@ixo/oracle-runtime-workers 0.12.0 → 0.15.0

package/src/do/user-oracle-do.ts

@@ -1,3 +1,13 @@
+import { ChannelTurns } from '../channels/turns';
+import { assertChannelAttemptAllowed } from '../channels/auth';
+import {
+  ChannelError,
+  channelRequestHash,
+  channelOrigin,
+  requireChannelDelegation,
+  type ChannelTurnInput,
+  type ChannelTurnOutcome,
+} from '../channels/contract';
 /* eslint-disable no-console -- console IS the logger on Workers (Logs/observability). */
 /**
  * `UserOracleDO` — one Durable Object per (user DID, oracle).
@@ -16,6 +26,12 @@
  * A Durable Object is single-threaded, which replaces the Node runtime's
  * per-user ref-counting, busy timeouts and cron locks outright.
  */
+import {
+  TopicOperationId,
+  TopicDeliverableRequestSchema,
+  type TopicDeliverableCommand,
+  type TopicDeliverableResult,
+} from '../tasks/topic-deliverables';
 import { DurableObject } from 'cloudflare:workers';
 import {
   AIMessage,
@@ -38,8 +54,10 @@ import {
   type AttachmentViewSurface,
   type MatrixMediaSource,
   type SandboxUploadConfig,
+  DOWNLOAD_TIMEOUT_MS,
   MAX_FILE_SIZE,
   readBytesCapped,
+  AttachmentTextCacheStore,
 } from '../attachments';
 import type { RuntimeCore } from '../core';
 import {
@@ -50,15 +68,35 @@ import {
   langsmithEnvFromWorkerEnv,
   llmEnvFromWorkerEnv,
   resolveLangsmithTracing,
+  type LangsmithTracingDecision,
   type OpenRouterLlmAdapter,
   DEFAULT_MODEL_ID,
+  OPENROUTER_MODEL_MAP,
 } from '../core/llm';
+import { renderTurnTimeNote } from '../core/prompt-composer';
+import { TURN_TIME_NOTE_KWARG, withTurnTimeNote } from '../core/turn-time-note';
+import {
+  capabilityRouterMode,
+  createCapabilityRouter,
+  shadowAgreement,
+  type CapabilityRouter,
+} from '../core/capability-router';
 import { createMainAgent } from '../core/main-agent';
+import {
+  REQUEST_ADMISSION_TIMEOUT_MS_DEFAULT,
+  admitRequest,
+  admissionMetadata,
+} from '../core/request-admission';
+import type {
+  RequestAdmissionResult,
+  RequestDisposition,
+} from '../plugin-api/request-admission';
+import { bootHiddenPlugins } from '../core/tool-access';
 import type { BaseChatModel } from '@langchain/core/language_models/chat_models';
 import type { AmbientServices, LlmAdapter } from '../core/runtime-context';
 import { chatGptBackendFromEnv } from '../llm/byo-client';
 import { createByoLlmAdapter } from '../llm/byo-adapter';
-import { isByoModelId } from '../llm/byo-catalog';
+import { byoModelForRole, isByoModelId } from '../llm/byo-catalog';
 import { handleByoRequest } from '../llm/byo-routes';
 import {
   WorkersByoService,
@@ -79,7 +117,7 @@ import {
   RealtimeEndpoint,
   type RealtimeStatus,
 } from '../realtime/realtime-endpoint';
-import { authenticate } from '../shell/auth';
+import { authConfigFromEnv, authenticate } from '../shell/auth';
 import {
   compactStep,
   finishCompaction,
@@ -135,7 +173,11 @@ import {
   VFS_DEFAULT_BASE_URLS,
 } from '../owner-store/ixo-vfs-store';
 import type { OwnerStore } from '../owner-store/types';
-import { createAmbientServices, SessionEventRouter } from './ambient';
+import {
+  createAmbientServices,
+  SessionEventRouter,
+  sweepExpiredBlobs,
+} from './ambient';
 import {
   checkpointStorageKey,
   type MatrixGatewayObject,
@@ -157,7 +199,7 @@ import { turnRecursionLimit } from './turn-config';
 import { decideMatrixTurn, MatrixTurnLedger } from './matrix-turn-ledger';
 import { decideBootDirty } from './boot-dirty';
 import { decideFlush } from './flush-schedule';
-import { mirrorTxnId, RoomMirror } from './room-mirror';
+import { mirrorTxnId, mirrorEventContent, RoomMirror } from './room-mirror';
 import { prefixSpeaker } from './speaker-prefix';
 import {
   type ObservedMessage,
@@ -176,6 +218,7 @@ import { WorkStatusProducer } from '../matrix/work-status';
 import { fetchUserMatrixServerName } from '../matrix/user-homeserver';
 import { createWorkStatusMiddleware } from '../core/middlewares/work-status';
 import { UserPreferencesStore } from '../plugins/user-preferences/user-preferences-store';
+import { SqliteUserKv } from '../sqlite/user-kv-store';
 import {
   SessionHistoryIndexer,
   type HistoryMessage,
@@ -210,6 +253,15 @@ import {
   type ToolEffect,
 } from '../core/middlewares/tool-marks';
 import { createResultCapMiddleware } from '../core/middlewares/result-cap';
+import { createToolExecutionMiddleware } from '../core/middlewares/tool-execution';
+import { budgetedLlm } from '../core/budgeted-llm';
+import { ToolScheduler, type ToolLane } from '../core/tool-scheduler';
+import {
+  HarnessLimitError,
+  TurnBudget,
+  turnLimitsFromEnv,
+  type TurnUsage,
+} from '../core/turn-budget';
 import { READ_RESULT_TOOL_NAME } from '../core/read-result-tool';
 import {
   ContextWindowResolver,
@@ -222,6 +274,21 @@ import {
 } from '../core/middlewares/context-guard';
 import { fetchOpenRouterContextLengths } from '../core/openrouter-pricing';
 import { ResultStore, resultStoreKnobs } from './result-store';
+import { artifactStorageConfig } from '../artifacts/config';
+import {
+  ArtifactStore,
+  artifactIdFor,
+  type OwnedArtifact,
+} from '../artifacts/store';
+import { buildCreateArtifactTool } from '../artifacts/tool';
+import { resolveDeliveryProfile } from '../delivery/profile';
+import {
+  draftReplyPlan,
+  materializeReplyPlan,
+  turnSteps,
+} from '../delivery/plan';
+import { parseReplyPlan } from '../delivery/schema';
+import type { DeliveryProfile, ReplyPlan } from '../delivery/types';
 import { formatReplay } from '../matrix/replay-format';
 import { retryGateway } from './gateway-retry';
 import {
@@ -235,8 +302,55 @@ import {
   TranscriptCursorError,
   transformTranscript,
   type TranscriptPageOptions,
+  visibleText,
 } from './transcript';
-import { WorkersUcanService } from './ucan-service';
+import { evictIdleWorkingCopy } from './idle-eviction';
+import { FeedbackMarkers, reserveFeedback } from '../feedback/reservation';
+import type {
+  FeedbackReservation,
+  FeedbackSettlement,
+  FeedbackTarget,
+} from '../feedback/contract';
+import { resolveTurnDelegation, WorkersUcanService } from './ucan-service';
+import type { UcanDelegation } from '../plugin-api/types';
+
+/** What one attempt's agent build reads from the request body. */
+type TurnBuildBody = Pick<
+  TurnBody,
+  'message' | 'timezone' | 'model' | 'tools' | 'agActions' | 'attachments'
+>;
+
+/** The run an attempt's agent build belongs to. */
+interface TurnBuildRun {
+  runId: string;
+  abortController: AbortController;
+  /** A recovery attempt: no new input, the graph continues from the checkpoint. */
+  resumed: boolean;
+  /** The reply text the user already received (resumed attempts). */
+  continuation: string | null;
+}
+
+/**
+ * Whether a turn is offered to the plugins' admission handlers. Not for a
+ * turn with attachments, a scheduled task run, or a Matrix group room: a
+ * direct read is posted into the room, so one user's authorized read would
+ * be shown to every member.
+ */
+function admissionApplies(req: TurnRequest): boolean {
+  return (
+    !req.attachments?.length &&
+    !req.taskRunId &&
+    !req.sessionId.startsWith(TASK_SESSION_PREFIX) &&
+    req.roomKind !== 'group'
+  );
+}
+
+function admissionTimeoutMs(env: Record<string, unknown>): number {
+  const ms = env.REQUEST_ADMISSION_TIMEOUT_MS;
+  return typeof ms === 'number' && Number.isFinite(ms) && ms > 0
+    ? ms
+    : REQUEST_ADMISSION_TIMEOUT_MS_DEFAULT;
+}
 
 const DB_FILE = 'oracle.db';
 /**
@@ -261,8 +375,31 @@ const FLUSH_FAILURES_ERROR_THRESHOLD = 3;
  * more for anyone who comes back within that window.
  */
 const IDLE_EVICT_MS = 5 * 24 * 60 * 60 * 1000;
+/**
+ * A stream of requests to a loaded object persists its last access at most
+ * this often. The idle checks read the in-memory value as well, so what an
+ * instance saw is never lost to the throttle while it lives; an instance
+ * that unloads takes at most this much of its last access with it, against
+ * the five-day idle horizon.
+ */
+const ACCESS_PERSIST_INTERVAL_MS = 60 * 60_000;
+/**
+ * The session title is a separate model call after the reply; it runs in
+ * the background and is abandoned after this long.
+ */
+const TITLE_TIMEOUT_MS = 15_000;
+/** A new sweep of expired ambient blobs starts at most this often per instance. */
+const BLOB_SWEEP_INTERVAL_MS = 60 * 60_000;
+/** The Blocksync lookup of the user's homeserver is abandoned after this long (the fallback applies). */
+const HOMESERVER_LOOKUP_TIMEOUT_MS = 3_000;
 /** Set once the legacy Matrix copy has been removed (or found absent): no more lookups. */
 const META_LEGACY_CLEARED = 'meta:legacyCleared';
+/**
+ * Set once a zero-turn working copy looked for a legacy Matrix copy to adopt
+ * and found none, or one without turns: later boots skip the gateway round
+ * trips. Cleared when a legacy copy is imported after all.
+ */
+const META_LEGACY_UNUSABLE = 'meta:legacyUnusable';
 const META_USER_DID = 'meta:userDid';
 
 /** KV key of a session's context-guard counters (`GET /debug/context?session=`). */
@@ -466,6 +603,62 @@ function lastAiText(messages: BaseMessage[]): string {
 }
 
 /** Id of the final assistant message (what `POST /messages` reports as `message.id`). */
+/** `turn_runs.usage` for `/debug/runs`; a row written before the column existed, or an unreadable one, is null. */
+function parseUsage(raw: string | null): TurnUsage | null {
+  if (!raw) return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object') return null;
+    const num = (key: string): number | undefined => {
+      const value: unknown = Reflect.get(parsed, key);
+      return typeof value === 'number' ? value : undefined;
+    };
+    const limits: unknown = Reflect.get(parsed, 'limits');
+    const limit = (key: string): number | undefined => {
+      if (!limits || typeof limits !== 'object') return undefined;
+      const value: unknown = Reflect.get(limits, key);
+      return typeof value === 'number' ? value : undefined;
+    };
+    const usage = {
+      tokens: num('tokens'),
+      reportedTokens: num('reportedTokens'),
+      modelCalls: num('modelCalls'),
+      toolAttempts: num('toolAttempts'),
+      elapsedMs: num('elapsedMs'),
+      limits: {
+        tokens: limit('tokens'),
+        tools: limit('tools'),
+        durationMs: limit('durationMs'),
+      },
+    };
+    if (
+      usage.tokens === undefined ||
+      usage.reportedTokens === undefined ||
+      usage.modelCalls === undefined ||
+      usage.toolAttempts === undefined ||
+      usage.elapsedMs === undefined ||
+      usage.limits.tokens === undefined ||
+      usage.limits.tools === undefined ||
+      usage.limits.durationMs === undefined
+    )
+      return null;
+    return {
+      tokens: usage.tokens,
+      reportedTokens: usage.reportedTokens,
+      modelCalls: usage.modelCalls,
+      toolAttempts: usage.toolAttempts,
+      elapsedMs: usage.elapsedMs,
+      limits: {
+        tokens: usage.limits.tokens,
+        tools: usage.limits.tools,
+        durationMs: usage.limits.durationMs,
+      },
+    };
+  } catch {
+    return null;
+  }
+}
+
 function lastAiMessageId(messages: BaseMessage[]): string | undefined {
   for (let i = messages.length - 1; i >= 0; i--) {
     const m = messages[i];
@@ -510,14 +703,38 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       if (this.ctx.getWebSockets().length > 0) this.realtime.nextPingAt();
     }
     private readonly aborts = new Map<string, AbortController>();
+    /** Capability router (core/capability-router.ts); built with the ambient services. */
+    private capabilityRouter: CapabilityRouter | null = null;
+    /**
+     * Shadow-mode predictions awaiting the turn's end, by session: what the
+     * router would have preloaded, against the plugins loaded before the turn.
+     */
+    private readonly shadowRoutes = new Map<
+      string,
+      {
+        requestId: string;
+        priorLoaded: ReadonlySet<string>;
+        wouldPreload: readonly string[];
+      }
+    >();
     /** Durable runs (docs/plans/durable-runs.md): the rows, and the live side. */
     private runStore: RunStore | null = null;
+    /**
+     * Tool concurrency of this user object (tool-scheduler.ts): writes one
+     * at a time across every session and turn, reads and sub-agents in
+     * bounded lanes. Lives as long as the object.
+     */
+    private readonly toolScheduler = new ToolScheduler();
     private runs: RunCoordinator | null = null;
     private readonly runConfig: RunDurabilityConfig = runDurabilityConfig(
       this.env,
     );
     /** Whole tool results the result cap saved (docs/plans/context-budgets.md). */
     private resultStore: ResultStore | null = null;
+    /** Chat delivery's artefacts; null when no bucket is bound (see `canShare` for new ones). */
+    private artifacts: ArtifactStore | null = null;
+    /** Text `view_attachment` extracted, per session (`attachments/view-cache.ts`). */
+    private attachmentTextCache: AttachmentTextCacheStore | null = null;
     /**
      * Per-model context windows; learned limits persist in this object's KV
      * storage (`ctxwin:<model>`), so a provider's rejection is remembered
@@ -529,6 +746,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         fetchOpenRouterContextLengths({
           apiKey: this.env.OPEN_ROUTER_API_KEY,
           logger: console,
+          // A background refresh of the catalogue outlives the request.
+          waitUntil: (work) => this.ctx.waitUntil(work),
         }),
       learned: {
         get: (model) => this.ctx.storage.get<number>(`ctxwin:${model}`),
@@ -546,6 +765,28 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     /** Epoch-ms until which a room-state delegation lookup is not retried. */
     private delegationMissUntil = 0;
     private dirty = false;
+    /**
+     * `META_FLUSH_AT` as this instance last wrote or read it (null =
+     * unknown). With `dirty`, it tells `markDirty` that the upload is
+     * already scheduled, so a turn's mark costs no storage operation.
+     */
+    private flushAt: number | null = null;
+    /** The newest real request this instance served (null = none yet). */
+    private lastAccessAt: number | null = null;
+    /** The `META_LAST_ACCESS` this instance last wrote (null = none yet). */
+    private persistedAccessAt: number | null = null;
+    /** The user's Matrix id as resolved (or read from storage) by this instance. */
+    private matrixUserIdCache: MatrixUserIdCache | null = null;
+    /**
+     * The earliest housekeeping deadline armed since the current full alarm
+     * tick began: the tick's own `META_HOUSEKEEPING_AT` write never rises
+     * above a deadline armed while it ran.
+     */
+    private housekeepingFloor = Infinity;
+    /** Where the expired-blob sweep continues on the next tick (null = from the start). */
+    private blobSweepCursor: string | null = null;
+    /** When this instance last swept from the start (the sweep reads whole values). */
+    private lastBlobSweepAt: number | null = null;
     /** The flush in progress, if any (single-flight; a VFS snapshot is open while it runs). */
     private flushInFlight: Promise<FlushResult> | null = null;
 
@@ -572,6 +813,9 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     private matrixLedger: MatrixTurnLedger | null = null;
     /** Room mirrors of HTTP turns, serialised per session and retried across gateway restarts (see room-mirror.ts). */
     private mirror: RoomMirror | null = null;
+    private channelTurns: ChannelTurns | null = null;
+    /** Anonymous-feedback idempotency markers and the user's submission limit. */
+    private feedbackMarkers: FeedbackMarkers | null = null;
     /** The oracle room of each session this instance resolved: spares the mirrors a row read per send. */
     private readonly sessionRooms = new Map<string, string>();
     /** The user's main oracle room, once resolved (the session list is scoped to it). */
@@ -593,6 +837,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       { session: IndexableSession; messages: HistoryMessage[] }
     >();
     private initPromise: Promise<void> | null = null;
+    /** An idle eviction deleting the working copy; a boot waits for it. */
+    private evicting: Promise<void> | null = null;
     private reloadedFromOwnerStore = false;
     /** Set by `adoptOwnerCopy` for a legacy copy: `ready()` flushes it to the system of record right after. */
     private pendingLegacyMigration: { bytes: number } | null = null;
@@ -617,22 +863,44 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       userDid: string,
     ): Promise<string | undefined> {
       if (!userDid.startsWith('did:ixo:')) return undefined;
+      const fresh = (
+        entry: MatrixUserIdCache | null | undefined,
+      ): entry is MatrixUserIdCache =>
+        !!entry &&
+        entry.userDid === userDid &&
+        (entry.resolved ||
+          Date.now() - entry.at < MATRIX_USER_ID_FALLBACK_TTL_MS);
+      if (fresh(this.matrixUserIdCache))
+        return this.matrixUserIdCache.matrixUserId;
       const cached =
         await this.ctx.storage.get<MatrixUserIdCache>(META_MATRIX_USER_ID);
-      if (
-        cached &&
-        cached.userDid === userDid &&
-        (cached.resolved ||
-          Date.now() - cached.at < MATRIX_USER_ID_FALLBACK_TTL_MS)
-      ) {
+      if (fresh(cached)) {
+        this.matrixUserIdCache = cached;
         return cached.matrixUserId;
       }
       let server: string | undefined;
       let resolved = false;
       const blocksync = this.env.BLOCKSYNC_GRAPHQL_URL;
       if (blocksync) {
+        // Bounded: this lookup sits on the boot path and on every turn
+        // start. The timer is cleared however the lookup ends.
+        const lookup = new AbortController();
+        const timer = setTimeout(
+          () =>
+            lookup.abort(
+              new Error(
+                `Blocksync lookup timed out after ${HOMESERVER_LOOKUP_TIMEOUT_MS} ms`,
+              ),
+            ),
+          HOMESERVER_LOOKUP_TIMEOUT_MS,
+        );
         try {
-          const fromDid = await fetchUserMatrixServerName(blocksync, userDid);
+          const fromDid = await fetchUserMatrixServerName(
+            blocksync,
+            userDid,
+            (input, init) =>
+              globalThis.fetch(input, { ...init, signal: lookup.signal }),
+          );
           if (fromDid) {
             server = fromDid;
             resolved = true;
@@ -643,6 +911,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
               err instanceof Error ? err.message : String(err)
             }`,
           );
+        } finally {
+          clearTimeout(timer);
         }
       }
       server ??=
@@ -651,12 +921,14 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           : undefined;
       if (!server) return undefined;
       const matrixUserId = `@${userDid.replace(/:/g, '-')}:${server}`;
-      await this.ctx.storage.put<MatrixUserIdCache>(META_MATRIX_USER_ID, {
+      const entry: MatrixUserIdCache = {
         userDid,
         matrixUserId,
         resolved,
         at: Date.now(),
-      });
+      };
+      this.matrixUserIdCache = entry;
+      await this.ctx.storage.put<MatrixUserIdCache>(META_MATRIX_USER_ID, entry);
       return matrixUserId;
     }
 
@@ -673,8 +945,28 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       );
     }
 
-    /** Idempotent boot: bind user, open SQLite (importing the owner copy on a cold object). */
-    private async ready(identity: TurnIdentity): Promise<void> {
+    /** The delegation a turn runs under (`resolveTurnDelegation`). */
+    private async turnDelegation(
+      identity: TurnIdentity,
+    ): Promise<UcanDelegation> {
+      return resolveTurnDelegation(
+        identity.ucanDelegation,
+        this.delegations.get(identity.userDid)?.raw,
+        this.ucan,
+      );
+    }
+
+    /**
+     * Idempotent boot: bind user, open SQLite (importing the owner copy on a
+     * cold object). A request from the user records the access the idle
+     * eviction reads; the object's own wakes (the alarm, a flush, debug and
+     * operator calls) pass `recordAccess: false`, or an idle object would
+     * keep itself alive.
+     */
+    private async ready(
+      identity: TurnIdentity,
+      options: { recordAccess?: boolean } = {},
+    ): Promise<void> {
       this.installDebugTimerTracker();
       this.adoptHibernatedSockets();
       let delegationReplaced = false;
@@ -688,17 +980,21 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         this.delegations.set(identity.userDid, {
           raw: identity.ucanDelegation,
         });
-        // Remember it for turns that arrive without the header.
-        void this.ctx.storage.put(META_DELEGATION, {
-          raw: identity.ucanDelegation,
-          at: Date.now(),
-          ...(typeof identity.ucanDelegationExpiration === 'number'
-            ? { expiration: identity.ucanDelegationExpiration }
-            : {}),
-        } satisfies StoredDelegation);
+        // Remember a new one for turns that arrive without the header.
+        if (delegationReplaced)
+          await this.ctx.storage.put(META_DELEGATION, {
+            raw: identity.ucanDelegation,
+            at: Date.now(),
+            ...(typeof identity.ucanDelegationExpiration === 'number'
+              ? { expiration: identity.ucanDelegationExpiration }
+              : {}),
+          } satisfies StoredDelegation);
       } else if (!this.delegations.has(identity.userDid)) {
         await this.hydrateDelegation(identity.userDid);
       }
+      // A request that arrived while an idle eviction deletes the working
+      // copy boots afresh from the owner copy once it is gone.
+      while (this.evicting) await this.evicting;
       if (!this.initPromise) {
         this.initPromise = this.boot(identity.userDid).catch((err) => {
           this.initPromise = null;
@@ -711,10 +1007,59 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           `UserOracleDO bound to ${this.userDid} received a request for ${identity.userDid}`,
         );
       }
-      await this.ctx.storage.put(META_LAST_ACCESS, Date.now());
+      if (options.recordAccess !== false) await this.recordAccess();
       if (delegationReplaced) await this.onDelegationReplaced();
     }
 
+    /**
+     * A request from the user: remember it in memory, and in storage on this
+     * instance's first request and then at most every
+     * `ACCESS_PERSIST_INTERVAL_MS`.
+     */
+    private async recordAccess(): Promise<void> {
+      const now = Date.now();
+      this.lastAccessAt = now;
+      if (
+        typeof this.persistedAccessAt === 'number' &&
+        now - this.persistedAccessAt < ACCESS_PERSIST_INTERVAL_MS
+      )
+        return;
+      this.persistedAccessAt = now;
+      await this.ctx.storage.put(META_LAST_ACCESS, now);
+    }
+
+    /** The in-memory last access, when it is newer than the stored one. */
+    private async persistAccess(): Promise<void> {
+      const inMemory = this.lastAccessAt;
+      if (
+        typeof inMemory !== 'number' ||
+        (typeof this.persistedAccessAt === 'number' &&
+          this.persistedAccessAt >= inMemory)
+      )
+        return;
+      this.persistedAccessAt = inMemory;
+      await this.ctx.storage.put(META_LAST_ACCESS, inMemory);
+    }
+
+    /**
+     * The user's last request: the newer of what storage holds and what
+     * this instance saw (undefined when neither knows of one).
+     */
+    private async knownLastAccess(): Promise<number | undefined> {
+      const stored = await this.ctx.storage.get<number>(META_LAST_ACCESS);
+      const inMemory = this.lastAccessAt;
+      const known = Math.max(
+        typeof stored === 'number' ? stored : -Infinity,
+        typeof inMemory === 'number' ? inMemory : -Infinity,
+      );
+      return Number.isFinite(known) ? known : undefined;
+    }
+
+    /** `knownLastAccess`, or `now` when there is none (never idle). */
+    private async lastAccess(now: number): Promise<number> {
+      return (await this.knownLastAccess()) ?? now;
+    }
+
     /**
      * The mnemonic the oracle signs downstream UCAN invocations with:
      * `ORACLE_SIGNING_MNEMONIC` when set, otherwise the one the Node runtime
@@ -745,10 +1090,15 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
      * The object holds a delegation it had not seen before (a header on this
      * request, or a deposit through the shell). A fresh delegation is the one
      * thing that turns a "no file-storage grant" flush failure into a
-     * success: forget the failure streak and, with unsaved turns, flush now
-     * instead of at the next 10-minute retry.
+     * success: after a recorded failure, forget the streak and, with unsaved
+     * turns, flush now instead of at the next 10-minute retry. Without one
+     * the debounce stands: a user on two clients alternates two delegations,
+     * and an upload per request would replace the daily one.
      */
     private async onDelegationReplaced(): Promise<void> {
+      const failures =
+        (await this.ctx.storage.get<number>(META_FLUSH_FAILURES)) ?? 0;
+      if (failures === 0) return;
       await this.ctx.storage.delete(META_FLUSH_FAILURES);
       if (!this.db) return;
       if (
@@ -900,6 +1250,45 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         DB_FILE,
         this.sqliteOpenOptions(),
       );
+      try {
+        await this.bootWorkingCopy(
+          db,
+          userDid,
+          this.ownerStore,
+          this.ucan,
+          secretsService,
+        );
+      } catch (err) {
+        // Nothing of a failed boot stays behind: the connection (and the
+        // one a dropped zero-turn copy was reopened into) is closed and the
+        // handles forgotten, so the next request or alarm boots afresh on
+        // one connection instead of finding a half-built object.
+        const reopened = this.db;
+        this.dropInMemoryState();
+        await db.close().catch(() => undefined);
+        if (reopened && reopened !== db)
+          await reopened.close().catch(() => undefined);
+        throw err;
+      }
+    }
+
+    /**
+     * The fallible part of `boot()`, from the open database on: reconcile it
+     * with the owner copy, then build the stores and services over it.
+     */
+    private async bootWorkingCopy(
+      db: DoSqliteDatabase,
+      userDid: string,
+      ownerStore: OwnerStore,
+      ucan: WorkersUcanService,
+      secretsService: WorkersSecretsService,
+    ): Promise<void> {
+      const env = this.env;
+      // Whether the working copy holds a turn: one existence query, asked
+      // again only after an import or a wipe changed the file.
+      let turns: boolean | undefined;
+      const hasTurns = async (target: DoSqliteDatabase): Promise<boolean> =>
+        (turns ??= await this.hasLocalTurns(target));
       // Cold object (no pages yet) → pull the user's file if they have one.
       // `null` means the owner store PROVABLY holds no file (a new user): an
       // empty working copy is right. A load that FAILS is different: there is
@@ -908,7 +1297,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // real copy. So the request fails instead; the boot is not memoised on
       // failure, and the next request simply retries the load.
       if (db.fileSize === 0) {
-        const store = this.ownerStore;
+        const store = ownerStore;
         let loaded: OwnerCopy | null;
         let attempts = 0;
         try {
@@ -938,24 +1327,35 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           throw toRpcError(failure);
         }
         if (loaded) {
-          const imported = await this.adoptOwnerCopy(db, loaded);
+          let imported: number;
+          try {
+            imported = await this.adoptOwnerCopy(db, loaded);
+          } catch (err) {
+            // The object was empty, so nothing is lost by emptying it
+            // again: a copy that is not a database (a short or truncated
+            // file passes the import's header check) must not stay behind,
+            // or every later boot would open it and fail.
+            await this.wipeWorkingCopy(db).catch(() => undefined);
+            throw err;
+          }
           this.reloadedFromOwnerStore = true;
           console.log(
-            `[user-do] imported ${imported} bytes from ${loaded.fromLegacy ? 'legacy Matrix media' : this.ownerStore.kind} for ${userDid}`,
+            `[user-do] imported ${imported} bytes from ${loaded.fromLegacy ? 'legacy Matrix media' : ownerStore.kind} for ${userDid}`,
           );
         }
       } else {
         // Warm object: notice if the user replaced or deleted their file
         // upstream. A `head()` that FAILS (a VFS error/timeout, or our own
-        // delete→move replace window where the real path momentarily does
-        // not exist) must NEVER be read as "the file is gone" — swallowing
+        // replace window between moving the old file aside and moving the
+        // new one in, where the real path momentarily does not exist) must
+        // NEVER be read as "the file is gone" — swallowing
         // the error to null and wiping the working copy on it would destroy
         // the durable local history over a transient blip. So distinguish a
         // proven absence (null) from an unknown (the call threw).
         const knownEtag = await this.ctx.storage.get<string>(META_OWNER_ETAG);
         let head: { etag: string } | null | undefined;
         try {
-          head = await this.ownerStore.head();
+          head = await ownerStore.head();
         } catch (err) {
           head = undefined; // unknown — leave the working copy untouched
           console.warn(
@@ -971,11 +1371,12 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           // re-flushed, re-establishing the owner copy; a genuine "forget me"
           // goes through the explicit `remove()` path, never through an
           // auto-wipe that could fire on a mid-replace crash or a stale list.
-          if ((await this.localTurnCount(db)) === 0) {
+          if (!(await hasTurns(db))) {
             console.warn(
               `[user-do] owner copy for ${userDid} is gone upstream and the working copy is empty — dropping it`,
             );
             await this.wipeWorkingCopy(db);
+            turns = undefined;
             this.db = await DoSqliteDatabase.open(
               this.ctx,
               DB_FILE,
@@ -988,13 +1389,27 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             this.markDirty();
           }
         } else if (head && knownEtag && head.etag !== knownEtag) {
-          const loaded = await this.ownerStore.load().catch(() => null);
-          if (loaded) {
-            await this.adoptOwnerCopy(db, loaded);
-            this.reloadedFromOwnerStore = true;
-            console.log(
-              `[user-do] owner copy changed upstream (${knownEtag} → ${head.etag}); re-imported`,
+          // The file changed upstream. Re-import it only when every local
+          // write already went up: up to a day of turns waits for the
+          // debounced flush, and an import would drop them. With unflushed
+          // turns neither side can win automatically, so keep local (the
+          // next flush replaces the upstream file) and say so loudly.
+          const unflushed = await this.unflushedLocalWrites(db);
+          if (unflushed) {
+            console.warn(
+              `[user-do] owner copy for ${userDid} changed upstream (${knownEtag} → ${head.etag}) but the working copy holds writes not uploaded yet — keeping the local copy`,
             );
+            this.markDirty();
+          } else {
+            const loaded = await ownerStore.load().catch(() => null);
+            if (loaded) {
+              await this.adoptOwnerCopy(db, loaded);
+              turns = undefined;
+              this.reloadedFromOwnerStore = true;
+              console.log(
+                `[user-do] owner copy changed upstream (${knownEtag} → ${head.etag}); re-imported`,
+              );
+            }
           }
         } else if (head && !knownEtag) {
           // This object first booted before the user's owner file became
@@ -1005,9 +1420,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           // empty session, but no turn ever ran → no checkpoints); once local
           // turns exist neither side can win automatically, so keep local
           // and say so loudly (operators resolve via /debug/storage/reset).
-          const localTurns = await this.localTurnCount(db);
-          if (localTurns === 0) {
-            const loaded = await this.ownerStore.load().catch((err) => {
+          if (!(await hasTurns(db))) {
+            const loaded = await ownerStore.load().catch((err) => {
               console.warn(
                 `[user-do] late owner copy load failed for ${userDid}: ${err instanceof Error ? err.message : String(err)}`,
               );
@@ -1015,14 +1429,15 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             });
             if (loaded) {
               const imported = await this.adoptOwnerCopy(db, loaded);
+              turns = undefined;
               this.reloadedFromOwnerStore = true;
               console.log(
-                `[user-do] owner copy appeared upstream after first boot; imported ${imported} bytes from ${this.ownerStore.kind} for ${userDid}`,
+                `[user-do] owner copy appeared upstream after first boot; imported ${imported} bytes from ${ownerStore.kind} for ${userDid}`,
               );
             }
           } else {
             console.warn(
-              `[user-do] owner copy exists upstream (${head.etag}) but was never imported and ${localTurns} local checkpoint(s) already exist for ${userDid} — keeping the local copy`,
+              `[user-do] owner copy exists upstream (${head.etag}) but was never imported and local checkpoints already exist for ${userDid} — keeping the local copy`,
             );
           }
         }
@@ -1036,21 +1451,39 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // the working copy has zero turns and a legacy (Matrix) copy WITH turns
       // exists, adopt it and flush it over the empty file. Guard on the legacy
       // copy actually having turns so a genuinely new user (empty everywhere)
-      // is left empty, not churned.
+      // is left empty, not churned. A probe that proved there is nothing
+      // usable is remembered (`META_LEGACY_UNUSABLE`), as is a legacy copy
+      // already removed: later boots of a still zero-turn copy skip the
+      // gateway. A probe that failed proves nothing and runs again on the
+      // next boot.
       const activeDb = this.db ?? db;
-      if (
-        this.ownerStore.loadLegacy &&
-        (await this.localTurnCount(activeDb)) === 0
-      ) {
-        const legacy = await this.ownerStore.loadLegacy();
+      if (ownerStore.loadLegacy && !(await hasTurns(activeDb))) {
+        const markers = await this.ctx.storage.get<boolean>([
+          META_LEGACY_CLEARED,
+          META_LEGACY_UNUSABLE,
+        ]);
+        const settled =
+          markers.get(META_LEGACY_CLEARED) === true ||
+          markers.get(META_LEGACY_UNUSABLE) === true;
+        let legacy: OwnerCopy | null = null;
+        if (!settled) {
+          try {
+            legacy = await ownerStore.loadLegacy();
+            if (!legacy) await this.ctx.storage.put(META_LEGACY_UNUSABLE, true);
+          } catch (err) {
+            console.warn(
+              `[user-do] legacy Matrix copy of ${userDid} could not be read; checking again on the next boot: ${err instanceof Error ? err.message : String(err)}`,
+            );
+          }
+        }
         if (legacy) {
-          // Trial import: only the checkpoint count tells us whether the
-          // legacy copy holds history, so keep the (tiny, zero-turn) working
-          // copy to put back if it does not.
+          // Trial import: only the checkpoints tell us whether the legacy
+          // copy holds history, so keep the (tiny, zero-turn) working copy
+          // to put back if it does not.
           const before = await activeDb.export();
           const adoptedBytes = await activeDb.importFromStream(legacy.stream);
-          const adoptedTurns = await this.localTurnCount(activeDb);
-          if (adoptedTurns > 0) {
+          turns = undefined;
+          if (await hasTurns(activeDb)) {
             // The adopted bytes are NOT what the system of record holds:
             // forget the last upload so the flush below actually sends them.
             await this.ctx.storage.delete([
@@ -1062,10 +1495,12 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             // record so the next cold boot imports it directly.
             this.markDirty();
             console.log(
-              `[user-do] working copy had no turns; adopted the legacy Matrix copy (${adoptedBytes} bytes, ${adoptedTurns} checkpoint(s)) for ${userDid} — flushing it to the system of record`,
+              `[user-do] working copy had no turns; adopted the legacy Matrix copy (${adoptedBytes} bytes) for ${userDid} — flushing it to the system of record`,
             );
           } else {
             await activeDb.import(before);
+            turns = undefined;
+            await this.ctx.storage.put(META_LEGACY_UNUSABLE, true);
             console.log(
               `[user-do] legacy Matrix copy for ${userDid} holds no turns either; working copy left as is`,
             );
@@ -1088,7 +1523,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         try {
           const flushed = await this.flushToOwnerStore();
           console.log(
-            `[user-do] migrated ${bytes} bytes from legacy Matrix media to ${this.ownerStore.kind} for ${userDid} (${flushed.etag ?? '-'})`,
+            `[user-do] migrated ${bytes} bytes from legacy Matrix media to ${ownerStore.kind} for ${userDid} (${flushed.etag ?? '-'})`,
           );
         } catch (err) {
           console.warn(
@@ -1115,16 +1550,19 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         // Redacting on etag alone would drop the last backstop while the VFS
         // copy could still be a smaller or older export. A dirty or
         // not-yet-verified copy waits: the flush that lands it does the
-        // removal itself.
+        // removal itself. The verification hashes the whole file, so it
+        // only runs while a legacy copy may still exist.
+        const ownerEtag = await this.ctx.storage.get<string>(META_OWNER_ETAG);
         if (
-          (await this.localTurnCount(liveDb)) > 0 &&
+          ownerEtag &&
+          ownerStore.removeLegacyCopy &&
+          (await this.ctx.storage.get<boolean>(META_LEGACY_CLEARED)) !== true &&
+          (await hasTurns(liveDb)) &&
           (await this.ownerCopyIsCurrent(liveDb))
-        ) {
-          const ownerEtag = await this.ctx.storage.get<string>(META_OWNER_ETAG);
-          if (ownerEtag) await this.removeLegacyCopyIfAny(ownerEtag);
-        }
+        )
+          await this.removeLegacyCopyIfAny(ownerEtag);
         console.log(
-          `[user-do] ready ${userDid}: store=${this.ownerStore.kind} legacy=${this.ownerStore.loadLegacy ? 'yes' : 'no'} file=${liveDb.fileSize}B turns=${await this.localTurnCount(liveDb)} sessions=${sessionRow?.n ?? 0} ownerEtag=${(await this.ctx.storage.get<string>(META_OWNER_ETAG)) ?? '-'} reloaded=${this.reloadedFromOwnerStore}`,
+          `[user-do] ready ${userDid}: store=${ownerStore.kind} legacy=${ownerStore.loadLegacy ? 'yes' : 'no'} file=${liveDb.fileSize}B turns=${(await hasTurns(liveDb)) ? 'yes' : 'none'} sessions=${sessionRow?.n ?? 0} ownerEtag=${ownerEtag ?? '-'} reloaded=${this.reloadedFromOwnerStore}`,
         );
       }
       this.saver = new SqliteSaver(liveDb, undefined, {
@@ -1137,6 +1575,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       await this.matrixLedger.setup();
       this.runStore = new RunStore(liveDb);
       await this.runStore.setup();
+      this.feedbackMarkers = new FeedbackMarkers(liveDb);
+      await this.feedbackMarkers.setup();
       this.resultStore = new ResultStore(liveDb, {
         ...(this.env.TIER_BUCKET ? { bucket: this.env.TIER_BUCKET } : {}),
         prefix: this.ctx.id.toString(),
@@ -1144,6 +1584,17 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         logger: console,
       });
       await this.resultStore.setup();
+      this.attachmentTextCache = new AttachmentTextCacheStore(liveDb, console);
+      // The store exists whenever the bucket is bound, so artefacts made
+      // earlier stay readable, revocable and deleted with their session after
+      // the public origin is removed; only new ones need it.
+      const artifactConfig = artifactStorageConfig(this.env, (message) =>
+        console.warn(message),
+      );
+      if (artifactConfig) {
+        this.artifacts = new ArtifactStore(liveDb, artifactConfig);
+        await this.artifacts.setup();
+      }
       // Threads opened before the runtime adopted Node's session rule
       // (session id = thread root event id) are renamed to it, once.
       const renamed = await migrateThreadSessionIds(liveDb, console);
@@ -1153,12 +1604,81 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         config: this.runConfig,
         instanceId: this.instanceId,
         log: console,
-        requestAlarm: (at) => this.requestAlarm(at),
+        // Keep-alive and recovery deadlines alike: after a reset, the
+        // keep-alive deadline is the wake that boots the object and
+        // recovers its runs, so the heartbeat fast path must not skip it.
+        requestAlarm: (at) => this.ctx.waitUntil(this.requestHousekeeping(at)),
         runAttempt: (live, resumed) => this.runAttempt(live, resumed),
         checkpointIdOf: (sessionId) => this.checkpointIdOf(sessionId),
         onRunEnded: (record, outcome) => this.onRunEnded(record, outcome),
       });
 
+      this.channelTurns = new ChannelTurns(liveDb, {
+        createSession: async (identity, markerTxnId) => {
+          const room = await this.gateway.resolveUserRoom(identity.userDid);
+          if (!room) throw new ChannelError(409, 'Companion room is not ready');
+          return (
+            await this.createSession(identity, {
+              roomId: room.roomId,
+              markerTxnId,
+            })
+          ).sessionId;
+        },
+        assertSession: async (identity, sessionId) => {
+          const session = await this.sessions!.getSession(sessionId);
+          const room = await this.gateway.resolveUserRoom(identity.userDid);
+          if (
+            !session ||
+            !sessionId.startsWith('$') ||
+            !room ||
+            session.roomId !== room.roomId
+          )
+            throw new ChannelError(404, 'Companion session not found');
+          const encryption = await this.gateway.getRoomStateEvent(
+            room.roomId,
+            'm.room.encryption',
+          );
+          const parsed: unknown = encryption ? JSON.parse(encryption) : null;
+          if (
+            !parsed ||
+            typeof parsed !== 'object' ||
+            !('algorithm' in parsed) ||
+            parsed.algorithm !== 'm.megolm.v1.aes-sha2'
+          )
+            throw new ChannelError(409, 'Companion room must be encrypted');
+        },
+        requireDelegation: async (identity) =>
+          requireChannelDelegation(
+            !!this.delegations.get(identity.userDid)?.raw,
+          ),
+        getRun: (runId) => this.runStore!.get(runId),
+        getPlan: (runId) => this.runStore!.getPlan(runId),
+        wasPruned: (runId) => this.runStore!.wasChannelRunPruned(runId),
+        begin: async (runId, request) => {
+          const { live } = await this.runs!.begin({
+            runId,
+            sessionId: request.sessionId,
+            requestId: request.requestId,
+            client: 'channel',
+            request: this.runRequestJson(request, storedRunRequest(request)),
+            multitask: 'enqueue',
+          });
+          this.markDirty();
+          await this.requestHousekeeping(
+            Date.now() + this.runConfig.keepAliveMs,
+          );
+          await this.ctx.storage.sync();
+          this.ctx.waitUntil(live.done.catch(() => undefined));
+          return live.record;
+        },
+        mirror: (request, text, author) =>
+          this.replayToRoom(request, text, author),
+        changed: async () => {
+          this.markDirty();
+          await this.ctx.storage.sync();
+        },
+      });
+
       const core = this.core;
       // Boot-time plugin hooks + collision checks, once per object (memoised).
       await core.warm();
@@ -1173,7 +1693,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         matrixUserId: await this.resolveMatrixUserId(userDid),
         gateway: this.gateway,
         runTurn: (req) => this.runTurn(req),
-        requestAlarm: (at) => this.requestAlarm(at),
+        abortTurn: (sessionId) => this.abortTurn(sessionId),
+        requestAlarm: (at) => this.requestHousekeeping(at),
         turnRunLive: (taskRunId) => Boolean(this.runs?.byTaskRunId(taskRunId)),
         log: console,
         ...(Number.isFinite(maxTasks) ? { maxTasksPerUser: maxTasks } : {}),
@@ -1181,7 +1702,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       });
       if (this.taskScheduler) {
         const next = await this.taskScheduler.nextWakeAt().catch(() => null);
-        if (next !== null) this.requestAlarm(Math.max(next, Date.now() + 1000));
+        if (next !== null)
+          await this.requestHousekeeping(Math.max(next, Date.now() + 1000));
       }
 
       // Runs a previous incarnation left in flight: schedule their recovery
@@ -1198,7 +1720,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // imported from the Node runtime arrive with uncompressed blobs.
       this.compactDone ??=
         (await this.ctx.storage.get<boolean>(META_COMPACT_DONE)) ?? false;
-      if (!this.compactDone) this.requestAlarm(Date.now() + 3000);
+      if (!this.compactDone) await this.requestHousekeeping(Date.now() + 3000);
 
       // Provider selection: `core.llm` is the OpenRouter adapter built from
       // the validated base env; `LLM_PROVIDER=nebius` (read from the raw
@@ -1225,20 +1747,27 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       this.ambient = createAmbientServices({
         ...(this.taskScheduler ? { tasks: this.taskScheduler.surface } : {}),
         preferences: this.preferences,
+        kv: new SqliteUserKv(liveDb),
         frontend: this.realtime.frontend,
         config: core.validatedEnv,
         identity: core.identity,
         availablePlugins: core.availablePlugins,
         llm,
+        decisions: core.decisions,
         logger: console,
         storage: this.ctx.storage,
         gateway: this.gateway,
-        ucan: this.ucan,
+        ucan,
         delegationFor: (did) => this.delegations.get(did),
         events: this.events,
         secrets: createSecretsAdapter(secretsService),
         background: (work) => this.ctx.waitUntil(work),
       });
+      this.capabilityRouter = createCapabilityRouter({
+        evaluator: core.decisions,
+        logger: console,
+        background: (work) => this.ctx.waitUntil(work),
+      });
     }
 
     /**
@@ -1278,6 +1807,50 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       });
     }
 
+    /**
+     * Forget every handle on the working copy, so the next request boots
+     * afresh (and imports the owner copy into an empty file).
+     */
+    private dropInMemoryState(): void {
+      this.db = null;
+      this.saver = null;
+      this.sessions = null;
+      this.matrixLedger = null;
+      this.runStore = null;
+      this.channelTurns = null;
+      this.feedbackMarkers = null;
+      this.runs = null;
+      this.resultStore = null;
+      this.artifacts = null;
+      this.attachmentTextCache = null;
+      // Its store is bound to the database just dropped: a caller that sees
+      // no scheduler boots again instead of reading a closed connection.
+      this.taskScheduler = null;
+      this.sessionRooms.clear();
+      this.mainRoomId = null;
+      this.ambient = null;
+      this.secretsService = null;
+      this.byo = null;
+      this.initPromise = null;
+      this.reloadedFromOwnerStore = false;
+    }
+
+    /**
+     * Still idle after the idle tick's awaits: the same working copy, nothing
+     * written or uploading, no run, and no request since (every request
+     * records its access in `ready()`, in memory at once).
+     */
+    private async stillIdle(db: DoSqliteDatabase): Promise<boolean> {
+      const lastAccess = await this.lastAccess(Date.now());
+      return (
+        this.db === db &&
+        !this.dirty &&
+        !this.flushInFlight &&
+        (this.runs?.size ?? 0) === 0 &&
+        Date.now() - lastAccess > IDLE_EVICT_MS
+      );
+    }
+
     /** Drop the working copy entirely; the caller reopens/reboots afterwards. */
     private async wipeWorkingCopy(db: DoSqliteDatabase | null): Promise<void> {
       if (db) {
@@ -1294,6 +1867,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         META_FLUSH_FAILURES,
         META_LAST_VACUUM,
       ]);
+      this.flushAt = null;
     }
 
     /**
@@ -1354,6 +1928,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           META_LAST_CHECKSUM,
           META_UPLOADED_GEN,
           META_LEGACY_CLEARED,
+          META_LEGACY_UNUSABLE,
         ]);
         this.markDirty();
         this.pendingLegacyMigration = { bytes };
@@ -1375,8 +1950,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const uploadedGen = await this.ctx.storage.get<number>(META_UPLOADED_GEN);
       const lastChecksum =
         await this.ctx.storage.get<string>(META_LAST_CHECKSUM);
-      if (lastChecksum === undefined)
-        return (await this.localTurnCount(db)) === 0;
+      if (lastChecksum === undefined) return !(await this.hasLocalTurns(db));
       // Objects that last flushed before generations were recorded verify
       // by hash alone; everyone else gets the cheap generation gate first.
       if (uploadedGen !== undefined && uploadedGen !== db.writeGeneration)
@@ -1384,17 +1958,47 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       return (await db.checksum()) === lastChecksum;
     }
 
-    /** Checkpoint rows in the working copy — zero means no turn ever ran here. */
-    private async localTurnCount(db: DoSqliteDatabase): Promise<number> {
+    /** Whether the working copy holds a checkpoint — none means no turn ever ran here. */
+    private async hasLocalTurns(db: DoSqliteDatabase): Promise<boolean> {
       const row = await db
-        .get<{ n: number }>('SELECT count(*) AS n FROM checkpoints')
+        .get<{ one: number }>('SELECT 1 AS one FROM checkpoints LIMIT 1')
         .catch(() => undefined);
-      return row?.n ?? 0;
+      return row !== undefined;
+    }
+
+    /**
+     * Whether the working copy holds writes the owner store has not seen:
+     * marked dirty (in memory or on disk), or written past the generation
+     * of the last upload (`decideBootDirty`).
+     */
+    private async unflushedLocalWrites(db: DoSqliteDatabase): Promise<boolean> {
+      const got = await this.ctx.storage.get<unknown>([
+        META_DIRTY,
+        META_UPLOADED_GEN,
+      ]);
+      const decision = decideBootDirty({
+        dirtyInMemory: this.dirty,
+        dirtyFlag: got.get(META_DIRTY),
+        uploadedGen: got.get(META_UPLOADED_GEN),
+        writeGeneration: db.writeGeneration,
+      });
+      return (
+        decision === 'already-dirty' ||
+        decision === 'flagged' ||
+        decision === 'behind-upload'
+      );
     }
 
+    /**
+     * The working copy holds writes the owner store has not seen: persist the
+     * mark and make sure the upload is scheduled. Free once the copy is dirty
+     * with a known deadline — the alarm armed for it only ever moves earlier,
+     * and the tick that serves it re-arms whatever it leaves pending.
+     */
     private markDirty(): void {
+      if (this.dirty && typeof this.flushAt === 'number') return;
+      if (!this.dirty) void this.ctx.storage.put(META_DIRTY, true);
       this.dirty = true;
-      void this.ctx.storage.put(META_DIRTY, true);
       void this.armFlush(Date.now() + FLUSH_DEBOUNCE_MS);
     }
 
@@ -1404,12 +2008,16 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
      * `FLUSH_DEBOUNCE_MS` after the first of them, never later.
      */
     private async armFlush(at: number): Promise<void> {
-      const existing = await this.ctx.storage.get<number>(META_FLUSH_AT);
+      const existing =
+        typeof this.flushAt === 'number'
+          ? this.flushAt
+          : await this.ctx.storage.get<number>(META_FLUSH_AT);
       const deadline =
         typeof existing === 'number' && existing <= at ? existing : at;
+      this.flushAt = deadline;
       if (deadline !== existing)
         await this.ctx.storage.put(META_FLUSH_AT, deadline);
-      this.requestAlarm(deadline);
+      await this.requestHousekeeping(deadline);
     }
 
     /**
@@ -1417,17 +2025,47 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
      * that just came due (which would otherwise make every wake retry).
      */
     private async scheduleFlushRetry(at: number): Promise<void> {
+      this.flushAt = at;
       await this.ctx.storage.put(META_FLUSH_AT, at);
-      this.requestAlarm(at);
+      await this.requestHousekeeping(at);
+    }
+
+    private alarmArm: Promise<void> = Promise.resolve();
+
+    /**
+     * Arm the alarm for a deadline the full housekeeping tick serves (a
+     * flush, its retry, a task, compaction, a run's keep-alive or recovery),
+     * and lower the stored housekeeping deadline to it: the heartbeat fast
+     * path trusts that value, and a deadline it does not know of would wait
+     * for as long as a socket stays attached. Serialised with every other
+     * arm.
+     */
+    private requestHousekeeping(at: number): Promise<void> {
+      this.housekeepingFloor = Math.min(this.housekeepingFloor, at);
+      this.alarmArm = this.alarmArm
+        .catch(() => {})
+        .then(async () => {
+          const stored =
+            await this.ctx.storage.get<number>(META_HOUSEKEEPING_AT);
+          if (typeof stored === 'number' && stored > at)
+            await this.ctx.storage.put(META_HOUSEKEEPING_AT, at);
+          const existing = await this.ctx.storage.getAlarm();
+          if (existing === null || existing > at)
+            await this.ctx.storage.setAlarm(at);
+        });
+      return this.alarmArm;
     }
 
     /** Arm the object's single alarm no later than `at` (multiplexed). */
-    private requestAlarm(at: number): void {
-      void this.ctx.storage.getAlarm().then((existing) => {
-        if (existing === null || existing > at)
-          return this.ctx.storage.setAlarm(at);
-        return undefined;
-      });
+    private requestAlarm(at: number): Promise<void> {
+      this.alarmArm = this.alarmArm
+        .catch(() => {})
+        .then(async () => {
+          const existing = await this.ctx.storage.getAlarm();
+          if (existing === null || existing > at)
+            await this.ctx.storage.setAlarm(at);
+        });
+      return this.alarmArm;
     }
 
     /**
@@ -1452,8 +2090,17 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // exists once the object booted).
       const keepAliveAt = this.runs?.keepAliveDeadline(wakeAt) ?? null;
       const recoveryAt = this.runs?.nextRecoveryAt() ?? null;
-      if (this.runs && recoveryAt !== null && recoveryAt <= wakeAt + 1000)
-        await this.runs.resumeDue(wakeAt);
+      if (this.runs && recoveryAt !== null && recoveryAt <= wakeAt + 1000) {
+        // A store error here must not reject the alarm: the tick below (or
+        // the re-arm) still has to run.
+        try {
+          await this.runs.resumeDue(wakeAt);
+        } catch (err) {
+          console.error(
+            `[user-do] run recovery tick failed for ${this.userDid}: ${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+      }
       if (
         nextPingAt !== null &&
         housekeepingAt !== undefined &&
@@ -1461,28 +2108,33 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         keepAliveAt === null &&
         (recoveryAt === null || recoveryAt > wakeAt + 1000)
       ) {
-        await this.ctx.storage.setAlarm(
+        await this.requestAlarm(
           Math.min(nextPingAt, housekeepingAt, recoveryAt ?? Infinity),
         );
         return;
       }
 
+      // A full tick from here on. Deadlines armed while it runs (the boot
+      // below included) are kept by the housekeeping write at its end.
+      this.housekeepingFloor = Infinity;
+
       // Alarms routinely wake an EVICTED object: no db, no task scheduler,
       // dirty flag gone. Boot from the persisted identity first — a tick on
       // the un-booted object would skip every client and re-arm at the idle
-      // horizon, silently dropping pending task runs and flushes.
+      // horizon, silently dropping pending task runs and flushes. The boot
+      // is not a request: it records no access.
       if (!this.db) {
         const storedDid = await this.ctx.storage.get<string>(META_USER_DID);
         if (storedDid) {
           try {
-            await this.ready({ userDid: storedDid });
+            await this.ready({ userDid: storedDid }, { recordAccess: false });
           } catch (err) {
             console.error(
               `[user-do] alarm boot failed for ${storedDid}: ${err instanceof Error ? err.message : String(err)}`,
             );
             // State exists but could not be opened — retry soon instead of
             // falling through to a schedulerless re-arm.
-            await this.ctx.storage.setAlarm(Date.now() + 60_000);
+            await this.requestHousekeeping(Date.now() + 60_000);
             return;
           }
         }
@@ -1516,8 +2168,10 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           deadlines.push(Math.max(nextRecovery, now + 1000));
       }
 
-      const lastAccess =
-        (await this.ctx.storage.get<number>(META_LAST_ACCESS)) ?? now;
+      // The last real request, stored for the next instance before anything
+      // is decided on it.
+      await this.persistAccess();
+      const lastAccess = await this.lastAccess(now);
       const idle = now - lastAccess > IDLE_EVICT_MS;
 
       // Owner-store flush: only when its own deadline is due, or the copy
@@ -1548,14 +2202,15 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       }
 
       if (this.taskScheduler) {
+        let next: number | null;
         try {
-          await this.taskScheduler.onAlarm(now);
+          next = await this.taskScheduler.onAlarm(now);
         } catch (err) {
           console.error(
             `[user-do] task scheduler tick failed for ${this.userDid}: ${err instanceof Error ? err.message : String(err)}`,
           );
+          next = await this.taskScheduler.nextWakeAt().catch(() => null);
         }
-        const next = await this.taskScheduler.nextWakeAt().catch(() => null);
         if (next !== null) deadlines.push(Math.max(next, now + 1000));
       }
 
@@ -1585,24 +2240,39 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         if (next !== null) deadlines.push(next);
       }
 
-      // R2 page tier: move chunks no turn touched for a couple of days out
-      // of DO storage (see sqlite/page-tier.ts). After the flush above (the
-      // upload reads hot rows, not R2) and never over an in-flight one (it
-      // holds a snapshot). A pass is capped; more work re-arms soon.
+      // Expired ambient blobs (`blob:` keys), one page per tick while a
+      // sweep is under way, a new sweep at most hourly (a page read loads
+      // the whole values, and blobs live a day at most). Its follow-up is
+      // no reason to keep an idle copy: it is armed after the eviction
+      // decision below.
+      let blobSweepPending = false;
       if (
-        this.db?.tierEnabled &&
-        !this.flushInFlight &&
-        (this.runs?.activeCount ?? 0) === 0
+        this.blobSweepCursor !== null ||
+        this.lastBlobSweepAt === null ||
+        now - this.lastBlobSweepAt >= BLOB_SWEEP_INTERVAL_MS
       ) {
-        const next = await this.tierTick(this.db, now);
-        if (next !== null) deadlines.push(next);
+        if (this.blobSweepCursor === null) this.lastBlobSweepAt = now;
+        try {
+          const swept = await sweepExpiredBlobs(
+            this.ctx.storage,
+            this.blobSweepCursor ? { startAfter: this.blobSweepCursor } : {},
+          );
+          this.blobSweepCursor = swept.next;
+          blobSweepPending = swept.next !== null;
+        } catch (err) {
+          console.warn(
+            `[user-do] blob sweep failed for ${this.userDid}: ${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
       }
 
-      // Idle housekeeping: a user silent for a day loses the cached pages —
-      // their file is safe upstream, and we stop paying to store a copy. Never
-      // evict while tasks are scheduled: their runs ARE activity. The flush
-      // above ran first; the wipe additionally verifies the upstream copy
-      // matches the working copy, else the copy stays until it does.
+      // Idle housekeeping: a user silent for five days loses the cached
+      // pages — their file is safe upstream, and we stop paying to store a
+      // copy. Never evict while tasks are scheduled: their runs ARE
+      // activity. The flush above ran first; the wipe additionally verifies
+      // the upstream copy matches the working copy, else the copy stays
+      // until it does. The R2 tier's next pass is no reason to stay: the
+      // wipe deletes the object's R2 prefix with the working copy.
       if (
         idle &&
         !this.dirty &&
@@ -1610,27 +2280,82 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         deadlines.length === 0 &&
         (this.runs?.size ?? 0) === 0
       ) {
-        if (await this.ownerCopyIsCurrent(this.db)) {
-          await this.wipeWorkingCopy(this.db);
+        const db = this.db;
+        const outcome = await evictIdleWorkingCopy({
+          ownerCopyIsCurrent: () => this.ownerCopyIsCurrent(db),
+          stillIdle: () => this.stillIdle(db),
+          dropHandles: () => this.dropInMemoryState(),
+          wipe: () => {
+            const wipe = this.wipeWorkingCopy(db);
+            this.evicting = wipe
+              .catch(() => undefined)
+              .finally(() => {
+                this.evicting = null;
+              });
+            return wipe;
+          },
+        });
+        if (outcome === 'evicted') {
           await this.ctx.storage.delete(META_HOUSEKEEPING_AT);
           // An attached (idle) socket still needs its heartbeat rounds.
-          if (nextPingAt !== null) await this.ctx.storage.setAlarm(nextPingAt);
-          else await this.ctx.storage.deleteAlarm();
+          if (nextPingAt !== null) await this.requestAlarm(nextPingAt);
+          // A request that waited on the wipe has booted the object afresh
+          // and armed its own deadlines (a task Start's run): keep them.
+          else if (this.initPromise === null)
+            await this.ctx.storage.deleteAlarm();
           return;
         }
-        console.warn(
-          `[user-do] ${this.userDid} is idle but the owner copy is not verified current — keeping the working copy`,
-        );
-        deadlines.push(now + FLUSH_RETRY_DELAY_MS);
+        if (outcome === 'not-current') {
+          console.warn(
+            `[user-do] ${this.userDid} is idle but the owner copy is not verified current — keeping the working copy`,
+          );
+          deadlines.push(now + FLUSH_RETRY_DELAY_MS);
+        } else {
+          console.log(
+            `[user-do] ${this.userDid} became active during the idle check — keeping the working copy`,
+          );
+        }
+      }
+
+      // R2 page tier: move chunks no turn touched for a couple of days out
+      // of DO storage (see sqlite/page-tier.ts). After the flush above (the
+      // upload reads hot rows, not R2) and never over an in-flight one (it
+      // holds a snapshot). A pass is capped; more work re-arms soon.
+      if (
+        this.db?.tierEnabled &&
+        !this.flushInFlight &&
+        (this.runs?.activeCount ?? 0) === 0
+      ) {
+        const next = await this.tierTick(this.db, now);
+        if (next !== null) deadlines.push(next);
       }
+      if (blobSweepPending) deadlines.push(now + 60_000);
+
       deadlines.push(now + IDLE_EVICT_MS);
       const housekeeping = Math.min(...deadlines);
-      await this.ctx.storage.put(META_HOUSEKEEPING_AT, housekeeping);
-      await this.ctx.storage.setAlarm(
+      await this.storeHousekeeping(housekeeping);
+      await this.requestAlarm(
         nextPingAt === null ? housekeeping : Math.min(housekeeping, nextPingAt),
       );
     }
 
+    /**
+     * Record the next housekeeping deadline at the end of a full tick: the
+     * earliest the tick found, lowered by any deadline armed while it ran
+     * (an arm that lands after this write lowers it itself). Serialised
+     * with the arms, so neither overwrites the other.
+     */
+    private storeHousekeeping(at: number): Promise<void> {
+      this.alarmArm = this.alarmArm
+        .catch(() => {})
+        .then(async () => {
+          const deadline = Math.min(at, this.housekeepingFloor);
+          this.housekeepingFloor = Infinity;
+          await this.ctx.storage.put(META_HOUSEKEEPING_AT, deadline);
+        });
+      return this.alarmArm;
+    }
+
     /**
      * One page-tier eviction pass, at most once per `TIER_PASS_INTERVAL_MS`
      * (a pass that hit its segment cap re-arms in a minute). Returns the next
@@ -1687,7 +2412,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       if (!this.db) {
         const userDid =
           this.userDid ?? (await this.ctx.storage.get<string>(META_USER_DID));
-        if (userDid) await this.ready({ userDid });
+        if (userDid) await this.ready({ userDid }, { recordAccess: false });
       }
       if (!this.db) throw new Error('no working copy');
       if (this.flushInFlight) await this.flushInFlight.catch(() => undefined);
@@ -1747,14 +2472,20 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
 
     async createSession(
       identity: TurnIdentity,
-      o: { roomId?: string; sessionId?: string } = {},
+      o: { roomId?: string; sessionId?: string; markerTxnId?: string } = {},
     ): Promise<SessionSummary> {
       await this.ready(identity);
       const sessions = this.sessions!;
       // Like the Node runtime: creating a session sends the MOST RECENT
       // previous session's transcript to the memory engine, in the
-      // background — the new session never waits on it.
-      const { sessions: recent } = await sessions.listSessions(undefined, 1, 0);
+      // background — the new session never waits on it. Task runs are not
+      // conversations and are never indexed (`scheduleHistoryIndexing`).
+      const { sessions: recent } = await sessions.listSessions(
+        undefined,
+        1,
+        0,
+        TASK_SESSION_PREFIX,
+      );
       const previous = recent[0];
       if (previous) this.scheduleHistoryIndexing(previous.sessionId);
       let sessionId = o.sessionId;
@@ -1782,7 +2513,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           // the same transaction id across the restart window, which the
           // homeserver deduplicates. Node fails the request on send failure;
           // so do we — no silent local id when the user has an oracle room.
-          const txnId = `marker-${crypto.randomUUID()}`;
+          const txnId = o.markerTxnId ?? `marker-${crypto.randomUUID()}`;
           sessionId = await retryGateway(
             () =>
               this.gateway.sendText(room.roomId, NEW_CONVERSATION_TEXT, {
@@ -1802,6 +2533,10 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         }
       }
       sessionId ??= `s_${crypto.randomUUID()}`;
+      if (o.markerTxnId) {
+        const existing = await sessions.getSession(sessionId);
+        if (existing) return toSummary(existing);
+      }
       const row = await sessions.createSession({
         sessionId,
         roomId,
@@ -1813,6 +2548,30 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       return toSummary(row);
     }
 
+    async channelTurn(
+      identity: TurnIdentity,
+      input: ChannelTurnInput,
+      requestHash: string,
+    ): Promise<ChannelTurnOutcome> {
+      try {
+        if (identity.ucanDelegation)
+          throw new ChannelError(
+            403,
+            'Channel grants cannot become tool authority',
+          );
+        // The shell (the only caller) checked the binding just before.
+        await this.ready(identity);
+        return {
+          ok: true,
+          result: await this.channelTurns!.submit(identity, input, requestHash),
+        };
+      } catch (error) {
+        if (error instanceof ChannelError)
+          return { ok: false, status: error.status, message: error.message };
+        throw error;
+      }
+    }
+
     async listSessions(
       identity: TurnIdentity,
       o: { limit?: number; offset?: number } = {},
@@ -1853,12 +2612,17 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       sessionId: string,
     ): Promise<boolean> {
       await this.ready(identity);
+      // End every run of the session first: the executing one is aborted
+      // and waited for (up to the supersede grace), queued and recovering
+      // ones are closed — none may start a turn on the deleted thread, or
+      // recreate its session row, after the rows below are gone.
+      await this.runs?.abortAllForSession(sessionId);
       this.aborts.get(sessionId)?.abort();
       // Node indexes a session into the memory engine as it is deleted.
       // The rows are gone once this RPC returns, so capture the transcript
       // now and let the background indexer read the snapshot.
       const doomed = await this.sessions!.getSession(sessionId);
-      if (doomed) {
+      if (doomed && !sessionId.startsWith(TASK_SESSION_PREFIX)) {
         this.historySnapshots.set(sessionId, {
           session: doomed,
           messages: await this.historyMessages(sessionId),
@@ -1868,6 +2632,13 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const deleted = await this.sessions!.deleteSession(sessionId);
       if (deleted) {
         await this.saver!.deleteThread(sessionId);
+        await this.attachmentTextCache
+          ?.forgetSession(sessionId)
+          .catch((err: unknown) => {
+            console.warn(
+              `[user-do] could not delete the cached attachment text of ${sessionId}: ${err instanceof Error ? err.message : String(err)}`,
+            );
+          });
         await this.resultStore
           ?.deleteForSession(sessionId)
           .catch((err: unknown) => {
@@ -1875,12 +2646,60 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
               `[user-do] could not delete the saved tool results of ${sessionId}: ${err instanceof Error ? err.message : String(err)}`,
             );
           });
+        await this.artifacts
+          ?.deleteForSession(sessionId)
+          .catch((err: unknown) => {
+            console.warn(
+              `[user-do] could not delete the artefacts of ${sessionId}; their links expire on schedule: ${err instanceof Error ? err.message : String(err)}`,
+            );
+          });
         await this.ctx.storage.delete(contextStatsKey(sessionId));
+        await this.feedbackMarkers!.forgetSession(sessionId);
         this.markDirty();
       }
+      // A channel binding that pointed at the session opens a new one on
+      // its next message instead of failing the session check for ever.
+      if (await this.channelTurns!.forgetSession(sessionId)) this.markDirty();
       return deleted;
     }
 
+    /**
+     * `GET /artifacts/:id` — the canonical copy, for its owner. `url` is
+     * present only while the share link still works.
+     */
+    async artifact(
+      identity: TurnIdentity,
+      artifactId: string,
+    ): Promise<OwnedArtifact | null> {
+      await this.ready(identity);
+      const stored = await this.artifacts?.get(artifactId);
+      if (!stored) return null;
+      const { url, ...ref } = stored.ref;
+      const live =
+        url !== undefined &&
+        !stored.revoked &&
+        Date.parse(ref.expiresAt) > Date.now();
+      return {
+        ...ref,
+        ...(live ? { url } : {}),
+        sessionId: stored.sessionId,
+        createdAt: stored.createdAt,
+        revoked: stored.revoked,
+        content: stored.content,
+      };
+    }
+
+    /** `DELETE /artifacts/:id` — revoke the share link; the canonical copy stays. */
+    async revokeArtifact(
+      identity: TurnIdentity,
+      artifactId: string,
+    ): Promise<boolean> {
+      await this.ready(identity);
+      const revoked = (await this.artifacts?.revoke(artifactId)) ?? false;
+      if (revoked) this.markDirty();
+      return revoked;
+    }
+
     /** The session transcript as the indexer wants it (summarisation bookkeeping removed). */
     private async historyMessages(
       sessionId: string,
@@ -1890,7 +2709,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         .filter(
           (m) => !isSummarizationMessage(m) && !isAttachmentViewMessage(m),
         )
-        .map((m) => ({ type: m.type, content: contentToText(m.content) }));
+        .map((m) => ({ type: m.type, content: visibleText(m) }));
     }
 
     /**
@@ -1899,8 +2718,14 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
      * seeded from the row's `lastProcessedCount` for files migrated from Node;
      * `touchSession` is not used because it bumps `last_updated_at` and
      * would reorder the session list.
+     *
+     * Task-run sessions (`task:<id>`) are never indexed: a run's transcript
+     * is the task's instructions and its result, not something the user
+     * said, and a supplied-context task's source text must not become
+     * long-term memory that ordinary, tool-enabled turns can retrieve.
      */
     private scheduleHistoryIndexing(sessionId: string): void {
+      if (sessionId.startsWith(TASK_SESSION_PREFIX)) return;
       const ambient = this.ambient;
       const userDid = this.userDid;
       if (!ambient || !this.sessions || !userDid) return;
@@ -1984,6 +2809,57 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       return JSON.stringify(dtos);
     }
 
+    /**
+     * Anonymous feedback, step one (src/feedback/submit.ts): the message must
+     * be a completed Agent reply in this user's own session; then the
+     * idempotency marker and the user's submission limit decide. The shell
+     * holds the feedback text; it never reaches this object.
+     */
+    async reserveMessageFeedback(
+      identity: TurnIdentity,
+      target: FeedbackTarget,
+    ): Promise<FeedbackReservation> {
+      await this.ready(identity);
+      const reservation = await reserveFeedback(
+        {
+          sessionExists: async (sessionId) =>
+            (await this.sessions!.getSession(sessionId)) !== undefined,
+          transcript: async (sessionId) =>
+            (
+              await transformTranscript(
+                (await this.saver!.listThreadMessages(sessionId)).filter(
+                  (m) => !isSummarizationMessage(m),
+                ),
+              )
+            ).messages,
+          // A queued run has not written its user message yet, so it does
+          // not make the latest reply incomplete; a running one has.
+          runActive: async (sessionId) => {
+            const status = (
+              this.runs?.activeForSession(sessionId)?.record ??
+              (await this.runStore?.activeForSession(sessionId))
+            )?.status;
+            return status === 'running' || status === 'recovering';
+          },
+          markers: this.feedbackMarkers!,
+        },
+        target,
+      );
+      if (reservation.kind === 'reserved') this.markDirty();
+      return reservation;
+    }
+
+    /** Anonymous feedback, step two: settle the reservation (`FeedbackMarkers.settle`). */
+    async settleMessageFeedback(
+      identity: TurnIdentity,
+      target: FeedbackTarget,
+      outcome: FeedbackSettlement,
+    ): Promise<void> {
+      await this.ready(identity);
+      await this.feedbackMarkers!.settle(target, outcome);
+      this.markDirty();
+    }
+
     async listMessagesPage(
       identity: TurnIdentity,
       sessionId: string,
@@ -2192,6 +3068,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             sessionId: req.sessionId,
             requestId: req.requestId,
             text: existing?.replyText ?? '',
+            ...(existing?.replyPlan ? { plan: existing.replyPlan } : {}),
             toolCalls: [],
             replayed: true,
           };
@@ -2211,7 +3088,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       await ledger.start(eventId, req.sessionId, req.requestId);
       const run = this.runTurnOnce(req)
         .then(async (result) => {
-          await ledger.answer(eventId, result.text);
+          await ledger.answer(eventId, result.text, result.plan);
           return result;
         })
         .finally(() => {
@@ -2259,7 +3136,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         sessionId: req.sessionId,
         requestId: req.requestId,
         client: req.client,
-        request: JSON.stringify(
+        request: this.runRequestJson(
+          req,
           storedRunRequest(req, { timezone: req.identity.timezone }),
         ),
         multitask: req.multitask ?? this.runConfig.multitaskDefault,
@@ -2280,6 +3158,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         sessionId: req.sessionId,
         requestId: req.requestId,
         text: outcome.text,
+        ...(outcome.plan ? { plan: JSON.stringify(outcome.plan) } : {}),
         ...(outcome.messageId !== undefined
           ? { messageId: outcome.messageId }
           : {}),
@@ -2306,6 +3185,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           sessionId: req.sessionId,
           requestId: req.requestId,
           text: outcome.text,
+          ...(outcome.plan ? { plan: JSON.stringify(outcome.plan) } : {}),
           ...(outcome.messageId ? { messageId: outcome.messageId } : {}),
           toolCalls: outcome.toolCalls ?? [],
           replayed: true,
@@ -2313,10 +3193,12 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       }
       const record = await this.runStore?.getByRequestId(requestId);
       if (record?.status === 'finished') {
+        const plan = parseReplyPlan(await this.runStore!.getPlan(record.runId));
         return {
           sessionId: req.sessionId,
           requestId: req.requestId,
           text: record.partialText ?? '',
+          ...(plan ? { plan: JSON.stringify(plan) } : {}),
           ...(record.messageId ? { messageId: record.messageId } : {}),
           toolCalls: [],
           replayed: true,
@@ -2359,6 +3241,11 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         // One export at the end, not per batch — flushing a multi-GB file
         // after every 300 rows would dwarf the savings.
         this.markDirty();
+      } else if (await this.unflushedLocalWrites(db)) {
+        // Nothing saved, but the closing vacuum rewrote the file: an
+        // unmarked write would keep the owner copy unverifiable, and the
+        // idle wipe waiting on it, until some later boot noticed.
+        this.markDirty();
       }
       return false;
     }
@@ -2421,7 +3308,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         // an operator's `POST /debug/storage/flush` is never a silent no-op.
         const userDid =
           this.userDid ?? (await this.ctx.storage.get<string>(META_USER_DID));
-        if (userDid) await this.ready({ userDid });
+        if (userDid) await this.ready({ userDid }, { recordAccess: false });
       }
       if (this.flushInFlight) return this.flushInFlight;
       const run = this.flushOnce().finally(() => {
@@ -2521,7 +3408,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // Defence in depth: never drop the backstop for an empty working copy —
       // a zero-turn file is not worth confirming against, and redacting here
       // would strip a migrated user's only history if VFS held a stub.
-      if (this.db && (await this.localTurnCount(this.db)) === 0) return false;
+      if (this.db && !(await this.hasLocalTurns(this.db))) return false;
       try {
         const removed = await store.removeLegacyCopy(etag);
         await this.ctx.storage.put(META_LEGACY_CLEARED, true);
@@ -2573,21 +3460,36 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         uploadedGen !== this.db.writeGeneration
       ) {
         const at = Date.now() + FLUSH_DEBOUNCE_MS;
+        this.flushAt = at;
         await this.ctx.storage.put(META_FLUSH_AT, at);
-        this.requestAlarm(at);
+        await this.requestHousekeeping(at);
         return;
       }
       this.dirty = false;
+      this.flushAt = null;
       await this.ctx.storage.delete([META_DIRTY, META_FLUSH_AT]);
     }
 
-    async resetWorkingCopy(): Promise<{ reloadedFromOwnerStore: boolean }> {
+    /**
+     * `POST /debug/storage/reset`: upload what is unsaved, drop the working
+     * copy and boot again from the owner copy. `identity` is the caller the
+     * shell authenticated, with the delegation the request carried: an
+     * object that never booted boots for it (the owner store needs that
+     * delegation), and an object bound to another DID refuses before
+     * anything is dropped.
+     */
+    async resetWorkingCopy(
+      identity?: TurnIdentity,
+    ): Promise<{ reloadedFromOwnerStore: boolean }> {
       const userDid =
-        this.userDid ?? (await this.ctx.storage.get<string>(META_USER_DID));
+        identity?.userDid ??
+        this.userDid ??
+        (await this.ctx.storage.get<string>(META_USER_DID));
+      const caller = identity ?? (userDid ? { userDid } : undefined);
       // On a cold (evicted) object the in-memory dirty flag is gone — boot and
       // consult the persisted marker, or the wipe below discards changes the
-      // owner store never received.
-      if (!this.db && userDid) await this.ready({ userDid });
+      // owner store never received. A booted object only checks the caller.
+      if (caller) await this.ready(caller, { recordAccess: false });
       if (
         this.dirty ||
         (await this.ctx.storage.get<boolean>(META_DIRTY)) === true
@@ -2596,21 +3498,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         await this.flushToOwnerStore();
       }
       await this.wipeWorkingCopy(this.db);
-      this.db = null;
-      this.saver = null;
-      this.sessions = null;
-      this.matrixLedger = null;
-      this.runStore = null;
-      this.runs = null;
-      this.resultStore = null;
-      this.sessionRooms.clear();
-      this.mainRoomId = null;
-      this.ambient = null;
-      this.secretsService = null;
-      this.byo = null;
-      this.initPromise = null;
-      this.reloadedFromOwnerStore = false;
-      if (userDid) await this.ready({ userDid });
+      this.dropInMemoryState();
+      if (caller) await this.ready(caller, { recordAccess: false });
       return { reloadedFromOwnerStore: this.reloadedFromOwnerStore };
     }
 
@@ -2624,7 +3513,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       userDid: string,
       sessionId: string,
     ): Promise<Record<string, unknown> | null> {
-      await this.ready({ userDid });
+      await this.ready({ userDid }, { recordAccess: false });
       const session = await this.sessions!.getSession(sessionId);
       if (!session) return null;
       // Whether the thread's agent context was condensed: the summarization
@@ -2656,7 +3545,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     }
 
     async debugMemorySchema(userDid: string): Promise<MemorySchemaDebug> {
-      await this.ready({ userDid });
+      await this.ready({ userDid }, { recordAccess: false });
       const ambient = this.ambient;
       const url = this.core.validatedEnv['MEMORY_MCP_URL'];
       if (!ambient || typeof url !== 'string' || url.length === 0) {
@@ -2719,7 +3608,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         lastVacuumAt: await this.ctx.storage.get<number>(META_LAST_VACUUM),
         legacyCleared:
           (await this.ctx.storage.get<boolean>(META_LEGACY_CLEARED)) === true,
-        lastAccessAt: await this.ctx.storage.get<number>(META_LAST_ACCESS),
+        lastAccessAt: await this.knownLastAccess(),
         indexingInFlight: this.historyIndexer?.inFlightCount ?? 0,
         activeTurns: this.aborts.size,
         pendingTimers: timerTrackerInstalled()
@@ -2754,6 +3643,49 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       };
     }
 
+    async topicDeliverable(
+      identity: TurnIdentity,
+      operationId: string,
+      command: TopicDeliverableCommand,
+    ): Promise<TopicDeliverableResult> {
+      if (this.env.TOPIC_DELIVERABLES_ENABLED !== 'true')
+        return { ok: false, status: 404, message: 'Not found.' };
+      TopicOperationId.parse(operationId);
+      // Like every request: waits out an idle eviction in progress and
+      // records the access, so the idle tick re-reads this as activity.
+      await this.ready(identity);
+      const scheduler = this.taskScheduler;
+      const db = this.db;
+      if (!scheduler || !db) throw new Error('Task scheduler unavailable');
+      // Start and cancel write the task row outside any turn; nothing else
+      // would schedule their upload (and an unmarked write keeps the owner
+      // copy "not current", which blocks eviction for good). A write that
+      // committed before a later step threw (the alarm arm) counts too.
+      const execute = (): Promise<TopicDeliverableResult> => {
+        switch (command.action) {
+          case 'start':
+            return scheduler.startTopicDeliverable(
+              operationId,
+              TopicDeliverableRequestSchema.parse(command.request),
+            );
+          case 'read':
+            return scheduler.readTopicDeliverable(operationId);
+          case 'cancel':
+            return scheduler.cancelTopicDeliverable(
+              operationId,
+              TopicDeliverableRequestSchema.parse(command.request),
+            );
+        }
+      };
+      const generation = db.writeGeneration;
+      try {
+        return await execute();
+      } finally {
+        if (this.db === db && db.writeGeneration !== generation)
+          this.markDirty();
+      }
+    }
+
     async tasksStatus(userDid?: string): Promise<{
       now: number;
       alarm: number | null;
@@ -2781,7 +3713,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       if (!this.taskScheduler) {
         const did =
           userDid ?? (await this.ctx.storage.get<string>(META_USER_DID));
-        if (did) await this.ready({ userDid: did });
+        if (did) await this.ready({ userDid: did }, { recordAccess: false });
       }
       const records = this.taskScheduler
         ? await this.taskScheduler.surface.list()
@@ -2831,13 +3763,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           }
           if (auth.ucanDelegation)
             headers.set('x-ucan-delegation', auth.ucanDelegation);
-          return authenticate(headers, {
-            oracleDid: this.env.ORACLE_DID,
-            blocksyncUri: this.env.BLOCKSYNC_GRAPHQL_URL,
-            maxTtlSeconds: this.env.UCAN_AUTH_MAX_TTL_SECONDS
-              ? Number(this.env.UCAN_AUTH_MAX_TTL_SECONDS)
-              : undefined,
-          });
+          return authenticate(headers, authConfigFromEnv(this.env));
         },
         sessionExists: async (userDid, sessionId) => {
           await this.ready({ userDid });
@@ -2845,7 +3771,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         },
         router: this.events,
         logger: console,
-        requestAlarm: (at) => this.requestAlarm(at),
+        requestAlarm: (at) => this.ctx.waitUntil(this.requestAlarm(at)),
         // Node indexes a session into the memory engine when its last socket
         // disconnects (`WsService.removeClientConnection`); same trigger here.
         onSessionDrained: (sessionId) =>
@@ -2975,10 +3901,10 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       };
       const stream = body.stream !== false;
       if (!stream) {
-        this.replayToRoom(req, body.message, 'user');
+        void this.replayToRoom(req, body.message, 'user');
         try {
           const result = await this.runTurn(req);
-          this.replayToRoom(req, result.text, 'oracle');
+          void this.replayToRoom(req, result.text, 'oracle');
           // Node's `SendMessageResponse.message` is `{ type, content, id }`.
           const payload: Record<string, unknown> = {
             message: {
@@ -3011,13 +3937,14 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // A streamed turn is a durable run: recorded, kept alive and resumable
       // (docs/plans/durable-runs.md). The response is one subscriber of the
       // run's buffer; the run itself outlives it.
-      this.replayToRoom(req, body.message, 'user');
+      void this.replayToRoom(req, body.message, 'user');
       const { live, queued } = await this.runs!.begin({
         runId: crypto.randomUUID(),
         sessionId,
         requestId,
         client: 'portal',
-        request: JSON.stringify(
+        request: this.runRequestJson(
+          req,
           storedRunRequest(req, {
             timezone: body.timezone,
             tools: body.tools,
@@ -3112,6 +4039,23 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       });
     }
 
+    /**
+     * The stored request of a new run. When no admission handler can see the
+     * turn (no plugin declares one, or the turn is out of admission's scope)
+     * it is recorded as an agent turn from the start, which spares the first
+     * attempt both rewrites of the row (`admitting`, then `agent`). Recovery
+     * stays correct: a run the graph never checkpointed is retried with its
+     * input whatever its disposition.
+     */
+    private runRequestJson(req: TurnRequest, stored: StoredRunRequest): string {
+      const admissible =
+        admissionApplies(req) &&
+        this.core.plugins.some((plugin) => plugin.getRequestAdmission);
+      return JSON.stringify(
+        admissible ? stored : { ...stored, disposition: { kind: 'agent' } },
+      );
+    }
+
     /**
      * One attempt of a run (the coordinator's `runAttempt` host hook): build
      * the agent for the stored request, stream the turn's frames into the
@@ -3125,6 +4069,100 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     ): Promise<RunOutcome> {
       const stored = JSON.parse(live.record.request) as StoredRunRequest;
       const req = stored.turn;
+      if (req.client === 'channel') {
+        await this.ctx.storage.sync();
+        // The binding was checked as the request was admitted; a queued or
+        // recovered attempt starts later and checks it again.
+        if (live.attemptSource !== 'begin')
+          await assertChannelAttemptAllowed(req.identity, this.env);
+        requireChannelDelegation(
+          !!this.delegations.get(req.identity.userDid)?.raw,
+        );
+      }
+      // An attempt that starts from `admitting` never reached the agent (the
+      // previous incarnation stopped during admission), so the user's message
+      // is not in the graph: the agent runs with its input, not from the
+      // checkpoint.
+      const freshInput = !resumed || stored.disposition?.kind === 'admitting';
+      let announced = resumed;
+      const announce = (): void => {
+        if (announced) return;
+        announced = true;
+        live.buffer.push('run', {
+          runId: live.runId,
+          sessionId: req.sessionId,
+          requestId: req.requestId,
+        });
+      };
+      if (!stored.disposition && !resumed) {
+        stored.disposition = { kind: 'admitting' };
+        const request = JSON.stringify(stored);
+        await this.runStore!.update(live.runId, { request });
+        live.record.request = request;
+      }
+      if (!stored.disposition || stored.disposition.kind === 'admitting') {
+        let admission: RequestAdmissionResult = { kind: 'pass' };
+        try {
+          if (stored.disposition?.kind === 'admitting' && admissionApplies(req))
+            admission = await admitRequest(
+              this.core.plugins,
+              {
+                user: {
+                  did: req.identity.userDid,
+                  matrixUserId: req.identity.matrixUserId ?? '',
+                  ucanDelegation: { raw: req.identity.ucanDelegation ?? '' },
+                  timezone: req.identity.timezone,
+                  currentTime: new Date().toISOString(),
+                },
+                session: {
+                  id: req.sessionId,
+                  client: req.client,
+                  requestId: req.requestId,
+                  roomId:
+                    req.roomId ??
+                    (await this.sessions!.getSession(req.sessionId))?.roomId,
+                  ...(req.roomKind ? { roomKind: req.roomKind } : {}),
+                  ...(req.eventId ? { eventId: req.eventId } : {}),
+                  ...(req.threadId ? { threadId: req.threadId } : {}),
+                },
+                message: req.message,
+                metadata: admissionMetadata(req.metadata),
+                signal: live.abort.signal,
+              },
+              {
+                env: this.core.validatedEnv,
+                timeoutMs: admissionTimeoutMs(this.core.validatedEnv),
+                warn: (m) => console.warn(`[user-do] ${m}`),
+              },
+            );
+        } catch (error) {
+          return this.refuseTurn(live, req, error, announce, 'admission');
+        }
+        stored.disposition =
+          admission.kind === 'handled'
+            ? {
+                kind: 'direct-read',
+                text: admission.text,
+                title: admission.title,
+                messageId: `direct:${req.sessionId}:${req.requestId}:ai`,
+              }
+            : { kind: 'agent' };
+        const request = JSON.stringify(stored);
+        await this.runStore!.update(live.runId, { request });
+        live.record.request = request;
+      }
+      if (stored.disposition.kind === 'direct-read') {
+        try {
+          return await this.runDirectRead(
+            live,
+            req,
+            stored.disposition,
+            announce,
+          );
+        } catch (error) {
+          return this.refuseTurn(live, req, error, announce, 'direct read');
+        }
+      }
       const {
         agent,
         stateInput,
@@ -3133,6 +4171,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         byoNotice,
         byoProvider,
         toolOutputCapChars,
+        delivery,
+        usage,
       } = await this.prepareTurn(
         req,
         {
@@ -3141,13 +4181,13 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           model: req.model,
           tools: stored.tools,
           agActions: stored.agActions,
-          ...(resumed ? {} : { attachments: req.attachments }),
+          ...(freshInput ? { attachments: req.attachments } : {}),
         },
         {
           runId: live.runId,
           abortController: live.abort,
-          resumed,
-          continuation: resumed ? live.continuation : null,
+          resumed: !freshInput,
+          continuation: freshInput ? null : live.continuation,
         },
       );
       const sessionId = req.sessionId;
@@ -3157,20 +4197,22 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           live.buffer.push(eventName, payload);
         },
       };
-      this.events.register(sessionId, sink);
-      if (byoNotice)
-        sink.emit('error', {
-          ...byoNotice,
-          sessionId,
-          requestId: req.requestId,
-        });
-      const events = agent.streamEvents(resumed ? null : stateInput, {
-        ...config,
-        version: 'v2',
-      });
       const capture: BaseMessage[] = [];
       let completed = false;
+      // Everything after `prepareTurn` runs inside the try: its cleanups
+      // (the turn's deadline timer among them) run however the attempt ends.
       try {
+        this.events.register(sessionId, sink);
+        if (byoNotice)
+          sink.emit('error', {
+            ...byoNotice,
+            sessionId,
+            requestId: req.requestId,
+          });
+        const events = agent.streamEvents(freshInput ? stateInput : null, {
+          ...config,
+          version: 'v2',
+        });
         const outcome = await runTurnFrames({
           events: tapMessages(events, capture),
           sink: live.buffer,
@@ -3188,8 +4230,14 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           onFrame: () => this.runs?.touchKeepAlive(),
           onComplete: async () => {
             completed = true;
-            this.replayToRoom(req, lastAiText(capture), 'oracle');
-            await this.afterTurn(sessionId, capture);
+            if (req.client !== 'channel')
+              void this.replayToRoom(req, lastAiText(capture), 'oracle');
+            await this.afterTurn(
+              sessionId,
+              capture,
+              { kind: 'agent' },
+              live.abort.signal,
+            );
           },
           onError: (err) => {
             console.error(`[user-do] turn ${req.requestId} failed:`, err);
@@ -3204,8 +4252,18 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
               status: 'done' as const,
             })),
           );
-        const text = completed ? lastAiText(capture) : outcome.fullText;
         const messageId = completed ? lastAiMessageId(capture) : undefined;
+        // A chat surface also gets its reply as a plan. `text` stays the
+        // model's own text on every surface: stored results (task runs, the
+        // run record, the Matrix ledger) never hold a chat rendering whose
+        // links expire.
+        const plan =
+          completed && delivery.kind === 'chat'
+            ? await this.replyPlanOf(live, req, capture, delivery)
+            : undefined;
+        const text =
+          (live.continuation ?? '') +
+          (completed ? lastAiText(capture) : outcome.fullText);
         return {
           status:
             outcome.status === 'completed'
@@ -3213,10 +4271,13 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
               : outcome.status === 'aborted'
                 ? 'aborted'
                 : 'failed',
-          text: (live.continuation ?? '') + text,
+          text,
+          ...(plan ? { plan } : {}),
           ...(messageId ? { messageId } : {}),
           toolCalls,
           ...(outcome.status === 'failed' ? { error: outcome.error } : {}),
+          // Written with the terminal status: one row update per run.
+          usage: usage(),
         };
       } finally {
         this.events.unregister(sessionId, sink);
@@ -3226,6 +4287,178 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       }
     }
 
+    /**
+     * The Reply Plan of a finished chat-surface run, built once from the
+     * turn's messages and kept with the run (`/channels/turn` polls read it
+     * back). A long step becomes an artefact when storage is configured; an
+     * artefact that fails falls back to plain messages.
+     */
+    private async replyPlanOf(
+      live: LiveRun,
+      req: TurnRequest,
+      capture: BaseMessage[],
+      delivery: Extract<DeliveryProfile, { kind: 'chat' }>,
+    ): Promise<ReplyPlan> {
+      const artifacts = this.artifacts?.canShare ? this.artifacts : null;
+      const { steps, toolResults } = turnSteps(capture);
+      const draft = draftReplyPlan({
+        steps,
+        toolResults,
+        continuation: live.continuation,
+        limits: delivery.limits,
+        canSpill: artifacts !== null,
+      });
+      const plan = await materializeReplyPlan(draft, {
+        limits: delivery.limits,
+        createSpill: async (key, spill) => {
+          if (!artifacts)
+            throw new Error('artifacts: storage is not configured');
+          return artifacts.create({
+            artifactId: await artifactIdFor(live.runId, `spill:${key}`),
+            sessionId: req.sessionId,
+            runId: live.runId,
+            title: spill.title,
+            content: spill.markdown,
+          });
+        },
+        onSpillError: (error) =>
+          console.warn(
+            `[delivery] run ${live.runId}: could not store a long reply as an artefact; sending it as messages: ${error instanceof Error ? error.message : String(error)}`,
+          ),
+      });
+      await this.runStore!.setPlan(live.runId, JSON.stringify(plan));
+      console.log(
+        `[delivery] run ${live.runId}: ${delivery.surface} reply in ${plan.parts.length} parts (${plan.parts.filter((p) => p.kind === 'artifact').length} artefacts)`,
+      );
+      return plan;
+    }
+
+    private async runDirectRead(
+      live: LiveRun,
+      req: TurnRequest,
+      disposition: Extract<RequestDisposition, { kind: 'direct-read' }>,
+      announce: () => void,
+    ): Promise<RunOutcome> {
+      live.abort.signal.throwIfAborted();
+      announce();
+      const sessions = this.sessions!;
+      if (
+        req.client === 'matrix' &&
+        !(await sessions.getSession(req.sessionId))
+      ) {
+        await sessions.createSession({
+          sessionId: req.sessionId,
+          roomId: req.roomId,
+          oracleName: this.core.identity.name,
+          oracleDid: this.env.ORACLE_DID,
+          oracleEntityDid: this.core.identity.entityDid,
+        });
+      }
+      const kwargs = {
+        timestamp: new Date().toISOString(),
+        oracleName: this.core.identity.name,
+        msgFromMatrixRoom: req.client === 'matrix',
+        ...(req.client === 'matrix'
+          ? {
+              senderDid: req.identity.userDid,
+              senderMatrixUserId: req.identity.matrixUserId,
+              senderDisplayName: req.senderDisplayName ?? req.identity.userDid,
+              threadId: req.sessionId,
+              eventId: req.eventId,
+            }
+          : {}),
+      };
+      const messages = [
+        new HumanMessage({
+          id: `direct:${req.sessionId}:${req.requestId}:human`,
+          content:
+            req.client === 'matrix' && req.roomKind === 'group'
+              ? prefixSpeaker(
+                  req.message,
+                  req.senderDisplayName ??
+                    req.identity.matrixUserId ??
+                    req.identity.userDid,
+                )
+              : req.message,
+          additional_kwargs: kwargs,
+        }),
+        new AIMessage({
+          id: disposition.messageId,
+          content: disposition.text,
+          additional_kwargs: {
+            timestamp: kwargs.timestamp,
+            oracleName: kwargs.oracleName,
+            msgFromMatrixRoom: kwargs.msgFromMatrixRoom,
+          },
+        }),
+      ];
+      await this.saver!.appendTurnMessages(req.sessionId, messages);
+      // An abort that lands now ends the run as `aborted`; the reply stays
+      // in the transcript (the Matrix mirror and the title are skipped).
+      live.abort.signal.throwIfAborted();
+      await this.afterTurn(req.sessionId, messages, disposition);
+      // A channel's reply reaches the room through the channel's own
+      // delivery (`onRunEnded`), as on the agent path; its mirror is the
+      // required kind, whose failure would surface here unhandled.
+      if (req.client !== 'channel')
+        void this.replayToRoom(req, disposition.text, 'oracle');
+      const delivered = live.continuation ?? '';
+      const content = disposition.text.startsWith(delivered)
+        ? disposition.text.slice(delivered.length)
+        : disposition.text;
+      if (content)
+        live.buffer.push('message', { content, timestamp: kwargs.timestamp });
+      live.buffer.push('done', {
+        runId: live.runId,
+        messageId: disposition.messageId,
+      });
+      return {
+        status: 'finished',
+        text: disposition.text,
+        messageId: disposition.messageId,
+        toolCalls: [],
+      };
+    }
+
+    /**
+     * End a turn whose admission or direct read did not complete. The client
+     * gets the same terminal frames as a failed agent turn (`error`, then
+     * `done`) or, after a user abort or a superseding message, `done` with
+     * `aborted`. The handler's own message goes to the log only.
+     */
+    private refuseTurn(
+      live: LiveRun,
+      req: TurnRequest,
+      error: unknown,
+      announce: () => void,
+      stage: 'admission' | 'direct read',
+    ): RunOutcome {
+      announce();
+      if (live.abort.signal.aborted) {
+        live.buffer.push('done', { runId: live.runId, aborted: true });
+        return { status: 'aborted', text: live.continuation ?? '' };
+      }
+      console.error(
+        `[user-do] turn ${req.requestId}: ${stage} failed: ${error instanceof Error ? error.message : String(error)}`,
+      );
+      live.buffer.push('error', {
+        error: 'This request could not be answered. Please try again.',
+        kind: 'request_admission',
+        source: 'platform',
+        retryable: true,
+        sessionId: req.sessionId,
+        requestId: req.requestId,
+        runId: live.runId,
+        timestamp: new Date().toISOString(),
+      });
+      live.buffer.push('done', { runId: live.runId, failed: true });
+      return {
+        status: 'failed',
+        text: live.continuation ?? '',
+        error: new Error(`request ${stage} failed`),
+      };
+    }
+
     /** Latest checkpoint id of a session — recovery's progress marker. */
     private async checkpointIdOf(sessionId: string): Promise<string | null> {
       const tuple = await this.saver
@@ -3243,6 +4476,16 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       record: RunRecord,
       outcome: RunOutcome,
     ): Promise<void> {
+      if (record.client === 'channel' && outcome.status === 'finished') {
+        const stored = JSON.parse(record.request) as StoredRunRequest;
+        // Without the handle (a reset dropped it mid-run) the next poll of
+        // the request delivers the reply instead.
+        await this.channelTurns?.deliverReply(
+          stored.turn,
+          record.runId,
+          outcome.text,
+        );
+      }
       if (!record.taskRunId || !this.taskScheduler) return;
       if (this.taskScheduler.isRunActive(record.taskRunId)) return;
       if (outcome.status === 'finished')
@@ -3288,7 +4531,15 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const window = await this.contextWindows.resolve(modelId, {
         ...(byoProvider ? { byoProvider } : {}),
       });
-      const budget = contextBudgetFor(window, contextKnobs(this.env, console));
+      const budget = contextBudgetFor(
+        window,
+        contextKnobs(this.env, console),
+        await this.contextWindows.resolve(
+          llm && isProviderAdapter(llm)
+            ? llm.modelForRole('routing')
+            : OPENROUTER_MODEL_MAP.routing,
+        ),
+      );
       const stats = (await this.resultStore?.stats()) ?? {
         rows: 0,
         sqliteBytes: 0,
@@ -3403,7 +4654,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     async runsStatus(): Promise<RunsStatus> {
       const userDid =
         this.userDid ?? (await this.ctx.storage.get<string>(META_USER_DID));
-      if (!this.db && userDid) await this.ready({ userDid });
+      if (!this.db && userDid)
+        await this.ready({ userDid }, { recordAccess: false });
       const store = this.runStore;
       const records = store ? await store.listRecent(50) : [];
       const runs: RunsStatus['runs'] = [];
@@ -3425,12 +4677,14 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           nextAttemptAt: record.nextAttemptAt,
           error: record.error,
           taskRunId: record.taskRunId,
+          usage: parseUsage(record.usage),
         });
       }
       return {
         config: { ...this.runConfig },
         live: this.runs?.snapshot() ?? [],
         runs,
+        claims: store ? await store.listClaims() : [],
       };
     }
 
@@ -3443,25 +4697,39 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
      * the gateway (its whole-buffer download grew the crypto WASM heap for
      * good, and a hash mismatch on the far side of the RPC would only reach
      * this object as a disconnect).
+     *
+     * The gateway bounds each transfer to the attachment download deadline,
+     * from opening it to the last byte. An `AbortSignal` cannot cross the
+     * Durable Object RPC, so the turn's abort acts on this side instead:
+     * `readBytesCapped` cancels the stream it reads, and the cancel travels
+     * back over the RPC stream to stop the gateway's download.
      */
     private matrixMediaSource(): MatrixMediaSource {
+      const deadline = { timeoutMs: DOWNLOAD_TIMEOUT_MS };
       return {
-        downloadMxc: async (mxc, maxBytes = MAX_FILE_SIZE) =>
+        downloadMxc: async (mxc, maxBytes = MAX_FILE_SIZE, signal) =>
           readBytesCapped(
-            await this.gateway.downloadMxcMediaStream(mxc),
+            await this.gateway.downloadMxcMediaStream(mxc, deadline),
             maxBytes,
+            signal,
           ),
-        downloadEvent: async (roomId, eventId, maxBytes = MAX_FILE_SIZE) => {
+        downloadEvent: async (
+          roomId,
+          eventId,
+          maxBytes = MAX_FILE_SIZE,
+          signal,
+        ) => {
           const media = await this.gateway.downloadEventMediaStream(
             roomId,
             eventId,
+            deadline,
           );
           if (!media) return null;
           const plain = media.file
             ? media.stream.pipeThrough(createAttachmentDecryptor(media.file))
             : media.stream;
           return {
-            bytes: await readBytesCapped(plain, maxBytes),
+            bytes: await readBytesCapped(plain, maxBytes, signal),
             ...(media.mimetype ? { mimetype: media.mimetype } : {}),
             ...(media.filename ? { filename: media.filename } : {}),
           };
@@ -3523,6 +4791,9 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             roomId: input.roomId,
             signal: input.signal,
             logger: console,
+            ...(this.attachmentTextCache
+              ? { cache: this.attachmentTextCache.forSession(input.sessionId) }
+              : {}),
           });
           return { meta, view };
         },
@@ -3626,23 +4897,73 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       };
     }
 
+    /**
+     * The model that summarises the turn's history (the `routing` role): its
+     * window bounds what the summariser is handed.
+     */
+    private summaryModelId(
+      platform: LlmAdapter,
+      byoTurn: ByoTurnState | null,
+    ): string {
+      if (byoTurn)
+        return (
+          byoModelForRole(
+            byoTurn.credential.provider,
+            'routing',
+            byoTurn.mainModelId,
+          ) ?? OPENROUTER_MODEL_MAP.routing
+        );
+      return isProviderAdapter(platform)
+        ? platform.modelForRole('routing')
+        : OPENROUTER_MODEL_MAP.routing;
+    }
+
+    /**
+     * Build one attempt's agent and input (`buildTurn`). A build that fails
+     * part-way leaves nothing behind: the cleanups it registered run (the
+     * turn's deadline timer would otherwise keep the object resident for
+     * the whole turn limit and abort a finished run later) and the session's
+     * abort entry is released.
+     */
     private async prepareTurn(
       req: TurnRequest,
-      body: Pick<
-        TurnBody,
-        'message' | 'timezone' | 'model' | 'tools' | 'agActions' | 'attachments'
-      >,
-      run: {
-        runId: string;
-        abortController: AbortController;
-        /** A recovery attempt: no new input, the graph continues from the checkpoint. */
-        resumed: boolean;
-        /** The reply text the user already received (resumed attempts). */
-        continuation: string | null;
-      },
+      body: TurnBuildBody,
+      run: TurnBuildRun,
+    ) {
+      const turnDisposables = new Set<() => void | Promise<void>>();
+      try {
+        return await this.buildTurn(req, body, run, turnDisposables);
+      } catch (err) {
+        await this.runTurnDisposables(turnDisposables);
+        if (this.aborts.get(req.sessionId) === run.abortController)
+          this.aborts.delete(req.sessionId);
+        throw err;
+      }
+    }
+
+    private async buildTurn(
+      req: TurnRequest,
+      body: TurnBuildBody,
+      run: TurnBuildRun,
+      turnDisposables: Set<() => void | Promise<void>>,
     ) {
+      if (req.executionProfile && !this.taskScheduler)
+        throw new Error('Task scheduler unavailable');
+      await this.taskScheduler?.assertTurnProfile(req);
+      const suppliedContextOnly =
+        req.executionProfile === 'supplied-context-markdown';
+      if (
+        suppliedContextOnly &&
+        (body.attachments?.length ||
+          body.tools?.length ||
+          body.agActions?.length)
+      ) {
+        throw new Error('Supplied-context task accepts plain text only');
+      }
       const core = this.core;
       const baseAmbient = this.ambient!;
+      // One instant per turn: the prompt's date and the message's time note.
+      const turnAt = new Date();
       const saver = this.saver!;
       const sessions = this.sessions!;
 
@@ -3729,6 +5050,10 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const contextBudget = contextBudgetFor(
         windowResolution,
         contextKnobs(this.env, console),
+        await this.contextWindows.resolve(
+          this.summaryModelId(baseAmbient.llm, byoTurn),
+          byoTurn ? { byoProvider: byoTurn.provider } : {},
+        ),
       );
       if (
         req.client === 'matrix' &&
@@ -3753,15 +5078,16 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // memory engine rejects calls that carry no `x-room-id` (as a generic
       // "invalid token"). Matrix-ingress turns bring the room; HTTP turns
       // take it from the session row or resolve the user↔oracle room alias.
-      const sessionRoomId =
-        req.roomId ??
-        (await sessions.getSession(req.sessionId))?.roomId ??
-        (
-          await this.gateway
-            .resolveUserRoom(req.identity.userDid)
-            .catch(() => null)
-        )?.roomId;
-      if (!sessionRoomId) {
+      const sessionRoomId = suppliedContextOnly
+        ? undefined
+        : (req.roomId ??
+          (await sessions.getSession(req.sessionId))?.roomId ??
+          (
+            await this.gateway
+              .resolveUserRoom(req.identity.userDid)
+              .catch(() => null)
+          )?.roomId);
+      if (!suppliedContextOnly && !sessionRoomId) {
         console.warn(
           `[user-do] no oracle room resolved for ${req.identity.userDid}; room-scoped plugins (memory) will be unavailable this turn`,
         );
@@ -3784,7 +5110,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // on turn 1, exactly like the Node AgentBuilder. Best-effort: a
       // preferences read failure never fails the turn.
       const userPreferences =
-        sessionRoomId && this.preferences
+        !suppliedContextOnly && sessionRoomId && this.preferences
           ? await this.preferences.get(sessionRoomId).catch((err: unknown) => {
               console.warn(
                 `[user-do] could not load user preferences for ${sessionRoomId}: ${err instanceof Error ? err.message : String(err)}`,
@@ -3834,18 +5160,19 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // `retainAttachmentPayloads`); the tool fetches one again on demand.
       // Cleanups registered by tools for THIS turn (MCP clients …): run once
       // the turn ends, however it ends — see `RuntimeContext.onTurnEnd`.
-      const turnDisposables = new Set<() => void | Promise<void>>();
       abortController.signal.addEventListener('abort', () => {
         void this.runTurnDisposables(turnDisposables);
       });
-      const attachmentAccess = await this.attachmentViewSurface({
-        sessionId: req.sessionId,
-        roomId: sessionRoomId,
-        model: attachmentModel,
-        ambientLlm: baseAmbient.llm,
-        platform: core.llm,
-        signal: abortController.signal,
-      });
+      const attachmentAccess = suppliedContextOnly
+        ? undefined
+        : await this.attachmentViewSurface({
+            sessionId: req.sessionId,
+            roomId: sessionRoomId,
+            model: attachmentModel,
+            ambientLlm: baseAmbient.llm,
+            platform: core.llm,
+            signal: abortController.signal,
+          });
 
       const existing = await saver.getTupleWithoutMessages({
         configurable: { thread_id: req.sessionId },
@@ -3853,29 +5180,153 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const priorState = existing?.checkpoint.channel_values ?? {};
       // Request metadata (editor room, space, session run, entity) → state,
       // by the Node agent-builder's rules (see turn-metadata.ts).
-      const meta = parseTurnMetadata(req.metadata);
-      const priorMeta = priorMetadataState(priorState);
+      const meta = parseTurnMetadata(
+        suppliedContextOnly ? undefined : req.metadata,
+      );
+      const priorMeta = priorMetadataState(
+        suppliedContextOnly ? {} : priorState,
+      );
+
+      // Capability router: predict the on-demand plugin this message needs
+      // and preload it for THIS turn only. `on` is awaited here, ahead of the
+      // first model call; `shadow` returns at once and logs its verdict when
+      // it lands. The preload never enters `stateInput` — the checkpointed
+      // `loadedPlugins` channel is written by `load_capability` alone.
+      const priorLoaded: ReadonlySet<string> = new Set(
+        priorMeta.loadedPlugins ?? [],
+      );
+      this.shadowRoutes.delete(req.sessionId);
+      // LangSmith: resolved before the router so its Decision, which runs
+      // ahead of the graph, lands on the turn's tracer under the same
+      // allowlist gate. Metadata is attached unconditionally (inert without a
+      // tracer); the explicit tracer only when this turn is traced (global
+      // switch or per-DID allowlist — see `resolveLangsmithTracing`).
+      // A supplied-context turn is never traced: its source and output stay
+      // off third-party services whatever the tracing switches say.
+      const tracing: LangsmithTracingDecision = suppliedContextOnly
+        ? { metadata: {} }
+        : resolveLangsmithTracing({
+            userDid: req.identity.userDid,
+            client: req.client,
+            env: langsmithEnvFromWorkerEnv(this.env),
+          });
+      // The delegation the whole turn reads: the router's candidates here,
+      // every capability check of the build and its tools below.
+      const ucanDelegation = await this.turnDelegation(req.identity);
+      const preloadedPlugins =
+        !suppliedContextOnly && this.capabilityRouter
+          ? await this.capabilityRouter({
+              mode: capabilityRouterMode(core.validatedEnv.CAPABILITY_ROUTER),
+              manifests: core.registries.manifests.collect(),
+              loaded: priorLoaded,
+              hidden: () =>
+                bootHiddenPlugins({
+                  registries: core.registries,
+                  buildCtx: core.buildCtx(),
+                  has: (resource, action) =>
+                    ambient.ucan.hasCapability(
+                      ucanDelegation,
+                      resource,
+                      action,
+                    ),
+                }),
+              hasCapability: (resource, action) =>
+                ambient.ucan.hasCapability(ucanDelegation, resource, action),
+              text: body.message,
+              requestId: req.requestId,
+              signal: abortController.signal,
+              trace: {
+                ...(tracing.callbacks && { callbacks: tracing.callbacks }),
+                // `thread_id` matches the graph run's, so LangSmith's thread
+                // view groups the router span with the turn.
+                metadata: {
+                  ...tracing.metadata,
+                  thread_id: req.sessionId,
+                  request_id: req.requestId,
+                },
+              },
+              onShadowVerdict: (wouldPreload) =>
+                this.shadowRoutes.set(req.sessionId, {
+                  requestId: req.requestId,
+                  priorLoaded,
+                  wouldPreload,
+                }),
+            })
+          : undefined;
 
       // Host page-context / safety-guardrail hooks, resolved against this
       // object's ambient services (see `OracleWorkerHooks`).
-      const hostRoomTitle = opts.hooks?.getRoomTitle;
-      const hostSafetyModel = opts.hooks?.safetyModel;
+      const hostRoomTitle = suppliedContextOnly
+        ? undefined
+        : opts.hooks?.getRoomTitle;
+      const hostSafetyModel = suppliedContextOnly
+        ? undefined
+        : opts.hooks?.safetyModel;
 
       // The client-declared tool surface: this body's, else the thread's
       // checkpointed one (run-request.ts).
-      const surface = clientSurfaceFor(body, priorState);
+      const surface = suppliedContextOnly
+        ? clientSurfaceFor({}, {})
+        : clientSurfaceFor(body, priorState);
 
       // Write-ahead tool marks + the resume policy (tool-marks.ts). The
       // effect map is filled from the build below; the closure reads it at
       // call time, so the middleware can be created before the agent.
       const toolEffects = new Map<string, ToolEffect>();
+      const subAgentToolNames = new Set<string>();
+      const effectOf = (name: string): ToolEffect =>
+        toolEffects.get(name) ?? toolEffectOf({ name });
       const marksMiddleware = createToolMarksMiddleware({
         runId: run.runId,
         store: this.runStore!,
-        effectOf: (name) => toolEffects.get(name) ?? toolEffectOf({ name }),
+        effectOf,
         continuation: run.continuation,
         logger: console,
       });
+      // The turn's budget (turn-budget.ts): model calls are charged by the
+      // metered adapter every model of this turn comes from, tool calls by
+      // the execution middleware below, and the deadline aborts the run
+      // with the limit as the reason (the stream reports it as a terminal
+      // error, not as a user abort).
+      const turnLimits = turnLimitsFromEnv(core.validatedEnv);
+      const budget = new TurnBudget(turnLimits);
+      const meteredLlm = budgetedLlm(ambient.llm, {
+        budget,
+        outputReserveTokens: contextBudget.outputReserveTokens,
+        signal: abortController.signal,
+      });
+      const deadline = setTimeout(() => {
+        if (abortController.signal.aborted) return;
+        console.warn(
+          `[harness] turn ${req.requestId} reached its deadline (${turnLimits.durationMs} ms); aborting`,
+        );
+        abortController.abort(
+          new HarnessLimitError(
+            'budget_exhausted',
+            'time',
+            'The turn reached its time limit. Completed work is preserved; no further work was started.',
+          ),
+        );
+      }, turnLimits.durationMs);
+      turnDisposables.add(async () => {
+        clearTimeout(deadline);
+        const usage = budget.snapshot();
+        console.log(
+          `[harness] turn ${req.requestId} usage: ~${usage.tokens} tokens (${usage.reportedTokens} reported over ${usage.modelCalls} model calls), ${usage.toolAttempts} tool attempts, ${usage.elapsedMs} ms`,
+        );
+      });
+      const laneOf = (name: string): ToolLane =>
+        subAgentToolNames.has(name) ? 'subagent' : effectOf(name);
+      const executionMiddleware = createToolExecutionMiddleware({
+        budget,
+        scheduler: this.toolScheduler,
+        laneOf,
+        runId: run.runId,
+        sessionId: req.sessionId,
+        claims: this.runStore!,
+        signal: abortController.signal,
+        logger: console,
+      });
       // Every tool result above the budget's cap is saved whole and handed
       // to the model as head + tail + handle (result-cap.ts); applied to
       // sub-agents too through `toolMiddlewares`.
@@ -3892,15 +5343,45 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       // inside the wrapper (already under the cap by the time it runs).
       const capMiddleware = createResultCapMiddleware(resultCap);
 
+      // Chat delivery: a channel or Matrix turn replies as short messages and
+      // may hand long content to `create_artifact` (bound only when artefact
+      // storage is configured). The Portal streams as it always has.
+      const delivery = resolveDeliveryProfile(req, core.delivery);
+      const artifacts =
+        delivery.kind === 'chat' && this.artifacts?.canShare
+          ? this.artifacts
+          : null;
+      const turnTools = artifacts
+        ? [
+            {
+              tool: buildCreateArtifactTool(async (input) =>
+                artifacts.create({
+                  artifactId: await artifactIdFor(run.runId, input.source),
+                  sessionId: req.sessionId,
+                  runId: run.runId,
+                  title: input.title,
+                  content: input.content,
+                }),
+              ),
+              returnDirect: true,
+            },
+          ]
+        : [];
+
       const built = await createMainAgent({
+        executionProfile: req.executionProfile,
         registries: core.registries,
         identity: core.identity,
         config: core.validatedEnv,
         availablePlugins: core.availablePlugins,
+        preloadedPlugins,
         byoProvider: byoTurn?.provider,
         contextBudget,
+        turnBudget: budget,
+        delivery,
         ambient: {
           ...ambient,
+          llm: meteredLlm,
           attachments: attachmentAccess,
           onTurnEnd: (dispose) => turnDisposables.add(dispose),
         },
@@ -3913,7 +5394,11 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           // Applied to the main agent AND every sub-agent: a sub-agent's
           // own tool calls are marked and capped too.
           toolMiddlewares: [marksMiddleware, capMiddleware],
+          // Budget, scheduling and write claims, innermost around each tool
+          // call (main agent and sub-agents alike).
+          toolExecution: executionMiddleware,
           resultCap,
+          turnTools,
           onContextOverflow: (error) =>
             this.contextWindows.learnFromError(mainModelId, error, {
               ...(byoTurn ? { byoProvider: byoTurn.provider } : {}),
@@ -3941,9 +5426,9 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
               req.identity.matrixUserId ??
               (await this.resolveMatrixUserId(req.identity.userDid)) ??
               '',
-            ucanDelegation: { raw: req.identity.ucanDelegation ?? '' },
+            ucanDelegation,
             timezone: req.identity.timezone,
-            currentTime: new Date().toISOString(),
+            currentTime: turnAt.toISOString(),
           },
           session: {
             id: req.sessionId,
@@ -3954,7 +5439,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           model: effectiveModel,
         },
         state: {
-          ...priorState,
+          ...(suppliedContextOnly ? {} : priorState),
           userPreferences,
           ...metadataBuildState(meta, priorMeta),
           // The client-declared surface: the portal and AG-UI plugins turn
@@ -3969,6 +5454,7 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const { agent, context } = built;
       for (const [name, effect] of built.toolEffects)
         toolEffects.set(name, effect);
+      for (const name of built.subAgentToolNames) subAgentToolNames.add(name);
 
       const attachmentKwargs =
         prepared && prepared.metas.length > 0
@@ -3994,19 +5480,31 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             }
           : {};
       const rawContent = prepared ? prepared.content : body.message;
-      const content =
+      const spoken =
         req.client === 'matrix' && req.roomKind === 'group'
           ? prefixSpeaker(rawContent, speakerName)
           : rawContent;
+      // The exact time rides on the message (outermost, after the speaker
+      // prefix and the attachment blocks), so the system prompt carries the
+      // date only and stays identical across the session's turns. A
+      // supplied-context task's input stays exactly what was supplied.
+      const timeNote = suppliedContextOnly
+        ? undefined
+        : renderTurnTimeNote(turnAt, req.identity.timezone);
+      const content = timeNote ? withTurnTimeNote(spoken, timeNote) : spoken;
       const stateInput = {
         messages: [
           new HumanMessage({
             content,
             additional_kwargs: {
-              timestamp: new Date().toISOString(),
+              timestamp: turnAt.toISOString(),
+              ...(timeNote ? { [TURN_TIME_NOTE_KWARG]: timeNote } : {}),
               oracleName: core.identity.name,
               msgFromMatrixRoom: req.client === 'matrix',
               ...speakerKwargs,
+              ...(req.channel
+                ? { 'org.ixo.qi.origin': channelOrigin(req.channel) }
+                : {}),
               ...attachmentKwargs,
             },
           }),
@@ -4029,22 +5527,13 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         ...metadataGraphInput(meta, priorMeta),
         ...surface.input,
       };
-      // LangSmith: metadata is attached unconditionally (inert without a
-      // tracer); the explicit tracer only when this turn is traced (global
-      // switch or per-DID allowlist — see `resolveLangsmithTracing`).
-      const tracing = resolveLangsmithTracing({
-        userDid: req.identity.userDid,
-        client: req.client,
-        env: langsmithEnvFromWorkerEnv(this.env),
-      });
-
       const config = {
         configurable: { thread_id: req.sessionId },
         context,
         signal: abortController.signal,
         recursionLimit: turnRecursionLimit(this.env),
         metadata: tracing.metadata,
-        ...(tracing.callbacks ? { callbacks: tracing.callbacks } : {}),
+        callbacks: [meteredLlm.callback, ...(tracing.callbacks ?? [])],
       };
       return {
         agent,
@@ -4055,6 +5544,9 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
         byoProvider: byoTurn?.provider,
         turnDisposables,
         toolOutputCapChars: contextBudget.resultCapChars,
+        /** The budget's usage so far (JSON), stored with the run's end. */
+        usage: (): string => JSON.stringify(budget.snapshot()),
+        delivery,
       };
     }
 
@@ -4070,18 +5562,19 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       req: TurnRequest,
       text: string,
       who: 'user' | 'oracle',
-    ): void {
-      if (req.client === 'matrix') return;
-      if (req.sessionId.startsWith(SYNTHETIC_SESSION_PREFIX)) return;
+    ): Promise<void> {
+      if (req.client === 'matrix') return Promise.resolve();
+      if (req.sessionId.startsWith(SYNTHETIC_SESSION_PREFIX))
+        return Promise.resolve();
       // A local session id has no marker event to thread on: the user had
       // no oracle room when the session was created, so there is no room
       // transcript to mirror either.
-      if (!req.sessionId.startsWith('$')) return;
-      if (!text.trim()) return;
+      if (!req.sessionId.startsWith('$')) return Promise.resolve();
+      if (!text.trim()) return Promise.resolve();
       const label = who === 'user' ? 'user message' : 'AI response';
       // Serialised per session, retried across a gateway restart with a fixed
       // transaction id, kept alive past the request (room-mirror.ts).
-      void this.roomMirror().enqueue(
+      return this.roomMirror().enqueue(
         req.sessionId,
         async () => {
           const roomId =
@@ -4105,24 +5598,35 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
             body,
             ...(formattedBody ? { formattedBody } : {}),
             threadId: req.sessionId,
-            txnId: mirrorTxnId(req.sessionId, req.requestId, who),
+            txnId: req.channel
+              ? `channel-${await channelRequestHash(JSON.stringify([req.identity.userDid, req.channel.bindingId, req.requestId, who]))}`
+              : mirrorTxnId(req.sessionId, req.requestId, who),
+            ...(req.channel ? { origin: req.channel } : {}),
           };
         },
         label,
+        req.client === 'channel',
       );
     }
 
     private roomMirror(): RoomMirror {
       this.mirror ??= new RoomMirror({
         sendText: (send) =>
-          this.gateway.sendText(send.roomId, send.body, {
-            threadId: send.threadId,
-            ...(send.formattedBody
-              ? { formattedBody: send.formattedBody }
-              : {}),
-            priority: 'background',
-            txnId: send.txnId,
-          }),
+          send.origin
+            ? this.gateway.sendEvent(
+                send.roomId,
+                'm.room.message',
+                JSON.stringify(mirrorEventContent(send)),
+                { txnId: send.txnId },
+              )
+            : this.gateway.sendText(send.roomId, send.body, {
+                threadId: send.threadId,
+                ...(send.formattedBody
+                  ? { formattedBody: send.formattedBody }
+                  : {}),
+                priority: 'background',
+                txnId: send.txnId,
+              }),
         keepAlive: (work) => this.ctx.waitUntil(work),
         log: (message) => console.log(message),
         warn: (message) => console.warn(message),
@@ -4133,6 +5637,8 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
     private async afterTurn(
       sessionId: string,
       messages: BaseMessage[],
+      disposition: RequestDisposition = { kind: 'agent' },
+      signal?: AbortSignal,
     ): Promise<void> {
       const sessions = this.sessions!;
       await sessions.touchSession(sessionId);
@@ -4143,11 +5649,25 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
           );
         },
       );
+      if (disposition.kind === 'agent')
+        await this.compareShadowRoute(sessionId);
       const row = await sessions.getSession(sessionId);
-      if (row && (!row.title || row.title === UNTITLED_SESSION)) {
-        const title = await this.generateTitle(messages).catch(() => null);
-        if (title)
-          await sessions.setTitle(sessionId, title, { onlyIfUntitled: true });
+      // The title model is the platform adapter, outside the turn's metered
+      // model and budget: a supplied-context task's source and result never
+      // reach it. A direct read brings its own deterministic title.
+      // A generated title is a model call of its own: it runs in the
+      // background, so the reply's `done` (and a Matrix answer) never waits
+      // for it.
+      if (
+        row &&
+        (!row.title || row.title === UNTITLED_SESSION) &&
+        !(await this.isRestrictedTaskSession(sessionId))
+      ) {
+        if (disposition.kind === 'direct-read')
+          await sessions.setTitle(sessionId, disposition.title, {
+            onlyIfUntitled: true,
+          });
+        else this.ctx.waitUntil(this.titleSession(sessionId, messages, signal));
       }
       this.markDirty();
       // Which chunks this turn touched, for the page tier's eviction policy
@@ -4161,6 +5681,51 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       }
     }
 
+    /**
+     * Whether a session belongs to a supplied-context task, read from the
+     * task row (never from the request). A task session with no scheduler to
+     * read the row from is treated as restricted.
+     */
+    private async isRestrictedTaskSession(sessionId: string): Promise<boolean> {
+      if (!sessionId.startsWith(TASK_SESSION_PREFIX)) return false;
+      return this.taskScheduler
+        ? this.taskScheduler.isRestrictedSession(sessionId)
+        : true;
+    }
+
+    /**
+     * Shadow-mode follow-up: once the turn has ended, compare what the router
+     * would have preloaded with what `load_capability` actually added to the
+     * thread. Best effort — one checkpoint read, and it never fails the turn.
+     * Nothing to compare when the shadow verdict has not landed yet.
+     */
+    private async compareShadowRoute(sessionId: string): Promise<void> {
+      const shadow = this.shadowRoutes.get(sessionId);
+      if (!shadow) return;
+      this.shadowRoutes.delete(sessionId);
+      try {
+        const tuple = await this.saver?.getTupleWithoutMessages({
+          configurable: { thread_id: sessionId },
+        });
+        const loadedAfter = new Set(
+          priorMetadataState(tuple?.checkpoint.channel_values ?? {})
+            .loadedPlugins ?? [],
+        );
+        const { loadedDuringTurn, agree } = shadowAgreement({
+          priorLoaded: shadow.priorLoaded,
+          loadedAfter,
+          wouldPreload: shadow.wouldPreload,
+        });
+        console.log(
+          `[capability-router-shadow] request=${shadow.requestId} loadedDuringTurn=[${loadedDuringTurn.join(', ')}] agree=${agree}`,
+        );
+      } catch (err: unknown) {
+        console.warn(
+          `[capability-router-shadow] request=${shadow.requestId} comparison failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+
     /**
      * Channel-memory compaction for the gateway's group rooms
      * (`src/matrix/group-chat.ts`): the platform's small model distils a
@@ -4181,8 +5746,47 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       );
     }
 
+    /**
+     * Title an untitled session from its first exchange, in the background:
+     * bounded by `TITLE_TIMEOUT_MS` and by the turn's abort, never throws.
+     * The timer is cleared however the call ends.
+     */
+    private async titleSession(
+      sessionId: string,
+      messages: BaseMessage[],
+      turnSignal: AbortSignal | undefined,
+    ): Promise<void> {
+      const bound = new AbortController();
+      const onAbort = (): void => bound.abort(turnSignal?.reason);
+      if (turnSignal?.aborted) return;
+      turnSignal?.addEventListener('abort', onAbort, { once: true });
+      const timer = setTimeout(
+        () =>
+          bound.abort(
+            new Error(`session title timed out after ${TITLE_TIMEOUT_MS} ms`),
+          ),
+        TITLE_TIMEOUT_MS,
+      );
+      try {
+        const title = await this.generateTitle(messages, bound.signal);
+        // A session deleted (or reset away) meanwhile is not titled.
+        const sessions = this.sessions;
+        if (!title || !sessions || bound.signal.aborted) return;
+        if (await sessions.setTitle(sessionId, title, { onlyIfUntitled: true }))
+          this.markDirty();
+      } catch (err) {
+        console.warn(
+          `[user-do] no title for ${sessionId}: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      } finally {
+        clearTimeout(timer);
+        turnSignal?.removeEventListener('abort', onAbort);
+      }
+    }
+
     private async generateTitle(
       messages: BaseMessage[],
+      signal: AbortSignal,
     ): Promise<string | null> {
       const human = messages.find((m) => m.type === 'human');
       const ai = [...messages].reverse().find((m) => m.type === 'ai');
@@ -4192,9 +5796,24 @@ export function createUserOracleDO(opts: UserOracleDOOptions) {
       const model = (this.ambient?.llm ?? this.core.llm).get('session-title');
       const prompt =
         'Write a 3–6 word title for this conversation. Reply with the title only, no quotes.\n\n' +
-        `User: ${contentToText(human.content).slice(0, 500)}\n` +
+        `User: ${visibleText(human).slice(0, 500)}\n` +
         (ai ? `Assistant: ${contentToText(ai.content).slice(0, 500)}` : '');
-      const res = await model.invoke(prompt);
+      // Raced as well as signalled: a provider that ignores the signal
+      // still cannot hold the call past it.
+      const aborted = new Promise<never>((_resolve, reject) => {
+        const fail = (): void =>
+          reject(
+            signal.reason instanceof Error
+              ? signal.reason
+              : new Error('session title aborted'),
+          );
+        if (signal.aborted) fail();
+        else signal.addEventListener('abort', fail, { once: true });
+      });
+      const res = await Promise.race([
+        model.invoke(prompt, { signal }),
+        aborted,
+      ]);
       const title = contentToText(res.content)
         .trim()
         .replace(/^["']|["']$/g, '')