@mono-agent/web 0.20.11 → 0.21.0

package/dist/service.js

@@ -1,26 +1,298 @@
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile, rename, unlink, writeFile } from "node:fs/promises";
-import { DEFAULT_AGENT_ATTACHMENT_MAX_BYTES, DEFAULT_AGENT_ATTACHMENT_MIME_ALLOWLIST, createChannelUserCancelReason, isChannelUserCancelReason, toolNameLeaf, } from "@mono-agent/agent-contracts";
+import { AGENT_CONTEXT_IMPORT_MAX_TEXT_BYTES, AGENT_CONTEXT_IMPORT_SYSTEM_PROVENANCE, AGENT_LIVE_INPUT_MAX_CHARACTERS, DEFAULT_AGENT_ATTACHMENT_MAX_BYTES, DEFAULT_AGENT_ATTACHMENT_MIME_ALLOWLIST, createChannelUserCancelReason, isChannelUserCancelReason, toolNameLeaf, } from "@mono-agent/agent-contracts";
 import { EFFORT_LEVELS } from "@mono-agent/config";
 import { WEB_API_VERSION, WEB_MAX_CONCURRENT_UPLOADS, WEB_MAX_ACTIVE_ATTACHMENT_TURN_BYTES, WEB_MAX_FILES_PER_TURN, WEB_MAX_STAGED_UPLOAD_BYTES, WEB_MAX_STAGED_UPLOADS, WEB_MAX_QUEUED_ATTACHMENT_TURNS, WEB_MAX_TURN_TEXT_CHARACTERS, WEB_MAX_TURN_ATTACHMENT_BYTES, WEB_STAGED_UPLOAD_TTL_MS, } from "./contracts.js";
 import { discoverOperatorAgents, } from "./discovery.js";
 import { conversationTitleFromFrame } from "./conversation-title.js";
+import { parseCronReplyContext } from "./cron-reply-context.js";
+import { advertisedEffortLevels, effectiveModelForAgent, effortLevelsForModel, inheritedEffortForModel, } from "./effort-ladder.js";
 import { errorCode, errorMessage, WebConsoleError } from "./errors.js";
 import { OperatorClient } from "./operator-client.js";
 import { generateWebPushIdentity, normalizeWebPushEndpoint, resolveWebPushSubject, validateWebPushEndpoint, validateWebPushKeys, WebPushDispatcher, WEB_PUSH_SERVICE_WORKER_VERSION, } from "./push.js";
 import { acquireWebStateLease, prepareWebStatePaths } from "./state-paths.js";
-import { cronChannelReadOnlyError, toWebAttachment, WebStore, notificationPushLogicalKey, } from "./store.js";
+import { cronChannelReadOnlyError, toWebAttachment, WebStore, WEB_THREAD_PAGE_DEFAULT, notificationPushLogicalKey, } from "./store.js";
 const DEFAULT_DISCOVERY_INTERVAL_MS = 5_000;
 const DEFAULT_PURGE_INTERVAL_MS = 60 * 60 * 1_000;
 const INFO_TIMEOUT_MS = 2_500;
 const ASK_DISCOVERY_TIMEOUT_MS = 120_000;
+/** Bounded per-agent catalog-admitted model refs; beyond it, oldest go first. */
+const MODEL_CATALOG_CACHE_CAP = 2_048;
+/** Matches the browser picker: enough for today's 200-row provider ceiling,
+ * with slack for an older or independently implemented operator. */
+const MODEL_CATALOG_RESTORE_PAGE_SIZE = 100;
+const MODEL_CATALOG_RESTORE_PAGE_LIMIT = 5;
 const REPLY_ACCESS_TTL_MS = 10 * 60 * 1_000;
+/**
+ * How coarsely a reply capability's expiry is quantised.
+ *
+ * The expiry is part of the signed URL, so an expiry read off the wall clock
+ * made every projection of the same message a DIFFERENT transcript: the
+ * conversation's ETag moved once a second for the life of a running turn and no
+ * console could ever be answered with a 304, however little had changed. Rounded
+ * DOWN to the bucket the mint falls in, the URL is stable for the bucket and a
+ * key's life is between five and ten minutes -- shortened, never extended, so
+ * the validator's ceiling is untouched.
+ */
+const REPLY_ACCESS_BUCKET_MS = 5 * 60 * 1_000;
 /**
  * Raster types the console keeps its own copy of. `image/svg+xml` is absent on
  * purpose: it is active content, and both the inline gate in the browser and
  * `setReplyDownloadHeaders` already refuse to treat it as an image.
  */
 const REPLY_IMAGE_MEDIA_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+/**
+ * How much of a tool call's `result`/`args` a browser read carries.
+ *
+ * Measured on a real fleet transcript: a 4-message tool-heavy conversation is
+ * 231 KB, of which 211 KB is `tool-call` result bodies (single `Exec`/`ReadSkill`
+ * results run 14-21 KB). The rows are collapsed, so what the operator sees of
+ * one is its first screenful; the rest is a request away.
+ */
+const TOOL_PAYLOAD_PREVIEW_CHARS = 4_096;
+/**
+ * Telemetry whose `data` the console actually reads.
+ *
+ * `webapp/src/runtime.tsx` renders only `runtime_telemetry` of kind
+ * `context_compaction`/`assistant_message_boundary`/`context_usage` plus
+ * `cron_run`; `webapp/src/usage.ts` sums any part labelled `context_usage`,
+ * `context_compaction`, or containing `usage`/`cost`. Everything else --
+ * `provider_status`, `memory_recalled`, `status`, `run_config`, `cache_hit`,
+ * `capabilities_resolved`, ... -- is carried across the wire and dropped, which
+ * is ~10 KB a conversation.
+ */
+const TELEMETRY_DATA_ALLOWLIST = new Set([
+    "usage_update",
+    "cron_run",
+    "context_usage",
+    "context_compaction",
+    "assistant_message_boundary",
+]);
+/**
+ * Whether a tool name IS AskUser, however the agent qualified it.
+ *
+ * An MCP server serves it as `mcp__<server>__ask_user`, a forwarding runtime as
+ * `some.namespace:AskUser`, and separators vary. Two places have to agree on
+ * this -- the frame observer that arms the interaction poller, and the shaper
+ * that must leave the card's question and answer alone -- so they read the same
+ * rule rather than two spellings of it. An exact `=== "AskUser"` here silently
+ * shaped the card's payload for every run that routes the tool through a server.
+ */
+function isAskUserToolName(toolName) {
+    return toolNameLeaf(toolName).toLowerCase().replace(/[^a-z0-9]+/gu, "") === "askuser";
+}
+/** A `runtime_telemetry` event's variant, which the store stores inside `data`. */
+function telemetryKind(data) {
+    if (data === null || typeof data !== "object" || Array.isArray(data))
+        return undefined;
+    const kind = data.kind;
+    return typeof kind === "string" && kind.length > 0 ? kind : undefined;
+}
+/** The allowlist, or the `usage`/`cost` substring rule `usage.ts` applies. */
+function readsTelemetryLabel(label) {
+    if (label === undefined)
+        return false;
+    const normalized = label.toLowerCase();
+    return TELEMETRY_DATA_ALLOWLIST.has(normalized)
+        || normalized.includes("usage")
+        || normalized.includes("cost");
+}
+function keepsTelemetryData(part) {
+    // `usage.ts` matches on the event name AND on a nested `kind`, so both are
+    // measured against the same rule -- a `runtime_telemetry{kind:"token_usage"}`
+    // counts towards the run's tokens exactly like a bare `usage_update`.
+    return readsTelemetryLabel(part.event) || readsTelemetryLabel(telemetryKind(part.data));
+}
+/**
+ * Keep the part, drop the payload the console never reads.
+ *
+ * Removing it outright would renumber every later part, and both the client's
+ * part conversion and the index-based transcript reads that follow this change
+ * depend on positions being stable. `kind` is surfaced whenever the event has
+ * one -- kept or stripped -- so its presence is never a back-channel for "the
+ * payload was dropped".
+ */
+function shapeTelemetryPart(part) {
+    const kind = telemetryKind(part.data);
+    const keepsData = part.data === undefined || keepsTelemetryData(part);
+    if (keepsData && (kind === undefined || part.kind === kind))
+        return part;
+    return {
+        type: "telemetry",
+        event: part.event,
+        ...(kind === undefined ? {} : { kind }),
+        ...(keepsData ? { data: part.data } : {}),
+    };
+}
+/**
+ * What a truncated payload was cut from, so the console can prove a body it is
+ * holding is still that payload.
+ *
+ * The preview says how long the whole body is and what its first characters
+ * are, and a repaired body used to be restored on those two facts alone -- so a
+ * rewritten result of the same length with the same head put the OLD body back
+ * under the NEW preview. The digest closes that: a console restores only what
+ * the server names as the same content, and drops the repair otherwise.
+ *
+ * Over the SERIALIZED text, which is what both sides already have: a string
+ * payload as itself, anything else as its JSON. Nothing here is a secret and
+ * nothing is keyed -- it is an identity, not a signature.
+ */
+function payloadDigest(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+/**
+ * The head of an oversized payload, or `undefined` when it is small enough (or
+ * cannot be serialized, in which case it is left exactly as stored).
+ */
+function payloadPreview(value) {
+    if (value === undefined)
+        return undefined;
+    const text = typeof value === "string" ? value : jsonTextOf(value);
+    if (text === undefined || text.length <= TOOL_PAYLOAD_PREVIEW_CHARS)
+        return undefined;
+    return {
+        preview: text.slice(0, TOOL_PAYLOAD_PREVIEW_CHARS),
+        length: text.length,
+        digest: payloadDigest(text),
+    };
+}
+/** The same name the shaper gives a payload, for a whole one. See {@link payloadDigest}. */
+function wholePayloadDigest(value) {
+    if (value === undefined)
+        return undefined;
+    const text = typeof value === "string" ? value : jsonTextOf(value);
+    return text === undefined ? undefined : payloadDigest(text);
+}
+/** `undefined` for anything JSON cannot express, which is then left as stored. */
+function jsonTextOf(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return undefined;
+    }
+}
+function shapeToolCall(call) {
+    // AskUser's arguments and answer ARE the card the console renders, and they
+    // are bounded at the emitter. `structuredResult` is never shaped here: MCP
+    // and canonical host outcomes are already bounded and remain opaque.
+    if (isAskUserToolName(call.toolName))
+        return call;
+    const args = shapedArgs(call.args);
+    const result = payloadPreview(call.result);
+    if (args === undefined && result === undefined)
+        return call;
+    return {
+        ...call,
+        ...(args === undefined
+            ? {}
+            : { args: args.preview, argsTruncated: true, argsBytes: args.length, argsDigest: args.digest }),
+        ...(result === undefined
+            ? {}
+            : { result: result.preview, resultTruncated: true, resultBytes: result.length, resultDigest: result.digest }),
+    };
+}
+function shapeToolCallPart(part) {
+    return { ...shapeToolCall(part), type: "tool-call" };
+}
+/**
+ * A tool call's arguments, cut to fit -- serialized ONCE.
+ *
+ * The size question and the two answers to it all read the same JSON text: the
+ * object shaper used to serialize to decide whether it had work, and the
+ * whole-value fallback then serialized the same value again to answer the same
+ * question. Every under-budget object args paid for both, on every transcript
+ * read and now on every streamed delta.
+ */
+function shapedArgs(args) {
+    if (args === undefined)
+        return undefined;
+    const text = typeof args === "string" ? args : jsonTextOf(args);
+    // Under budget, or nothing JSON can express: left exactly as stored.
+    if (text === undefined || text.length <= TOOL_PAYLOAD_PREVIEW_CHARS)
+        return undefined;
+    const shaped = shapedArgsObject(args, text)
+        ?? { preview: text.slice(0, TOOL_PAYLOAD_PREVIEW_CHARS), length: text.length };
+    return { ...shaped, digest: payloadDigest(text) };
+}
+/**
+ * An oversized ARGUMENTS OBJECT with its string leaves cut back to fit, rather
+ * than replaced by the head of its JSON text.
+ *
+ * Arguments are not opaque the way a result is: the console reads named keys out
+ * of them -- `command`, `file_path`, a delegation's `prompt` -- for the row
+ * summary and the Task note, and the head of a JSON text is none of those. It is
+ * also what an operator scans, and a mid-object slice reads as garbage. Nothing
+ * is added or removed, so the object keeps its shape and every key keeps its
+ * place, and the longest string pays first.
+ *
+ * Termination is the bounded pass count, NOT an assumption that every slice
+ * shrinks the serialization: cutting between a surrogate pair leaves a lone
+ * surrogate that `JSON.stringify` writes as `\udXXX`, which can make one pass
+ * longer than the last. Anything still over budget after eight passes falls
+ * back to the whole-value head.
+ */
+function shapedArgsObject(args, original) {
+    if (args === null || typeof args !== "object" || Array.isArray(args))
+        return undefined;
+    let shaped = { ...args };
+    for (let pass = 0; pass < 8; pass += 1) {
+        const text = jsonTextOf(shaped);
+        if (text === undefined)
+            return undefined;
+        if (text.length <= TOOL_PAYLOAD_PREVIEW_CHARS)
+            return { preview: shaped, length: original.length };
+        const longest = Object.entries(shaped)
+            .filter((entry) => typeof entry[1] === "string" && entry[1].length > 1)
+            .sort(([, left], [, right]) => right.length - left.length)[0];
+        if (longest === undefined)
+            return undefined;
+        const [key, value] = longest;
+        const keep = Math.max(1, value.length - (text.length - TOOL_PAYLOAD_PREVIEW_CHARS));
+        shaped = { ...shaped, [key]: value.slice(0, keep) };
+    }
+    // Too many oversized leaves to fit: fall back to the whole-value head rather
+    // than serve an object that is still over budget.
+    return undefined;
+}
+function shapeSubagentPart(part) {
+    const args = shapedArgs(part.args);
+    const result = payloadPreview(part.result);
+    return {
+        ...part,
+        ...(args === undefined
+            ? {}
+            : { args: args.preview, argsTruncated: true, argsBytes: args.length, argsDigest: args.digest }),
+        ...(result === undefined
+            ? {}
+            : { result: result.preview, resultTruncated: true, resultBytes: result.length, resultDigest: result.digest }),
+        calls: part.calls.map(shapeToolCall),
+    };
+}
+/**
+ * ONE part's own payloads, named the way a preview of them would be.
+ *
+ * The repair read serves what is stored; without these the console has nothing
+ * to compare a later preview against and, failing closed, would drop every
+ * repair it made.
+ *
+ * Only the part handed to it -- a delegation's `calls` are NOT walked. They do
+ * not need to be: a repair is addressed by tool-call id, and a request naming a
+ * child is answered by synthesizing that child as the tool-call part it would
+ * have been, which comes back through here as a part in its own right.
+ */
+function nameWholePayloads(part) {
+    const args = wholePayloadDigest(part.args);
+    const result = wholePayloadDigest(part.result);
+    if (args === undefined && result === undefined)
+        return part;
+    return {
+        ...part,
+        ...(args === undefined ? {} : { argsDigest: args }),
+        ...(result === undefined ? {} : { resultDigest: result }),
+    };
+}
 function formatQuotedTurn(quote, text) {
     const blockquote = quote
         .trim()
@@ -29,6 +301,36 @@ function formatQuotedTurn(quote, text) {
         .join("\n");
     return `Quoted context:\n${blockquote}\n\n${text}`;
 }
+function assertTurnTextWithinLimit(operatorText) {
+    if (operatorText.length <= WEB_MAX_TURN_TEXT_CHARACTERS)
+        return;
+    throw new WebConsoleError("turn_text_too_large", `The message and quote may contain at most ${WEB_MAX_TURN_TEXT_CHARACTERS} characters after formatting.`, 413);
+}
+function assertMonitorWakeAddress(input) {
+    const originConversation = input.monitor.origin.conversationId.split("#", 1)[0];
+    const expectedDeliveryKey = `monitor:${input.monitor.monitorId}:${String(input.monitor.counters.seq)}`;
+    if (input.monitor.origin.channel !== "web"
+        || originConversation !== `web:${input.threadId}`
+        || input.deliveryKey !== expectedDeliveryKey) {
+        throw new WebConsoleError("invalid_notification", "The Monitor wake origin or delivery key does not match its web destination.", 409);
+    }
+}
+function monitorWakePayloadSha256(monitor, wakePrompt) {
+    return createHash("sha256")
+        .update(canonicalJson(monitor))
+        .update("\0")
+        .update(wakePrompt)
+        .digest("hex");
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
+    if (typeof value === "object" && value !== null) {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
 export class WebService {
     store;
     options;
@@ -39,9 +341,11 @@ export class WebService {
     drainingLiveInputThreads = new Set();
     activeUploads = new Map();
     activeNotifications = new Map();
-    processJobWakeTails = new Map();
-    processJobWakeReservations = new Map();
-    activeProcessJobWakes = new Map();
+    activeCronReplies = new Map();
+    /** One serialization lane shared by queued user input and every host wake kind. */
+    hostWakeTails = new Map();
+    hostWakeReservations = new Map();
+    activeHostWakes = new Map();
     allowlist = new Set(DEFAULT_AGENT_ATTACHMENT_MIME_ALLOWLIST);
     attachmentTurnBudget;
     pushIdentity;
@@ -50,6 +354,20 @@ export class WebService {
     replyAccessKey;
     askWatches = new Map();
     connections = new Map();
+    /**
+     * Source id -> the capability signature projected for it on the last
+     * discovery pass. No projected capability is on the summary or in the store,
+     * so this is the only record of them that survives a poll -- and the only way
+     * `refreshAgentsOnce` can tell that provider authentication itself moved.
+     */
+    projectedCapabilities = new Map();
+    /** Bounded catalog-admitted model refs per agent, seeded from `modelOptions`
+     *  and appended to by every proxied `/v1/models` page. Admission is `has`,
+     *  metadata is `get`. Map preserves insertion order, so evicting the oldest
+     *  entry is deleting the head. Scoped to the agent GENERATION that filled it
+     *  (see `reconcileModelCatalogCache`), because a source id outlives the
+     *  process behind it. */
+    modelCatalogCache = new Map();
     /** Parts whose durable copy is being fetched, so concurrent reads fetch once. */
     persistingReplyImages = new Set();
     discoveryTimer;
@@ -119,8 +437,23 @@ export class WebService {
             throw error;
         }
     }
-    async bootstrap() {
+    async bootstrap(scope = {}) {
         const currentThreadId = this.store.currentThreadId();
+        const currentThread = currentThreadId === undefined ? undefined : this.store.getThread(currentThreadId);
+        const discoveredCurrentThreadId = currentThread !== undefined
+            && this.store.getAgent(currentThread.sourceId) !== undefined
+            ? currentThreadId
+            : undefined;
+        const agents = this.store.listAgents().map((agent) => this.decorateProjectedCapabilities(agent));
+        const threadsSourceId = this.bootstrapSourceId(scope.sourceId, currentThread, agents);
+        const archived = scope.archived ?? false;
+        const page = threadsSourceId === null
+            ? { threads: [] }
+            : this.store.listThreadsPage({
+                sourceId: threadsSourceId,
+                archived,
+                limit: scope.limit ?? WEB_THREAD_PAGE_DEFAULT,
+            });
         return {
             version: WEB_API_VERSION,
             push: {
@@ -128,9 +461,11 @@ export class WebService {
                 keyFingerprint: this.pushIdentity.fingerprint,
                 serviceWorkerVersion: WEB_PUSH_SERVICE_WORKER_VERSION,
             },
-            agents: this.store.listAgents(),
-            threads: this.store.listThreads(),
-            ...(currentThreadId === undefined ? {} : { currentThreadId }),
+            agents,
+            threads: page.threads,
+            threadsSourceId,
+            threadsNextCursor: page.nextCursor ?? null,
+            ...(discoveredCurrentThreadId === undefined ? {} : { currentThreadId: discoveredCurrentThreadId }),
             limits: {
                 maxFileBytes: DEFAULT_AGENT_ATTACHMENT_MAX_BYTES,
                 maxFilesPerTurn: WEB_MAX_FILES_PER_TURN,
@@ -139,16 +474,83 @@ export class WebService {
             },
         };
     }
-    createThread(sourceId) {
-        const thread = this.store.createThread(sourceId);
-        this.emit("threads.changed", thread.id, { thread });
+    /**
+     * The one bucket a bootstrap answers with.
+     *
+     * An absent or unknown `sourceId` is the ordinary case, not an error: the
+     * first request a fresh console makes has no selection to name, and a
+     * console whose stored agent has since gone away must still get a console.
+     * The chain is the one the browser resolves its own selection with -- the
+     * agent of the conversation the console was last in, else the first agent
+     * that can answer, else the first agent at all.
+     */
+    bootstrapSourceId(requested, currentThread, agents) {
+        if (requested !== undefined && agents.some((agent) => agent.sourceId === requested))
+            return requested;
+        const current = currentThread === undefined
+            ? undefined
+            : agents.find((agent) => agent.sourceId === currentThread.sourceId);
+        return current?.sourceId
+            ?? agents.find((agent) => agent.status !== "offline")?.sourceId
+            ?? agents[0]?.sourceId
+            ?? null;
+    }
+    /**
+     * The only place provider authentication is projected onto an agent summary.
+     *
+     * It is derived from the live operator connection's `/v1/info` response.
+     * `supportsProviderAuth` has an `agents` column, but the stored presentation
+     * bit is never authorization to call an agent. Keeping the field off discovery
+     * summaries prevents every heartbeat from looking like a fleet change.
+     *
+     * Provider authentication also requires a live connection deliberately:
+     * `requireProviderAuthConnection` refuses without one, so advertising it to a
+     * browser that cannot use it would expose a button whose route only 409s.
+     *
+     * `refreshAgentsOnce` tracks this projection explicitly so real transitions
+     * still emit `agents.changed` without treating heartbeats as changes.
+     */
+    decorateProjectedCapabilities(agent) {
+        const connection = this.connections.get(agent.sourceId);
+        const providerAuth = connection?.info.supportsProviderAuth === true;
+        const providerAuthChecks = connection?.info.supportsProviderAuthChecks === true;
+        if (!providerAuth)
+            return agent;
+        return {
+            ...agent,
+            supportsProviderAuth: true,
+            ...(providerAuthChecks ? { supportsProviderAuthChecks: true } : {}),
+        };
+    }
+    /**
+     * Compared pass to pass, this says provider authentication moved when
+     * nothing on the stored summary did.
+     */
+    projectedCapabilitySignature(agent) {
+        const projected = this.decorateProjectedCapabilities(agent);
+        return [
+            projected.supportsProviderAuth === true ? "providerAuth" : "",
+            projected.supportsProviderAuthChecks === true ? "providerAuthChecks" : "",
+        ].join("|");
+    }
+    createThread(sourceId, input = {}) {
+        const agent = this.store.getAgent(sourceId);
+        if (agent === undefined) {
+            throw new WebConsoleError("agent_not_found", "The selected agent is no longer available.", 404);
+        }
+        const inherited = agent.runSettings.override;
+        const model = input.model === undefined ? inherited?.model : input.model ?? undefined;
+        const effort = input.effort === undefined ? inherited?.effort : input.effort ?? undefined;
+        this.validateModelAndEffort(sourceId, agent, model, effort, input.model === undefined && inherited?.model !== undefined);
+        const thread = this.store.createThread(sourceId, input);
+        this.emitThread("threads.changed", { thread });
         return thread;
     }
-    thread(id) {
+    thread(id, options = {}) {
         const detail = this.store.getThreadDetail(id);
         if (detail === undefined)
             throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
-        return this.decorateThreadDetail(detail);
+        return this.decorateThreadDetail(detail, options);
     }
     threadsPage(input) {
         return this.store.listThreadsPage(input);
@@ -161,8 +563,56 @@ export class WebService {
         return this.store.searchThreads(input);
     }
     messagePage(threadId, input) {
-        const page = this.store.listMessagesPage(threadId, input);
-        return { ...page, messages: page.messages.map((message) => this.decorateMessage(message)) };
+        // The store pages; the shape is a view concern and has no business reaching it.
+        const { full, ...query } = input;
+        const page = this.store.listMessagesPage(threadId, query);
+        const shape = full === undefined ? {} : { full };
+        return { ...page, messages: this.shapeMessages(page.messages, shape) };
+    }
+    /**
+     * ONE message, at the version it currently holds.
+     *
+     * The recovery a streamed transcript needs: a console whose delta no longer
+     * chains onto the `seq` it is holding re-reads the one message rather than
+     * the conversation around it. Addressed by (conversation, message) for the
+     * same reason the tool-call read is -- a message id is not a capability, and
+     * a lookup that took it alone would serve any caller any conversation.
+     */
+    message(threadId, messageId, options = {}) {
+        const thread = this.store.getThread(threadId);
+        const message = this.store.getMessage(messageId);
+        if (thread === undefined || message === undefined || message.threadId !== thread.id) {
+            throw new WebConsoleError("message_not_found", "The message is unavailable.", 404);
+        }
+        return this.shapeMessage(message, options);
+    }
+    /**
+     * The untruncated payloads of ONE tool call, for a transcript that was served
+     * a preview of it.
+     *
+     * Addressed by (conversation, message, tool call) rather than by tool-call id
+     * alone: the id is not a capability, and a lookup that took it on its own
+     * would hand any caller any conversation's transcript.
+     */
+    toolCallPart(threadId, messageId, toolCallId) {
+        const thread = this.store.getThread(threadId);
+        const message = this.store.getMessage(messageId);
+        if (thread === undefined || message === undefined || message.threadId !== thread.id) {
+            throw new WebConsoleError("tool_call_not_found", "The tool call is unavailable.", 404);
+        }
+        const owned = message.parts.find((part) => (part.type === "tool-call" || part.type === "subagent") && part.toolCallId === toolCallId);
+        if (owned !== undefined)
+            return nameWholePayloads(owned);
+        for (const part of message.parts) {
+            if (part.type !== "subagent")
+                continue;
+            const call = part.calls.find((candidate) => candidate.toolCallId === toolCallId);
+            // A subagent's child owns no part of its own, so it answers as the
+            // tool-call part it would have been outside the delegation.
+            if (call !== undefined)
+                return nameWholePayloads({ type: "tool-call", ...call });
+        }
+        throw new WebConsoleError("tool_call_not_found", "The tool call is unavailable.", 404);
     }
     /**
      * Re-mint a browser capability from the authoritative durable message. The
@@ -175,7 +625,7 @@ export class WebService {
         return this.decorateReplyPart(message, part);
     }
     async replyAttachment(threadId, messageId, partId, expires, token, signal) {
-        const { thread, part } = this.authorizeReplyPart(threadId, messageId, partId, "attachment", expires, token);
+        const { thread, part, remainingSeconds } = this.authorizeReplyPart(threadId, messageId, partId, "attachment", expires, token);
         const connection = this.connections.get(thread.sourceId);
         if (connection === undefined || connection.info.replyAttachments?.version !== 1) {
             throw new WebConsoleError("reply_attachment_unavailable", "The attachment source is offline or incompatible.", 409);
@@ -191,7 +641,7 @@ export class WebService {
             ...(part.expiresAt === undefined ? {} : { expiresAt: part.expiresAt }),
         };
         const response = await connection.client.replyArtifact(this.conversationIdForThread(thread.id), attachment, signal);
-        return { part, response };
+        return { part, response, remainingSeconds };
     }
     async mcpAppResource(threadId, messageId, partId, expires, token, signal) {
         const { thread, part } = this.authorizeReplyPart(threadId, messageId, partId, "mcp_app", expires, token);
@@ -317,32 +767,71 @@ export class WebService {
         return result;
     }
     patchThread(id, patch) {
+        if (patch.ifRunConfigUnset === true) {
+            // Compare-and-set for the console's one-time adoption of a browser-local
+            // override. Whoever set an override first keeps it; the loser adopts what
+            // it reads back, and no event is emitted because nothing changed.
+            //
+            // The check and the write are one `BEGIN IMMEDIATE` inside the store, not
+            // two calls from here: this request handler is synchronous, so no other
+            // HTTP request can interleave, but the process lease is held on a
+            // separate database file and does not stop a second connection to the
+            // state DB from writing between a bare read and a bare write.
+            const result = this.store.patchThreadIfRunConfigUnset(id, patch);
+            if (!result.applied)
+                return result.thread;
+            this.emitThread("thread.changed", { thread: result.thread });
+            this.emitThread("threads.changed", { thread: result.thread });
+            return result.thread;
+        }
         const thread = this.store.patchThread(id, patch);
-        this.emit("thread.changed", thread.id, { thread });
-        this.emit("threads.changed", thread.id);
+        this.emitThread("thread.changed", { thread });
+        this.emitThread("threads.changed", { thread });
         return thread;
     }
-    async deleteThread(id) {
+    async deleteThread(id, options = {}) {
         const resolved = this.store.getThread(id)?.id;
         if (resolved === undefined)
             throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
         if (this.activeTurns.has(resolved)) {
             throw new WebConsoleError("turn_active", "Cancel the active turn before deleting this conversation.", 409);
         }
-        const result = await this.store.deleteArchivedThread(resolved);
+        const result = await this.store.deleteArchivedThread(resolved, options);
         if (result.orphanedFiles > 0) {
             this.options.logger?.warn?.("Deleted a web conversation with attachment files deferred to orphan cleanup.", {
                 threadId: resolved,
                 count: result.orphanedFiles,
             });
         }
-        this.emit("thread.changed", resolved, { threadId: resolved, removed: true });
-        this.emit("threads.changed", resolved);
+        this.emitThread("thread.changed", { threadId: resolved, removed: true });
+        this.emitThread("threads.changed", { threadId: resolved, removed: true });
     }
     patchAgent(sourceId, patch) {
         const agent = this.store.setAgentPinned(sourceId, patch.pinned);
-        this.emit("agents.changed", undefined, { agents: this.store.listAgents() });
-        return agent;
+        // A pin says exactly what it changed. The payload-less form means "discovery
+        // saw something move", which costs every open console a bootstrap plus its
+        // skills and cron -- for one boolean the pinning tab already applied from
+        // this call's own response.
+        const payload = { sourceId: agent.sourceId, pinned: agent.pinned === true };
+        this.emit("agents.changed", undefined, payload);
+        return this.decorateProjectedCapabilities(agent);
+    }
+    setAgentRunDefaults(sourceId, input) {
+        const agent = this.store.getAgent(sourceId);
+        if (agent === undefined)
+            throw new WebConsoleError("agent_not_found", "Agent not found.", 404);
+        if (this.connections.get(sourceId) === undefined || agent.status === "offline") {
+            throw new WebConsoleError("agent_offline", "This agent is offline. Reconnect it before saving new defaults.", 409);
+        }
+        this.validateModelAndEffort(sourceId, agent, input.model ?? undefined, input.effort ?? undefined, true);
+        const updated = this.store.setAgentRunOverride(sourceId, input);
+        this.emit("agents.changed");
+        return this.decorateProjectedCapabilities(updated);
+    }
+    clearAgentRunDefaults(sourceId) {
+        const agent = this.store.clearAgentRunOverride(sourceId);
+        this.emit("agents.changed");
+        return this.decorateProjectedCapabilities(agent);
     }
     agentSkills(sourceId) {
         const agent = this.store.getAgent(sourceId);
@@ -387,7 +876,7 @@ export class WebService {
             const stored = this.store.storedCronRuns(sourceId, jobId, input.limit);
             return stored.messages === undefined
                 ? stored
-                : { ...stored, messages: stored.messages.map((message) => this.decorateMessage(message)) };
+                : { ...stored, messages: stored.messages.map((message) => this.shapeMessage(message)) };
         }
         const page = await connection.client.cronRuns(jobId, {
             limit: input.limit,
@@ -396,25 +885,192 @@ export class WebService {
         });
         const reconciled = this.store.reconcileCronRunsResult(sourceId, jobId, page.runs);
         if (reconciled.changed) {
-            const threadId = this.store.cronThread(sourceId, jobId)?.id;
-            this.emit("thread.changed", threadId);
-            this.emit("threads.changed", threadId);
+            this.announceReconciledMessages(reconciled);
+            this.emitStoredThread(this.store.cronThread(sourceId, jobId)?.id, ["thread.changed", "threads.changed"]);
         }
-        return { ...page, messages: reconciled.messages.map((message) => this.decorateMessage(message)) };
+        return { ...page, messages: reconciled.messages.map((message) => this.shapeMessage(message)) };
     }
     async cronRun(sourceId, jobId, runId) {
         const connection = this.requireCronConnection(sourceId, false);
         const run = await connection.client.cronRun(jobId, runId, AbortSignal.timeout(INFO_TIMEOUT_MS));
         const reconciled = this.store.reconcileCronRunsResult(sourceId, jobId, [run]);
         const message = reconciled.messages[0];
+        if (reconciled.changed) {
+            this.announceReconciledMessages(reconciled);
+            this.emitStoredThread(this.store.cronThread(sourceId, jobId)?.id, ["thread.changed", "threads.changed"]);
+        }
         if (message === undefined) {
+            if (reconciled.suppressedRunIds?.includes(runId)) {
+                throw new WebConsoleError("cron_run_not_visible", "This cron run has no visible message.", 404);
+            }
             throw new WebConsoleError("invalid_operator_cron", "Cron detail did not reconcile a message.", 502);
         }
-        if (reconciled.changed) {
-            this.emit("thread.changed", message.threadId, { messageId: message.id });
-            this.emit("threads.changed", message.threadId);
+        return this.shapeMessage(message);
+    }
+    createCronReplyThread(sourceId, jobId, runId, input) {
+        const running = this.activeCronReplies.get(input.operationId);
+        if (running !== undefined) {
+            if (running.sourceId !== sourceId || running.jobId !== jobId || running.runId !== runId) {
+                return Promise.reject(new WebConsoleError("cron_reply_operation_conflict", "Cron reply operation id was used for another run.", 409));
+            }
+            return running.promise;
+        }
+        const operation = this.createCronReplyThreadOnce(sourceId, jobId, runId, input)
+            .then((receipt) => ({ ...receipt, messages: this.shapeMessages(receipt.messages) }));
+        this.activeCronReplies.set(input.operationId, { sourceId, jobId, runId, promise: operation });
+        const release = () => {
+            if (this.activeCronReplies.get(input.operationId)?.promise === operation) {
+                this.activeCronReplies.delete(input.operationId);
+            }
+        };
+        void operation.then(release, release);
+        return operation;
+    }
+    async createCronReplyThreadOnce(sourceId, jobId, runId, input) {
+        let state = this.store.cronReplyOperation(input.operationId);
+        if (state !== undefined) {
+            this.assertCronReplyStateIdentity(state, sourceId, jobId, runId);
+            const terminal = this.cronReplyTerminalResult(state);
+            if (terminal !== undefined)
+                return terminal;
+        }
+        const candidate = state === undefined
+            ? this.store.captureCronReplySnapshot(sourceId, jobId, runId, input.snapshotKind)
+            : undefined;
+        const connection = this.connections.get(sourceId);
+        if (connection === undefined) {
+            throw new WebConsoleError("cron_reply_agent_offline", "This agent is offline; Reply was not started.", 503);
+        }
+        if (connection.info.contextImport?.version !== 1
+            || connection.info.contextImport.maxTextBytes < AGENT_CONTEXT_IMPORT_MAX_TEXT_BYTES) {
+            throw new WebConsoleError("cron_reply_unsupported", "This agent does not support canonical cron-result Reply.", 503);
+        }
+        if (state === undefined) {
+            state = this.store.reserveCronReplyOperation(input.operationId, candidate);
+            this.assertCronReplyStateIdentity(state, sourceId, jobId, runId);
+            const terminal = this.cronReplyTerminalResult(state);
+            if (terminal !== undefined)
+                return terminal;
+            if (state.kind === "pending" && state.operation.operationId !== input.operationId) {
+                throw new WebConsoleError("cron_reply_pending", "A Reply for this cron result is already pending. Retry it explicitly.", 409, { operationId: state.operation.operationId });
+            }
         }
-        return this.decorateMessage(message);
+        if (state.kind !== "reserved" && state.kind !== "pending") {
+            throw new WebConsoleError("cron_reply_operation_conflict", "Cron reply operation cannot continue.", 409);
+        }
+        const reservation = state.operation;
+        if (reservation.snapshotText === undefined) {
+            throw new WebConsoleError("storage_corrupt", "Pending cron reply lost its immutable snapshot.", 500);
+        }
+        let canonicalStatus;
+        try {
+            canonicalStatus = await connection.client.recordContextImport(reservation.conversationId, reservation.snapshotText, reservation.idempotencyKey);
+        }
+        catch (error) {
+            if (error instanceof WebConsoleError
+                && (error.code === "context_import_conflict"
+                    || error.code === "context_import_failed"
+                    || error.code === "context_import_unsupported")) {
+                const failed = this.store.failCronReplyOperation(input.operationId, typeof error.details?.reason === "string" ? error.details.reason : error.code);
+                const wonRace = this.cronReplyTerminalResult(failed);
+                if (wonRace !== undefined)
+                    return wonRace;
+                throw new WebConsoleError(error.code === "context_import_conflict"
+                    ? "cron_reply_conflict"
+                    : error.code === "context_import_unsupported"
+                        ? "cron_reply_unsupported"
+                        : "cron_reply_failed", error.message, error.code === "context_import_conflict" ? 409 : error.code === "context_import_unsupported" ? 503 : 502);
+            }
+            throw new WebConsoleError("cron_reply_outcome_unknown", "Cron Reply may have reached the agent. Retry explicitly to resolve it.", 504, { operationId: input.operationId });
+        }
+        const completed = this.store.completeCronReplyOperation(input.operationId, canonicalStatus);
+        const receipt = this.cronReplyTerminalResult(completed);
+        if (receipt === undefined) {
+            throw new WebConsoleError("cron_reply_operation_conflict", "Cron reply operation did not complete.", 409);
+        }
+        if (!receipt.duplicate) {
+            for (const message of receipt.messages) {
+                if (this.isCronReplyProvenanceMessage(message))
+                    continue;
+                this.emit("message.changed", receipt.thread.id, { messageId: message.id, updatedAt: message.updatedAt });
+            }
+            this.emitThread("threads.changed", { thread: receipt.thread });
+            this.emitThread("thread.changed", { thread: receipt.thread });
+        }
+        return receipt;
+    }
+    assertCronReplyStateIdentity(state, sourceId, jobId, runId) {
+        const identity = state.kind === "completed" ? state.receipt : state.operation;
+        if (identity.sourceId !== sourceId || identity.jobId !== jobId || identity.runId !== runId) {
+            throw new WebConsoleError("cron_reply_operation_conflict", "Cron reply operation id was used for another run.", 409);
+        }
+    }
+    cronReplyTerminalResult(state) {
+        if (state.kind === "completed")
+            return state.receipt;
+        if (state.kind === "tombstoned") {
+            throw new WebConsoleError("cron_reply_gone", "This imported conversation was deleted.", 410);
+        }
+        if (state.kind === "failed") {
+            throw new WebConsoleError("cron_reply_failed", "This cron Reply failed definitively; start a new Reply to try again.", 409, {
+                ...(state.operation.failureReason === undefined ? {} : { reason: state.operation.failureReason }),
+            });
+        }
+        return undefined;
+    }
+    async agentModels(sourceId, input) {
+        const agent = this.store.getAgent(sourceId);
+        if (agent === undefined)
+            throw new WebConsoleError("agent_not_found", "Agent not found.", 404);
+        const connection = this.connections.get(sourceId);
+        if (connection === undefined)
+            throw new WebConsoleError("agent_offline", "This agent is offline.", 409);
+        const generation = this.modelCatalogCache.get(sourceId)?.generation;
+        const page = await connection.client.models({
+            ...(input.provider === undefined ? {} : { provider: input.provider }),
+            ...(input.q === undefined ? {} : { q: input.q }),
+            ...(input.cursor === undefined ? {} : { cursor: input.cursor }),
+            limit: input.limit,
+            signal: AbortSignal.timeout(INFO_TIMEOUT_MS),
+        });
+        // Every proxied page widens the per-agent catalog cache, the only feed
+        // (besides `modelOptions` keys) that makes tier-2 model admission possible,
+        // and the only place the effort ladder a catalog model advertises is ever
+        // seen -- `modelOptions` never describes it, so dropping it here is what
+        // left effort validation with nothing to judge against.
+        //
+        // Admitted under the generation the request was ISSUED under, never under
+        // whatever is current when it answers. A discovery refresh can retire this
+        // agent's generation inside the await above, and keyed by source id alone
+        // the reply -- fetched from a process that is gone -- was written straight
+        // into the freshly reconciled map, where `source: "page"` overwrites
+        // unconditionally. Generation 1's ladder then judged generation 2's turns.
+        this.admitModelPage(sourceId, generation, page);
+        return page;
+    }
+    async providerAuthStatus(sourceId) {
+        return await this.providerAuthCall(sourceId, async (connection) => await connection.client.providerAuthStatus(AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async startProviderAuth(sourceId, input) {
+        return await this.providerAuthCall(sourceId, async (connection) => await connection.client.startProviderAuth(input, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async providerAuthSession(sourceId, sessionId) {
+        return await this.providerAuthCall(sourceId, async (connection) => await connection.client.providerAuthSession(sessionId, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async submitProviderAuth(sourceId, sessionId, input) {
+        return await this.providerAuthCall(sourceId, async (connection) => await connection.client.submitProviderAuth(sessionId, input, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async cancelProviderAuth(sourceId, sessionId) {
+        await this.providerAuthCall(sourceId, async (connection) => await connection.client.cancelProviderAuth(sessionId, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async startProviderAuthCheck(sourceId, input) {
+        return await this.providerAuthCheckCall(sourceId, async (connection) => await connection.client.startProviderAuthCheck(input, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async providerAuthCheck(sourceId, checkId) {
+        return await this.providerAuthCheckCall(sourceId, async (connection) => await connection.client.providerAuthCheck(checkId, AbortSignal.timeout(INFO_TIMEOUT_MS)));
+    }
+    async cancelProviderAuthCheck(sourceId, checkId) {
+        await this.providerAuthCheckCall(sourceId, async (connection) => await connection.client.cancelProviderAuthCheck(checkId, AbortSignal.timeout(INFO_TIMEOUT_MS)));
     }
     async cronConfigView(sourceId) {
         const connection = this.requireCronConnection(sourceId, false);
@@ -426,9 +1082,8 @@ export class WebService {
         if (result.kind === "completed") {
             const reconciled = this.store.reconcileCronRunsResult(sourceId, jobId, [result.value.run]);
             if (reconciled.changed) {
-                const threadId = this.store.cronThread(sourceId, jobId)?.id;
-                this.emit("thread.changed", threadId);
-                this.emit("threads.changed", threadId);
+                this.announceReconciledMessages(reconciled);
+                this.emitStoredThread(this.store.cronThread(sourceId, jobId)?.id, ["thread.changed", "threads.changed"]);
             }
         }
         return result;
@@ -446,8 +1101,7 @@ export class WebService {
             throw new WebConsoleError("invalid_operator_cron", "Updated cron job disappeared.", 502);
         if (synced.changed) {
             this.emit("cron.changed", job.threadId, { sourceId, jobId });
-            this.emit("thread.changed", job.threadId, { thread: this.store.getThread(job.threadId) });
-            this.emit("threads.changed", job.threadId);
+            this.emitStoredThread(job.threadId, ["thread.changed", "threads.changed"]);
         }
         return { ...result, value: { job } };
     }
@@ -455,10 +1109,40 @@ export class WebService {
         if (this.stopped) {
             throw new WebConsoleError("web_service_stopping", "The web service is stopping.", 409);
         }
-        if (this.store.getAgent(input.sourceId) === undefined)
+        // Monitor wakes are addressed to a retained thread, so they must reach the
+        // wake-specific retry/abandon path even after discovery has removed the
+        // source from the picker. New source-scoped deliveries still refresh before
+        // the store decides whether the agent exists.
+        if (input.triggerKind !== "monitor" && this.store.getAgent(input.sourceId) === undefined) {
             await this.refreshAgents();
+        }
+        if (this.stopped) {
+            throw new WebConsoleError("web_service_stopping", "The web service is stopping.", 409);
+        }
+        if (input.triggerKind === "monitor") {
+            assertMonitorWakeAddress(input);
+            const thread = this.store.getThread(input.threadId);
+            if (thread === undefined || thread.sourceId !== input.sourceId) {
+                return {
+                    duplicate: true,
+                    tombstoned: true,
+                    delivery: { delivered: false, code: "monitor_origin_mismatch", retryable: false },
+                };
+            }
+            if (thread.archivedAt !== null || thread.trigger !== undefined) {
+                return {
+                    thread,
+                    duplicate: false,
+                    delivery: { delivered: false, code: "monitor_wake_failed", retryable: false },
+                };
+            }
+            const result = await this.deliverMonitorWake(input);
+            return { thread, duplicate: result.duplicate, delivery: result.receipt };
+        }
         if (input.triggerKind === "job") {
-            const completed = this.store.upsertProcessJobCard({
+            // Destructured off: the card's message id is how this service addresses
+            // the invalidation, and it is not part of the delivery result on the wire.
+            const { messageId, ...completed } = this.store.upsertProcessJobCard({
                 sourceId: input.sourceId,
                 threadId: input.threadId,
                 deliveryKey: input.deliveryKey,
@@ -466,16 +1150,24 @@ export class WebService {
                 ...(input.text === undefined ? {} : { responseText: input.text }),
                 ...(input.parts === undefined ? {} : { replyParts: input.parts }),
             });
-            const message = this.store.getThreadDetail(input.threadId)?.messages.find((candidate) => candidate.parts.some((part) => part.type === "process-job" && part.job.jobId === input.processJob.jobId));
+            // Addressed, not searched. Scanning a page of the conversation meant a job
+            // that finished behind thirty later messages emitted no invalidation at
+            // all, and its card sat at "running" until something else forced a read.
+            const message = this.store.getMessage(messageId);
             if (!completed.duplicate && message !== undefined) {
                 this.emit("message.changed", input.threadId, { messageId: message.id, updatedAt: message.updatedAt });
             }
-            this.emit("threads.changed", input.threadId, { thread: completed.thread });
-            this.emit("thread.changed", input.threadId, { thread: completed.thread });
+            // Read back rather than trusted: the shared notification result leaves the
+            // conversation optional, and an event that carries `undefined` is exactly
+            // the bare event this normalisation exists to remove.
+            this.emitStoredThread(input.threadId, ["threads.changed", "thread.changed"]);
             if (input.wakePrompt === undefined)
                 return completed;
             if (this.connections.get(input.sourceId) === undefined)
                 await this.refreshAgents();
+            if (this.stopped) {
+                throw new WebConsoleError("web_service_stopping", "The web service is stopping.", 409);
+            }
             const delivery = await this.deliverProcessJobWake(input);
             return { ...completed, delivery };
         }
@@ -515,28 +1207,148 @@ export class WebService {
     async startTurn(threadId, input) {
         const text = input.text ?? "";
         const operatorText = input.quote === undefined ? text : formatQuotedTurn(input.quote.text, text);
-        if (operatorText.length > WEB_MAX_TURN_TEXT_CHARACTERS) {
-            throw new WebConsoleError("turn_text_too_large", `The message and quote may contain at most ${WEB_MAX_TURN_TEXT_CHARACTERS} characters after formatting.`, 413);
-        }
+        assertTurnTextWithinLimit(operatorText);
         const attachmentIds = input.attachmentIds ?? [];
-        const thread = this.store.getThread(threadId);
-        if (thread === undefined)
-            throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
+        const selection = this.resolveTurnSelection(threadId, input.model, input.effort);
+        const { thread, agent, model, effort, requestedModel, requestedEffort } = selection;
         threadId = thread.id;
-        const agent = this.store.getAgent(thread.sourceId);
         const connection = this.connections.get(thread.sourceId);
         if (thread.trigger?.kind === "cron")
             throw cronChannelReadOnlyError();
-        if (agent === undefined || connection === undefined || !thread.canSend) {
+        if (connection === undefined || !thread.canSend) {
             throw new WebConsoleError("agent_offline", "This agent is offline. The conversation remains available read-only.", 409);
         }
-        validateModelAndEffort(agent, input.model, input.effort);
-        const started = this.store.beginTurn({ threadId, text, attachmentIds, ...(input.quote === undefined ? {} : { quote: input.quote }), ...(input.model === undefined ? {} : { model: input.model }), ...(input.effort === undefined ? {} : { effort: input.effort }) });
+        const started = this.store.beginTurn({
+            threadId,
+            text,
+            attachmentIds,
+            ...(input.quote === undefined ? {} : { quote: input.quote }),
+            ...(model === undefined ? {} : { model }),
+            ...(effort === undefined ? {} : { effort }),
+            ...(requestedModel === undefined ? {} : { requestedModel }),
+            ...(requestedEffort === undefined ? {} : { requestedEffort }),
+        });
         this.launchTurn(started, connection.client, operatorText);
+        // The operator's own row, inserted by `beginTurn` and announced by nothing
+        // else. A console that did not issue this turn holds neither it nor the
+        // assistant row the deltas are about to describe, and it no longer answers
+        // a conversation summary by re-reading the transcript.
+        this.emit("message.changed", threadId, {
+            messageId: started.userMessageId,
+            updatedAt: started.thread.updatedAt,
+        });
         this.emit("turn.changed", threadId, { turn: started.thread.runState });
-        this.emit("threads.changed", threadId);
+        this.emitThread("threads.changed", { thread: started.thread });
         return { thread: started.thread, turn: started.thread.runState };
     }
+    submit(threadId, input) {
+        if (this.stopped)
+            throw new WebConsoleError("web_service_stopping", "The web service is stopping.", 409);
+        const thread = this.store.getThread(threadId);
+        if (thread === undefined)
+            throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
+        threadId = thread.id;
+        const text = input.text ?? "";
+        const attachmentIds = input.attachmentIds ?? [];
+        const operatorText = input.quote === undefined ? text : formatQuotedTurn(input.quote.text, text);
+        const payloadSha256 = createHash("sha256").update(JSON.stringify({
+            text,
+            quote: input.quote ?? null,
+            attachmentIds,
+            model: input.model ?? null,
+            effort: input.effort ?? null,
+        })).digest("hex");
+        const existing = this.store.webSubmission(threadId, input.submissionId);
+        if (existing !== undefined) {
+            if (existing.payloadSha256 !== payloadSha256) {
+                throw new WebConsoleError("submission_conflict", "Submission id was already used for different content.", 409);
+            }
+            return this.submissionReceipt(existing);
+        }
+        assertTurnTextWithinLimit(operatorText);
+        if (thread.trigger?.kind === "cron")
+            throw cronChannelReadOnlyError();
+        const connection = this.connections.get(thread.sourceId);
+        if (connection === undefined || !thread.canSend) {
+            throw new WebConsoleError("agent_offline", "This agent is offline. The conversation remains available read-only.", 409);
+        }
+        let started;
+        let reserved;
+        const activeTurnId = this.store.activeTurn(threadId)?.id;
+        const activeTarget = activeTurnId === undefined ? undefined : this.activeTurns.get(threadId);
+        const ownsActiveTarget = activeTarget?.turnId === activeTurnId;
+        const claimed = this.store.claimWebSubmission({
+            threadId,
+            submissionId: input.submissionId,
+            payloadSha256,
+            create: () => {
+                if (activeTurnId !== undefined && attachmentIds.length > 0) {
+                    return { outcome: "rejected", reason: "active_attachments_unsupported" };
+                }
+                if (activeTurnId !== undefined) {
+                    reserved = this.store.reserveLiveInput(threadId, text, input.quote, operatorText);
+                    if (!connection.info.supportsLiveInputTargeting || !ownsActiveTarget) {
+                        const reason = connection.info.supportsLiveInputTargeting
+                            ? "closed_before_dispatch"
+                            : "unsupported_targeting";
+                        this.store.queueLiveInput(reserved.input.id, reason);
+                        return {
+                            outcome: "live-input",
+                            reason,
+                            messageId: reserved.message.id,
+                            inputId: reserved.input.id,
+                            turnId: activeTurnId,
+                        };
+                    }
+                    return {
+                        outcome: "live-input",
+                        messageId: reserved.message.id,
+                        inputId: reserved.input.id,
+                        turnId: activeTurnId,
+                    };
+                }
+                const { model, effort, requestedModel, requestedEffort } = this.resolveTurnSelection(threadId, input.model, input.effort);
+                started = this.store.beginTurn({
+                    threadId,
+                    text,
+                    attachmentIds,
+                    ...(input.quote === undefined ? {} : { quote: input.quote }),
+                    ...(model === undefined ? {} : { model }),
+                    ...(effort === undefined ? {} : { effort }),
+                    ...(requestedModel === undefined ? {} : { requestedModel }),
+                    ...(requestedEffort === undefined ? {} : { requestedEffort }),
+                });
+                return {
+                    outcome: "turn",
+                    messageId: started.userMessageId,
+                    turnId: started.turnId,
+                };
+            },
+        });
+        if (claimed.created && started !== undefined) {
+            this.launchTurn(started, connection.client, operatorText);
+            this.emit("message.changed", threadId, { messageId: started.userMessageId, updatedAt: started.thread.updatedAt });
+            this.emit("turn.changed", threadId, { turn: started.thread.runState });
+            this.emitThread("threads.changed", { thread: started.thread });
+        }
+        else if (claimed.created && reserved !== undefined) {
+            this.emit("message.changed", threadId, { messageId: reserved.message.id, updatedAt: reserved.message.updatedAt });
+            this.emitThread("threads.changed", { thread: reserved.thread });
+            if (claimed.submission.reason !== undefined || activeTarget === undefined) {
+                void this.drainQueuedLiveInputs(threadId);
+            }
+            else {
+                void this.dispatchTargetedSubmission(claimed.submission, activeTarget);
+            }
+        }
+        return this.submissionReceipt(claimed.submission);
+    }
+    submission(threadId, submissionId) {
+        const stored = this.store.webSubmission(threadId, submissionId);
+        if (stored === undefined)
+            throw new WebConsoleError("submission_not_found", "Submission not found.", 404);
+        return this.submissionReceipt(stored);
+    }
     submitLiveInput(threadId, text) {
         if (this.stopped) {
             throw new WebConsoleError("web_service_stopping", "The web service is stopping.", 409);
@@ -549,13 +1361,21 @@ export class WebService {
         const active = this.activeTurns.get(threadId);
         const reserved = this.store.reserveLiveInput(threadId, text);
         this.emit("message.changed", threadId, { messageId: reserved.message.id, updatedAt: reserved.message.updatedAt });
-        this.emit("threads.changed", threadId);
+        this.emitThread("threads.changed", { thread: reserved.thread });
         if (!reserved.offered || active === undefined || connection === undefined || !connection.info.supportsLiveInput) {
             const queued = reserved.offered ? this.store.queueLiveInput(reserved.input.id) ?? reserved.message : reserved.message;
             this.emit("message.changed", threadId, { messageId: queued.id, updatedAt: queued.updatedAt });
             void this.drainQueuedLiveInputs(threadId);
             return { message: queued, disposition: "queued" };
         }
+        if (!this.store.markLiveInputDispatchStarted(reserved.input.id, active.turnId)) {
+            // A concurrent terminal transition won before the request boundary. Do
+            // not dispatch and do not recreate a fallback from stale in-memory state.
+            return {
+                message: this.store.getMessage(reserved.message.id) ?? reserved.message,
+                disposition: "pending",
+            };
+        }
         const controller = new AbortController();
         const completion = this.deliverLiveInput(reserved.input.id, threadId, active.client, controller, {
             conversationId: `web:${threadId}`,
@@ -678,6 +1498,17 @@ export class WebService {
     readyEvent() {
         return this.createEvent("ready", undefined, { version: WEB_API_VERSION });
     }
+    /**
+     * The id a conversation is known by NOW, following whatever superseded it.
+     *
+     * Every read resolves redirects on its way through the store; the event
+     * stream matches its subscription by string equality against the id events
+     * carry, so it has to ask for the same resolution explicitly. An id nothing
+     * superseded resolves to itself, so this is safe for any string.
+     */
+    resolveThreadId(id) {
+        return this.store.resolveThreadId(id);
+    }
     refreshAgents() {
         if (this.stopped)
             return Promise.resolve();
@@ -709,7 +1540,7 @@ export class WebService {
         const active = [...this.activeTurns.values()];
         const activeLiveInputs = [...this.activeLiveInputs.entries()];
         const activeNotifications = [...this.activeNotifications.values()];
-        const activeProcessJobWakes = [...this.activeProcessJobWakes.values()];
+        const activeHostWakes = [...this.activeHostWakes.values()];
         const trackedIds = new Set(active.map((turn) => turn.turnId));
         for (const turnId of this.store.listActiveTurnIds()) {
             if (!trackedIds.has(turnId))
@@ -720,12 +1551,15 @@ export class WebService {
             turn.controller.abort(new WebTurnCancellation("shutdown", "Web service is stopping."));
         }
         for (const [id, input] of activeLiveInputs) {
-            this.store.queueLiveInput(id);
+            // Dispatch has already crossed the durable marker boundary. Seal it as
+            // uncertain before abort so a crash at any later shutdown cut-point can
+            // never recover it into the automatic next-turn queue.
+            this.store.markLiveInputUncertain(id);
             input.controller.abort(new WebTurnCancellation("shutdown", "Web service is stopping."));
         }
         await Promise.allSettled(active.map((turn) => turn.completion));
         await Promise.allSettled(activeLiveInputs.map(([, input]) => input.completion));
-        await Promise.allSettled(activeProcessJobWakes);
+        await Promise.allSettled(activeHostWakes);
         await Promise.allSettled(activeNotifications);
         await Promise.allSettled(askWatches.map((watch) => watch.promise));
         await this.pushDispatcher.stopAndDrain(5_000);
@@ -737,10 +1571,9 @@ export class WebService {
         this.store.close();
         await this.lease.release();
     }
-    async runTurn(started, client, controller, operatorText, processJobWakeDeliveryKey) {
+    async runTurn(started, client, controller, operatorText, hostWakeDeliveryKey, onAdmitted) {
         const coalescer = new StreamFrameCoalescer(async (frames) => {
-            const message = this.store.applyStreamFrames(started.turnId, frames);
-            this.emit("message.changed", started.thread.id, { messageId: message.id, updatedAt: message.updatedAt });
+            this.emitMessageWrite(started.thread.id, this.store.applyStreamFrames(started.turnId, frames));
         }, (error) => controller.abort(error));
         let releaseAttachmentBudget;
         try {
@@ -761,24 +1594,32 @@ export class WebService {
                         threadId: started.thread.id,
                         turnId: started.turnId,
                         ...modelMetadata,
-                        ...(processJobWakeDeliveryKey === undefined && this.store.canApplyAgentTitle(started.thread.id)
+                        ...(hostWakeDeliveryKey === undefined && this.store.canApplyAgentTitle(started.thread.id)
                             ? { conversationTitle: { schema: 1, writable: true } }
                             : {}),
                     },
                     tui: modelMetadata,
                 },
-                ...(processJobWakeDeliveryKey === undefined ? {} : { processJobWakeDeliveryKey }),
+                ...(hostWakeDeliveryKey === undefined ? {} : { processJobWakeDeliveryKey: hostWakeDeliveryKey }),
                 onFrame: (frame) => {
                     this.observeAskUserFrame(started.thread.id, started.turnId, frame);
                     this.observeConversationTitleFrame(started.thread.id, started.turnId, frame);
                     coalescer.push(frame);
                 },
+                ...(onAdmitted === undefined ? {} : { onAdmitted }),
             });
             await coalescer.flush();
-            const detail = this.store.completeTurn(started.turnId, response.finalText, response.metadata, response.parts);
+            const silentMonitorWake = hostWakeDeliveryKey?.startsWith("monitor:") === true
+                && (response.finalText === undefined || response.finalText.length === 0)
+                && (response.parts === undefined || response.parts.length === 0);
+            const detail = this.store.completeTurn(started.turnId, response.finalText, response.metadata, response.parts, {
+                suppressResponsePush: silentMonitorWake,
+                ...(hostWakeDeliveryKey === undefined ? {} : { monitorWakeDeliveryKey: hostWakeDeliveryKey }),
+            });
+            this.emitMessageWrite(started.thread.id, detail.write);
             this.emit("turn.changed", started.thread.id, { turn: detail.thread.runState });
-            this.emit("thread.changed", started.thread.id, { revision: detail.thread.revision });
-            this.emit("threads.changed", started.thread.id);
+            this.emitThread("thread.changed", { thread: detail.thread });
+            this.emitThread("threads.changed", { thread: detail.thread });
             this.announcePushEvent(`turn:${started.turnId}:terminal`);
             // Detached: the turn is already finished and reported, and keeping a copy
             // must neither delay nor fail it. The agent is still connected here, which
@@ -802,9 +1643,10 @@ export class WebService {
                 ...(code === undefined ? {} : { code }),
                 cancelled,
             });
+            this.emitMessageWrite(started.thread.id, detail.write);
             this.emit("turn.changed", started.thread.id, { turn: detail.thread.runState });
-            this.emit("thread.changed", started.thread.id, { revision: detail.thread.revision });
-            this.emit("threads.changed", started.thread.id);
+            this.emitThread("thread.changed", { thread: detail.thread });
+            this.emitThread("threads.changed", { thread: detail.thread });
             this.announcePushEvent(`turn:${started.turnId}:terminal`);
         }
         finally {
@@ -812,19 +1654,80 @@ export class WebService {
             coalescer.close();
         }
     }
-    launchTurn(started, client, operatorText, processJobWakeDeliveryKey) {
+    launchTurn(started, client, operatorText, hostWakeDeliveryKey) {
         const threadId = started.thread.id;
         const controller = new AbortController();
-        const completion = this.runTurn(started, client, controller, operatorText, processJobWakeDeliveryKey).finally(() => {
+        let resolveAdmitted;
+        const admitted = new Promise((resolve) => { resolveAdmitted = resolve; });
+        const completion = this.runTurn(started, client, controller, operatorText, hostWakeDeliveryKey, () => { resolveAdmitted(true); }).finally(() => {
+            // Inert once admission already resolved; the turn settled without the
+            // operator ever returning a stream when it did not.
+            resolveAdmitted(false);
             const active = this.activeTurns.get(threadId);
             if (active?.turnId === started.turnId)
                 this.activeTurns.delete(threadId);
-            if (!this.stopped && !this.processJobWakeReservations.has(threadId)) {
+            if (!this.stopped && !this.hostWakeReservations.has(threadId)) {
                 void this.drainQueuedLiveInputs(threadId);
             }
         });
-        this.activeTurns.set(threadId, { turnId: started.turnId, controller, client, completion });
-        return completion;
+        this.activeTurns.set(threadId, {
+            turnId: started.turnId,
+            controller,
+            client,
+            completion,
+            admitted,
+            resolveAdmitted,
+        });
+        return { completion, admitted };
+    }
+    submissionReceipt(submission) {
+        const message = submission.messageId === undefined ? undefined : this.store.getMessage(submission.messageId);
+        const thread = this.store.getThread(submission.threadId);
+        return {
+            submissionId: submission.submissionId,
+            threadId: submission.threadId,
+            outcome: submission.outcome,
+            ...(submission.reason === undefined ? {} : { reason: submission.reason }),
+            ...(submission.messageId === undefined ? {} : { messageId: submission.messageId }),
+            ...(submission.turnId === undefined ? {} : { turnId: submission.turnId }),
+            ...(message === undefined ? {} : { message }),
+            ...(submission.turnId === undefined || thread?.runState.id !== submission.turnId
+                ? {}
+                : { turn: thread.runState }),
+            ...(submission.outcome !== "live-input"
+                ? {}
+                : message?.liveInputStatus === "queued"
+                    ? { disposition: "queued" }
+                    : message?.liveInputStatus === "pending"
+                        ? { disposition: "pending" }
+                        : {}),
+        };
+    }
+    async dispatchTargetedSubmission(submission, active) {
+        if (submission.inputId === undefined || submission.messageId === undefined || submission.turnId === undefined)
+            return;
+        await active.admitted;
+        if (this.activeTurns.get(submission.threadId) !== active
+            || this.store.activeTurn(submission.threadId)?.id !== submission.turnId) {
+            const queued = this.store.queueLiveInput(submission.inputId, "closed_before_dispatch");
+            if (queued !== undefined) {
+                this.emit("message.changed", submission.threadId, { messageId: queued.id, updatedAt: queued.updatedAt });
+                void this.drainQueuedLiveInputs(submission.threadId);
+            }
+            return;
+        }
+        const input = this.store.storedLiveInput(submission.inputId);
+        if (input === undefined || !this.store.markLiveInputDispatchStarted(submission.inputId, submission.turnId))
+            return;
+        const controller = new AbortController();
+        const completion = this.deliverLiveInput(submission.inputId, submission.threadId, active.client, controller, {
+            conversationId: `web:${submission.threadId}`,
+            id: submission.inputId,
+            text: input.text,
+            receivedAt: input.createdAt,
+            targetTurnId: submission.turnId,
+        }).finally(() => this.activeLiveInputs.delete(submission.inputId));
+        this.activeLiveInputs.set(submission.inputId, { threadId: submission.threadId, controller, completion });
     }
     async deliverLiveInput(id, threadId, client, controller, input) {
         let queued = false;
@@ -837,16 +1740,22 @@ export class WebService {
             else if (result.status === "discarded") {
                 changedMessage = this.store.cancelLiveInput(id);
             }
-            else {
-                changedMessage = this.store.queueLiveInput(id);
+            else if (result.status === "requeue") {
+                changedMessage = this.store.queueLiveInput(id, `mailbox_${result.reason}`);
                 queued = changedMessage !== undefined;
             }
+            else if (result.status === "unavailable") {
+                changedMessage = this.store.queueLiveInput(id, `operator_${result.reason}`);
+                queued = changedMessage !== undefined;
+            }
+            else {
+                changedMessage = this.store.markLiveInputUncertain(id);
+            }
         }
         catch (error) {
-            changedMessage = this.store.queueLiveInput(id);
-            queued = changedMessage !== undefined;
+            changedMessage = this.store.markLiveInputUncertain(id);
             if (!controller.signal.aborted) {
-                this.options.logger?.debug?.("Web live-input delivery failed; queued as a turn.", {
+                this.options.logger?.debug?.("Web live-input delivery outcome is uncertain; automatic fallback is suppressed.", {
                     threadId,
                     error: errorMessage(error),
                 });
@@ -858,14 +1767,14 @@ export class WebService {
                 updatedAt: changedMessage.updatedAt,
             });
         }
-        this.emit("threads.changed", threadId);
+        this.emitStoredThread(threadId, ["threads.changed"]);
         if (queued && !this.stopped)
             await this.drainQueuedLiveInputs(threadId);
     }
     async drainQueuedLiveInputs(threadId) {
         if (this.stopped
             || this.activeTurns.has(threadId)
-            || this.processJobWakeReservations.has(threadId)
+            || this.hostWakeReservations.has(threadId)
             || this.drainingLiveInputThreads.has(threadId))
             return;
         this.drainingLiveInputThreads.add(threadId);
@@ -880,20 +1789,28 @@ export class WebService {
             if (started === undefined)
                 return;
             this.launchTurn(started, connection.client, started.text);
+            // BOTH rows. `promoteNextQueuedLiveInput` rewrites the queued operator
+            // message (its live-input status becomes "applied") as well as opening
+            // the assistant row, and a console that heard only about the second was
+            // left showing a steer that still reads "queued".
+            this.emit("message.changed", threadId, {
+                messageId: started.userMessageId,
+                updatedAt: started.thread.updatedAt,
+            });
             this.emit("message.changed", threadId, {
                 messageId: started.assistantMessageId,
                 updatedAt: started.thread.updatedAt,
             });
             this.emit("turn.changed", threadId, { turn: started.thread.runState });
-            this.emit("threads.changed", threadId);
+            this.emitThread("threads.changed", { thread: started.thread });
         }
         finally {
             this.drainingLiveInputThreads.delete(threadId);
         }
     }
     async deliverProcessJobWake(input) {
-        const activeKey = `${input.sourceId}\0${input.processJob.jobId}`;
-        const existing = this.activeProcessJobWakes.get(activeKey);
+        const activeKey = `${input.sourceId}\0${input.deliveryKey}`;
+        const existing = this.activeHostWakes.get(activeKey);
         if (existing !== undefined)
             return await existing;
         const reservation = this.store.reserveProcessJobWake({
@@ -913,8 +1830,8 @@ export class WebService {
                 ambiguous: true,
             };
         }
-        this.retainProcessJobWakeReservation(input.threadId);
-        const previous = this.processJobWakeTails.get(input.threadId) ?? Promise.resolve();
+        this.retainHostWakeReservation(input.threadId);
+        const previous = this.hostWakeTails.get(input.threadId) ?? Promise.resolve();
         const delivery = previous.catch(() => undefined).then(async () => {
             const connection = this.connections.get(input.sourceId);
             if (connection === undefined) {
@@ -928,6 +1845,7 @@ export class WebService {
             const active = this.activeTurns.get(input.threadId);
             if (active !== undefined && connection.info.supportsLiveInput) {
                 try {
+                    this.store.associateProcessJobWakeTurn(input.deliveryKey, active.turnId);
                     const settlement = await active.client.liveInput({
                         conversationId: `web:${input.threadId}`,
                         id: input.deliveryKey,
@@ -937,16 +1855,33 @@ export class WebService {
                         signal: AbortSignal.timeout(10 * 60 * 1_000),
                     });
                     if (settlement.status === "applied") {
-                        this.store.completeProcessJobWake({
+                        const message = this.store.completeProcessJobWake({
                             sourceId: input.sourceId,
                             jobId: input.processJob.jobId,
                             deliveryKey: input.deliveryKey,
                             disposition: "steered",
+                            turnId: active.turnId,
                         });
+                        if (message !== undefined) {
+                            this.emit("message.changed", input.threadId, { messageId: message.id, updatedAt: message.updatedAt });
+                        }
                         return { delivered: true, disposition: "steered" };
                     }
+                    if (settlement.status !== "requeue" && settlement.status !== "unavailable") {
+                        this.store.releaseProcessJobWakeTurn(input.deliveryKey, active.turnId);
+                        return {
+                            delivered: false,
+                            code: "process_job_wake_ambiguous",
+                            retryable: false,
+                            ambiguous: true,
+                        };
+                    }
+                    this.store.associateProcessJobWakeTurn(input.deliveryKey, active.turnId, false);
                 }
                 catch (error) {
+                    // Receipt uncertainty forbids replay, but is not authority to silence
+                    // the ordinary answer from the active turn indefinitely.
+                    this.store.releaseProcessJobWakeTurn(input.deliveryKey, active.turnId);
                     this.options.logger?.warn?.("Web process-job steering outcome is unknown; automatic fallback is suppressed.", {
                         threadId: input.threadId,
                         error: errorMessage(error),
@@ -959,8 +1894,41 @@ export class WebService {
                     };
                 }
             }
-            if (active !== undefined)
-                await active.completion;
+            if (active !== undefined) {
+                try {
+                    await active.completion;
+                }
+                catch {
+                    // No live-input request was sent, or the active run explicitly said
+                    // requeue/unavailable before this wait. This wake therefore has not
+                    // crossed an operator boundary and is safe to release only when the
+                    // store proves that it deleted the exact accepted reservation.
+                    let abandoned = false;
+                    try {
+                        abandoned = this.store.abandonProcessJobWake({
+                            sourceId: input.sourceId,
+                            jobId: input.processJob.jobId,
+                            deliveryKey: input.deliveryKey,
+                        });
+                    }
+                    catch {
+                        // The accepted claim may remain. Preserve ambiguity and no-replay.
+                    }
+                    if (!abandoned) {
+                        return {
+                            delivered: false,
+                            code: "process_job_wake_ambiguous",
+                            retryable: false,
+                            ambiguous: true,
+                        };
+                    }
+                    return {
+                        delivered: false,
+                        code: "process_job_wake_failed",
+                        retryable: false,
+                    };
+                }
+            }
             if (this.stopped) {
                 this.store.abandonProcessJobWake({
                     sourceId: input.sourceId,
@@ -980,9 +1948,19 @@ export class WebService {
             }
             let started;
             try {
+                const selection = this.resolveTurnSelection(input.threadId);
                 started = this.store.beginAssistantTurn({
                     threadId: input.threadId,
                     prompt: input.wakePrompt,
+                    processJobWake: {
+                        jobId: input.processJob.jobId,
+                        deliveryKey: input.deliveryKey,
+                        disposition: "follow_up",
+                    },
+                    ...(selection.model === undefined ? {} : { model: selection.model }),
+                    ...(selection.effort === undefined ? {} : { effort: selection.effort }),
+                    ...(selection.requestedModel === undefined ? {} : { requestedModel: selection.requestedModel }),
+                    ...(selection.requestedEffort === undefined ? {} : { requestedEffort: selection.requestedEffort }),
                 });
             }
             catch (error) {
@@ -997,56 +1975,277 @@ export class WebService {
                     retryable: false,
                 };
             }
-            const completion = this.launchTurn(started, refreshedConnection.client, input.wakePrompt, input.deliveryKey);
+            const { completion, admitted } = this.launchTurn(started, refreshedConnection.client, input.wakePrompt, input.deliveryKey);
+            // Receipt ownership moves to the durable turn below. The turn remains
+            // owned by `activeTurns`, but its completion is no longer part of the
+            // notification request and an unexpected terminal-store failure must not
+            // become an unhandled rejection after the receipt has returned. Attached
+            // before the admission wait below, so a rejection in that window cannot
+            // escape either.
+            void completion.catch((error) => {
+                try {
+                    this.options.logger?.error?.("Web process-job follow-up turn settlement failed after admission.", {
+                        threadId: input.threadId,
+                        turnId: started.turnId,
+                        errorCode: errorCode(error) ?? "unknown",
+                    });
+                }
+                catch {
+                    // A caller-provided logger cannot be allowed to re-detach the failure.
+                }
+            });
+            // Announced before the wait: this row exists either way, and a turn that
+            // never reaches the operator still has to be visible as the failure it is.
             this.emit("message.changed", input.threadId, {
                 messageId: started.assistantMessageId,
                 updatedAt: started.thread.updatedAt,
             });
             this.emit("turn.changed", input.threadId, { turn: started.thread.runState });
-            this.emit("threads.changed", input.threadId);
-            await completion;
-            if (this.store.turnStatus(started.turnId) !== "complete") {
+            this.emitThread("threads.changed", { thread: started.thread });
+            // The wake's host-owned capability — chain depth and remaining background
+            // starts — is bound to this exact request by the agent when it accepts the
+            // turn. Receipting earlier ends the wake route on the agent side and
+            // strips that capability from the very turn the wake raised, so the
+            // follow-up can no longer start the next job. This waits for admission
+            // only; the model turn itself stays detached above.
+            if (!await admitted) {
+                // The request may still have reached the agent, so the accepted claim
+                // stays put: no abandon, no replay, and any retry fails closed.
                 return {
                     delivered: false,
-                    code: "process_job_wake_failed",
+                    code: "process_job_wake_ambiguous",
                     retryable: false,
                     ambiguous: true,
                 };
             }
-            this.store.completeProcessJobWake({
+            const message = this.store.completeProcessJobWake({
                 sourceId: input.sourceId,
                 jobId: input.processJob.jobId,
                 deliveryKey: input.deliveryKey,
                 disposition: "follow_up",
                 turnId: started.turnId,
             });
+            if (message !== undefined) {
+                this.emit("message.changed", input.threadId, { messageId: message.id, updatedAt: message.updatedAt });
+            }
             return { delivered: true, disposition: "follow_up" };
         });
         const tail = delivery.then(() => undefined, () => undefined);
-        this.processJobWakeTails.set(input.threadId, tail);
-        this.activeProcessJobWakes.set(activeKey, delivery);
+        this.hostWakeTails.set(input.threadId, tail);
+        this.activeHostWakes.set(activeKey, delivery);
         try {
             return await delivery;
         }
         finally {
-            if (this.processJobWakeTails.get(input.threadId) === tail) {
-                this.processJobWakeTails.delete(input.threadId);
+            if (this.hostWakeTails.get(input.threadId) === tail) {
+                this.hostWakeTails.delete(input.threadId);
+            }
+            if (this.activeHostWakes.get(activeKey) === delivery) {
+                this.activeHostWakes.delete(activeKey);
+            }
+            this.releaseHostWakeReservation(input.threadId);
+        }
+    }
+    async deliverMonitorWake(input) {
+        const activeKey = `${input.sourceId}\0${input.deliveryKey}`;
+        const reservation = this.store.reserveMonitorWake({
+            sourceId: input.sourceId,
+            threadId: input.threadId,
+            monitorId: input.monitor.monitorId,
+            deliveryKey: input.deliveryKey,
+            payloadSha256: monitorWakePayloadSha256(input.monitor, input.wakePrompt),
+            monitor: input.monitor,
+        });
+        if (reservation.kind === "completed") {
+            return {
+                receipt: { delivered: true, disposition: reservation.disposition },
+                duplicate: true,
+            };
+        }
+        if (reservation.kind === "uncertain") {
+            const existing = this.activeHostWakes.get(activeKey);
+            if (existing !== undefined)
+                return { receipt: await existing, duplicate: true };
+            return {
+                receipt: {
+                    delivered: false,
+                    code: "monitor_wake_ambiguous",
+                    retryable: false,
+                    ambiguous: true,
+                },
+                duplicate: true,
+            };
+        }
+        this.retainHostWakeReservation(input.threadId);
+        const previous = this.hostWakeTails.get(input.threadId) ?? Promise.resolve();
+        const delivery = previous.catch(() => undefined).then(async () => {
+            const abandon = () => this.store.abandonMonitorWake({
+                sourceId: input.sourceId,
+                monitorId: input.monitor.monitorId,
+                deliveryKey: input.deliveryKey,
+            });
+            let connection = this.connections.get(input.sourceId);
+            if (connection === undefined) {
+                try {
+                    await this.refreshAgents();
+                }
+                catch (error) {
+                    abandon();
+                    this.options.logger?.debug?.("Web Monitor destination refresh failed before delivery.", {
+                        threadId: input.threadId,
+                        monitorId: input.monitor.monitorId,
+                        error: errorMessage(error),
+                    });
+                    return { delivered: false, code: "destination_channel_unavailable", retryable: true };
+                }
+                connection = this.connections.get(input.sourceId);
+            }
+            if (this.stopped || connection === undefined) {
+                abandon();
+                return { delivered: false, code: "destination_channel_unavailable", retryable: true };
+            }
+            const destination = this.store.getThread(input.threadId);
+            if (destination === undefined
+                || destination.sourceId !== input.sourceId
+                || destination.archivedAt !== null
+                || destination.trigger !== undefined) {
+                abandon();
+                return { delivered: false, code: "monitor_origin_mismatch", retryable: false };
+            }
+            const active = this.activeTurns.get(input.threadId);
+            if (active !== undefined
+                && connection.info.supportsLiveInput
+                && input.wakePrompt.length <= AGENT_LIVE_INPUT_MAX_CHARACTERS) {
+                try {
+                    this.store.setMonitorWakeSteeringTurn(input.sourceId, input.deliveryKey, active.turnId, true);
+                    const settlement = await active.client.liveInput({
+                        conversationId: `web:${input.threadId}`,
+                        id: input.deliveryKey,
+                        text: input.wakePrompt,
+                        receivedAt: new Date().toISOString(),
+                        deliveryKey: input.deliveryKey,
+                        signal: AbortSignal.timeout(10 * 60 * 1_000),
+                    });
+                    if (settlement.status === "applied") {
+                        const message = this.store.completeMonitorWake({
+                            sourceId: input.sourceId,
+                            monitorId: input.monitor.monitorId,
+                            deliveryKey: input.deliveryKey,
+                            disposition: "steered",
+                            turnId: active.turnId,
+                        });
+                        if (message !== undefined) {
+                            this.emit("message.changed", input.threadId, { messageId: message.id, updatedAt: message.updatedAt });
+                        }
+                        return { delivered: true, disposition: "steered" };
+                    }
+                    if (settlement.status !== "requeue" && settlement.status !== "unavailable") {
+                        return {
+                            delivered: false,
+                            code: "monitor_wake_ambiguous",
+                            retryable: false,
+                            ambiguous: true,
+                        };
+                    }
+                    this.store.setMonitorWakeSteeringTurn(input.sourceId, input.deliveryKey, active.turnId, false);
+                }
+                catch (error) {
+                    this.options.logger?.warn?.("Web Monitor steering outcome is unknown; automatic fallback is suppressed.", {
+                        threadId: input.threadId,
+                        monitorId: input.monitor.monitorId,
+                        error: errorMessage(error),
+                    });
+                    return {
+                        delivered: false,
+                        code: "monitor_wake_ambiguous",
+                        retryable: false,
+                        ambiguous: true,
+                    };
+                }
+            }
+            if (active !== undefined)
+                await active.completion;
+            if (this.stopped) {
+                abandon();
+                return { delivered: false, code: "destination_channel_unavailable", retryable: true };
+            }
+            const refreshedConnection = this.connections.get(input.sourceId);
+            if (refreshedConnection === undefined) {
+                abandon();
+                return { delivered: false, code: "destination_channel_unavailable", retryable: true };
             }
-            if (this.activeProcessJobWakes.get(activeKey) === delivery) {
-                this.activeProcessJobWakes.delete(activeKey);
+            let started;
+            try {
+                const selection = this.resolveTurnSelection(input.threadId);
+                started = this.store.beginAssistantTurn({
+                    threadId: input.threadId,
+                    prompt: input.wakePrompt,
+                    storedPrompt: "[Monitor wake]",
+                    ...(selection.model === undefined ? {} : { model: selection.model }),
+                    ...(selection.effort === undefined ? {} : { effort: selection.effort }),
+                    ...(selection.requestedModel === undefined ? {} : { requestedModel: selection.requestedModel }),
+                    ...(selection.requestedEffort === undefined ? {} : { requestedEffort: selection.requestedEffort }),
+                });
             }
-            this.releaseProcessJobWakeReservation(input.threadId);
+            catch (error) {
+                abandon();
+                return {
+                    delivered: false,
+                    code: errorCode(error) ?? "monitor_wake_failed",
+                    retryable: false,
+                };
+            }
+            const { completion } = this.launchTurn(started, refreshedConnection.client, input.wakePrompt, input.deliveryKey);
+            this.emit("message.changed", input.threadId, {
+                messageId: started.assistantMessageId,
+                updatedAt: started.thread.updatedAt,
+            });
+            this.emit("turn.changed", input.threadId, { turn: started.thread.runState });
+            this.emitThread("threads.changed", { thread: started.thread });
+            await completion;
+            if (this.store.turnStatus(started.turnId) !== "complete") {
+                return {
+                    delivered: false,
+                    code: "monitor_wake_failed",
+                    retryable: false,
+                    ambiguous: true,
+                };
+            }
+            const message = this.store.completeMonitorWake({
+                sourceId: input.sourceId,
+                monitorId: input.monitor.monitorId,
+                deliveryKey: input.deliveryKey,
+                disposition: "follow_up",
+                turnId: started.turnId,
+            });
+            if (message !== undefined) {
+                this.emit("message.changed", input.threadId, { messageId: message.id, updatedAt: message.updatedAt });
+            }
+            return { delivered: true, disposition: "follow_up" };
+        });
+        const tail = delivery.then(() => undefined, () => undefined);
+        this.hostWakeTails.set(input.threadId, tail);
+        this.activeHostWakes.set(activeKey, delivery);
+        try {
+            return { receipt: await delivery, duplicate: false };
+        }
+        finally {
+            if (this.hostWakeTails.get(input.threadId) === tail)
+                this.hostWakeTails.delete(input.threadId);
+            if (this.activeHostWakes.get(activeKey) === delivery)
+                this.activeHostWakes.delete(activeKey);
+            this.releaseHostWakeReservation(input.threadId);
         }
     }
-    retainProcessJobWakeReservation(threadId) {
-        this.processJobWakeReservations.set(threadId, (this.processJobWakeReservations.get(threadId) ?? 0) + 1);
+    retainHostWakeReservation(threadId) {
+        this.hostWakeReservations.set(threadId, (this.hostWakeReservations.get(threadId) ?? 0) + 1);
     }
-    releaseProcessJobWakeReservation(threadId) {
-        const remaining = (this.processJobWakeReservations.get(threadId) ?? 1) - 1;
+    releaseHostWakeReservation(threadId) {
+        const remaining = (this.hostWakeReservations.get(threadId) ?? 1) - 1;
         if (remaining > 0)
-            this.processJobWakeReservations.set(threadId, remaining);
+            this.hostWakeReservations.set(threadId, remaining);
         else
-            this.processJobWakeReservations.delete(threadId);
+            this.hostWakeReservations.delete(threadId);
         if (!this.stopped)
             void this.drainQueuedLiveInputs(threadId);
     }
@@ -1069,8 +2268,19 @@ export class WebService {
                 return completed;
             throw new WebConsoleError("storage_corrupt", "A new notification completed without a conversation.", 500);
         }
-        this.emit("threads.changed", completed.thread.id, { thread: completed.thread });
-        this.emit("thread.changed", completed.thread.id, { thread: completed.thread });
+        // Before the summaries, so a console applies the transcript move it can act
+        // on rather than being told only that the conversation's revision moved.
+        if (!completed.duplicate && completed.messageId !== undefined) {
+            const written = this.store.getMessage(completed.messageId);
+            if (written !== undefined) {
+                this.emit("message.changed", completed.thread.id, {
+                    messageId: written.id,
+                    updatedAt: written.updatedAt,
+                });
+            }
+        }
+        this.emitThread("threads.changed", { thread: completed.thread });
+        this.emitThread("thread.changed", { thread: completed.thread });
         if (!completed.duplicate) {
             this.announcePushEvent(notificationPushLogicalKey(reservation.sourceId, reservation.deliveryKey));
         }
@@ -1101,28 +2311,49 @@ export class WebService {
         }
         catch (error) {
             this.options.logger?.warn?.("Web agent discovery failed.", { error: errorMessage(error) });
-            const changed = this.store.replaceAgents([]);
+            const changed = this.store.markDiscoveredAgentsOffline();
             this.connections = new Map();
+            // The live connection that backs the projection is gone, so provider
+            // authentication is unavailable now.
+            // Clearing it here is what makes the recovery a transition worth
+            // announcing rather than a no-op against a stale map. It is belt and
+            // braces today: this projected capability implies a live connection, which
+            // implies a row that was not offline, so `markDiscoveredAgentsOffline`
+            // returns true and the failure is announced anyway.
+            this.projectedCapabilities = new Map();
             if (changed)
-                this.emit("agents.changed", undefined, { agents: this.store.listAgents() });
+                this.emit("agents.changed");
             return;
         }
         const nextConnections = new Map();
+        // What the cache is allowed to survive: the same process, at the same
+        // endpoint, since the same start. Anything else is a new generation whose
+        // catalog the previous one cannot speak for.
+        const generations = new Map(discovered.map((agent) => [
+            agent.source.sourceId,
+            agentGeneration(agent),
+        ]));
+        this.reconcileModelCatalogCache(generations);
         const summaries = await Promise.all(discovered.map(async (agent) => {
+            const generation = generations.get(agent.source.sourceId);
             if (agent.baseUrl === undefined)
-                return offlineSummary(agent);
+                return offlineSummary(agent, generation);
             const client = new OperatorClient({
                 baseUrl: agent.baseUrl,
                 ...(agent.apiKey === undefined ? {} : { apiKey: agent.apiKey }),
                 ...(agent.processJobsBearer === undefined ? {} : { processJobsBearer: agent.processJobsBearer }),
+                ...(agent.monitorsBearer === undefined ? {} : { monitorsBearer: agent.monitorsBearer }),
                 ...(this.options.fetchImpl === undefined ? {} : { fetchImpl: this.options.fetchImpl }),
             });
             try {
                 const info = await client.info(AbortSignal.any([signal, AbortSignal.timeout(INFO_TIMEOUT_MS)]));
-                nextConnections.set(agent.source.sourceId, { client, info });
+                nextConnections.set(agent.source.sourceId, { client, info, generation });
+                this.seedModelCatalogFromOptions(agent.source.sourceId, generation, info.modelOptions);
+                await this.restorePersistedModelAdmission(client, agent.source.sourceId, generation, info.providers, signal);
                 const efforts = collectEfforts(info);
                 return {
                     sourceId: agent.source.sourceId,
+                    generation,
                     label: info.label ?? agent.source.label,
                     status: agent.source.health === "running" ? "online" : "degraded",
                     pinned: false,
@@ -1133,6 +2364,8 @@ export class WebService {
                     ...(info.effort === undefined ? {} : { defaultEffort: info.effort }),
                     ...(efforts.length === 0 ? {} : { efforts }),
                     ...(info.modelOptions === undefined ? {} : { modelOptions: info.modelOptions }),
+                    runSettings: configRunSettings(info.model, info.effort),
+                    ...(info.providers === undefined ? {} : { providers: info.providers }),
                     ...(info.cron === undefined ? {} : { cron: info.cron }),
                     ...(info.supportsAskById ? { supportsAskById: true } : {}),
                     updatedAt: agent.source.updatedAt,
@@ -1143,11 +2376,21 @@ export class WebService {
                     sourceId: agent.source.sourceId,
                     error: errorMessage(error),
                 });
-                return offlineSummary(agent);
+                return offlineSummary(agent, generation);
             }
         }));
         this.connections = nextConnections;
         const agentsChanged = this.store.replaceAgents(summaries);
+        // Usable provider authentication comes from the live connection, so when it
+        // turns on or off nothing on the discovery summary moves and `replaceAgents`
+        // is right to say so. An operator can start or stop advertising
+        // `capabilities.providerAuth` across a restart; an open console would
+        // otherwise keep the action hidden until an unrelated change, or keep
+        // offering one whose route now 409s. Read here after assigning the live
+        // connections and before the cron refresh awaits on the network.
+        const projected = new Map(summaries.map((summary) => [summary.sourceId, this.projectedCapabilitySignature(summary)]));
+        const capabilityChanged = projected.size !== this.projectedCapabilities.size
+            || [...projected].some(([sourceId, signature]) => this.projectedCapabilities.get(sourceId) !== signature);
         const cronChangedSources = new Set();
         await Promise.all([...nextConnections.entries()].map(async ([sourceId, connection]) => {
             if (connection.info.cron?.read !== true)
@@ -1165,8 +2408,14 @@ export class WebService {
                 });
             }
         }));
-        if (agentsChanged)
-            this.emit("agents.changed", undefined, { agents: this.store.listAgents() });
+        // Adopted only once the announcement is about to go out. Assigning it
+        // before the cron refresh would let a throw in that window consume the
+        // transition: the next pass would compare against a map that already
+        // carried the new signatures, find nothing changed, and the flip would be
+        // lost rather than deferred.
+        this.projectedCapabilities = projected;
+        if (agentsChanged || capabilityChanged)
+            this.emit("agents.changed");
         for (const sourceId of cronChangedSources)
             this.emit("cron.changed", undefined, { sourceId });
         if (cronChangedSources.size > 0)
@@ -1175,6 +2424,34 @@ export class WebService {
             void this.drainQueuedLiveInputs(threadId);
         }
     }
+    requireProviderAuthConnection(sourceId) {
+        const agent = this.store.getAgent(sourceId);
+        if (agent === undefined)
+            throw new WebConsoleError("agent_not_found", "Agent not found.", 404);
+        const connection = this.connections.get(sourceId);
+        if (connection === undefined)
+            throw new WebConsoleError("agent_offline", "This agent is offline.", 409);
+        if (connection.info.supportsProviderAuth !== true) {
+            throw new WebConsoleError("provider_auth_unavailable", "This agent does not expose provider authentication.", 409);
+        }
+        return connection;
+    }
+    async providerAuthCall(sourceId, operation) {
+        const connection = this.requireProviderAuthConnection(sourceId);
+        const result = await operation(connection);
+        if (this.connections.get(sourceId)?.generation !== connection.generation) {
+            throw new WebConsoleError("agent_generation_changed", "The agent restarted during provider authentication. Refresh status and retry.", 409);
+        }
+        return result;
+    }
+    async providerAuthCheckCall(sourceId, operation) {
+        return await this.providerAuthCall(sourceId, async (connection) => {
+            if (connection.info.supportsProviderAuthChecks !== true) {
+                throw new WebConsoleError("provider_auth_unavailable", "This agent does not expose provider checks.", 409);
+            }
+            return await operation(connection);
+        });
+    }
     startTimers() {
         const discoveryInterval = this.options.discoveryIntervalMs ?? DEFAULT_DISCOVERY_INTERVAL_MS;
         const purgeInterval = this.options.purgeIntervalMs ?? DEFAULT_PURGE_INTERVAL_MS;
@@ -1213,6 +2490,117 @@ export class WebService {
             this.options.logger?.info?.("Purged orphaned web uploads.", { count, partialCount, unreferencedCount });
         }
     }
+    /**
+     * A listing event that names a conversation AND describes it.
+     *
+     * The id comes off the payload, so the two can never disagree: an event that
+     * named one conversation while carrying another would have every console
+     * apply the wrong row.
+     */
+    emitThread(type, payload) {
+        this.emit(type, "thread" in payload ? payload.thread.id : payload.threadId, payload);
+    }
+    /**
+     * Name every row a cron reconciliation actually wrote.
+     *
+     * A reconciliation moves a transcript and has no delta to describe it, so
+     * each written row reaches a console as the invalidation it answers with one
+     * message read. Rows the poll left alone are not announced: an unchanged page
+     * must cost a console nothing.
+     */
+    announceReconciledMessages(reconciled) {
+        const written = new Set(reconciled.writtenMessageIds);
+        for (const message of reconciled.messages) {
+            if (!written.has(message.id))
+                continue;
+            this.emit("message.changed", message.threadId, {
+                messageId: message.id,
+                updatedAt: message.updatedAt,
+            });
+        }
+    }
+    /**
+     * The same as {@link emitThread}, for a write whose caller kept no snapshot of
+     * what it produced -- a cron reconcile, a live-input hand-off -- so the store
+     * is the only place the fresh summary can come from.
+     *
+     * A conversation that is no longer there leaves nothing to describe, and the
+     * bulk form is the only honest scope left for a listing that did change.
+     */
+    emitStoredThread(threadId, types) {
+        const thread = threadId === undefined ? undefined : this.store.getThread(threadId);
+        if (thread === undefined) {
+            this.emit("threads.changed");
+            return;
+        }
+        for (const type of types)
+            this.emitThread(type, { thread });
+    }
+    /**
+     * Put one persisted assistant-message write on the wire as content.
+     *
+     * A streaming answer is rewritten every {@link STREAM_FLUSH_INTERVAL_MS}
+     * milliseconds. Announcing each one as an invalidation made every connected
+     * console re-read the whole conversation to find the few characters that had
+     * arrived, so these two paths -- the stream coalescer and the write that
+     * settles a turn -- say what changed instead.
+     *
+     * Three rules keep that honest:
+     * - A write that did not happen says nothing. `applyStreamFrames` and the
+     *   finish both answer a settled turn with no delta at all, and a version
+     *   nobody wrote is not a version to announce.
+     * - An empty `ops` list is still announced. A status-only finish moves the
+     *   sequence number without changing a part, and a console that never heard
+     *   about it would reject the next delta as a gap.
+     * - The parts inside a `set` are shaped exactly as a read would serve them,
+     *   and a delta that would cost more than re-reading the message declines to
+     *   the invalidation hint every other writer emits. A splice-driven finish
+     *   re-sets every part it shifted, which is bigger than the message itself.
+     *   That hint carries no sequence number, so the NEXT delta will not chain
+     *   onto the last one a console applied -- which is exactly the mismatch that
+     *   sends it to the message read.
+     */
+    emitMessageWrite(threadId, write) {
+        if (write?.attributionChanged === true) {
+            const thread = this.store.getThread(threadId);
+            if (thread !== undefined)
+                this.emit("turn.changed", threadId, { turn: thread.runState });
+        }
+        if (write === undefined || write.delta === undefined)
+            return;
+        const { message, delta } = write;
+        // An invariant, not a case: all three callers pass the assistant row of a
+        // turn. `mapMessage` filters quote and live-input telemetry off user rows,
+        // so a delta diffed against one would describe parts no reader ever holds,
+        // and quietly downgrading here would hide the day that stops being true.
+        if (message.role !== "assistant") {
+            throw new TypeError(`A ${message.role} message reached the delta path.`);
+        }
+        const shaped = {
+            ...delta,
+            // Set only once a turn, by the write that ends it. Without it a
+            // subscribed console still bought one whole-conversation read per turn
+            // finish, purely to draw the Activity header's window.
+            ...(message.finishedAt === undefined ? {} : { finishedAt: message.finishedAt }),
+            ops: delta.ops.map((op) => (op.op === "set" ? { ...op, part: this.shapePart(message, op.part, {}) } : op)),
+        };
+        // Only a write that REWRITES parts can outweigh the message it describes: an
+        // `append` carries strictly less than the part it grew, and the message
+        // carries that whole part plus its own envelope. Worth the check, because
+        // the comparison shapes the entire message -- reply capabilities re-minted
+        // and all -- and the streaming path runs this every 50 ms.
+        if (shaped.ops.some((op) => op.op !== "append")
+            && JSON.stringify(shaped.ops).length > JSON.stringify(this.shapeMessage(message)).length) {
+            const declined = {
+                messageId: message.id,
+                updatedAt: message.updatedAt,
+                deltaDeclined: true,
+            };
+            this.emit("message.changed", threadId, declined);
+            return;
+        }
+        this.emit("message.delta", threadId, shaped);
+    }
     emit(type, threadId, payload) {
         if (this.stopped)
             return;
@@ -1240,7 +2628,7 @@ export class WebService {
     }
     observeAskUserFrame(threadId, turnId, frame) {
         if (this.stopped || frame.kind !== "event" || frame.event.type !== "tool_call_started"
-            || toolNameLeaf(frame.event.name).toLowerCase().replace(/[^a-z0-9]+/gu, "") !== "askuser")
+            || !isAskUserToolName(frame.event.name))
             return;
         const key = `${threadId}\0${turnId}`;
         if (this.askWatches.has(key))
@@ -1263,8 +2651,8 @@ export class WebService {
             const thread = this.store.applyAgentTitle(threadId, title);
             if (thread === undefined)
                 return;
-            this.emit("thread.changed", threadId, { revision: thread.revision });
-            this.emit("threads.changed", threadId, { thread });
+            this.emitThread("thread.changed", { thread });
+            this.emitThread("threads.changed", { thread });
         }
         catch (error) {
             this.options.logger?.warn?.("Agent conversation-title update failed; the turn is continuing.", {
@@ -1322,7 +2710,10 @@ export class WebService {
             sourceId: thread.sourceId,
             title: `${agent?.label ?? "mono-agent"} needs input`,
             body: `${question.header}: ${question.question}`,
-            expiresAt: snapshot.expiresAt,
+            // Push delivery remains bounded even when the underlying AskUser wait is
+            // unbounded. Expiring this notification does not expire the interaction.
+            expiresAt: snapshot.expiresAt
+                ?? new Date(this.currentDate().getTime() + ASK_PUSH_DELIVERY_TTL_MS).toISOString(),
         });
         if (event !== undefined)
             this.announcePushEvent(event.logicalKey);
@@ -1344,7 +2735,8 @@ export class WebService {
                 : await connection.client.pendingAsk(this.store.cronConversationIdForThread(event.threadId) ?? `web:${event.threadId}`, boundedSignal);
             return snapshot?.interactionId === interactionId
                 && snapshot.status === "pending"
-                && new Date(snapshot.expiresAt).getTime() > this.currentDate().getTime()
+                && (snapshot.expiresAt === null
+                    || new Date(snapshot.expiresAt).getTime() > this.currentDate().getTime())
                 ? "current"
                 : "stale";
         }
@@ -1365,6 +2757,245 @@ export class WebService {
         }
         return connection;
     }
+    /**
+     * Tier-2 admission: the catalog cache, seeded from `modelOptions` keys and
+     * appended to by every proxied `/v1/models` page.
+     *
+     * Both feeds cross an await between deciding what to admit and admitting it,
+     * so both name the generation they read. A write whose generation is no
+     * longer the one on file is dropped outright rather than filed under the
+     * successor: it describes a process that has been replaced, and admitting it
+     * is exactly the cross-generation contamination `reconcileModelCatalogCache`
+     * exists to prevent. Nothing is created here either -- an entry exists for
+     * every discovered source from the moment a refresh reconciles it, and a
+     * source with no entry is one discovery has dropped.
+     *
+     * @returns whether the refs were admitted.
+     */
+    admitCatalogRefs(sourceId, generation, refs) {
+        if (generation === undefined)
+            return false;
+        const entry = this.modelCatalogCache.get(sourceId);
+        if (entry === undefined || entry.generation !== generation)
+            return false;
+        for (const [ref, record] of refs)
+            this.admitModelRef(entry.models, ref, record);
+        return true;
+    }
+    /**
+     * Bind the cache to the agent process that filled it, and to nothing else.
+     * A source id outlives the process behind it: reconfigure an agent and
+     * restart it and the next generation advertises a different catalog under
+     * the same id. Keyed by id alone, generation 1's ladder judged generation
+     * 2's turns and rejected grades the running agent accepts, with no way to
+     * clear it short of restarting the console.
+     *
+     * The single place the cache is scoped, so there is one answer to "whose
+     * catalog is this". Runs before the per-agent probes of a refresh, so a seed
+     * or a proxied page during that refresh files under the current generation.
+     * Sources discovery no longer reports are dropped outright, or a retired
+     * agent's refs would accumulate for the life of the process.
+     */
+    reconcileModelCatalogCache(generations) {
+        for (const sourceId of [...this.modelCatalogCache.keys()]) {
+            if (!generations.has(sourceId))
+                this.modelCatalogCache.delete(sourceId);
+        }
+        for (const [sourceId, generation] of generations) {
+            if (this.modelCatalogCache.get(sourceId)?.generation === generation)
+                continue;
+            this.modelCatalogCache.set(sourceId, { generation, models: new Map() });
+        }
+    }
+    seedModelCatalogFromOptions(sourceId, generation, modelOptions) {
+        if (modelOptions === undefined)
+            return;
+        // `modelOptions` stays the authority for the refs it names, so the seed
+        // only records admission; recording a ladder here would shadow it.
+        this.admitCatalogRefs(sourceId, generation, Object.keys(modelOptions).map((key) => [key, { source: "shortlist", efforts: undefined }]));
+    }
+    /**
+     * A catalog-only web default outlives this process, while the admission cache
+     * deliberately does not. Revalidate that one persisted ref against the live
+     * generation during discovery so first-use thread creation never depends on
+     * a browser having opened the model picker. An exact match is mandatory: a
+     * retired ref remains unadmitted even if the search returns close names.
+     */
+    async restorePersistedModelAdmission(client, sourceId, generation, providers, signal) {
+        const model = this.store.getAgent(sourceId)?.runSettings.override?.model;
+        if (model === undefined || this.modelCatalogCache.get(sourceId)?.models.has(model) === true)
+            return;
+        const separator = model.indexOf(":");
+        // The runtime wire makes only the first colon structural: provider ids may
+        // not contain one, while opaque model ids commonly do. Keeping that exact
+        // split also prevents a malformed colon-bearing provider from colliding
+        // with a legitimate provider plus colon-bearing model id.
+        const target = separator > 0 && separator < model.length - 1
+            ? {
+                kind: "canonical",
+                provider: model.slice(0, separator),
+                modelId: model.slice(separator + 1),
+            }
+            : { kind: "bare", modelId: model };
+        const boundedSignal = AbortSignal.any([signal, AbortSignal.timeout(INFO_TIMEOUT_MS)]);
+        try {
+            if (target.kind === "canonical") {
+                await this.restorePersistedModelFromProvider(client, sourceId, generation, target.provider, target, boundedSignal);
+                return;
+            }
+            // Bare ids have no provider address. Keep the cheap global search, but
+            // accept only an exact id; if its 100-row fuzzy cap hides the target,
+            // traverse the bounded provider window advertised in `/v1/info`.
+            const search = await client.models({
+                q: target.modelId,
+                limit: MODEL_CATALOG_RESTORE_PAGE_SIZE,
+                signal: boundedSignal,
+            });
+            if (this.admitModelPage(sourceId, generation, search, target))
+                return;
+            for (const provider of new Set((providers ?? []).map((entry) => entry.id))) {
+                if (await this.restorePersistedModelFromProvider(client, sourceId, generation, provider, target, boundedSignal))
+                    return;
+            }
+        }
+        catch (error) {
+            this.options.logger?.debug?.("Persisted web model default could not be revalidated.", {
+                sourceId,
+                error: errorMessage(error),
+            });
+        }
+    }
+    async restorePersistedModelFromProvider(client, sourceId, generation, provider, target, signal) {
+        let cursor;
+        const seenCursors = new Set();
+        for (let pageIndex = 0; pageIndex < MODEL_CATALOG_RESTORE_PAGE_LIMIT; pageIndex += 1) {
+            if (this.modelCatalogCache.get(sourceId)?.generation !== generation)
+                return false;
+            const page = await client.models({
+                provider,
+                ...(cursor === undefined ? {} : { cursor }),
+                limit: MODEL_CATALOG_RESTORE_PAGE_SIZE,
+                signal,
+            });
+            if (this.modelCatalogCache.get(sourceId)?.generation !== generation)
+                return false;
+            if (this.admitModelPage(sourceId, generation, page, target))
+                return true;
+            const nextCursor = page.truncated ? page.nextCursor : undefined;
+            if (nextCursor === undefined || nextCursor.length === 0 || seenCursors.has(nextCursor))
+                return false;
+            seenCursors.add(nextCursor);
+            cursor = nextCursor;
+        }
+        return false;
+    }
+    admitModelPage(sourceId, generation, page, exactTarget) {
+        const refs = page.models.flatMap((model) => {
+            const record = {
+                source: "page",
+                efforts: advertisedEffortLevels(model),
+                advertisement: model,
+            };
+            // The wire carries provider-local ids while every selection surface
+            // speaks the canonical `<provider>:<model>` reference. Admit both, or a
+            // turn is judged against metadata the page did advertise but under a
+            // name nothing ever asks for.
+            const reference = model.provider ? `${model.provider}:${model.id}` : model.id;
+            if (exactTarget?.kind === "canonical"
+                && (model.provider !== exactTarget.provider || model.id !== exactTarget.modelId))
+                return [];
+            if (exactTarget?.kind === "bare" && model.id !== exactTarget.modelId)
+                return [];
+            const entries = [[model.id, record]];
+            if (reference !== model.id)
+                entries.push([reference, record]);
+            return entries;
+        });
+        return refs.length > 0 && this.admitCatalogRefs(sourceId, generation, refs);
+    }
+    admitModelRef(entries, ref, record) {
+        const known = entries.get(ref);
+        if (known !== undefined) {
+            // A page is the live word on what it serves, so its metadata replaces
+            // whatever is held -- including replacing a ladder with silence, which
+            // is how a re-fetched catalog heals a model whose grades changed. The
+            // shortlist seed only records admission and must never shadow a page.
+            // Re-setting an existing key leaves its eviction position alone.
+            if (record.source === "page")
+                entries.set(ref, record);
+            return;
+        }
+        entries.set(ref, record);
+        if (entries.size > MODEL_CATALOG_CACHE_CAP) {
+            const oldest = entries.keys().next().value;
+            if (oldest !== undefined)
+                entries.delete(oldest);
+        }
+    }
+    /** Resolve dispatch and durable attribution from the same fresh thread snapshot. */
+    resolveTurnSelection(threadId, explicitModel, explicitEffort) {
+        const thread = this.store.getThread(threadId);
+        if (thread === undefined)
+            throw new WebConsoleError("thread_not_found", "Conversation not found.", 404);
+        const agent = this.store.getAgent(thread.sourceId);
+        if (agent === undefined) {
+            throw new WebConsoleError("agent_offline", "This agent is offline. The conversation remains available read-only.", 409);
+        }
+        const model = explicitModel ?? thread.runModel ?? undefined;
+        const effort = explicitEffort ?? thread.runEffort ?? undefined;
+        this.validateModelAndEffort(thread.sourceId, agent, model, effort);
+        const requestedModel = effectiveModelForAgent(agent, model);
+        const cached = requestedModel === undefined
+            ? undefined
+            : this.modelCatalogCache.get(thread.sourceId)?.models.get(requestedModel);
+        const requestedEffort = effort ?? inheritedEffortForModel(agent, requestedModel, cached?.advertisement, agent.defaultEffort);
+        return {
+            thread,
+            agent,
+            ...(model === undefined ? {} : { model }),
+            ...(effort === undefined ? {} : { effort }),
+            ...(requestedModel === undefined ? {} : { requestedModel }),
+            ...(requestedEffort === undefined ? {} : { requestedEffort }),
+        };
+    }
+    validateModelAndEffort(sourceId, agent, model, effort, strictModel = false) {
+        if (model !== undefined && !(strictModel
+            ? this.modelStrictlyAdmitted(sourceId, agent, model)
+            : this.modelAdmitted(sourceId, agent, model))) {
+            throw new WebConsoleError("invalid_model", "This agent did not advertise the selected model.", 400);
+        }
+        // Both ends resolve a blank selection to the same route -- the browser fell
+        // back to the first shortlist entry while this stopped at `defaultModel`,
+        // so any `/v1/info` omitting `model` had the picker offering one ladder and
+        // this rejecting from another.
+        const effectiveModel = effectiveModelForAgent(agent, model);
+        // `modelOptions` only ever covers the configured shortlist, so a model
+        // reached through the provider catalog has no entry there. `effort-ladder`
+        // holds the tiering, and the browser runs the exact same function, so the
+        // picker cannot offer a grade this rejects or hide one it accepts.
+        const cached = effectiveModel === undefined
+            ? undefined
+            : this.modelCatalogCache.get(sourceId)?.models.get(effectiveModel);
+        const allowedEfforts = effortLevelsForModel(agent, effectiveModel, cached?.efforts);
+        if (effort !== undefined && !allowedEfforts.includes(effort)) {
+            throw new WebConsoleError("invalid_effort", "This agent did not advertise the selected effort for this model.", 400);
+        }
+    }
+    modelAdmitted(sourceId, agent, model) {
+        if (this.modelStrictlyAdmitted(sourceId, agent, model))
+            return true;
+        // Tier 3: syntactic `<provider>:<model>` floor. Existing per-conversation
+        // selections retain this compatibility path; durable web defaults do not.
+        return modelPassesSyntacticFloor(model);
+    }
+    modelStrictlyAdmitted(sourceId, agent, model) {
+        // Tier 1: the configured-route shortlist — unchanged, always allowed.
+        if (agent.models === undefined ? model === agent.defaultModel : agent.models.includes(model))
+            return true;
+        // Tier 2: a model reached only through the catalog cache.
+        const cached = this.modelCatalogCache.get(sourceId);
+        return cached !== undefined && cached.models.has(model);
+    }
     authorizeReplyPart(threadId, messageId, partId, type, expires, token) {
         const access = this.replyAccessTokenStatus(threadId, messageId, type, partId, expires, token);
         if (access === "invalid") {
@@ -1375,7 +3006,11 @@ export class WebService {
         if (access === "expired") {
             throw new WebConsoleError("reply_access_expired", "Reply access expired. Refresh this reply part and try again.", 410);
         }
-        return { thread, part };
+        // Answered here rather than at the route, because the SERVICE owns the
+        // clock this expiry was signed against -- a route reading `Date.now()`
+        // against an injected clock reports a body that may already be cold.
+        const remainingMs = Number(expires) * 1_000 - this.currentDate().getTime();
+        return { thread, part, remainingSeconds: Math.max(0, Math.floor(remainingMs / 1_000)) };
     }
     requireReplyPart(threadId, messageId, partId, type) {
         const thread = this.store.getThread(threadId);
@@ -1396,20 +3031,79 @@ export class WebService {
             throw new WebConsoleError("reply_part_expired", "The reply part has expired.", 410);
         }
     }
-    decorateThreadDetail(detail) {
+    decorateThreadDetail(detail, options = {}) {
         // Backfill: messages that predate this feature, and any turn whose own
         // attempt failed or was interrupted. Idempotent and guarded, so repeated
         // reads of the same thread fetch each image at most once.
         void this.persistReplyImages(detail.thread.id, detail.messages);
-        return { ...detail, messages: detail.messages.map((message) => this.decorateMessage(message)) };
+        return { ...detail, messages: this.shapeMessages(detail.messages, options) };
     }
-    decorateMessage(message) {
-        const parts = message.parts.map((part) => {
-            if (part.type !== "attachment" && part.type !== "mcp_app")
-                return part;
+    /**
+     * Fold the host's provenance row into the imported-context card.
+     *
+     * The exact host-owned string is enough to identify this row: no model turn
+     * can own it, and the store writes it only for canonical context imports.
+     * Filtering independently of its neighbour is intentional, because the two
+     * stored rows can straddle a message-page boundary. `?full=1` remains the raw
+     * transcript escape hatch and therefore returns both stored rows unchanged.
+     */
+    shapeMessages(messages, options = {}) {
+        const visible = options.full === true
+            ? messages
+            : messages.filter((message) => !this.isCronReplyProvenanceMessage(message));
+        return visible.map((message) => this.shapeMessage(message, options));
+    }
+    isCronReplyProvenanceMessage(message) {
+        return message.role === "system"
+            && message.turnId === undefined
+            && message.parts.length === 1
+            && message.parts[0]?.type === "text"
+            && message.parts[0].text === AGENT_CONTEXT_IMPORT_SYSTEM_PROVENANCE;
+    }
+    /**
+     * The one boundary every browser-facing message crosses: it mints the
+     * short-lived reply capabilities, and it puts the transcript on a diet.
+     *
+     * Shaping lives HERE and never in the store. The store's parts feed the
+     * sidebar preview, the streamed-text split, and the transcript deltas that
+     * follow this change, all of which need the payloads whole and the indexes
+     * exactly as recorded.
+     */
+    shapeMessage(message, options = {}) {
+        if (options.full !== true && this.isCronReplyProvenanceMessage(message)) {
+            // Individual-message recovery cannot omit its addressed row. An empty
+            // projection keeps the raw provenance out of the UI; list reads remove
+            // the row altogether through `shapeMessages`.
+            return { ...message, parts: [] };
+        }
+        return { ...message, parts: message.parts.map((part) => this.shapePart(message, part, options)) };
+    }
+    /**
+     * One part, shaped exactly as a read of its message would serve it.
+     *
+     * A streamed delta puts individual parts on the wire, and they cross the same
+     * boundary the transcript does. Reading the rules from one place is what keeps
+     * a `set` op and a re-read of the same message from disagreeing about what a
+     * tool result contains.
+     */
+    shapePart(message, part, options) {
+        if (part.type === "attachment" || part.type === "mcp_app")
             return this.decorateReplyPart(message, part);
-        });
-        return { ...message, parts };
+        if (options.full === true)
+            return part;
+        if (message.role === "assistant"
+            && message.turnId === undefined
+            && message.parts.length === 1
+            && part.type === "text") {
+            return parseCronReplyContext(part.text) ?? part;
+        }
+        if (part.type === "telemetry")
+            return shapeTelemetryPart(part);
+        if (part.type === "tool-call")
+            return shapeToolCallPart(part);
+        if (part.type === "subagent")
+            return shapeSubagentPart(part);
+        return part;
     }
     /**
      * Keeps the console's own copy of an image the agent published.
@@ -1524,7 +3218,10 @@ export class WebService {
         const retentionDeadline = part.expiresAt === undefined
             ? Number.POSITIVE_INFINITY
             : Date.parse(part.expiresAt);
-        const expiresAt = Math.min(now + REPLY_ACCESS_TTL_MS, retentionDeadline);
+        // From the bucket, not from this instant. A retention deadline that binds is
+        // already a fixed value and is left exactly as it is.
+        const bucketStart = Math.floor(now / REPLY_ACCESS_BUCKET_MS) * REPLY_ACCESS_BUCKET_MS;
+        const expiresAt = Math.min(bucketStart + REPLY_ACCESS_TTL_MS, retentionDeadline);
         if (!Number.isFinite(expiresAt) || expiresAt <= now) {
             return part.type === "attachment" ? { ...part, ...storedUrl } : part;
         }
@@ -1616,10 +3313,15 @@ function abortableDelay(delayMs, signal) {
     });
 }
 function isFuturePendingAsk(snapshot, now) {
+    if (snapshot.status !== "pending")
+        return false;
+    if (snapshot.expiresAt === null)
+        return true;
     const expiresAt = new Date(snapshot.expiresAt).getTime();
-    return snapshot.status === "pending" && Number.isFinite(expiresAt) && expiresAt > now.getTime();
+    return Number.isFinite(expiresAt) && expiresAt > now.getTime();
 }
 const STREAM_FLUSH_INTERVAL_MS = 50;
+const ASK_PUSH_DELIVERY_TTL_MS = 24 * 60 * 60 * 1_000;
 class WebTurnCancellation extends Error {
     kind;
     constructor(kind, message) {
@@ -1745,17 +3447,77 @@ export class WeightedTurnBudget {
         }
     }
 }
-function offlineSummary(agent) {
+/**
+ * The identity of the agent PROCESS behind a source id. `sourceId` is stable
+ * across restarts by design, so it cannot scope anything the running process
+ * told us: a reconfigured agent restarts at a new endpoint, with a new pid and
+ * a new `startedAt`, and advertises a different catalog under the same id.
+ * Deliberately excludes `updatedAt`, which every heartbeat moves.
+ *
+ * This is what the model catalog cache is scoped to -- and, since the browser
+ * caches the same `/v1/models` pages and had nothing generation-shaped to
+ * watch, what `WebAgentSummary.generation` carries to it.
+ *
+ * Hashed because it now goes on the wire: the raw form names the agent's
+ * operator endpoint and pid, and the console has no reason to hand those to a
+ * page. The token only has to be stable while one process lives and different
+ * once it is replaced, which a digest of those three fields is.
+ *
+ * Length-prefixed rather than `|`-joined. A separator that can occur inside a
+ * field is not a separator: two different accepted tuples whose parts happen to
+ * contain the delimiter flatten to the same string and hash to the same token,
+ * and two distinct processes sharing a generation is precisely the state the
+ * token exists to make impossible. Nothing first-party produces such a tuple
+ * today, which is why this is robustness rather than a live defect --- but a
+ * digest whose only defence is what its inputs happen to look like is one
+ * unrelated change away from being wrong.
+ *
+ * Hashed as UTF-16 code units for the same reason the prefix replaced the
+ * delimiter. UTF-8 has no encoding for an unpaired surrogate, so a lone high
+ * surrogate and a lone low surrogate both became the replacement character and
+ * two different one-character fields -- identically length-prefixed -- hashed
+ * alike. `utf16le` is a lossless transcription of exactly the code units the
+ * length prefix counts, so what is hashed is what was measured.
+ */
+export function agentGeneration(agent) {
+    const parts = [
+        agent.baseUrl ?? "",
+        String(agent.source.pid ?? ""),
+        agent.source.startedAt,
+    ];
+    return createHash("sha256")
+        .update(parts.map((part) => `${String(part.length)}:${part}`).join(""), "utf16le")
+        .digest("hex")
+        .slice(0, 16);
+}
+function offlineSummary(agent, generation) {
     return {
         sourceId: agent.source.sourceId,
+        generation,
         label: agent.source.label,
         status: "offline",
         pinned: false,
         health: agent.source.health,
         supportsAttachments: false,
+        runSettings: configRunSettings(),
         updatedAt: agent.source.updatedAt,
     };
 }
+function configRunSettings(model, effort) {
+    return {
+        config: {
+            ...(model === undefined ? {} : { model }),
+            ...(effort === undefined ? {} : { effort }),
+        },
+        override: null,
+        effective: {
+            ...(model === undefined ? {} : { model }),
+            modelSource: "config",
+            ...(effort === undefined ? {} : { effort }),
+            effortSource: "config",
+        },
+    };
+}
 function collectEfforts(info) {
     // Older operator schemas do not advertise per-model metadata. Match the TUI
     // picker in that case: cloud/unknown models use the canonical global effort
@@ -1763,32 +3525,25 @@ function collectEfforts(info) {
     if (info.modelOptions === undefined)
         return EFFORT_LEVELS;
     const models = info.models ?? (info.model === undefined ? [] : [info.model]);
-    return [...new Set(models.flatMap((model) => effortLevelsForOption(info.modelOptions?.[model])))];
+    // Same rule as every other effort decision, so the union an agent advertises
+    // cannot disagree with what a turn on one of those models may carry.
+    return [...new Set(models.flatMap((model) => effortLevelsForModel(info, model, undefined)))];
 }
-function validateModelAndEffort(agent, model, effort) {
-    if (model !== undefined
-        && (agent.models === undefined ? model !== agent.defaultModel : !agent.models.includes(model))) {
-        throw new WebConsoleError("invalid_model", "This agent did not advertise the selected model.", 400);
-    }
-    const effectiveModel = model ?? agent.defaultModel;
-    const option = effectiveModel === undefined ? undefined : agent.modelOptions?.[effectiveModel];
-    const allowedEfforts = agent.modelOptions === undefined
-        ? agent.efforts
-        : effortLevelsForOption(option);
-    if (effort !== undefined && (allowedEfforts === undefined || !allowedEfforts.includes(effort))) {
-        throw new WebConsoleError("invalid_effort", "This agent did not advertise the selected effort for this model.", 400);
-    }
-}
-function effortLevelsForOption(option) {
-    if (option === undefined
-        || option.reasoning === false
-        || option.reasoningMode === "none"
-        || option.effortLevels?.length === 0) {
-        return [];
-    }
-    if (option.reasoningMode === "toggle")
-        return ["high", "none"];
-    return option.effortLevels ?? [];
+/**
+ * Tier 3: the syntactic floor. `@mono-agent/web` may not import pi-ai, so this
+ * cannot be authoritative -- the agent is. It exists to reject obvious garbage,
+ * and it must not be looser than the runtime parser, or a reference the console
+ * accepts is silently ignored and the turn runs on the default model instead.
+ */
+function modelPassesSyntacticFloor(model) {
+    const separator = model.indexOf(":");
+    if (separator <= 0 || separator >= model.length - 1)
+        return false;
+    const provider = model.slice(0, separator);
+    const rest = model.slice(separator + 1);
+    // Provider ids are lowercase kebab/alphanumeric; the model half may carry
+    // further colons and slashes but must not be blank or padded.
+    return /^[a-z0-9][a-z0-9-]*$/u.test(provider) && rest.trim() === rest && rest.trim().length > 0;
 }
 function normalizeFilename(value) {
     const withoutPath = value.replace(/\\/gu, "/").split("/").at(-1)?.trim() ?? "";