@orkestrel/agent 0.0.38 → 0.0.40

package/dist/src/core/index.cjs

@@ -8909,7 +8909,7 @@ var DETERMINISTIC_JUDGE_ERROR = /invalid or duplicate top logprob token/;
 * carrying the machine-readable `code`.
 *
 * @remarks
-* A threshold, share, capacity, limit, topic, lookup, question, or gauge outside its bounds is a
+* A threshold, share, capacity, limit, topic, lookup, write, question, or gauge outside its bounds is a
 * programmer error and throws this with the matching {@link LedgerErrorCode}. A calibration call that reports
 * no prompt usage throws this with `'GAUGE'`. A snapshot option that `isLedgerSnapshot` refuses
 * throws this with `'SNAPSHOT'`, its `context` holding the `faults`. Narrow a caught value with {@link isLedgerError} and
@@ -8953,7 +8953,7 @@ function isLedgerError(value) {
 	return (0, _orkestrel_contract.holds)(() => {
 		if (!(value instanceof Error && _orkestrel_contract.INTRINSICS.prototype(value) !== Error.prototype && _orkestrel_contract.INTRINSICS.describe(value, Symbol.for("@orkestrel/agent.LedgerError"))?.value === value)) return false;
 		const code = _orkestrel_contract.INTRINSICS.reflect.read(value, "code");
-		if (!(code === "REQUEST" || code === "THRESHOLD" || code === "SHARE" || code === "CAPACITY" || code === "LIMIT" || code === "TOPIC" || code === "LOOKUP" || code === "GAUGE" || code === "REFERENCE" || code === "SNAPSHOT" || code === "QUESTION")) return false;
+		if (!(code === "REQUEST" || code === "THRESHOLD" || code === "SHARE" || code === "CAPACITY" || code === "LIMIT" || code === "TOPIC" || code === "LOOKUP" || code === "GAUGE" || code === "REFERENCE" || code === "SNAPSHOT" || code === "QUESTION" || code === "WRITE")) return false;
 		const context = _orkestrel_contract.INTRINSICS.reflect.read(value, "context");
 		return context === void 0 || (0, _orkestrel_contract.isObject)(context) || (0, _orkestrel_contract.isFunction)(context);
 	});
@@ -8983,7 +8983,43 @@ function digestLedgerWindow(exchanges, messages) {
 		return values.some((value) => value === void 0) ? void 0 : (0, _orkestrel_contract.canonicalStringify)([values, exchanges.map((entry) => [entry.copy ?? null, entry.lines])]);
 	});
 	if (!encoded.success || encoded.value === void 0) return void 0;
-	const hash = [...encoded.value].reduce((prior, character) => {
+	return computeLedgerChecksum(encoded.value);
+}
+/**
+* Digests tool definitions as the JSON a provider request carries them, in order.
+*
+* @remarks
+* A ledger stores this digest with its gauge, so a hydrate reuses the gauge only for the same
+* definitions: an added, removed, reordered, or edited definition changes the digest. The digest is
+* a {@link computeLedgerChecksum} checksum and makes no security claim.
+*
+* @param definitions - The tool definitions, as a tool manager's `definitions` method returns them
+* @returns The 16-digit hexadecimal digest, or undefined when JSON cannot render the definitions
+* @example
+* ```ts
+* digestLedgerTools([{ name: 'lookup_order', description: 'Read an order by its id.' }]) // '1eff754a69b7128c'
+* ```
+*/
+function digestLedgerTools(definitions) {
+	const text = renderJSON(definitions);
+	return text === void 0 ? void 0 : computeLedgerChecksum(text);
+}
+/**
+* Computes a checksum of text: two 32-bit FNV-1a lanes over its code points, as 16 hexadecimal digits.
+*
+* @remarks
+* The checksum detects an edit, can collide, and makes no security claim. Over ASCII text, the first
+* lane is the standard 32-bit FNV-1a hash.
+*
+* @param text - The text to checksum
+* @returns The 16-digit lowercase hexadecimal checksum
+* @example
+* ```ts
+* computeLedgerChecksum('a') // 'e40c292ce457465e'
+* ```
+*/
+function computeLedgerChecksum(text) {
+	const hash = [...text].reduce((prior, character) => {
 		const code = character.codePointAt(0) ?? 0;
 		return {
 			first: Math.imul(prior.first ^ code, 16777619) >>> 0,
@@ -8998,19 +9034,21 @@ function digestLedgerWindow(exchanges, messages) {
 /**
 * Collects stored messages eligible to open the recall offer.
 * @remarks
-* Notes and findings without a result do not open the offer. User statements, including quiet
-* statements available through recall's word route, can open it; this helper does not filter results.
+* Notes, findings without a result, and findings {@link collectRetiredFindings} names do not open
+* the offer. User statements, including quiet statements available through recall's word route,
+* can open it; this helper does not filter results.
 * @param input - The messages, findings, and classification
 * @param requests - The marked request ids
 * @param notes - The annotation ids to exclude
-* @returns User statements, lookup findings with results, marked requests, and nonblank call-free replies
+* @returns User statements, lookup findings with results that no write superseded and no later finding replaced, marked requests, and nonblank call-free replies
 * @example
 * ```ts
 * collectRecallMessages(input, new Set(), new Set()) // eligible stored messages
 * ```
 */
 function collectRecallMessages(input, requests, notes) {
-	const findings = new Set(input.findings.filter((finding) => finding.result !== void 0).map((finding) => finding.id));
+	const retired = collectRetiredFindings(input.messages, input.findings);
+	const findings = new Set(input.findings.filter((finding) => finding.result !== void 0 && !retired.has(finding.id)).map((finding) => finding.id));
 	return input.messages.filter((message) => !notes.has(message.id) && (requests.has(message.id) || message.role === "assistant" && !hasCalls(message) && message.content.trim() !== "" || message.role === "user" && !hasCalls(message) || message.role === "tool" && findings.has(message.id)));
 }
 /**
@@ -9908,6 +9946,7 @@ function matchesCutLine(line) {
 * @param name - The lookup tool name
 * @param args - The arguments the call carried; arguments JSON cannot carry leave the call as its bare tool name, per {@link renderLookupCall}
 * @param state - What became of the result: `failed`, `empty`, `shown` in the records, or `hidden` from them
+* @param write - If `true`, the call is a write's, whose `empty` state reads `changed nothing`; if `false`, a lookup's, whose `empty` state reads `no record`. Default: `false`
 * @returns The stub text, which carries the call and its state
 *
 * @example
@@ -9916,10 +9955,10 @@ function matchesCutLine(line) {
 * // 'lookup_order {"id":"BW-5512"}: result not shown; call recall with BW-5512'
 * ```
 */
-function renderStub(name, args, state) {
+function renderStub(name, args, state, write = false) {
 	const head = renderLookupCall(name, args);
 	if (state === "failed") return `${head}: failed`;
-	if (state === "empty") return `${head}: no record`;
+	if (state === "empty") return write ? `${head}: changed nothing` : `${head}: no record`;
 	if (state === "shown") return `${head}: result shown under Records below`;
 	return `${head}: result not shown; call recall with ${(Object.values(args).find(_orkestrel_contract.isString) ?? "").trim() || "its id"}`;
 }
@@ -9966,7 +10005,8 @@ function fitSlope(groups) {
 * or superseded. When the whole run is superseded, its first finding reaches that final filter.
 * Different text or an undefined result replaces the earlier run, so an empty lookup leaves the
 * earlier result out of every record. A thrown lookup leaves the earlier result live. A finding
-* with no canonical identity participates in no replacement.
+* with no canonical identity participates in no replacement. A finding a write retired is
+* superseded once {@link mergeSupersessions} merges the write's edges into the classification.
 *
 * @param input - The messages, findings, and classification to read
 * @returns The live message ids
@@ -9993,6 +10033,100 @@ function collectLive(input) {
 	return [...new Map(input.messages.map((message) => [message.id, message])).values()].filter((message) => message.role === "user" || message.role === "tool" && current.has(message.id)).map((message) => message.id).filter((id) => !excluded.has(id) && !classification.quiet.has(id) && (classification.supersessions.get(id) ?? []).length === 0);
 }
 /**
+* Collects each finding a write made stale, mapped to the writes that supersede it.
+*
+* @remarks
+* A write is a finding with `targets`. It supersedes another finding whose names meet its targets
+* when that finding comes before it in conversation order, or sits in its own tool group and
+* carries no targets, because one batch dispatches its calls at once. So the later of two writes in
+* one group supersedes the earlier, and never the reverse. A finding's names are its result's `ids`
+* and owner ids, or, for an empty finding, the ids its string arguments name, as `extractLiterals`
+* reads them. Names and targets compare exactly. A write never supersedes itself, a finding with
+* empty `targets` supersedes nothing, and a finding the messages don't hold takes no part.
+*
+* @param messages - The conversation's messages, which fix each finding's position and tool group
+* @param findings - The lookup and write findings of those messages
+* @returns Each superseded finding's id, in conversation order, mapped to the ids of the writes that supersede it, in conversation order
+*
+* @example
+* ```ts
+* collectWriteSupersessions(messages, findings) // Map { 'tool-1' => ['tool-2'] } when tool-2 wrote what tool-1 read
+* ```
+*/
+function collectWriteSupersessions(messages, findings) {
+	if (!findings.some((finding) => (finding.targets ?? []).length > 0)) return /* @__PURE__ */ new Map();
+	const positions = new Map(messages.map((message, at) => [message.id, at]));
+	const groups = new Map(collectToolGroups(messages).flatMap((group, at) => group.map((message) => [message.id, at])));
+	const held = findings.filter((finding) => positions.has(finding.id)).toSorted((left, right) => (positions.get(left.id) ?? 0) - (positions.get(right.id) ?? 0));
+	const writes = held.filter((finding) => (finding.targets ?? []).length > 0);
+	return new Map(held.flatMap((finding) => {
+		const names = new Set(finding.result === void 0 ? Object.values(finding.arguments).filter(_orkestrel_contract.isString).flatMap((value) => [...extractLiterals(value).ids]) : [...finding.result.ids, ...finding.result.owners.map((owner) => owner.id)]);
+		const at = positions.get(finding.id) ?? 0;
+		const group = groups.get(finding.id);
+		const targeted = (finding.targets ?? []).length > 0;
+		const superseders = writes.filter((write) => write.id !== finding.id && (write.targets ?? []).some((target) => names.has(target)) && ((positions.get(write.id) ?? 0) > at || !targeted && group !== void 0 && groups.get(write.id) === group));
+		return superseders.length === 0 ? [] : [[finding.id, superseders.map((write) => write.id)]];
+	}));
+}
+/**
+* Collects the findings a write superseded or a later finding of the same lookup replaced.
+*
+* @remarks
+* A write supersedes the findings {@link collectWriteSupersessions} maps. A later finding of the
+* same canonical lookup identity, as {@link identifyLookup} writes it, replaces an earlier one when
+* its text differs or it holds no result, and a later finding with the same text replaces nothing.
+* A finding with no canonical identity is never replaced, and a finding the messages don't hold
+* takes no part. A supersession the judge files is not read here.
+*
+* @param messages - The conversation's messages, which fix each finding's position
+* @param findings - The lookup and write findings of those messages
+* @returns The ids of the superseded and replaced findings
+*
+* @example
+* ```ts
+* collectRetiredFindings(messages, findings) // Set { 'tool-1' } when tool-2 wrote what tool-1 read
+* ```
+*/
+function collectRetiredFindings(messages, findings) {
+	const positions = new Map(messages.map((message, at) => [message.id, at]));
+	const held = findings.filter((finding) => positions.has(finding.id));
+	const replaced = [...Map.groupBy(held, (finding) => identifyLookup(finding.name, finding.arguments) ?? finding).values()].flatMap((group) => {
+		const ordered = group.toSorted((left, right) => (positions.get(left.id) ?? 0) - (positions.get(right.id) ?? 0));
+		const last = ordered.at(-1);
+		const boundary = last === void 0 ? -1 : ordered.findLastIndex((finding) => finding.result === void 0 || finding.text !== last.text);
+		return ordered.slice(0, Math.min(boundary + 1, ordered.length - 1)).map((finding) => finding.id);
+	});
+	return /* @__PURE__ */ new Set([...collectWriteSupersessions(messages, findings).keys(), ...replaced]);
+}
+/**
+* Merges supersession edges into a classification, adding each edge to both its supersessions and its amendments.
+*
+* @remarks
+* Each earlier message's later ids stay distinct and in conversation order, so every supersession
+* is still an amendment, as the classifier files one. An empty edge map returns the classification
+* itself.
+*
+* @param classification - The judged classification
+* @param edges - The later ids that supersede each earlier id, such as {@link collectWriteSupersessions} returns
+* @param messages - The conversation's messages, which order the later ids
+* @returns The classification with the edges merged
+*
+* @example
+* ```ts
+* mergeSupersessions(classification, new Map([['tool-1', ['tool-2']]]), messages).supersessions.get('tool-1') // ['tool-2']
+* ```
+*/
+function mergeSupersessions(classification, edges, messages) {
+	if (edges.size === 0) return classification;
+	const positions = new Map(messages.map((message, at) => [message.id, at]));
+	const [amendments = classification.amendments, supersessions = classification.supersessions] = [classification.amendments, classification.supersessions].map((laters) => new Map([.../* @__PURE__ */ new Set([...laters.keys(), ...edges.keys()])].map((earlier) => [earlier, [.../* @__PURE__ */ new Set([...laters.get(earlier) ?? [], ...edges.get(earlier) ?? []])].toSorted((left, right) => (positions.get(left) ?? 0) - (positions.get(right) ?? 0))])));
+	return {
+		...classification,
+		amendments,
+		supersessions
+	};
+}
+/**
 * Places a message on the record keys it joins.
 *
 * @remarks
@@ -10652,7 +10786,8 @@ var Gauge = class {
 // src/core/ledgers/LedgerPass.ts
 /**
 * Holds what one pass of a ledger request keeps: the selection its run adopted last, the
-* conversation boundary its calls count additions from, its summed usage, and its gauge calls.
+* conversation boundary its calls count additions from, its summed usage, its gauge calls, and the
+* abort that ends its run.
 *
 * @remarks
 * A `LedgerRequest` opens one pass per agent run and exposes only projections of it, so no public
@@ -10666,6 +10801,7 @@ var LedgerPass = class {
 	#selection;
 	#boundary;
 	#usage;
+	#abort = (0, _orkestrel_abort.createAbort)();
 	/**
 	* Opens the pass at a conversation boundary.
 	*
@@ -10699,6 +10835,22 @@ var LedgerPass = class {
 		return this.#usage;
 	}
 	/**
+	* Returns the signal `abort` aborts.
+	*
+	* @returns The pass's abort signal
+	*/
+	get signal() {
+		return this.#abort.signal;
+	}
+	/**
+	* Reports whether `abort` ended the pass.
+	*
+	* @returns True if the pass was aborted; false otherwise
+	*/
+	get aborted() {
+		return this.#abort.signal.aborted;
+	}
+	/**
 	* Returns the call in flight.
 	*
 	* @returns The latest call the pass observed, or undefined before one
@@ -10792,6 +10944,10 @@ var LedgerPass = class {
 	think(thinking) {
 		this.#log = [...this.#log, { thinking }];
 	}
+	/** Aborts the pass's run through `signal`, with the reason `'stray'`; a later call changes nothing. */
+	abort() {
+		this.#abort.abort("stray");
+	}
 };
 // src/core/ledgers/LedgerRequest.ts
 /**
@@ -10825,6 +10981,7 @@ var LedgerRequest = class {
 	#passes = [];
 	#attempts = [];
 	#admitted = /* @__PURE__ */ new Set();
+	#denials = /* @__PURE__ */ new Set();
 	#listed = [];
 	#recalls = 0;
 	#closed = false;
@@ -10906,6 +11063,22 @@ var LedgerRequest = class {
 	get attempts() {
 		return this.#attempts;
 	}
+	/**
+	* Returns the signal `abort` aborts for the current pass's run.
+	*
+	* @returns The current pass's abort signal, or undefined before a pass
+	*/
+	get signal() {
+		return this.#passes.at(-1)?.signal;
+	}
+	/**
+	* Reports whether `abort` ended the current pass.
+	*
+	* @returns True if the current pass was aborted; false otherwise, and before a pass
+	*/
+	get aborted() {
+		return this.#passes.at(-1)?.aborted ?? false;
+	}
 	enter(conversation) {
 		if (this.#message !== void 0) return this.#message;
 		this.#message = conversation.add({
@@ -10920,6 +11093,9 @@ var LedgerRequest = class {
 	adopt(selection, boundary) {
 		this.#passes.at(-1)?.adopt(selection, boundary);
 	}
+	abort() {
+		this.#passes.at(-1)?.abort();
+	}
 	observe(call, position) {
 		const draft = this.#draft;
 		this.#sent = draft !== void 0 && this.selection?.messages.some((message) => message.id === draft.copy.id && message.content === draft.copy.content) ? draft : void 0;
@@ -10954,6 +11130,18 @@ var LedgerRequest = class {
 		if (this.#admitted.has(key)) throw new Error(LEDGER_NOTES.repeat);
 		this.#admitted = /* @__PURE__ */ new Set([...this.#admitted, key]);
 	}
+	release(name, args) {
+		const key = (0, _orkestrel_contract.canonicalStringify)([name, args]);
+		this.#admitted = new Set([...this.#admitted].filter((admitted) => admitted !== key));
+	}
+	deny(name, args) {
+		const key = (0, _orkestrel_contract.canonicalStringify)([name, args]);
+		if (key !== void 0) this.#denials = /* @__PURE__ */ new Set([...this.#denials, key]);
+	}
+	denied(name, args) {
+		const key = (0, _orkestrel_contract.canonicalStringify)([name, args]);
+		return key !== void 0 && this.#denials.has(key);
+	}
 	recall() {
 		if (this.#recalls >= this.#limit) this.#closed = true;
 		if (this.#closed) throw new Error(LEDGER_NOTES.closure);
@@ -11129,7 +11317,8 @@ var ledgerSnapshotShape = (0, _orkestrel_contract.objectShape)({
 	failures: (0, _orkestrel_contract.arrayShape)((0, _orkestrel_contract.stringShape)()),
 	gauge: (0, _orkestrel_contract.optionalShape)((0, _orkestrel_contract.objectShape)({
 		scale: (0, _orkestrel_contract.numberShape)(),
-		overhead: (0, _orkestrel_contract.numberShape)()
+		overhead: (0, _orkestrel_contract.numberShape)(),
+		digest: (0, _orkestrel_contract.stringShape)()
 	})),
 	window: (0, _orkestrel_contract.optionalShape)(ledgerWindowShape)
 });
@@ -11204,8 +11393,8 @@ function isLedgerQuestion(value) {
 * `conversation` must pass `isConversationSnapshot`, and `requests`, `notes`, and `failures` must be
 * dense arrays of strings. Each request and note id must name a `user` message of
 * `conversation.messages` and each failure id a `tool` message, so an id only a section original
-* holds is refused. A `gauge`, when present, must hold a finite `scale` greater than 0 and a finite
-* `overhead` of at least 0. The guard is exact: an unknown member and an own `undefined` `gauge` return
+* holds is refused. A `gauge`, when present, must hold a finite `scale` greater than 0, a finite
+* `overhead` of at least 0, and a string `digest`. The guard is exact: an unknown member and an own `undefined` `gauge` return
 * false, at the snapshot and in its `gauge`. Unreadable members and untrusted inputs return false. The
 * guard is structural: it admits a conversation holding a stored `system` role
 * or a repeated id, which `requireConversationSnapshot` and the `Conversation` constructor then
@@ -11231,9 +11420,9 @@ function isLedgerSnapshot(value) {
 		const isIds = (0, _orkestrel_contract.arrayOf)(_orkestrel_contract.isString);
 		if (!isIds(requests) || !isIds(notes) || !isIds(failures)) return false;
 		if (gauge !== void 0) {
-			if (!(0, _orkestrel_contract.isRecord)(gauge) || Object.keys(gauge).length !== 2) return false;
-			const { scale, overhead } = gauge;
-			if (!(0, _orkestrel_contract.isFiniteNumber)(scale) || scale <= 0 || !(0, _orkestrel_contract.isFiniteNumber)(overhead) || overhead < 0) return false;
+			if (!(0, _orkestrel_contract.isRecord)(gauge) || Object.keys(gauge).length !== 3) return false;
+			const { scale, overhead, digest } = gauge;
+			if (!(0, _orkestrel_contract.isFiniteNumber)(scale) || scale <= 0 || !(0, _orkestrel_contract.isFiniteNumber)(overhead) || overhead < 0 || !(0, _orkestrel_contract.isString)(digest)) return false;
 		}
 		const roles = new Map(conversation.messages.map((message) => [message.id, message.role]));
 		return requests.every((id) => roles.get(id) === "user") && notes.every((id) => roles.get(id) === "user") && failures.every((id) => roles.get(id) === "tool") && (window === void 0 || isLedgerWindowSnapshot(window));
@@ -11266,6 +11455,7 @@ var Ledger = class {
 	#scans = /* @__PURE__ */ new Set();
 	#calibrations = /* @__PURE__ */ new Set();
 	#gauge;
+	#digest;
 	#window = [];
 	#evidence = collectLedgerEvidence([], /* @__PURE__ */ new Set(), []);
 	/**
@@ -11273,6 +11463,7 @@ var Ledger = class {
 	* @param provider - The provider that serves the conversation
 	* @param options - The filing policy, capacity, and request bounds
 	* @throws {LedgerError} Thrown when a threshold, share, capacity, limit, topic, lookup, or gauge is invalid
+	* @throws {LedgerError} Thrown when a write lacks the `consequential` annotation, writes come without `agent.authority`, or a write is named `recall` or shares a lookup's or another write's name (code `'WRITE'`)
 	* @throws {LedgerError} Thrown when `predict` is not a nonnegative safe integer less than `capacity` (code `'CAPACITY'`)
 	* @throws {LedgerError} Thrown when `questions` fails `isLedgerQuestion` (code `'QUESTION'`)
 	* @throws {LedgerError} Thrown when `snapshot` is malformed or marks an id its conversation does not hold (code `'SNAPSHOT'`, its faults under `context.faults`)
@@ -11298,6 +11489,12 @@ var Ledger = class {
 		if (topics.some((name) => name.trim() === "") || new Set(topics).size !== topics.length) throw new LedgerError("TOPIC", "topic names must be nonempty and unique");
 		const lookups = ["recall", ...Array.from(options.lookups ?? [], (lookup) => lookup.tool.name)];
 		if (new Set(lookups).size !== lookups.length) throw new LedgerError("LOOKUP", "lookup names must be unique and cannot be recall");
+		const writes = Array.from(options.writes ?? [], (write) => write.tool);
+		const names = [...lookups, ...writes.map((tool) => tool.name)];
+		if (new Set(names).size !== names.length) throw new LedgerError("WRITE", "write names must be unique and cannot be recall or the name of a lookup");
+		if (writes.some((tool) => tool.annotations?.consequential !== true)) throw new LedgerError("WRITE", "a write tool must carry annotations.consequential: true, so the host approves each call");
+		const host = options.agent?.authority;
+		if (writes.length > 0 && host === void 0) throw new LedgerError("WRITE", "writes need an agent.authority that gates each call");
 		if (!isLedgerQuestion(options.questions)) throw new LedgerError("QUESTION", "questions must hold a choice category question whose criteria describe every category, a non-empty topic string, and noul amends and supersedes questions; pass the LEDGER_QUESTIONS constant for the measured wording");
 		const snapshot = options.snapshot;
 		if (snapshot !== void 0 && !isLedgerSnapshot(snapshot)) {
@@ -11312,13 +11509,6 @@ var Ledger = class {
 			...DEFAULT_LEDGER_SHARE,
 			...options.share
 		};
-		const gauge = options.gauge ?? snapshot?.gauge;
-		if (gauge !== void 0) this.#gauge = new Gauge({
-			...gauge,
-			capacity: options.capacity,
-			predict: this.#predict,
-			replay: this.#replay
-		});
 		const conversations = createConversationManager();
 		this.#conversation = snapshot === void 0 ? conversations.add() : conversations.add({ snapshot: snapshot.conversation });
 		conversations.switch(this.#conversation.id);
@@ -11339,14 +11529,14 @@ var Ledger = class {
 			...options.agent?.strict === void 0 ? {} : { strict: options.agent.strict }
 		});
 		const tools = (0, _orkestrel_tool.createToolManager)();
-		for (const lookup of options.lookups ?? []) tools.add((0, _orkestrel_tool.createTool)({
-			name: lookup.tool.name,
-			...lookup.tool.parameters === void 0 ? {} : { parameters: lookup.tool.parameters },
-			...lookup.tool.description === void 0 ? {} : { description: lookup.tool.description },
-			...lookup.tool.summary === void 0 ? {} : { summary: lookup.tool.summary },
-			...lookup.tool.title === void 0 ? {} : { title: lookup.tool.title },
-			...lookup.tool.annotations === void 0 ? {} : { annotations: lookup.tool.annotations },
-			execute: (args, context) => this.#lookup(lookup.tool.name, args, context)
+		for (const { tool } of [...options.lookups ?? [], ...options.writes ?? []]) tools.add((0, _orkestrel_tool.createTool)({
+			name: tool.name,
+			...tool.parameters === void 0 ? {} : { parameters: tool.parameters },
+			...tool.description === void 0 ? {} : { description: tool.description },
+			...tool.summary === void 0 ? {} : { summary: tool.summary },
+			...tool.title === void 0 ? {} : { title: tool.title },
+			...tool.annotations === void 0 ? {} : { annotations: tool.annotations },
+			execute: (args, context) => this.#lookup(tool.name, args, context)
 		}));
 		tools.add((0, _orkestrel_tool.createTool)({
 			name: "recall",
@@ -11357,33 +11547,60 @@ var Ledger = class {
 			}) }),
 			execute: (args) => this.#recall(args)
 		}));
+		const advertised = new Authority({
+			rules: [{
+				match: (context) => names.includes(context.call.name),
+				zone: "ledger",
+				verdict: "allow"
+			}],
+			fallback: {
+				zone: "ledger",
+				verdict: "deny",
+				reason: "the ledger advertises no such tool"
+			}
+		});
 		this.#agent = createAgent(provider, {
 			...options.agent,
 			conversations,
 			system: options.system,
 			tools,
-			authority: createAuthority({
-				rules: [{
-					match: (context) => lookups.includes(context.call.name),
-					zone: "ledger",
-					verdict: "allow"
-				}],
-				fallback: {
+			authority: {
+				evaluate: (context) => this.#current()?.denied(context.call.name, context.call.arguments) === true ? {
 					zone: "ledger",
 					verdict: "deny",
-					reason: "the ledger advertises no such tool"
-				}
-			}),
+					reason: LEDGER_NOTES.repeat
+				} : host === void 0 || context.call.name === "recall" || !names.includes(context.call.name) ? advertised.evaluate(context) : host.evaluate(context),
+				ask: (context, decision, signal) => this.#current()?.denied(context.call.name, context.call.arguments) === true ? Promise.resolve(false) : host?.ask === void 0 ? advertised.ask(context, decision, signal) : host.ask(context, decision, signal)
+			},
 			limit: options.agent?.limit ?? 8,
 			select: (conversation, request, signal) => this.#select(conversation, request, signal)
 		});
-		this.#agent.emitter.on("tool", (_call, result) => {
+		const digest = digestLedgerTools(this.#agent.context.tools.definitions());
+		const gauge = options.gauge ?? (snapshot?.gauge?.digest === digest ? snapshot?.gauge : void 0);
+		if (gauge !== void 0) {
+			this.#gauge = new Gauge({
+				scale: gauge.scale,
+				overhead: gauge.overhead,
+				capacity: options.capacity,
+				predict: this.#predict,
+				replay: this.#replay
+			});
+			this.#digest = digest;
+		}
+		this.#agent.emitter.on("deny", (call, _reason, decision) => {
+			if (decision !== void 0 && call.name !== "recall" && names.includes(call.name)) this.#current()?.deny(call.name, call.arguments);
+		});
+		this.#agent.emitter.on("tool", (call, result) => {
 			this.#flush();
 			this.#pending.set(this.#conversation.messages().length, result);
-			if (!result.success && result.error === LEDGER_NOTES.repeat) {
+			const stopped = denyCall(call, LEDGER_NOTES.repeat);
+			if (!result.success && (result.error === LEDGER_NOTES.repeat || !stopped.success && result.error === stopped.error)) {
 				this.#current()?.close();
 				this.#agent.abort("repeat");
 			}
+			const request = this.#current();
+			if (request?.calls.at(-1)?.tools === 0) request.abort();
+			this.#release(call, result);
 		});
 		this.#agent.emitter.on("select", (selection) => {
 			if (isLedgerError(selection.fault) && selection.fault.code === "REQUEST") return;
@@ -11444,6 +11661,7 @@ var Ledger = class {
 		const conversation = this.#conversation.snapshot();
 		const ids = conversation.messages.map((message) => message.id);
 		const gauge = this.gauge;
+		const priced = this.#digest;
 		const window = {
 			exchanges: this.#window.map((entry) => ({
 				request: entry.request.id,
@@ -11464,7 +11682,10 @@ var Ledger = class {
 			requests: ids.filter((id) => this.#requests.has(id)),
 			notes: ids.filter((id) => this.#annotations.has(id)),
 			failures: ids.filter((id) => this.#results.get(id)?.success === false),
-			...gauge === void 0 ? {} : { gauge },
+			...gauge === void 0 || priced === void 0 ? {} : { gauge: {
+				...gauge,
+				digest: priced
+			} },
 			...window.exchanges.length === 0 || digest === void 0 ? {} : { window: {
 				...window,
 				digest
@@ -11473,6 +11694,7 @@ var Ledger = class {
 	}
 	/**
 	* Appends a request and serves it, recovering an unfinished or rejected first pass with one answer pass.
+	* In either pass, a call the model makes in a turn that advertises no tools runs nothing and ends the pass after that generation, whatever the agent's `limit`, and when every call of that turn failed, the ledger stores the reply without its calls: a reply with text ends the pass complete, and one without text ends it partial with empty content.
 	* A calibration call that reports no prompt usage, or a prompt usage of 0 or less, rejects with `LedgerError` code `'GAUGE'`; a provider error during calibration rejects with that error.
 	* When the answer pass rejects, `respond` rejects with that error, and under the default `strict` a judge failure or another selection failure rejects it too. A rejection belongs to its own call: the ledger stays free, and the next call asks the judge again about whatever is still unanswered.
 	* @param content - The request text
@@ -11492,14 +11714,14 @@ var Ledger = class {
 			if (this.#gauge === void 0) await this.#measureGauge(caller);
 			const entered = request.enter(this.#conversation);
 			this.#requests.add(entered.id);
-			const first = await this.#generatePass(request, caller, this.#options.think).catch((error) => {
+			const first = this.#dropStrayCalls(request, await this.#generatePass(request, caller, this.#options.think).catch((error) => {
 				if (request.faulted(error)) throw error;
 				return {
 					content: "",
 					partial: true,
 					...request.usage === void 0 ? {} : { usage: request.usage }
 				};
-			});
+			}));
 			const passes = [first];
 			if (!caller.aborted && (first.partial || first.content.trim() === "")) {
 				const recovery = this.#buildDigest(request, entered);
@@ -11527,7 +11749,7 @@ var Ledger = class {
 				});
 				this.#agent.context.apply(answer);
 				try {
-					passes.push(await this.#generatePass(request, caller, false));
+					passes.push(this.#dropStrayCalls(request, await this.#generatePass(request, caller, false)));
 				} finally {
 					if (this.#agent.context.scope === answer) this.#agent.context.apply(previous);
 				}
@@ -11564,7 +11786,8 @@ var Ledger = class {
 				}],
 				judgments: []
 			}), this.#replay).slice(0, -1);
-			const priced = await this.#provider.generate(messages, signal, this.#agent.context.tools.definitions(), { think: false });
+			const definitions = this.#agent.context.tools.definitions();
+			const priced = await this.#provider.generate(messages, signal, definitions, { think: false });
 			const bare = await this.#provider.generate(messages, signal, void 0, { think: false });
 			if (!(0, _orkestrel_contract.isFiniteNumber)(priced.usage?.prompt) || priced.usage.prompt <= 0 || !(0, _orkestrel_contract.isFiniteNumber)(bare.usage?.prompt) || bare.usage.prompt <= 0) throw new LedgerError("GAUGE", "calibration requires prompt usage from both calls");
 			this.#gauge = new Gauge({
@@ -11574,6 +11797,7 @@ var Ledger = class {
 				scale: bare.usage.prompt / estimateMessages(messages),
 				overhead: Math.max(0, priced.usage.prompt - bare.usage.prompt)
 			});
+			this.#digest = digestLedgerTools(definitions);
 			return {
 				scale: this.#gauge.scale,
 				overhead: this.#gauge.overhead
@@ -11585,12 +11809,35 @@ var Ledger = class {
 	}
 	async #generatePass(request, signal, think) {
 		request.open(this.#conversation.messages().length);
+		const stop = request.signal;
 		return await this.#agent.generate({
-			signal,
+			signal: stop === void 0 ? signal : AbortSignal.any([signal, stop]),
 			conversation: this.#conversation,
 			...think === void 0 ? {} : { think }
 		});
 	}
+	#dropStrayCalls(request, pass) {
+		const boundary = request.boundary;
+		if (!request.aborted || boundary === void 0) return pass;
+		this.#flush();
+		const messages = this.#conversation.messages().slice(boundary);
+		const at = messages.findLastIndex((message) => message.role === "assistant");
+		const reply = messages[at];
+		const replies = messages.slice(at + 1);
+		if (reply === void 0 || !hasCalls(reply) || !replies.every((message) => message.role === "tool" && this.#results.get(message.id)?.success === false)) return pass;
+		this.#conversation.remove([reply.id, ...replies.map((message) => message.id)]);
+		for (const message of replies) this.#results.delete(message.id);
+		this.#conversation.add({
+			role: "assistant",
+			content: reply.content,
+			...reply.thinking === void 0 ? {} : { thinking: reply.thinking }
+		});
+		return {
+			...pass,
+			content: reply.content,
+			partial: reply.content.trim() === ""
+		};
+	}
 	#current() {
 		const [request] = this.#live;
 		return request?.message === void 0 ? void 0 : request;
@@ -11680,27 +11927,36 @@ var Ledger = class {
 		return collectToolGroups(messages).flatMap((group) => group.slice(1).flatMap((message) => {
 			const call = findLedgerCall(group, message);
 			const lookup = this.#options.lookups?.find((one) => one.tool.name === call?.name);
-			if (call === void 0 || lookup === void 0 || this.#results.get(message.id)?.success === false) return [];
-			const read = (0, _orkestrel_contract.attempt)(() => lookup.read(call.arguments, message.content));
-			if (!read.success) {
+			const write = this.#options.writes?.find((one) => one.tool.name === call?.name);
+			if (call === void 0 || lookup === void 0 && write === void 0 || this.#results.get(message.id)?.success === false) return [];
+			const read = (0, _orkestrel_contract.attempt)(() => lookup?.read(call.arguments, message.content));
+			const written = (0, _orkestrel_contract.attempt)(() => write?.read(call.arguments, message.content));
+			if (!read.success || !written.success) {
+				const error = read.success ? written.success ? void 0 : written.error : read.error;
 				this.#results.set(message.id, {
 					success: false,
 					id: call.id,
 					name: call.name,
-					error: (0, _orkestrel_contract.isError)(read.error) ? read.error.message : String(read.error)
+					error: (0, _orkestrel_contract.isError)(error) ? error.message : String(error)
 				});
 				return [];
 			}
+			const literals = Object.values(call.arguments).filter(_orkestrel_contract.isString).flatMap((value) => [...extractLiterals(value).ids]);
 			const result = read.value;
+			const change = written.value;
 			return [{
 				id: message.id,
 				name: call.name,
 				arguments: call.arguments,
 				text: message.content,
-				result: result === void 0 ? void 0 : {
+				result: result !== void 0 ? {
 					...result,
-					ids: [.../* @__PURE__ */ new Set([...result.ids, ...Object.values(call.arguments).filter(_orkestrel_contract.isString).flatMap((value) => [...extractLiterals(value).ids])])]
-				}
+					ids: [.../* @__PURE__ */ new Set([...result.ids, ...literals])]
+				} : change !== void 0 ? {
+					ids: [.../* @__PURE__ */ new Set([...change.ids, ...literals])],
+					owners: change.owners
+				} : void 0,
+				...change === void 0 ? {} : { targets: [...change.targets] }
 			}];
 		}));
 	}
@@ -11712,7 +11968,7 @@ var Ledger = class {
 			messages: scan.messages,
 			findings: scan.findings,
 			entities: new Map(scan.messages.map((message) => [message.id, [...matchEntities(scan.index, message.content, true)]])),
-			classification: this.#classifier.classification()
+			classification: mergeSupersessions(this.#classifier.classification(), collectWriteSupersessions(scan.messages, scan.findings), scan.messages)
 		};
 		return {
 			input,
@@ -12063,7 +12319,7 @@ var Ledger = class {
 				kept: (leader.calls ?? []).flatMap((call) => {
 					const message = group.slice(1).find((result) => findLedgerCall(group, result) === call);
 					const result = message === void 0 ? void 0 : this.#results.get(message.id);
-					return message === void 0 || !this.#options.lookups?.some((lookup) => lookup.tool.name === call.name) || result?.success === false && result.error === LEDGER_NOTES.repeat ? [] : [{
+					return message === void 0 || ![...this.#options.lookups ?? [], ...this.#options.writes ?? []].some((entry) => entry.tool.name === call.name) || result?.success === false && result.error === LEDGER_NOTES.repeat ? [] : [{
 						call,
 						message
 					}];
@@ -12109,19 +12365,48 @@ var Ledger = class {
 	#renderTailStub(message, scan, shown) {
 		const group = scan.group(message.id);
 		const call = group === void 0 ? void 0 : findLedgerCall(group, message);
+		const write = this.#options.writes?.some((one) => one.tool.name === call?.name) === true;
 		const finding = scan.finding(message.id);
 		const hidden = renderStub(call?.name ?? "tool", call?.arguments ?? {}, "hidden");
 		const visible = renderStub(call?.name ?? "tool", call?.arguments ?? {}, "shown");
 		return {
 			...message,
-			content: renderStub(call?.name ?? "tool", call?.arguments ?? {}, this.#results.get(message.id)?.success === false ? "failed" : finding?.result === void 0 ? "empty" : shown === void 0 ? hidden.length > visible.length ? "hidden" : "shown" : scan.findings.some((other) => shown.has(other.id) && matchesLookup(finding, other)) ? "shown" : "hidden")
+			content: renderStub(call?.name ?? "tool", call?.arguments ?? {}, this.#results.get(message.id)?.success === false ? "failed" : finding?.result === void 0 ? "empty" : shown === void 0 ? hidden.length > visible.length ? "hidden" : "shown" : scan.findings.some((other) => shown.has(other.id) && matchesLookup(finding, other)) ? "shown" : "hidden", write)
 		};
 	}
+	#release(call, result) {
+		const request = this.#current();
+		const write = this.#options.writes?.find((one) => one.tool.name === call.name);
+		if (request === void 0 || write === void 0 || !result.success) return;
+		const text = settleToolResult(result).content;
+		const read = (0, _orkestrel_contract.attempt)(() => {
+			const change = write.read(call.arguments, text);
+			return change === void 0 ? [] : [...change.targets];
+		});
+		if (!read.success || read.value.length === 0) return;
+		const messages = this.#conversation.messages();
+		const findings = this.#readLookups(messages);
+		const id = crypto.randomUUID();
+		const edges = collectWriteSupersessions([...messages, {
+			id,
+			role: "tool",
+			content: text,
+			call: call.id
+		}], [...findings, {
+			id,
+			name: call.name,
+			arguments: call.arguments,
+			text,
+			result: void 0,
+			targets: read.value
+		}]);
+		for (const finding of findings) if ((edges.get(finding.id) ?? []).includes(id) && this.#options.lookups?.some((lookup) => lookup.tool.name === finding.name) === true) request.release(finding.name, finding.arguments);
+	}
 	#observeTurn() {
 		this.#flush();
 		const request = this.#current();
 		const boundary = request?.boundary;
-		if (request === void 0 || boundary === void 0) return;
+		if (request === void 0 || boundary === void 0 || request.aborted) return;
 		const additions = this.#conversation.messages().slice(boundary);
 		const messages = this.#agent.context.build(request.selection);
 		const names = this.#agent.context.scope?.tools;
@@ -12142,10 +12427,17 @@ var Ledger = class {
 		return this.#conversation.messages().filter((message) => message.role === "assistant").reduce((longest, message) => message.content.length > longest.length ? message.content : longest, "");
 	}
 	#lookup(name, args, context) {
-		this.#current()?.admit(name, args);
-		const lookup = this.#options.lookups?.find((one) => one.tool.name === name);
-		if (lookup === void 0) throw new Error(`unknown lookup ${name}`);
-		return lookup.tool.execute(args, context);
+		const request = this.#current();
+		request?.admit(name, args);
+		const entry = this.#options.lookups?.find((one) => one.tool.name === name) ?? this.#options.writes?.find((one) => one.tool.name === name);
+		if (entry === void 0) throw new Error(`unknown lookup or write ${name}`);
+		const ran = (0, _orkestrel_contract.attempt)(() => entry.tool.execute(args, context));
+		if (!ran.success) return this.#reject(request, name, args, ran.error);
+		return (0, _orkestrel_contract.isPromiseLike)(ran.value) ? Promise.resolve(ran.value).catch((error) => this.#reject(request, name, args, error)) : ran.value;
+	}
+	#reject(request, name, args, error) {
+		if ((0, _orkestrel_tool.isToolError)(error) && error.code === "ARGUMENTS") request?.release(name, args);
+		throw error;
 	}
 	#recall(args) {
 		const request = this.#current();
@@ -12183,7 +12475,8 @@ var Ledger = class {
 				};
 			});
 			const start = request?.message === void 0 ? -1 : scan.position(request.message.id) ?? -1;
-			const listable = new Map(input.messages.filter((message, at) => !this.#requests.has(message.id) && (at < start || message.role === "tool")).map((message) => [message.id, message]));
+			const retired = collectRetiredFindings(scan.messages, scan.findings);
+			const listable = new Map(input.messages.filter((message, at) => !this.#requests.has(message.id) && !retired.has(message.id) && (at < start || message.role === "tool")).map((message) => [message.id, message]));
 			const matched = new Set(searches.flatMap((search) => [...search.matched]));
 			const unmatched = searches.filter((search) => search.matched.size === 0 && search.words.length > 0);
 			const gathered = [...listable.values()].reverse().reduce((state, message) => {
@@ -12428,7 +12721,10 @@ exports.collectNames = collectNames;
 exports.collectProjectionIds = collectProjectionIds;
 exports.collectRecallMessages = collectRecallMessages;
 exports.collectRegistry = collectRegistry;
+exports.collectRetiredFindings = collectRetiredFindings;
 exports.collectToolGroups = collectToolGroups;
+exports.collectWriteSupersessions = collectWriteSupersessions;
+exports.computeLedgerChecksum = computeLedgerChecksum;
 exports.computeThinking = computeThinking;
 exports.conversationSnapshotContract = conversationSnapshotContract;
 exports.conversationSnapshotShape = conversationSnapshotShape;
@@ -12463,6 +12759,7 @@ exports.denyCall = denyCall;
 exports.describeQuestionRefusal = describeQuestionRefusal;
 exports.describeRelayRefusal = describeRelayRefusal;
 exports.describeSnapshotRefusal = describeSnapshotRefusal;
+exports.digestLedgerTools = digestLedgerTools;
 exports.digestLedgerWindow = digestLedgerWindow;
 exports.estimateMessages = estimateMessages;
 exports.estimateRequest = estimateRequest;
@@ -12540,6 +12837,7 @@ exports.memoContract = memoContract;
 exports.memoShape = memoShape;
 exports.memoSnapshotContract = memoSnapshotContract;
 exports.memoSnapshotShape = memoSnapshotShape;
+exports.mergeSupersessions = mergeSupersessions;
 exports.messageContract = messageContract;
 exports.messageInputContract = messageInputContract;
 exports.messageInputShape = messageInputShape;