } : {}),
-    trust: answer.trust === true && answer.approved
-  };
-}
-
-/** What the model is told when the user says no — with their note, when they left one. */
-function declinedResult(reason) {
-  return reason ? `The user declined this change and said: "${reason}". Do not retry it as proposed; take their note into account and, if a different change would fit, propose that instead.` : "The user declined this change. Do not retry it; ask what they would prefer.";
-}
-function findDescriptor(catalog, toolId, action) {
-  return catalog.find(t => t.toolId === toolId)?.actions.find(a => a.action === action);
-}
-
-/**
- * Why a picture did not render, in the model's own terms.
- *
- * Two messages, not one, because they answer different questions: the first
- * is "your block was refused", the second is "your block was shown but with
- * holes in it". The literal opening of the rejection is pinned by the
- * trajectory classifier (evals/ask-buoy/lib/trajectory.ts) — keep it.
- */
-const URL_PROVENANCE_REJECTION = "Rejected: every image URL must be one you read from a tool result in THIS conversation (images.list, a storage value, a response body). Never invent or remember URLs — read them first, then show them.";
-const droppedImageNote = n => ` NOTE: ${n} image ${n === 1 ? "URL was" : "URLs were"} dropped — they were not read from a tool result in this conversation, so the card the user is looking at has no picture there. Do not tell them it does; read the URLs and show it again, or say the artwork is missing.`;
-
-/** The whole result as text — what the evidence store keeps. */
-function fullText(value) {
-  try {
-    return JSON.stringify(value ?? null);
-  } catch {
-    return String(value);
-  }
-}
-
-/** What the model is sent: the text, cut at the cap with a marker that names where the rest is. */
-function encodeResult(text, ref) {
-  if (text.length <= MAX_RESULT_CHARS) return text;
-  return `${text.slice(0, MAX_RESULT_CHARS)}${truncationMarker(text.length, ref)}`;
-}
-
-/** A short line for the transcript row, so the UI never renders raw payloads. */
-/**
- * The trailing status word on a transcript row — "12 items", "Not found",
- * "Done". Written for the person watching, not the model (which gets the full
- * result): a list of JSON key names ("found, storeName, …") told a QA tester
- * nothing, so this reads the few result shapes that carry meaning and says
- * "Done" for the rest.
- */
-function summarise(value) {
-  if (value === null || value === undefined) return "Done";
-  if (Array.isArray(value)) return countOf(value.length);
-  if (typeof value === "boolean") return value ? "Done" : "Failed";
-  if (typeof value === "object") {
-    const rec = value;
-    if (rec.ok === false) return typeof rec.error === "string" ? rec.error : "Failed";
-    if (rec.found === false) return "Not found";
-    if (rec.tapped === false) return "Nothing to tap";
-    if (rec.active === false) return "Saved, but inactive in this build";
-    for (const key of ["returned", "count", "total"]) {
-      const n = rec[key];
-      if (typeof n === "number") return countOf(n);
-    }
-    // `{requests:[…]}` → "12 items", but a snapshot with several lists
-    // (`{stack, routes, recentNavigations}`) has no single honest count.
-    const lists = Object.values(rec).filter(Array.isArray);
-    if (lists.length === 1) return countOf(lists[0].length);
-    return "Done";
-  }
-  return String(value).slice(0, 80);
-}
-function countOf(n) {
-  return n === 1 ? "1 item" : `${n} items`;
-}
-
-/**
- * A call that came back reporting its own failure.
- *
- * Buoy adapters RESOLVE with `{ok:false, error}` rather than throwing, so the
- * dispatch's try/catch never fires and a refused write looked like a completed
- * one: the row read "Done", and — much worse — the effect ledger recorded a
- * change that had not happened, so the changes bar offered to undo nothing.
- * Caught on device: a typed-edit refusal ("qty is a number, 'many' is text")
- * left the bag untouched and the bar claiming one permanent change.
- *
- * `ok === false` is the same signal `summarise` above already trusts to turn a
- * result into the row's text, so this reads it no more liberally than the UI
- * already does.
- */
-function reportsFailure(value) {
-  return typeof value === "object" && value !== null && value.ok === false;
-}
-export async function* runAgentTurn(input) {
-  const {
-    provider,
-    catalog,
-    system,
-    systemVolatile,
-    model,
-    maxTokens,
-    dispatch,
-    readSnapshot,
-    storeKeyOwners,
-    ledger,
-    policy,
-    isRelease,
-    requestApproval,
-    signal,
-    evidence,
-    trusted,
-    procedures
-  } = input;
-  /** Notes the user left with a decline, by call id — see declinedResult. */
-  const declineReasons = new Map();
-  const calibration = input.calibration ?? new TokenCalibration();
-  const messages = [...input.messages];
-  const tools = toProviderTools(catalog, {
-    availableToolIds: input.availableToolIds,
-    availableActions: input.availableActions,
-    isRelease
-  });
-  tools.push(uiProviderTool());
-  const maxSteps = policy.maxSteps ?? DEFAULT_MAX_STEPS;
-  /**
-   * The conversation this turn belongs to. Handed back on every `record` so a
-   * dispatch that settles after the user started a new conversation lands in
-   * the app (nothing can pull it back) but not in the new chat's undo bar.
-   */
-  const ledgerGeneration = ledger.generation;
-  /**
-   * What every request costs before a single message is added: the tool
-   * definitions, the system prompt, and the room the model needs to reply.
-   *
-   * Measured, not guessed — the tool block alone is ~32k characters for a
-   * typical install and ~94k with all 24 tools available, which is far too
-   * much to leave out of a budget. `maxTokens` is multiplied by four because
-   * the budget is in characters.
-   */
-  const fixedChars = system.length + (systemVolatile?.length ?? 0) + tools.reduce((n, t) => n + t.description.length + JSON.stringify(t.inputSchema).length, 0);
-  /** The reserve at the ratio believed RIGHT NOW — it moves as usage reports come in. */
-  const requestReserve = () => fixedChars + calibration.chars(maxTokens);
-  /**
-   * Caps the AGENT's wall-clock, not the user's. Time spent parked on an
-   * approval sheet is pushed onto the deadline as it is spent (see the
-   * `requestApproval` await below) — otherwise a user who takes three minutes
-   * to tap Approve gets the change applied and then "this is taking too long"
-   * for the turn that applied it.
-   */
-  let deadline = Date.now() + DEFAULT_TURN_MS;
-  /** Retries spent this turn, per kind — the budget is per turn, not per step. */
-  const retries = {
-    throttled: 0,
-    overflow: 0
-  };
-  /** Tightened after an overflow; see budgetForRequest's `cap`. In tokens, so a calibration change re-scales it. */
-  let historyCapTokens = MAX_HISTORY_TOKENS;
-
-  // Every http(s) URL that appeared in a tool result in this CONVERSATION.
-  // The prompt tells the model image URLs must come from here; this Set is
-  // the enforcement — a model-remembered or injected URL in an image block is
-  // both a fabrication vector and a data-exfil beacon (the GET carries
-  // whatever is encoded into the URL). Session-owned when the caller passes
-  // one; see RunTurnInput.seenUrls for why it is not per-turn.
-  const seenUrls = input.seenUrls ?? new Set();
-  const URL_RE = /https?:\/\/[^\s"'\\)\]}>]+/g;
-
-  /** Whether any text has gone out THIS TURN — see `breakBefore`. */
-  let answerStarted = false;
-
-  /**
-   * The last few rounds' call signatures. See LOOP_REPEATS — a run of
-   * identical rounds gets one warning appended to the results, once, so the
-   * model is told rather than silently capped.
-   */
-  const recentSignatures = [];
-  let loopWarned = false;
-
-  /**
-   * Everything the model SAID this turn, in order. Read once, at the end, by
-   * the ask gate — a question asked in round one and left hanging is the same
-   * dead end as one asked in the last round. See askGate.ts.
-   */
-  const spoken = [];
-  /**
-   * Whether the user already has something to tap. An `actions` or
-   * `suggestions` block is the model doing this job itself, and a second card
-   * asking the same thing underneath it is worse than none.
-   *
-   * Note this does NOT suppress the shortfall gate below — that one asks
-   * whether the user can tap the GAP, which unrelated chips do not answer.
-   */
-  let offeredTap = false;
-  /**
-   * Whether this turn actually went and looked — navigated, described the
-   * screen, tapped something, refetched. The shortfall gate stays quiet when
-   * it did: an agent that tried and came up short has earned its answer.
-   */
-  let attemptedAcquisition = false;
-  for (let step = 0; step < maxSteps; step++) {
-    if (signal?.aborted) {
-      yield {
-        type: "done",
-        stopReason: "stopped"
-      };
-      return messages;
-    }
-    if (Date.now() > deadline) {
-      // Same shape as the step cap below. This used to be an `error`, which
-      // drew the failed-turn card with Try again — and Try again re-sends the
-      // question, restarting the whole investigation that just ran out of
-      // time. Continue picks up with everything so far still in history.
-      yield {
-        type: "block",
-        block: {
-          id: `cap${Date.now()}`,
-          kind: "notice",
-          tone: "warning",
-          // Keeps the "This is taking too long" prefix: the eval classifier
-          // (evals/ask-buoy/lib/trajectory.ts) tells a time-out from a step
-          // cap by it.
-          text: `This is taking too long — stopped after ${Math.round(DEFAULT_TURN_MS / 1000)}s. What it found so far is above.`,
-          actions: [{
-            label: "Continue",
-            primary: true,
-            send: "Continue where you left off."
-          }]
-        }
-      };
-      yield {
-        type: "done",
-        stopReason: "time-cap"
-      };
-      return messages;
-    }
-
-    /**
-     * BUDGET, EVERY REQUEST — not once per turn.
-     *
-     * The session trims when a turn opens, and that used to be the only
-     * check. But a turn is not one request: each step appends an assistant
-     * message and a tool-results message, and a single result can be 24,000
-     * characters. A twelve-step investigation could therefore add six figures
-     * of history AFTER the only check had run, and the turn died on the
-     * provider's context limit with an opaque error — in exactly the long
-     * sessions the tool is for.
-     *
-     * The current round is never touched: it is the question being answered.
-     */
-    const budgeted = budgetForRequest(messages, requestReserve(), calibration.chars(historyCapTokens), calibration.charsPerToken, ledger.liveCallIds());
-    if (budgeted.droppedRounds > 0) {
-      messages.length = 0;
-      messages.push(...budgeted.messages);
-      yield {
-        type: "history-trimmed",
-        droppedRounds: budgeted.droppedRounds,
-        droppedPinned: budgeted.droppedPinned
-      };
-    } else if (budgeted.messages !== messages) {
-      messages.length = 0;
-      messages.push(...budgeted.messages);
-    }
-    let text = "";
-    /** See `breakBefore`: set once the first text of THIS round has gone out. */
-    let textThisRound = false;
-    const textEvent = delta => {
-      // Only when this round opens a NEW paragraph of an answer that has
-      // already started. A turn whose first words arrive in round three has
-      // nothing to be separated from, and marking that would put the flag on
-      // events where it means nothing.
-      const opensNewRound = answerStarted && !textThisRound;
-      textThisRound = true;
-      answerStarted = true;
-      return opensNewRound ? {
-        type: "text",
-        delta,
-        breakBefore: true
-      } : {
-        type: "text",
-        delta
-      };
-    };
-    let calls = [];
-    /**
-     * Recovered from text rather than emitted as calls — see textToolCalls.ts.
-     * Tracked by id so each one's result can tell the model to stop doing that;
-     * they are otherwise ordinary calls and get every check the others get.
-     */
-    const salvagedIds = new Set();
-    /**
-     * Text withheld from the screen while it could still be a tool-call
-     * envelope. Streamed text cannot be un-shown, so the choice has to be made
-     * before it leaves — and a model that writes its call as JSON must not
-     * have that JSON become the answer the user reads.
-     */
-    let held = "";
-    let holding = true;
-    // Carried, never read: Anthropic requires the turn's thinking blocks back
-    // verbatim with its tool results. See providers/anthropic.ts note 5.
-    let thinking = [];
-    let failed = false;
-    /**
-     * What the provider said about how the stream ended.
-     *
-     * Undefined means it never said — a bare EOF, or a host-supplied provider
-     * whose generator simply returned. Both are treated as incomplete, so the
-     * fail-safe direction is the default rather than something each adapter
-     * has to remember to opt into.
-     */
-    let outcome;
-    /** Set for the two kinds that are recoverable rather than a hard failure. */
-    let incomplete;
-
-    /**
-     * THE REQUEST, with its retries. One request per pass; a pass that fails
-     * before the model generated anything may be sent again (see
-     * THROTTLE_RETRIES). Everything the pass accumulated is reset first —
-     * there is nothing to keep, by the rule that made the retry safe.
-     */
-    for (;;) {
-      text = "";
-      calls = [];
-      held = "";
-      holding = true;
-      thinking = [];
-      failed = false;
-      outcome = undefined;
-      incomplete = undefined;
-      /** The failure that ended this pass, when it is one the engine may retry. */
-      let retryable;
-      /** What this pass sends, in characters — the numerator of the calibration sample. */
-      const sentChars = fixedChars + messages.reduce((n, m) => n + messageSize(m), 0);
-      for await (const ev of provider.send({
-        messages,
-        system,
-        systemVolatile,
-        tools,
-        model,
-        maxTokens,
-        signal
-      })) {
-        if (ev.type === "text") {
-          text += ev.delta;
-          if (!holding) {
-            yield textEvent(ev.delta);
-          } else if (couldBeToolCallEnvelope(text)) {
-            held += ev.delta;
-          } else {
-            // Not an envelope after all. Release everything at once and stream
-            // the rest as usual — the reader loses nothing but a few characters
-            // of latency at the very start of the answer.
-            holding = false;
-            held = "";
-            yield textEvent(text);
-          }
-        } else if (ev.type === "tool-call") {
-          calls.push(ev.call);
-        } else if (ev.type === "thinking") {
-          thinking.push(ev.block);
-          // Surfaced as well as carried: the block goes back to the provider
-          // verbatim (note above), and the readable half goes to the UI so a
-          // tester can see WHY a turn did what it did. Redacted blocks have no
-          // readable half and are carried only.
-          if (ev.block.type === "thinking" && ev.block.thinking.trim()) {
-            yield {
-              type: "reasoning",
-              text: ev.block.thinking
-            };
-          }
-        } else if (ev.type === "error") {
-          if (ev.kind === "truncated" || ev.kind === "timeout") {
-            // Not a failure the user did anything about, and not one Try again
-            // can fix — re-sending the QUESTION restarts an investigation that
-            // may already have written things. Held back from the error card
-            // (which is what draws Try again) and handled below as a recoverable
-            // stop with a Continue button.
-            incomplete = {
-              message: ev.message
-            };
-          } else if (ev.problem && (ev.problem.kind === "throttled" || ev.problem.kind === "overflow") && text === "" && calls.length === 0 && thinking.length === 0) {
-            // Nothing generated, and a kind that a wait or a trim can fix.
-            // Decided after the stream closes; the adapter returns on error.
-            retryable = {
-              problem: ev.problem,
-              message: ev.message
-            };
-          } else {
-            // A mid-stream error can arrive on an already-committed 200.
-            yield {
-              type: "error",
-              message: ev.message
-            };
-            failed = true;
-          }
-        } else if (ev.type === "done") {
-          outcome = ev.outcome;
-          if (ev.usage) {
-            // The provider just counted this prompt. One sample per request
-            // keeps the chars↔tokens ratio honest for the NEXT budget.
-            calibration.observe(sentChars, promptTokensOf(ev.usage, provider.protocol));
-            // Surfaced so a host can meter cost per seat. Parsed for a long time;
-            // went nowhere anyone could see.
-            yield {
-              type: "usage",
-              ...ev.usage,
-              model: ev.model
-            };
-          }
-        }
-      }
-      if (!retryable) break;
-      const kind = retryable.problem.kind;
-      const maxAttempts = 1 + (kind === "throttled" ? THROTTLE_RETRIES : OVERFLOW_RETRIES);
-      const spent = retries[kind];
-      let waitMs = kind === "throttled" ? Math.min(retryable.problem.retryAfterMs ?? RETRY_BASE_MS * 2 ** spent, RETRY_AFTER_CAP_MS) + Math.floor(Math.random() * RETRY_JITTER_MS) : 0;
-      let giveUp = spent >= maxAttempts - 1 || signal?.aborted === true || Date.now() + waitMs > deadline;
-      if (!giveUp && kind === "overflow") {
-        // Halve the ceiling and trim again. If that changes nothing — the
-        // current round alone is over the limit — a retry would only repeat
-        // the refusal, so report it instead.
-        historyCapTokens = Math.floor(historyCapTokens / 2);
-        const before = messages.reduce((n, m) => n + messageSize(m), 0);
-        const again = budgetForRequest(messages, requestReserve(), calibration.chars(historyCapTokens), calibration.charsPerToken, ledger.liveCallIds());
-        const after = again.messages.reduce((n, m) => n + messageSize(m), 0);
-        if (after >= before) {
-          giveUp = true;
-        } else {
-          messages.length = 0;
-          messages.push(...again.messages);
-          if (again.droppedRounds > 0) yield {
-            type: "history-trimmed",
-            droppedRounds: again.droppedRounds,
-            droppedPinned: again.droppedPinned
-          };
-        }
-      }
-      if (giveUp) {
-        // Plain words first; the endpoint's own text after, for whoever files
-        // the bug. A user reading "prompt is too long: 213000 tokens" has no
-        // move; "start a new conversation" is one.
-        const plain = kind === "throttled" ? spent > 0 ? `The AI endpoint is rate-limiting requests — tried ${spent + 1} times.` : "The AI endpoint is rate-limiting requests." : "This conversation is too large for the AI endpoint and there was nothing older to trim. Start a new conversation, or ask a shorter question.";
-        yield {
-          type: "error",
-          message: `${plain} (${retryable.message})`
-        };
-        failed = true;
-        break;
-      }
-      retries[kind] += 1;
-      yield {
-        type: "retrying",
-        reason: kind,
-        attempt: retries[kind] + 1,
-        maxAttempts,
-        inMs: waitMs
-      };
-      if (waitMs > 0) await sleep(waitMs, signal);
-      if (signal?.aborted) {
-        yield {
-          type: "done",
-          stopReason: "stopped"
-        };
-        return messages;
-      }
-    }
-    if (failed) {
-      // Whatever was withheld is the model's own words on the way to an error.
-      // Show it rather than swallowing it.
-      if (held) yield textEvent(held);
-      yield {
-        type: "done",
-        stopReason: "error"
-      };
-      return messages;
-    }
-
-    /**
-     * THE COMPLETION GATE. Nothing below this runs a tool unless the provider
-     * said the response was whole.
-     *
-     * The failure it exists for is not theoretical and does not look like a
-     * failure: a connection cut after the model emitted
-     * `{"key":"cart","value":[]}` leaves valid JSON, a plausible-looking plan,
-     * and no error anywhere. The old code parsed those arguments, dispatched
-     * the write, sent the result back and carried on — a real mutation from
-     * half a sentence. Bare EOF is not consent.
-     *
-     * `output-limited` is the same shape from a different cause: the model hit
-     * max_tokens partway through planning. What it managed to SAY is real and
-     * is shown; what it was part-way through DOING is not run.
-     */
-    if (!incomplete && outcome !== "completed") {
-      incomplete = {
-        message: outcome === "output-limited" ? calls.length ? "The model ran out of room mid-plan, so nothing was run. What it found so far is above." : "The model ran out of room before finishing this answer." : "The answer ended before the endpoint said it was finished, so nothing was run."
-      };
-    }
-    if (incomplete) {
-      // Held text is the model's own words on the way out. Show it: the user
-      // watched it arrive and hiding it now reads as the app losing work.
-      if (held) yield textEvent(held);
-      /**
-       * Text only — never the tool calls, and never the thinking.
-       *
-       * An assistant turn carrying `tool_use` with no matching `tool_result`
-       * is an instant 400 on the next request, and these calls are exactly the
-       * ones that must not be answered. Keeping the text preserves what the
-       * user can see on screen for whatever comes next.
-       */
-      if (text.trim()) messages.push({
-        role: "assistant",
-        text
-      });
-      yield {
-        type: "block",
-        block: {
-          id: `cut${Date.now()}`,
-          kind: "notice",
-          tone: "warning",
-          text: incomplete.message,
-          actions: [{
-            label: "Continue",
-            primary: true,
-            send: "Continue where you left off."
-          }]
-        }
-      };
-      yield {
-        type: "done",
-        stopReason: "incomplete"
-      };
-      return messages;
-    }
-    if (held) {
-      // A model that wrote its call out as JSON instead of calling it. Run it,
-      // and show its `reply` — never the blob. See textToolCalls.ts.
-      const salvaged = calls.length === 0 ? parseTextToolCalls(held, catalog) : undefined;
-      if (salvaged) {
-        for (const call of salvaged.calls) {
-          calls.push(call);
-          salvagedIds.add(call.id);
-        }
-        text = salvaged.reply;
-        if (salvaged.reply) yield textEvent(salvaged.reply);
-      } else {
-        yield textEvent(held);
-      }
-      held = "";
-    }
-    messages.push({
-      role: "assistant",
-      text,
-      toolCalls: calls.length ? calls : undefined,
-      thinking: thinking.length ? thinking : undefined
-    });
-    if (text.trim()) spoken.push(text.trim());
-    if (calls.length === 0) {
-      // The turn is over and the model wrote its own words. Two ways those
-      // words end badly, and they are different failures — see askGate.ts.
-      const said = spoken.join("\n\n");
-
-      // 1. It answered a smaller question than it was asked and handed the
-      //    rest back. Fires even when chips were offered: the question is
-      //    whether the user can tap the GAP, not whether they can tap.
-      const gap = synthesizeShortfallBlock({
-        text: said,
-        attempted: attemptedAcquisition
-      });
-      if (gap) yield {
-        type: "block",
-        block: gap
-      };
-
-      // 2. It ended waiting on the user in prose. Suppressed once anything
-      //    tappable is on screen, the gap button included.
-      const asked = offeredTap || gap ? null : synthesizeAskBlock(said);
-      if (asked) {
-        yield {
-          type: "block",
-          block: asked
-        };
-        yield {
-          type: "awaiting-user",
-          blockId: asked.id
-        };
-      }
-      yield {
-        type: "done",
-        stopReason: asked ? "awaiting-user" : "answered"
-      };
-      return messages;
-    }
-    const results = [];
-    let realmWillDie = false;
-
-    /**
-     * Reads, already in flight.
-     *
-     * The loop below stays strictly serial — every yield, every ledger entry
-     * and every approval keeps its order — but a round of independent READS
-     * used to pay each round trip end to end. The prompt tells the model to
-     * chain reads freely ("reading is cheap; do it"), and a three-read round
-     * cost three times the device latency for no reason.
-     *
-     * ONLY when the whole batch is safe to overlap: every call a catalog read,
-     * none needing approval, no `buoy_ui`, nothing snapshot-only or
-     * session-local. One write, one approval or one unknown action in the
-     * batch and nothing is prefetched — the mixed case is where ordering
-     * actually matters, and it is not worth the risk for the latency.
-     */
-    const prefetch = new Map();
-    if (calls.length > 1) {
-      const safe = calls.every(c => {
-        if (c.name === UI_TOOL_NAME) return false;
-        const id = fromProviderToolName(c.name, catalog);
-        if (!id || id === "ask-buoy") return false;
-        const act = c.input?.action;
-        if (typeof act !== "string" || act === SNAPSHOT_ACTION) return false;
-        const d = findDescriptor(catalog, id, act);
-        if (!d || d.effect !== "read") return false;
-        return decide({
-          descriptor: d,
-          toolId: id,
-          policy,
-          isRelease
-        }).verdict === "allow";
-      });
-      if (safe) {
-        for (const c of calls) {
-          const id = fromProviderToolName(c.name, catalog);
-          const act = String(c.input.action);
-          const raw = {
-            ...(c.input.params ?? {})
-          };
-          const d = findDescriptor(catalog, id, act);
-          const norm = normalizeParams(id, act, raw);
-          const withDefaults = applyDefaults(norm.params, d.params);
-          if (!validateParams(withDefaults, d.params).ok) continue;
-          // Rejections are swallowed here and re-awaited in the loop, where
-          // they are turned into the same tool_result they always were.
-          const p = Promise.resolve(dispatch(id, act, withDefaults)).catch(e => {
-            throw e;
-          });
-          p.catch(() => {});
-          prefetch.set(c.id, p);
-        }
-      }
-    }
-    let awaiting = null;
-
-    /**
-     * A call Stop got to first — as a row, so the transcript says which ones.
-     *
-     * Resolved leniently: the call has not been validated yet, and a label
-     * that falls back to `tool.action` is better than no row for a call the
-     * user needs to know did not run.
-     */
-    const stoppedStep = call => {
-      const toolId = fromProviderToolName(call.name, catalog) ?? call.name;
-      const action = typeof call.input?.action === "string" ? call.input.action : "";
-      const descriptor = action ? findDescriptor(catalog, toolId, action) : undefined;
-      const params = call.input?.params ?? {};
-      return [{
-        type: "tool-start",
-        id: call.id,
-        toolId,
-        action,
-        label: descriptor ? describeCall(toolId, descriptor, params) : `${toolId}.${action}`,
-        description: descriptor?.summary ?? "",
-        params,
-        effect: descriptor?.effect ?? "read"
-      }, {
-        type: "tool-end",
-        id: call.id,
-        ok: false,
-        summary: "stopped",
-        durationMs: 0
-      }];
-    };
-
-    /**
-     * THE BATCH BARRIER — what the whole batch will do, decided before any of
-     * it does anything.
-     *
-     * A model answers with several calls at once, and they used to run one at
-     * a time with each approval asked when its own call came up. So
-     * `[set the flag, delete the cache]` wrote the flag, THEN asked about the
-     * delete — and a user who declined had already changed the app, with the
-     * bubble reading "changed the flag" directly above "left the cache alone".
-     * Declining is supposed to mean the plan does not happen.
-     *
-     * The fix is not to ask again later or to refuse afterwards, neither of
-     * which can unrun a write. It is to ask FIRST: every gated call in the
-     * batch is put to the user before the batch's first mutation dispatches,
-     * so consent is given with the whole plan visible.
-     *
-     * Resolution here is pure and duplicates the loop's own — deliberately.
-     * Anything it cannot resolve (an unknown tool, a bad shape) comes back as
-     * neither mutating nor gated, so the loop reports it exactly as it always
-     * did and the barrier simply does not fire. Failing back to today's
-     * behaviour is the right failure for a safety gate to have.
-     */
-    const planned = calls.map(call => {
-      if (call.name === UI_TOOL_NAME) return undefined;
-      const toolId = fromProviderToolName(call.name, catalog);
-      const action = typeof call.input?.action === "string" ? call.input.action : undefined;
-      if (!toolId || !action) return undefined;
-      const descriptor = findDescriptor(catalog, toolId, action);
-      if (!descriptor) return undefined;
-      const raw = call.input.params ?? {};
-      const params = applyDefaults(normalizeParams(toolId, action, raw).params, descriptor.params);
-      if (!validateParams(params, descriptor.params).ok) return undefined;
-      const verdict = decide({
-        descriptor,
-        toolId,
-        policy,
-        isRelease
-      });
-      return {
-        call,
-        toolId,
-        action,
-        descriptor,
-        params,
-        label: describeCall(toolId, descriptor, params),
-        mutates: descriptor.effect !== "read",
-        gated: verdict.verdict === "needs-approval",
-        reason: verdict.verdict === "needs-approval" ? verdict.reason : ""
-      };
-    });
-    const gatedInBatch = planned.some(p => p?.gated);
-    /** Decisions the barrier has already taken, so no call is asked twice. */
-    const decided = new Map();
-    let barrierRun = false;
-    let batchDeclined = false;
-
-    /** Put every gated call in the batch to the user, in the order written. */
-    async function* runBarrier() {
-      barrierRun = true;
-      for (const p of planned) {
-        if (!p?.gated || decided.has(p.call.id)) continue;
-        if (trusted?.has(`${p.toolId}.${p.action}`)) {
-          // Waived for this conversation: runs like any allowed write, no card.
-          decided.set(p.call.id, true);
-          continue;
-        }
-        yield {
-          type: "approval-required",
-          id: p.call.id,
-          toolId: p.toolId,
-          action: p.action,
-          label: p.label,
-          description: p.descriptor.summary,
-          reason: p.reason
-        };
-        const askedAt = Date.now();
-        const targetDigest = await readTargetDigest({
-          toolId: p.toolId,
-          action: p.action,
-          params: p.params,
-          dispatch,
-          catalog
-        });
-        const answer = readAnswer(trusted?.has(`${p.toolId}.${p.action}`) ? true : requestApproval ? await requestApproval({
-          id: p.call.id,
-          toolId: p.toolId,
-          action: p.action,
-          label: p.label,
-          description: p.descriptor.summary,
-          reason: p.reason,
-          params: p.params,
-          targetDigest
-        }) : false);
-        // The user's deliberation is not the agent's runtime.
-        deadline += Date.now() - askedAt;
-        const approved = answer.approved;
-        decided.set(p.call.id, approved);
-        if (answer.trust) trusted?.add(`${p.toolId}.${p.action}`);
-        if (answer.reason) declineReasons.set(p.call.id, answer.reason);
-        if (!approved) {
-          // One refusal ends the PLAN, not just the call. The remaining
-          // changes were proposed together and nothing has run yet, so
-          // carrying on with the rest would apply half of something the user
-          // has just turned down.
-          batchDeclined = true;
-          return;
-        }
-      }
-    }
-    for (const call of calls) {
-      /**
-       * Stop was pressed while this batch was running.
-       *
-       * The abort signal used to be read only at the top of a ROUND, so a
-       * response carrying three calls ran all three after the tap — and the
-       * bubble then said "Stopped." over two writes the user believed it had
-       * prevented. Each call now checks before it starts. A dispatch already
-       * in flight is left to finish (nothing can pull a store write back out
-       * of an adapter) and keeps its receipt; everything after it is reported
-       * as not run, each as its own row, so the transcript says exactly which
-       * changes landed. A result is still pushed for every call — the provider
-       * requires one per tool_use or the next request is rejected.
-       */
-      if (signal?.aborted) {
-        // A `buoy_ui` card that was never shown is not a step; no row for it.
-        if (call.name !== UI_TOOL_NAME) {
-          for (const ev of stoppedStep(call)) yield ev;
-        }
-        results.push({
-          toolCallId: call.id,
-          content: "Not run — the user pressed Stop before this call started.",
-          isError: true
-        });
-        continue;
-      }
-
-      // `buoy_ui`: show or ask. Validated like any action; an Ask block ends
-      // the turn after this batch — the answer comes back as a user message.
-      if (call.name === UI_TOOL_NAME) {
-        const built = buildUiBlock(call.input);
-        if (!built.ok || !built.block) {
-          results.push({
-            toolCallId: call.id,
-            /**
-             * The trailing sentence is the expensive half.
-             *
-             * A model that gets a block bounced rewrites its WHOLE answer on
-             * the retry, and one assistant bubble spans every round of a turn
-             * (see `breakBefore`), so the user reads the same paragraph again
-             * — measured at four near-identical closings from three schema
-             * misses in a row on one live turn. The block is wrong; the
-             * sentence under it was fine.
-             */
-            content: `Invalid ${UI_TOOL_NAME} block:\n${built.errors.join("\n")}\n\nResend ONLY the corrected block. Do not rewrite your answer — whatever you already said this turn has been shown to the user, and saying it again repeats it on their screen.`,
-            isError: true
-          });
-          continue;
-        }
-        // Provenance for pictures, ENFORCED: an image URL the model did not
-        // read from a tool result this turn does not render. Live or nothing.
-        // Dropping pictures SILENTLY is its own bug: the model then writes
-        // "here they are, with artwork" over a card that has none, and the
-        // user is told something untrue about their own screen. Every drop
-        // comes back in the tool result so the next sentence can be honest.
-        let droppedImages = 0;
-        if (built.block.kind === "imageGrid") {
-          const kept = built.block.images.filter(img => seenUrls.has(img.url));
-          droppedImages = built.block.images.length - kept.length;
-          if (kept.length === 0) {
-            results.push({
-              toolCallId: call.id,
-              content: URL_PROVENANCE_REJECTION,
-              isError: true
-            });
-            continue;
-          }
-          built.block = {
-            ...built.block,
-            images: kept
-          };
-        }
-        if (built.block.kind === "list") {
-          const items = built.block.items.map(item => {
-            if (!item.image || seenUrls.has(item.image)) return item;
-            droppedImages += 1;
-            return {
-              ...item,
-              image: undefined
-            };
-          });
-          built.block = {
-            ...built.block,
-            items
-          };
-        }
-        yield {
-          type: "block",
-          block: built.block,
-          forToolCallId: call.id
-        };
-        if (built.block.kind === "actions" || built.block.kind === "suggestions") offeredTap = true;
-        if (isAskBlock(built.block)) {
-          awaiting = built.block.id;
-          results.push({
-            toolCallId: call.id,
-            content: "Shown. Waiting for the user's answer — it will arrive as their next message. Do not guess it."
-          });
-        } else {
-          results.push({
-            toolCallId: call.id,
-            content: "Shown to the user. Don't repeat its contents in text." + (droppedImages > 0 ? droppedImageNote(droppedImages) : "")
-          });
-        }
-        continue;
-      }
-      const toolId = fromProviderToolName(call.name, catalog);
-      const action = call.input.action;
-
-      /**
-       * A call that never reached a tool at all.
-       *
-       * Same rule as a refusal: the model made a move, the move went nowhere,
-       * and a transcript that hides it leaves the reader watching the agent
-       * change its mind for no visible reason. Caught on device — a model
-       * guessed three navigation tool names that do not exist, spent 41
-       * seconds doing it, and the only trace was a sentence it chose to write.
-       * `read` because nothing was touched.
-       */
-      const deadCall = (label, summary) => [{
-        type: "tool-start",
-        id: call.id,
-        toolId: toolId ?? call.name,
-        action: action ?? "",
-        label,
-        description: "",
-        params: call.input.params ?? {},
-        effect: "read"
-      }, {
-        type: "tool-end",
-        id: call.id,
-        ok: false,
-        summary,
-        durationMs: 0
-      }];
-
-      // Two different mistakes, kept apart on purpose. Merging them tells a
-      // model that forgot `action` that the TOOL does not exist, and it stops
-      // reaching for a tool that was fine — the same distinction
-      // `dispatchToolAction` draws between an unknown tool and an unknown
-      // action, for the same reason.
-      if (!toolId) {
-        for (const ev of deadCall(call.name, "No such tool")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: `There is no tool called "${call.name}". Use one of the tools you were given.`,
-          isError: true
-        });
-        continue;
-      }
-      if (!action) {
-        for (const ev of deadCall(call.name, "No action given")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: `"${call.name}" needs an "action" — it is required, and it names which of this tool's actions to run. See the action list in the tool's description.`,
-          isError: true
-        });
-        continue;
-      }
-      const descriptor = findDescriptor(catalog, toolId, action);
-      if (!descriptor) {
-        // Name the alternatives. Without them a model that guessed an action
-        // has nowhere to go but guess again, and the next guess is no better
-        // informed than the last.
-        const known = catalog.find(t => t.toolId === toolId)?.actions.map(a => a.action).join(", ");
-        for (const ev of deadCall(`${toolId}.${action}`, "No such action")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: `"${action}" is not an action on ${toolId}.${known ? ` Valid actions: ${known}.` : ""}`,
-          isError: true
-        });
-        continue;
-      }
-      const raw = call.input.params ?? {};
-      // Accept the parameter-name misses every model makes (queryKey for
-      // queryHash, requestId for id, flat rule fields, …) before validation,
-      // so a mechanical alias never costs a turn. See normalizeParams.ts.
-      const normalized = normalizeParams(toolId, action, raw);
-      const params = applyDefaults(normalized.params, descriptor.params);
-      const check = validateParams(params, descriptor.params);
-      if (!check.ok) {
-        results.push({
-          toolCallId: call.id,
-          content: `Invalid parameters for ${toolId}.${action}:\n${check.errors.join("\n")}\n\nExpected schema:\n${JSON.stringify(descriptor.params)}`,
-          isError: true
-        });
-        continue;
-      }
-      const aliasTrailer = aliasNote(normalized.notes);
-      const label = describeCall(toolId, descriptor, params);
-      const verdict = decide({
-        descriptor,
-        toolId,
-        policy,
-        isRelease
-      });
-
-      // A step the user can SEE, for a call that never ran. `tool-end` alone
-      // updates a row that was never opened, so a refusal used to leave no
-      // trace in the transcript at all — the model simply changed its mind
-      // between one sentence and the next.
-      const unrunStep = summary => [{
-        type: "tool-start",
-        id: call.id,
-        toolId,
-        action,
-        label,
-        description: descriptor.summary,
-        params,
-        effect: descriptor.effect
-      }, {
-        type: "tool-end",
-        id: call.id,
-        ok: false,
-        summary,
-        durationMs: 0
-      }];
-      if (verdict.verdict === "refuse") {
-        for (const ev of unrunStep("refused")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: verdict.reason,
-          isError: true
-        });
-        continue;
-      }
-
-      /**
-       * Nothing in this batch changes anything until every card in it has been
-       * answered. See `runBarrier` — this is the line that makes a decline
-       * mean "the plan does not happen" rather than "the rest of the plan does
-       * not happen".
-       */
-      const gatedHere = verdict.verdict === "needs-approval";
-      if (gatedInBatch && !barrierRun && (descriptor.effect !== "read" || gatedHere)) {
-        yield* runBarrier();
-      }
-      if (batchDeclined && (descriptor.effect !== "read" || gatedHere)) {
-        for (const ev of unrunStep("declined")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: decided.get(call.id) === false ? declinedResult(declineReasons.get(call.id)) : "Not run — the user declined another change in this same batch, so none of it was applied. Ask what they would prefer before proposing it again.",
-          isError: true
-        });
-        continue;
-      }
-      if (gatedHere) {
-        let approved;
-        if (decided.has(call.id)) {
-          // The barrier already put this card up, before the batch's first
-          // mutation. Asking again would be the same question twice.
-          approved = decided.get(call.id);
-        } else if (trusted?.has(`${toolId}.${action}`)) {
-          // Waived for this conversation — see RunTurnInput.trusted.
-          approved = true;
-          decided.set(call.id, true);
-        } else {
-          // The barrier could not resolve this call (see `planned`), so it was
-          // never offered. Ask here, exactly as this always did — a gate that
-          // fails closed by silently declining would be worse than one that
-          // asks late.
-          yield {
-            type: "approval-required",
-            id: call.id,
-            toolId,
-            action,
-            label,
-            description: descriptor.summary,
-            reason: verdict.reason
-          };
-          const askedAt = Date.now();
-          // What the write is about to replace, as of NOW. Only a restored
-          // card ever reads it back — see readTargetDigest.
-          const targetDigest = await readTargetDigest({
-            toolId,
-            action,
-            params,
-            dispatch,
-            catalog
-          });
-          const answer = readAnswer(requestApproval ? await requestApproval({
-            id: call.id,
-            toolId,
-            action,
-            label,
-            description: descriptor.summary,
-            reason: verdict.reason,
-            params,
-            targetDigest
-          }) : false);
-          // The user's deliberation is not the agent's runtime. Give the clock
-          // back before anything else can trip the deadline check.
-          deadline += Date.now() - askedAt;
-          approved = answer.approved;
-          decided.set(call.id, approved);
-          if (answer.trust) trusted?.add(`${toolId}.${action}`);
-          if (answer.reason) declineReasons.set(call.id, answer.reason);
-        }
-        if (!approved) {
-          // The row is the whole point here. Without it the bubble read as a
-          // contradiction — "Bumped the line from 5 to 9." straight into "I
-          // left it as it was" — with nothing on screen to say a change had
-          // been proposed and turned down.
-          for (const ev of unrunStep("declined")) yield ev;
-          results.push({
-            toolCallId: call.id,
-            content: declinedResult(declineReasons.get(call.id)),
-            isError: true
-          });
-          continue;
-        }
-      }
-      if (ACQUISITION_CALLS.has(`${toolId}.${action}`)) attemptedAcquisition = true;
-      yield {
-        type: "tool-start",
-        id: call.id,
-        toolId,
-        action,
-        label,
-        description: descriptor.summary,
-        params,
-        effect: descriptor.effect
-      };
-      const startedAt = Date.now();
-
-      // Capture the prior value BEFORE a storage write, so undo can restore it
-      // exactly. This is the one thing that makes storage reversible here when
-      // the Scenarios engine has to treat it as permanent.
-      const before = await captureBefore(descriptor, toolId, params, dispatch);
-      const stateBefore = await captureStoreState(descriptor, toolId, params, dispatch);
-
-      /**
-       * THE FINAL GUARD. Everything above this line happened in the past.
-       *
-       * `decide()` ran before the approval card went up, and between there and
-       * here are three awaits: the target read, the person deciding, and two
-       * pre-reads. Each one yields the thread, and a person can do a lot in
-       * that gap — press Stop, or flip the read-only toggle in the settings
-       * sheet while the card is still on screen. Both were reproduced: the
-       * write went ahead on the verdict it captured before they touched
-       * anything, which is precisely the moment the product promises it will
-       * not. `live` is mutated in place by the session (see `refreshLive`), so
-       * asking again reads the toggles as they are NOW.
-       *
-       * Below this there is no `await` before `dispatch` is CALLED. That is
-       * load-bearing: an await here would reopen the same gap one line lower.
-       */
-      if (signal?.aborted) {
-        for (const ev of unrunStep("stopped")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: "Not run — the user pressed Stop before this call started.",
-          isError: true
-        });
-        continue;
-      }
-      const stillAllowed = decide({
-        descriptor,
-        toolId,
-        policy,
-        isRelease
-      });
-      if (stillAllowed.verdict === "refuse") {
-        // `needs-approval` is NOT re-refused: reaching here means the tap
-        // already happened, and asking twice for one call is its own bug.
-        for (const ev of unrunStep("refused")) yield ev;
-        results.push({
-          toolCallId: call.id,
-          content: stillAllowed.reason,
-          isError: true
-        });
-        continue;
-      }
-      try {
-        // `getSnapshot` is reserved: it is not an adapter action, so it goes to
-        // the snapshot reader and is trimmed to the fields worth sending. See
-        // catalog/snapshotReads.ts. `ask-buoy.*` is the session itself — the
-        // ledger the model asks about lives HERE, not behind an adapter, so
-        // routing it through dispatch would only work on a device and would
-        // record the undo as a fresh effect.
-        const result = action === SNAPSHOT_ACTION ? projectSnapshot(toolId, await requireSnapshot(readSnapshot, toolId), params) : toolId === "ask-buoy" ? await runAskBuoyAction(action, ledger, dispatch, evidence, params, procedures) : await (prefetch.get(call.id) ?? dispatch(toolId, action, params));
-        const cleaned = redact(stripSelfTraffic(result));
-        const refused = reportsFailure(result);
-
-        // Kept in full — after redaction, never before — so the model can go
-        // back to it. Not a retrieve's own result (a retrieve of a retrieve is
-        // a loop), and not a refusal (nothing to go back to).
-        const text = fullText(cleaned);
-        const ref = evidence && !refused && !(toolId === "ask-buoy" && action === "retrieve") ? evidence.stash({
-          toolId,
-          action,
-          params,
-          capturedAt: Date.now(),
-          text
-        }) : undefined;
-        const encodedResult = encodeResult(text, ref);
-        const traceResult = encodedResult.length > MAX_TRACE_RESULT_CHARS ? `${encodedResult.slice(0, MAX_TRACE_RESULT_CHARS)}…` : encodedResult;
-        yield {
-          type: "tool-end",
-          id: call.id,
-          ok: !refused,
-          summary: summarise(result),
-          durationMs: Date.now() - startedAt,
-          result: traceResult
-        };
-
-        // The receipt: what the user sees of this result, built from the
-        // same redacted data the model gets. See blocks/receipts.ts.
-        //
-        // The store is read back a second time so the diff shows what the
-        // write ACTUALLY did rather than what it asked for — the two differ on
-        // every `path` edit and every keyed list edit, and the request-shaped
-        // version reported untouched fields as deleted.
-        const stateAfter = stateBefore === undefined || refused ? undefined : await captureStoreState(descriptor, toolId, params, dispatch);
-        if (descriptor.effect !== "read" && toolId !== "ask-buoy" && !refused) {
-          // A delete of something we created IS the undo, whoever asked for
-          // it — mark the matching entry undone instead of leaving the bar
-          // promising an undo against a rule that no longer exists.
-          const wasUndo = ledger.noteExternalRevert(toolId, action, params);
-          // Recorded AFTER the read-back so a cache edit's entry can carry both
-          // halves: the data to restore and a fingerprint of what the write
-          // left behind, which is how undo knows whether the app has since
-          // replaced it. See effectFor / ledger "query-write".
-          const fx = effectFor(toolId, descriptor, params, result, before, {
-            before: stateBefore,
-            after: stateAfter
-          });
-          if (fx && !wasUndo) {
-            const entry = ledger.record(toolId, action, fx, ledgerGeneration);
-            // Ties the change to its round, so the budget keeps that round
-            // while the change is live. See LedgerEntry.callId.
-            if (entry) entry.callId = call.id;
-          }
-        }
-        // No receipt for a call that changed nothing: a "what changed" card
-        // under a refusal is the same lie as the ledger entry, drawn bigger.
-        const receipt = refused ? undefined : projectReceipt({
-          toolId,
-          action,
-          params,
-          result: cleaned,
-          before: stateBefore ?? before,
-          after: stateAfter,
-          effect: descriptor.effect
-        });
-        if (receipt) yield {
-          type: "block",
-          block: receipt,
-          forToolCallId: call.id
-        };
-        /**
-         * THE OUTCOME CHECK. A write's own `{ok:true}` says the adapter
-         * accepted it; this reads the app back and says whether the requested
-         * state is actually there. Only for actions that have a verifier, only
-         * for writes that were not refused, and never itself a write. Its
-         * verdict rides in the tool result as a trailer the model reads, and
-         * on a second tool-end so the row says "verified" / "unverified" /
-         * "check failed". See engine/verify.ts for the three meanings.
-         */
-        const verification = descriptor.effect !== "read" && !refused ? await verifyOutcome({
-          toolId,
-          action,
-          params,
-          result,
-          dispatch,
-          signal,
-          after: stateAfter
-        }) : undefined;
-        if (verification) yield {
-          type: "tool-verified",
-          id: call.id,
-          verification
-        };
-        for (const url of encodedResult.match(URL_RE) ?? []) seenUrls.add(url);
-        results.push({
-          toolCallId: call.id,
-          content: encodedResult + ownedKeyNote(toolId, descriptor, params, storeKeyOwners) + aliasTrailer + (verification ? verificationTrailer(verification) : "") + (salvagedIds.has(call.id) ? SALVAGE_NOTE : ""),
-          ...(ref ? {
-            ref
-          } : {})
-        });
-        if (toolId === "app" && (action === "reloadApp" || action === "reload")) {
-          realmWillDie = true;
-        }
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        yield {
-          type: "tool-end",
-          id: call.id,
-          ok: false,
-          summary: message,
-          durationMs: Date.now() - startedAt
-        };
-        results.push({
-          toolCallId: call.id,
-          content: `Failed: ${message}`,
-          isError: true
-        });
-      }
-    }
-
-    // Looping? Say so, once, on the LAST result of this round — so it arrives
-    // attached to the thing being repeated rather than as a free-floating
-    // user turn, and the model reads it before deciding what to do next.
-    if (calls.length) {
-      recentSignatures.push(callSignature(calls));
-      if (recentSignatures.length > LOOP_REPEATS) recentSignatures.shift();
-      const looping = !loopWarned && recentSignatures.length === LOOP_REPEATS && recentSignatures.every(sig => sig === recentSignatures[0]);
-      if (looping) {
-        loopWarned = true;
-        const last = results[results.length - 1];
-        if (last) last.content = `${last.content}\n\n${LOOP_WARNING}`;
-      }
-    }
-    messages.push({
-      role: "tool-results",
-      results
-    });
-    if (awaiting) {
-      yield {
-        type: "awaiting-user",
-        blockId: awaiting
-      };
-      yield {
-        type: "done",
-        stopReason: "awaiting-user"
-      };
-      return messages;
-    }
-    if (realmWillDie) {
-      // Anything after this dies with the JS realm. Stop cleanly instead of
-      // sending a request whose answer can never arrive.
-      yield {
-        type: "done",
-        stopReason: "realm-died"
-      };
-      return messages;
-    }
-  }
-  yield {
-    type: "block",
-    block: {
-      id: `cap${Date.now()}`,
-      kind: "notice",
-      tone: "warning",
-      text: `Stopped after ${maxSteps} steps to avoid looping.`,
-      actions: [{
-        label: "Continue",
-        primary: true,
-        send: "Continue where you left off."
-      }]
-    }
-  };
-  yield {
-    type: "done",
-    stopReason: "step-cap"
-  };
-  return messages;
-}
-
-/**
- * A factual postscript for a storage write that landed on a store's saved copy.
- *
- * This is a STATEMENT ABOUT WHAT HAPPENED, not a policy reminder — the same
- * kind of thing the release refusals say, and the reason it belongs in the
- * result rather than the system prompt. The write really did succeed and the
- * app really did not change, and only the engine is in a position to know
- * both at once.
- *
- * Deliberately not a refusal. Writing the on-disk value on purpose — "make it
- * this on next launch" — is legitimate, and a hard block would make that
- * impossible. Saying so leaves the model free to continue, correct itself with
- * `zustand.rehydrate`, or explain the distinction to the user.
- */
-function ownedKeyNote(toolId, descriptor, params, storeKeyOwners) {
-  if (toolId !== "storage" || descriptor.effect === "read") return "";
-  if (!storeKeyOwners || typeof params.key !== "string") return "";
-  const storeName = storeKeyOwners[params.key];
-  if (!storeName) return "";
-  return `\n\n[Buoy] This wrote to disk, but "${params.key}" is the saved copy of the live "${storeName}" store, so nothing on screen has changed — the app read that key once at startup and has held the state in memory since. Call zustand.rehydrate({"storeName":"${storeName}"}) to make the app pick this up, or use zustand.setState next time to change the store directly. If you meant to set the value for the app's next launch, this is already done and no further action is needed.`;
-}
-export { digestOf };
-
-/**
- * Fingerprint the value a write is about to replace.
- *
- * Built for the approval card that outlives its turn: the app crashed with
- * "Set bag line L-01 qty to 14" still asking, relaunched, and the card came
- * back — and Allow wrote qty 14 against whatever the bag was NOW, maybe a
- * different account, maybe a line that no longer existed. A hash of the
- * params alone would not catch that (same label, same params, different
- * world). So the card carries a digest of the TARGET at ask time, and a
- * restored Allow re-reads and compares before it writes. Undefined when the
- * target cannot be read — then the card can only warn, not check.
- */
-export async function readTargetDigest(input) {
-  const descriptor = findDescriptor(input.catalog ?? CATALOG, input.toolId, input.action);
-  if (!descriptor || descriptor.effect === "read") return undefined;
-  const store = await captureStoreState(descriptor, input.toolId, input.params, input.dispatch);
-  if (store !== undefined) return digestOf(store);
-  const before = await captureBefore(descriptor, input.toolId, input.params, input.dispatch);
-  if (before !== undefined) return digestOf(before);
-  return undefined;
-}
-/**
- * One human-initiated action through EVERY gate the model's calls go through:
- * catalog lookup, param validation, policy, pre-read, effect ledger.
- *
- * This exists for block buttons. The `buoy_ui` schema promises the model that
- * a dispatch button runs "with the same policy and undo as if you called it",
- * and the first implementation called `dispatchToolAction` raw — no deny list,
- * no release refusal, no ledger entry. One tap on a model-authored button was
- * an invisible, ungoverned, unundoable mutation. Route every button through
- * here so the promise is true.
- *
- * `needs-approval` is treated as approved: the human's tap on the button IS
- * the approval. Deny lists, read-only mode and release refusals still stand —
- * a button must never reach further than the model could.
- */
-export async function runGatedAction(input) {
-  const {
-    toolId,
-    action,
-    dispatch,
-    ledger,
-    policy,
-    isRelease
-  } = input;
-  const catalog = input.catalog ?? CATALOG;
-  const descriptor = findDescriptor(catalog, toolId, action);
-  if (!descriptor) {
-    return {
-      ok: false,
-      error: `${toolId}.${action} is not in Buoy's catalog.`
-    };
-  }
-  const normalized = normalizeParams(toolId, action, input.params ?? {});
-  const params = applyDefaults(normalized.params, descriptor.params);
-  const check = validateParams(params, descriptor.params);
-  if (!check.ok) {
-    return {
-      ok: false,
-      error: check.errors.join("\n")
-    };
-  }
-  const verdict = decide({
-    descriptor,
-    toolId,
-    policy,
-    isRelease
-  });
-  if (verdict.verdict === "refuse") {
-    return {
-      ok: false,
-      error: verdict.reason
-    };
-  }
-  const before = await captureBefore(descriptor, toolId, params, dispatch);
-  /**
-   * The same read-back the model's path takes. It was missing here, and the
-   * gap was invisible: a `setQueryData` through a block button or a restored
-   * approval card recorded a ledger entry with no prior value, so Undo had
-   * nothing to put back and the concurrent-writer check had no fingerprint to
-   * compare. The bar said "1 undoable" over a change that could not be undone.
-   */
-  const stateBefore = await captureStoreState(descriptor, toolId, params, dispatch);
-
-  // Asked again after the pre-reads, for the same reason the model's path asks
-  // again: those are awaits, and read-only can be switched on inside one.
-  const stillAllowed = decide({
-    descriptor,
-    toolId,
-    policy,
-    isRelease
-  });
-  if (stillAllowed.verdict === "refuse") {
-    return {
-      ok: false,
-      error: stillAllowed.reason
-    };
-  }
-  try {
-    const result = toolId === "ask-buoy" ? await runAskBuoyAction(action, ledger, dispatch, undefined, params) : await dispatch(toolId, action, params);
-
-    // Same rule as the model's path: a resolved `{ok:false}` is a refusal, not
-    // a change. Without this a block button (or an approval answered after a
-    // reload) put a phantom entry in the undo bar too.
-    if (reportsFailure(result)) {
-      const err = result.error;
-      return {
-        ok: false,
-        error: typeof err === "string" ? err : "The tool refused this."
-      };
-    }
-    if (descriptor.effect !== "read" && toolId !== "ask-buoy") {
-      const wasUndo = ledger.noteExternalRevert(toolId, action, params);
-      // Read back AFTER the write, exactly as the model's path does — the two
-      // halves together are what make a cache edit undoable.
-      const stateAfter = await captureStoreState(descriptor, toolId, params, dispatch);
-      const fx = effectFor(toolId, descriptor, params, result, before, {
-        before: stateBefore,
-        after: stateAfter
-      });
-      if (fx && !wasUndo) ledger.record(toolId, action, fx);
-    }
-    return {
-      ok: true,
-      result
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-
-/**
- * The `ask-buoy` catalog tool, served by the engine itself. `listChanges` and
- * `undoAll` operate on THIS session's ledger — the same one the changes bar
- * renders — so the model's undo and the human's undo are one mechanism. The
- * adapter's same-named actions remain for desktop/MCP, where the ledger is
- * reached over the broker instead.
- */
-async function runAskBuoyAction(action, ledger, dispatch, evidence, params, procedures) {
-  if (action === "retrieve") {
-    return retrieveEvidence(evidence, params ?? {});
-  }
-  if (action === "openProcedure") {
-    const id = typeof params?.id === "string" ? params.id : "";
-    const found = procedures?.find(p => p.id === id);
-    if (!found) {
-      const ids = (procedures ?? []).map(p => p.id);
-      return {
-        ok: false,
-        error: ids.length ? `No procedure "${id}". This app's procedures: ${ids.join(", ")}.` : "This app has no procedures written for it."
-      };
-    }
-    return {
-      id: found.id,
-      title: found.title,
-      ...(found.version ? {
-        version: found.version
-      } : {}),
-      ...(found.requires?.length ? {
-        requires: found.requires
-      } : {}),
-      body: found.body,
-      note: "Follow these steps with the ordinary tools. Every write still goes through the same policy, approval and undo as any other call; a step that is refused stays refused."
-    };
-  }
-  if (action === "listChanges") {
-    const changes = ledger.list().filter(e => !e.undoneAt).map(e => ({
-      toolId: e.toolId,
-      action: e.action,
-      kind: e.effect.kind,
-      label: e.effect.label,
-      reversible: isReversible(e.effect)
-    }));
-    return {
-      changes,
-      returned: changes.length
-    };
-  }
-  if (action === "undoAll") {
-    const outcome = await ledger.revertAll(dispatch);
-    return {
-      ok: outcome.failed.length === 0,
-      ...outcome
-    };
-  }
-  throw new Error(`Unknown ask-buoy action "${action}"`);
-}
-
-/** Fail loudly rather than hand the model an empty object it will believe. */
-async function requireSnapshot(readSnapshot, toolId) {
-  if (!readSnapshot) {
-    throw new Error(`This app cannot read ${toolId}'s snapshot — Buoy's tool registry is not published here.`);
-  }
-  return await readSnapshot(toolId);
-}
-
-/**
- * Read a storage key's current value so the write can be reversed.
- *
- * This pre-read is the ONLY reason storage is reversible here. The adapter's
- * `async.*` / `mmkv.*` proxies all return void, so neither the prior value nor
- * the store event id that `timeTravel.undo` needs ever reaches a caller — and
- * that event only exists while something holds capture open. Reading first is
- * what turns "we don't know what was there" into a real undo.
- *
- * Deliberately NOT gated on `descriptor.undo`: the catalog's undo claims were
- * audited down to almost nothing precisely because they were unsound. The
- * ledger's reversibility comes from this read, not from a catalog promise.
- */
-/**
- * The prior state for a store write, so the receipt can show a real diff.
- * Zustand only for now: `getStoreState` is cheap and the write params carry
- * the after-state, so the diff is exact without the store's cooperation.
- */
-/**
- * Read a zustand store whole, for the before/after halves of a write receipt.
- * Called on both sides of the dispatch — see the receipt above.
- */
-async function captureStoreState(descriptor, toolId, params, dispatch) {
-  if (toolId === "zustand" && descriptor.action === "setState") {
-    if (typeof params.storeName !== "string") return undefined;
-    try {
-      return await dispatch(toolId, "getStoreState", {
-        storeName: params.storeName
-      });
-    } catch {
-      return undefined;
-    }
-  }
-  /**
-   * The same read-both-sides trick for the CACHE.
-   *
-   * A zustand edit produced a "what changed" card and the identical edit to a
-   * query produced nothing — for the write the prompt calls "THE way to change
-   * what a server-backed screen shows". The QA tester's confirmation that the
-   * right field moved was missing from the most-used tool in the product.
-   */
-  if (toolId === "query" && descriptor.action === "setQueryData") {
-    // hashQueryKey, not JSON.stringify: React Query SORTS object keys when it
-    // hashes, so a key carrying `{query:"",category:null}` hashes as
-    // `{"category":null,"query":""}`. Stringifying in insertion order produced
-    // a hash that matched nothing, the read came back empty, and the card
-    // silently did not draw.
-    const queryHash = typeof params.queryHash === "string" ? params.queryHash : Array.isArray(params.queryKey) ? hashQueryKey(params.queryKey) : undefined;
-    if (!queryHash) return undefined;
-    try {
-      return await dispatch(toolId, "getQueryData", {
-        queryHash
-      });
-    } catch {
-      return undefined;
-    }
-  }
-  return undefined;
-}
-async function captureBefore(descriptor, toolId, params, dispatch) {
-  if (descriptor.effect === "read") return undefined;
-  if (toolId === "network") return captureRuleSwitch(descriptor, params, dispatch);
-  if (toolId !== "storage" || typeof params.key !== "string") return undefined;
-  const readAction = descriptor.action.startsWith("async.") ? "async.getItem" : descriptor.action.startsWith("mmkv.") ? "mmkv.get" : undefined;
-  // secure.* is excluded on purpose: a key registered with
-  // `requireAuthentication` cannot be read without a biometric prompt, so a
-  // pre-read would either fail or pop a Face ID sheet mid-conversation.
-  if (!readAction) return undefined;
-
-  // MMKV IS PER-INSTANCE, and `mmkv.get` does not throw when the id is missing
-  // — it returns `{found:false, reason:"missing instanceId/key"}`. Reading with
-  // the key alone therefore produced a `before` that LOOKED captured and was
-  // empty, which the ledger then read as "the key did not exist" and undid by
-  // deleting it. Without an instance there is nothing to capture, so say so.
-  const readParams = {
-    key: params.key
-  };
-  if (readAction === "mmkv.get") {
-    if (typeof params.instanceId !== "string") return undefined;
-    readParams.instanceId = params.instanceId;
-  }
-  try {
-    const current = await dispatch(toolId, readAction, readParams);
-    const rec = current && typeof current === "object" ? current : undefined;
-    // An explicit "I could not read that" is not a captured empty value.
-    if (rec?.found === false) return undefined;
-    const value = rec ? rec.value : current;
-    return {
-      had: value !== undefined && value !== null,
-      value: value ?? undefined
-    };
-  } catch {
-    // A failed pre-read must not block the write the user asked for; it just
-    // means this one is not reversible, which the ledger will say.
-    return undefined;
-  }
-}
-
-/**
- * The switch a rule toggle is about to flip, as `{had, value:"true"|"false"}`.
- *
- * Arming a rule the user already had fell through to a one-shot, so the bar
- * showed no change and Undo left the rule firing. The prior flag is what
- * makes it reversible: undo sets it back, and a toggle that changed nothing
- * is not recorded as a change at all.
- */
-async function captureRuleSwitch(descriptor, params, dispatch) {
-  if (descriptor.action !== "setOverrideRuleEnabled" && descriptor.action !== "setOverridesEnabled") {
-    return undefined;
-  }
-  try {
-    const state = await dispatch("network", "listOverrideRules", {});
-    if (!state || typeof state !== "object") return undefined;
-    if (descriptor.action === "setOverridesEnabled") {
-      return {
-        had: true,
-        value: String(state.enabled !== false)
-      };
-    }
-    const rule = (state.rules ?? []).find(r => r && r.id === params.id);
-    if (!rule) return undefined;
-    return {
-      had: true,
-      value: String(rule.enabled !== false)
-    };
-  } catch {
-    return undefined;
-  }
-}
-//# sourceMappingURL=runAgentTurn.js.map
+[Buoy] This wrote to disk, but "${r.key}" is the saved copy of the live "${c}" store, so nothing on screen has changed \u2014 the app read that key once at startup and has held the state in memory since. Call zustand.rehydrate({"storeName":"${c}"}) to make the app pick this up, or use zustand.setState next time to change the store directly. If you meant to set the value for the app's next launch, this is already done and no further action is needed.`}export{ve as digestOf};export async function readTargetDigest(t){const n=D(t.catalog??Ge,t.toolId,t.action);if(!n||n.effect==="read")return void 0;const r=await ee(n,t.toolId,t.params,t.dispatch);if(r!==void 0)return ve(r);const l=await Ie(n,t.toolId,t.params,t.dispatch);if(l!==void 0)return ve(l);return void 0}export async function runGatedAction(t){const{toolId:n,action:r,dispatch:l,ledger:c,policy:k,isRelease:y}=t;const f=t.catalog??Ge;const m=D(f,n,r);if(!m){return{ok:false,error:`${n}.${r} is not in Buoy's catalog.`}}const J=le(n,r,t.params??{});const w=ae(J.params,m.params);const M=de(w,m.params);if(!M.ok){return{ok:false,error:M.errors.join("\n")}}const L=G({descriptor:m,toolId:n,policy:k,isRelease:y});if(L.verdict==="refuse"){return{ok:false,error:L.reason}}const q=await Ie(m,n,w,l);const N=await ee(m,n,w,l);const j=G({descriptor:m,toolId:n,policy:k,isRelease:y});if(j.verdict==="refuse"){return{ok:false,error:j.reason}}try{const v=n==="ask-buoy"?await nt(r,c,l,void 0,w):await l(n,r,w);if(ot(v)){const B=v.error;return{ok:false,error:typeof B==="string"?B:"The tool refused this."}}if(m.effect!=="read"&&n!=="ask-buoy"){const B=c.noteExternalRevert(n,r,w);const F=await ee(m,n,w,l);const _=Ye(n,m,w,v,q,{before:N,after:F});if(_&&!B)c.record(n,r,_)}return{ok:true,result:v}}catch(v){return{ok:false,error:v instanceof Error?v.message:String(v)}}}async function nt(t,n,r,l,c,k){if(t==="retrieve"){return _t(l,c??{})}if(t==="openProcedure"){const y=typeof c?.id==="string"?c.id:"";const f=k?.find(m=>m.id===y);if(!f){const m=(k??[]).map(J=>J.id);return{ok:false,error:m.length?`No procedure "${y}". This app's procedures: ${m.join(", ")}.`:"This app has no procedures written for it."}}return{id:f.id,title:f.title,...f.version?{version:f.version}:{},...f.requires?.length?{requires:f.requires}:{},body:f.body,note:"Follow these steps with the ordinary tools. Every write still goes through the same policy, approval and undo as any other call; a step that is refused stays refused."}}if(t==="listChanges"){const y=n.list().filter(f=>!f.undoneAt).map(f=>({toolId:f.toolId,action:f.action,kind:f.effect.kind,label:f.effect.label,reversible:ht(f.effect)}));return{changes:y,returned:y.length}}if(t==="undoAll"){const y=await n.revertAll(r);return{ok:y.failed.length===0,...y}}throw new Error(`Unknown ask-buoy action "${t}"`)}async function Qt(t,n){if(!t){throw new Error(`This app cannot read ${n}'s snapshot \u2014 Buoy's tool registry is not published here.`)}return await t(n)}async function ee(t,n,r,l){if(n==="zustand"&&t.action==="setState"){if(typeof r.storeName!=="string")return void 0;try{return await l(n,"getStoreState",{storeName:r.storeName})}catch{return void 0}}if(n==="query"&&t.action==="setQueryData"){const c=typeof r.queryHash==="string"?r.queryHash:Array.isArray(r.queryKey)?ut(r.queryKey):void 0;if(!c)return void 0;try{return await l(n,"getQueryData",{queryHash:c})}catch{return void 0}}return void 0}async function Ie(t,n,r,l){if(t.effect==="read")return void 0;if(n==="network")return Xt(t,r,l);if(n!=="storage"||typeof r.key!=="string")return void 0;const c=t.action.startsWith("async.")?"async.getItem":t.action.startsWith("mmkv.")?"mmkv.get":void 0;if(!c)return void 0;const k={key:r.key};if(c==="mmkv.get"){if(typeof r.instanceId!=="string")return void 0;k.instanceId=r.instanceId}try{const y=await l(n,c,k);const f=y&&typeof y==="object"?y:void 0;if(f?.found===false)return void 0;const m=f?f.value:y;return{had:m!==void 0&&m!==null,value:m??void 0}}catch{return void 0}}async function Xt(t,n,r){if(t.action!=="setOverrideRuleEnabled"&&t.action!=="setOverridesEnabled"){return void 0}try{const l=await r("network","listOverrideRules",{});if(!l||typeof l!=="object")return void 0;if(t.action==="setOverridesEnabled"){return{had:true,value:String(l.enabled!==false)}}const c=(l.rules??[]).find(k=>k&&k.id===n.id);if(!c)return void 0;return{had:true,value:String(c.enabled!==false)}}catch{return void 0}}