@canonmsg/agent-sdk 12.6.1 → 13.0.2

package/dist/chunks/{chunk-DAJ7L7TN.js → chunk-DNHJGAEL.js}

@@ -8,9 +8,8 @@ import {
   wasmMlsCustody,
   windowsAclProblems,
   writeDurable
-} from "./chunk-HH7KR22P.js";
+} from "./chunk-DTAWEQCM.js";
 import {
-  ApprovalManager,
   BoundedFileReadError,
   CanonClient,
   MAX_CANON_MEDIA_BYTES,
@@ -18,8 +17,6 @@ import {
   RUNTIME_STOP_ACTION,
   RUNTIME_STOP_AND_DROP_ACTION,
   acquireLock,
-  assertCompletedOutputAudience,
-  buildChunkedMessagePartMetadata,
   conversationMediaCacheDir,
   createCompletedOutputJournal,
   createRuntimeHeartbeat,
@@ -27,26 +24,22 @@ import {
   inferUploadMimeType,
   initRTDBAuth,
   isPendingCanonOperation,
-  isRetryableCanonDeliveryError,
   materializeAttachment,
   normalizeRuntimeCommandDescriptors,
   readBoundedRegularFileHandle,
   renderCanonHostInboundContent,
-  reportNoReplyOutcome,
   resolveCanonRuntimeConnection,
-  resolveTurnVerbosity,
-  sendMessageWithRetryChunked,
-  splitTextByUtf8Bytes,
+  splitTextWithinBytes,
   verifyCanonRuntimeConnection
-} from "./chunk-5J4YPLNW.js";
+} from "./chunk-TYZT346O.js";
 import {
   NodeMlsDevCustodyError,
   createNodeMlsDevCustody,
   createPortableNodeMlsDevCustody
-} from "./chunk-FVYKLH6I.js";
+} from "./chunk-YJUPKU47.js";
 import {
   parseMlsDevClientConfiguration
-} from "./chunk-QK37HAHC.js";
+} from "./chunk-YHDDOADK.js";
 import {
   CONNECTOR_RELAY_ANSWER_WITHIN_MS,
   CONNECTOR_RELAY_INSTALLATION_PATTERN,
@@ -60,9 +53,11 @@ import {
   MLS_DEV_TEXT_MAX_BYTES,
   MLS_DEV_TEXT_PROTOCOL_V3,
   NO_REPLY_ACK_NOTE,
-  VERB_LIMITS,
+  PARTICIPATION_HISTORY_FETCH_LIMIT,
   __name,
+  buildParticipationHistorySnapshot,
   connectorRelayResponseBytes,
+  evaluateParticipationPolicy,
   isConnectorRelayCredential,
   isConnectorRelayInstallation,
   isMlsDevTextProtocol,
@@ -73,8 +68,9 @@ import {
   parseMlsDevCredentialToken,
   parseMlsDevGroupHead,
   parseMlsDevGroupRoster,
-  resolveAllowedUploadMimeType
-} from "./chunk-S7BV74DN.js";
+  resolveAllowedUploadMimeType,
+  resolveConversationPolicyScope
+} from "./chunk-5WPAB5MB.js";
 
 // src/runner/types.ts
 var DriverSessionError = class extends Error {
@@ -225,6 +221,7 @@ async function approve(turn, request) {
   return answer.scope === "session" ? "session" : "once";
 }
 __name(approve, "approve");
+var PIPE_GRACE_MS = 1e3;
 function stdioRpc(child, handlers, { name, envelope }) {
   let next = 0;
   const pending = /* @__PURE__ */ new Map();
@@ -258,6 +255,12 @@ function stdioRpc(child, handlers, { name, envelope }) {
     } else handlers.notify(message2.method, params);
   });
   child.stderr?.resume();
+  child.once("exit", () => {
+    setTimeout(() => {
+      child.stdout?.destroy();
+      child.stderr?.destroy();
+    }, PIPE_GRACE_MS).unref();
+  });
   return {
     call: /* @__PURE__ */ __name((method, params) => new Promise((resolve3, reject) => {
       next += 1;
@@ -283,7 +286,6 @@ var AUTH_REQUIRED = -32e3;
 var SYSTEM = "You are an agent in Canon, a messaging app where people and AI agents talk. Each prompt holds the new messages in one conversation. Your final message in a turn is posted there as your reply, so put your whole answer in it. Canon's tools are on the MCP server whose name starts with canon_. To ask the people in the conversation a question, call its ask_question tool and wait for the answer. When you have nothing to add, call its no_reply tool instead of answering.";
 var GUEST = "Only your owner can let you use tools in this conversation, and this turn holds a message from someone else: do not read files, run commands or use any tool but those of the MCP server whose name starts with canon_. Answer from the conversation and what you already know, and say so when something needs your owner.";
 var OWNER_ONLY = "This agent only takes messages from its owner.";
-var PIPE_GRACE_MS = 1e3;
 var KILL_AFTER_MS = 2e3;
 var MACHINE_KINDS = /* @__PURE__ */ new Set(["read", "edit", "delete", "move", "search", "execute", "fetch"]);
 var BRIDGE = `
@@ -537,10 +539,6 @@ ${text(item.newText)}`);
               }, KILL_AFTER_MS);
             });
           }
-          setTimeout(() => {
-            child.stdout?.destroy();
-            child.stderr?.destroy();
-          }, PIPE_GRACE_MS).unref();
         });
         child.once("error", (error) => gone(new Error(`Could not run ${command}: ${error.message}`)));
         child.once("close", () => gone(new Error(`${agent} exited before finishing the turn`)));
@@ -1701,7 +1699,7 @@ function createMlsIds(key) {
 }
 __name(createMlsIds, "createMlsIds");
 function requireMlsSupport(input) {
-  if (!isMlsEnvironmentId(input.environmentId) || input.agent.outboundPolicy === "closed") fail();
+  if (!isMlsEnvironmentId(input.environmentId)) fail();
 }
 __name(requireMlsSupport, "requireMlsSupport");
 function mentionsAgent(text3, names) {
@@ -2421,153 +2419,7 @@ import { realpath as realpath4, stat as stat2 } from "node:fs/promises";
 import { basename as basename4, isAbsolute as isAbsolute3, join as join7, sep } from "node:path";
 
 // ../agent-tools/src/communication-tool.ts
-var CANON_COMMUNICATE_TOOL_NAME = "communicate";
 var CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS = 10;
-var NON_EMPTY_ID = { type: "string", minLength: 1, maxLength: 160 };
-var MESSAGE_TEXT = { type: "string", minLength: 1, maxLength: 4096 };
-var OPTIONAL_CAPTION = { type: "string", maxLength: 4096 };
-var DIRECT_SELECTION_SCHEMA = {
-  oneOf: [
-    {
-      type: "object",
-      required: ["mode"],
-      additionalProperties: false,
-      properties: { mode: { const: "latest_or_new" } }
-    },
-    {
-      type: "object",
-      required: ["mode"],
-      additionalProperties: false,
-      properties: { mode: { const: "new" } }
-    },
-    {
-      type: "object",
-      required: ["mode", "conversationId"],
-      additionalProperties: false,
-      properties: {
-        mode: { const: "specific" },
-        conversationId: NON_EMPTY_ID
-      }
-    }
-  ]
-};
-function canonCommunicateToolDefinition(name = CANON_COMMUNICATE_TOOL_NAME) {
-  return {
-    name,
-    description: "Find agents, list current conversations with their participants, message an explicit conversation, start_conversation with a person or agent (new by default), create_conversation with an optional title, manage_participants, leave, forward a message or share a contact. Check the current participants before selecting an existing conversation. Canon enforces admission and operator permissions.",
-    inputSchema: {
-      type: "object",
-      oneOf: [
-        { type: "object", required: ["action"], additionalProperties: false, properties: { action: { const: "list_conversations" }, limit: { type: "integer", minimum: 1, maximum: 100 } } },
-        { type: "object", required: ["action", "conversationId"], additionalProperties: false, properties: { action: { const: "leave_conversation" }, conversationId: NON_EMPTY_ID } },
-        {
-          type: "object",
-          required: ["action"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "discover_agents" },
-            query: {
-              type: "string",
-              maxLength: MAX_DISCOVER_AGENTS_QUERY_LENGTH,
-              description: "Optional name or description prefix. Empty lists the directory."
-            },
-            limit: {
-              type: "integer",
-              minimum: 1,
-              maximum: CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS,
-              default: CANON_COMMUNICATE_DISCOVERY_MAX_RESULTS
-            },
-            cursor: {
-              type: "string",
-              minLength: 1,
-              description: "Opaque cursor from a prior discovery action with the same query."
-            }
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "text"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "message_existing" },
-            conversationId: NON_EMPTY_ID,
-            text: MESSAGE_TEXT,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "principalId", "text"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["start_conversation", "start_direct"] },
-            principalId: NON_EMPTY_ID,
-            text: MESSAGE_TEXT,
-            selection: DIRECT_SELECTION_SCHEMA,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "memberIds"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["create_conversation", "create_group"] },
-            name: { type: "string", minLength: 1, maxLength: VERB_LIMITS.groupNameChars },
-            memberIds: {
-              type: "array",
-              minItems: 1,
-              maxItems: VERB_LIMITS.groupMembers - 1,
-              uniqueItems: true,
-              items: NON_EMPTY_ID
-            }
-          }
-        },
-        {
-          type: "object",
-          required: [
-            "action",
-            "sourceConversationId",
-            "targetConversationId",
-            "messageId"
-          ],
-          additionalProperties: false,
-          properties: {
-            action: { const: "forward_message" },
-            sourceConversationId: NON_EMPTY_ID,
-            targetConversationId: NON_EMPTY_ID,
-            messageId: NON_EMPTY_ID,
-            text: OPTIONAL_CAPTION
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "contactUserId"],
-          additionalProperties: false,
-          properties: {
-            action: { const: "share_contact" },
-            conversationId: NON_EMPTY_ID,
-            contactUserId: NON_EMPTY_ID,
-            text: OPTIONAL_CAPTION,
-            messageId: NON_EMPTY_ID
-          }
-        },
-        {
-          type: "object",
-          required: ["action", "conversationId", "userId", "operation"],
-          additionalProperties: false,
-          properties: {
-            action: { enum: ["manage_participants", "manage_group_members"] },
-            conversationId: NON_EMPTY_ID,
-            userId: NON_EMPTY_ID,
-            operation: { enum: ["add", "remove"] }
-          }
-        }
-      ]
-    }
-  };
-}
-__name(canonCommunicateToolDefinition, "canonCommunicateToolDefinition");
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -2788,124 +2640,41 @@ __name(executeCanonCommunicateTool, "executeCanonCommunicateTool");
 
 // src/runner/live.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-var SNAPSHOT_GAP_MS = 250;
 var KEEPALIVE_MS = 3500;
 var PROGRESS_REFRESH_MS = 6e4;
-var MAX_ROWS = 30;
 function createLivePublisher(options) {
   const { client, conversationId, enqueue } = options;
-  const presence = options.mode === "presence";
   const presenceId = `turn-${randomBytes3(16).toString("hex")}`;
-  const publicTurnId = /* @__PURE__ */ __name(() => presence && options.turnId() !== null ? presenceId : options.turnId(), "publicTurnId");
+  const publicTurnId = /* @__PURE__ */ __name(() => options.turnId() !== null ? presenceId : null, "publicTurnId");
   const openedAt = Date.now();
-  const rows = /* @__PURE__ */ new Map();
-  let mode = options.mode;
-  let text3 = "";
   let waiting = false;
   let ended = false;
-  let sequence = 0;
-  let state;
   let stateAt = 0;
-  let snapshotAt = 0;
-  let timer;
   let keepalive;
-  const current = /* @__PURE__ */ __name(() => waiting ? "waiting_input" : presence ? "thinking" : [...rows.values()].some((row) => row.status === "running") ? "tool" : text3 ? "streaming" : "thinking", "current");
-  const typing = /* @__PURE__ */ __name((on) => enqueue(() => client.setTyping(conversationId, on, on ? "thinking" : void 0)), "typing");
-  const node = /* @__PURE__ */ __name((blank = false) => enqueue(async () => {
-    if (ended && !blank) return;
-    const turnId = options.turnId();
-    await client.setStreaming({
-      conversationId,
-      turnId,
-      messageId: turnId ?? "",
-      text: blank ? "" : text3,
-      status: blank ? "thinking" : current(),
-      blocks: blank ? [] : [...rows.values()]
-    });
-  }), "node");
   const publishState = /* @__PURE__ */ __name(() => {
-    const next = state = current();
+    const state = waiting ? "waiting_input" : "thinking";
     stateAt = Date.now();
-    enqueue(() => client.setRuntimeTurn({
-      conversationId,
-      turnId: publicTurnId(),
-      state: next,
-      openedAt,
-      turnUpdatedAt: Date.now(),
-      ...presence ? {} : options.context()
-    }));
+    enqueue(() => client.setRuntimeTurn({ conversationId, turnId: publicTurnId(), state, openedAt, turnUpdatedAt: Date.now() }));
   }, "publishState");
-  const progress = /* @__PURE__ */ __name(() => {
-    if (current() !== state || Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
-    if (mode !== "full" || timer) return;
-    timer = setTimeout(() => {
-      timer = void 0;
-      snapshotAt = Date.now();
-      node();
-    }, Math.max(0, snapshotAt + SNAPSHOT_GAP_MS - Date.now()));
-  }, "progress");
   return {
     open() {
       if (ended) return;
-      if (!presence) typing(true);
       publishState();
-      if (mode === "full") node();
       keepalive = setInterval(() => {
-        if (ended) return;
-        if (presence) {
-          if (Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
-          return;
-        }
-        if (waiting) return;
-        typing(true);
-        if (mode === "full" && !text3 && !rows.size) node();
+        if (!ended && Date.now() - stateAt > PROGRESS_REFRESH_MS) publishState();
       }, KEEPALIVE_MS);
       keepalive.unref?.();
     },
-    setMode(next) {
-      if (ended || next === mode || presence || next === "presence") return;
-      mode = next;
-      if (mode === "full") node();
-    },
-    text(snapshot) {
-      if (ended || presence || snapshot === text3) return;
-      text3 = snapshot;
-      progress();
-    },
-    activity(event) {
-      if (ended || presence) return;
-      rows.set(event.id, {
-        id: event.id,
-        turnId: options.turnId() ?? "",
-        kind: event.kind,
-        title: event.title,
-        status: event.state === "done" ? "completed" : event.state,
-        sequence: rows.get(event.id)?.sequence ?? ++sequence
-      });
-      for (const id of rows.keys()) if (rows.size > MAX_ROWS) rows.delete(id);
-      progress();
-    },
     waiting(on) {
       if (ended || waiting === on) return;
       waiting = on;
-      if (!presence) typing(!on);
       publishState();
-      if (mode === "full") node();
-    },
-    refresh() {
-      if (!ended && state && !presence) publishState();
     },
     end(how) {
       if (ended) return;
       ended = true;
-      clearTimeout(timer);
       clearInterval(keepalive);
-      if (!presence) typing(false);
-      if (mode === "full") {
-        if (how !== "answered") node(true);
-        enqueue(() => client.clearStreaming(conversationId));
-      }
-      enqueue(() => client.setRuntimeTurn(how === "stopped" ? { conversationId, turnId: publicTurnId(), state: "interrupted", ...presence ? {} : options.context() } : { conversationId, turnId: null, state: "idle", ...presence ? {} : { queueDepth: 0 }, openedAt: null, turnUpdatedAt: null }));
+      enqueue(() => client.setRuntimeTurn(how === "stopped" ? { conversationId, turnId: publicTurnId(), state: "interrupted" } : { conversationId, turnId: null, state: "idle", openedAt: null, turnUpdatedAt: null }));
     }
   };
 }
@@ -3419,7 +3188,6 @@ var CLAIM_PATIENCE_MS = 2e4;
 var HISTORY_WINDOW = 20;
 var STATE_LIMIT_BYTES = 64 * 1024;
 var FAILURE_NOTICE = "Sorry, something went wrong and I could not finish this reply.";
-var STOPS_SHORT_NOTICE = "Sorry, my reply could not be delivered in full.";
 var RESTART_NOTICE = "Sorry, I was restarted before I could finish replying to this. Please send it again if you still need an answer.";
 var CLIENT_TYPES = { code: "generic", claude: "claude-code", codex: "codex", acp: "generic", connector: "generic" };
 var objectSchema = /* @__PURE__ */ __name((properties, required = []) => ({ type: "object", properties, required, additionalProperties: false }), "objectSchema");
@@ -3489,16 +3257,60 @@ __name(within, "within");
 var pause2 = /* @__PURE__ */ __name((ms) => new Promise((resolve3) => {
   setTimeout(resolve3, ms).unref?.();
 }), "pause");
-var audienceOf = /* @__PURE__ */ __name((room) => room?.memberIds ? { memberIds: [...room.memberIds], ...typeof room.membershipRevision === "number" ? { membershipRevision: room.membershipRevision } : {} } : null, "audienceOf");
+function agentRun(turns) {
+  const history = turns.map(({ senderId, senderType }) => senderType === "ai_agent" ? { senderId, senderType, metadata: { turnSemantics: "turn_complete" } } : { senderId, senderType: "human" });
+  return {
+    consecutiveAgentTurns: buildParticipationHistorySnapshot(history.slice(1)).consecutiveAgentTurns,
+    currentAgentStreakStartedByHuman: buildParticipationHistorySnapshot(history).currentAgentStreakStartedByHuman
+  };
+}
+__name(agentRun, "agentRun");
 var inert = /* @__PURE__ */ __name((value) => value.replace(/\s+/g, " ").trim(), "inert");
 var OWNER_MARK = " [your owner]";
 var TRUSTED_MARK = " [trusted teammate agent]";
 var speaker = /* @__PURE__ */ __name((name) => inert(name).replace(/\[/g, "(").replace(/\]/g, ")"), "speaker");
-var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)"), "defused");
+var defused = /* @__PURE__ */ __name((text3) => text3.replace(/\[(\s*(?:trusted\s+teammate\s+agent|your\s+owner)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?owner['\u2019]s\s+(?:private\s+note|errand)\s*)\]/gi, "($1)").replace(/\[(\s*(?:end\s+of\s+)?conversation\s+facts\s*)\]/gi, "($1)"), "defused");
 var NOTE_OPEN = "[owner's private note] Your owner left this for you on the machine you run on. It is not a message in this conversation: no one in it sees it, and it was not posted.";
 var NOTE_CLOSE = "[end of owner's private note]";
 var ERRAND_OPEN = "[owner's errand]";
 var ERRAND_CLOSE = "[end of owner's errand]";
+var FACTS_OPEN = "[conversation facts] Your runner added this from Canon's records. It is not a message, and no one in the conversation sees it.";
+var FACTS_CLOSE = "[end of conversation facts]";
+var MAX_FACT_MEMBERS = 50;
+var MAX_FACT_NAME = 200;
+var MAX_FACT_TOPIC = 500;
+var STYLE_RULES = {
+  natural: void 0,
+  collaborative: "Work openly with the people and agents here.",
+  "mention-first": "Speak when you are clearly addressed; otherwise end your turn with no_reply.",
+  "approval-gated": "Be cautious: join in only on a strong signal; otherwise end your turn with no_reply.",
+  "handoff-only": "Act when someone explicitly hands you a task; otherwise end your turn with no_reply.",
+  observer: "Stay quiet unless a reply is necessary, and end your turn with no_reply."
+};
+var factText = /* @__PURE__ */ __name((value, limit = MAX_FACT_NAME) => speaker(value).slice(0, limit).trimEnd(), "factText");
+function factsPrompt({ name, topic, owner, members, rules }, kind) {
+  const shown = members.slice(0, MAX_FACT_MEMBERS).map((member) => member.isYou ? "you" : factText(member.name ?? member.id) + (member.isOwner ? OWNER_MARK : member.type === "ai_agent" ? " [agent]" : ""));
+  const lines = !rules ? [] : [
+    STYLE_RULES[rules.style],
+    kind === "group" && rules.requireMentionForGroupReplies ? "Only messages that mention you reach you." : void 0,
+    rules.allowAgentToAgent ? void 0 : "Messages from other agents do not reach you.",
+    rules.allowLongRunningCollaboration ? void 0 : "After a person writes, another agent gets one exchange with you.",
+    typeof rules.maxConsecutiveAgentTurns === "number" ? `Agents get at most ${rules.maxConsecutiveAgentTurns} turns in a row before a person writes.` : void 0
+  ].filter((line) => line !== void 0);
+  return [
+    FACTS_OPEN,
+    `Your owner: ${factText(owner.name ?? owner.id)}`,
+    ...name ? [`Conversation: ${factText(name)}`] : [],
+    ...topic ? [`Topic: ${factText(topic, MAX_FACT_TOPIC)}`] : [],
+    `Members: ${shown.join(", ")}${members.length > shown.length ? `, and ${members.length - shown.length} more` : ""}`,
+    ...lines.length ? [
+      "This conversation's rules, which your owner or any of its admins can set. They say how you take part here, not what you may do:",
+      ...lines.map((line) => `- ${line}`)
+    ] : [],
+    FACTS_CLOSE
+  ];
+}
+__name(factsPrompt, "factsPrompt");
 var errandCommunicate = /* @__PURE__ */ __name((contact) => ({
   name: "communicate",
   description: "List Canon conversations or agents, or send text to your errand's recipient or to the conversation it came from" + (contact ? ". Start the conversation with the recipient first, with start_conversation." : "."),
@@ -3527,21 +3339,6 @@ var inputMessage = /* @__PURE__ */ __name((message2, trusted = false) => Object.
   ...message2.replyTo ? { replyTo: message2.replyTo } : {},
   createdAt: message2.createdAt ?? ""
 }), "inputMessage");
-function outputOptions(turnId, trigger, kind, actedForOwner = false, messageId = `${turnId}:${kind}`) {
-  return {
-    messageId,
-    ...trigger.replyAuthority ? { replyAuthority: trigger.replyAuthority } : {},
-    ...trigger.activeSelfContextId ? { selfContextId: trigger.activeSelfContextId } : {},
-    metadata: {
-      turnId,
-      turnSemantics: "turn_complete",
-      ...kind === "final" ? {} : { replyBehavior: "suppress_auto_reply" },
-      ...kind === "final" && actedForOwner ? { [ACTED_FOR_OWNER]: true } : {}
-    }
-  };
-}
-__name(outputOptions, "outputOptions");
-var ACTED_FOR_OWNER = "actedForOwner";
 var MAX_TEAM = 20;
 function approvalScope(request) {
   if (request.scopeKey !== void 0 && /^[A-Za-z0-9_:-]{1,64}$/.test(request.scopeKey)) return request.scopeKey;
@@ -3552,19 +3349,6 @@ function approvalScope(request) {
 __name(approvalScope, "approvalScope");
 var MAX_GROUP_PARTS = 100;
 var CUT_SHORT_NOTE = "(This reply was too long to send in full and was cut short.)";
-var EXPIRED_UPLOAD = ["MEDIA_UPLOAD_TEMPORARY_EXPIRED", "MEDIA_UPLOAD_EXPIRED"];
-function fitGroup(text3, files) {
-  const room = Math.max(1, MAX_GROUP_PARTS - files);
-  const count = /* @__PURE__ */ __name((value) => value ? splitTextByUtf8Bytes(value).length : 0, "count");
-  let fitted = text3;
-  for (let end = Math.floor(text3.length * Math.min(1, room / Math.max(1, count(text3)))); count(fitted) > room; end = Math.floor(end * 0.95)) {
-    fitted = `${text3.slice(0, end).replace(/[\uD800-\uDBFF]$/, "").trimEnd()}
-
-${CUT_SHORT_NOTE}`;
-  }
-  return fitted;
-}
-__name(fitGroup, "fitGroup");
 function fitEncrypted(text3) {
   if (Buffer.byteLength(text3) <= MLS_DEV_TEXT_MAX_BYTES) return text3;
   const room = MLS_DEV_TEXT_MAX_BYTES - Buffer.byteLength(`
@@ -3582,6 +3366,27 @@ ${CUT_SHORT_NOTE}`);
 ${CUT_SHORT_NOTE}`;
 }
 __name(fitEncrypted, "fitEncrypted");
+function encryptedParts(text3, limit) {
+  if (Buffer.byteLength(text3) <= MLS_DEV_TEXT_MAX_BYTES) return [text3];
+  const parts = splitTextWithinBytes(text3, MLS_DEV_TEXT_MAX_BYTES).filter((part) => part.trim());
+  if (parts.length <= limit) return parts;
+  const room = MLS_DEV_TEXT_MAX_BYTES - Buffer.byteLength(`
+
+${CUT_SHORT_NOTE}`);
+  let bytes = 0;
+  let end = 0;
+  for (const char of parts[limit - 1]) {
+    bytes += Buffer.byteLength(char);
+    if (bytes > room) break;
+    end += char.length;
+  }
+  return [...parts.slice(0, limit - 1), `${parts[limit - 1].slice(0, end).trimEnd()}
+
+${CUT_SHORT_NOTE}`];
+}
+__name(encryptedParts, "encryptedParts");
+var MAX_REPLY_PARTS = 32;
+var REPLY_GRANT_RETRIES = 6;
 var ENCRYPTED_FILES = "Files cannot be sent in encrypted conversations yet";
 var ERRAND_RETRY_MS = 5e3;
 var STOPPED_ERRAND = {
@@ -3593,14 +3398,10 @@ var STOPPED_ERRAND = {
 };
 var SUBMITTED = { phase: "submitted", settle: /* @__PURE__ */ __name(async () => void 0, "settle"), release: /* @__PURE__ */ __name(async () => void 0, "release"), cancel: /* @__PURE__ */ __name(async () => void 0, "cancel") };
 var SILENT = { open() {
-}, setMode() {
-}, text() {
-}, activity() {
 }, waiting() {
-}, refresh() {
 }, end() {
 } };
-var UNAVAILABLE_ENCRYPTED = ["react", "send_file", "ask_question"];
+var UNAVAILABLE_ENCRYPTED = ["send_file", "ask_question"];
 var carriesCards = /* @__PURE__ */ __name((audience) => mlsDevProtocolCarriesCards(audience?.protocol), "carriesCards");
 var carriesItems = /* @__PURE__ */ __name((audience) => audience?.protocol === MLS_DEV_TEXT_PROTOCOL_V3, "carriesItems");
 function runtimeDescriptor(driver) {
@@ -3641,14 +3442,6 @@ async function createRunner(options) {
   const mentionAliases = names(options.mentionAliases, "mentionAliases").map((name) => name.replace(/^@+/, "")).filter(Boolean);
   const descriptor = runtimeDescriptor(driver);
   const offersQuestions = !driver.capabilities.nativeQuestions && ["choose", "text"].every((kind) => driver.capabilities.ask.includes(kind));
-  const capabilities = {
-    supportsInterrupt: true,
-    supportsInputInterrupt: false,
-    supportsQueue: true,
-    supportsInterleave: false,
-    supportsRequiresAction: driver.capabilities.ask.length > 0,
-    supportsNonFinalPermanentMessages: false
-  };
   const rooms = /* @__PURE__ */ new Map();
   const running = /* @__PURE__ */ new Set();
   const detach = [];
@@ -3663,7 +3456,6 @@ async function createRunner(options) {
   let tools;
   let lock;
   let owner;
-  const approvals = /* @__PURE__ */ new Map();
   let roots = [];
   let mlsOn = false;
   let mlsAsks;
@@ -3672,12 +3464,14 @@ async function createRunner(options) {
     if (!mlsIds) throw new Error("MLS_AUTHORITY_REQUIRED");
     return mlsIds;
   }, "keyed");
+  let outboundClosed = false;
   let ownershipVersion;
   let displayName;
+  let ownerOf;
   const refused = /* @__PURE__ */ new Set();
   const deferredNotes = /* @__PURE__ */ new Set();
+  const ruleNotes = /* @__PURE__ */ new Set();
   const guards = /* @__PURE__ */ new Map();
-  const relayed = /* @__PURE__ */ new Set();
   const relaySends = /* @__PURE__ */ new Map();
   let errands;
   let errandInbox2;
@@ -3706,17 +3500,10 @@ async function createRunner(options) {
   const settle = /* @__PURE__ */ __name(async (ids, reason) => (await Promise.allSettled(ids.map((id) => endpoint.setInboundState(id, "settled", reason)))).every(({ status }) => status === "fulfilled"), "settle");
   const queued = /* @__PURE__ */ __name((turn) => turn.inputs.filter((input) => input.handle.phase === "queued"), "queued");
   const turnId = /* @__PURE__ */ __name((roomId, inputs) => `turn-${sha2563(JSON.stringify([roomId, ...inputs.map((input) => [input.id, input.generation])])).slice(0, 32)}`, "turnId");
-  const livePublisher = /* @__PURE__ */ __name((current, turn, mode) => createLivePublisher({
+  const livePublisher = /* @__PURE__ */ __name((current, turn) => createLivePublisher({
     client,
     conversationId: current.id,
-    mode,
     turnId: /* @__PURE__ */ __name(() => turn?.id ?? null, "turnId"),
-    context: /* @__PURE__ */ __name(() => ({
-      queueDepth: current.queue.length,
-      currentSpeakerId: agentId,
-      capabilities,
-      activeMessageIds: turn?.inputs.map(({ payload }) => payload.message.id) ?? []
-    }), "context"),
     enqueue: /* @__PURE__ */ __name((publish2) => {
       current.lane = current.lane.then(publish2).catch(() => void 0);
     }, "enqueue")
@@ -3731,15 +3518,18 @@ async function createRunner(options) {
   function refuse(roomId, why) {
     if (refused.has(roomId)) return;
     refused.add(roomId);
-    log(`Refusing encrypted room ${roomId}: ${why === "no-device" ? "this runner has no MLS device (run it with --mls-dev-config)" : why === "remote" ? `the ${driver.name} driver runs off this host, which an encrypted room allows only in relay mode` : "its encryption protocol is not supported"}. Its messages are not delivered to this agent.`);
+    log(why === "plaintext" ? `Refusing room ${roomId}: it is not encrypted, and this runner takes part only in encrypted rooms. Its messages are not delivered to this agent.` : `Refusing encrypted room ${roomId}: ${why === "no-device" ? "this runner has no MLS device (run it with --mls-dev-config)" : why === "remote" ? `the ${driver.name} driver runs off this host, which an encrypted room allows only in relay mode` : "its encryption protocol is not supported"}. Its messages are not delivered to this agent.`);
   }
   __name(refuse, "refuse");
   async function authorize() {
     await endpoint.mlsDevDevice.ensureReady();
     const me = await client.getAgentMe();
-    requireMlsSupport({ environmentId: options.environmentId, agent: me });
+    requireMlsSupport({ environmentId: options.environmentId });
     if (me.agentId !== agentId || me.ownershipVersion !== ownershipVersion) throw new Error("MLS_AUTHORITY_REQUIRED");
+    outboundClosed = me.outboundPolicy === "closed";
+    if (outboundClosed && options.relay) throw new Error("MLS_AUTHORITY_REQUIRED");
     displayName = me.displayName;
+    ownerOf = { id: me.ownerId, ...me.ownerName ? { name: me.ownerName } : {} };
     return me.ownerId;
   }
   __name(authorize, "authorize");
@@ -3790,55 +3580,53 @@ ${error instanceof Error ? error.message : String(error)}`;
     if (!input) return;
     if (stopping) return void await handle.release("runner-stopping");
     const target = room(input.payload.conversationId);
-    if (input.mls) target.mls = true;
     target.queue.push(input);
-    target.turn?.live.refresh();
     requeue(target);
     pump();
   }
   __name(offer, "offer");
   async function admitInput(event, handle) {
     const payload = event.data;
+    const { conversationId } = payload;
     const generation = (await endpoint.getInbound(event.id))?.handoffGeneration ?? "";
-    const mode = await endpoint.getConversationContentMode(payload.conversationId).catch((error) => {
-      if (error.code === "MLS_DEV_ROOM_MODE_UNAVAILABLE") return "plaintext";
+    let mode;
+    try {
+      mode = await endpoint.getConversationContentMode(conversationId);
+    } catch (error) {
+      if (error.code !== "MLS_DEV_ROOM_MODE_UNAVAILABLE") throw error;
+      if (!(await client.getConversation(conversationId))?.memberIds?.includes(agentId)) return void await handle.cancel("membership-lost");
       throw error;
-    });
-    if (mode === "plaintext") {
-      if (options.relay) {
-        if (!relayed.has(payload.conversationId)) log(`Relay mode: leaving plaintext room ${payload.conversationId} to the connector.`);
-        relayed.add(payload.conversationId);
-        return void await handle.cancel("relay-plaintext-room");
-      }
-      if (payload.turnDispatch && payload.turnDispatch.kind !== "run_turn") return void await handle.cancel("observe-only");
-      return { id: event.id, payload, handle, generation };
     }
     if (mode !== "mls-dev-text" || !mlsOn || driver.capabilities.remote && !options.relay) {
-      refuse(payload.conversationId, !mlsOn ? "no-device" : mode !== "mls-dev-text" ? "protocol" : "remote");
-      return void await handle.cancel("encrypted-room-refused");
+      refuse(conversationId, mode === "plaintext" ? "plaintext" : !mlsOn ? "no-device" : mode !== "mls-dev-text" ? "protocol" : "remote");
+      return void await handle.cancel(mode === "plaintext" ? "plaintext-room-refused" : "encrypted-room-refused");
     }
-    const { conversationId } = payload;
     const groups = endpoint.mlsDevGroups;
     await authorize();
     const binding = await groups.readVerifiedMessageBinding({ conversationId, messageId: payload.message.id });
     if (!binding) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const { messages } = await endpoint.query("get_messages", { conversationId, messageIds: [binding.messageId] });
     const [message2] = messages;
-    if (messages.length !== 1 || message2.id !== binding.messageId || message2.senderId !== binding.senderId || message2.senderType !== binding.senderPrincipal.type || typeof message2.text !== "string" && !(message2.text === null && (message2.attachments?.length ?? 0) === 1)) throw new Error("MLS_INPUT_NOT_VERIFIED");
+    if (messages.length !== 1 || message2.id !== binding.messageId || message2.senderId !== binding.senderId || message2.senderType !== binding.senderPrincipal.type || !Number.isSafeInteger(message2.mlsFeedOrdinal) || typeof message2.text !== "string" && !(message2.text === null && (message2.attachments?.length ?? 0) === 1)) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const { audience, ownerId } = await currentAudience(conversationId);
     if (binding.groupId !== audience.groupId) throw new Error("MLS_INPUT_NOT_VERIFIED");
     const obsolete = binding.head.sequence < audience.head.sequence;
     if (!obsolete && JSON.stringify(binding.head) !== JSON.stringify(audience.head)) throw new Error("MLS_INPUT_AHEAD_OF_AUDIENCE");
     if (obsolete) return void await handle.settle("mls-obsolete-audience");
     const fromAgent = binding.senderPrincipal.type !== "human";
-    if (fromAgent) {
-      const wake = agentWake(conversationId, event.id, message2.senderId, message2.text ?? "", message2.mentions ?? []);
-      if (wake !== "admit") return void await handle.settle(wake);
-    } else {
+    const mentioned = (message2.mentions ?? []).includes(agentId) || mentionsAgent(message2.text ?? "", [displayName, agentId, ...mentionAliases]);
+    if (fromAgent && (message2.senderId === agentId || !mentioned)) return void await handle.settle("mls-observe-only-sender");
+    if (!fromAgent) {
       const target = room(conversationId);
       target.agentInputs = void 0;
       target.capped = false;
     }
+    const rule = await withheld(conversationId, message2, fromAgent, mentioned, ownerId);
+    if (rule) return void await handle.settle(rule);
+    if (fromAgent) {
+      const wake = agentWake(conversationId, event.id);
+      if (wake !== "admit") return void await handle.settle(wake);
+    }
     const verified = {
       id: message2.id,
       senderId: message2.senderId,
@@ -3855,8 +3643,48 @@ ${error instanceof Error ? error.message : String(error)}`;
     return { id: event.id, handle, generation, mls: audience, payload: { conversationId, message: verified } };
   }
   __name(admitInput, "admitInput");
-  function agentWake(roomId, inputId, senderId, text3, mentions) {
-    if (senderId === agentId || !mentions.includes(agentId) && !mentionsAgent(text3, [displayName, agentId, ...mentionAliases])) return "mls-observe-only-sender";
+  async function withheld(roomId, message2, fromAgent, mentioned, ownerId) {
+    const current = await endpoint.query(
+      "conversation",
+      { conversationId: roomId }
+    );
+    if (current?.blockedMemberIds?.includes(message2.senderId)) return "mls-blocked-sender";
+    if (options.relay || !current?.behavior) return void 0;
+    const { maxConsecutiveAgentTurns, allowLongRunningCollaboration } = current.behavior.participation;
+    const decision = evaluateParticipationPolicy(current.behavior, {
+      conversationType: resolveConversationPolicyScope(current.memberIds),
+      senderType: fromAgent ? "ai_agent" : "human",
+      isOwner: !fromAgent && message2.senderId === ownerId,
+      mentionedAgent: mentioned,
+      ...fromAgent ? agentRun(await turnsBehind(roomId, message2, Math.max(maxConsecutiveAgentTurns ?? 0, allowLongRunningCollaboration ? 0 : 2))) : {}
+    });
+    if (decision.allow) return void 0;
+    const note = `${roomId}
+${decision.reasonCode}`;
+    if (!ruleNotes.has(note)) log(`The rules of ${roomId} keep messages from a turn: ${decision.reasonCode}.`);
+    ruleNotes.add(note);
+    return `mls-${decision.reasonCode}`;
+  }
+  __name(withheld, "withheld");
+  async function turnsBehind(roomId, message2, limit) {
+    const turns = [message2];
+    let before = String(message2.mlsFeedOrdinal);
+    while (before && turns.length <= limit) {
+      const page = await endpoint.query(
+        "list_messages",
+        { conversationId: roomId, limit: PARTICIPATION_HISTORY_FETCH_LIMIT, before }
+      );
+      for (const entry of page.messages) {
+        if (entry.contentType === "interaction" || entry.senderId === turns.at(-1).senderId) continue;
+        turns.push(entry);
+        if (entry.senderType !== "ai_agent" || turns.length > limit) return turns;
+      }
+      before = page.nextBefore;
+    }
+    return turns;
+  }
+  __name(turnsBehind, "turnsBehind");
+  function agentWake(roomId, inputId) {
     const target = room(roomId);
     const streak = target.agentInputs ??= /* @__PURE__ */ new Set();
     if (!streak.has(inputId) && streak.size >= agentTurnCap) {
@@ -3896,12 +3724,10 @@ ${error instanceof Error ? error.message : String(error)}`;
         continue;
       }
       if (!candidate.queue.length) continue;
-      const encrypted = !!candidate.queue[0].mls;
-      const other = candidate.queue.findIndex((input) => !!input.mls !== encrypted);
-      const inputs = candidate.queue.splice(0, Math.min(MAX_INPUTS_PER_TURN, other < 0 ? MAX_INPUTS_PER_TURN : other));
+      const inputs = candidate.queue.splice(0, MAX_INPUTS_PER_TURN);
       const turn = newTurn(inputs, turnId(candidate.id, inputs), candidate.id);
       candidate.turn = turn;
-      (turn.live = driver.capabilities.remote ? SILENT : livePublisher(candidate, turn, encrypted ? "presence" : "status")).open();
+      (turn.live = driver.capabilities.remote ? SILENT : livePublisher(candidate, turn)).open();
       const done = execute(candidate, turn).catch((error) => {
         warn("turn failed")(error);
         return dispose(queued(turn), "release", "turn-failed");
@@ -3918,6 +3744,32 @@ ${error instanceof Error ? error.message : String(error)}`;
     while (localErrands.length && !stopping && running.size < maxTurns) startErrand(void 0, localErrands.shift());
   }
   __name(pump, "pump");
+  async function roomFacts(conversation) {
+    const { members } = await endpoint.query("get_members", { conversationId: conversation.id });
+    const names2 = new Map(members.map(({ userId, displayName: name }) => [userId, name]));
+    const owner2 = Object.freeze(ownerOf);
+    const participation = conversation.behavior?.participation;
+    return Object.freeze({
+      ...conversation.name ? { name: conversation.name } : {},
+      ...conversation.topic ? { topic: conversation.topic } : {},
+      owner: owner2,
+      members: Object.freeze(conversation.memberIds.map((id) => Object.freeze({
+        id,
+        ...names2.get(id) ? { name: names2.get(id) } : {},
+        type: conversation.participantTypes?.[id] === "ai_agent" || id === agentId ? "ai_agent" : "human",
+        isOwner: id === owner2.id,
+        isYou: id === agentId
+      }))),
+      ...participation ? { rules: Object.freeze({
+        style: participation.style,
+        requireMentionForGroupReplies: participation.requireMentionForGroupReplies,
+        allowAgentToAgent: participation.allowAgentToAgent,
+        allowLongRunningCollaboration: participation.allowLongRunningCollaboration,
+        maxConsecutiveAgentTurns: participation.maxConsecutiveAgentTurns ?? null
+      }) } : {}
+    });
+  }
+  __name(roomFacts, "roomFacts");
   async function execute(current, turn) {
     let conversation;
     try {
@@ -3928,12 +3780,18 @@ ${error instanceof Error ? error.message : String(error)}`;
     }
     if (!conversation?.memberIds?.includes(agentId)) return loseMembership(current);
     const kind = conversation.memberIds.length > 2 ? "group" : "direct";
-    if (turn.inputs[0].mls && !await beforeTurn(current, turn)) return;
+    if (!await beforeTurn(current, turn)) return;
+    if (!options.relay) {
+      try {
+        turn.facts = await roomFacts(conversation);
+      } catch (error) {
+        warn("room read failed; input returns to the inbox")(error);
+        return dispose(queued(turn), "release", "room-unavailable");
+      }
+    }
     turn.trusted = await confirmTrusted(turn, conversation.memberIds);
     turn.notes = pendingNotes(current.id);
-    turn.contexts = await Promise.all(openErrands(current.id).map(async (record) => ({ record, encryptedOrigin: !!record.origin && await endpoint.getConversationContentMode(record.origin).then((mode2) => mode2 === "mls-dev-text", () => false) })));
-    const mode = turn.mls ? "presence" : driver.capabilities.streaming && resolveTurnVerbosity({ conversationType: kind }) === "verbose" ? "full" : "status";
-    turn.live.setMode(mode);
+    turn.contexts = openErrands(current.id);
     const history = driver.capabilities.sessionMemory === "none" ? await recentHistory(current, turn) : [];
     await materialize(current, turn);
     const bound = bindTools(current, turn);
@@ -3944,7 +3802,7 @@ ${error instanceof Error ? error.message : String(error)}`;
         if (live.length && !turn.controller.signal.aborted) {
           turn.inputs = live;
           turn.id = turnId(current.id, live);
-          turn.pickUp = () => pickUp(current, turn, mode);
+          turn.pickUp = () => pickUp(current, turn);
           try {
             work = Promise.resolve(driver.runTurn(buildTurn(current.id, turn, kind, history, bound.tools)));
           } catch (error) {
@@ -3990,7 +3848,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       turn.ended.abort();
       bound.release();
       clearTimeout(turn.timer);
-      await deliver(current, turn, outcome, audienceOf(conversation));
+      await deliver(current, turn, outcome);
     } finally {
       turn.ended.abort();
       bound.release();
@@ -4001,15 +3859,10 @@ ${error instanceof Error ? error.message : String(error)}`;
   function started(current, turn) {
     turn.submitted = true;
     progress(turn);
-    if (!turn.mls) void client.markAsRead(current.id).catch(warn("mark read"));
-    for (const { payload } of turn.mls ? [] : turn.inputs) {
-      if (payload.message.metadata?.inboundDisposition === "queued") {
-        void client.updateMessageDisposition(current.id, payload.message.id, "accepted_now").catch(warn("accepted_now"));
-      }
-    }
+    if (!options.relay) void client.markAsRead(current.id).catch(warn("mark read"));
   }
   __name(started, "started");
-  async function pickUp(current, turn, mode) {
+  async function pickUp(current, turn) {
     const live = queued(turn);
     if (live.length !== turn.inputs.length) {
       abort(turn, "requeue");
@@ -4019,7 +3872,7 @@ ${error instanceof Error ? error.message : String(error)}`;
       if (result.status === "submitted") {
         turn.pickUp = void 0;
         started(current, turn);
-        if (!turn.controller.signal.aborted) (turn.live = livePublisher(current, turn, mode)).open();
+        if (!turn.controller.signal.aborted) (turn.live = livePublisher(current, turn)).open();
       }
       return result;
     });
@@ -4033,20 +3886,19 @@ ${error instanceof Error ? error.message : String(error)}`;
   __name(pickUp, "pickUp");
   function requeue(current) {
     const turn = current.turn, next = current.queue[0];
-    if (!turn?.pickUp || turn.pickingUp || turn.controller.signal.aborted || !next) return;
-    if (!!next.mls !== !!turn.inputs[0].mls || turn.inputs.length >= MAX_INPUTS_PER_TURN) return;
+    if (!turn?.pickUp || turn.pickingUp || turn.controller.signal.aborted || !next || turn.inputs.length >= MAX_INPUTS_PER_TURN) return;
     abort(turn, "requeue");
   }
   __name(requeue, "requeue");
   async function confirmTrusted(turn, memberIds) {
-    if (!trustedAgents.size || driver.capabilities.remote || options.relay) return /* @__PURE__ */ new Set();
-    const candidates = turn.inputs.map(({ payload }) => payload.message).filter((message2) => message2.senderType === "ai_agent" && message2.senderId !== agentId && trustedAgents.has(message2.senderId) && (turn.mls ? true : message2.metadata?.[ACTED_FOR_OWNER] === true && message2.metadata.turnSemantics === "turn_complete" && message2.forwarded !== true));
+    const audience = turn.mls;
+    if (!trustedAgents.size || driver.capabilities.remote || options.relay || !audience) return /* @__PURE__ */ new Set();
+    const candidates = turn.inputs.map(({ payload }) => payload.message).filter((message2) => message2.senderType === "ai_agent" && message2.senderId !== agentId && trustedAgents.has(message2.senderId));
     if (!candidates.length) return /* @__PURE__ */ new Set();
-    const roster = turn.mls?.roster ?? [];
-    if (roster.some((entry) => isConnectorRelayInstallation(entry.device.installationId))) return /* @__PURE__ */ new Set();
-    const rosterIds = turn.mls ? await Promise.all(roster.map(async (entry) => await endpoint.mlsAccountOf(turn.mls.conversationId, entry.device.principal) ?? "")) : [];
+    if (audience.roster.some((entry) => isConnectorRelayInstallation(entry.device.installationId))) return /* @__PURE__ */ new Set();
+    const rosterIds = await Promise.all(audience.roster.map(async (entry) => await endpoint.mlsAccountOf(audience.conversationId, entry.device.principal) ?? ""));
     if (rosterIds.includes("")) return /* @__PURE__ */ new Set();
-    const member = /* @__PURE__ */ __name((id) => memberIds.includes(id) && (!turn.mls || rosterIds.includes(id)), "member");
+    const member = /* @__PURE__ */ __name((id) => memberIds.includes(id) && rosterIds.includes(id), "member");
     if (candidates.some((message2) => !member(message2.senderId))) return /* @__PURE__ */ new Set();
     try {
       const { ownerId } = await client.getAgentMe();
@@ -4174,35 +4026,30 @@ ${error instanceof Error ? error.message : String(error)}`;
     };
     const cards = carriesCards(turn.mls), items = carriesItems(turn.mls);
     const errand = turn.errand;
-    const sendsFiles = roots.length > 0 && actedForOwner(turn);
+    const sendsFiles = roots.length > 0 && forOwner2(turn);
     const binding = {
-      // §6: an encrypted turn gets no_reply and a communicate that only lists and sends encrypted text to its own room,
-      // and in a room created for cards, ask_question. §12.6: an errand turn reaches its recipient and its origin, and
-      // asks only in an origin its report may go to.
+      // §6: a turn gets no_reply, a communicate that only lists and sends encrypted text to its own room, and react, which
+      // a relay's credential cannot do; in a room created for cards, ask_question, and in one that carries items, send_file.
+      // §12.6: an errand turn reaches its recipient and its origin, and asks only in an origin its report goes to.
       definitions: errand ? [
         TOOLS.no_reply,
         errandCommunicate("contact" in errand.target),
-        ...errand.reports && (!turn.mls || cards) && offersQuestions ? [TOOLS.ask_question] : []
-      ] : turn.mls ? [
+        ...errand.reports && cards && offersQuestions ? [TOOLS.ask_question] : []
+      ] : [
         TOOLS.no_reply,
         ENCRYPTED_COMMUNICATE,
+        ...options.relay ? [] : [TOOLS.react],
         ...items && sendsFiles ? [TOOLS.send_file] : [],
         ...cards && offersQuestions ? [TOOLS.ask_question] : []
-      ] : [
-        TOOLS.no_reply,
-        canonCommunicateToolDefinition(),
-        TOOLS.react,
-        ...sendsFiles ? [TOOLS.send_file] : [],
-        ...offersQuestions ? [TOOLS.ask_question] : []
       ],
       async call(name, args) {
         if (!turn.open) throw turnEnded2();
         if (name === "no_reply" && turn.silenced) return { result: toolText(NO_REPLY_ACK_NOTE) };
         if (turn.controller.signal.aborted || turn.silenced) throw turnEnded2();
-        if (turn.mls && !errand && UNAVAILABLE_ENCRYPTED.includes(name) && !(name === "ask_question" && cards) && !(name === "send_file" && items)) {
+        if (!errand && UNAVAILABLE_ENCRYPTED.includes(name) && !(name === "ask_question" && cards) && !(name === "send_file" && items)) {
           return { result: toolText(`${name} is not available in encrypted conversations yet.`, true) };
         }
-        if (name === "send_file" && !errand && roots.length && !actedForOwner(turn)) {
+        if (name === "send_file" && !errand && roots.length && !forOwner2(turn)) {
           return { result: toolText("send_file sends files only in a turn answering your owner.", true) };
         }
         const handler = binding.definitions.some((definition) => definition.name === name) ? handlers[name] : void 0;
@@ -4223,11 +4070,9 @@ ${error instanceof Error ? error.message : String(error)}`;
     }, "call") } };
   }
   __name(bindTools, "bindTools");
-  const sealed = /* @__PURE__ */ __name((turn) => turn.errand ? "room" in turn.errand.target && !!turn.errand.target.mls : !!turn.mls, "sealed");
   async function communicate(current, turn, args) {
     const errand = turn.errand;
-    const origins = errand ? errand.origin ? [errand.origin.room] : [] : turn.contexts.flatMap(({ record }) => record.origin ? [record.origin] : []);
-    if (!errand && !sealed(turn) && !origins.length) return executeCanonCommunicateTool(client, args);
+    const origins = errand ? errand.origin ? [errand.origin.room] : [] : turn.contexts.flatMap((record) => record.origin ? [record.origin] : []);
     let command;
     try {
       command = parseCommunicateToolInput(args);
@@ -4239,19 +4084,14 @@ ${error instanceof Error ? error.message : String(error)}`;
     }
     if (command.action === "message_existing" && command.text.trim()) {
       const to = command.conversationId;
-      if (turn.mls && !errand && to === current.id) return sealedSend(turn, to, command.text, turn.mls);
+      if (!errand && to === current.id) return sealedSend(turn, to, command.text, turn.mls);
       if (errand && "room" in errand.target && to === errand.target.room) {
         reach(turn, to);
-        return errand.target.mls ? sealedSend(turn, to, command.text) : executeCanonCommunicateTool(client, args);
+        return sealedSend(turn, to, command.text);
       }
       if (origins.includes(to)) {
-        const mode = await endpoint.getConversationContentMode(to);
-        if (mode === "mls-dev-text" && mlsOn) return sealedSend(turn, to, command.text);
-        if (mode !== "plaintext") return toolText(`${to} is an encrypted conversation this runner cannot write to.`, true);
-        if (sealed(turn)) {
-          return toolText(errand ? `This errand's recipient is in an encrypted conversation, so nothing of it may go to ${to}, which is not encrypted. Your final answer stays on your owner's machine as your report.` : `Nothing from this encrypted conversation may go to ${to}: it is not encrypted, and Canon must never receive this conversation's content in plaintext. Your owner sees on their machine that the errand was answered.`, true);
-        }
-        return executeCanonCommunicateTool(client, args);
+        if (await endpoint.getConversationContentMode(to) === "mls-dev-text" && mlsOn) return sealedSend(turn, to, command.text);
+        return toolText(`${to} is not an encrypted conversation this runner can write to.`, true);
       }
     }
     if (errand && "contact" in errand.target && (command.action === "start_conversation" || command.action === "start_direct") && command.principalId === errand.target.contact) {
@@ -4261,8 +4101,7 @@ ${error instanceof Error ? error.message : String(error)}`;
 ${JSON.stringify(result, null, 2)}`);
     }
     if (errand) return toolText("On an errand, communicate can only list conversations or agents, or send text to the errand's recipient or its origin.", true);
-    if (sealed(turn)) return toolText("In an encrypted conversation, communicate can only list conversations or agents, or send text to this conversation.", true);
-    return executeCanonCommunicateTool(client, args);
+    return toolText("In an encrypted conversation, communicate can only list conversations or agents, or send text to this conversation.", true);
   }
   __name(communicate, "communicate");
   async function sealedSend(turn, roomId, text3, audience) {
@@ -4283,9 +4122,10 @@ ${JSON.stringify(result, null, 2)}`);
           notice: false,
           mls: mls2
         };
-        journal.save(record);
-        const sent2 = await publish(record);
+        saveOutput(record);
+        const sent2 = await publish(record, turn.retire.signal);
         if (sent2 !== "pending") journal.remove(messageId);
+        else if (turn.retire.signal.aborted) await stopOutput(record);
         return sent2;
       })().catch((error) => {
         turn.said.delete(messageId);
@@ -4309,60 +4149,6 @@ ${JSON.stringify(result, null, 2)}`);
     }
   }
   __name(admitFile, "admitFile");
-  async function attach(conversationId, turn, candidates) {
-    const attachments = [];
-    const flows = [];
-    const refused2 = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const candidate of candidates) {
-      const file = await admitFile(candidate);
-      if (typeof file === "string") {
-        refused2.push(typeof candidate === "string" ? basename4(candidate) : "a file");
-        continue;
-      }
-      if (seen.has(file.path)) continue;
-      seen.add(file.path);
-      if (attachments.length >= MAX_GROUP_PARTS - 1) {
-        refused2.push(basename4(file.path));
-        continue;
-      }
-      try {
-        const media = await client.getFileMediaPipeline(options.fetch);
-        const attachmentId = `${turn.id}-${seen.size}`;
-        const [prepared] = await media.prepare({ conversationId, attachmentId, files: [{
-          source: file.path,
-          descriptor: { mimeType: inferUploadMimeType(file.path), sizeBytes: file.size, fileName: basename4(file.path) }
-        }] }, { signal: turn.retire.signal });
-        attachments.push(prepared);
-        flows.push(`${conversationId}:upload:${attachmentId}`);
-      } catch (error) {
-        if (turn.retire.signal.aborted) break;
-        warn("file upload")(error);
-        refused2.push(basename4(file.path));
-      }
-    }
-    return { attachments, flows, refused: refused2 };
-  }
-  __name(attach, "attach");
-  const releaseUploads = /* @__PURE__ */ __name((attachments = []) => void (attachments.length && client.getFileMediaPipeline(options.fetch).then((media) => Promise.all(attachments.map((attachment) => attachment.uploadId && media.releasePreparedUpload(attachment.uploadId)))).catch(warn("release upload"))), "releaseUploads");
-  async function renew(flows, signal) {
-    const media = await client.getFileMediaPipeline(options.fetch);
-    const renewed = [];
-    for (const id of flows) {
-      let prepared;
-      const off = media.subscribe((flow) => {
-        if (flow.id === id && flow.status === "prepared") prepared = flow.files[0]?.attachment;
-      });
-      try {
-        await media.resume(id, { signal });
-      } finally {
-        off();
-      }
-      renewed.push(prepared);
-    }
-    return renewed;
-  }
-  __name(renew, "renew");
   async function recentHistory(current, turn) {
     const first = turn.inputs[0].payload.message;
     try {
@@ -4373,8 +4159,8 @@ ${JSON.stringify(result, null, 2)}`);
       const ownerId = driver.capabilities.ownerHistoryOnly ? (await client.getAgentMe()).ownerId : void 0;
       const allowed = /* @__PURE__ */ __name((message2) => ownerId === void 0 || message2.senderId === agentId || message2.senderId === ownerId, "allowed");
       const window = recent.filter((message2, index) => before(message2, index) && !message2.deleted && !skip.has(message2.id) && allowed(message2)).slice(0, HISTORY_WINDOW);
-      const sameAudience = turn.mls ? await Promise.all(window.map((message2) => endpoint.mlsDevGroups.readVerifiedMessageBinding({ conversationId: current.id, messageId: message2.id }).then((binding) => !!binding && JSON.stringify(binding.head) === JSON.stringify(turn.mls.head), () => false))) : void 0;
-      return window.filter((_, index) => !sameAudience || sameAudience[index]).reverse();
+      const sameAudience = await Promise.all(window.map((message2) => endpoint.mlsDevGroups.readVerifiedMessageBinding({ conversationId: current.id, messageId: message2.id }).then((binding) => !!binding && JSON.stringify(binding.head) === JSON.stringify(turn.mls.head), () => false)));
+      return window.filter((_, index) => sameAudience[index]).reverse();
     } catch (error) {
       warn("history read failed; the turn runs without it")(error);
       return [];
@@ -4394,8 +4180,9 @@ ${JSON.stringify(result, null, 2)}`);
     return void 0;
   }
   __name(outcomeOf, "outcomeOf");
-  async function deliver(current, turn, outcome, audience) {
+  async function deliver(current, turn, outcome) {
     if (turn.reason === "shutdown") return turn.live.end("stopped");
+    const audience = turn.mls;
     const result = outcome && "result" in outcome ? outcome.result : void 0;
     const stopped = /* @__PURE__ */ __name(() => turn.retire.signal.aborted, "stopped");
     const silent = !stopped() && (turn.silenced !== void 0 || !turn.reason && result?.reply === null);
@@ -4403,141 +4190,108 @@ ${JSON.stringify(result, null, 2)}`);
     const failed = !stopped() && !silent && !answered2;
     if (failed && outcome && "error" in outcome) warn("the runtime failed the turn")(outcome.error);
     let text3 = answered2 ? result.reply : failed ? FAILURE_NOTICE : null;
-    let attachments = [];
-    let flows = [];
     let items = [];
     const resultFiles = answered2 && Array.isArray(result.files) ? result.files : [];
-    if (answered2 && turn.mls && carriesItems(turn.mls)) {
+    if (answered2 && carriesItems(audience)) {
       const admitted = await admitItems(current.id, turn, [...turn.outbox, ...resultFiles]);
       items = admitted.items;
       if (admitted.refused.length) text3 = `${text3}
 
 (Could not attach ${admitted.refused.join(", ")}.)`;
-    } else if (answered2 && turn.mls && resultFiles.length) {
+    } else if (answered2 && resultFiles.length) {
       text3 = `${text3}
 
 (${ENCRYPTED_FILES}: ${resultFiles.map((file) => typeof file === "string" ? basename4(file) : "a file").join(", ")}.)`;
-    } else if (answered2 && !turn.mls) {
-      const files = await attach(current.id, turn, [...turn.outbox, ...resultFiles]);
-      ({ attachments, flows } = files);
-      if (files.refused.length) text3 = `${text3}
-
-(Could not attach ${files.refused.join(", ")}.)`;
     }
     let sent;
     if (text3 !== null && !stopped()) {
       const kind = failed ? "failed" : "final";
+      const replyAuthority = await replyGrant(current.id, turn.inputs.at(-1).payload.message.id, stopped);
       const record = {
         version: 1,
         turnId: turn.id,
         conversationId: current.id,
         createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        audience,
+        audience: null,
         inputs: turn.inputs.map((input) => input.id),
         text: text3,
-        ...attachments.length ? { attachments, flows } : {},
         ...items.length ? { items } : {},
-        options: outputOptions(
-          turn.id,
-          turn.inputs.at(-1).payload,
-          kind,
-          !turn.mls && actedForOwner(turn),
-          turn.mls ? keyed().text(kind, current.id, turn.id) : void 0
-        ),
+        options: { messageId: keyed().text(kind, current.id, turn.id), ...replyAuthority ? { replyAuthority } : {} },
         notice: failed,
-        ...turn.mls ? { mls: turn.mls } : {}
+        mls: audience
       };
-      journal.save(record);
+      saveOutput(record);
       sent = await publish(record, turn.retire.signal);
-      attachments = record.attachments ?? [];
-      if (sent === "pending" && !stopped()) return turn.live.end(turn.reason && (!turn.mls || STOPS.includes(turn.reason)) ? "stopped" : "ended");
+      if (sent === "pending" && !stopped()) return turn.live.end(turn.reason && STOPS.includes(turn.reason) ? "stopped" : "ended");
+      if (sent === "pending") await stopOutput(record);
     }
     turn.live.end(sent === "delivered" ? "answered" : stopped() ? "stopped" : "ended");
-    releaseUploads(attachments);
     if (failed && outcome && "error" in outcome && outcome.error instanceof DriverSessionError) {
       await resetSession(turn.session).catch(warn("session reset"));
     }
-    if (turn.mls && (turn.reason === "audience" || turn.reason === "membership")) {
+    if (turn.reason === "audience" || turn.reason === "membership") {
       await resetSession(turn.session).catch(warn("session reset"));
       if (current.session === turn.session) current.session = void 0;
     }
-    if (silent && !turn.mls) reportNoReplyOutcome(client, { conversationId: current.id, messageId: turn.inputs.at(-1).payload.message.id, ...turn.silenced });
     const reason = stopped() ? turn.reason : silent ? "silent" : answered2 ? "answered" : "failed";
     if (await settle(turn.inputs.map((input) => input.id), reason) && sent !== void 0) journal.remove(turn.id);
   }
   __name(deliver, "deliver");
-  const actedForOwner = /* @__PURE__ */ __name((turn) => turn.inputs.every(({ payload: { message: message2 } }) => message2.isOwner === true || message2.senderType === "ai_agent" && turn.trusted.has(message2.id)), "actedForOwner");
-  async function sendWithFiles(record, text3, options2, signal) {
-    const root = options2.messageId;
-    const register = /* @__PURE__ */ __name((attachments, replaces) => {
-      const bodies = [
-        ...attachments.map((attachment) => ({ text: "", contentType: attachment.kind, attachments: [attachment] })),
-        ...(text3 ? splitTextByUtf8Bytes(text3) : []).map((part) => ({ text: part }))
-      ];
-      const parts = bodies.map(({ text: partText, ...body }, index) => ({ text: partText, options: {
-        ...options2,
-        ...body,
-        messageId: `${root}-part-${index + 1}`,
-        metadata: buildChunkedMessagePartMetadata({ groupId: root, metadata: options2.metadata, index: index + 1, count: bodies.length })
-      } }));
-      return client.prepareMessageGroup(record.conversationId, root, parts, { signal, ...replaces ? { operationId: sha2563(JSON.stringify([root, ...attachments.map((attachment) => attachment.uploadId)])), replacesOperationId: replaces } : {} }).then((group2) => ({ ...group2, count: parts.length }));
-    }, "register");
-    const original = await register(record.attachments);
-    let group = original;
-    const cancel = /* @__PURE__ */ __name(() => {
-      void client.cancelMessageGroup(group.id).catch(() => void 0);
-    }, "cancel");
-    signal?.addEventListener("abort", cancel, { once: true });
-    try {
-      for (; ; ) {
-        try {
-          for (let index = 0; index < group.count; index += 1) await group.sendPart(index, { signal });
-          return;
-        } catch (error) {
-          if (!record.flows || !EXPIRED_UPLOAD.includes(error.code ?? "")) throw error;
-          const renewed = await renew(record.flows, signal).catch((failure) => {
-            throw failure.retryable === false ? error : failure;
-          });
-          if (renewed.some((attachment) => !attachment) || renewed.every((attachment, index) => attachment.uploadId === record.attachments[index].uploadId)) throw error;
-          record.attachments = renewed;
-          group = await register(record.attachments, original.id);
-        }
-      }
-    } finally {
-      signal?.removeEventListener("abort", cancel);
-    }
-  }
-  __name(sendWithFiles, "sendWithFiles");
+  const forOwner2 = /* @__PURE__ */ __name((turn) => turn.inputs.every(({ payload: { message: message2 } }) => message2.isOwner === true || message2.senderType === "ai_agent" && turn.trusted.has(message2.id)), "forOwner");
   async function publish(record, retire) {
-    const sent = await send(record.conversationId, record.text, record.options, retire, record);
-    if (sent !== "refused" || record.notice || record.mls || record.errand) return sent;
-    const notice = {
-      ...record.options,
-      messageId: `${record.options.messageId}:short`,
-      metadata: { ...record.options.metadata, replyBehavior: "suppress_auto_reply" }
-    };
-    return await send(record.conversationId, STOPS_SHORT_NOTICE, notice, retire) === "pending" ? "pending" : "refused";
+    return send(record.text, record.options, record.mls, retire, record);
   }
   __name(publish, "publish");
-  async function send(conversationId, text3, options2, retire, record, mls2 = record?.mls) {
+  async function send(text3, options2, mls2, retire, record) {
+    const grant = options2.replyAuthority;
+    const parts = encryptedMessages(mls2, text3, options2, record);
     const sent = await (async () => {
       for (let attempt = 0; ; attempt += 1) {
-        const files = record?.attachments?.length ?? 0;
-        const result = await untilHalt((mls2 ? sendEncryptedItems(mls2, record?.items ?? [], retire).then(() => sendEncrypted(mls2, options2.messageId, text3, retire)) : files ? sendWithFiles(record, fitGroup(text3, files), options2, retire) : sendMessageWithRetryChunked(client, conversationId, fitGroup(text3, 0), options2, { signal: retire })).then(() => "delivered", (error) => error));
+        const result = await untilHalt(sendEncryptedItems(mls2, record?.items ?? [], retire).then(async () => {
+          for (const part of parts) await sendEncrypted(mls2, part.messageId, part.text, retire, grant && { ...grant, turnId: options2.messageId, complete: part.last });
+        }).then(() => "delivered", (error) => error));
         if (result === "delivered" || result === "pending") return result;
-        if (retire?.aborted || isPendingCanonOperation(result)) return "pending";
-        if (mls2 ? result.retryable === false : !isRetryableCanonDeliveryError(result)) {
+        if (retire?.aborted || isPendingCanonOperation(result) && parts.length < 2) return "pending";
+        if (result.retryable === false) {
           warn("Canon refused a reply")(result);
           return "refused";
         }
         if (await untilHalt(pause2(Math.min(3e4, 1e3 * 2 ** attempt))) === "pending") return "pending";
       }
     })();
-    if (mls2) forgetGuard(mls2, options2.messageId, sent);
+    for (const part of parts) forgetGuard(mls2, part.messageId, sent);
     return sent;
   }
   __name(send, "send");
-  async function sendEncrypted(audience, messageId, text3, signal) {
+  const partsOf = /* @__PURE__ */ __name((text3, options2) => encryptedParts(text3, options2.replyAuthority ? MAX_REPLY_PARTS : MAX_GROUP_PARTS), "partsOf");
+  function saveOutput(record) {
+    record.parts = partsOf(record.text, record.options).length;
+    journal.save(record);
+  }
+  __name(saveOutput, "saveOutput");
+  function encryptedMessages(mls2, text3, options2, record) {
+    const all = record && record.parts === void 0 ? [fitEncrypted(text3)] : partsOf(text3, options2);
+    return all.slice(0, record?.parts).map((part, index) => ({
+      text: part,
+      last: index === all.length - 1,
+      messageId: index ? keyed().text("part", mls2.conversationId, options2.messageId, String(index)) : options2.messageId
+    }));
+  }
+  __name(encryptedMessages, "encryptedMessages");
+  async function stopOutput(record) {
+    let queued2 = 0;
+    for (const [index, { messageId }] of encryptedMessages(record.mls, record.text, record.options, record).entries()) {
+      const status = (await endpoint.getOperation(encryptedOperation(record.mls, messageId)))?.status;
+      if (status && status !== "succeeded" && status !== "rejected") queued2 = index + 1;
+    }
+    if (queued2) {
+      const { items: _items, errand: _errand, ...rest } = record;
+      journal.save({ ...rest, turnId: `${record.turnId}:stopped`, inputs: [], parts: queued2 });
+    }
+    journal.remove(record.turnId);
+  }
+  __name(stopOutput, "stopOutput");
+  async function sendEncrypted(audience, messageId, text3, signal, replyAuthority) {
     const operationId = encryptedOperation(audience, messageId);
     if (!guards.has(operationId)) {
       guards.set(operationId, endpoint.registerDeliveryGuard(operationId, () => assertAudience(audience).then(() => true, (error) => {
@@ -4548,11 +4302,38 @@ ${JSON.stringify(result, null, 2)}`);
     if (!await endpoint.getOperation(operationId)) await assertAudience(audience);
     signal?.throwIfAborted();
     await endpoint.executeResult(
-      { action: "send_message", body: { conversationId: audience.conversationId, messageId, text: fitEncrypted(text3), contentType: "text" } },
+      { action: "send_message", body: {
+        conversationId: audience.conversationId,
+        messageId,
+        text: text3,
+        contentType: "text",
+        ...replyAuthority ? { replyAuthority } : {}
+      } },
       { operationId, guardId: operationId }
     );
   }
   __name(sendEncrypted, "sendEncrypted");
+  async function replyGrant(roomId, source, stopped) {
+    for (let attempt = 0; !options.relay; attempt += 1) {
+      try {
+        await authorize();
+        if (!outboundClosed) return void 0;
+        const { changes } = await endpoint.query(
+          "admit_messages",
+          { conversationId: roomId, messageIds: [source] }
+        );
+        return changes[0]?.data?.replyAuthority;
+      } catch (error) {
+        if (attempt >= REPLY_GRANT_RETRIES || stopped() || halt.signal.aborted) {
+          warn("no reply authority")(error);
+          return void 0;
+        }
+        await untilHalt(pause2(1e3 * 2 ** attempt));
+      }
+    }
+    return void 0;
+  }
+  __name(replyGrant, "replyGrant");
   async function sendEncryptedItems(audience, items, signal) {
     if (!items.length) return;
     const media = await client.getFileMediaPipeline(options.fetch);
@@ -4628,8 +4409,9 @@ ${JSON.stringify(result, null, 2)}`);
       messages: Object.freeze(messages),
       history: Object.freeze(history.map((message2) => inputMessage(message2))),
       ...turn.notes.length ? { ownerNotes: Object.freeze(turn.notes.map((note) => note.text)) } : {},
-      ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map(({ record }) => errandFacts(record))) } : {},
-      ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {}
+      ...turn.contexts.length ? { errands: Object.freeze(turn.contexts.map((record) => errandFacts(record))) } : {},
+      ...turn.errand ? { errand: errandFacts(turn.errand.record) } : {},
+      ...turn.facts ? { roomFacts: turn.facts } : {}
     });
     const line = /* @__PURE__ */ __name((message2, mark = "") => promptLine(message2, message2.senderId === agentId ? "You" : message2.senderName ?? message2.senderId, turn.media.get(message2.id), mark), "line");
     const open4 = /* @__PURE__ */ __name(() => turn.open && !turn.controller.signal.aborted, "open");
@@ -4638,25 +4420,21 @@ ${JSON.stringify(result, null, 2)}`);
       session: turn.session,
       // §12.6: an errand turn's prompt is its errand; the owner's message is only its input's record.
       prompt: turn.errand ? errandPrompt(turn.errand) : [
+        ...turn.facts ? [...factsPrompt(turn.facts, kind), ""] : [],
         ...turn.notes.flatMap((note) => [NOTE_OPEN, defused(note.text), NOTE_CLOSE, ""]),
-        ...turn.contexts.flatMap((context) => [...contextPrompt(context, !!turn.mls), ""]),
-        ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
+        ...turn.contexts.flatMap((record) => [...contextPrompt(record), ""]),
+        ...history.length ? ["Earlier in this conversation (context, not new requests):", ...history.map((message2) => line(message2)), "", "New messages:"] : turn.facts || turn.notes.length || turn.contexts.length ? ["New messages:"] : [],
         ...turn.inputs.map(({ payload: { message: message2 } }) => line(message2, message2.isOwner === true ? OWNER_MARK : trustedSender(message2) ? TRUSTED_MARK : ""))
       ].join("\n"),
       input,
       files: turn.inputs.flatMap(({ payload: { message: message2 } }) => turn.media.get(message2.id)?.files.map((file) => file.path) ?? []),
       signal: turn.controller.signal,
-      onText: /* @__PURE__ */ __name((snapshot) => {
-        if (live()) {
-          progress(turn);
-          turn.live.text(snapshot);
-        }
+      // Text and activity are progress (RUN-12), and nothing of them is published (§6).
+      onText: /* @__PURE__ */ __name(() => {
+        if (live()) progress(turn);
       }, "onText"),
-      onActivity: /* @__PURE__ */ __name((event) => {
-        if (live()) {
-          progress(turn);
-          turn.live.activity(event);
-        }
+      onActivity: /* @__PURE__ */ __name(() => {
+        if (live()) progress(turn);
       }, "onActivity"),
       ask: /* @__PURE__ */ __name((request) => live() ? ask(roomId, turn, input.sender, request) : Promise.reject(turnEnded2()), "ask"),
       state: driverState(turn.session, open4),
@@ -4675,7 +4453,7 @@ ${JSON.stringify(result, null, 2)}`);
         loseMembership(room(roomId));
         throw new Error("The agent is no longer a member of this conversation");
       }
-      if (turn.mls && await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
+      if (await readAgain(() => reaudience(roomId, turn), Date.now() + CONNECTOR_RELAY_ANSWER_WITHIN_MS) === "changed") {
         if (!turn.controller.signal.aborted) {
           void dispose(queued(turn), "settle", "mls-obsolete-audience");
           abort(turn, "audience");
@@ -4698,68 +4476,32 @@ ${JSON.stringify(result, null, 2)}`);
     if (turn.errand && !turn.errand.reports) return Promise.resolve({ status: "cancelled" });
     const signal = AbortSignal.any([turn.controller.signal, turn.ended.signal]);
     turn.asking += 1;
-    if (!turn.mls) turn.live.waiting(true);
     const answer = (async () => {
       try {
-        if (turn.mls && (!carriesCards(turn.mls) || !mlsAsks)) throw new Error("approvals and questions need an encrypted conversation created for them");
+        if (!turn.mls || !carriesCards(turn.mls) || !mlsAsks) throw new Error("approvals and questions need an encrypted conversation created for them");
         const ownerId = await (owner ??= client.getAgentMe().then((me) => me.ownerId, (error) => {
           owner = void 0;
           throw error;
         }));
         const secret = request.kind === "text" && request.secret === true;
         const responder = secret || sender.type !== "human" ? ownerId : sender.id;
-        const requestId = turn.mls ? keyed().request(roomId, turn.id, request.id) : `ask-${sha2563(JSON.stringify([turn.id, request.id])).slice(0, 32)}`;
-        const expiresAt = Date.now() + askExpiryMs;
-        if (turn.mls) {
-          return await mlsAsks.ask({
-            conversationId: roomId,
-            session: turn.session,
-            requestId,
-            responder,
-            ownerId,
-            request,
-            expiresAtMs: expiresAt,
-            audience: /* @__PURE__ */ __name(() => turn.mls, "audience"),
-            signal,
-            recheck: /* @__PURE__ */ __name(() => checkAudience(room(roomId)), "recheck"),
-            pending: /* @__PURE__ */ __name(() => turn.live.waiting(true), "pending"),
-            // Stop, and a new member (whose card is void for every device), withdraw a card, and so does the turn's end;
-            // shutdown leaves it to restart recovery, and an agent no longer in the room can send nothing.
-            ending: /* @__PURE__ */ __name(() => turn.reason === "shutdown" ? "keep" : turn.reason === "membership" ? "drop" : turn.reason && STOPS.includes(turn.reason) ? "stopped" : "turn_ended", "ending")
-          });
-        }
-        let manager = approvals.get(roomId);
-        if (!manager) approvals.set(roomId, manager = new ApprovalManager(client, agentId, ownerId));
-        const options2 = { requestId, expiresAt, signal };
-        if (request.kind === "approve") {
-          let created = false;
-          const result2 = await manager.requestApproval(roomId, approvalScope(request), {}, {
-            toolSummary: request.title,
-            responseUserId: responder,
-            turnId: turn.id,
-            ...request.detail ? { details: [{ label: "Details", value: request.detail.slice(0, 500) }] } : {},
-            ...request.risk ? { riskLevel: request.risk, risk: request.risk } : {},
-            ignoreSessionRules: request.allowSession !== true,
-            allowSessionRule: request.allowSession === true
-          }, { ...options2, onCreated: /* @__PURE__ */ __name(() => {
-            created = true;
-          }, "onCreated") });
-          if (created && !result2.respondedBy) return { status: "expired" };
-          return { status: "answered", by: result2.respondedBy ?? ownerId, allow: result2.decision === "allow", scope: !created || result2.sessionRule ? "session" : "once" };
-        }
-        const choices = request.kind === "choose" ? request.options.map(({ id, label }) => ({ label, value: id })) : void 0;
-        const result = await manager.request("input", roomId, {
-          kind: secret ? "secret" : "clarify",
-          prompt: request.question,
-          responseUserId: responder,
-          turnId: turn.id,
-          ...secret ? { sensitive: true } : {},
-          ...request.kind === "choose" && request.multiple ? { questions: [{ id: "choice", question: request.question, choices, multiSelect: true }] } : choices ? { choices } : {}
-        }, options2);
-        if (result.status !== "submitted") return { status: result.status === "timeout" ? "expired" : "cancelled" };
-        if (request.kind !== "choose") return { status: "answered", by: responder, text: result.value };
-        const picked = result.answers ? Object.values(result.answers).flatMap((entry) => entry.answers) : [result.value];
-        return { status: "answered", by: responder, choices: picked.filter((id) => request.options.some((option) => option.id === id)) };
+        const requestId = keyed().request(roomId, turn.id, request.id);
+        return await mlsAsks.ask({
+          conversationId: roomId,
+          session: turn.session,
+          requestId,
+          responder,
+          ownerId,
+          request,
+          expiresAtMs: Date.now() + askExpiryMs,
+          audience: /* @__PURE__ */ __name(() => turn.mls, "audience"),
+          signal,
+          recheck: /* @__PURE__ */ __name(() => checkAudience(room(roomId)), "recheck"),
+          pending: /* @__PURE__ */ __name(() => turn.live.waiting(true), "pending"),
+          // Stop, and a new member (whose card is void for every device), withdraw a card, and so does the turn's end;
+          // shutdown leaves it to restart recovery, and an agent no longer in the room can send nothing.
+          ending: /* @__PURE__ */ __name(() => turn.reason === "shutdown" ? "keep" : turn.reason === "membership" ? "drop" : turn.reason && STOPS.includes(turn.reason) ? "stopped" : "turn_ended", "ending")
+        });
       } catch (error) {
         if (signal.aborted) throw turnEnded2();
         warn("ask could not be put to anyone")(error);
@@ -4812,20 +4554,13 @@ ${JSON.stringify(result, null, 2)}`);
     if (consumed.status !== "signal") return;
     const signal = consumed.signal;
     const turn = current.turn;
-    if (signal === "stop_and_drop" || signal === "new_session") {
-      const dropped = current.queue.splice(0);
-      for (const { payload } of current.mls ? [] : dropped) {
-        void client.updateMessageDisposition(current.id, payload.message.id, "rejected").catch(warn("rejected disposition"));
-      }
-      void dispose(dropped, "cancel", "stop-and-clear");
-    }
+    if (signal === "stop_and_drop" || signal === "new_session") void dispose(current.queue.splice(0), "cancel", "stop-and-clear");
     if (turn) {
       void dispose(turn.inputs, "cancel", "stopped-before-submit");
       abort(turn, signal === "interrupt" ? "stop" : signal === "stop_and_drop" ? "drop" : "new_session");
     }
-    (turn?.live ?? livePublisher(current, void 0, current.mls ? "presence" : "full")).end("stopped");
+    (turn?.live ?? livePublisher(current, void 0)).end("stopped");
     if (signal === "new_session") {
-      approvals.delete(current.id);
       const sessions = /* @__PURE__ */ new Set([
         turn?.session ?? current.session ?? current.id,
         current.session ?? (turn?.mls ? mlsSession(current.id, mlsAudienceEpoch(turn.mls)) : current.id)
@@ -4860,25 +4595,19 @@ ${JSON.stringify(result, null, 2)}`);
       const target = room(roomId);
       const work = (async () => {
         for (const record of records.filter((candidate) => candidate.conversationId === roomId)) {
-          if (record.mls) target.mls = true;
           await redeliver(record).catch(warn("journaled reply kept for reconciliation"));
         }
         const inputs = orphans.filter(({ event }) => event.conversationId === roomId).sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.event.id.localeCompare(b.event.id));
         if (inputs.length) {
           const id = turnId(roomId, inputs.map(({ event, handoffGeneration }) => ({ id: event.id, generation: handoffGeneration ?? "" })));
-          const trigger = inputs.at(-1).event.data;
           const mode = await endpoint.getConversationContentMode(roomId);
-          if (mode !== "plaintext") target.mls = true;
-          if (mode !== "plaintext" && (!mlsOn || mode !== "mls-dev-text")) refuse(roomId, mlsOn ? "protocol" : "no-device");
+          if (mode !== "mls-dev-text" || !mlsOn) refuse(roomId, mode === "plaintext" ? "plaintext" : mlsOn ? "protocol" : "no-device");
           const mls2 = mode === "mls-dev-text" && mlsOn ? (await currentAudience(roomId)).audience : void 0;
           const legacy = `${id}:restart`;
           const messageId = mls2 && !await endpoint.getOperation(encryptedOperation(mls2, legacy)) ? keyed().text("restart", roomId, id) : legacy;
-          if (mode !== "plaintext" && !mls2) await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
-          else if (await send(roomId, RESTART_NOTICE, outputOptions(id, trigger, "restart", false, messageId), void 0, void 0, mls2) !== "pending") {
-            await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
-          }
+          if (!mls2 || await send(RESTART_NOTICE, { messageId }, mls2) !== "pending") await settle(inputs.map(({ event }) => event.id), "interrupted-by-restart");
         }
-        livePublisher(target, void 0, target.mls ? "presence" : "full").end("ended");
+        livePublisher(target, void 0).end("ended");
       })().catch(warn("restart recovery"));
       target.recovering = work.finally(() => {
         target.recovering = void 0;
@@ -4888,24 +4617,16 @@ ${JSON.stringify(result, null, 2)}`);
   }
   __name(recover, "recover");
   async function redeliver(record) {
-    if (record.mls) {
-      if (!mlsOn) return refuse(record.conversationId, "no-device");
-    } else if (!await client.getMessageOperation(record.conversationId, record.options.messageId)) {
-      const members = audienceOf(await client.getConversation(record.conversationId));
-      try {
-        assertCompletedOutputAudience(record, members, "agent runner");
-      } catch (error) {
-        if (!record.errand) throw error;
-        return finishErrandOutput(record, "refused", "the conversation's members changed before it was sent");
-      }
+    if (!record.mls) {
+      if (record.errand) return finishErrandOutput(record, "refused", "its conversation is not encrypted");
+      if (await settle(record.inputs, "plaintext-output-dropped")) journal.remove(record.turnId);
+      return;
     }
+    if (!mlsOn) return refuse(record.conversationId, "no-device");
     const sent = await publish(record);
     if (sent === "pending") return;
     if (record.errand) return finishErrandOutput(record, sent);
-    if (await settle(record.inputs, "recovered")) {
-      journal.remove(record.turnId);
-      releaseUploads(record.attachments);
-    }
+    if (await settle(record.inputs, "recovered")) journal.remove(record.turnId);
   }
   __name(redeliver, "redeliver");
   function pendingNotes(roomId) {
@@ -5003,15 +4724,15 @@ ${JSON.stringify(result, null, 2)}`);
       turnId: turnId2,
       conversationId,
       createdAt,
-      audience: target.audience,
+      audience: null,
       inputs: [],
       text: parsed.text,
-      options: target.mls ? { messageId: keyed().text("final", conversationId, turnId2) } : { messageId: `${turnId2}:final`, metadata: { turnId: turnId2, turnSemantics: "turn_complete" } },
+      options: { messageId: keyed().text("final", conversationId, turnId2) },
       notice: false,
       errand: id,
-      ...target.mls ? { mls: target.mls } : {}
+      mls: target.mls
     };
-    journal.save(record);
+    saveOutput(record);
     errands.put({ ...base, status: "sending", updatedAt });
     const delivery = publish(record).then((sent) => {
       if (sent !== "pending") finishErrandOutput(record, sent);
@@ -5030,9 +4751,9 @@ ${JSON.stringify(result, null, 2)}`);
     if (!conversation) return "Canon does not show the agent that conversation";
     if (!conversation.memberIds?.includes(agentId)) return "the agent is not a member of that conversation";
     const mode = await endpoint.getConversationContentMode(roomId).catch(missing);
-    if (mode === "plaintext") return { audience: audienceOf(conversation) };
+    if (mode === "plaintext") return "it is not encrypted, and the agent takes part only in encrypted conversations";
     if (mode !== "mls-dev-text" || !mlsOn) return "it is an encrypted conversation this runner cannot take part in";
-    return { audience: null, ...kind === "post" ? { mls: (await currentAudience(roomId)).audience } : {} };
+    return kind === "post" ? { mls: (await currentAudience(roomId)).audience } : {};
   }
   __name(errandRoom, "errandRoom");
   function finishErrandOutput(record, sent, reason = "Canon did not accept it") {
@@ -5075,8 +4796,8 @@ ${JSON.stringify(result, null, 2)}`);
     ...record.origin ? { origin: record.origin } : {}
   }), "errandFacts");
   function errandPrompt({ record, target, origin, reports }) {
-    const recipient = "contact" in target ? `${target.contact}. Start a new conversation with them: communicate start_conversation.` : `the ${target.mls ? "encrypted " : ""}conversation ${target.room}. Send to it with communicate message_existing.`;
-    const report = reports ? `your final answer is your report to your owner, posted in the conversation ${origin.room}.` : origin ? `your final answer is your report to your owner, and it stays on their machine: the conversation ${origin.room} is not encrypted, and nothing of an errand to an encrypted conversation may go there.` : "your final answer is your report to your owner, and it stays on their machine.";
+    const recipient = "contact" in target ? `${target.contact}. Start a new conversation with them: communicate start_conversation.` : `the encrypted conversation ${target.room}. Send to it with communicate message_existing.`;
+    const report = reports ? `your final answer is your report to your owner, posted in the conversation ${origin.room}.` : "your final answer is your report to your owner, and it stays on their machine.";
     return [
       `${ERRAND_OPEN} Your owner sends you on an errand, from the machine you run on. It is not a message in any conversation, and no one else sees it.`,
       `Why: ${defused(record.why)}`,
@@ -5088,8 +4809,8 @@ ${JSON.stringify(result, null, 2)}`);
     ].join("\n");
   }
   __name(errandPrompt, "errandPrompt");
-  function contextPrompt({ record, encryptedOrigin }, encryptedRoom) {
-    const report = !record.origin ? "Your owner follows this errand on their machine; it has no conversation to report to." : encryptedOrigin || !encryptedRoom ? `You may report to your owner in the ${encryptedOrigin ? "encrypted " : ""}conversation ${record.origin} with communicate.` : `Nothing from this encrypted conversation may go to ${record.origin}, which is not encrypted; your owner sees on their machine that the errand was answered.`;
+  function contextPrompt(record) {
+    const report = !record.origin ? "Your owner follows this errand on their machine; it has no conversation to report to." : `You may report to your owner in the encrypted conversation ${record.origin} with communicate.`;
     return [
       `${ERRAND_OPEN} Your owner sent you into this conversation on an errand, from the machine you run on. No one here sees this note.`,
       `Why: ${defused(record.why)}`,
@@ -5107,7 +4828,7 @@ ${JSON.stringify(result, null, 2)}`);
   }
   __name(openErrands, "openErrands");
   function replied(turn) {
-    for (const { record } of turn.contexts) {
+    for (const record of turn.contexts) {
       const known = latest(record.id);
       if (!known || !openErrand(known)) continue;
       try {
@@ -5132,7 +4853,7 @@ ${JSON.stringify(result, null, 2)}`);
     const turn = newTurn([], errandTurnId(record.id), `errand:${record.id}`);
     holder.turn = turn;
     errandTurns.set(record.id, turn);
-    (turn.live = origin ? livePublisher(origin, turn, "presence") : SILENT).open();
+    (turn.live = origin ? livePublisher(origin, turn) : SILENT).open();
     const done = executeErrand(holder, turn, record).catch(warn(`errand ${record.id}`)).finally(() => {
       turn.live.end("ended");
       if (holder.turn === turn) holder.turn = void 0;
@@ -5167,7 +4888,6 @@ ${JSON.stringify(result, null, 2)}`);
     if (typeof setup === "string") return void saveErrand({ ...known, status: "refused", reason: setup });
     turn.errand = setup;
     turn.mls = setup.origin?.mls;
-    if (turn.mls) current.mls = true;
     const message2 = {
       id: `${turn.id}-errand`,
       senderId: setup.owner,
@@ -5210,16 +4930,15 @@ ${JSON.stringify(result, null, 2)}`);
     if (record.target === "room") {
       const found = await errandRoom(record.to, "post");
       if (typeof found === "string") return `its recipient: ${found}`;
-      target = { room: record.to, ...found.mls ? { mls: found.mls } : {} };
+      target = { room: record.to };
     }
     let origin;
     if (record.origin) {
       const found = await errandRoom(record.origin, "post");
       if (typeof found === "string") return `its origin: ${found}`;
-      origin = { room: record.origin, audience: found.audience, ...found.mls ? { mls: found.mls } : {} };
+      origin = { room: record.origin, mls: found.mls };
     }
-    const reports = !!origin && (!!origin.mls || !("room" in target && target.mls));
-    return { record, owner: owner2, target, ...origin ? { origin } : {}, reports };
+    return { record, owner: owner2, target, ...origin ? { origin } : {}, reports: !!origin };
   }
   __name(errandSetup, "errandSetup");
   async function deliverReport(turn, outcome) {
@@ -5252,19 +4971,16 @@ ${JSON.stringify(result, null, 2)}`);
       turnId: turn.id,
       conversationId: origin.room,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      audience: origin.audience,
+      audience: null,
       inputs: [],
       text: text3,
       notice: failed,
       errand: record.id,
-      ...origin.mls ? { mls: origin.mls } : {},
-      options: origin.mls ? { messageId: keyed().text(kind, origin.room, turn.id) } : {
-        messageId: `${turn.id}:${kind}`,
-        metadata: { turnId: turn.id, turnSemantics: "turn_complete", ...failed ? { replyBehavior: "suppress_auto_reply" } : {} }
-      }
+      mls: origin.mls,
+      options: { messageId: keyed().text(kind, origin.room, turn.id) }
     };
     try {
-      journal.save(out);
+      saveOutput(out);
     } catch (error) {
       warn(`errand ${record.id}: its report could not be journaled; it stays in the record`)(error);
       saveErrand({ ...closing, report: text3, reported: "refused", reason: "its report: it could not be saved for sending" });
@@ -5273,9 +4989,9 @@ ${JSON.stringify(result, null, 2)}`);
     saveErrand({ ...closing, reported: "sending" });
     const sent = await publish(out, turn.retire.signal);
     if (sent === "pending" && stopped()) {
-      journal.remove(out.turnId);
-      const { reported: _reported, ...withheld } = latest(record.id) ?? closing;
-      saveErrand({ ...withheld, status: "cancelled", reason: STOPPED_ERRAND[turn.reason] ?? "stopped" });
+      await stopOutput(out);
+      const { reported: _reported, ...withheld2 } = latest(record.id) ?? closing;
+      saveErrand({ ...withheld2, status: "cancelled", reason: STOPPED_ERRAND[turn.reason] ?? "stopped" });
     } else if (sent !== "pending") finishErrandOutput(out, sent);
     turn.live.end(sent === "delivered" ? "answered" : stopped() ? "stopped" : "ended");
   }
@@ -5309,7 +5025,6 @@ ${JSON.stringify(result, null, 2)}`);
     } else if (event.kind === "conversation.updated") {
       void onRoomChanged(data).catch(warn("membership update"));
     } else if (event.kind === "runtime.control" && data.kind === "signal" && typeof data.conversationId === "string") {
-      if (options.relay && !rooms.get(data.conversationId)?.mls) return;
       scheduleControl(room(data.conversationId));
     }
   }
@@ -5373,7 +5088,7 @@ ${JSON.stringify(result, null, 2)}`);
         notice: false,
         mls: audience
       };
-      journal.save(record);
+      saveOutput(record);
       return { text: text3, record };
     })();
     const sent = ready.then(({ record, settled }) => settled ?? publish(record).then((result) => {
@@ -5462,7 +5177,7 @@ ${JSON.stringify(result, null, 2)}`);
       }
       journal = createCompletedOutputJournal(join7(home, "runner", options.environmentId, agentId, "finals"), scope, {
         label: "agent runner",
-        validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.attachments === void 0 || Array.isArray(record.attachments)) && (record.flows === void 0 || Array.isArray(record.flows) && record.flows.length === record.attachments?.length) && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.errand === void 0 || typeof record.errand === "string"), "validate")
+        validate: /* @__PURE__ */ __name((record) => typeof record.text === "string" && typeof record.options?.messageId === "string" && Array.isArray(record.inputs) && typeof record.notice === "boolean" && (record.mls === void 0 || !!record.mls && typeof record.mls === "object") && (record.parts === void 0 || Number.isSafeInteger(record.parts)) && (record.errand === void 0 || typeof record.errand === "string"), "validate")
       });
       if (!options.relay && !driver.capabilities.remote) {
         errands = errandJournal(errandsDirectory(home, options.environmentId, agentId));
@@ -5480,7 +5195,7 @@ ${JSON.stringify(result, null, 2)}`);
           else if (report) saveErrand({ ...record, status: ended(record, report.notice), reported: "sending" });
           else {
             saveErrand({ ...record, status: "interrupted", reason: "the runner stopped during its turn, which never runs again" });
-            if (record.origin) livePublisher(room(record.origin), void 0, "presence").end("stopped");
+            if (record.origin) livePublisher(room(record.origin), void 0).end("stopped");
           }
         }
       }