@indexnetwork/protocol 22.0.0-rc.499.1 → 64.0.0

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # Changelog
 
+## 64.0.0
+
+### Breaking changes
+
+- Opportunity status is a projection of an append-only event log (`opened`, `agreed`, `committed`, `declined`, `expired`). Remove `updateOpportunityStatus` and `deleteOpportunity` exports, `stampOpportunityActorAction`, and `acceptSiblingOpportunities`. Drop `accepted_by` and `actors.actedAt`. One person's commit no longer accepts the row or opens a conversation.
+
+## 63.0.0
+
+### Breaking changes
+
+- **`Intents.clarify()` → `Intents.prepare()`.** Fold recovery answers into the draft, run creation admission, and return `ready` with metadata or `needs_revision` with admission feedback plus a dynamic recovery form. Remove `ClarifyAnswer`, `ClarifyInput`, `ClarifyQuestion`, `ClarifyQuestionOption`, `ClarifyResult`, and `needs_clarification`.
+- Export `PrepareAnswer`, `PrepareInput`, `PrepareResult`, `RecoveryField`, `RecoveryFieldKind`, and `RecoveryFieldOption` instead.
+
+## 62.0.0
+
+### Breaking changes
+
+- Remove outcome-feedback capture and mining from the protocol. Remove the `OutcomeOutbox` export and the optional outbox arguments from the database ports `updateOpportunityStatus` and `stampOpportunityActorAction`; hosts must stop supplying these arguments and remove their feedback capture/mining wiring.
+- Remove `PoolDiscriminatorMiner`, `DiscriminatorMiningInput`, `MinedDiscriminator`, `PoolCandidate`, `isOutcomeQuestionsActivated`, `OUTCOME_MAX_CANDIDATES`, `OUTCOME_MAX_PUBLIC_CONTEXT_CHARS`, `OUTCOME_MIN_INDEPENDENT_EXAMPLES`, `runOutcomeShadow`, `OutcomeExample`, `OutcomeLabel`, and `OutcomeShadowResult` from the public entry point. Delete the internal outcome pipeline and its discriminator miner, types, and evidence-verification helpers without compatibility exports.
+- Remove the `poolDiscriminatorMiner`, `poolDiscriminatorAssigner`, and `negotiationEvidenceMiner` model keys. They are no longer accepted by `getModelName` or `EVAL_MODEL_OVERRIDES`.
+
+### Preserved behavior
+
+- Negotiation outcomes and presentation, opportunity lifecycle and shared claim-safety guards, and intent preparation, clarification, and scoring are unchanged.
+
+## 61.0.0
+
+### Breaking changes
+
+- A standing proposal cannot be proposed over. `decideNegotiationTurn` rejects a `propose` whose previous turn is the other seat's `propose` as the new `propose_over_offer` rejection, and `observeNegotiation` offers `counter`, `accept`, `decline` to a seat facing a proposal. `propose` keeps its two uses: opening a negotiation, and answering a counter.
+- `NEGOTIATION_GUIDANCE` states the rule alongside the accept rule from 60.0.0.
+
+### Why
+
+60.0.0 made `propose` legal at every turn index so an answer to a counter could be re-offered. With nothing stopping a proposal from answering a proposal, two agents that already agreed volleyed restatements until the turn limit: one live negotiation ran `propose > counter > propose` ten times and never settled, each turn saying what the other had just said.
+
+### Preserved behavior
+
+- Settled negotiations, turn limits, seat and eligibility checks, race detection, outcomes and their opportunity statuses are unchanged. No stored enum value changed, so no migration is required. A negotiation mid-flight facing a proposal simply loses `propose` from its menu.
+
+## 60.0.0
+
+### Breaking changes
+
+- A counter is no longer a standing offer. `decideNegotiationTurn` accepts an `accept` only against the other seat's `propose`; an accept whose previous turn is a counter is rejected as `accept_without_offer`. The seat that asked a question is now the one that settles, because answering means proposing again.
+- `propose` is valid at any turn index, not only the opening one. It is how an answer to a counter is put back on the table. The `propose_not_first` rejection is removed from `NegotiationRejection`; `counter_is_first` still blocks a counter at turn 0, and the opening remains a propose or a decline.
+- `observeNegotiation` derives its menu from the same fact. A seat facing a `propose` sees `propose`, `counter`, `accept`, `decline`; a seat facing a `counter` sees `propose`, `counter`, `decline`; an empty log still sees `propose`, `decline`.
+- `NEGOTIATION_GUIDANCE` states the new rule in place of "counter responds with revised terms".
+
+### Preserved behavior
+
+- Settled negotiations, turn limits, seat and eligibility checks, race detection, and the `agreed`/`declined` outcomes and their opportunity statuses are unchanged. No stored enum value changed, so no migration is required. A negotiation mid-flight whose last turn is a counter simply loses `accept` from its menu.
+
+## 59.0.1
+
+### Documentation
+
+- `IMPLEMENTATION.md` now describes the host's negotiation routes as they are: `GET /api/negotiations` lists a seat's negotiations, and one is observed and turned through its opportunity at `GET /api/opportunities/:id/negotiation` and `POST /api/opportunities/:id/negotiation/turns`. No exported surface changed.
+
+## 59.0.0
+
+### Breaking changes
+
+- Discovery is no longer a post-persist workflow. `IntentFollowUp.onIntentSaved`, `onIntentArchived`, and `onIntentResumed` no longer imply matching work and may do nothing; hosts search on demand instead. The interface shape is unchanged, so implementations keep compiling. `scoreIntent` is unaffected.
+- Remove the `@indexnetwork/discovery` workspace. There is no lens inference, hypothetical-document generation or validation, artifact cache, or match explainer anywhere in the repository. Retrieval is one embedding of the caller's own query against real intent embeddings, and the judging is the caller's.
+
+### Preserved behavior
+
+- Pair identity and opening are unchanged: `pairKeyOf` plus `openCounterparties(pairs, decideNegotiationOpening)` still writes the opportunity and its negotiation atomically, and remains the only way one is created. Network/broadcast scope (`resolveDiscoveryNetworkScope`, `renderDiscoveryNetworkContext`), negotiation rules, and opportunity lifecycle/presentation are untouched.
+
+## 58.0.0
+
+### Breaking changes
+
+- Extract post-intent discovery into the independent `@indexnetwork/discovery` workspace. Remove `OpportunityGraphFactory`, `OpportunityGraphThresholdOverrides`, `HydeGraphFactory`, `HydeGenerator`, `LensInferrer`, `HydeGraphDatabase`, `HydeCache`, the lens/search DTOs, `buildCandidateEvidence`, and discovery threshold exports from protocol. The extracted path uses plain async TypeScript and validated fetch-based model responses.
+- Replace `IntentFollowUp.generateHyde`, `deleteHyde`, and `resumeDiscovery` with `onIntentSaved`, `onIntentArchived`, and `onIntentResumed`. Scheduling and failure/compensation behavior are unchanged; `scoreIntent` remains a separate best-effort metadata hook.
+- Remove artifact storage methods from protocol database ports and multi-lens retrieval from `Embedder`. Replace `OpportunityGraphDatabase` with the lifecycle/read-only `OpportunityDatabase` port; expose `readOpportunities`, `updateOpportunityStatus`, and `deleteOpportunity` directly. Remove discovery agents from protocol model assignments.
+- Hosts run discovery and commit returned potential pairs with `pairKeyOf` and `decideNegotiationOpening` through atomic `openCounterparties`. Protocol retains intent lifecycle, network/broadcast scope rules, negotiations, and opportunity lifecycle/presentation. Expose `resolveDiscoveryNetworkScope` and `renderDiscoveryNetworkContext` for host composition.
+
+### Preserved behavior
+
+- Keep source-grounded frame-v1 cache identity and generation cohorts, validation failure semantics, real-intent candidate retrieval, membership checks, per-lens/per-network budgets, rejection cooldown, ranking limits, explanations, and atomic pair uniqueness. Hypothetical documents remain query-side retrieval artifacts.
+
+## 57.0.0
+
+### Breaking changes
+- `Intents.clarify()` now applies creation admission to the complete draft and returns `ready` with semantic metadata or `needs_clarification` with feedback and questions. Model failures throw for retry; an empty question list no longer substitutes for admission.
+- Explicit graph creation prepares once and persists exactly one new intent verbatim, including when similar intents exist. It no longer infers, rewrites, or reconciles creation into updates or archival. The reconciler agent injection is removed.
+- Hosts may pass authenticated `preparation` to the creation graph to authorize final user revisions without another admission gate. Preserve metadata only when it measures the submitted text; use null metadata after revisions. Never accept preparation objects from untrusted clients.
+- `IntentFollowUp.scoreIntent` is required for best-effort rescoring after edited creation. It must never reject, rewrite, archive, or undo the saved intent and must apply metadata only while the owner and text still match. `Intents.scoreIntent()` returns measurements without admission filters.
+- Export `PreparedIntent` and `IntentSemanticMetadata` for host integration. Existing explicit update, read, archive, and status operations retain their behavior.
+
+### Fixed
+- Restrict the generic-job shortcut to bare requests. Qualified searches containing "a job" use the verifier's existing admission thresholds and specificity verdict.
+
 All notable changes to `@indexnetwork/protocol` are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
@@ -10,6 +105,69 @@ See [STABILITY.md](./STABILITY.md) for the public-contract and tier definitions.
 > itemized. From `2.0.0` onward, keep this file updated as part of every release
 > (bump `package.json` and the `[Unreleased]` section before promoting to `main`).
 
+
+## 56.0.0
+
+### Breaking changes
+
+- **The tool layer is gone.** `createToolRegistry`, `invokeToolRuntime`,
+  `toolRuntimeErrorToResult`, `getToolTimeoutPolicy`, `resolveChatContext`,
+  `createEnrichmentTools`, `createOpportunityTools`, `Intents.createTools`,
+  `Networks.createTools`, and the `ResolvedToolContext` / `ToolDeps` /
+  `RawToolDefinition` / `EnrichmentToolDeps` / `OpportunityToolDeps` /
+  `IntentToolDeps` / `NetworkToolDeps` types are removed, along with every
+  `*.tools.ts` factory, `tool.registry.ts`, `tool.runtime.ts`, and
+  `tool.helpers.ts`. Hosts expose capabilities as their own REST resources and
+  reach the protocol through the graph factories and capability classes, which
+  are unchanged. `@indexnetwork/agent`'s own `Tool` loop is a different thing
+  and is untouched.
+- **`ToolScopeType` is `ScopeType`** and `deriveAllowedNetworkIds` /
+  `deriveDiscoveryNetworkIds` moved to `internal/shared/agent/scope.ts`.
+- **`CompositeToolDatabase` is `CompositeDatabase`.** Same members.
+
+### Changed
+
+- Canonical guidance (`GET /api/docs` in the reference host) describes REST
+  resources and CLI commands instead of tool names, and the user event stream is
+  documented as `GET /api/events`.
+
+## 55.0.0
+
+### Breaking changes
+
+- Remove MCP serving and authentication exports: `createMcpServer`, `ScopedDepsFactory`, `McpAuthResolver`, `McpAuthInput`, `McpResolvedIdentity`, `buildMcpOnboardingMessage`, and `ONBOARDING_ALLOWED`.
+- Remove `createOpportunityVerdictTools`, the registry `surface` option, and MCP-only tool context/dependency fields. Hosts compose scoped tools through `createToolRegistry` and `invokeToolRuntime`; owner approval remains a separate explicit HTTP operation.
+- External agents use the HTTP API through CLI 0.24.0. `read_docs` now serves canonical HTTP/CLI workflows, and utility tools use one shared registry. Shared execution limits, cancellation, ownership, and network scoping remain in place.
+- Remove the direct MCP SDK dependency. The API host removes `/mcp` and MCP OAuth discovery and drops only the three obsolete OAuth tables.
+
+## 54.0.1 - 2026-09-09
+
+### Changed
+
+- Centralize shared negotiation guidance, MCP instructions, and `read_docs`
+  content and composition in `src/protocol/protocol.prompt.ts`. Emitted text,
+  topic matching, response envelopes, and package-root exports are unchanged.
+- Share negotiation limits between guidance and enforcement through
+  `src/protocol/negotiation.constants.ts`, and document prompt consumers in the
+  implementation guide.
+
+## 54.0.0
+
+### Breaking changes
+
+- Add the `Negotiations` participation capability, current-state observations,
+  protocol guidance, and atomic host commit contract. Submissions carry the
+  observed `expectedTurnCount`; stale decisions are refused.
+- `openCounterparties` now receives a protocol decision callback that hosts must
+  evaluate against current network membership and active intent assignments.
+- Replace `NEGOTIATION_MAX_TURNS_AMBIENT` (and the private chat limit) with one
+  `NEGOTIATION_MAX_TURNS` of 12. Exhaustion blocks further turns with no outcome;
+  A2A agreement advances only to pending human approval.
+- The API host renames domain tables with `protocol_` prefixes, adds private
+  `agent_sessions`, and composes the independent agent library through its local
+  TUI runner. Forward migrations preserve existing records.
+
+
 ## Release model
 
 Every push to `dev` publishes `<package.json version>-rc.<run>.<attempt>` under
@@ -20,6 +178,1646 @@ went 6.7.1 → 8.0.2 with no 7.x in between because the whole 7.x line shipped a
 prereleases between the two promotions. To track every change, read `rc`; to
 pin a supported release, use `latest`.
 
+## 53.0.0 - 2026-09-06
+
+### Removed
+
+- **BREAKING — `mcpRateLimiter` is gone.** Hosts used to inject a per-principal
+  throttle on MCP tool dispatch. That hook is deleted; a tool call runs as soon
+  as identity resolves.
+
+## 52.0.0 - 2026-09-06
+
+### Removed
+
+- **BREAKING — the MCP capability policy is gone.** `mcp.authorization-policy.ts`
+  is deleted along with the `CANONICAL_MCP_CAPABILITY_POLICY_OPTIONS`,
+  `McpCapabilityPolicyOptions`, `McpAuthorizationObserver` and
+  `McpAuthorizationDenialEvent` exports. `createMcpServer` now takes three
+  arguments — `(deps, authResolver, scopedDepsFactory)` — and every
+  authenticated caller sees and can call every registered tool. A credential
+  names a user, so ownership and membership checks in the handlers are the only
+  remaining gate.
+- **BREAKING — agent CRUD is not an MCP tool.** `register_agent`, `list_agents`,
+  `update_agent` and `delete_agent` are deleted. Agents are created, updated and
+  deleted from the owner's own signed-in session over the host's REST surface.
+  `read_own_agent` stays, unchanged, as a plain authenticated tool.
+- The owner-session gate inside `accept_opportunity` and `reject_opportunity` is
+  removed. A verdict passed through a key is the owner passing it, and the write
+  was always scoped to `context.userId`.
+
+## 51.0.0 - 2026-09-06
+
+### Removed
+
+- **BREAKING — an API key names a user, never an agent.**
+  `McpResolvedIdentity` is `{ userId }` plus the session flag: `agentId`,
+  `enrollmentCapable`, `isHermesAgent` and `networkScopeId` are gone, along with
+  `McpApiKeyMetadataSchema`. Nothing derives a principal from key metadata, so
+  the `enrollment_key`, `unregistered_key`, `registered_network_agent` and
+  `registered_global_agent` capability profiles are gone too — a caller is
+  either a session or a key, and a key gets the full product tool set.
+- **BREAKING — `agent_permissions` is deleted.** `AgentPermissionRecord`,
+  `AgentWithRelations` and `GrantPermissionInput` are removed from the public
+  types; `AgentDatabase` loses `getAgentWithRelations`, `grantPermission`,
+  `revokePermission` and `hasPermission`, and gains `getSelectedNegotiator`.
+  The `grant_agent_permission` and `revoke_agent_permission` MCP tools are
+  gone, `register_agent` no longer takes `permissions`, and `read_own_agent`
+  returns the owner's selected negotiator.
+- **BREAKING — tool access rules collapse to four kinds.**
+  `McpToolAccessRule` is `authenticated`, `human_only`, `agent_admin` or
+  `removed`; `reach` and the stored-permission projection
+  (`defineMcpToolPermissionMap`, `McpToolPermissionMap`,
+  `MCP_PERMISSION_ACTIONS`, `projectStoredPermissionActions`) are removed.
+  Owner verdicts and `delete_network` stay `human_only`; agent CRUD is
+  `agent_admin` and reachable only from a session.
+
+### Changed
+
+- `ResolvedToolContext` no longer carries `agentId`, so rate limiting and
+  owner-verdict checks key off the user and the session flag alone.
+
+## 50.0.0 - 2026-09-05
+
+### Removed
+
+- **BREAKING — drop the IND-593 owner-approval proof port.** `update_opportunity`
+  send/accept/reject is an ordinary tool call gated by existing MCP/session auth.
+  Removed `ownerApprovalProof` from the public schema, plus
+  `OpportunityOwnerApprovalAuthority` and related public types,
+  `bindOwnerApprovalProvenance`, and `opportunityOwnerActionForStatus`. Owner
+  verdict tools (`accept_opportunity` / `reject_opportunity`) still require a
+  host-bound session (`context.isSessionAuth`).
+
+## 49.0.1 - 2026-09-05
+
+### Changed
+
+- Documentation only. TSDoc and inline comments across `platform/database/` and
+  `internal/opportunities/` no longer call a network an "index".
+  `IMPLEMENTATION.md` drops the removed `indexer` dependency from its `Networks`
+  example and describes `createAssignmentGraph()` as it behaves today: no
+  scoring policy, rows written at score 1 with `mode: manual_override`.
+  `src/README.md` drops the Intent Indexer agent row, whose file
+  (`internal/intents/indexing/intent.indexer.ts`) no longer exists. No public
+  surface change.
+
+## 49.0.0 - 2026-09-04
+
+### Removed
+
+- **BREAKING — the three intent↔network MCP tools were renamed.** External agents
+  must switch tool names; there is no alias or compatibility shim.
+  - `create_intent_index` → `add_intent_to_network`
+  - `read_intent_indexes` → `list_intent_networks`
+  - `delete_intent_index` → `remove_intent_from_network`
+
+### Changed
+
+- **BREAKING — host interfaces no longer call a network an "index".** The domain
+  renamed indexes to networks, but the ports a host implements still said
+  `Index`, so a host had to speak both vocabularies. Every such member is renamed
+  in place. Hosts must rename their implementations:
+  - `Database`/`UserDatabase`/`SystemDatabase` methods: `getOwnedIndexes` →
+    `getOwnedNetworks`, `getUserIndexIds` → `getUserNetworkIds`,
+    `getPublicIndexesNotJoined` → `getPublicNetworksNotJoined`,
+    `getMembersFromUserIndexes` → `getMembersFromUserNetworks`,
+    `getActiveIntentsAcrossIndexes` → `getActiveIntentsAcrossNetworks`,
+    `getIntentsInIndex` → `getIntentsInNetwork`, `getUserIntentsInIndex` →
+    `getUserIntentsInNetwork`, `getIntentsInIndexForMember` →
+    `getIntentsInNetworkForMember`, `getIntentIndexScores` →
+    `getIntentNetworkScores`, `deleteIntentIndexAssociations` →
+    `deleteIntentNetworkAssociations`, `isIntentAssignedToIndex` →
+    `isIntentAssignedToNetwork`, `unassignIntentFromIndex` →
+    `unassignIntentFromNetwork`, `isIndexOwner` → `isNetworkOwner`,
+    `removeMemberFromIndex` → `removeMemberFromNetwork`, `updateIndexSettings` →
+    `updateNetworkSettings`.
+  - Entity types: `OwnedIndex` → `OwnedNetwork`, `IndexMemberDetails` →
+    `NetworkMemberDetails`, `IndexedIntentDetails` → `NetworkIntentDetails`,
+    `UpdateIndexSettingsData` → `UpdateNetworkSettingsData`. The
+    `NetworkMembership.indexPrompt` field is now `networkPrompt`.
+  - Scope plumbing: `indexScope` is `networkScope` everywhere it appears —
+    `SystemDatabase.indexScope`, the `createSystemDatabase` /
+    `ScopedDepsFactory.create` third argument, `HydeSearchOptions.indexScope`,
+    `ChatToolRequest.indexScope`, and the intent/opportunity graph state channels.
+  - Tool context: `ResolvedToolContext.indexName`/`scopedIndex` are `networkName`/
+    `scopedNetwork`; `ToolRequestContext.indexName` is `networkName`.
+  - Graph registry keys: `graphs.index` → `graphs.network` and
+    `graphs.intentIndex` → `graphs.intentNetwork`. Their trace name changed from
+    `index` to `network`.
+  - `ChatContextAccessError.code` values `INDEX_NOT_FOUND` and
+    `INDEX_MEMBERSHIP_REQUIRED` are now `NETWORK_NOT_FOUND` and
+    `NETWORK_MEMBERSHIP_REQUIRED`.
+  - `resolveIndexNames` → `resolveNetworkNames`;
+    `DiscoveryNegotiation.indexContext` → `networkContext`.
+  - Presenter context: the `indexName` field returned by `gatherPresenterContext`
+    is `networkName`, which also fixes `focusedNetworkLabel` reading a field that
+    no longer existed and falling back to the network id.
+- Agent-facing tool descriptions, scope-refusal messages, and `read_docs`
+  guidance now say "network" or "community" wherever they said "index".
+- The intent assignment pipeline keeps its verb naming (`getIntentForIndexing`,
+  `indexer.graph.ts`, `IndexedIntent`): those describe assigning a signal, not
+  the community noun.
+
+## 48.1.0 - 2026-09-04
+
+### Changed
+
+- **`read_docs` speaks networks, not indexes.** The topic key `indexes` is now
+  `networks` and its section is rewritten in network terms, so `topic=indexes`
+  no longer resolves to a section and falls back to the summary. MCP callers are
+  unaffected: that surface already served `communities-networks`.
+- **Opportunity-graph log payloads renamed.** `targetIndexesCount` is
+  `targetNetworksCount` and the `indexes` key is `networks`, alongside the
+  surrounding trace strings. Log-scraping dashboards need updating.
+
+## 48.0.0 - 2026-09-04
+
+### Added
+
+- **`Intents.clarify({ payload, answers? })` → `{ payload, questions }`.** One
+  stateless round of signal clarification: with no answers it returns the payload
+  untouched plus the questions worth asking; with answers it rewrites the payload
+  so those answers are stated in it and returns whatever is still open. Nothing
+  is stored, so skipping is always valid. `ClarifyAnswer`, `ClarifyInput`,
+  `ClarifyQuestion`, `ClarifyQuestionOption` and `ClarifyResult` are exported.
+
+### Removed
+
+- **BREAKING: the intake funnel is gone.** `IntakePack`, `IntakePackInput`,
+  `IntakePackQuestion`, `IntakePackQuestionOption`, `IntakeAnswer`, `IntakeRound`,
+  `FollowUpPlan`, `SynthesisInput` and `SynthesisResult` are removed along with
+  the pack generator and intake orchestrator. Clarification is `clarify` now, and
+  it holds no run state — hosts can drop their intake pack and run storage.
+- **BREAKING: signals are no longer proposed before they are created.** The
+  dry-run branch of `create_intent`, the `intent_proposal` fence it emitted and
+  the `autoApprove` argument are gone. `create_intent({ description, networkIds })`
+  persists directly, so hosts can drop their proposal storage and their confirm
+  and reject endpoints.
+- **BREAKING: networks are no longer assigned by a model.** `IntentNetworkIndexer`,
+  `IntentIndexingResult`, `Intents.indexIntent` and the evaluated branch of the
+  indexer graph are removed, and so is the threshold scoring behind them. A signal
+  reaches exactly the networks its owner names on create or links afterwards with
+  `create_intent_index`.
+- **BREAKING: agents no longer have transports.** `AgentTransportRecord`,
+  `CreateTransportInput` and the `AgentDatabase` methods `createTransport`,
+  `deleteTransport`, `recordTransportFailure` and `recordTransportSuccess` are
+  removed, and `AgentWithRelations` no longer carries a `transports` array. No
+  delivery loop ever read the rows. Hosts can drop their `agent_transports`
+  storage.
+- `createIntentSuggested` and `suggestedIntentDescription` from the opportunity
+  graph state. Nothing routed on them.
+
+## 47.0.0 - 2026-09-03
+
+### Removed
+
+- **BREAKING: `'personal'` is no longer an agent type.** `AgentRecord.type` and
+  `CreateAgentInput.type` are now `'external' | 'system'`. The `personal` row was
+  the auto-provisioned per-user negotiator behind the in-process negotiation
+  loop; nothing reads it since that loop was deleted. Hosts must delete their
+  `personal` rows and shrink their own enum — user-registered agents are
+  `external`.
+
+## 46.0.0 - 2026-09-03
+
+### Removed
+
+- **BREAKING: the question surface is gone.** `Question`, `QuestionPurpose`,
+  `QuestionPurposeSchema`, `QuestionStrategy`, `QuestionStrategySchema`,
+  `QuestionRecoverySnapshot` and `QuestionVoidedReason` are removed along with
+  `question.ts`, and so are the question-block exports (`QuestionBlockSchema`,
+  `QuestionBlockQuestionSchema`, `QuestionBlock`, `QuestionBlockQuestion`,
+  `ParsedQuestionMessage`, `parseQuestionMessage`, `serializeQuestionMessage`,
+  `questionBlockFixture`, `questionMessageFixture`, `questionProseFixture`).
+  The durable question system was retired generator-first; nothing produced,
+  stored or rendered these shapes any more. Hosts can drop their `questions`
+  storage with them.
+- `UnderspecificationTypeSchema` and `UnderspecificationType` now come straight
+  from `protocol/schemas/underspecification.schema.ts`. The exported names and
+  types are unchanged; only the (never-contractual) internal module moved.
+
+## 46.0.0 - 2026-09-03
+
+### Removed
+
+- **BREAKING: `upsertDiscoveryMatchCandidates` and `openCandidates` are replaced
+  by `openCounterparties(pairs)`.** Discovery no longer stages a scored pair
+  before opening it: it hands the host the pair and the host writes the
+  opportunity and its negotiation in one transaction, keyed on `pairKey`. Hosts
+  can drop their candidates table; the pair-uniqueness it enforced belongs on
+  the negotiation.
+- **BREAKING: `DiscoveryMatchCandidate`, `CreateDiscoveryMatchCandidateData` and
+  `DiscoveryMatchCandidateStatus` are gone.** `CreateIntentCounterpartyData`
+  replaces the create shape as a call payload rather than a stored entity.
+
+## 45.0.0 - 2026-09-03
+
+### Added
+
+- **`NegotiationContextDatabase`** (`platform/database/negotiation.ts`), with
+  `NegotiationContextRecord`, `NegotiationContextTurn` and
+  `NegotiationContextOutcome`. The host reads one negotiation record and its
+  turn log; the loader turns that into the prompt block and the negotiating
+  chip. It replaces every task-shaped read the old loader performed.
+- **`OpportunityGraphDatabase.openCandidates`** returns `OpenedNegotiation[]`.
+  Discovery now opens the opportunity and its negotiation record together, so
+  the graph never leaves a scored candidate without a record to negotiate in.
+
+### Removed
+
+- **BREAKING: `NegotiationGraphDatabase` is gone**, along with
+  `NegotiationTurnSchema`, the `negotiation-evidence` module and its exports,
+  the negotiation digest schema, and `CreateAndOpenResult`. Index is the server
+  for a negotiation: it validates turn order, appends the turn and computes the
+  settlement, so there is no in-process graph left to give a port.
+- **BREAKING: `listPendingCandidatesForIntent` is replaced by `openCandidates`**
+  on the discovery database port.
+- **BREAKING: `'stalled'` is gone from `OpportunityStatus`.** It was the
+  turn-cap outcome of the A2A task loop; the negotiation record has two
+  outcomes and a close, so nothing produces it.
+
+## 44.0.0 - 2026-09-03
+
+### Removed
+
+- **BREAKING: `NegotiationRoundLogDatabase`, `NegotiationRoundLogEventKind` and
+  `NegotiationRoundLogEventRecord` are gone.** The port was orphaned when the
+  in-process negotiation graph and its `foldNegotiationRoundLog` were deleted:
+  nothing composed it into `NegotiationGraphDatabase` and no host implemented
+  its two methods. Hosts that declared them can delete those implementations
+  along with their `negotiation_round_log_events` storage.
+
+## 43.0.0 - 2026-09-02
+
+### Removed
+
+- **BREAKING: `McpAuthInputSchema` no longer accepts `telegramHandle` or
+  `telegramUsername`.** The MCP server stops reading the `x-telegram-handle` and
+  `x-telegram-username` headers, and the host no longer binds a Telegram handle
+  to an account at authentication time. Telegram on a user profile is now only a
+  social link, so `telegram-handle.ts` and `social-label.ts` are unchanged.
+
+## 42.0.0 - 2026-09-02
+
+### Removed
+
+- **BREAKING: the premises capability is gone.** `create_premise`,
+  `read_premises`, `update_premise`, and `retract_premise` are no longer
+  registered; `PremiseGraphFactory`, `PremiseGraphDatabase`, `PremiseRecord`,
+  `OpportunityActor.premise`, and every premise method on the host database
+  ports are removed. Matching is intent-only: `HydeTargetCorpus` drops
+  `'premises'`, the `query_premise` evidence kind and the
+  `sourcePremiseId`/`candidatePremiseId` candidate fields are gone, and
+  `manage:premises` is no longer a permission action. The protocol README drops
+  **Premise** as an entity: context stands on its own, and candidate generation
+  no longer lists premise-to-premise as a strategy.
+- **BREAKING: opportunity delivery is gone.** `confirm_opportunity_delivery`,
+  the `DeliveryLedger` port, `getOrCreateDeliveryCardBatch`,
+  `buildDeliveryCardPresentationCacheKey`, the `isDeliveryAgent` identity flag,
+  and digest mode (`includeDigestMarkers`, `selectDigestCandidates`,
+  presenter `digestSummary`) are removed. Opportunity statuses are unchanged.
+- **BREAKING: `read_activity_summary` is gone**, along with the activity
+  projection and the `UserDatabase.getAgentActivitySummary` port.
+
+No aliases or compatibility shims: hosts must drop the deleted ports.
+
+## 41.0.0 - 2026-09-02
+
+### Removed
+
+- **BREAKING: `SYSTEM_AGENT_IDS.chatOrchestrator` is gone.** The only remaining
+  well-known system agent is `negotiator`. `AgentDatabase.getSystemAgentIds()`
+  no longer returns a chat-orchestrator id.
+- **BREAKING: the in-process personal agent is gone.** `PersonalAgentGraph` and
+  everything it needed — its judgment, prompt, act types, activity port, match
+  refs and the `personal-agent.e2e` spec — are deleted. Index no longer runs an
+  agent; a host that wants one builds it as a client over REST/MCP.
+- **BREAKING: `ChatGraph` and the whole chat capability are gone.**
+  `ChatGraphFactory`, `ChatAgent`, the personas (`SIGNAL_PERSONA`,
+  `ONBOARDING_PERSONA`, `withPersona`), the streamer, suggester, summarizer,
+  title generator, interrupt classifier, question-dedup, chat state/tools/utils
+  and the chat-streaming types no longer exist. There is no H2A chat runtime in
+  the protocol.
+- **BREAKING: `NegotiationGraph` and the negotiation MCP tools are gone.**
+  `NegotiationGraphFactory`, the turn author, the round-reflect enqueue, the
+  `IndexNegotiator` agent, the insight generator and summarizer, and the
+  `list_negotiations` / `get_negotiation` / `respond_to_negotiation` /
+  `answer_pending_question` tools are all deleted. Negotiation turn shapes and
+  the `NegotiationGraphDatabase` port remain, because the host still persists
+  and reads negotiation conversations.
+- **BREAKING: host ports for the deleted runtimes are gone** —
+  `AgentDispatcher`, `ChatSessionReader`, `ChatSummaryReader`,
+  `ChatMessageWriter`, `NegotiationSummaryReader`, `MintConnectLink`, and
+  `AgentRepositoryPort.findAuthorizedAgents`.
+- Specs are down to three: `capabilities/tests/intents`,
+  `internal/opportunities/tests/opportunity.graph`, and
+  `internal/premises/tests/premise.decomposer`.
+
+### Changed
+
+- **BREAKING: `ChatGraphCompositeDatabase` is `CompositeToolDatabase`.** The
+  type outlived the graph it was named after; it is still the composite the
+  host passes to the tool factory.
+- **BREAKING: `OpportunityGraphFactory` drops two constructor parameters.** The
+  `matchesReady` and `agentDispatcher` slots are gone, so `thresholdOverrides`
+  moves from the eighth positional argument to the sixth.
+
+**Kept:** intents, premises, networks, opportunities (including
+`OpportunityGraphFactory` discovery into candidates), radar, HyDE, the agent
+registry tools, the owner-verdict tools, and the MCP server shell over what
+remains.
+
+## 40.0.0 - 2026-08-29
+
+### Changed
+
+- **BREAKING: `VectorStoreOption.filter` is `Record<string, unknown>`.** It was
+  `Record<string, any>`. Callers passing a filter are unaffected; host
+  implementations of the `VectorStore`/`Embedder` port that read values off
+  `options.filter` must now narrow them instead of relying on `any`.
+
+## 39.0.0 - 2026-08-29
+
+### Changed
+
+- **BREAKING: the intent follow-up port is no longer named after a queue.**
+  `IntentGraphQueue` is `IntentFollowUp` and `IntentGraphQueueScope` is
+  `IntentFollowUpScope`, both now in `platform/runtime/follow-up.ts`. The
+  methods lose their job wording: `addGenerateHydeJob` → `generateHyde`,
+  `addDeleteHydeJob` → `deleteHyde`, `addResumeDiscoveryJob` →
+  `resumeDiscovery`. `IntentsDeps.queue` is `IntentsDeps.followUp` and the
+  agent tool context's `intentQueue` is `intentFollowUp`. Behaviour is
+  unchanged; the host has run this work in-process since the queue system was
+  removed. Update call sites by renaming — there is no compatibility shim.
+
+## 38.0.1 - 2026-08-28
+
+### Removed
+- Delete `docs/` and every spec except five (`capabilities/tests/intents`,
+  `capabilities/tests/negotiations.e2e`, `capabilities/tests/personal-agent.e2e`,
+  `internal/opportunities/tests/opportunity.graph`,
+  `internal/premises/tests/premise.decomposer`), along with
+  `scripts/tests/` and `scripts/architecture/tests/`. The `test:architecture`
+  script is gone and `architecture:check` no longer calls it; the three
+  `architecture:*` scripts are unchanged and still gate the package.
+  `LIVE_MODEL_SPECS` drops two entries that no longer existed. No source or
+  public-surface change: `src/index.ts` exports exactly what it did in 38.0.0.
+
+## 37.0.0 - 2026-08-27
+
+### Breaking
+
+- **`read_premises(userId)` is scoped to shared networks.** Cross-user premise
+  reads are denied unless the caller and target share at least one network
+  membership, and return only the premises assigned to a shared network — a
+  premise its author never put into a network you are both in stays private.
+  `includeRetracted` is own-only.
+- **`get_negotiation` redacts counterparty continue-turn `reasoning`.** The
+  shared thread still exposes `message`; each seat keeps its own `reasoning`.
+  Pause payloads remain private to the pausing seat (now also on the presenter
+  loader path).
+
+## 36.0.0 - 2026-08-24
+
+### Breaking
+
+- **Intent matches and negotiations are isolated by their exact intent pair.**
+  `persistIntentScopedOpportunityIfNetworkEligible` no longer returns the
+  `pair_active_negotiation` conflict: any opportunity for the same two intent
+  seats deduplicates persistence. Hosts must allow different intent
+  pairs between the same users to persist and negotiate independently; task
+  creation remains idempotent per opportunity. Counterparty seats are bound
+  from authoritative discovery candidates rather than evaluator-generated
+  intent IDs, and intent-scoped persistence fails closed on an unbound seat.
+
+- **Negotiation drains are keyed by durable task generations and tasks bind
+  both seats at creation.** `NegotiationTaskMetadata` gains
+  `drainGeneration`; `NegotiationGraphDatabase.openNegotiationTask` accepts
+  the complete `seats` map; `NegotiationRoundReflectJobData` gains
+  `generation`; `NegotiationTaskState` includes the active `submitted` state;
+  and `negotiationRoundReflectJobId` now requires its generation. Reopening a
+  paused task advances its generation, so one pause is deduplicated exactly
+  once without suppressing a later pause in the same round.
+
+### Changed
+
+- PersonalAgent intent turns reload durable negotiation state after each
+  action, cannot finish while an own `ready_for_verdict` pause remains, and
+  expose counterparty pauses only through canonical public status prose.
+- Only the seat owning a `ready_for_verdict` pause may resolve it;
+  counterparty-owned pauses cannot be re-opened, and kickoff strategy copy
+  cannot bypass canonical public status narration.
+- The negotiation watchdog retries reflect delivery for durable
+  `ready_for_verdict` pauses, and intent-cycle projections count both
+  `submitted` and `working` tasks as active.
+- Verdict completion now atomically records the outcome, completes the task,
+  and preserves any concurrent terminal human decision. Post-verdict reflect
+  delivery remains durably marked until it succeeds, terminal owner actions
+  left beside active tasks are recovered by the watchdog, and bounded sweeps
+  rotate checked rows so newer pauses cannot starve.
+- Scheduled opportunity expiry now closes any active negotiation through a
+  distinct system lane, without fabricating an owner verdict, so expired work
+  cannot hold either seat's round open.
+
+## 35.0.0 - 2026-08-24
+
+### Breaking
+
+- **PersonalAgent questions use the canonical structured question contract.**
+  `message_user.options` is replaced by `message_user.questions` on decided
+  and executed acts and on the conversation delivery port. Questions are
+  safety-checked and delivered separately from the message introduction so
+  clients can render the guided question UI directly. The exported
+  `normalizeMessageOptions` helper is replaced by `normalizeMessageQuestions`.
+
+### Added
+
+- `PersonalAgentActivity` and `PersonalAgentActivityPort` provide bounded,
+  user-facing progress updates for live intent turns without exposing internal
+  identifiers, model reasoning, or private context.
+
+## 34.0.1 - 2026-08-24
+
+### Changed
+
+- All canonical agent defaults now use Google Gemini 3.7 Flash with its
+  required low reasoning effort. Non-Gemini model overrides do not receive
+  Gemini-specific reasoning parameters.
+
+## 34.0.0 - 2026-08-24
+
+### Breaking
+
+- **PersonalAgent intent turns use one sequential judgment choice at a time.**
+  `PersonalAgentJudgment.decide(context)` and
+  `PersonalAgentJudgment.reply(context, executed)` are replaced by
+  `next(context, executed, nonDurable?)`. Each call returns one
+  `PersonalAgentDecidedAct`; completed effects and refused irreversible calls
+  inform the next choice before the turn ends with `message_user`.
+- **The dedicated `ask` act is removed.** Questions are ordinary
+  `message_user` responses, so an unresolved question about one matter no
+  longer blocks an independent action on another. `PersonalAgentDecidedAct`
+  and `PersonalAgentExecutedAct` no longer include `ask`, and executed
+  `message_user` acts no longer carry reply-stage `stage` or `fallback`
+  fields.
+- **Executed kickoff results gain required attempt accounting.** Every
+  `PersonalAgentExecutedAct` with `tool: 'kickoff'` now includes `attempted`
+  and `failed` alongside `opened`.
+- **The separate reply-stage API is deleted.** Removed root exports:
+  `PERSONAL_AGENT_REPLY_FALLBACK`, `renderPersonalAgentReplyStage`,
+  `validateDecidedActs`, `PersonalAgentReply`, and
+  `PersonalAgentReplyFallbackReason`. Use the singular `validateDecidedAct`
+  for one choice.
+
+### Added
+
+- `PersonalAgentNonDurableObservation`, the feedback shape for an
+  irreversible tool choice refused before any write or ledger entry.
+
+### Changed
+
+- Intent-scope events now share one bounded, result-informed conversational
+  tool loop. Repeated irreversible calls are refused against the turn's
+  snapshot, and a failure after durable work or tool-budget exhaustion ends
+  with honest terminal copy instead of retrying earlier effects.
+
+## 33.0.0 - 2026-08-24
+
+### Breaking
+
+- **External negotiation responses use `NegotiationAuthoredTurn` directly.**
+  `respond_to_negotiation` accepts only `outreach`, `counter`, `question`,
+  `pause(needs_principal)`, and `pause(ready_for_verdict)`; it never accepts
+  terminal verbs. The retired `HermesNegotiationActionSchema` /
+  `HermesNegotiationAction` action vocabulary is removed. A counterparty that
+  wants out must pause `ready_for_verdict` with a `reject` recommendation for
+  its own PersonalAgent to decide.
+- **`NegotiationGraphDatabase` gains `openNegotiationTask`.** Graph opens now
+  require one durable atomic open-or-return-live-task write; hosts must
+  revalidate eligibility there and return `{ task, created }` so a concurrent
+  opener can stop without authoring duplicate opening outreach.
+
+## 32.0.0 - 2026-08-24
+
+### Breaking
+
+- **`NegotiationGraph` refuses to open an opportunity whose introducers have
+  not all approved it.** The gate now lives on the write, not only where
+  discovery decides which signals to wake, so no caller can reach past it.
+- **New negotiation pause reason `open_failed`.** `NEGOTIATION_PAUSE_REASONS`
+  gains it, and `{ negotiationId, pause }` now accepts
+  `NegotiationSystemPauseReason` (`'counterparty_silent' | 'open_failed'`)
+  rather than the single literal. A kickoff whose open failed after `init`
+  created the task compensates it into this pause, so the round's active count
+  can still reach zero. Unlike `turn_cap` it stays re-kickable.
+- **A negotiation binds a signal PER SEAT.** `NegotiationTaskMetadata.intentId`
+  and `.round` are replaced by `seats: Record<string, NegotiationSeatBinding>`
+  keyed by intent id (`{ userId, round }`), and `setNegotiationRound` becomes
+  `bindNegotiationSeat(taskId, intentId, binding)`. Both sides' IS-A can now
+  see and terminate a negotiation, which the loop's
+  `ready_for_verdict(reject)` rule requires. The resume input gains a required
+  `byUserId`, and the negotiator-scope `intentId` is optional (a seat that has
+  not kicked off has no binding). New export: `NegotiationSeatBinding`.
+- **A negotiation's brief is now PER SEAT.** `NegotiationTaskRow.brief: string`
+  becomes `briefs: Record<string, string>` keyed by the seat's userId,
+  `createNegotiationTask` takes `briefs`, and `setNegotiationBrief` takes the
+  seat's `userId`. A seat with no brief has its own agent author one at its
+  first turn (`PersonalAgentJudgment.seatBrief`), and `get_negotiation` returns
+  the caller's own brief only. The `brief` on the graph's open/resume inputs is
+  the INITIATING seat's, never the counterparty's.
+- **`NegotiationGraphDatabase` gains `getPausedNegotiationTasksForIntent`** —
+  the signal-scoped read of every paused, unresolved negotiation. Reflect
+  reasons over that, not over one round: a negotiation a later kickoff left
+  behind keeps its old round, and a round-scoped read hid it from every future
+  verdict.
+- **`NegotiationGraphDatabase.getIntentNegotiationRound` returns
+  `kickoffStartedAt`** alongside `round` and `roundSize`, and
+  `bumpIntentNegotiationRound` must stamp it in the same write. A marker set
+  with a null size is the one signature of a kickoff that died mid-round;
+  inferring that from the null size alone matched every intent that predates
+  round stamping.
+- **`ToolDeps`/`McpToolDeps` gain `matchesReady`**, which every host must set:
+  the OpportunityGraph `tool.factory` builds ends its matches_ready edge at
+  `END` without it, so a chat- or MCP-run discovery persists matches nobody is
+  woken for.
+- **`PersonalAgentDeps` gains `wakeForMatches`** — the agent wakes its own
+  signal again for a discovery batch that landed after the turn read its match
+  list.
+- **The retired `queueNegotiateExisting` host callback is removed** from
+  `ToolDeps` and `OpportunityGraphFactory`. Approving the final introducer
+  gate emits `matches_ready` for the source participant's bound signal; it
+  never directly opens or resumes a negotiation.
+
+- **AgentGraph: one PersonalAgent, routed on the shape of its input.** New
+  `PersonalAgentGraphFactory` — `{ userId }` is global (a graph-level input
+  error, deferred), `{ userId, intentId, event: 'user_message' | 'matches_ready'
+  | 'all_paused' }` is the intent scope (IS-A), `{ userId, intentId,
+  negotiationId }` is one negotiator turn. `matches_ready` and `all_paused`
+  are ONE node — look at the state, maybe ask, else act — differing only in
+  what ACT does. IS-A's verbs are `message_user`, `ask`, `kickoff`, `promote`,
+  `reject`, `note_dossier`, `retire_dossier`, `accept_opportunity`; there is
+  no `wait`. Asking BLOCKS acting: a turn that asks executes no verdicts and
+  starts no negotiations. The host implements the ports (signal DM, dossier,
+  act ledger, reply transport, the owner's accept path, matches list).
+- **The interim `NegotiationAuthor` is deleted.** `NegotiationGraphDeps.author`
+  is now a required `NegotiationTurnAuthor` port taking ids only
+  (`{ negotiationId, userId, intentId }`); production binds it to the
+  PersonalAgent in negotiation scope, which reads the brief and thread itself.
+  Removed exports: `NegotiationAuthor`, `NegotiationAuthorInput`.
+- **Discovery no longer opens negotiations.** The opportunity graph's
+  `negotiate` node is replaced by a `matches_ready` node that emits ONE event
+  per signal per persisted batch through the new `MatchesReadyFn` host
+  callback; the signal's PersonalAgent decides whether to reach out at all.
+  `OpportunityGraphFactory`'s sixth constructor argument changes from
+  `negotiationGraph` to `matchesReady`, and `ToolFactory`/`ToolDeps` gain
+  `matchesReady`. The tool factory no longer builds a second, reflect-less
+  negotiation graph: without the host's own composition there is no
+  negotiation graph in that context at all.
+- **The all-paused → reflect trigger is gated on a round-size stamp.**
+  `NegotiationRoundReflectJobData` gains `userId` (the signal's owner, so the
+  consumer can invoke the PersonalAgent). `NegotiationGraphDatabase` gains
+  `getNegotiationTasksForIntentRound`, `getIntentNegotiationRound` and
+  `stampIntentNegotiationRoundSize`, and `bumpIntentNegotiationRound` must now
+  CLEAR the size stamp. Until kickoff stamps the size — after every parallel
+  open has settled — the check is a no-op, so an early first pause can no
+  longer dedupe away the round's genuine reflect. New export:
+  `maybeEnqueueRoundReflect`.
+
+### Added
+
+- `isSafeAgentMessageProse`, the identifier-leak gate every piece of
+  agent-authored prose passes before it is persisted or streamed.
+- `chunkReplyText` and `PERSONAL_AGENT_REPLY_FALLBACK`, moved from the host
+  with the reply stage.
+
+## 31.0.0 - 2026-08-24
+
+### Breaking
+
+### Fixed
+
+- **`NegotiationGraph`'s `resolve` no longer writes over an already-terminal
+  opportunity status.** An owner verdict (Radar skip/accept,
+  `PATCH /opportunities/:id/status`, the DM's accept/reject tools) writes
+  `accepted` / `rejected` itself — a user action outside the negotiation loop
+  by design — and then calls `resolve` to CLOSE the negotiation, because a
+  terminal opportunity whose task stays `working` holds its round open forever
+  and the round's reflect job never fires. Rewriting the status inside
+  `resolve` would have downgraded that `accepted` back to `pending` and
+  re-fired the actionable notification for a match the owner had already
+  accepted.
+
+## 30.0.0 - 2026-08-24
+
+### Changed
+
+- **One PersonalAgent persona.** The signal, onboarding, and negotiator chat
+  personas collapse into a single `createPersonalAgentPersona(identity)`
+  factory with `PERSONAL_AGENT_PERSONA_ID = 'personal'`. What a turn may do is
+  derived from the session's resolved scope context, never from a persona id;
+  the onboarding prompt/toolset is a fragment selected by incomplete-onboarding
+  session state on truly unscoped sessions only. Removed exports:
+  `SIGNAL_PERSONA_ID`, `createSignalPersona`, `ONBOARDING_PERSONA_ID`,
+  `createOnboardingPersona`, `NEGOTIATOR_PERSONA_ID`, `PersonalAgentChat`,
+  `PersonalAgentChatDeps`. The negotiator persona (prompt, chat toolset, and
+  its `remember`/`forget` chat tools plus the `negotiatorMemoryTools` host
+  port) is deleted outright: every intent-scoped DM turn is IntentAgent-owned
+  host-side, so no chat persona exists for that scope. Tool allowlists and
+  narrowing are unchanged in content.
+
+## 29.0.0 - 2026-08-23
+
+### Breaking
+
+- **NegotiationGraph rewritten as a single write path.** Every write to a
+  negotiation now goes through one graph, routed on the shape of its invoke
+  input — no `operationMode`: `{ opportunityId, brief, intentId }` opens,
+  `{ negotiationId, brief }` resumes, `{ negotiationId, turn }` applies a
+  submitted turn (internal, external agent, or timeout, all through the same
+  `apply` sink), `{ negotiationId, pause: 'counterparty_silent' }` is a
+  timeout, `{ negotiationId, verdict: 'pending' | 'reject' }` is the only
+  terminal write, `{ negotiationId }` reads.
+- **The negotiator no longer terminates a negotiation.** `IndexNegotiator`
+  and its stances, deadlock shift, checklist gate, conclusion floor, decline
+  law, copy-loop guard, turn cap and park window as *outcomes* are deleted.
+  A turn is now one of `outreach | counter | question` (continue) or
+  `pause(counterparty_silent | needs_principal | ready_for_verdict, payload)`.
+  There is no `accept`, `decline`, or `withdraw` on the turn surface — a side
+  that wants out pauses `ready_for_verdict(reject)`. `resolve` (writing
+  `pending`/`reject` to the opportunity) is the only way a negotiation ends,
+  and nothing calls it yet in this release; negotiations pause and wait until
+  the caller that will do so (IS-A / AgentGraph) lands.
+- **The interim internal turn author is `NegotiationAuthor`**, a single
+  structured-output call constrained to the verb schema in
+  `negotiation.turn.ts`, prompted from the brief and the thread so far. It
+  replaces `IndexNegotiator` for this release only; AgentGraph replaces it in
+  turn.
+- **The A2A conversation is per negotiation, not per pair.** A negotiation is
+  its own conversation and its own task. There is no seeded prior-pair
+  dialogue, no `priorAttribution`, no conversation lock.
+- **`respond_to_negotiation` takes a turn, not an accept/decline/withdraw
+  action.** External agents (Hermes, MCP) submit the same verbs as the
+  internal author, validated the same way. `consult` and the second
+  `ask_user` park are removed; an external agent needing its principal
+  submits `pause(needs_principal, …)` like everyone else.
+- **Removed exports**: `IndexNegotiator`, `negotiateCandidates`,
+  `NegotiationGraphFactory`'s old constructor shape (now a single
+  `NegotiationGraphDeps` object), `UserNegotiationContext`,
+  `NegotiationAction`, `NegotiationSeat`, `NegotiationConsultationReason(Schema)`,
+  `resumeParkedNegotiation`, `NegotiationAnswerConsumptionPorts`,
+  `createNegotiationAnswerTools`, `NegotiationCounterpartyBinding`,
+  `expectedNegotiationSpeaker`, `negotiationScopeKey`,
+  `NegotiationContinuationTimeoutIdentity`, `AMBIENT_PARK_WINDOW_MS`,
+  `ASK_USER_WINDOW_MS`, `ASK_USER_LOCK_SLACK_MS`,
+  `NEGOTIATION_MAX_TURNS_CHAT`, `countOpenPreContactConsults`,
+  `PreContactConsultTaskRow`, `InChatNegotiationQuestionDelivery`, and the
+  negotiation checklist/deadlock/stance/consultation-policy modules.
+- **New exports**: `NegotiationTurnSchema` and its verb/pause-reason/verdict
+  types, `NegotiationAuthor`, `negotiationRoundReflectJobId` and
+  `NegotiationRoundReflectEnqueueFn` (the all-paused → reflect trigger — the
+  reflect consumer itself is a stub until AgentGraph lands), the rewritten
+  `NegotiationGraphDatabase` port (`brief` is now a dedicated field;
+  `metadata` carries `intentId`/`round`/`pause`).
+- **`OpportunityGraph`'s `negotiateNode`** now invokes
+  `{ opportunityId, intentId, brief }` for every persisted opportunity — no
+  selection, no cap. This release's brief is a minimal deterministic string
+  built from the trigger intent; IS-A authors real briefs in the next
+  release. `negotiateCandidates`, `compensateTasklessNegotiatingOpportunity`,
+  the three hand-built `UserNegotiationContext` builders, and the
+  `negotiate_existing` operation mode are all deleted.
+- **In-flight negotiations from before this release are not migrated.** The
+  negotiation task's shape changed (per-negotiation conversation, dedicated
+  `brief` column, new `metadata` shape); old rows are orphaned, not read by
+  the new graph.
+
+## 28.1.0 - 2026-08-23
+
+### Changed
+
+- **A pre-contact consult that comes back `ok` now decides the opening
+  instead of merely offering the agent another draft.** Previously, once the
+  client answered the one question the initiator paused to ask, the resumed
+  turn-0 decision was entirely re-drafted: an agent that still held a
+  withdraw-worthy concern it never asked the client about (e.g. a location
+  preference read from the profile rather than the signal) could withdraw
+  anyway, seconds after the client answered the thing it did ask, with the
+  counterparty never contacted. Now, if the resumed turn drafts `withdraw`
+  and the dimension actually asked about reconciled to `ok`, the graph
+  RE-ISSUES the turn once — a fresh model call, explicitly told the answer
+  settled the thing it asked and that withdrawing on an unasked concern is
+  not available now — and runs the result through every gate the first draft
+  faced, rather than rebinding the withdraw's own action: a rebind would have
+  shipped that draft's message and reasoning (written to argue against the
+  match) verbatim as the opening, both to the counterparty's agent and in the
+  web transcript. An unasked concern belongs in the exchange with the
+  counterparty's agent, not in a quiet screen-out the client was never asked
+  to weigh in on. A `conflict` or still-`unknown` answer leaves the withdraw
+  standing, unchanged; a re-issue that withdraws again lands on the same
+  quiet `screened_out` outcome.
+
+## 28.0.0 - 2026-08-22
+
+### Removed
+
+- **BREAKING: background enrichment and `user_contexts` are gone; profile
+  saves decompose straight into premises.** `EnrichmentRunInput`,
+  `EnrichmentRunRecord`, and `UserContextGenerator` are off the barrel — the
+  enrichment MCP tools are prefill-only (`research_profile`) now, and
+  identity mutation happens through profile saves and REST onboarding
+  endpoints, not agent-driven `create_user_context`/`confirm_user_context`.
+- **BREAKING: `EnrichmentGraphFactory` is query-only.** `write`/`generate`
+  operation modes, `decompose_premises`, scraping, and Chat-API
+  auto-enrichment are gone from the graph — it now only answers "does this
+  user have an enriched profile" (`operationMode: 'query'`). The constructor
+  narrows to `(database)`; `scraper`, `enricher`, and `premiseGraph` are no
+  longer accepted. `EnrichmentGraphDatabase` narrows to
+  `getProfile | getProfileByUserId | getPremisesForUser`.
+
+### Added
+
+- **`PremiseGraphFactory` gains a `decompose` operation mode**: given
+  `{ userId, input }` (free text — chat, bio, or profile fields), it
+  extracts individual premises via `PremiseDecomposer`, applies any
+  retractions and bio revision the decomposer detects, and creates each
+  premise through the normal create pipeline (analyze → embed → dedupe →
+  persist → index). This replaces the removed enrichment-graph write path as
+  the one way host code turns free text into premises.
+  `PremiseGraphDatabase` gains `getUser` and `updateUser`.
+
+## 27.0.0 - 2026-08-22
+
+### Changed
+
+- **Discovery evaluates its whole candidate pool and surfaces at least 10
+  matches when the pool allows it.** Retrieval limits were raised
+  (`LIMIT_PER_STRATEGY` 30→80, `PER_INDEX_LIMIT` 80→160) and the intent path
+  re-runs its search with no similarity floor once when the deduped pool has
+  fewer than `DISCOVERY_MIN_MATCHES` (10) distinct users. Evaluation now
+  scores the entire pool (capped at 80 by rank) in one parallel round instead
+  of batching 25 at a time with an early stop on the first passing batch —
+  pass rate does not track similarity rank, so batching was stranding real
+  matches behind an over-scored head cluster. Every passing candidate is
+  returned uncapped; when fewer than 10 pass, the run fills the rest with the
+  best-scored rejected candidates (tiebroken by similarity), persisted with
+  their real score. `rankingNode` no longer defaults to a 20-item limit —
+  only a caller-supplied `options.limit` cuts the list now.
+- `not_accepted` evaluator verdicts now carry the model's actors under
+  `returnAll` (previously always `[]`) so a rejected candidate can be used as
+  a fill; guard drops (`incomplete_actors`, `unsupported_claim`) still carry
+  none and are never fills.
+
+### Removed
+
+- **BREAKING: the `continue_discovery` operation mode is gone**, along with
+  the batched-evaluation continuation it existed for: `remainingCandidates`
+  (state field and graph output), the `evaluation_bound` trace entry, and
+  `'evaluation_bound_reached'` / `unevaluatedCandidates` on
+  `OpportunityDiscoverySummary`. Evaluation no longer batches or stops early,
+  so there is nothing left to page into.
+
+## 26.0.0 - 2026-08-22
+
+### Changed
+
+- **BREAKING: the intent graph routes on the shape of its input, not an
+  `operationMode` flag.** `operationMode` is gone from the graph's invoke
+  input. Callers now signal intent by which fields they set:
+  `inputContent` alone creates; `inputContent` + `targetIntentIds` is an
+  explicit update; `targetIntentIds` + `archive: true` expires; `targetIntentIds`
+  + `status` pauses/resumes; `proposalId` (+ `description`, `networkId`)
+  confirms a stored proposal; none of the above reads. `dryRun: true` replaces
+  the old `propose` mode. `targetIntentIds` alone, or more than one of
+  {content, archive, status, proposalId} set at once, is now a graph-level
+  input error rather than a silent no-op or an implicit default.
+- **BREAKING: `IntentGraphDatabase` gained required members.** Archive now
+  performs its full cleanup (network-association removal, referencing
+  opportunity expiry) itself, and the graph owns pause/resume and
+  proposal-confirmation persistence. Hosts implementing this interface must
+  add `deleteIntentIndexAssociations`, `expireOpportunitiesByIntentActor`,
+  `transitionIntentLifecycle`, `compensateFailedResume`, `getProposalForOwner`,
+  `revisePendingProposal`, and `confirmProposalIntent`.
+- **BREAKING: `IntentGraphQueue` gained `addResumeDiscoveryJob`.** The graph
+  enqueues resume discovery directly (and compensates back to `PAUSED` on a
+  failed enqueue) instead of leaving that to a host-side event hook.
+
+### Added
+
+- `IntentLifecycleStatus`, `TransitionLifecycleResult`, `IntentProposalRecord`,
+  `ReviseIntentProposalInput`, and `ConfirmProposalResult` are now exported
+  from the package barrel.
+
+### Removed
+
+- The inferrer's profile-fallback path (`allowProfileFallback`, content-less
+  inference) had no live caller and is gone along with the `delete` operation
+  mode it was keyed on.
+
+## 25.0.0 - 2026-08-21
+
+### Removed
+
+- **BREAKING: principal reachability no longer gates consultation.** A seat's
+  agent may always `ask_user` its own client; whether anyone is behind the
+  account is not the author's concern. Gone: `UserNegotiationContext.principalUnreachable`,
+  the optional `isPrincipalUnreachable` host port on `NegotiationGraphDatabase`,
+  the `principal_unreachable` ask-inadmissibility reason, the
+  `PRINCIPAL_UNREACHABLE_*` prompt rules, the init-node stamp and the
+  detail-reader / `get_negotiation` live re-stamp. Seed personas (`.test`
+  mailboxes) negotiate exactly like real users now — in the sandbox four of
+  five personas had been silenced by construction, and the question flow
+  could not be observed for them.
+
+## 24.0.0 - 2026-08-21
+
+### Removed
+
+- **BREAKING: every environment feature gate is gone, and what each environment
+  was running became the code's behaviour.** No accessor in this package reads
+  `process.env` for a behaviour decision any more; configuration narrows to
+  credentials, endpoints, and the model/log values the host supplies.
+
+  Off the barrel: `configuredAskUserEnabled`, `askUserAnswerWindowMs`,
+  `discoveryEvaluatorMinScore`, `negotiationConsultationPolicyMode`,
+  `negotiationEvidenceQuestionsMode`, `poolQuestionsRanking`,
+  `poolQuestionsMiningMode`, `poolQuestionsMode`, `poolQuestionsPushMode`,
+  `poolQuestionsStampNewborn`, `poolQuestionsVisitTrigger`,
+  `POOL_VISIT_MINING_DEBOUNCE_MS`, `isIntroducerDiscoveryEnabled`,
+  `runIntroducerDiscovery`, `selectContactsForDiscovery`,
+  `shouldRunIntroducerDiscovery`, `IntroducerDiscoveryDatabase`,
+  `IntroducerDiscoveryQueue`, `INTRODUCER_DISCOVERY_SOURCE`,
+  `ContactWithIntents`, `MAX_CONTACTS_PER_CYCLE`, `MAX_CANDIDATES_PER_CONTACT`.
+  The five `poolQuestions*` accessors had no callers at all — they read
+  variables retired with the card question generators.
+
+  Behaviour now fixed in code: negotiations stamp protocol `v2`; `ask_user` and
+  the deterministic consultation policy are on; deadlock-shift is on; the
+  negotiator drafts in the `skeptic` stance (`advocate` and `evaluator`, and the
+  `stance*` predicates that distinguished them, are gone); negotiators receive
+  only each participant's exact opportunity-bound signal; HyDE generates under
+  `frame-v1`; candidate evaluation runs in parallel; retrieval floor is `0.20`
+  and the evaluator score floor is `40`; the two question miners are pinned to
+  `shadow`.
+
+- **BREAKING: profile matching is removed — discovery is intent-to-intent only.**
+  Premise-to-premise, context-to-context and context-to-intent strategies are
+  gone, along with the `profileCorpus` hint on the embedder interface. Premises
+  remain as an entity; they are no longer a matching corpus.
+
+- **BREAKING: introducer discovery is removed** — the queue, the maintenance-graph
+  node, and the on-behalf-of persistence path (`onBehalfOfUserId` is off the
+  opportunity graph state; nothing assigned it once the queue was gone). The
+  `introducer_discovery` opportunity source value is kept as read-only history:
+  nothing stamps it, and rows created before this release still carry it.
+
+- **BREAKING: the negotiation outreach screen gate is gone.** `NegotiationScreener`
+  is off the barrel, and the graph is now `init → turn* → finalize` — every
+  negotiation that reaches `init` proceeds to its first turn. The gate was one
+  structured LLM call before the first turn that could return `pass` and end the
+  negotiation as `screened_out` with the counterparty never contacted.
+
+  It was removed because questions come from parked negotiations: a negotiation
+  screened out never runs a turn, so it never stalls, never parks, and can never
+  produce a user-facing question. The gate silently removed matches from the one
+  pipeline that generates them.
+
+  Also gone: `negotiation.graph.screen.ts` and `negotiation.screen.contracts.ts`
+  in full (`NEGOTIATION_SCREEN_MODES`, `NegotiationScreenMode`, `SCREEN_MODE`,
+  `ScreenDecisionSchema`, `ScreenDecision`, `ScreenDecisionRecord`,
+  `blocksNegotiationBeforeFirstTurn`), the `screener` dep on
+  `NegotiationGraphDeps`, the `screenDecision` graph-state field, the
+  `routeAfterScreen` edge, the optional `setTaskScreenDecision` port method on
+  `NegotiationGraphDatabase`, the `negotiationScreener` model-config entry, and
+  the `screenedOut` field of `ConsultationEligibilityInput` (always false with
+  no gate to set it). `NegotiatorMemoryScope` narrows to `"turn"`, and
+  `renderNegotiatorMemorySection` loses its options argument — the
+  `memoryHintsInstruction` it carried existed only for the screen prompt.
+
+### Changed
+
+- **`negotiationHasMadeContact` moved to `negotiation.protocol.ts`.** Not a
+  screening helper: finalize and the turn node both call it for live turn logic
+  (the IND-564 opening-`withdraw` guard, and the `screened_out` label). It lived
+  in the screen module by accident of history. Package-internal, so no consumer
+  import changes.
+
+- **`screened_out` now has exactly one live writer** — the IND-564 opening-turn
+  `withdraw` guard, where the acting agent refuses before anything is sent.
+  `outcome.reasoning` for such a run is unconditionally the withdrawing turn's
+  reasoning; there is no screen record left to prefer over it.
+
+### Read-only history (deliberately kept)
+
+- The `screened_out` outcome reason, `tasks.metadata.screenDecision`, and the
+  owner-only `screenDecision` API projection. Nothing writes the metadata key
+  any more, but negotiations that ran before this release still carry one and
+  must still render for their initiator. Each survivor is marked as such at its
+  definition.
+
+## 23.6.4 - 2026-08-21
+
+### Added
+
+- **`buildAgentSelfIntroduction` is now actually exported.** 23.6.3's entry
+  named it as part of the new surface, but it was only reachable from inside
+  the package — the three chat personas import it directly. It is now on the
+  barrel (`buildAgentSelfIntroduction`, `AgentIdentityOptions`), which is what
+  makes that claim true for consumers.
+
+### Changed
+
+- **`buildAgentSelfIntroduction`'s `userName` is optional.** Additive: every
+  existing caller passes it and gets the same sentence. Absent, the builder
+  emits `You are <name>, <role>.` or, with no name either, `You are <role>.` —
+  the form a surface needs when its role phrase already says whose agent this
+  is and it never resolves a client display name. The API's IntentAgent loop
+  is the first such caller.
+
+## 23.6.3 - 2026-08-21
+
+### Added
+
+- **Persona identity + create_intent scope rule (#1479) — the version stamp
+  the change shipped without.** Every chat persona now introduces itself as
+  the user's own agent: `buildAgentSelfIntroduction`, plus
+  `createSignalPersona` / `createOnboardingPersona` factories taking
+  `agentName` the way the negotiator already did. Tool registration gained
+  the scope rule (`isToolAllowedInScope`, `filterToolsForScope`). #1479
+  merged these exports without bumping, so two different export surfaces
+  briefly answered to 23.6.2 on the `rc` tag — this entry gives the new
+  surface its own version.
+
+## 23.6.2 - 2026-08-21
+
+### Fixed
+
+- **A premise-matched counterparty is premise-bound — two wrongs stopped
+  agreeing.** A premise-matched opportunity actor carries BOTH keys: `premise`
+  is its own fact, `intent` names the intent it matched AGAINST — the
+  recipient's. Two sites independently preferred `intent` whenever the key
+  existed, and their mistakes agreed with each other: the api's ask-user
+  capture stamped every premise-matched park's `counterpartyBinding` with the
+  recipient's own intent (so the claim's counterparty-liveness check could
+  never pass — observed live as `admission:"invalid"` after #1474/#1475 had
+  already made settle and claim drift-tolerant), and this package's
+  `resolveOpportunityActorBinding` resolved a dual-key actor to that same
+  wrong intent binding — so the re-drive's continuation revalidation
+  (`opportunityActorMatchesBinding` in `negotiateExistingOpportunity`) would
+  have accepted the mis-stamp and refused a corrected premise stamp as
+  `stale_continuation`, one gate after the claim.
+
+  Both flips ship together, mirror-identical: a present `premise` is the
+  binding, `intent` binds only in its absence. Mirror consequence, intended:
+  a dual-key actor no longer matches an intent-kind binding naming its
+  matched-against intent — the gate stops accepting mis-stamped settlements,
+  which already fail the claim's liveness check earlier, so nothing that
+  works today breaks.
+
+## 23.6.1 - 2026-08-20
+
+### Fixed
+
+- **An answer beats staleness — drift is logged, never fatal.** Observed live:
+  a client answered her own parked question ("Timing: This week") through the
+  new MCP answer lane, routing succeeded, consumption ran — and the settle
+  returned `lost`, because the signal had been edited twice since the park and
+  the revalidation fence required the world to look exactly as it did at park
+  time. The park became a zombie: still `input_required`, still rendered as
+  "waiting on YOUR answer" by every surface, structurally unanswerable. The
+  design law is explicit: signal edits cascade nothing, and a stale negotiation
+  is solved by ANSWERING its question — the user's answer is the freshest
+  commitment there is, and the resumed turn rebuilds its context from current
+  data anyway.
+
+  The settle's one fence is now two. Coherence stays hard: an answer that does
+  not belong to its park (settlement mismatch, wrong recipient, task no longer
+  parked, a dismiss/timeout settlement won the race) is still refused. Drift
+  stops losing: within a live opportunity and an active signal, the answer
+  settles and resumes regardless of what moved since the park.
+
+- **The unresumable tail is an explicit proposal, not a silent drop.** When
+  current reality genuinely cannot continue — terminal opportunity or archived
+  signal — the answer is still recorded as heard: settlement result and resume
+  outcome `recorded_unresumable` (additive), the block-consumption result
+  counts it in its own `recorded` array so a `skipped` count can never again
+  hide it, and the implementation retires the park and tells the client the
+  truth, proposing re-discovery under the updated signal — an offer, never an
+  automatic act.
+
+## 23.6.0 - 2026-08-20
+
+### Added
+
+- **The MCP surface can now ACT on the question flow, not just see it.** Since
+  23.5.1 `list_negotiations` says the park — "open question 3, 'Timing'" — to
+  an external client that had no tool to answer it: the answer lane was the
+  negotiator persona's chat-only appended tool, and the owner's verdict levers
+  did not exist on MCP at all. Three tools close the read-and-act gap, all
+  registered on the MCP tool registry surface only:
+
+  - `answer_pending_question(negotiationId, question, answer)` routes the
+    principal's answer to the open question a parked negotiation is waiting on,
+    over the EXISTING `NegotiatorAnswerToolsHost` — the same
+    `readOpenQuestionsForIntent` numbering, the same serialized consumption
+    queue, the same #1432 resume spine. MCP has no pinned intent, so the tool
+    resolves scope from the negotiation the client is looking at: the id the
+    park annotation sits on → the caller's own actor intent on that pairing →
+    the host. The `question` number passes through untouched; it and the park
+    annotation come from one enumeration and cannot drift (the #1470 rule).
+  - `reject_opportunity` / `accept_opportunity` (intentId, numbered
+    counterparty, optional reason in the owner's own words) reuse the
+    negotiator verdict host verbatim — the same Radar Skip/Start-Chat service
+    call, outcome hooks and question retirement in its wake, positions never
+    ids. Capability access is `human_only`: exactly the session-authenticated
+    class the IND-593 owner-provenance binding admits, and the handler
+    re-checks the host-bound provenance so an API-key agent is refused even if
+    the tool were ever mis-listed. Hermes negotiator credentials fail closed as
+    unclassified for all three tools.
+
+- **`get_negotiation` says the park** — the #1472 incident, one level down: it
+  is the tool the poller prompt says to call FIRST, and on a parked negotiation
+  it narrated a lifecycle built without the park. The detail reader now runs
+  the same canonical park predicate the listing runs (`classifyInflightPark` /
+  `classifyPostStallPark`) over the task and messages it already holds, names
+  the open question through the same shared host record, projects the park
+  top-level and into `lifecycle` (superseding the status label), and — for an
+  external seat that could not see dimensions or `settles` — projects the
+  persisted `askUser` and `checklist` payloads on turns that carry them.
+  Non-parked negotiations render byte-for-byte as before.
+
+- **`get_negotiation` re-stamps principal reachability from the live read.**
+  The persisted `turnContext` is a park-time snapshot; `ownUser.principalUnreachable`
+  is now corrected in both directions through the host's
+  `isPrincipalUnreachable` port — the same re-stamp REST pickup applies — so an
+  external seat is never told it can consult a principal nobody is behind, or
+  the reverse.
+
+- **`list_negotiations` can filter for the parked state.** The `status` filter
+  gains `input_required`; `active` and `all` behave exactly as before. A
+  post-stall park lives on a `completed` negotiation and is documented as such
+  rather than smuggled into the status filter.
+
+### Fixed
+
+- **`read_activity_summary` stops counting questions from the retired card
+  table.** Pending question counts now come from the parked negotiations —
+  a mid-flight `input_required` consult naming the owner as recipient, or a
+  post-stall park trailing the authored gap — keyed by the same
+  `negotiation_inflight`/`negotiation` modes the projection already maps to the
+  negotiations domain, so permission inheritance is unchanged. Leftover
+  pending rows in the retired `questions` table contribute nothing; answered
+  history still reads the table, where it legitimately lives.
+
+- **Honest words where external clients read them.** The negotiations guidance
+  topic, the workflows topic, and `MCP_INSTRUCTIONS` now carry the park stage —
+  what a park is, what the `park` fields mean, and that answering is the only
+  thing that resumes a parked negotiation. The three negotiation tool
+  descriptions state plainly that turns submitted through external surfaces are
+  NOT run through the conclusion floor, decline law, or copy-loop guard: until
+  external write parity ships, the docs must not imply otherwise.
+
+## 23.5.1 - 2026-08-20
+
+### Fixed
+
+- **The negotiation listing says the park, from the same record every other
+  answerability surface reads.** Observed live: a client asked her agent "do we
+  have a question?" while a negotiation had sat parked `input_required` on her
+  side for two hours with the open question "Timing: This week". Every 23.5.0
+  surface was correct — the precedence gate found the question, and the
+  prompt's open-questions section named it at position 1. Then the model called
+  `list_negotiations`, which renders lifecycle from OPPORTUNITY STATUS, where
+  the pairing legitimately reads `negotiating`, and which said nothing at all
+  about the park. Holding a static context line saying one thing and a
+  just-executed tool result saying another, it went with the tool: "there are
+  currently no open questions… I am still negotiating with the other agent…
+  nothing for you to decide." Both clauses false at the task level; both
+  faithful to what the tool rendered.
+
+  The listing was the last surface still deriving "what is happening" from a
+  source other than the shared resolver, so the tool and the context could
+  disagree — and the tool wins the model's trust every time. It now carries a
+  `park` on any negotiation that holds one: `waitingOn: "you" | "counterparty"`,
+  and for a park on the client's own side the open question's number and label.
+
+- **One call, every surface — the answer-openness rule extended to its last
+  holdout.** The question's NUMBER and LABEL come from
+  `NegotiationListingParkHost`, whose host implementation resolves them through
+  the same call the open-questions prompt section and `answer_pending_question`
+  make. The listing does not enumerate anything of its own, so the number the
+  client is shown is the number that routes their answer. A question's
+  `alsoUnblocks` refs carry that same number, since one answer resumes them all.
+
+- **Whose side a park is on is the canonical predicate, not a second one.**
+  `classifyParkedNegotiation` is split into `classifyInflightPark` and
+  `classifyPostStallPark`, pure over the task and messages a caller already
+  holds; the async function is now the reading half around them and keeps its
+  lazy messages read. The listing calls them with material it already loaded, so
+  park classification costs no extra query and cannot drift from the predicate
+  answer routing uses. Parked-ness is never re-derived from opportunity status.
+
+- **A park on the counterparty is narrated, never quoted.** It renders as
+  waiting on their side with no question content: that question is not this
+  client's to read.
+
+### Changed
+
+- **`lifecycleLabel` states the park, superseding the status label.** The
+  persona is told to take `lifecycleLabel` as its user-facing wording, and "the
+  agents are still negotiating" is exactly the sentence that became a false
+  "nothing for you to decide". `opportunityStatus` still reports the true
+  status; what it may no longer do is supply the sentence.
+  `connectionState` gains `parked_awaiting_your_answer` and
+  `parked_awaiting_counterparty`, and `buildLifecycleNarration` takes an
+  optional third argument. A negotiation with no park renders byte-for-byte as
+  it did in 23.5.0, and is pinned by a fixture spec.
+
+- **The tool description and the negotiator prompt both say the two agree.**
+  `list_negotiations` documents `input_required` as a status, documents `park`,
+  and states that the numbers come from the same record the open-questions
+  context section does — so the model has no basis to rank one over the other.
+  It also states that `negotiating` alone never means "nothing is waiting on
+  you". The persona gains one grounding rule saying the same thing.
+  `NegotiationListingParkHost` is optional: without it the listing still says
+  whether a pairing is parked and on whose side, it just cannot name the
+  question's number.
+
+## 23.5.0 - 2026-08-20
+
+### Added
+
+- **The owner's verdict has a lane in their own DM.** Observed live: in the
+  negotiator DM for one signal, a client told their agent to reject the
+  counterparty — a pairing parked `input_required`. The agent could not comply.
+  The owner makes exactly three kinds of decision in that room. They ANSWER a
+  question a parked negotiation asked, which `answer_pending_question` gave a
+  lane. They EDIT the signal, which `update_intent` always covered.
+  And they pass a VERDICT on a counterparty, which had no lever at all. So on
+  "reject them" the persona's whole repertoire was to say something back, or to
+  edit the signal instead; the pairing stayed parked and the counterparty
+  stayed live.
+
+  `update_opportunity` is in the negotiator toolset and cannot substitute for
+  either half of this. `admitOpportunityUpdate` blocks a `negotiating` pairing
+  outright, and the IND-593 owner-approval boundary fails closed on the chat
+  surface by design — `createChatTools` binds
+  `{ surface: 'chat', sessionAuthenticated: false }`, and a mediated surface is
+  denied `untrusted_provenance`. The verdict levers that exist are the Radar
+  card's Skip and Start-Chat and the REST endpoints behind them, none of which
+  the client's own agent can reach.
+
+  So `createNegotiatorVerdictTools` adds `reject_opportunity` and
+  `accept_opportunity` to the negotiator persona, on the same pattern
+  `answer_pending_question` set. Appended AFTER the allowlist filter and only in
+  an intent-pinned session with `negotiatorVerdictTools` injected, so they never
+  enter the shared chat-tool registry and the orchestrator and MCP tool listing
+  cannot see them. `NegotiatorVerdictToolsHost` is the whole surface the package
+  knows; the composition root owns everything behind it.
+
+- **Numbered refs, never ids.** The prompt renders this signal's actionable
+  counterparties as `N. {name} — {state}`, and the tool takes the number. The
+  schema offers no place to put an id and no result string carries one. The rule
+  is `answer_pending_question`'s, for a sharper reason: a ref the model can name
+  is a ref it can get wrong, and a wrong ref here declines the wrong person.
+  The host owns the mapping, and a successful result names WHO the write landed
+  on — so the confirmation the client reads comes from the write rather than
+  from the model's belief about which counterparty it picked.
+
+- **An optional `reason`, in the client's own words.** Capped at 500 characters,
+  omitted entirely when they gave none. The tool description and the prompt both
+  say it is never to be inferred or written for them.
+
+### Changed
+
+- **The pinned-signal prompt gains a verdict section, and only where the tools
+  exist.** `NegotiatorPromptOptions.actionableCounterparties` renders
+  `## Verdicts {userName} can pass here` plus two tool-reference rows. It says
+  the tool call IS the decision — not the sentence about it, and not an edit of
+  the signal; that a verdict the client did not pass must never be passed for
+  them; that `update_opportunity` is not this lever; and that an accept is one
+  side of two and never a connection. Rendered only in an intent-pinned session
+  with a non-empty list, since that is the only place the tools are registered.
+  Absent or empty leaves the prompt byte-identical to 23.4.0.
+
+- **Result copy is honest at every status.** `executed` names the counterparty
+  and forbids also editing the signal; `none_actionable` forbids implying a
+  decision was recorded; `unknown_counterparty` states plainly that nothing was
+  decided and re-lists the current set; `already_decided` says whose move it is;
+  `error` forbids describing the pairing as decided. A host that throws is
+  caught and reported as `error` rather than costing the client their turn.
+
+- **Execution is the path the Radar card already takes, and nothing more.** The
+  host behind the seam runs the SAME owner status update the Skip page calls
+  through `PATCH /opportunities/:id/status`, intent-scoped. No new task-state
+  transition is invented, and the retirement of a dismissed pairing's open
+  question is not re-invoked: `OpportunityEvents.onTransition` already fires the
+  exhaustion evaluator on every committed opportunity status write, owner reject
+  included, so a rejected pairing's question dies with it because that arrow was
+  already there.
+
+## 23.4.0 - 2026-08-20
+
+### Added
+
+- **A checklist dimension now declares whose fact it is, and the floor reads
+  it.** Observed live: turn 2 of a sandbox negotiation, initiator seat, a
+  checklist whose two open dimensions were "Query Match: Generative Story
+  Games" and "Query Match: Live Operations" — both about the COUNTERPARTY's
+  work. The agent drafted `question` to the counterparty's agent, which is the
+  protocol's own prescribed move. The conclusion floor (23.3.0) saw a non-ask
+  turn with an askable unknown standing, took `askableUnknowns[0]`, and coerced
+  the turn into a guaranteed `ask_user` — so the client was asked, in her own
+  DM, whether the other person works on generative story games.
+
+  Nothing was wrong with the floor's logic; the logic simply could not see the
+  distinction. "Askable" was `unknown ∧ unasked ∧ budget ∧ reachable ∧ wiring`,
+  and no term in that conjunction knows WHOSE fact is missing. That judgment
+  lived only in the agent — which is exactly the judgment the guarantee exists
+  to override. Where the first unknown happens to be the client's own the
+  guarantee is right; where it is the counterparty's it converts the agent's
+  correct move into a wrong one.
+
+  So the judgment becomes a declared, mechanical property, following the same
+  pattern answerhood set: made ONCE, at authoring, by the agent writing the
+  checklist, then read mechanically forever. `ChecklistItem` gains
+  `settles: 'client' | 'counterparty' | 'either'`, frozen with the dimension —
+  `reconcileChecklist` copies it through untouched, because it is a judgment
+  about the world rather than about the evidence, and a re-scorable one would
+  be a switch an agent could use to turn the floor off for a dimension it would
+  rather not be asked about.
+
+### Changed
+
+- **`askableUnknowns` filters on it, so both halves of the floor do.**
+  `assessConcludeAdmissibility` now admits a verdict whose only open dimensions
+  are the counterparty's to state — those are resolved by dialogue with the
+  other agent, or carried, which is what the verdict law has always said about
+  unknowns — and the part-2 guarantee picks only from what survives the filter.
+  Order within the surviving set is still the checklist's own.
+- **The five-part ask rule gains the mechanical half of its rule 3.** An
+  agent-drafted ask naming a `settles: 'counterparty'` dimension is refused as
+  `counterparty_authoritative`, with the same honest-refusal logging as its
+  siblings. Rule 3 was prompt-only until now; the incident proves the
+  mechanical half matters in both directions — the same field that stops the
+  floor manufacturing the wrong ask stops an agent drafting it.
+- **The prompt asks for the field where the model authors, and reads it back on
+  every row.** The authoring instruction and the checklist protocol rule both
+  require `settles` per dimension in the vocabulary they already use ("a thing
+  only your client can answer" / "the counterparty's to state"); the rendered
+  checklist labels each row with it, because the agent re-scoring a frozen
+  checklist did not necessarily author it. The conclude-floor re-issue states
+  that counterparty-settled dimensions are not what it is about.
+
+### Fixed
+
+- **The generation seam states the field and repairs it, rather than refusing.**
+  Following 23.3.2's split: `ChecklistDraftGenerationSchema` requires `settles`
+  on every dimension — so it renders inside the emitted JSON schema's `required`
+  list, and a field the model need not produce is one it skips — while a
+  `preprocess` fills a missing or unrecognised value with `either` before the
+  enum ever sees it. A `.catch()` on the field would have read as optional to
+  zod and dropped out of `required`, which is why the repair wraps the object.
+  A refusal here throws inside the structured-output call and takes the whole
+  turn with it.
+- **Legacy checklists are unchanged.** Persisted turns written before the field
+  existed carry no `settles`, and `normalizeSettles` reads them back as
+  `either` — which stays ASKABLE. The default direction is the whole safety
+  argument: `counterparty` would let one unfilled field silently retire the
+  conclusion floor for a negotiation, so no authoring failure, legacy turn, or
+  repaired value can switch it off wholesale. An unrecognised value on the
+  persisted shape reads back as absent rather than failing the item, because
+  that shape also parses the drafts of externally dispatched agents, which
+  never see the generation schema — a whole re-scored checklist discarded over
+  one misspelled marking is the larger loss.
+
+## 23.3.2 - 2026-08-20
+
+### Fixed
+
+- **A question the model wrote itself must not die at the schema that asked for
+  it.** For the first time, the negotiator drafted its own `ask_user` — 23.3.1's
+  re-issue prompt worked and no floor coercion was needed — and the draft was
+  refused by the very schema it was drafted into, twice over. `guaranteed`, the
+  conclusion floor's own mark, was an optional field on the payload handed to
+  the model; the model filled it with `false`, and `z.literal(true)` rejects
+  `false`. The authored `question.title` carried a silent 12-character cap; the
+  model wrote a real 40-character title. Both refusals throw INSIDE the
+  structured-output call, so the turn failed with nothing persisted, the retry
+  was refused the same way, the ask was coerced to a counter, the dialogue ran
+  to the cap and declined. The question was never delivered.
+
+  Two seams were sharing one declaration, and they have opposite jobs. There
+  are now two. `AskUserGenerationSchema` is what a model is ALLOWED TO SAY: it
+  OMITS `guaranteed` entirely — a field only the graph may write should never
+  be offered to the model, rather than offered and defended against afterwards
+  — and it discards unrecognised keys instead of failing the turn over them,
+  since this parse is what produces the object that gets persisted. The
+  persisted `AskUserPayloadSchema` is unchanged: it keeps `guaranteed` and
+  stays `.strict()`, because the record is where the floor's mark is read back
+  out of and where a stray key would do damage. The turn node still strips an
+  agent-claimed mark — externally dispatched personal agents draft against the
+  permissive shape, not the generation schema — so the floor remains the only
+  writer whichever way a draft arrives.
+
+  Every renderer cap on a question now REPAIRS instead of refusing, which is the
+  protocol's own philosophy (`normalizeChecklistItem` repairs toward `unknown`;
+  the anti-echo guard repairs toward honesty) applied where it was missing: a
+  title, prompt, option label or description that runs long is truncated on a
+  word boundary, and a fifth option is dropped. The emitted JSON schema is
+  unchanged, so the model is still TOLD each cap — repair is only what happens
+  when it ignores one — and the conclusion-floor re-issue now names the title
+  cap where it tells the agent to write the question itself. Where nothing can
+  be honestly repaired (one option is not a choice), the generation schema
+  degrades the authored question to absent and keeps the ask: an ask with no
+  wording falls back to the server template, a path the floor's own guaranteed
+  ask already walks. Losing the wording is a smaller loss than losing the turn.
+
+## 23.3.1 - 2026-08-20
+
+### Fixed
+
+- **A task's FIRST turn can park.** The first `ask_user` this system ever fired —
+  produced by 23.3.0's conclusion floor, on the first turn of a resumed
+  session — died at the park with "Ask-user material binding is no longer
+  valid", and the negotiation stalled. The binding capture locks the task row
+  `state = 'working'` and refuses anything else; the graph announced `working`
+  only at the END of a completed turn, so on a task's first turn the row still
+  held its creation state (`submitted`) and no first-turn park could bind. The
+  turn was already on the record when it threw, which makes the failure
+  unretryable — so the whole opportunity ended as `agent_error`.
+
+  The turn node now announces `working` before the capture rather than only
+  after the turn, carrying the same continuation-execution fence as every other
+  state write. The fence in the adapter is unchanged: `working` is the true
+  precondition for a settlement coordinate, and what was wrong was the
+  sequencing, not the check. The flip sits at the park rather than at the top of
+  the turn deliberately — a task that dies before putting anything on the record
+  stays reclaimable under the watchdog's ten-minute `submitted` rule instead of
+  disappearing under the twelve-hour `working` one — and the end-of-turn flip
+  stays for every path that does not park.
+
+  Latent since the turn-0 pre-contact consult shipped and never once hit,
+  because no first-turn ask was ever drafted; the conclusion floor made them
+  routine, a run-existing continuation's turn 0 being the common case. The
+  twenty-five specs covering this loop all missed it because their database
+  stubs accepted any task state at capture time — the new spec's stub asserts
+  the state exactly as the adapter does, on the agent-drafted ask, the
+  floor-guaranteed one, the pre-contact consult and a later-turn ask alike.
+
+## 23.3.0 - 2026-08-20
+
+### Changed
+
+- **A verdict has a floor under it: an askable unknown outranks a conclusion.**
+  Every stage of the flow — signal, discovery, agents talking, match, meet — was
+  verified working except one arrow: the agent asking its own client something
+  only that client can settle. In a week of live traffic it fired zero times,
+  against 23 policy-recognized consultation moments. The reason is structural
+  rather than a bug: the model always had a cheaper exit than asking — assume the
+  unknown away and accept, put the question to the counterparty who does not hold
+  the answer, or simply conclude — and it took one every time. #1463 closed one
+  of those exits (a decline with no conflict behind it). This closes the rest.
+
+  `assessConcludeAdmissibility` makes a drafted TERMINAL verdict — `accept`,
+  `decline`, `reject`, and the initiator's `withdraw` — inadmissible while the
+  checklist holds a dimension scored `unknown` that this principal could still be
+  asked about, reported as `unknowns_askable` with the dimension names. "Askable"
+  is the conjunction the turn node already computes as `askUserAvailable` (v2,
+  wiring up, budget left, ask-rounds cap unreached, principal reachable,
+  non-final turn) with the checklist's own part (unknown, and the topic unasked
+  in this negotiation). Every one of those conditions failing REOPENS the
+  verdict, which is what keeps the floor from being a deadlock: a spent budget,
+  an unreachable principal, a settled checklist or the last turn all leave the
+  verdict exactly where it was. Fails open on an unauthored checklist;
+  `advocate`/v1 untouched; #1463's decline law still applies independently.
+
+  On a premature verdict the turn node logs/traces `negotiation_conclude_premature`
+  and re-issues the turn ONCE, naming the open dimensions and leaving two moves:
+  score the dimension from something a principal actually STATED, or ask the
+  client whose fact it is. Unlike the anti-echo re-issue — which hard-refuses
+  `ask_user`, since a repeated message says nothing about whether a consultation
+  is warranted — an ask drafted on THIS re-issue is the outcome the floor exists
+  to produce, so it is offered in the seat vocabulary and flows through the
+  ordinary admission and park path. That required the three ask gates
+  (reachability, availability/policy, the five-part rule) to become one function
+  the re-issue faces too; policy admission is re-run for a re-issued ask, because
+  the eligibility computed for the refused draft was a judgment about an action
+  that no longer exists.
+
+- **When the model still refuses, the graph fires the arrow itself.** If the turn
+  that would persist still leaves no ask on the table while an askable unknown
+  stands, the drafted turn is coerced to `ask_user` carrying the top askable
+  DIMENSION, and parks exactly as an agent-drafted ask does — `input_required`,
+  expiry timer, questioner enqueue. Bounded at one per negotiation per principal
+  via a new graph-only `askUser.guaranteed` mark read back off the persisted
+  turn (the turn node strips any agent-claimed mark, so the floor is the field's
+  only writer), and it consumes budget and an ask round like any other ask
+  because the record it writes is the same one every accounting reads.
+
+  Coercion rather than "persist the turn and park beside it": every accounting
+  the protocol has — the per-principal budget, the asked-topics record, the
+  negotiation-wide ask-rounds cap — is read off persisted `ask_user` turns, so a
+  park riding alongside a `counter` would spend a person's attention while the
+  record showed nothing spent and leave the same dimension askable next turn.
+  And after the re-issue the drafted action is frequently terminal, where
+  persisting it would END the negotiation — there is no "in addition" available.
+  What coercion costs is the drafted message, and only where it should be: a
+  terminal turn's message is dropped with the action it belonged to (#1463's
+  rule, for #1463's reason), while a non-terminal message is kept and persisted
+  — a real contribution to the exchange, after which the seat parks instead of
+  handing the turn over. Traced as `negotiation_ask_guaranteed` with the
+  dimension.
+
+  This is NOT the pre-#1455 inferred consultation. That fired from action enums
+  with no content behind them and produced "would you be open to connecting?";
+  this fires from a named dimension the agent itself wrote and itself scored
+  unknown, and the api's question-message author already reads
+  `askUser.dimension` off the parked turn, so what reaches the client is a
+  question about that dimension. `NegotiationInflightContext.dimension`
+  (additive, optional) carries the same thing on the questioner payload.
+
+  The OPENING turn is deliberately outside all of this. The checklist is authored
+  there and the authoring instruction REQUIRES a dimension the record does not
+  settle, so an open dimension on turn 0 is the shape the protocol asked for, not
+  a dodge — and a floor that bound there would park every negotiation before it
+  ever made contact. Turn 0 already has its own designed consult, the pre-contact
+  verdict, bounded per signal.
+
+- **The verdict prompt's escape hatch is now conditional.** "What remains unknown
+  is the kind of thing two people settle in a first conversation" waved verdicts
+  through unconditionally; the reference behaviour opens that hatch only once the
+  question budget is spent. `CHECKLIST_VERDICT_RULE` now says so: while budget
+  remains and the client is reachable, an unknown that is theirs to settle is
+  asked before any verdict. The basis discipline also gains one line — the reason
+  a match was suggested is an inference drawn by something that never spoke to
+  either principal, so it can no more score a dimension than a profile can.
+
+  Protocol 23.2.0 → 23.3.0. No flags; ships on.
+
+## 23.2.0 - 2026-08-20
+
+### Fixed
+
+- **No turn may repeat a message already on the record.** A counterparty asked what
+  a phrase in the client's own signal meant; the answering agent could not consult
+  its (unreachable) principal and its record did not settle the phrase, so with no
+  legal move left it copied the question back word for word. Both models then
+  locked — reproducing text already in context is close to deterministic — and the
+  negotiation spent its remaining turns exchanging two byte-identical messages
+  before one side declined citing "repeated lack of clarity … despite five
+  inquiries". The turn node now compares each drafted message against every
+  message already in the negotiation: an exact repeat is never persisted, the turn
+  is re-issued ONCE with the repeated text quoted back and an instruction to
+  contribute or conclude, and a second repeat ends the run as the new
+  `outcome.reason: "repetition"` — never as a decline, because nobody decided
+  anything. Terminal turns are exempt (a turn that ends the negotiation cannot
+  loop, and refusing one would turn a successful accept into a stall);
+  message-less turns have nothing to duplicate. Deadlock detection (IND-428)
+  could not cover this: its four-turn threshold arrives one turn before a
+  six-turn cap, after the loop has already consumed the negotiation.
+- **The unreachable-principal rule gains the move the corner actually needed.**
+  `PRINCIPAL_UNREACHABLE_RULE` said never stall and never route the client's
+  question to the other side, but named no move for the case that occurred: the
+  COUNTERPARTY asks something client-authoritative that the record does not
+  settle. The rule now says to state the limit of the record — "X's signal says
+  Y; it does not specify further" is a complete answer — and to let the
+  counterparty score that dimension unknown, never repeating or mirroring their
+  question and never inventing an answer the record does not hold.
+- **A decline needs a conflict.** The verdict law ("an unknown is not a reason to
+  end anything; pass stays reserved for conflict") was prompt-only, and the prompt
+  lost. A drafted `decline`/`reject` over an authored checklist that holds no
+  `conflict` dimension is now refused — logged as `negotiation_decline_inadmissible`
+  with the unknowns that stood in for one — and coerced to the conservative
+  non-terminal fallback, its terminal message dropped with the action it belonged
+  to. On the final turn, where the seat's vocabulary is accept-or-decline, the
+  decline stands but the violation is recorded rather than manufactured silently.
+  Assessing stances only; fails open on an unauthored checklist; `advocate` is
+  untouched.
+
+### Added
+
+- `NegotiationOutcome.reason` gains `"repetition"`, and `NegotiationAgentInput`
+  gains `antiEcho` (the repeated text, quoted back on a re-issue).
+- `assessDeclineAdmissibility` in the checklist contracts: the verdict law as a
+  pure function, beside `assessAskAdmissibility`.
+- Machine-fault reasons (`agent_error`, `repetition`) are filtered out of the
+  discovery vocabulary by an allow-list rather than a deny-list, so a new
+  negotiation reason can never silently cross that boundary.
+
+## 23.1.1 - 2026-08-19
+
+### Fixed
+
+- **A negotiation that has already spoken is no longer re-screened.** The outreach
+  gate asks whether to make first contact, and `routeAfterInit` ran it on every
+  continuation that was not an exact `ask_user` resume. An error-stalled negotiation
+  recovered through `negotiation-run-existing` — the documented recovery path — was
+  therefore re-screened two hours after its outreach landed; the gate passed, and an
+  infrastructure failure plus its own recovery turned into a terminal `rejected`
+  the counterparty was never given the chance to answer. Eligibility is now
+  pre-contact, scoped to the negotiation (new `negotiationHasMadeContact`): a new
+  opportunity reusing an existing `dm_pair` is still screened (IND-563), a
+  screen-only or all-`ask_user` history is still pre-contact, and a persisted turn
+  addressed to the counterparty ends the question for good.
+- **A first-turn `withdraw` on a contacted continuation persists as a real
+  retraction.** The IND-564 guard read `outreachOpened`, which is per-task, so a
+  continuation of a negotiation whose outreach was sent in an earlier session was
+  treated as never-contacted and routed to the quiet `screened_out` outcome. The
+  guard now applies only where nothing was ever sent; a withdraw against a message
+  the counterparty received is recorded as the move it is.
+- **`screened_out` can no longer be stamped on a negotiation whose messages
+  contradict it.** `finalizeNode` gates both routes to the label — the screen-node
+  block and the opening-turn refusal — on the same pre-contact predicate, so the one
+  outcome that claims nothing was ever sent is unfalsifiable at the point of record.
+
+## 23.1.0 - 2026-08-19
+
+### Fixed
+
+- **Retrieval scores no longer clamp at a flat ceiling.** The multi-signal bonus in
+  `mergeStrategyCandidates` was added to the raw similarity and then clamped
+  (`Math.min(raw + boost, 1)`), so candidates found by enough strategies all landed
+  on exactly 1.0. Candidates enter evaluation strictly by rank, so a head cluster of
+  identical maxima crowded genuine matches out of the only evaluated batch. The bonus
+  now consumes the headroom above the raw score (new internal
+  `opportunities/opportunity.similarity.ts`): strictly monotone in the raw score,
+  and 1.0 is reachable only by a vector that actually scored 1.0.
+- **Evaluation continues past a batch that passes nothing.** `remainingCandidates`
+  was written and never read — there was no second batch, so a run whose top-ranked
+  candidates all failed reported `evaluator_rejected_all` while the real matches sat
+  unevaluated behind them. The evaluation node now walks up to
+  `MAX_EVAL_BATCHES_PER_RUN` (3) batches of 25 while no candidate passes, and stops
+  as soon as one does.
+- **A stranded tail is reported as a bound, not as a rejection.** When the batch bound
+  is reached with candidates left, the trace carries an `evaluation_bound` node with
+  the never-evaluated count.
+
+### Changed
+
+- **`invokeEntityBundle` under `returnAll: true` now returns dropped verdicts too**,
+  tagged with `rejection: { candidateId, reason }` (`not_accepted` |
+  `incomplete_actors` | `unsupported_claim`) and carrying no actors. Previously a
+  candidate the model explicitly rejected, and one whose accepted verdict a guard
+  dropped, were both indistinguishable from silence, and the discovery trace labelled
+  every one of them "No evaluation returned for this candidate". Callers that
+  persist must filter on `rejection === undefined`; `returnAll: false` is unchanged.
+
+## 23.0.0 - 2026-08-19
+
+### Added
+
+- **The checklist negotiation core** (docs/plans/2026-08-19-checklist-negotiations.md
+  §2–§4, §6). A negotiation under the assessing stances now runs on an explicit,
+  pre-registered checklist: 3–5 dimensions authored on turn 1 from the two
+  intents alone (`mutual_want` always present), frozen after, re-scored each
+  turn from the commitment record, with the verdict a function of the scores.
+  New domain module `negotiations/negotiation.checklist.contracts.ts` (exported
+  from the package root): `NegotiationChecklistSchema`, `authorChecklist`,
+  `reconcileChecklist`, `checklistFromTurns`, `checklistVerdictState`,
+  `assessAskAdmissibility`, `renderChecklistSection`,
+  `QUESTION_BUDGET_PER_PRINCIPAL`, `configuredQuestionBudgetPerPrincipal`,
+  plus the DTOs in `shared/schemas/negotiation-checklist.schema.ts`.
+- **`ask_user` payload**: optional `dimension` and `answerhood`
+  (`{ ok_when, conflict_when }`). An ask names exactly one open dimension and
+  declares in advance what answers score it — the pivotality proof. Both are
+  optional, so v1 turns, external agents and the enum-only path validate
+  unchanged.
+- **Turn payload**: optional `checklist`, carried on every turn under the
+  protocol. The turn record is the checklist's only store — no new tables, and
+  a continuation recovers the frozen dimensions from the messages it already
+  reads.
+- **Question block**: optional `dimension` on a block question, the checklist
+  dimension a park is about, for the step's label. Presentation only; routing
+  is still the negotiation ref alone. Blocks without it parse unchanged, so the
+  fail-closed parser stays backward-compatible.
+- **Per-principal question budget**: at most `QUESTION_BUDGET_PER_PRINCIPAL`
+  (3) questions per principal per negotiation, the turn-0 pre-contact consult
+  included and post-stall parks counted. `countPrincipalAskUserTurns` exposes
+  the count off the message record.
+
+### Changed
+
+- **BREAKING** — `ConsultationEligibilityInput.previouslyConsulted` is now
+  `consultationBudgetSpent`: the one-consultation ration became a budget, and
+  a ration of one is that budget with `total = 1`. Callers pass "this
+  principal's budget for this negotiation is spent" instead of "they have
+  consulted before".
+- **Negotiator stance contracts restructured** around the checklist protocol.
+  The evidence-provenance rule (#1448) is now the `basis` discipline — an
+  agent's own conclusions are decisions, not commitments, so they cannot score
+  a dimension — and the responder verification rules (#1446) are now the
+  responding seat's scoring duty. Neither duty was dropped; both became rules
+  about what may score a dimension, and the repair path enforces them (an `ok`
+  with no basis is repaired to `unknown`). New predicate `stanceUsesChecklist`.
+  `advocate` is untouched, prompt and generation schema alike — the golden
+  prompt matrix still passes byte-for-byte.
+- `negotiationAskRoundsCap()` takes `{ checklist }` and defaults to
+  `CHECKLIST_NEGOTIATION_ASK_ROUNDS_CAP` (both principals' budgets plus one
+  post-stall park) under the checklist protocol; the pre-checklist default
+  stays 3. An explicit `NEGOTIATION_ASK_ROUNDS_CAP` still wins.
+- `AskUserOpts` is now `TurnVocabularyOpts` (`{ askUser, checklist }`); the old
+  name remains as a deprecated alias.
+
 ## 22.0.0 - 2026-08-18
 
 ### Removed
@@ -761,6 +2559,49 @@ No public API change: all 441 exported symbols are byte-identical to 13.2.0, and
 
 ## [Unreleased]
 
+### Removed
+
+- **Breaking (38.0.0): single-path opportunities.** Discovery no longer creates
+  opportunities. It records one `discovery_match_candidates` row per pair, keyed by
+  `pairKeyOf(networkId, intentA, intentB)`, and the `opportunities` row is INSERTed at
+  kickoff by `createAndOpen` when a principal's PersonalAgent decides to reach out.
+  - `PersonalAgentMatch.opportunityId` is replaced by
+    `ref: { kind: 'candidate' | 'opportunity'; id: string }`. Read it with
+    `matchRefId(match)`; build one with `opportunityRef(id)`.
+  - `PersonalAgentOpportunityPort` requires `createAndOpen`.
+  - `OpportunityStatus` loses `latent` and `draft`. An opportunity is born
+    `negotiating`; there is no pre-kickoff state.
+  - The `introducer` actor role is removed, with its `approved` field,
+    `updateOpportunityActorApproval`, and every visibility rule that keyed on it.
+    `canUserSeeOpportunity` now answers one question — is the viewer an actor.
+  - Removed exports: `MaintenanceGraphFactory`, `MaintenanceGraphDatabase`,
+    `MaintenanceGraphCache`, `MaintenanceGraphQueue`, `createIntroduction`,
+    `approveIntroduction`, `sendOpportunity`, `evaluateIntroduction`,
+    `validateIntroduction`, `IntroductionRequest`, `persistOpportunities`,
+    `StampNewbornOpportunitiesFn`, `StampNewbornOpportunitiesInput`,
+    `OpportunityPersistenceOutcome`, and the `radar.health` scoring module.
+  - `operationMode` narrows to `create | read | update | delete`.
+  - Discovery sources narrow to `query`; `premise-similarity`,
+    `context-similarity` and `context-to-intent` are gone, as are their evidence
+    kinds.
+  - Hosts must implement `upsertDiscoveryMatchCandidates` and
+    `listPendingCandidatesForIntent`.
+- **Breaking (38.0.0): `QuestionRecoverySnapshot` drops its discovery-completion
+  fields.** `completionSource` narrows to `z.enum(["intent_creation"])` — the
+  `from_intent`/`discovery_run` values belonged to the post-discovery
+  recovery-question generator, retired in `6a3b65b0e` with no writer left.
+  `rejectedNegotiationCount` and `runId` are removed for the same reason.
+  Existing persisted `questions.detection` rows written before the retirement
+  may still carry the old values; nothing in the host parses them against this
+  schema at read time.
+
+### Added
+
+- `pairKeyOf`, `DiscoveryMatchCandidate`, `CreateDiscoveryMatchCandidateData`,
+  `DiscoveryMatchCandidateStatus`, `CreateAndOpenResult`, `PersonalAgentMatchRef`,
+  `matchRefId`, `opportunityRef`, `OpportunityEvidence`.
+
+
 ### Changed
 - Behaviour-neutral internal refactor (16.1.1): split the six largest modules and hoist every graph node to a top-level function. The opportunity graph is now the discovery pipeline only — its eight non-pipeline modes (read, update, delete, send, negotiate_existing, approve_introduction, and the two introduction stages) are plain functions on `OpportunityGraphFactory` instead of `operationMode` conditional-edge routing. `database.interface.ts` becomes a barrel over entity, query-group, and capability-view modules; every `Pick<Database, ...>` resolves as before. The opportunity presentation cluster is one module. `opportunity.graph.ts` 4167 → 250 lines, `database.interface.ts` 2925 → 17, `negotiation.graph.ts` 1619 → 111, `opportunity.tools.ts` 1200 → 354, `enrichment.tools.ts` 1198 → 178, `intent.graph.ts` 1091 → 174. No public export, feature flag, or environment variable changed.
 - Move the opportunity-presentation review checklist into `src/opportunity/AGENTS.md` and repoint the `opportunity.safe-presentation.ts` and `discriminator.adjustments.ts` comments at it. Comment-only; no runtime change.