@nylorun/runtime 0.22.0-beta → 0.24.0-beta

package/dist/gates/journal.js

@@ -0,0 +1,52 @@
+import { mcpToolOf } from "../mcp/snapshot.js";
+import { canonical } from "../store/canonical.js";
+import { httpToolRefOf } from "./http-tool.js";
+export function journalCheck(vaults) {
+    return {
+        async check(tenantId, claims, key, call) {
+            const store = (await vaults.open(tenantId)).store;
+            const refusal = await store.tx(async (t) => {
+                const row = await t.get("effects", key);
+                if (!row)
+                    return `No journaled call has the effect id '${key}'`;
+                const request = row.request;
+                if (request.kind !== "tool" ||
+                    request.sessionId !== claims.sessionId ||
+                    request.turnId !== claims.turnId)
+                    return `Effect '${key}' is not a tool call of this run's turn`;
+                if (row.status !== "invoking")
+                    return `Effect '${key}' is not running: it is ${row.status}`;
+                if (call.kind === "http") {
+                    const { sessionId: _journaled, ...expected } = httpToolRefOf(request);
+                    const { sessionId: _named, ...named } = call.tool;
+                    if (canonical(expected) !== canonical(named))
+                        return `Effect '${key}' calls another tool`;
+                    if (canonical(request.input ?? null) !== canonical(call.input ?? null))
+                        return `Effect '${key}' was journaled with other input`;
+                    return held(row);
+                }
+                const session = await t.get("sessions", request.sessionId);
+                const tool = mcpToolOf(session?.mcpSnapshot, request);
+                if (!tool ||
+                    tool.capabilityId !== call.server.capabilityId ||
+                    tool.serverName !== call.server.serverName ||
+                    (tool.agentId ?? null) !== (call.server.agentId ?? null) ||
+                    tool.serverToolName !== call.name)
+                    return `Effect '${key}' calls another tool`;
+                if (canonical(argumentsOf(request.input)) !== canonical(call.arguments))
+                    return `Effect '${key}' was journaled with other input`;
+                return held(row);
+            });
+            return typeof refusal === "string" ? { refused: refusal } : refusal;
+        },
+    };
+}
+/** A journaled call: its span context, when core recorded one (R7.4). */
+function held(row) {
+    const traceparent = row.traceparent;
+    return typeof traceparent === "string" ? { traceparent } : {};
+}
+/** A tool call's input as `tools/call` arguments (`callMcpTool`): an object, else none. */
+function argumentsOf(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : {};
+}

package/dist/gates/mcp-handler.d.ts

@@ -29,6 +29,10 @@ export interface McpHandler {
         effectId: string;
         name: string;
         arguments: Record<string, unknown>;
+        /** The call's `Idempotency-Key`, sent to the server in `_meta` (R5.5). */
+        key?: string;
+        /** The call's span context from its journal row (R7.4), sent as `traceparent`. */
+        traceparent?: string;
     }, signal: AbortSignal): Promise<McpAnswer<Record<string, unknown>>>;
     close(server: McpServerRef): Promise<void>;
     /** Closes connections idle past the timeout. */

package/dist/gates/mcp-handler.js

@@ -114,7 +114,11 @@ export function createMcpHandler(options) {
     async function callOnce(tenantId, request, signal) {
         for (let attempt = 0;; attempt += 1) {
             try {
-                return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, { signal }), true);
+                return await use(tenantId, request.server, (entry) => entry.connection.client.callTool({ name: request.name, arguments: request.arguments }, {
+                    signal,
+                    ...(request.key === undefined ? {} : { key: request.key }),
+                    ...(request.traceparent === undefined ? {} : { traceparent: request.traceparent }),
+                }), true);
             }
             catch (error) {
                 if (!(error instanceof McpConnectionStale) || attempt > 0)

package/dist/gates/meter.d.ts

@@ -13,8 +13,16 @@ export interface MeterOptions {
     readonly now?: () => Date;
 }
 export declare function createMeter(options: MeterOptions): Meter;
-/** The ledger row of an outcome that carries usage; undefined for a failure. */
-export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date): ModelUsageWrite | undefined;
+/** When the gate sent a call and when its answer was complete (R7.1). */
+export interface CallTiming {
+    readonly startedAt: Date;
+    readonly endedAt: Date;
+}
+/**
+ * The ledger row of an outcome that carries usage; undefined for a failure. With `timing`, the
+ * row keeps the gate's start and end of the call, and the adapter's `firstTokenMs`.
+ */
+export declare function usageRow(request: ModelGateRequest, outcome: ModelGateOutcome, at: Date, timing?: CallTiming): ModelUsageWrite | undefined;
 /**
  * Why the budget refuses another call, or undefined. Calls in flight count at the scope's
  * average cost per recorded call.

package/dist/gates/meter.js

@@ -8,6 +8,10 @@
  * the scope at the scope's average cost per call, reaches its limit. Calls in a turn run one
  * at a time, so a scope overspends by at most one call per concurrent call. The refusal is a
  * `budget_exhausted` failure, which the turn does not retry.
+ *
+ * The row also keeps the gate's own timing of the call (R7.1): `now()` before the call and
+ * after it, and the adapter's `firstTokenMs` (`evidence.extras`), so a model call's span is
+ * what the gate measured.
  */
 import { randomUUID } from "node:crypto";
 import { failure } from "../model/classify.js";
@@ -60,8 +64,9 @@ export function createMeter(options) {
             for (const key of keys)
                 inflight.set(key, (inflight.get(key) ?? 0) + 1);
             try {
+                const startedAt = now();
                 const outcome = await call();
-                await record(store, request, outcome);
+                await record(store, request, outcome, { startedAt, endedAt: now() });
                 return outcome;
             }
             finally {
@@ -75,8 +80,8 @@ export function createMeter(options) {
             }
         },
     };
-    async function record(store, request, outcome) {
-        const row = usageRow(request, outcome, now());
+    async function record(store, request, outcome, timing) {
+        const row = usageRow(request, outcome, timing.endedAt, timing);
         if (!row)
             return;
         try {
@@ -96,11 +101,15 @@ export function createMeter(options) {
         }
     }
 }
-/** The ledger row of an outcome that carries usage; undefined for a failure. */
-export function usageRow(request, outcome, at) {
+/**
+ * The ledger row of an outcome that carries usage; undefined for a failure. With `timing`, the
+ * row keeps the gate's start and end of the call, and the adapter's `firstTokenMs`.
+ */
+export function usageRow(request, outcome, at, timing) {
     if (typeof outcome !== "object" || "kind" in outcome || !outcome.usage)
         return undefined;
     const usage = outcome.usage;
+    const firstTokenMs = outcome.evidence?.extras?.firstTokenMs;
     const producer = producerOf(outcome);
     const inputTokens = count(usage.inputTokens);
     const outputTokens = count(usage.outputTokens);
@@ -126,6 +135,12 @@ export function usageRow(request, outcome, at) {
         reasoningTokens: count(usage.reasoningTokens),
         costUsd: Number.isFinite(usage.costUsd) && usage.costUsd > 0 ? usage.costUsd : 0,
         createdAt: at.toISOString(),
+        ...(timing
+            ? { startedAt: timing.startedAt.toISOString(), endedAt: timing.endedAt.toISOString() }
+            : {}),
+        ...(typeof firstTokenMs === "number" && Number.isFinite(firstTokenMs) && firstTokenMs >= 0
+            ? { firstTokenMs: Math.round(firstTokenMs) }
+            : {}),
     };
 }
 /** The ledger rows a budget counts for `request`; undefined when it doesn't apply. */

package/dist/gates/policy.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { type ToolPolicy, type ToolRule } from "@nylorun/core/contracts";
+import type { AgentManifest } from "@nylorun/core/define";
+import type { HostEffect } from "@nylorun/harness/run";
+import { type McpSnapshot } from "../mcp/snapshot.js";
+import type { Tx } from "../store/types.js";
+import type { Session } from "../tenant/context.js";
+/** The `tenant_settings` key the policy is kept under. */
+export declare const TOOL_POLICY_SETTING = "tool-policy";
+/** A call as the policy reads it. */
+export interface PolicyCall {
+    readonly kind: "mcp" | "http";
+    /** The name the model calls the tool by; a flow stage's key. */
+    readonly tool: string;
+    /** The MCP server's name. */
+    readonly server?: string;
+    /** The agent that calls it. */
+    readonly agent: string;
+    readonly input: unknown;
+}
+export type PolicyDecision = {
+    readonly effect: "allow";
+} | {
+    readonly effect: "ask" | "deny";
+    readonly reason: string;
+};
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export declare function readToolPolicy(t: Pick<Tx, "getSetting">): Promise<ToolPolicy>;
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export declare function toolCallDecision(t: Pick<Tx, "getSetting">, s: Session, request: HostEffect, kind: "mcp" | "http"): Promise<PolicyDecision>;
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export declare function decide(rules: readonly ToolRule[], call: PolicyCall, pinnedAsk?: boolean): PolicyDecision;
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export declare function pinnedApproval(manifest: AgentManifest, snapshot: McpSnapshot | undefined, request: HostEffect): boolean;

package/dist/gates/policy.js

@@ -0,0 +1,134 @@
+/**
+ * Tool policy (R5 step 2). Every MCP and HTTP tool call of every harness is decided as core
+ * journals it (`harness-api/record.ts`), which each harness must do before it sends a call:
+ * `deny` fails it to the model as `tool.denied`, unsent; `ask` holds the row until a person
+ * approves it on the session; `allow` runs it. The Tool Gate sends only a call the journal holds
+ * running (`journal.ts`), so a held or refused call cannot run, whichever harness asks.
+ *
+ * The rules are the Tenant's (`PUT /v1/tenant/tool-policy`, the `tool-policy` setting). A rule
+ * matches a call when every selector it sets matches; the strictest matching rule decides
+ * (`deny`, then `ask`, then `allow`), and a call no rule matches runs. A session pinned to a
+ * manifest saved before R5 step 2 keeps its `approval: "always"` as an ask: no session loses
+ * the approval it was opened with. A policy that cannot be read refuses every call.
+ */
+import { ToolPolicySchema } from "@nylorun/core/contracts";
+import { mcpToolOf, mcpToolSettingsIn } from "../mcp/snapshot.js";
+import { canonical } from "../store/canonical.js";
+import { turnManifestOf } from "../tenant/session.js";
+import { declaredHttpTool } from "./http-tool.js";
+/** The `tenant_settings` key the policy is kept under. */
+export const TOOL_POLICY_SETTING = "tool-policy";
+const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
+/** The Tenant's policy; an empty one when none was set. Throws when it cannot be read. */
+export async function readToolPolicy(t) {
+    const raw = await t.getSetting(TOOL_POLICY_SETTING);
+    if (raw === undefined)
+        return { rules: [], updatedAt: null };
+    return ToolPolicySchema.parse(JSON.parse(raw));
+}
+/**
+ * The decision for `request`, a session's MCP or HTTP tool call: the Tenant's rules and the
+ * pinned manifest's `approval`. A policy that cannot be read refuses the call.
+ */
+export async function toolCallDecision(t, s, request, kind) {
+    let rules;
+    try {
+        rules = (await readToolPolicy(t)).rules;
+    }
+    catch {
+        return { effect: "deny", reason: "The Tenant's tool policy could not be read, so no tool call runs" };
+    }
+    const mcp = mcpToolOf(s.mcpSnapshot, request);
+    return decide(rules, {
+        kind,
+        tool: request.toolName ?? request.key ?? request.effectId,
+        ...(mcp ? { server: mcp.serverName } : {}),
+        agent: request.agent?.id ?? s.agentId,
+        input: request.input,
+    }, pinnedApproval(turnManifestOf(s), s.mcpSnapshot, request));
+}
+/** Decides `call` by `rules`; `pinnedAsk` adds the ask of a manifest saved before R5 step 2. */
+export function decide(rules, call, pinnedAsk = false) {
+    let strictest = pinnedAsk
+        ? { effect: "ask", reason: `The agent's manifest asks for approval of '${call.tool}'` }
+        : undefined;
+    for (const rule of rules) {
+        if (!matches(rule, call))
+            continue;
+        if (strictest && STRICTNESS[rule.effect] <= STRICTNESS[strictest.effect])
+            continue;
+        strictest = { effect: rule.effect, reason: rule.reason ?? describe(rule) };
+    }
+    if (!strictest || strictest.effect === "allow")
+        return { effect: "allow" };
+    return { effect: strictest.effect, reason: strictest.reason };
+}
+/** The pinned `approval: "always"` of the call's tool, in a manifest saved before R5 step 2. */
+export function pinnedApproval(manifest, snapshot, request) {
+    const mcp = mcpToolOf(snapshot, request);
+    if (mcp)
+        return mcpToolSettingsIn(manifest, mcp).approval === "always";
+    if (request.capabilityId === undefined)
+        return false;
+    return declaredHttpTool(manifest, request.agent?.id, request.capabilityId, request.toolName)?.approval === "always";
+}
+function matches(rule, call) {
+    if (rule.kind !== undefined && rule.kind !== call.kind)
+        return false;
+    if (rule.tool !== undefined && !glob(rule.tool).test(call.tool))
+        return false;
+    if (rule.server !== undefined && (call.server === undefined || !glob(rule.server).test(call.server)))
+        return false;
+    if (rule.agent !== undefined && !glob(rule.agent).test(call.agent))
+        return false;
+    for (const [path, condition] of Object.entries(rule.when ?? {}))
+        if (!holds(condition, fieldOf(call.input, path)))
+            return false;
+    return true;
+}
+/** A pattern where `*` is any run of characters, matched whole. */
+function glob(pattern) {
+    return new RegExp(`^${pattern.split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*")}$`);
+}
+/** The value at a dotted `path` of `input`, or undefined. */
+function fieldOf(input, path) {
+    let value = input;
+    for (const key of path.split(".")) {
+        if (!value || typeof value !== "object")
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}
+function holds(condition, value) {
+    if (value === undefined)
+        return false;
+    if (condition.equals !== undefined && canonical(value) !== canonical(condition.equals))
+        return false;
+    if (condition.in !== undefined && !condition.in.some((item) => canonical(item) === canonical(value)))
+        return false;
+    const number = typeof value === "number" ? value : undefined;
+    if (condition.gt !== undefined && !(number !== undefined && number > condition.gt))
+        return false;
+    if (condition.gte !== undefined && !(number !== undefined && number >= condition.gte))
+        return false;
+    if (condition.lt !== undefined && !(number !== undefined && number < condition.lt))
+        return false;
+    if (condition.lte !== undefined && !(number !== undefined && number <= condition.lte))
+        return false;
+    if (condition.matches !== undefined && !(typeof value === "string" && new RegExp(condition.matches).test(value)))
+        return false;
+    return true;
+}
+/** What a rule with no `reason` says. */
+function describe(rule) {
+    const what = [
+        rule.tool === undefined ? undefined : `tool '${rule.tool}'`,
+        rule.server === undefined ? undefined : `server '${rule.server}'`,
+        rule.kind === undefined ? undefined : `${rule.kind} tools`,
+        rule.agent === undefined ? undefined : `agent '${rule.agent}'`,
+        rule.when === undefined ? undefined : `input ${Object.keys(rule.when).join(", ")}`,
+    ].filter((part) => part !== undefined);
+    const verb = rule.effect === "deny" ? "refuses" : "asks a person about";
+    return `The Tenant's tool policy ${verb} ${what.length === 0 ? "every tool call" : `calls of ${what.join(", ")}`}`;
+}

package/dist/gates/tenant-vaults.d.ts

@@ -29,15 +29,15 @@ export interface TenantVault {
     session(sessionId: string): Promise<Session | undefined>;
     /**
      * The authorization of one request to a session's remote MCP server or HTTP tool: its
-     * credential from the session's attached vaults.
+     * credential from the vault of the session's Environment.
      */
     authorizeMcp(sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;
     /** Vault writes and token signing with the Tenant's vault key (the keys service, F4.2). */
     keys(): Keys;
-    /** Whether a live session on the sandbox has an `environment_secret` bound to `host` (R2c). */
-    environmentSecretBound(sandboxId: string, host: string): Promise<boolean>;
+    /** Whether the Environment's vault has an `environment_secret` bound to `host` (R2c). */
+    environmentSecretBound(environmentId: string, host: string): Promise<boolean>;
     /** The header an `environment_secret` sets on one request to `host` (R2c). */
-    releaseEnvironmentSecret(sandboxId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
+    releaseEnvironmentSecret(environmentId: string, host: string): ReturnType<VaultService["releaseEnvironmentSecret"]>;
 }
 export interface TenantVaults {
     /**
@@ -60,8 +60,8 @@ export interface TenantVaultsOptions {
 }
 export declare function createTenantVaults(options: TenantVaultsOptions): TenantVaults;
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export declare function authorizeSessionMcp(vault: Pick<VaultService, "authorize">, session: (sessionId: string) => Promise<Session | undefined>, sessionId: string, request: McpCredentialRequest): Promise<AuthorizeResult>;

package/dist/gates/tenant-vaults.js

@@ -52,8 +52,8 @@ export function createTenantVaults(options) {
             session,
             authorizeMcp: (sessionId, request) => authorizeSessionMcp(credentials, session, sessionId, request),
             keys: () => keys,
-            environmentSecretBound: (sandboxId, host) => credentials.environmentSecretBound(sandboxId, host),
-            releaseEnvironmentSecret: (sandboxId, host) => credentials.releaseEnvironmentSecret({ sandboxId, host }),
+            environmentSecretBound: (environmentId, host) => credentials.environmentSecretBound(environmentId, host),
+            releaseEnvironmentSecret: (environmentId, host) => credentials.releaseEnvironmentSecret({ environmentId, host }),
         };
     }
     /** The database's Tenant, once its schema is at this build's version. */
@@ -81,9 +81,9 @@ export function createTenantVaults(options) {
     };
 }
 /**
- * A request to a session's remote MCP server, authorized from the session's attached vaults:
- * what the loop does in its own process (`tenant/effects.ts` `authorize`). The vaults come from
- * the session row.
+ * A request to a session's remote MCP server, authorized from its Environment's vault: what the
+ * loop does in its own process (`tenant/effects.ts` `authorize`). The Environment comes from the
+ * session row.
  */
 export async function authorizeSessionMcp(vault, session, sessionId, request) {
     const found = await session(sessionId);

package/dist/gates/tool-calls.d.ts

@@ -8,10 +8,14 @@
  * - The gate also writes a `tool_crossings` row before it calls the server, and the answer
  *   after. A re-send that finds the answer gets it. One that finds a row without an answer,
  *   for a call this gateway is not running, was lost with an earlier gateway (a restart mid
- *   call): it answers `uncertain`, because the call may have run, and is never run again.
+ *   call): it is started again under the same key (R5.3), so the tool sees the key twice and
+ *   a tool that honors it acts once. Core counts the sends and stops at its cap (R5.4).
+ * - A re-send that another gateway process started or settled between this one's read and its
+ *   write answers `{uncertain: true}`: not answered here, so the caller sends it again later.
  *
- * A cancel aborts the call and leaves its row without an answer. Settled rows are deleted a day
- * later (`prune`).
+ * A cancel aborts the call and settles its row as cancelled: it never runs again under its key.
+ * A shutdown leaves the row open, so the next gateway starts it again. Settled rows are deleted
+ * a day later (`prune`); a re-send after that runs the call again, which at least once allows.
  */
 import type { Logger } from "../tenant/types.js";
 import { type InflightCallsOptions, type InflightOwner } from "./inflight.js";
@@ -29,8 +33,9 @@ export interface ToolCalls {
      */
     run(tenantId: string | undefined, key: string, hash: string, call: (signal: AbortSignal) => Promise<ToolCallAnswer>, owner?: InflightOwner): Promise<ToolCallAnswer>;
     /**
-     * Aborts the call under `key`; it is never run again under that key. With `sessionId`, false
-     * when the running call is another session's (nothing is aborted).
+     * Aborts the call under `key` and settles its crossing as cancelled: it is never run again
+     * under that key. With `sessionId`, false when the running call is another session's (nothing
+     * is aborted).
      */
     cancel(key: string, sessionId?: string): boolean;
     /** Aborts every running call (gateway shutdown). */

package/dist/gates/tool-calls.js

@@ -1,11 +1,15 @@
 import { createInflightCalls, InflightConflict, } from "./inflight.js";
 /** How long a settled crossing is kept. */
 export const TOOL_CROSSING_TTL_MS = 24 * 60 * 60_000;
-const LOST = {
+const CANCELLED = {
+    ok: false,
+    error: { message: "The call was cancelled while it ran; it may have reached its server" },
+};
+const ELSEWHERE = {
     ok: false,
     error: {
         uncertain: true,
-        message: "The gateway stopped while this tool call ran; the call may have reached its server, so it is not run again",
+        message: "Another gateway process is running this tool call; send it again",
     },
 };
 export function createToolCalls(options) {
@@ -16,7 +20,7 @@ export function createToolCalls(options) {
     return {
         async run(tenantId, key, hash, call, owner) {
             if (inflight.has(key))
-                return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
+                return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
             const vault = await vaults.open(tenantId);
             const store = vault.store;
             const row = await store.tx((t) => t.toolCrossing(key));
@@ -25,16 +29,19 @@ export function createToolCalls(options) {
                     throw new InflightConflict(`A different request already ran under ${key}`);
                 if (row.answer !== null && row.answer !== undefined)
                     return row.answer;
-                // Started here a moment ago, or lost with an earlier gateway.
+                // Started here a moment ago: join it.
                 if (inflight.has(key))
-                    return inflight.run(key, hash, () => Promise.resolve(LOST), owner);
-                return LOST;
+                    return inflight.run(key, hash, () => Promise.resolve(ELSEWHERE), owner);
+                // Otherwise it was lost with an earlier gateway: it starts again below (R5.3).
             }
             return inflight.run(key, hash, async (signal) => {
-                const started = await store.tx((t) => t.startToolCrossing({ key, hash, startedAt: iso() }));
-                // Another gateway process wrote it between the read and now: never run it twice.
+                const startedAt = iso();
+                const started = await store.tx((t) => row
+                    ? t.restartToolCrossing({ key, hash, startedAt })
+                    : t.startToolCrossing({ key, hash, startedAt }));
+                // Another gateway process started or settled it between the read and now.
                 if (!started)
-                    return LOST;
+                    return ELSEWHERE;
                 const answer = await call(signal);
                 // A cancel or a shutdown: the call may have reached the server; the row stays open.
                 if (signal.aborted)
@@ -48,7 +55,18 @@ export function createToolCalls(options) {
                 return answer;
             }, owner);
         },
-        cancel: (key, sessionId) => inflight.cancel(key, sessionId),
+        cancel(key, sessionId) {
+            if (!inflight.cancel(key, sessionId))
+                return false;
+            void vaults
+                .open(undefined)
+                .then((vault) => vault.store.tx((t) => t.settleToolCrossing(key, CANCELLED, iso())))
+                .catch((error) => logger.warn("tool_crossing_unsettled", {
+                effect: key,
+                message: error instanceof Error ? error.message : String(error),
+            }));
+            return true;
+        },
         close: () => inflight.close(),
         async prune() {
             try {

package/dist/gates/tool-client.d.ts

@@ -1,5 +1,13 @@
 import type { ToolGate } from "./tool-gate.js";
 import type { RunTokens } from "../tenant/run-grants.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export declare class GateCallLost extends Error {
+    readonly name = "GateCallLost";
+}
 export interface HttpToolGateOptions {
     /** The gates service, e.g. `http://gateway:4100` (`NYLORUN_GATES_URL`). */
     readonly url: string;

package/dist/gates/tool-client.js

@@ -8,10 +8,12 @@
  * Failures keep the meaning they had in the loop's own process:
  * - An MCP request that fails throws, so the pool reports a diagnostic. A tool call's coded
  *   failure (R2b C7) throws the `McpCallFailed` the loop's own call would have, which becomes a
- *   failed outcome the model sees. Only the hop's failures and a call lost with the gateway leave
- *   it `uncertain`.
- * - An HTTP tool call throws only for the hop, or a call lost with the gateway: its own failures
- *   are outcomes.
+ *   failed outcome the model sees.
+ * - An HTTP tool call throws only for the hop: its own failures are outcomes.
+ * - A hop that lost the answer (the gate unreachable, the connection lost, a `5xx`, or a call
+ *   another gateway process holds) throws `GateCallLost`: sending the call again with the same
+ *   key joins it, collects its answer, or runs it again (R5.3). A gate's refusal (`4xx`) throws
+ *   a plain error.
  *
  * Credentials (F5): a session's MCP requests and keyed cancels carry its run token, read per
  * request from the advance's grant, and leave the session out of the body: the gate takes it
@@ -26,6 +28,14 @@ import { McpCallFailed, } from "../mcp/connect.js";
 import { TENANT_HEADER } from "./contract.js";
 import { GATE_CLIENT_TIMEOUT_MS } from "./http-client.js";
 import { HTTP_CALLS_PATH, MCP_CLOSE_PATH, MCP_CONNECT_PATH, MCP_LIST_PATH, TOOL_CALLS_PATH, } from "./tool-contract.js";
+/**
+ * A keyed call whose answer the hop lost (R5.3): the gate never got it, the connection broke,
+ * the gate answered `5xx`, or another gateway process holds the call. Sending it again with the
+ * same key is safe: the gate joins the call, answers it from its crossing, or runs it again.
+ */
+export class GateCallLost extends Error {
+    name = "GateCallLost";
+}
 /** How long a close or a cancel may take; neither changes an outcome. */
 const SHORT_TIMEOUT_MS = 2_000;
 export function httpToolGate(options) {
@@ -111,8 +121,7 @@ export function httpToolGate(options) {
     }
     /**
      * The answer of an MCP or HTTP tool request, or a throw: a coded MCP failure (`McpCallFailed`),
-     * or one the pool and `resolveEffect` read as before, the call's fate unknown and the effect
-     * `uncertain`.
+     * a lost hop (`GateCallLost`, sent again), or a gate's refusal.
      */
     async function answer(path, scope, request) {
         const result = await exchange(path, scope.body, {
@@ -123,8 +132,10 @@ export function httpToolGate(options) {
         if (result.kind === "aborted")
             throw result.reason ?? new Error("aborted");
         if (result.kind !== "answer")
-            throw new Error(result.message);
+            throw new GateCallLost(result.message);
         const parsed = parse(result.text);
+        if (result.status >= 500)
+            throw new GateCallLost(gateRefusal(result.status, parsed));
         if (result.status !== 200 || !parsed || !("ok" in parsed))
             throw new Error(gateRefusal(result.status, parsed));
         if (parsed.ok)
@@ -176,7 +187,9 @@ export function httpToolGate(options) {
         async callHttp(call, signal) {
             const token = options.runTokens?.token(call.tool.sessionId);
             const { sessionId: _, ...unnamed } = call.tool;
-            const body = { ...call, tool: token ? unnamed : { ...call.tool } };
+            // The gate reads the call's span context from its journal row (R7.4), not from the caller.
+            const { traceparent: _traceparent, ...sent } = call;
+            const body = { ...sent, tool: token ? unnamed : { ...call.tool } };
             return answered(HTTP_CALLS_PATH, { body, ...(token ? { bearer: token } : {}) }, { signal, idempotencyKey: call.effectId });
         },
         async cancel(request) {
@@ -190,10 +203,13 @@ export function httpToolGate(options) {
 }
 /** An MCP failure the gate reported, as the loop's own MCP code would have thrown it. */
 function mcpError(error) {
-    // Coded (R2b C7): the model sees it. A call lost with the gateway never is.
-    if (error.failure && !error.uncertain)
+    // Held by another gateway process: send it again (R5.3).
+    if (error.uncertain)
+        return new GateCallLost(error.message);
+    // Coded (R2b C7): the model sees it.
+    if (error.failure)
         return McpCallFailed.from(error.failure);
-    const thrown = new Error(error.uncertain ? `${error.message} (the call may have run; it is not sent again)` : error.message);
+    const thrown = new Error(error.message);
     if (error.code !== undefined)
         thrown.code = error.code;
     if (error.credentialIds !== undefined)