@demlik/tea 0.1.2 → 0.3.0

package/dist/do/index.d.ts

@@ -1,21 +1,21 @@
-import { Store, Runtime, BootingRuntime } from '../index.js';
-import { P as PendingEffectsRecorder, b as EffectOwed, a as EffectConfirmed } from '../durable-effects-CO9Uh971.js';
-export { D as DeliveryId, E as EffectLedgerEvent, O as OwedEffect, d as PendingEffectsLedger, c as applyEffectEvent, e as emptyLedger, f as foldLedger, i as isOwed, p as pendingEffectsLedger, s as survivingEffects } from '../durable-effects-CO9Uh971.js';
+import { S as Store, R as Runtime, B as BootingRuntime } from '../runtime-types-gsog27b6.js';
+import { P as PendingEffectsRecorder, b as EffectOwed, a as EffectConfirmed } from '../durable-effects-CFRngTNA.js';
+export { D as DeliveryId, E as EffectLedgerEvent, O as OwedEffect, d as PendingEffectsLedger, c as applyEffectEvent, e as emptyLedger, f as foldLedger, i as isOwed, p as pendingEffectsLedger, s as survivingEffects } from '../durable-effects-CFRngTNA.js';
 import { RetryPolicy, Rng } from '../retry-backoff/index.js';
-import { C as Cmd, S as Sub, M as Machine } from '../core-BoB6t7dB.js';
-import { AgentTurn, AgentState, AgentMachineMsg, AgentEvent, AgentStatus } from '../agent/index.js';
-import '../fan-out/index.js';
-import '../work-queue/index.js';
+import { C as Cmd, S as Sub, M as Machine } from '../core-42kapW0n.js';
+import { y as AgentEvent, A as AgentTurn, N as AgentState, x as AgentMachineMsg, P as AgentStatus } from '../machine-B_BF4jij.js';
 import '../llm-call/index.js';
 import '../resilient-call/index.js';
 import '../cache/index.js';
-import '../types-B-8bcAp8.js';
+import '../types-KbL3W1mj.js';
 import '../circuit-breaker/index.js';
 import '../deadline/index.js';
 import '../protocol-B5YmJr0d.js';
 import '../rate-limit/index.js';
 import '../monitored-run/index.js';
 import '../snapshot/index.js';
+import '../work-queue/index.js';
+import '../fan-out/index.js';
 
 /**
  * @demlik/tea/do — `stepHost`, the HTTP-PULL control carrier (#92).
@@ -117,6 +117,13 @@ interface NextStep<I> {
  * A `/step` response — a discriminated union on `done`:
  *   - `{ done: false, step }` — execute `step`, POST its result, ask again.
  *   - `{ done: true, output }` — the run is terminal; `output` is its result.
+ *
+ * This is the ORIGINAL 2-arm INLINE contract, kept byte-identical: a host that
+ * resolves each step inside the held request returns exactly these two shapes.
+ * The not-ready arm ({@link StepWorking}) is a SEPARATE, opt-in type reachable
+ * only through the defer-resume hook — see {@link DeferredStepResponse}. Keeping
+ * `StepResponse` a strict subset is what makes inline adopters unaffected: their
+ * `if (r.done) … else r.step` narrowing never sees a third member.
  */
 type StepResponse<I, O> = {
     readonly done: false;
@@ -125,6 +132,37 @@ type StepResponse<I, O> = {
     readonly done: true;
     readonly output: O;
 };
+/**
+ * The NOT-READY arm — the run is computing OUT-OF-BAND under a defer-resume host
+ * (Binclusive ADR 0035 / prod incident #1873: a non-blocking pull carrier must
+ * answer a pull with an explicit "computing, poll again" instead of holding the
+ * request across a multi-second step). The held `/step` request returns this
+ * IMMEDIATELY instead of inline-awaiting `engine.resume`; the hands re-poll
+ * (optionally after `retryAfterMs`) until the deferred compute lands in the
+ * durable checkpoint and a real {@link StepResponse} step/done arm is returned.
+ *
+ * It is a first-class discriminated member (`working: true`), NOT a hollow
+ * `{ done: false }` with an absent/stale `step` — the not-ready state is made
+ * representable so it can never be confused with a real pending step.
+ */
+interface StepWorking {
+    readonly done: false;
+    readonly working: true;
+    /**
+     * Advisory earliest re-poll delay as a hint to the hands (ms to wait before
+     * the next pull). Purely advisory — a host may omit it and the hands fall back
+     * to their own backoff curve.
+     */
+    readonly retryAfterMs?: number;
+}
+/**
+ * The 3-arm response a DEFER-RESUME host returns — the inline {@link StepResponse}
+ * arms PLUS {@link StepWorking}. A superset of `StepResponse`, so a 2-arm value is
+ * assignable to it (the widening is safe for existing transports); discriminate
+ * with `if (r.done)` for terminal, then `"working" in r` for the not-ready arm,
+ * else the step arm.
+ */
+type DeferredStepResponse<I, O> = StepResponse<I, O> | StepWorking;
 /**
  * Mint a fresh per-run capability token: 32 random bytes, hex-encoded. Uses the
  * Web Crypto `crypto.getRandomValues` available in the Workers runtime (and in
@@ -202,6 +240,51 @@ interface StepHostConfig {
      */
     readonly giveUpAfterMs?: number;
 }
+/**
+ * The DEFER-RESUME hook — the opt-in seam that drives `engine.resume` OUT of the
+ * held `/step` request. A non-blocking host (Binclusive audit carrier, ADR 0035)
+ * cannot inline-await a multi-second step inside the held request, so instead of
+ * `stepHost` calling `engine.resume` inline it hands the posted result to this
+ * hook to SETTLE-AND-ENQUEUE (record it durably, schedule the compute in a
+ * returning activation) and returns the {@link StepWorking} arm PROMPTLY. A later
+ * pull re-reads the durable next-step once {@link DeferResumeHook.settled} reports
+ * the enqueued compute has landed.
+ *
+ * Providing this hook is what flips `stepHost` from the 2-arm inline contract to
+ * the 3-arm deferred contract — see the `stepHost` overloads. Omit it and the
+ * host stays byte-identical inline.
+ */
+interface DeferResumeHook<R> {
+    /**
+     * SETTLE-AND-ENQUEUE the posted result to resume OUT of the held request:
+     * durably record it and schedule the compute (e.g. `ctx.storage.setAlarm` or a
+     * queue) so a returning activation runs `engine.resume`. MUST return promptly —
+     * it never awaits the step compute. Called at most once per distinct `callId`
+     * (`stepHost` dedupes re-POSTs through `idempotent-intake` first), so a re-POST
+     * of the same step does not re-enqueue.
+     */
+    enqueue(runId: string, posted: StepResult<R>): void | Promise<void>;
+    /**
+     * Has the enqueued resume for `callId` COMPLETED and been written to the
+     * durable checkpoint? `false` ⇒ the held request returns {@link StepWorking}
+     * (poll again); `true` ⇒ `stepHost` reads the next step / terminal output off
+     * the now-advanced checkpoint, exactly as the inline path does.
+     */
+    settled(runId: string, callId: string): boolean | Promise<boolean>;
+    /**
+     * Optional advisory re-poll delay (ms) surfaced on the {@link StepWorking} arm
+     * so the hands can back off to the host's expected step latency.
+     */
+    readonly retryAfterMs?: number;
+}
+/**
+ * `StepHostConfig` with the defer-resume hook engaged — the presence of
+ * `deferResume` is the type-level switch that selects the 3-arm response (see the
+ * `stepHost` overloads). Extends the inline config, so the alarm tuning is shared.
+ */
+interface DeferStepHostConfig<R> extends StepHostConfig {
+    readonly deferResume: DeferResumeHook<R>;
+}
 /**
  * A structured `/step` outcome `stepHost` returns — the response body plus the
  * HTTP status the consumer's route should send. Kept transport-agnostic (no
@@ -216,6 +299,21 @@ type StepOutcome<I, O> = {
         readonly error: string;
     };
 };
+/**
+ * The `/step` outcome a DEFER-RESUME host returns — like {@link StepOutcome} but
+ * its 200 body is the 3-arm {@link DeferredStepResponse} (it can carry the
+ * not-ready arm). Returned only from the `deferResume` overload of `stepHost`;
+ * the inline overload keeps the narrower {@link StepOutcome}.
+ */
+type DeferredStepOutcome<I, O> = {
+    readonly status: 200;
+    readonly body: DeferredStepResponse<I, O>;
+} | {
+    readonly status: 401 | 404;
+    readonly body: {
+        readonly error: string;
+    };
+};
 /**
  * Build the `/step` handler for a DO that drives one or more runs over the pull
  * carrier. Returns `handle(request, now)` — call it from the DO's `/step`
@@ -233,11 +331,20 @@ type StepOutcome<I, O> = {
  * @param engine the run-specific operations
  * @param config alarm tuning
  */
+declare function stepHost<R, I, O>(ctx: StepCtx, engine: StepEngine<R, I, O>, config: DeferStepHostConfig<R>): {
+    handle(request: StepRequest<R>, now: number): Promise<DeferredStepOutcome<I, O>>;
+};
 declare function stepHost<R, I, O>(ctx: StepCtx, engine: StepEngine<R, I, O>, config?: StepHostConfig): {
     handle(request: StepRequest<R>, now: number): Promise<StepOutcome<I, O>>;
 };
-/** The `/step` transport the hands POST through (injected; faked in tests). */
-type StepTransport<R, I, O> = (request: StepRequest<R>) => Promise<StepResponse<I, O>>;
+/**
+ * The `/step` transport the hands POST through (injected; faked in tests).
+ * Returns the 3-arm {@link DeferredStepResponse} — a defer-resume host may answer
+ * with the not-ready arm, which {@link runStepLoop} re-polls. An inline host's
+ * 2-arm transport (`=> Promise<StepResponse>`) is assignable here (the narrower
+ * return widens), so existing inline adopters are unaffected.
+ */
+type StepTransport<R, I, O> = (request: StepRequest<R>) => Promise<DeferredStepResponse<I, O>>;
 /** Execute one tool call and produce its result (the consumer's hands). */
 type ExecuteStep<I, R> = (step: NextStep<I>) => Promise<R> | R;
 /** Tuning for {@link runStepLoop}. */
@@ -284,6 +391,11 @@ type StepLoopOutcome<O> = {
  *     not re-executed; its prior result is re-POSTed. Closes the "the host
  *     re-handed the same step after a duplicate settle" path (the host side is
  *     idempotent; the hands match it).
+ *   - **not-ready re-poll** — a {@link StepWorking} arm (a defer-resume host
+ *     computing the step out-of-band) is not a step: the loop re-POSTs the SAME
+ *     `posted` after a backoff (honoring the host's advisory `retryAfterMs`),
+ *     until a real step / done arrives. Bounded only by the absolute deadline —
+ *     an inline host never returns this arm, so its drive is unchanged.
  */
 declare function runStepLoop<R, I, O>(token: string, runId: string, transport: StepTransport<R, I, O>, execute: ExecuteStep<I, R>, config: RunStepLoopConfig): Promise<StepLoopOutcome<O>>;
 
@@ -662,6 +774,18 @@ interface ProjectionId {
 }
 /** Render a `ProjectionId` to its canonical `name-key` string. */
 declare function projectionIdString(id: ProjectionId): string;
+/** Context handed to a {@link ProjectionOnError} sink alongside the throw. */
+interface ProjectionErrorContext {
+    /** The id of the projection whose `apply`/`emit` threw. */
+    readonly id: ProjectionId;
+}
+/**
+ * Sink for a projection `apply`/`emit` throw the driver isolated. Injected into
+ * {@link projectionRegistry}; called with the original error and the id of the
+ * failing projection so a broken projection surfaces instead of being silently
+ * discarded (errors-are-data). Should be total.
+ */
+type ProjectionOnError = (error: unknown, context: ProjectionErrorContext) => void;
 /**
  * One unit the projection driver presents to a projection's `apply`. Mirrors
  * the `(msg, model)` pair `runtime.observe` fans out, plus the exclusive
@@ -750,9 +874,11 @@ interface ProjectionRunner<Model, Msg extends {
  * `startOffset` (the driver's offset guard enforces exclusivity even if an
  * already-applied update is re-presented).
  *
- * `emitOnStart`/`emitOnReset` default false: a fresh runner holds `initial` but
- * does not push it at the sink until the first real update lands (an SSE client
- * that just connected wants the next event, not a replay of the seed).
+ * The runner never emits the seed: a fresh runner holds `initial` but does not
+ * push it at the sink until the first real update lands (an SSE client that just
+ * connected wants the next event, not a replay of the seed), and `reset()`
+ * likewise re-seeds `view`/`offset` silently — `emit` fires only from `present`
+ * when a strictly-newer update is folded.
  */
 declare function runProjection<Model, Msg extends {
     type: string;
@@ -771,7 +897,8 @@ interface ProjectionRegistry<Model, Msg extends {
      * Present one update to EVERY registered runner. Each folds independently; an
      * `apply`/`emit` throw in one runner is caught so it cannot strand the others
      * (errors-are-data: a broken projection is dropped from THIS update, not
-     * allowed to corrupt siblings). Returns the offset assigned to this update.
+     * allowed to corrupt siblings) and routed to the registry's `onError` sink so
+     * it surfaces rather than vanishing. Returns the offset assigned to this update.
      */
     dispatch(msg: Msg | null, model: Model): number;
     /** The current monotonic offset (the last dispatched update's position). */
@@ -779,10 +906,15 @@ interface ProjectionRegistry<Model, Msg extends {
     /** The registered runners (introspection / tests). */
     runners(): readonly ProjectionRunner<Model, Msg, unknown>[];
 }
-/** Build an empty {@link ProjectionRegistry}. */
+/**
+ * Build an empty {@link ProjectionRegistry}. Pass an `onError` sink to receive
+ * any `apply`/`emit` throw the driver isolates — without it a broken projection
+ * is still isolated from its siblings, but its failure is not surfaced (the
+ * substrate's `run(machine, { onError })` is the natural source to forward).
+ */
 declare function projectionRegistry<Model, Msg extends {
     type: string;
-}>(): ProjectionRegistry<Model, Msg>;
+}>(onError?: ProjectionOnError): ProjectionRegistry<Model, Msg>;
 /**
  * Wire a {@link ProjectionRegistry} to a runtime's transition stream. The boot
  * update (the initial state, offset 0) is presented via `onBoot`; every applied
@@ -828,166 +960,202 @@ declare function rebuildProjection<Model, Msg extends {
 }[]): ProjectionRunner<Model, Msg, View>;
 
 /**
- * @demlik/tea/do — the minimum-viable Durable-Object HOST for a `@demlik/tea`
- * `createAgent` runtime.
- *
- * `doStore` (in `./index`) is the durability half. This file is the rest of the
- * boilerplate a DO consumer hand-rolls every time it drives a tea agent over a
- * remote transport: the deferred-tool gateway, auto-boot on rehydrate, the
- * command-runner WS accept, the runtime→SSE plumbing, and a clean read of a
- * run's terminal output. Each export below names exactly the hand-rolled piece
- * it deletes from the consumer.
- *
- * ## The transport model: ONE Sub type, gateway-bridged I/O
- *
- * `createAgent().toMachine()` fixes the machine's Sub type to `DeadlineSub` —
- * the agent owns the retry + watchdog timers and nothing else. That is the
- * WHOLE Sub model for a DO-hosted agent, and it is coherent because the
- * transport deliberately does NOT live in the Sub system:
- *
- *   - Inbound WebSocket frames are bridged straight into `gateway.settle(...)`
- *     from the DO's `webSocketMessage` lifecycle method — a direct dispatch,
- *     not a Sub.
- *   - The per-tool deadline is a `setTimeout` inside the gateway — a timer, not
- *     a DO alarm.
- *
- * The deferred-tool gateway owns each tool round-trip as a Promise the interpret
- * cell awaits; the transport bridges results into `dispatch` from outside the
- * Sub system. The agent's Sub type stays exactly `DeadlineSub` — there is no
- * competing DO-native Sub variant to union in, and the host needs none. This is
- * the single transport model for `@demlik/tea/do` (#52); see
- * `.patterns/tea/durable-actors.md` for the host-layer north star.
+ * The runtime→SSE plumbing — the hub, its projection expression, and the
+ * semantic-event adapter. See `./host` for the transport-model rationale.
  */
 
 /**
- * The deferred-tool gateway. `R` is the consumer's tool-result type (what
- * `agent_tool_ok` carries).
+ * A set of SSE sinks plus the plumbing to fan an event out to all of them and
+ * to open a `text/event-stream` Response wired to a fresh sink.
  *
- *   - `await(callId, send, deadlineMs)` — register the round-trip, fire `send`,
- *     return the Promise the reply (or the deadline) settles. Idempotent per
- *     `callId`: a second call for an in-flight id returns the SAME promise
- *     without re-firing `send` (the boot-reconcile re-fire is a no-op at the
- *     gateway, mirroring the agent's idempotent boot).
- *   - `settle(callId, result)` — the transport calls this on a reply; resolves
- *     the awaited promise. A settle for an unknown / already-settled id is a
- *     no-op (the callId guard the consumer used to keep in its pending Map).
- *   - `fail(callId, reason)` — settle the round-trip as an error on demand
- *     (e.g. a transport-level close). Same unknown-id no-op.
- *   - `inFlight()` — the callIds with an open round-trip (tests / introspection).
+ * The consumer:
+ *   1. holds one `SseHub<E>` per DO,
+ *   2. calls `hub.emit(event)` from its Msg→event mapping (driven off
+ *      `runtime.observe`), and
+ *   3. returns `hub.open()` from the `/sse` route.
  *
- * The deadline → reject path is what makes "timeout is data": the tool cell's
- * `catch` maps the rejection to `agent_tool_err`, recorded on the conversation,
- * never a hang.
+ * `register(sink)` exists for tests: subscribe a sink directly and observe the
+ * exact event sequence a live client would receive (a live `text/event-stream`
+ * fights vitest-pool-workers teardown). Deletes the consumer's `sseSinks` set,
+ * `openSse`, `emitSse`, and `onSseEvent`.
  */
-interface DeferredGateway<R> {
-    await(callId: string, send: () => void, deadlineMs: number): Promise<R>;
-    settle(callId: string, result: R): void;
-    fail(callId: string, reason: string): void;
-    inFlight(): readonly string[];
+interface SseHub<E> {
+    emit(event: E): void;
+    open(): Response;
+    register(sink: (event: E) => void): () => void;
 }
+/** Build an SSE hub for event type `E` (the consumer's domain event shape). */
+declare function sseHub<E>(): SseHub<E>;
 /**
- * Build a deferred-tool gateway. No clock / RNG captured at construction — the
- * deadline is per-call (`await(..., deadlineMs)`), so one gateway serves every
- * tool family with its own timeout.
+ * Express an {@link SseHub} as a {@link Projection}. The projection's view is
+ * the latest emitted SSE event (or `null` before the first); `apply` maps each
+ * write-model update to an event via `toEvent` and emits it through `hub.emit`,
+ * so the SSE stream is driven by the SAME hub `sseHub()` returns — no API
+ * change for the `/sse` route (`hub.open()`) or any existing caller.
  *
- * Deletes from the consumer: the `pending` Map, the `Pending` interface, the
- * `awaitClient` method, the `forceTimeout` plumbing, and the `deliverResult`
- * callId-guard body — all of it collapses to this object plus the tool cell's
- * `await` + try/catch.
+ *   - `toEvent(msg, model)` returns the SSE event for this update, or `null` to
+ *     skip it (the view stays, nothing is emitted).
+ *   - `name`/`key` default to `"sse"`/`"main"`; override for a second SSE view.
+ *
+ * @example
+ *   const hub = sseHub<MyEvent>();
+ *   const registry = projectionRegistry<MyState, MyMsg>();
+ *   registry.register(sseProjection(hub, (msg) =>
+ *     msg?.type === "turn_done" ? { kind: "turn", ... } : null,
+ *   ));
+ *   driveProjections(registry, runtime); // SSE is now one projection
+ *   // /sse route unchanged:
+ *   return hub.open();
  */
-declare function deferredGateway<R>(): DeferredGateway<R>;
-/** A `callId`-keyed durable round-trip: maps the gateway's string id to the
- *  ledger's monotonic delivery id so a `settle(callId)` finds the owed entry. */
-interface DurableDeferredGateway<R> extends DeferredGateway<R> {
-    /** The ledger recorder this gateway feeds (for `surviving()` on activation). */
-    readonly recorder: PendingEffectsRecorder<{
-        callId: string;
-    }>;
-}
+declare function sseProjection<Model, Msg extends {
+    type: string;
+}, E>(hub: SseHub<E>, toEvent: (msg: Msg | null, model: Model) => E | null, id?: {
+    name?: string;
+    key?: string;
+}): Projection<Model, Msg, E | null>;
 /**
- * Wrap a `DeferredGateway<R>` so every round-trip is also recorded in a durable
- * `PendingEffectsRecorder`. The in-memory gateway is the fast path; the recorder
- * is the durability slice.
+ * Wire an {@link SseHub} to a runtime's semantic {@link AgentEvent} stream (#47).
+ * For each event `type` the runtime can emit, subscribes via `runtime.on` and
+ * pushes `toFrame(event)` at the hub (returning `null` skips that event). The
+ * runtime MUST have been built with `run(machine, { events: agentEvents() })`,
+ * which is what makes `on` deliver the `AgentEvent`s. Returns a cleanup that
+ * detaches every subscription.
  *
- *   - `recordOwed(callId, event)` — fires from `await`, BEFORE `send`, carrying
- *     the `effect_owed` event the consumer must persist (then deliver).
- *   - `recordConfirmed(callId, event)` — fires from `settle`/`fail` for a known
- *     id, carrying the `effect_confirmed` event to persist.
- *   - `reissue(callId, send, deadlineMs)` — re-arm a surviving round-trip on
- *     activation. Idempotent: the gateway's own `await` returns the open promise
- *     without re-firing `send` for an in-flight `callId`, so re-issuing an id
- *     that is somehow still pending is a no-op (mirrors the boot-reconcile
- *     re-fire). The effect is already owed, so no second `effect_owed` is
- *     recorded.
+ * This is the runtime→SSE adapter expressed over the typed event channel: no
+ * `observe` firehose, no private-Msg coupling. `hub.open()` and every existing
+ * `sseHub` caller are unchanged — only the SOURCE of `hub.emit` moves from a
+ * hand-rolled Msg switch to `on`.
  *
- * The effect payload the ledger stores is the `callId` (the correlation key the
- * consumer round-trips); the consumer maps it back to its tool-call context.
+ * @example
+ *   const hub = sseHub<MyFrame>();
+ *   const runtime = await run(machine, { ctx, events: agentEvents() }).ready;
+ *   const off = sseFromAgentEvents(runtime, hub, (e) =>
+ *     e.type === "RunDone" ? { kind: "done", output: e.output } : null,
+ *   );
+ *   // /sse route unchanged:
+ *   return hub.open();
  */
-declare function durableDeferredGateway<R>(inner: DeferredGateway<R>, recorder: PendingEffectsRecorder<{
-    callId: string;
-}>, hooks: {
-    recordOwed(callId: string, event: EffectOwed<{
-        callId: string;
-    }>): void;
-    recordConfirmed(callId: string, event: EffectConfirmed): void;
-}): DurableDeferredGateway<R>;
+declare function sseFromAgentEvents<R, Frame>(runtime: {
+    on<K extends AgentEvent<R>["type"]>(type: K, handler: (event: Extract<AgentEvent<R>, {
+        type: K;
+    }>) => void): () => void;
+}, hub: SseHub<Frame>, toFrame: (event: AgentEvent<R>) => Frame | null): () => void;
+
 /**
- * The typed cold-wake resume port `bootResume` fires through — the agent's
- * `AgentBootPort` (issue #60) generalized to any DO-hosted machine (issue #231).
- *
- * - `isResumable(state)` — true iff the rehydrated State is mid-loop and needs a
- *   resume dispatch. False on a fresh boot, which makes `bootResume` a no-op.
- * - `resumeMsg(now)` — the TYPED constructor for the single resume Msg (never a
- *   hand-built `{ type: … }` literal); the `agentBootMsg` shape lifted out so a
- *   non-agent grain supplies its own boot Msg constructor.
+ * `createAgentHost` — the runtime+events+autoBoot assembly + the test seam,
+ * ONCE (issue #53). The facade over the concern modules: the deferred gateway
+ * (`./deferred-gateway`), the WS carrier (`./command-socket`), the SSE plumbing
+ * (`./sse`), and the cold-wake resume (`./resume`). See `./host` for the
+ * transport-model rationale.
  */
-interface ResumePort<S, M extends {
-    type: string;
-}> {
-    readonly isResumable: (state: S) => boolean;
-    readonly resumeMsg: (now: number) => M;
-}
+
 /**
- * After `runtime.ready`, derive the single resume Msg from the rehydrated State
- * via `port` and dispatch it exactly once — the generalized AgentBoot. On a
- * fresh (non-rehydrated) machine `port.isResumable` is false and this is a
- * no-op. Call once right after building the runtime; it standardizes the
- * hand-written `if (isResumable(state)) await runtime.dispatch(bootMsg(now()))`
- * every DO-hosted machine otherwise re-derives.
- *
- * `await ready` is the single boot gate (issue #45): `getState()` is total only
- * on the booted `Runtime`, so state cannot be inspected before boot populates
- * it. `now` is injected (the sole boot clock read) so a test can pin it.
+ * What the consumer supplies to {@link createAgentHost} — the domain mappings,
+ * nothing of the wiring. `Stage`/`P`/`O`/`R` are the agent slice's type
+ * parameters (the consumer names them once); `Frame` is its SSE event shape.
+ * `C`/`U`/`Ctx` are the machine's own Cmd/Sub/Ctx — inferred from
+ * `buildMachine` at the `createAgentHost` call site (never name them by hand;
+ * an erased `any` here cost consumers all checking on this layer — #278).
  */
-declare function bootResume<S, M extends {
-    type: string;
-}, E extends {
-    type: string;
-} = never>(booting: BootingRuntime<S, M, E>, port: ResumePort<S, M>, now?: () => number): Promise<void>;
+interface AgentHostConfig<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame, C extends Cmd = Cmd, U extends Sub = Sub, Ctx = unknown> {
+    /**
+     * Build the wired agent machine. Called once per host build (per activation),
+     * AFTER the previous runtime — if any — was torn down. The consumer wires its
+     * per-tool interpret here (`agent.toMachine({ toolInterpret })`).
+     */
+    readonly buildMachine: () => Machine<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, C, U, Ctx>;
+    /** The durable `Store` for the agent slice (typically `doStore(storage, parse)`). */
+    readonly store: Store<AgentState<Stage, P, O, R>>;
+    /** The Ctx the machine threads to its interpret cells — checked against `buildMachine`'s. */
+    readonly ctx: Ctx;
+    /**
+     * The run-terminality predicate (#46) — what makes `result()` first-class.
+     * Defaults to the agent's own terminal phases (`done` / `failed`).
+     */
+    readonly terminal?: (state: AgentState<Stage, P, O, R>) => boolean;
+    /**
+     * Map one semantic {@link AgentEvent} to the consumer's SSE frame, or `null`
+     * to skip it. This is the ONLY place the consumer touches the SSE seam — the
+     * host owns the subscription wiring (`sseFromAgentEvents`) and the hub.
+     */
+    readonly toSseFrame: (event: AgentEvent<R>) => Frame | null;
+    /** Clock injected for `autoBoot` (the host's only boot clock read). */
+    readonly now?: () => number;
+}
 /**
- * True iff an agent slice loaded from storage is mid-loop (running + awaiting
- * tools) — the resumable case `agent_boot` re-fires.
+ * The assembled host: the runtime cell + the SSE hub + the framework test seam,
+ * owned ONCE. A DO holds one `AgentHost` and delegates to it; its own surface
+ * shrinks to the domain (the gateway, the WS bridge, the command-send mapping).
  *
- * The resumability question IS "is the run suspended on tools?" — so this
- * delegates to the agent's own typed `status` channel (issue #49) rather than
- * re-deriving the private `run.phase` / `conversation.awaiting` shape by hand.
- * The host no longer leaks the agent's internal slice structure; a change to
- * `Awaiting` surfaces as a compile error in `status`, not a silent break here.
+ * @typeParam Stage Pipeline stage type.
+ * @typeParam P     Brain-call purposes.
+ * @typeParam O     Per-purpose outputs (bound to {@link AgentTurn}).
+ * @typeParam R     Tool result type.
+ * @typeParam Frame The consumer's SSE event shape.
  */
-declare function agentIsResumable<Stage, P extends string, O extends Record<P, unknown>, R>(state: AgentState<Stage, P, O, R>): boolean;
-/**
- * The AGENT specialization of {@link bootResume} (issue #231): after
- * `runtime.ready`, self-dispatch `agent_boot` iff the rehydrated slice is
- * resumable, a no-op on a fresh DO. Wires the agent slice's `agentIsResumable`
- * predicate + the agent-owned `agentBootMsg` typed port (issue #60) into the
- * generalized helper, so the resume dispatch lives in ONE place — see
- * `bootResume`'s docblock for the boot-gate / init-purity rationale.
+interface AgentHost<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame> {
+    /**
+     * Get (or build) the booted runtime. Build-once-boot-once: the first call
+     * builds the machine, wires SSE off the semantic event stream, awaits the boot
+     * gate, runs the `autoBoot` re-fire for a rehydrated suspended run, and caches
+     * the booted `Runtime`; subsequent calls return the cached handle. The single
+     * assembly every consumer used to hand-roll in `getRuntime()`.
+     */
+    runtime(): Promise<Runtime<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, AgentEvent<R>>>;
+    /**
+     * The agent's lifecycle status (#49) — the ONE typed channel a consumer reads
+     * instead of re-deriving `run.phase` / `awaiting` by hand. Ensures the runtime
+     * is built + boot-reconciled first. Replaces the per-consumer `isSuspended` /
+     * `runPhase` test methods (read `status().kind`).
+     */
+    status(): Promise<AgentStatus<Stage>>;
+    /**
+     * The run's terminal State (#46), or `undefined` while in flight. Read the
+     * run's product off it (e.g. `result()?.output`). Replaces the per-consumer
+     * `verdict` plumbing's source. Ensures the runtime is built first.
+     */
+    result(): Promise<AgentState<Stage, P, O, R> | undefined>;
+    /**
+     * The SSE hub — the route (`host.sse.open()`) AND the test seam
+     * (`host.sse.register(sink)`). The host drives `hub.emit` off the semantic
+     * event stream; the consumer never touches it except to open / register.
+     */
+    readonly sse: SseHub<Frame>;
+    /**
+     * Tear down the cached runtime (drain its tail via `stop()`, drop the handle)
+     * so the next `runtime()` rebuilds from storage. The framework `settle` test
+     * seam, owned once.
+     */
+    reset(): Promise<void>;
+}
+/**
+ * Build an {@link AgentHost} from the consumer's domain mappings. Owns the
+ * runtime+events+autoBoot assembly and the framework test seam — the wiring
+ * issue #53 had every consumer re-write.
  *
- * `now` is injected (the host's only clock read for boot) so a test can pin it.
+ * @example
+ *   const host = createAgentHost<Stage, Purpose, Outputs, ClientResult, SseEvent>({
+ *     buildMachine: () => agent.toMachine<Ctx>({ toolInterpret }),
+ *     store: doStore(storage, parse),
+ *     ctx,
+ *     toSseFrame: (e) =>
+ *       e.type === "ToolSettled" ? { kind: "result", ...} :
+ *       e.type === "TurnSettled" && e.turn.toolCalls.length === 0
+ *         ? { kind: "verdict", verdict: e.turn.content } :
+ *       e.type === "RunDone" ? { kind: "phase", phase: "done" } : null,
+ *   });
+ *   // route:   return host.sse.open();
+ *   // start:   await (await host.runtime()).dispatch({ type: "agent_start", ... });
+ *   // test:    (await host.status()).kind === "suspended"
+ */
+declare function createAgentHost<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame, C extends Cmd = Cmd, U extends Sub = Sub, Ctx = unknown>(config: AgentHostConfig<Stage, P, O, R, Frame, C, U, Ctx>): AgentHost<Stage, P, O, R, Frame>;
+
+/**
+ * The command-runner WebSocket host + broadcast — the WS half of the
+ * `@demlik/tea/do` transport, in both the resident (`acceptCommandSocket`) and
+ * hibernation-aware (`acceptDurableCommandSocket`) forms. See `./host` for the
+ * transport-model rationale (ONE Sub type, gateway-bridged I/O).
  */
-declare function autoBoot<Stage, P extends string, O extends Record<P, unknown>, R, E extends {
-    type: string;
-} = never>(booting: BootingRuntime<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, E>, now?: () => number): Promise<void>;
 /**
  * Accept a command-runner WebSocket on the DO's `fetch`. Adds the server end to
  * `clients`, wires `message` → `onFrame(data)` (string frames only) and
@@ -1001,6 +1169,11 @@ declare function acceptCommandSocket(clients: Set<WebSocket>, onFrame: (data: st
  * Broadcast a JSON frame to every connected command-runner socket. A dead
  * socket is skipped (dropped on its own `close` event). Lifts the consumer's
  * fan-out loop in `sendCommand`.
+ *
+ * Thin delegation to {@link broadcastFrame} — the general fan-out (serialize
+ * once, send to every OPEN socket, skip a closed/errored one). The
+ * {@link BroadcastReport} it returns is discarded here to keep the `void`
+ * command-socket signature.
  */
 declare function broadcast(clients: Set<WebSocket>, frame: unknown): void;
 /**
@@ -1032,8 +1205,92 @@ declare function acceptDurableCommandSocket(ctx: HibernatableCtx): Response;
  * set is read from `ctx.getWebSockets()` (the runtime repopulates it after a
  * wake), NOT a resident `Set<WebSocket>` — so it is correct immediately after an
  * eviction, before any other lifecycle method has run. A dead socket is skipped.
+ *
+ * Thin delegation to {@link broadcastFrame} over `ctx.getWebSockets()` — the
+ * general fan-out (serialize once, send to every OPEN socket, skip a
+ * closed/errored one). The {@link BroadcastReport} it returns is discarded here
+ * to keep the `void` command-socket signature.
  */
 declare function broadcastHibernatable(ctx: HibernatableCtx, frame: unknown): void;
+
+/**
+ * The deferred-tool gateway + its durable wrappers — the Promise-owning half of
+ * the `@demlik/tea/do` transport. See `./host` for the transport-model
+ * rationale (ONE Sub type, gateway-bridged I/O).
+ */
+
+/**
+ * The deferred-tool gateway. `R` is the consumer's tool-result type (what
+ * `agent_tool_ok` carries).
+ *
+ *   - `await(callId, send, deadlineMs)` — register the round-trip, fire `send`,
+ *     return the Promise the reply (or the deadline) settles. Idempotent per
+ *     `callId`: a second call for an in-flight id returns the SAME promise
+ *     without re-firing `send` (the boot-reconcile re-fire is a no-op at the
+ *     gateway, mirroring the agent's idempotent boot).
+ *   - `settle(callId, result)` — the transport calls this on a reply; resolves
+ *     the awaited promise. A settle for an unknown / already-settled id is a
+ *     no-op (the callId guard the consumer used to keep in its pending Map).
+ *   - `fail(callId, reason)` — settle the round-trip as an error on demand
+ *     (e.g. a transport-level close). Same unknown-id no-op.
+ *   - `inFlight()` — the callIds with an open round-trip (tests / introspection).
+ *
+ * The deadline → reject path is what makes "timeout is data": the tool cell's
+ * `catch` maps the rejection to `agent_tool_err`, recorded on the conversation,
+ * never a hang.
+ */
+interface DeferredGateway<R> {
+    await(callId: string, send: () => void, deadlineMs: number): Promise<R>;
+    settle(callId: string, result: R): void;
+    fail(callId: string, reason: string): void;
+    inFlight(): readonly string[];
+}
+/**
+ * Build a deferred-tool gateway. No clock / RNG captured at construction — the
+ * deadline is per-call (`await(..., deadlineMs)`), so one gateway serves every
+ * tool family with its own timeout.
+ *
+ * Deletes from the consumer: the `pending` Map, the `Pending` interface, the
+ * `awaitClient` method, the `forceTimeout` plumbing, and the `deliverResult`
+ * callId-guard body — all of it collapses to this object plus the tool cell's
+ * `await` + try/catch.
+ */
+declare function deferredGateway<R>(): DeferredGateway<R>;
+/** A `callId`-keyed durable round-trip: maps the gateway's string id to the
+ *  ledger's monotonic delivery id so a `settle(callId)` finds the owed entry. */
+interface DurableDeferredGateway<R> extends DeferredGateway<R> {
+    /** The ledger recorder this gateway feeds (for `surviving()` on activation). */
+    readonly recorder: PendingEffectsRecorder<{
+        callId: string;
+    }>;
+}
+/**
+ * Wrap a `DeferredGateway<R>` so every round-trip is also recorded in a durable
+ * `PendingEffectsRecorder`. The in-memory gateway is the fast path; the recorder
+ * is the durability slice.
+ *
+ *   - `recordOwed(callId, event)` — fires from `await`, BEFORE `send`, carrying
+ *     the `effect_owed` event the consumer must persist (then deliver).
+ *   - `recordConfirmed(callId, event)` — fires from `settle`/`fail` for a known
+ *     id, carrying the `effect_confirmed` event to persist.
+ *   - `reissue(callId, send, deadlineMs)` — re-arm a surviving round-trip on
+ *     activation. Idempotent: the gateway's own `await` returns the open promise
+ *     without re-firing `send` for an in-flight `callId`, so re-issuing an id
+ *     that is somehow still pending is a no-op (mirrors the boot-reconcile
+ *     re-fire). The effect is already owed, so no second `effect_owed` is
+ *     recorded.
+ *
+ * The effect payload the ledger stores is the `callId` (the correlation key the
+ * consumer round-trips); the consumer maps it back to its tool-call context.
+ */
+declare function durableDeferredGateway<R>(inner: DeferredGateway<R>, recorder: PendingEffectsRecorder<{
+    callId: string;
+}>, hooks: {
+    recordOwed(callId: string, event: EffectOwed<{
+        callId: string;
+    }>): void;
+    recordConfirmed(callId: string, event: EffectConfirmed): void;
+}): DurableDeferredGateway<R>;
 /**
  * The durable command carrier — a {@link DurableDeferredGateway} whose every
  * tool round-trip is also a durable owed effect.
@@ -1045,18 +1302,15 @@ declare function broadcastHibernatable(ctx: HibernatableCtx, frame: unknown): vo
  * `recordOwed`) to PERSIST before the send, and `settle`/`fail` hand it an
  * `effect_confirmed` (via `recordConfirmed`) to persist. On the next activation
  * the consumer reads its persisted ledger events back and calls
- * {@link reissueSurvivingEffects} to re-fire the survivors.
+ * `reissueSurvivingEffects` (see `./resume`) to re-fire the survivors.
  *
- * It extends `DurableDeferredGateway` (so it is a drop-in for the gateway the
+ * It IS a `DurableDeferredGateway` (so it is a drop-in for the gateway the
  * interpret cell already awaits) and exposes the underlying `recorder` for a
- * host that wants to read `surviving()` directly.
+ * host that wants to read `surviving()` directly. The #91 "command carrier"
+ * concept is exactly the durable gateway under a domain name — a type alias, not
+ * a second byte-identical interface that could drift.
  */
-interface DurableCommandCarrier<R> extends DeferredGateway<R> {
-    /** The ledger recorder backing this carrier (for `surviving()` introspection). */
-    readonly recorder: PendingEffectsRecorder<{
-        callId: string;
-    }>;
-}
+type DurableCommandCarrier<R> = DurableDeferredGateway<R>;
 /**
  * Build a durable command carrier over a (volatile) `DeferredGateway<R>` and a
  * `PendingEffectsRecorder`. Thin assembly over {@link durableDeferredGateway}:
@@ -1083,6 +1337,71 @@ declare function durableCommandCarrier<R>(inner: DeferredGateway<R>, recorder: P
     }>): void;
     recordConfirmed(callId: string, event: EffectConfirmed): void;
 }): DurableCommandCarrier<R>;
+
+/**
+ * Cold-wake resume — the boot/hibernation re-fire path: the generalized
+ * `bootResume` port, its agent specialization `autoBoot`, and the wake-time
+ * re-emit of surviving tool round-trips. See `./host` for the transport-model
+ * rationale.
+ */
+
+/**
+ * The typed cold-wake resume port `bootResume` fires through — the agent's
+ * `AgentBootPort` (issue #60) generalized to any DO-hosted machine (issue #231).
+ *
+ * - `isResumable(state)` — true iff the rehydrated State is mid-loop and needs a
+ *   resume dispatch. False on a fresh boot, which makes `bootResume` a no-op.
+ * - `resumeMsg(now)` — the TYPED constructor for the single resume Msg (never a
+ *   hand-built `{ type: … }` literal); the `agentBootMsg` shape lifted out so a
+ *   non-agent grain supplies its own boot Msg constructor.
+ */
+interface ResumePort<S, M extends {
+    type: string;
+}> {
+    readonly isResumable: (state: S) => boolean;
+    readonly resumeMsg: (now: number) => M;
+}
+/**
+ * After `runtime.ready`, derive the single resume Msg from the rehydrated State
+ * via `port` and dispatch it exactly once — the generalized AgentBoot. On a
+ * fresh (non-rehydrated) machine `port.isResumable` is false and this is a
+ * no-op. Call once right after building the runtime; it standardizes the
+ * hand-written `if (isResumable(state)) await runtime.dispatch(bootMsg(now()))`
+ * every DO-hosted machine otherwise re-derives.
+ *
+ * `await ready` is the single boot gate (issue #45): `getState()` is total only
+ * on the booted `Runtime`, so state cannot be inspected before boot populates
+ * it. `now` is injected (the sole boot clock read) so a test can pin it.
+ */
+declare function bootResume<S, M extends {
+    type: string;
+}, E extends {
+    type: string;
+} = never>(booting: BootingRuntime<S, M, E>, port: ResumePort<S, M>, now?: () => number): Promise<void>;
+/**
+ * True iff an agent slice loaded from storage is mid-loop (running + awaiting
+ * tools) — the resumable case `agent_boot` re-fires.
+ *
+ * The resumability question IS "is the run suspended on tools?" — so this
+ * delegates to the agent's own typed `status` channel (issue #49) rather than
+ * re-deriving the private `run.phase` / `conversation.awaiting` shape by hand.
+ * The host no longer leaks the agent's internal slice structure; a change to
+ * `Awaiting` surfaces as a compile error in `status`, not a silent break here.
+ */
+declare function agentIsResumable<Stage, P extends string, O extends Record<P, unknown>, R>(state: AgentState<Stage, P, O, R>): boolean;
+/**
+ * The AGENT specialization of {@link bootResume} (issue #231): after
+ * `runtime.ready`, self-dispatch `agent_boot` iff the rehydrated slice is
+ * resumable, a no-op on a fresh DO. Wires the agent slice's `agentIsResumable`
+ * predicate + the agent-owned `agentBootMsg` typed port (issue #60) into the
+ * generalized helper, so the resume dispatch lives in ONE place — see
+ * `bootResume`'s docblock for the boot-gate / init-purity rationale.
+ *
+ * `now` is injected (the host's only clock read for boot) so a test can pin it.
+ */
+declare function autoBoot<Stage, P extends string, O extends Record<P, unknown>, R, E extends {
+    type: string;
+} = never>(booting: BootingRuntime<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, E>, now?: () => number): Promise<void>;
 /**
  * RE-EMIT ON ACTIVATION (the #91 wake path). Given a durable carrier whose
  * recorder was rehydrated from the persisted ledger events (e.g.
@@ -1112,182 +1431,6 @@ declare function durableCommandCarrier<R>(inner: DeferredGateway<R>, recorder: P
  * they restore a suspended run's full in-flight state after a wake.
  */
 declare function reissueSurvivingEffects<R>(carrier: DurableCommandCarrier<R>, reissue: (callId: string) => void): readonly string[];
-/**
- * A set of SSE sinks plus the plumbing to fan an event out to all of them and
- * to open a `text/event-stream` Response wired to a fresh sink.
- *
- * The consumer:
- *   1. holds one `SseHub<E>` per DO,
- *   2. calls `hub.emit(event)` from its Msg→event mapping (driven off
- *      `runtime.observe`), and
- *   3. returns `hub.open()` from the `/sse` route.
- *
- * `register(sink)` exists for tests: subscribe a sink directly and observe the
- * exact event sequence a live client would receive (a live `text/event-stream`
- * fights vitest-pool-workers teardown). Deletes the consumer's `sseSinks` set,
- * `openSse`, `emitSse`, and `onSseEvent`.
- */
-interface SseHub<E> {
-    emit(event: E): void;
-    open(): Response;
-    register(sink: (event: E) => void): () => void;
-}
-/** Build an SSE hub for event type `E` (the consumer's domain event shape). */
-declare function sseHub<E>(): SseHub<E>;
-/**
- * Express an {@link SseHub} as a {@link Projection}. The projection's view is
- * the latest emitted SSE event (or `null` before the first); `apply` maps each
- * write-model update to an event via `toEvent` and emits it through `hub.emit`,
- * so the SSE stream is driven by the SAME hub `sseHub()` returns — no API
- * change for the `/sse` route (`hub.open()`) or any existing caller.
- *
- *   - `toEvent(msg, model)` returns the SSE event for this update, or `null` to
- *     skip it (the view stays, nothing is emitted).
- *   - `name`/`key` default to `"sse"`/`"main"`; override for a second SSE view.
- *
- * @example
- *   const hub = sseHub<MyEvent>();
- *   const registry = projectionRegistry<MyState, MyMsg>();
- *   registry.register(sseProjection(hub, (msg) =>
- *     msg?.type === "turn_done" ? { kind: "turn", ... } : null,
- *   ));
- *   driveProjections(registry, runtime); // SSE is now one projection
- *   // /sse route unchanged:
- *   return hub.open();
- */
-declare function sseProjection<Model, Msg extends {
-    type: string;
-}, E>(hub: SseHub<E>, toEvent: (msg: Msg | null, model: Model) => E | null, id?: {
-    name?: string;
-    key?: string;
-}): Projection<Model, Msg, E | null>;
-/**
- * Wire an {@link SseHub} to a runtime's semantic {@link AgentEvent} stream (#47).
- * For each event `type` the runtime can emit, subscribes via `runtime.on` and
- * pushes `toFrame(event)` at the hub (returning `null` skips that event). The
- * runtime MUST have been built with `run(machine, { events: agentEvents() })`,
- * which is what makes `on` deliver the `AgentEvent`s. Returns a cleanup that
- * detaches every subscription.
- *
- * This is the runtime→SSE adapter expressed over the typed event channel: no
- * `observe` firehose, no private-Msg coupling. `hub.open()` and every existing
- * `sseHub` caller are unchanged — only the SOURCE of `hub.emit` moves from a
- * hand-rolled Msg switch to `on`.
- *
- * @example
- *   const hub = sseHub<MyFrame>();
- *   const runtime = await run(machine, { ctx, events: agentEvents() }).ready;
- *   const off = sseFromAgentEvents(runtime, hub, (e) =>
- *     e.type === "RunDone" ? { kind: "done", output: e.output } : null,
- *   );
- *   // /sse route unchanged:
- *   return hub.open();
- */
-declare function sseFromAgentEvents<R, Frame>(runtime: {
-    on<K extends AgentEvent<R>["type"]>(type: K, handler: (event: Extract<AgentEvent<R>, {
-        type: K;
-    }>) => void): () => void;
-}, hub: SseHub<Frame>, toFrame: (event: AgentEvent<R>) => Frame | null): () => void;
-/**
- * What the consumer supplies to {@link createAgentHost} — the domain mappings,
- * nothing of the wiring. `Stage`/`P`/`O`/`R` are the agent slice's type
- * parameters (the consumer names them once); `Frame` is its SSE event shape.
- * `C`/`U`/`Ctx` are the machine's own Cmd/Sub/Ctx — inferred from
- * `buildMachine` at the `createAgentHost` call site (never name them by hand;
- * an erased `any` here cost consumers all checking on this layer — #278).
- */
-interface AgentHostConfig<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame, C extends Cmd = Cmd, U extends Sub = Sub, Ctx = unknown> {
-    /**
-     * Build the wired agent machine. Called once per host build (per activation),
-     * AFTER the previous runtime — if any — was torn down. The consumer wires its
-     * per-tool interpret here (`agent.toMachine({ toolInterpret })`).
-     */
-    readonly buildMachine: () => Machine<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, C, U, Ctx>;
-    /** The durable `Store` for the agent slice (typically `doStore(storage, parse)`). */
-    readonly store: Store<AgentState<Stage, P, O, R>>;
-    /** The Ctx the machine threads to its interpret cells — checked against `buildMachine`'s. */
-    readonly ctx: Ctx;
-    /**
-     * The run-terminality predicate (#46) — what makes `result()` first-class.
-     * Defaults to the agent's own terminal phases (`done` / `failed`).
-     */
-    readonly terminal?: (state: AgentState<Stage, P, O, R>) => boolean;
-    /**
-     * Map one semantic {@link AgentEvent} to the consumer's SSE frame, or `null`
-     * to skip it. This is the ONLY place the consumer touches the SSE seam — the
-     * host owns the subscription wiring (`sseFromAgentEvents`) and the hub.
-     */
-    readonly toSseFrame: (event: AgentEvent<R>) => Frame | null;
-    /** Clock injected for `autoBoot` (the host's only boot clock read). */
-    readonly now?: () => number;
-}
-/**
- * The assembled host: the runtime cell + the SSE hub + the framework test seam,
- * owned ONCE. A DO holds one `AgentHost` and delegates to it; its own surface
- * shrinks to the domain (the gateway, the WS bridge, the command-send mapping).
- *
- * @typeParam Stage Pipeline stage type.
- * @typeParam P     Brain-call purposes.
- * @typeParam O     Per-purpose outputs (bound to {@link AgentTurn}).
- * @typeParam R     Tool result type.
- * @typeParam Frame The consumer's SSE event shape.
- */
-interface AgentHost<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame> {
-    /**
-     * Get (or build) the booted runtime. Build-once-boot-once: the first call
-     * builds the machine, wires SSE off the semantic event stream, awaits the boot
-     * gate, runs the `autoBoot` re-fire for a rehydrated suspended run, and caches
-     * the booted `Runtime`; subsequent calls return the cached handle. The single
-     * assembly every consumer used to hand-roll in `getRuntime()`.
-     */
-    runtime(): Promise<Runtime<AgentState<Stage, P, O, R>, AgentMachineMsg<P, O, R>, AgentEvent<R>>>;
-    /**
-     * The agent's lifecycle status (#49) — the ONE typed channel a consumer reads
-     * instead of re-deriving `run.phase` / `awaiting` by hand. Ensures the runtime
-     * is built + boot-reconciled first. Replaces the per-consumer `isSuspended` /
-     * `runPhase` test methods (read `status().kind`).
-     */
-    status(): Promise<AgentStatus<Stage>>;
-    /**
-     * The run's terminal State (#46), or `undefined` while in flight. Read the
-     * run's product off it (e.g. `result()?.output`). Replaces the per-consumer
-     * `verdict` plumbing's source. Ensures the runtime is built first.
-     */
-    result(): Promise<AgentState<Stage, P, O, R> | undefined>;
-    /**
-     * The SSE hub — the route (`host.sse.open()`) AND the test seam
-     * (`host.sse.register(sink)`). The host drives `hub.emit` off the semantic
-     * event stream; the consumer never touches it except to open / register.
-     */
-    readonly sse: SseHub<Frame>;
-    /**
-     * Tear down the cached runtime (drain its tail via `stop()`, drop the handle)
-     * so the next `runtime()` rebuilds from storage. The framework `settle` test
-     * seam, owned once.
-     */
-    reset(): Promise<void>;
-}
-/**
- * Build an {@link AgentHost} from the consumer's domain mappings. Owns the
- * runtime+events+autoBoot assembly and the framework test seam — the wiring
- * issue #53 had every consumer re-write.
- *
- * @example
- *   const host = createAgentHost<Stage, Purpose, Outputs, ClientResult, SseEvent>({
- *     buildMachine: () => agent.toMachine<Ctx>({ toolInterpret }),
- *     store: doStore(storage, parse),
- *     ctx,
- *     toSseFrame: (e) =>
- *       e.type === "ToolSettled" ? { kind: "result", ...} :
- *       e.type === "TurnSettled" && e.turn.toolCalls.length === 0
- *         ? { kind: "verdict", verdict: e.turn.content } :
- *       e.type === "RunDone" ? { kind: "phase", phase: "done" } : null,
- *   });
- *   // route:   return host.sse.open();
- *   // start:   await (await host.runtime()).dispatch({ type: "agent_start", ... });
- *   // test:    (await host.status()).kind === "suspended"
- */
-declare function createAgentHost<Stage, P extends string, O extends Record<P, AgentTurn>, R, Frame, C extends Cmd = Cmd, U extends Sub = Sub, Ctx = unknown>(config: AgentHostConfig<Stage, P, O, R, Frame, C, U, Ctx>): AgentHost<Stage, P, O, R, Frame>;
 
 /**
  * @demlik/tea/do — the idempotent-effect brick (the receiver/effect-side dedup).
@@ -1668,6 +1811,7 @@ declare function acceptPresenceSocket<A>(ctx: PresenceCtx, options?: RegisterOpt
 declare function presenceCount(ctx: PresenceCtx, tag?: string): number;
 
 /**
+ * @packageDocumentation
  * @demlik/tea/do — Durable Object adapter for `@demlik/tea`.
  *
  * The integration is built on ONE transport model and one durability primitive:
@@ -1763,4 +1907,4 @@ interface DoStoreOptions<S> {
  */
 declare function doStore<S>(storage: DurableObjectStorage, parse: (raw: unknown) => S | null, keyOrOptions?: string | DoStoreOptions<S>): Store<S>;
 
-export { type AgentHost, type AgentHostConfig, type AlarmStorage, type AppliedEffects, type AppliedEffectsEvent, type AppliedEffectsGuard, type AttachableSocket, type BroadcastOptions, type BroadcastReport, type DeferredGateway, type DoStoreOptions, type DurableCommandCarrier, type DurableTimer, type DurableTimerConfig, type EffectApplied, EffectConfirmed, type EffectForgotten, type EffectKey, EffectOwed, type EventLogRange, type EventSourcedOptions, type EventSourcedStore, type ExecuteStep, type HibernatableCtx, type IdempotentEffect, type IdempotentOutcome, type NextStep, PendingEffectsRecorder, type PersistedEvent, type PresenceCtx, type PresenceSocket, type PresenceUpgrade, type Projection, type ProjectionId, type ProjectionRegistry, type ProjectionRunner, type ProjectionUpdate, type RegisterOptions, type ResumePort, type RunStepLoopConfig, type SseHub, type StepCtx, type StepEngine, type StepHostConfig, type StepLoopOutcome, type StepOutcome, type StepRequest, type StepResponse, type StepResult, type StepTransport, WS_READY_STATE_OPEN, acceptCommandSocket, acceptDurableCommandSocket, acceptPresenceSocket, agentIsResumable, appliedEffects, applyAppliedEvent, autoBoot, bootResume, broadcast, broadcastFrame, broadcastHibernatable, constantTimeEqual, createAgentHost, deferredGateway, doEventSourcedStore, doStore, driveProjections, durableCommandCarrier, durableDeferredGateway, durableTimer, emptyApplied, foldApplied, idempotentEffect, isApplied, mintRunToken, presenceCount, projectionIdString, projectionRegistry, rebuildProjection, registerHibernatableSocket, reissueSurvivingEffects, runProjection, runStepLoop, sseFromAgentEvents, sseHub, sseProjection, stepHost };
+export { type AgentHost, type AgentHostConfig, type AlarmStorage, type AppliedEffects, type AppliedEffectsEvent, type AppliedEffectsGuard, type AttachableSocket, type BroadcastOptions, type BroadcastReport, type DeferResumeHook, type DeferStepHostConfig, type DeferredGateway, type DeferredStepOutcome, type DeferredStepResponse, type DoStoreOptions, type DurableCommandCarrier, type DurableTimer, type DurableTimerConfig, type EffectApplied, EffectConfirmed, type EffectForgotten, type EffectKey, EffectOwed, type EventLogRange, type EventSourcedOptions, type EventSourcedStore, type ExecuteStep, type HibernatableCtx, type IdempotentEffect, type IdempotentOutcome, type NextStep, PendingEffectsRecorder, type PersistedEvent, type PresenceCtx, type PresenceSocket, type PresenceUpgrade, type Projection, type ProjectionErrorContext, type ProjectionId, type ProjectionOnError, type ProjectionRegistry, type ProjectionRunner, type ProjectionUpdate, type RegisterOptions, type ResumePort, type RunStepLoopConfig, type SseHub, type StepCtx, type StepEngine, type StepHostConfig, type StepLoopOutcome, type StepOutcome, type StepRequest, type StepResponse, type StepResult, type StepTransport, type StepWorking, WS_READY_STATE_OPEN, acceptCommandSocket, acceptDurableCommandSocket, acceptPresenceSocket, agentIsResumable, appliedEffects, applyAppliedEvent, autoBoot, bootResume, broadcast, broadcastFrame, broadcastHibernatable, constantTimeEqual, createAgentHost, deferredGateway, doEventSourcedStore, doStore, driveProjections, durableCommandCarrier, durableDeferredGateway, durableTimer, emptyApplied, foldApplied, idempotentEffect, isApplied, mintRunToken, presenceCount, projectionIdString, projectionRegistry, rebuildProjection, registerHibernatableSocket, reissueSurvivingEffects, runProjection, runStepLoop, sseFromAgentEvents, sseHub, sseProjection, stepHost };