@orkestrel/agent 0.0.41 → 0.0.43

package/dist/src/core/index.js

@@ -1,14 +1,14 @@
-import { ContractError, INTRINSICS, arrayOf, arrayShape, attempt, booleanShape, boundsOf, canonicalStringify, cloneJSONValue, createContract, describeFaults, errorToMessage, failure, holds, isArray, isBoolean, isError, isFiniteNumber, isFunction, isJSONValue, isNumber, isObject, isPromiseLike, isRecord, isString, jsonShape, literalShape, nullableOf, nullableShape, numberShape, objectOf, objectShape, optionalOf, optionalShape, parseJSON, parseJSONAs, parseJSONValue, preview, rawShape, recordOf, recordShape, schemaToShape, stringShape, success, unionOf, unionShape } from "@orkestrel/contract";
+import { ContractError, INTRINSICS, admitValue, arrayOf, arrayShape, attempt, booleanShape, boundsOf, canonicalStringify, cloneJSONValue, createContract, describeFaults, errorToMessage, failure, holds, integerShape, isArray, isBoolean, isError, isFiniteNumber, isFunction, isJSONValue, isNumber, isObject, isPromiseLike, isRecord, isString, jsonShape, literalOf, literalShape, matchesExactKeys, nullableOf, nullableShape, numberShape, objectOf, objectShape, optionalOf, optionalShape, parseJSON, parseJSONAs, parseJSONValue, preview, rawShape, recordOf, recordShape, refuseOptionKeys, schemaToParameters, schemaToShape, stringShape, success, unionOf, unionShape } from "@orkestrel/contract";
 import { createTokenBudget, createTokenMeter, isBudget, isBudgetAmount, isBudgetError, isTokenUsage } from "@orkestrel/budget";
-import { ToolManager, createTool, createToolManager, isToolCall, isToolError } from "@orkestrel/tool";
+import { ToolError, ToolManager, createTool, createToolManager, isToolCall, isToolError } from "@orkestrel/tool";
 import { createNDJSONParser } from "@orkestrel/ndjson";
-import { Timeout, createTimeout } from "@orkestrel/timeout";
+import { createAbort, linkSignal } from "@orkestrel/abort";
+import { MAX_TIMEOUT_MS, Timeout, createTimeout } from "@orkestrel/timeout";
 import { createDatabase, createMemoryDriver } from "@orkestrel/database";
 import { Emitter } from "@orkestrel/emitter";
 import { WorkspaceManager, createFile, isBinary, isTextContent } from "@orkestrel/workspace";
 import { createQueue } from "@orkestrel/queue";
 import { createRunner } from "@orkestrel/workflow";
-import { createAbort } from "@orkestrel/abort";
 // src/core/constants.ts
 /**
 * Lists the roles any message can play, the built `system` head included, in the order the wire
@@ -725,6 +725,23 @@ function collectToolGroups(messages) {
 	return [...groups, ...orphans];
 }
 /**
+* Finds the call that owns a tool message within a collected tool group.
+* @param group - The assistant leader followed by its tool results, as {@link collectToolGroups} returns it
+* @param message - The tool result to pair; distinct leader ids pair by result id when any result has one
+* @returns The call matching the result's call id, or its position when the leader repeats an id or every result lacks an id; undefined when unpaired
+* @example
+* ```ts
+* findToolCall(group, result)?.arguments
+* ```
+*/
+function findToolCall(group, message) {
+	const [leader, ...results] = group;
+	const at = results.findIndex((result) => result.id === message.id);
+	if (message.role !== "tool" || at < 0) return void 0;
+	const calls = leader?.calls ?? [];
+	return !(new Set(calls.map((call) => call.id)).size !== calls.length) && results.some((result) => result.call !== void 0) ? calls.find((call) => call.id === message.call) : calls[at];
+}
+/**
 * Renders a value as the JSON text `JSON.stringify` produces, or `undefined` when JSON cannot
 * carry the value.
 *
@@ -1022,6 +1039,60 @@ var REFUSED_RELAY_STATUS = 422;
 var REFUSED_RELAY_CONTENT_TYPE = "text/plain; charset=utf-8";
 /** Names the System One decision endpoint shared by compatible servers. */
 var SYSTEM_ONE_PATH = "/v1/systemone";
+/** Lists the members `RelayOptions` declares, frozen — the keys `createRelay` admits. */
+var RELAY_OPTION_KEYS = Object.freeze([
+	"provider",
+	"authorize",
+	"limit",
+	"system",
+	"tools"
+]);
+/** Lists the members `RelayProviderOptions` declares, frozen — the keys the `RelayProvider` constructor admits. */
+var RELAY_PROVIDER_KEYS = Object.freeze([
+	"url",
+	"parser",
+	"timeout",
+	"replay",
+	"fetch",
+	"headers"
+]);
+/** Lists the members `RelayStreamOptions` declares, frozen — the keys the `RelayStream` constructor admits. */
+var RELAY_STREAM_KEYS = Object.freeze([
+	"provider",
+	"request",
+	"signal"
+]);
+/** Lists the members `AgentProviderInput` declares, frozen — the keys the `AgentProvider` constructor admits. */
+var PROVIDER_INPUT_KEYS = Object.freeze([
+	"url",
+	"path",
+	"split",
+	"strict",
+	"timeout",
+	"replay",
+	"fetch",
+	"headers"
+]);
+/** Lists the members `AgentJudgeInput` declares, frozen — the keys the `AgentJudge` constructor admits. */
+var JUDGE_INPUT_KEYS = Object.freeze([
+	"url",
+	"path",
+	"model",
+	"batch",
+	"timeout",
+	"fetch",
+	"headers"
+]);
+/** Lists the members `SystemOneJudgeOptions` declares, frozen — the keys the `SystemOneJudge` constructor admits. */
+var SYSTEM_ONE_OPTION_KEYS = Object.freeze([
+	"url",
+	"model",
+	"timeout",
+	"fetch",
+	"headers"
+]);
+/** Lists the members `ProviderStreamOptions` declares, frozen — the keys the `generate` and `stream` methods of an `AgentProvider` admits. */
+var STREAM_OPTION_KEYS = Object.freeze(["think", "schema"]);
 // src/core/providers/errors.ts
 /**
 * Reports a provider stream cancelled mid-flight by its bound signal — thrown by the
@@ -2038,6 +2109,7 @@ var RelayStream = class {
 	#response;
 	#settled = false;
 	constructor(options) {
+		refuseOptionKeys(options, RELAY_STREAM_KEYS, "RelayStream", "RelayStreamOptions");
 		this.#replay = options.provider.replay ?? "none";
 		this.#signal = options.signal;
 		this.#listener = this.#abort.bind(this);
@@ -2304,6 +2376,7 @@ var AgentProvider = class {
 	#split;
 	#strict;
 	constructor(input) {
+		refuseOptionKeys(input, PROVIDER_INPUT_KEYS, "AgentProvider", "AgentProviderInput");
 		this.#id = crypto.randomUUID();
 		this.#replay = input.replay ?? "none";
 		this.#url = input.url;
@@ -2351,10 +2424,11 @@ var AgentProvider = class {
 	* is malformed or carries an upstream failure, or a strict stream ends without a settled result
 	*/
 	async *stream(messages, signal, tools, options) {
+		refuseOptionKeys(options, STREAM_OPTION_KEYS, "AgentProvider", "ProviderStreamOptions");
 		if (signal.aborted) throw new ProviderAbortError({ content: "" });
 		const timeout = new Timeout({ ms: this.#timeout });
 		timeout.start();
-		const combined = AbortSignal.any([timeout.signal, signal]);
+		const combined = linkSignal(timeout.signal, signal);
 		try {
 			const parser = this.#frame(combined);
 			try {
@@ -2506,6 +2580,7 @@ var AgentProvider = class {
 var RelayProvider = class extends AgentProvider {
 	#parser;
 	constructor(options) {
+		refuseOptionKeys(options, RELAY_PROVIDER_KEYS, "RelayProvider", "RelayProviderOptions");
 		const { url, timeout, fetch, headers, replay } = options;
 		super({
 			url,
@@ -2638,6 +2713,7 @@ var AgentJudge = class {
 	#headers;
 	#batch;
 	constructor(input) {
+		refuseOptionKeys(input, JUDGE_INPUT_KEYS, "AgentJudge", "AgentJudgeInput");
 		this.#id = crypto.randomUUID();
 		this.#url = input.url;
 		this.#path = input.path ?? "";
@@ -2702,7 +2778,7 @@ var AgentJudge = class {
 	async #call(request, body, signal, completed) {
 		const timeout = new Timeout({ ms: this.#timeout });
 		timeout.start();
-		const combined = AbortSignal.any([timeout.signal, signal]);
+		const combined = linkSignal(timeout.signal, signal);
 		try {
 			const headers = await buildProviderHeaders(this.#headers, combined);
 			combined.throwIfAborted();
@@ -2803,6 +2879,7 @@ var AgentJudge = class {
 */
 var SystemOneJudge = class extends AgentJudge {
 	constructor(options) {
+		refuseOptionKeys(options, SYSTEM_ONE_OPTION_KEYS, "SystemOneJudge", "SystemOneJudgeOptions");
 		super({
 			...options,
 			path: SYSTEM_ONE_PATH,
@@ -2902,6 +2979,7 @@ var SystemOneJudge = class extends AgentJudge {
 * ```
 */
 function createRelay(options) {
+	refuseOptionKeys(options, RELAY_OPTION_KEYS, "createRelay", "RelayOptions");
 	const { provider, authorize, limit } = options;
 	const system = { ...options.system };
 	const { definitions, accept } = options.tools ?? {};
@@ -3056,6 +3134,43 @@ var DEFAULT_CONVERSATION_KEEP = 0;
 * because it interpolates the per-call provenance `label`).
 */
 var CONVERSATION_RECAP_PREFIX = "[Summary of earlier messages] ";
+/** Lists the members `ConversationOptions` declares, frozen — the keys the `Conversation` constructor admits. */
+var CONVERSATION_OPTION_KEYS = Object.freeze([
+	"id",
+	"on",
+	"error",
+	"summarize",
+	"keep",
+	"sections",
+	"cumulative",
+	"snapshot"
+]);
+/** Lists the members `ConversationManagerOptions` declares, frozen — the keys the `ConversationManager` constructor admits. */
+var CONVERSATION_MANAGER_KEYS = Object.freeze([
+	"summarize",
+	"keep",
+	"sections",
+	"store"
+]);
+/** Lists the members `ConversationInput` declares, frozen — the keys the `add` method of a `ConversationManager` admits. */
+var CONVERSATION_INPUT_KEYS = Object.freeze([
+	"id",
+	"summarize",
+	"keep",
+	"sections",
+	"cumulative",
+	"on",
+	"error",
+	"snapshot"
+]);
+/** Lists the members `CompactOptions` declares, frozen — the keys the `compact` method of a `Conversation` admits. */
+var COMPACT_OPTION_KEYS = Object.freeze([
+	"keep",
+	"sections",
+	"signal"
+]);
+/** Lists the members `ConversationReferenceOptions` declares, frozen — the keys the `reference` method of a `Conversation` admits. */
+var REFERENCE_OPTION_KEYS = Object.freeze(["label", "messages"]);
 // src/core/conversations/errors.ts
 /**
 * Reports a conversation with no {@link ConversationSummaryHandler} to fold its messages with, a
@@ -3081,7 +3196,8 @@ var CONVERSATION_RECAP_PREFIX = "[Summary of earlier messages] ";
 * `'SUMMARY'`. A stored message plays a `ConversationRole`: `add` refuses any other role with
 * `'ROLE'` before it stores any message of the batch, a hydrating snapshot that holds one throws
 * `'ROLE'`, and an agent's selection that holds one becomes a `'ROLE'` fault. `add` refuses an input
-* whose other members fail `isMessageInput` with `'MESSAGE'`, its `context` holding the `faults`,
+* that is not a plain record, before its role is read, or whose other members fail `isMessageInput`
+* with `'MESSAGE'`, its `context` holding the `faults`,
 * before it stores any message of the batch. A hydrating snapshot that fails
 * `isConversationSnapshot` or repeats an id, and a store row or written snapshot that does, throw
 * `'SNAPSHOT'`; a judgment the guard admits but JSON cannot carry still throws `'JUDGMENT'`. A
@@ -3089,7 +3205,7 @@ var CONVERSATION_RECAP_PREFIX = "[Summary of earlier messages] ";
 * {@link isConversationError} and branch on `error.code`.
 */
 var ConversationError = class extends Error {
-	/** Names the machine-readable condition — `'SUMMARIZER'`: a `compact()` with no summarizer; `'SECTIONS'`: a `sections` cap that is not a positive safe integer, or a cap combined with `cumulative`; `'JUDGMENT'`: a judgment or judge request that is not JSON; `'KEEP'`: a `keep` that is not a nonnegative safe integer; `'SUMMARY'`: a summarizer digest whose trimmed text is empty; `'ROLE'`: a stored or selected message whose role is not a `ConversationRole`; `'MESSAGE'`: a message input whose other members fail `isMessageInput`; `'SNAPSHOT'`: a snapshot that fails `isConversationSnapshot` or repeats an id; `'ID'`: a manager's `add` of an id it already holds. */
+	/** Names the machine-readable condition — `'SUMMARIZER'`: a `compact()` with no summarizer; `'SECTIONS'`: a `sections` cap that is not a positive safe integer, or a cap combined with `cumulative`; `'JUDGMENT'`: a judgment or judge request that is not JSON; `'KEEP'`: a `keep` that is not a nonnegative safe integer; `'SUMMARY'`: a summarizer digest whose trimmed text is empty; `'ROLE'`: a stored or selected message whose role is not a `ConversationRole`; `'MESSAGE'`: a message input that is not a plain record or whose other members fail `isMessageInput`; `'SNAPSHOT'`: a snapshot that fails `isConversationSnapshot` or repeats an id; `'ID'`: a manager's `add` of an id it already holds. */
 	code;
 	/** Holds the values that locate the failure, such as the `question` id of a malformed question, or `undefined` when none were supplied. */
 	context;
@@ -3224,13 +3340,17 @@ function isMessage(value) {
 	return checked.success && checked.value;
 }
 /**
-* Checks whether a value is a message input a conversation can store: a string `content`, and `calls`,
-* `call`, `images`, and `thinking` absent or of their declared types.
+* Checks whether a value is a message input a conversation can store: a `ConversationRole`, a string
+* `content`, and `calls`, `call`, `images`, and `thinking` absent or of their declared types.
 *
 * @remarks
-* A hand guard, because `add` checks every message: it reads the members once and composes no record
-* guard. The role is `requireRole`'s to refuse, so its text can name the role received. Unknown members
-* are left behind by the store. An unreadable member returns false.
+* An exact record, because a stored message is one: a value that is not a plain record, such as a
+* class instance or an object that inherits its `role`, returns false through `recordOf`'s own plain
+* record check, as does a member `MessageInput` does not declare or a declared optional member holding
+* `undefined`. Each tool call crosses `isToolCall` of
+* `@orkestrel/tool`, whose interface admits more members, so the store keeps `id`, `name`, and
+* `arguments` and leaves the rest. `add` reads the role through `requireRole` first, so its text can
+* name the role received. An unreadable member returns false.
 *
 * @param value - The unknown input candidate
 * @returns True if the input's members are valid; false otherwise
@@ -3240,14 +3360,19 @@ function isMessage(value) {
 * isMessageInput({ role: 'user' }) // false
 * ```
 */
-function isMessageInput(value) {
-	const checked = attempt(() => {
-		if (!isRecord(value)) return false;
-		const { content, calls, call, images, thinking } = value;
-		return isString(content) && (calls === void 0 || arrayOf(isToolCall)(calls)) && (call === void 0 || isString(call)) && (images === void 0 || arrayOf(isString)(images)) && (thinking === void 0 || isString(thinking));
-	});
-	return checked.success && checked.value;
-}
+var isMessageInput = recordOf({
+	role: literalOf(CONVERSATION_ROLES),
+	content: isString,
+	calls: arrayOf(isToolCall),
+	call: isString,
+	images: arrayOf(isString),
+	thinking: isString
+}, [
+	"calls",
+	"call",
+	"images",
+	"thinking"
+]);
 /**
 * Checks whether a stored judgment carries a valid question and exactly one answer or refusal.
 *
@@ -3559,14 +3684,17 @@ function requireRole(role) {
 * Returns a message input after checking its role and its members, or throws a coded error.
 *
 * @remarks
-* The role goes first, through {@link requireRole}, so its refusal names what it received. The members
-* cross {@link isMessageInput}, and `audit` runs only after it refused, so a stored message costs one
-* guard read. Tool-call arguments must also be JSON values before a message is stored.
+* A value that is not a plain record, such as a class instance or an object that inherits its
+* `role`, refuses first, through `isRecord` of `@orkestrel/contract`, with a text saying so. The role
+* goes next, through {@link requireRole}, so its refusal names what it received. The members
+* cross {@link isMessageInput}, an exact record guard, so a member `MessageInput` does not declare or a
+* declared member holding `undefined` refuses, and `audit` runs only after a refusal. Tool-call
+* arguments must also be JSON values before a message is stored.
 *
 * @param input - The message input to check
 * @param contract - The message input contract, whose `audit` is read only on a refusal
 * @returns The input, narrowed
-* @throws ConversationError Thrown when the role is not a `ConversationRole` (code `'ROLE'`) or a member fails `isMessageInput` (code `'MESSAGE'`), with the faults under `context.faults`
+* @throws ConversationError Thrown when the input is not a plain record (code `'MESSAGE'`), when the role is not a `ConversationRole` (code `'ROLE'`), or when a member fails `isMessageInput`, an undeclared member included (code `'MESSAGE'`), with the faults under `context.faults`
 *
 * @example
 * ```ts
@@ -3575,10 +3703,11 @@ function requireRole(role) {
 * ```
 */
 function requireMessageInput(input, contract) {
-	requireRole(isRecord(input) ? input.role : void 0);
+	if (!isRecord(input)) throw new ConversationError("MESSAGE", "a message input must be a plain record, an object literal or parsed JSON holding its role and content as its own members, not a class instance or an object that inherits them", { context: { faults: contract.audit(input) } });
+	requireRole(input.role);
 	if (isMessageInput(input) && (input.calls === void 0 || input.calls.every((call) => isJSONValue(call.arguments)))) return input;
 	const faults = contract.audit(input);
-	throw new ConversationError("MESSAGE", `a message input must carry string content, and calls, call, images, and thinking of their declared types\n${describeFaults(faults, contract.schema)}`, { context: { faults } });
+	throw new ConversationError("MESSAGE", `a message input must carry string content, calls, call, images, and thinking of their declared types, and no other member\n${describeFaults(faults, contract.schema)}`, { context: { faults } });
 }
 /**
 * Returns a conversation snapshot after checking its shape, its stored roles, and its ids, or
@@ -3956,6 +4085,7 @@ var Conversation = class {
 	#judgments;
 	#pending = /* @__PURE__ */ new Set();
 	constructor(options) {
+		refuseOptionKeys(options, CONVERSATION_OPTION_KEYS, "Conversation", "ConversationOptions");
 		const supplied = options?.snapshot;
 		const snapshot = supplied === void 0 ? void 0 : requireConversationSnapshot(supplied, conversationSnapshotContract);
 		this.#judgments = new JudgmentManager(snapshot?.judgments);
@@ -4011,6 +4141,7 @@ var Conversation = class {
 		return [...this.#sections.map((section) => buildRecapMessage(section)), ...this.#messages.values()];
 	}
 	async compact(options) {
+		refuseOptionKeys(options, COMPACT_OPTION_KEYS, "Conversation", "CompactOptions");
 		const summarize = this.#summarize;
 		if (summarize === void 0) throw new ConversationError("SUMMARIZER", "cannot compact a conversation without a summarizer");
 		const cap = requireSectionsCap(options?.sections ?? this.#cap);
@@ -4035,6 +4166,7 @@ var Conversation = class {
 		return [...this.#sections.flatMap((section) => section.messages), ...this.#messages.values()].filter((message) => message.content.toLowerCase().includes(needle));
 	}
 	reference(options) {
+		refuseOptionKeys(options, REFERENCE_OPTION_KEYS, "Conversation", "ConversationReferenceOptions");
 		const label = options?.label ?? this.#id;
 		const messages = options?.messages ?? [];
 		return [`[Reference — conversation "${label}" — NOT part of this conversation]`, ...messages.length > 0 ? ["Relevant messages:", ...Array.from(messages, (message) => `- ${message.role}: ${message.content}`)] : []].join("\n");
@@ -4161,6 +4293,7 @@ var ConversationManager = class {
 	#sections;
 	#store;
 	constructor(options) {
+		refuseOptionKeys(options, CONVERSATION_MANAGER_KEYS, "ConversationManager", "ConversationManagerOptions");
 		this.#summarize = options?.summarize;
 		this.#keep = requireKeep(options?.keep ?? 0);
 		this.#sections = options?.sections;
@@ -4179,6 +4312,7 @@ var ConversationManager = class {
 		return [...this.#conversations.values()];
 	}
 	add(input) {
+		refuseOptionKeys(input, CONVERSATION_INPUT_KEYS, "ConversationManager", "ConversationInput");
 		const held = input?.id ?? input?.snapshot?.id;
 		if (held !== void 0 && this.#conversations.has(held)) throw new ConversationError("ID", `conversation ${preview(held)} is already live; pick another id, or remove it first`, { context: { conversation: held } });
 		const sections = input?.sections ?? this.#sections;
@@ -4642,6 +4776,16 @@ function createDatabaseConversationStore(driver = createMemoryDriver()) {
 */
 var WORKSPACE_SECTION_HEADER = "## Workspace";
 /**
+* Names the section header the loaded skills' bodies render under at the end of the system
+* message — `'## Loaded skills'`.
+*/
+var LOADED_SECTION_HEADER = "## Loaded skills";
+/**
+* Names the section header the admitted workspace ids render under in the user context message —
+* `'## Workspaces'`, rendered only while a run can select a workspace.
+*/
+var WORKSPACE_INDEX_HEADER = "## Workspaces";
+/**
 * Names the built-in section header a {@link import('./types.js').MemoManagerInterface} renders
 * its index under — `'## Memos'`, the `open` value when no `format.open` overrides it.
 *
@@ -4659,6 +4803,80 @@ var MEMO_SECTION_HEADER = "## Memos";
 * {@link import('./helpers.js').renderIndexEntry}.
 */
 var SKILL_SECTION_HEADER = "## Skills";
+/**
+* Lists the members `ScopeInput` declares, frozen — the keys a `Scope` is built from.
+*
+* @remarks
+* The `Scope` constructor passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an
+* own enumerable member outside it, a misspelled list included, refuses with a `ContractError`
+* coded `'structure'` instead of building a scope with no constraint.
+*/
+var SCOPE_KEYS = Object.freeze([
+	"name",
+	"select",
+	"instructions",
+	"skills",
+	"memos",
+	"tools",
+	"files",
+	"workspaces"
+]);
+/**
+* Lists the members `ScopeFilter` declares, frozen — the keys the `narrow` method of a scope admits.
+*
+* @remarks
+* The `narrow` method passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an own
+* enumerable member outside it refuses with a `ContractError` coded `'structure'`.
+*/
+var SCOPE_FILTER_KEYS = Object.freeze([
+	"instructions",
+	"skills",
+	"memos",
+	"tools",
+	"files",
+	"workspaces"
+]);
+/** Lists the members `AgentContextOptions` declares, frozen — the keys the `AgentContext` constructor admits. */
+var CONTEXT_OPTION_KEYS = Object.freeze([
+	"system",
+	"tools",
+	"instructions",
+	"skills",
+	"memos",
+	"workspaces",
+	"scope",
+	"conversations",
+	"select"
+]);
+/** Lists the members `ContextBuildOptions` declares, frozen — the keys the `build` method of an `AgentContext` admits. */
+var BUILD_OPTION_KEYS = Object.freeze([
+	"selection",
+	"scope",
+	"disclosure",
+	"switchable"
+]);
+/** Lists the members `InstructionManagerOptions` declares, frozen — the keys the `InstructionManager` constructor admits. */
+var INSTRUCTION_MANAGER_KEYS = Object.freeze([
+	"on",
+	"error",
+	"format"
+]);
+/** Lists the members `MemoManagerOptions` declares, frozen — the keys the `MemoManager` constructor admits. */
+var MEMO_MANAGER_KEYS = Object.freeze([
+	"id",
+	"on",
+	"error",
+	"format",
+	"snapshot"
+]);
+/** Lists the members `ScopeManagerOptions` declares, frozen — the keys the `ScopeManager` constructor admits. */
+var SCOPE_MANAGER_KEYS = Object.freeze(["on", "error"]);
+/** Lists the members `SkillManagerOptions` declares, frozen — the keys the `SkillManager` constructor admits. */
+var SKILL_MANAGER_KEYS = Object.freeze([
+	"on",
+	"error",
+	"format"
+]);
 // src/core/contexts/errors.ts
 /**
 * Reports a context snapshot that `isMemoSnapshot` refuses, thrown by the construction of a
@@ -4720,132 +4938,84 @@ function isContextError(value) {
 		return context === void 0 || isObject(context) || isFunction(context);
 	});
 }
-// src/core/contexts/instructions/Instruction.ts
+// src/core/contexts/shapers.ts
+/** Describes a stored memo revision exactly. */
+var memoShape = objectShape({
+	id: stringShape(),
+	name: stringShape(),
+	description: stringShape(),
+	content: stringShape(),
+	time: numberShape(),
+	origin: optionalShape(objectShape({
+		conversation: stringShape(),
+		message: optionalShape(stringShape())
+	}))
+});
 /**
-* Represents an immutable named directive — an {@link InstructionInterface} assembled once from
-* its input (`name` / `content` and an optional `priority`), the `id` minted at
-* construction. Default: `0` for `priority`.
+* Describes a stored memo set exactly: an unknown key refuses.
 *
 * @remarks
-* A thin immutable value object (mirroring {@link import('@orkestrel/tool').Tool}): the
-* constructor mints a fresh `id` (`crypto.randomUUID()`), copies the input's `name` /
-* `content`, resolves `priority` to the input's value or `0`, and carries the input's
-* per-item `override` value when supplied; otherwise that property is `undefined`.
-* Never mutated after construction. An
-* {@link import('./InstructionManager.js').InstructionManager} keys it by `name` and
-* renders it (highest `priority` first) under its section header.
+* `isMemoSnapshot` is the door a hydrate and a store read, and this shape fills a refusal's faults. A
+* lockstep test holds that `is` implies the guard, and on the snapshot fixtures the converse.
+*/
+var memoSnapshotShape = objectShape({
+	id: stringShape(),
+	memos: arrayShape(memoShape)
+});
+/**
+* Describes a memo input exactly: the members of a stored revision less the `id` and `time` the
+* manager mints, each taken from {@link memoShape}.
 *
-* @example
-* ```ts
-* const instruction = new Instruction({ name: 'tone', content: 'Be concise.', priority: 5 })
-* instruction.priority // 5
-* ```
+* @remarks
+* An unknown member, a missing required member, and a declared member holding `undefined` refuse, so
+* a revision `add` stores is one its own snapshot hydrates.
 */
-var Instruction = class {
-	id;
-	name;
-	content;
-	priority;
-	override;
-	constructor(input) {
-		this.id = crypto.randomUUID();
-		this.name = input.name;
-		this.content = input.content;
-		this.priority = input.priority ?? 0;
-		if (input.override !== void 0) this.override = input.override;
-	}
-};
-// src/core/contexts/instructions/InstructionManager.ts
+var memoInputShape = objectShape({
+	name: memoShape.properties.name,
+	description: memoShape.properties.description,
+	content: memoShape.properties.content,
+	origin: memoShape.properties.origin
+});
 /**
-* Registers the immutable {@link Instruction} instances a richer context assembles a directives block
-* from — keyed by `name` so adding an instruction whose name is already stored overwrites it,
-* last write wins, and listed by descending `priority`, carrying the `open` / `render` / `close` build contract and an observable `emitter`.
+* Describes an instruction input exactly: a string `name` and `content`, and an optional finite
+* `priority` and string `override`.
 *
 * @remarks
-* - **Registry.** Instructions live in an insertion-ordered `Map` keyed by `name`;
-*   `add` takes one {@link InstructionInput} or a batch, mints each instruction's
-*   `id`, and adding an instruction whose name is already stored overwrites it (last write wins).
-*   `count` is the map size, `instruction(name)` looks one up, and `instructions()` lists them sorted by
-*   descending `priority` (a stable sort, so equal priorities keep insertion order).
-* - **Build contract (the whole format cascade).** `open` is the section header a context
-*   renders the instructions under, `render(instruction)` renders one instruction, and
-*   `close` is the line after them. Each resolves the cascade most-specific-first: `render`
-*   returns the instruction's {@link InstructionInput.override}, else the
-*   `InstructionManagerOptions.format` `render`, else its `content`; `open` returns the
-*   options `open`, else the built-in header; `close` returns the options `close`, else
-*   `undefined`. A context reads the three and frames the section from them (see
-*   {@link import('../AgentContext.js').AgentContext}).
-* - **Removal.** `remove` drops one by name, or a batch — `true` only when every supplied
-*   name was removed; `clear` empties the registry.
-* - **Observable.** The owned {@link emitter} ({@link InstructionManagerEventMap})
-*   carries `add` (the created instruction) / `remove` (the name) / `clear` for
-*   fire-and-forget observers. Every event is emitted directly, strictly after the map
-*   mutation completes; the emitter isolates a listener throw and routes it to its `error`
-*   handler (the `error` option), so a buggy observer can never corrupt a mutation.
+* An unknown member, a missing required member, and a declared member holding `undefined` refuse.
+*/
+var instructionInputShape = objectShape({
+	name: stringShape(),
+	content: stringShape(),
+	priority: optionalShape(numberShape()),
+	override: optionalShape(stringShape())
+});
+/**
+* Describes a skill input exactly: a string `name`, `description`, and `content`, optional `tools`
+* names, and optional `files`.
 *
-* @example
-* ```ts
-* const manager = new InstructionManager()
-* manager.add([
-* 	{ name: 'tone', content: 'Be concise.', priority: 1 },
-* 	{ name: 'safety', content: 'Refuse unsafe requests.', priority: 10 },
-* ])
-* manager.instructions().map((one) => one.name) // ['safety', 'tone'] — highest priority first
-* ```
+* @remarks
+* An unknown member, a missing required member, and a declared member holding `undefined` refuse.
+* Each file is the `FileInput` interface of `@orkestrel/workspace`, which publishes no guard for it,
+* so the shape admits any defined element and `createFile`, that package's own door, reads it.
 */
-var InstructionManager = class {
-	#instructions = /* @__PURE__ */ new Map();
-	#emitter;
-	#format;
-	constructor(options) {
-		this.#emitter = new Emitter(options);
-		this.#format = options?.format;
-	}
-	get emitter() {
-		return this.#emitter;
-	}
-	get count() {
-		return this.#instructions.size;
-	}
-	get open() {
-		return this.#format?.open ?? "## Instructions";
-	}
-	get close() {
-		return this.#format?.close;
-	}
-	add(input) {
-		if (isArray(input)) return input.map((one) => this.#create(one));
-		return this.#create(input);
-	}
-	instruction(name) {
-		return this.#instructions.get(name);
-	}
-	instructions() {
-		return [...this.#instructions.values()].sort((a, b) => b.priority - a.priority);
-	}
-	render(instruction) {
-		return instruction.override ?? this.#format?.render?.(instruction) ?? instruction.content;
-	}
-	remove(names) {
-		if (isArray(names)) return removeEntries(names, (name) => this.#delete(name));
-		return this.#delete(names);
-	}
-	clear() {
-		this.#instructions.clear();
-		this.#emitter.emit("clear");
-	}
-	#create(input) {
-		const instruction = new Instruction(input);
-		this.#instructions.set(instruction.name, instruction);
-		this.#emitter.emit("add", instruction);
-		return instruction;
-	}
-	#delete(name) {
-		const removed = this.#instructions.delete(name);
-		if (removed) this.#emitter.emit("remove", name);
-		return removed;
-	}
-};
+var skillInputShape = objectShape({
+	name: stringShape(),
+	description: stringShape(),
+	content: stringShape(),
+	tools: optionalShape(arrayShape(stringShape())),
+	files: optionalShape(arrayShape(rawShape({})))
+});
+// src/core/contexts/contracts.ts
+/** Reads the faults of a refused memo revision. */
+var memoContract = createContract(memoShape);
+/** Reads the faults of a refused memo snapshot. */
+var memoSnapshotContract = createContract(memoSnapshotShape);
+/** Admits a memo input exactly, and reads the faults of a refused one. */
+var memoInputContract = createContract(memoInputShape);
+/** Admits an instruction input exactly, and reads the faults of a refused one. */
+var instructionInputContract = createContract(instructionInputShape);
+/** Admits a skill input exactly, and reads the faults of a refused one. */
+var skillInputContract = createContract(skillInputShape);
 // src/core/contexts/helpers.ts
 /**
 * Renders a path-addressed text body as a fenced reference block — a `File: <path>` label line
@@ -5019,6 +5189,70 @@ function intersectKeys(parent, child) {
 	return child.filter((key) => allowed.has(key));
 }
 /**
+* Intersects two scope filters list by list; an absent side constrains nothing.
+*
+* @remarks
+* Pure, and it can only tighten. Each list of the result is {@link intersectKeys} over the two
+* sides' lists, each read one time, in the order `instructions`, `skills`, `memos`, `tools`,
+* `files`, and `workspaces`. A list neither side constrains is omitted, and every returned list is
+* a fresh copy.
+* `Scope.narrow`, a run's build, and a ledger's answer-pass scope compose their layers through it.
+*
+* @param parent - The outer filter, such as the context scope (`undefined` ⇒ no constraint)
+* @param child - The inner filter, such as a run scope (`undefined` ⇒ no constraint)
+* @returns The intersected filter
+*
+* @example
+* ```ts
+* import { intersectFilters } from '@orkestrel/agent'
+*
+* intersectFilters({ tools: ['read', 'write'] }, { tools: ['write', 'admin'], files: [] })
+* // { tools: ['write'], files: [] }
+* ```
+*/
+function intersectFilters(parent, child) {
+	const instructions = intersectKeys(parent?.instructions, child?.instructions);
+	const skills = intersectKeys(parent?.skills, child?.skills);
+	const memos = intersectKeys(parent?.memos, child?.memos);
+	const tools = intersectKeys(parent?.tools, child?.tools);
+	const files = intersectKeys(parent?.files, child?.files);
+	const workspaces = intersectKeys(parent?.workspaces, child?.workspaces);
+	return {
+		...instructions === void 0 ? {} : { instructions },
+		...skills === void 0 ? {} : { skills },
+		...memos === void 0 ? {} : { memos },
+		...tools === void 0 ? {} : { tools },
+		...files === void 0 ? {} : { files },
+		...workspaces === void 0 ? {} : { workspaces }
+	};
+}
+/**
+* Resolves the workspace a run renders and acts on: the one `selected` names, else the registry's
+* active one, kept only while `allowed` admits its id.
+*
+* @remarks
+* A selection the registry does not hold resolves to `undefined` and never falls back to the active
+* workspace. `allowed` is three-way, as {@link import('../helpers.js').filterAllowList} reads it.
+* `AgentContext.build`, the caller an agent run hands each tool call, and a ledger's calibration
+* resolve through it, so what a request renders and what a call receives come from one rule.
+*
+* @param workspaces - The workspace registry to read
+* @param selected - The id a `switch` call or the `workspace` option selected, or `undefined`
+* @param allowed - The ceiling's `workspaces` list (`undefined` ⇒ every id, `[]` ⇒ none)
+* @returns The workspace, or `undefined` when none resolves
+*
+* @example
+* ```ts
+* import { resolveWorkspace } from '@orkestrel/agent'
+*
+* resolveWorkspace(agent.context.workspaces, 'returns', ['returns']) // the registered returns workspace
+* ```
+*/
+function resolveWorkspace(workspaces, selected, allowed) {
+	const workspace = selected === void 0 ? workspaces.active : workspaces.workspace(selected);
+	return workspace !== void 0 && filterAllowList(allowed, [workspace.id], (id) => id).length > 0 ? workspace : void 0;
+}
+/**
 * Renders one index line for a memo or a skill — `- name: description`, the built-in `render` of
 * the memo and skill managers.
 *
@@ -5038,37 +5272,219 @@ function intersectKeys(parent, child) {
 * ```
 */
 function renderIndexEntry(entry) {
-	return `- ${entry.name}: ${entry.description}`.replace(/[\n\v\f\r\u0085\u2028\u2029]+/g, " ");
+	return renderIndexLine(`${entry.name}: ${entry.description}`);
 }
-// src/core/contexts/shapers.ts
-/** Describes a stored memo revision exactly. */
-var memoShape = objectShape({
-	id: stringShape(),
-	name: stringShape(),
-	description: stringShape(),
-	content: stringShape(),
-	time: numberShape(),
-	origin: optionalShape(objectShape({
-		conversation: stringShape(),
-		message: optionalShape(stringShape())
-	}))
-});
 /**
-* Describes a stored memo set exactly: an unknown key refuses.
+* Renders one index line from its text as `- text`, with each run of line-break code points as one
+* space.
 *
 * @remarks
-* `isMemoSnapshot` is the door a hydrate and a store read, and this shape fills a refusal's faults. A
-* lockstep test holds that `is` implies the guard, and on the snapshot fixtures the converse.
+* Pure and total. The memo and skill index lines and the workspace index lines render through it,
+* so text in an index never opens another line or heading.
+*
+* @param text - The line's text
+* @returns The index line
+*
+* @example
+* ```ts
+* import { renderIndexLine } from '@orkestrel/agent'
+*
+* renderIndexLine('orders') // '- orders'
+* ```
 */
-var memoSnapshotShape = objectShape({
-	id: stringShape(),
-	memos: arrayShape(memoShape)
-});
-// src/core/contexts/contracts.ts
-/** Reads the faults of a refused memo revision. */
-var memoContract = createContract(memoShape);
-/** Reads the faults of a refused memo snapshot. */
-var memoSnapshotContract = createContract(memoSnapshotShape);
+function renderIndexLine(text) {
+	return `- ${text}`.replace(/[\n\v\f\r\u0085\u2028\u2029]+/g, " ");
+}
+/**
+* Renders one loaded skill's body: `### name`, a blank line, then its content.
+*
+* @remarks
+* Pure and total. The context build renders each shown skill through it under the loaded skills
+* header, last in the system message.
+*
+* @param skill - The skill whose name and content the body shows
+* @returns The body
+*
+* @example
+* ```ts
+* import { renderSkillBody } from '@orkestrel/agent'
+*
+* renderSkillBody({ name: 'refunds', content: 'Check the order first.' })
+* // '### refunds\n\nCheck the order first.'
+* ```
+*/
+function renderSkillBody(skill) {
+	return `### ${skill.name}\n\n${skill.content}`;
+}
+/**
+* Checks a stored record's input against its exact contract, and throws a `ContractError` coded
+* `'structure'` when it fails.
+*
+* @remarks
+* The input must pass the contract's `is` guard: a missing required member, a member the input type
+* does not declare, a declared member holding `undefined`, and a member of another type each refuse,
+* so nothing a refused input carries is stored. A class instance refuses, and the contract reads own
+* enumerable string keys alone, as every option door does. The contract's `audit` runs only after a refusal, and
+* the message names the owner, the input type, and every fault with the members to send. The
+* `context` holds the first fault's `path` and the input type as its `shape`.
+*
+* @param input - The input to check
+* @param contract - The input's compiled contract
+* @param owner - The entity named at the head of the refusal
+* @param shape - The input type named in the refusal and its `context`
+* @throws ContractError Thrown when the input fails the contract (code `'structure'`)
+*
+* @example
+* ```ts
+* import { memoInputContract, requireRecordInput } from '@orkestrel/agent'
+*
+* requireRecordInput({ name: 'tone', description: 'Prefers short replies.', content: 'Answer briefly.' }, memoInputContract, 'MemoManager', 'MemoInput') // returns
+* requireRecordInput({ name: 'tone', description: undefined, content: 'Answer briefly.' }, memoInputContract, 'MemoManager', 'MemoInput') // throws ContractError ('structure')
+* ```
+*/
+function requireRecordInput(input, contract, owner, shape) {
+	if (contract.is(input)) return;
+	const faults = contract.audit(input);
+	throw new ContractError(`${owner}: a ${shape} must hold each required member and no other, every member of its declared type\n${describeFaults(faults, contract.schema)}`, {
+		code: "structure",
+		context: {
+			path: faults[0]?.path ?? [],
+			shape
+		}
+	});
+}
+// src/core/contexts/instructions/Instruction.ts
+/**
+* Represents an immutable named directive — an {@link InstructionInterface} assembled once from
+* its input (`name` / `content` and an optional `priority`), the `id` minted at
+* construction. Default: `0` for `priority`.
+*
+* @remarks
+* A thin immutable value object (mirroring {@link import('@orkestrel/tool').Tool}): the
+* constructor mints a fresh `id` (`crypto.randomUUID()`), copies the input's `name` /
+* `content`, resolves `priority` to the input's value or `0`, and carries the input's
+* per-item `override` value when supplied; otherwise the instance owns no `override` member, so
+* its own keys and a JSON copy carry no member holding `undefined`. The input meets its exact
+* contract first, so a missing required member, an undeclared member, and a declared member holding
+* `undefined` refuse with a `ContractError` coded `'structure'`. Never mutated after construction. An
+* {@link import('./InstructionManager.js').InstructionManager} keys it by `name` and
+* renders it (highest `priority` first) under its section header.
+*
+* @example
+* ```ts
+* const instruction = new Instruction({ name: 'tone', content: 'Be concise.', priority: 5 })
+* instruction.priority // 5
+* ```
+*/
+var Instruction = class {
+	id;
+	name;
+	content;
+	priority;
+	constructor(input) {
+		requireRecordInput(input, instructionInputContract, "Instruction", "InstructionInput");
+		this.id = crypto.randomUUID();
+		this.name = input.name;
+		this.content = input.content;
+		this.priority = input.priority ?? 0;
+		if (input.override !== void 0) this.override = input.override;
+	}
+};
+// src/core/contexts/instructions/InstructionManager.ts
+/**
+* Registers the immutable {@link Instruction} instances a richer context assembles a directives block
+* from — keyed by `name` so adding an instruction whose name is already stored overwrites it,
+* last write wins, and listed by descending `priority`, carrying the `open` / `render` / `close` build contract and an observable `emitter`.
+*
+* @remarks
+* - **Registry.** Instructions live in an insertion-ordered `Map` keyed by `name`;
+*   `add` takes one {@link InstructionInput} or a batch, mints each instruction's
+*   `id`, and adding an instruction whose name is already stored overwrites it (last write wins).
+*   `count` is the map size, `instruction(name)` looks one up, and `instructions()` lists them sorted by
+*   descending `priority` (a stable sort, so equal priorities keep insertion order).
+* - **Build contract (the whole format cascade).** `open` is the section header a context
+*   renders the instructions under, `render(instruction)` renders one instruction, and
+*   `close` is the line after them. Each resolves the cascade most-specific-first: `render`
+*   returns the instruction's {@link InstructionInput.override}, else the
+*   `InstructionManagerOptions.format` `render`, else its `content`; `open` returns the
+*   options `open`, else the built-in header; `close` returns the options `close`, else
+*   `undefined`. A context reads the three and frames the section from them (see
+*   {@link import('../AgentContext.js').AgentContext}).
+* - **Removal.** `remove` drops one by name, or a batch — `true` only when every supplied
+*   name was removed; `clear` empties the registry.
+* - **Observable.** The owned {@link emitter} ({@link InstructionManagerEventMap})
+*   carries `add` (the created instruction) / `remove` (the name) / `clear` for
+*   fire-and-forget observers. Every event is emitted directly, strictly after the map
+*   mutation completes; the emitter isolates a listener throw and routes it to its `error`
+*   handler (the `error` option), so a buggy observer can never corrupt a mutation.
+*
+* @example
+* ```ts
+* const manager = new InstructionManager()
+* manager.add([
+* 	{ name: 'tone', content: 'Be concise.', priority: 1 },
+* 	{ name: 'safety', content: 'Refuse unsafe requests.', priority: 10 },
+* ])
+* manager.instructions().map((one) => one.name) // ['safety', 'tone'] — highest priority first
+* ```
+*/
+var InstructionManager = class {
+	#instructions = /* @__PURE__ */ new Map();
+	#emitter;
+	#format;
+	constructor(options) {
+		refuseOptionKeys(options, INSTRUCTION_MANAGER_KEYS, "InstructionManager", "InstructionManagerOptions");
+		this.#emitter = new Emitter(options);
+		this.#format = options?.format;
+	}
+	get emitter() {
+		return this.#emitter;
+	}
+	get count() {
+		return this.#instructions.size;
+	}
+	get open() {
+		return this.#format?.open ?? "## Instructions";
+	}
+	get close() {
+		return this.#format?.close;
+	}
+	add(input) {
+		if (isArray(input)) {
+			input.forEach((one) => requireRecordInput(one, instructionInputContract, "Instruction", "InstructionInput"));
+			return input.map((one) => this.#create(one));
+		}
+		return this.#create(input);
+	}
+	instruction(name) {
+		return this.#instructions.get(name);
+	}
+	instructions() {
+		return [...this.#instructions.values()].sort((a, b) => b.priority - a.priority);
+	}
+	render(instruction) {
+		return instruction.override ?? this.#format?.render?.(instruction) ?? instruction.content;
+	}
+	remove(names) {
+		if (isArray(names)) return removeEntries(names, (name) => this.#delete(name));
+		return this.#delete(names);
+	}
+	clear() {
+		this.#instructions.clear();
+		this.#emitter.emit("clear");
+	}
+	#create(input) {
+		const instruction = new Instruction(input);
+		this.#instructions.set(instruction.name, instruction);
+		this.#emitter.emit("add", instruction);
+		return instruction;
+	}
+	#delete(name) {
+		const removed = this.#instructions.delete(name);
+		if (removed) this.#emitter.emit("remove", name);
+		return removed;
+	}
+};
 // src/core/contexts/validators.ts
 /**
 * Checks whether a value is a memo's origin: a record with a string `conversation` and an optional
@@ -5149,6 +5565,35 @@ function isMemoSnapshot(value) {
 		return isString(id) && arrayOf(isMemo)(memos);
 	});
 }
+/**
+* Checks whether a value implements `ScopeInterface`; total, each member read one time, any
+* implementation admitted.
+*
+* @remarks
+* A scope is a string `id` and `name`, each of `instructions`, `skills`, `memos`, `tools`, `files`,
+* and `workspaces` absent or a dense array of strings, `select` absent or a function, and a `narrow`
+* function. The guard reads each of those members one time and never calls a method. It admits
+* unknown members, a class instance, and a transparent proxy, and returns false for a throwing
+* getter, a revoked proxy, and any other malformed input.
+*
+* @param value - The value to test
+* @returns True if `value` carries the members of a {@link ScopeInterface}; false otherwise
+*
+* @example
+* ```ts
+* import { createScope, isScope } from '@orkestrel/agent'
+*
+* isScope(createScope({ name: 'reader', tools: ['search'] })) // true
+* isScope({ id: 's1', name: 'reader' }) // false
+* ```
+*/
+function isScope(value) {
+	return holds(() => {
+		if (!isObject(value)) return false;
+		const list = optionalOf(arrayOf(isString));
+		return isString(Reflect.get(value, "id")) && isString(Reflect.get(value, "name")) && list(Reflect.get(value, "instructions")) && list(Reflect.get(value, "skills")) && list(Reflect.get(value, "memos")) && list(Reflect.get(value, "tools")) && list(Reflect.get(value, "files")) && list(Reflect.get(value, "workspaces")) && optionalOf(isFunction)(Reflect.get(value, "select")) && isFunction(Reflect.get(value, "narrow"));
+	});
+}
 // src/core/contexts/memos/MemoManager.ts
 /**
 * Registers the revisions of a memo set — durable facts keyed by `name`, where a same-name `add`
@@ -5196,6 +5641,7 @@ var MemoManager = class {
 	* @throws {ContextError} Thrown when the `snapshot` option cannot be copied through JSON or its copy is not a memo snapshot (code `'SNAPSHOT'`); nothing is seated and nothing is emitted
 	*/
 	constructor(options) {
+		refuseOptionKeys(options, MEMO_MANAGER_KEYS, "MemoManager", "MemoManagerOptions");
 		const supplied = options?.snapshot;
 		const owned = supplied === void 0 ? void 0 : copyJSON(supplied);
 		const snapshot = isMemoSnapshot(owned) ? owned : void 0;
@@ -5224,6 +5670,7 @@ var MemoManager = class {
 		return this.#format?.close;
 	}
 	add(input) {
+		(isArray(input) ? input : [input]).forEach((one) => requireRecordInput(one, memoInputContract, "MemoManager", "MemoInput"));
 		if (isArray(input)) return input.map((one) => this.#append(one));
 		return this.#append(input);
 	}
@@ -5282,9 +5729,9 @@ var MemoManager = class {
 // src/core/contexts/scopes/Scope.ts
 /**
 * Represents a named, immutable filter over a richer context's items — an optional allow-list per
-* category (`instructions` / `skills` / `memos` / `tools` / `files`), each keyed by that category's
-* identity (an instruction's, a skill's, a memo's, or a tool's `name`, a workspace file's `path`)
-* and read as an allow-list:
+* category (`instructions` / `skills` / `memos` / `tools` / `files` / `workspaces`), each keyed by
+* that category's identity (an instruction's, a skill's, a memo's, or a tool's `name`, a workspace
+* file's `path`, a workspace's `id`) and read as an allow-list:
 * `undefined` lets everything pass, `[]` lets nothing pass, and a non-empty list passes the listed
 * keys alone. `narrow` composes a tighter child by set intersection.
 *
@@ -5302,6 +5749,10 @@ var MemoManager = class {
 *   `undefined` with a list yields the list, and `undefined` with `undefined` stays
 *   `undefined`. Narrowing can only tighten, never widen — a key excluded by a parent
 *   can never be re-admitted by a child. The child keeps this scope's `name` and `select` handler.
+* - **Exact.** The constructor refuses an own enumerable member of its input outside
+*   `SCOPE_KEYS`, and `narrow` one of its filter outside `SCOPE_FILTER_KEYS`, with a
+*   `ContractError` coded `'structure'`, so a misspelled list never builds an open scope. A
+*   declared member holding `undefined` reads as omitted.
 *
 * @example
 * ```ts
@@ -5321,8 +5772,10 @@ var Scope = class Scope {
 	memos;
 	tools;
 	files;
+	workspaces;
 	select;
 	constructor(input) {
+		refuseOptionKeys(input, SCOPE_KEYS, "Scope", "ScopeInput");
 		this.name = input.name;
 		if (input.select !== void 0) this.select = input.select;
 		if (input.instructions !== void 0) this.instructions = [...input.instructions];
@@ -5330,21 +5783,14 @@ var Scope = class Scope {
 		if (input.memos !== void 0) this.memos = [...input.memos];
 		if (input.tools !== void 0) this.tools = [...input.tools];
 		if (input.files !== void 0) this.files = [...input.files];
+		if (input.workspaces !== void 0) this.workspaces = [...input.workspaces];
 	}
 	narrow(config) {
-		const instructions = intersectKeys(this.instructions, config.instructions);
-		const skills = intersectKeys(this.skills, config.skills);
-		const memos = intersectKeys(this.memos, config.memos);
-		const tools = intersectKeys(this.tools, config.tools);
-		const files = intersectKeys(this.files, config.files);
+		refuseOptionKeys(config, SCOPE_FILTER_KEYS, "Scope", "ScopeFilter");
 		return new Scope({
 			name: this.name,
 			...this.select === void 0 ? {} : { select: this.select },
-			...instructions === void 0 ? {} : { instructions },
-			...skills === void 0 ? {} : { skills },
-			...memos === void 0 ? {} : { memos },
-			...tools === void 0 ? {} : { tools },
-			...files === void 0 ? {} : { files }
+			...intersectFilters(this, config)
 		});
 	}
 };
@@ -5381,6 +5827,7 @@ var ScopeManager = class {
 	#scopes = /* @__PURE__ */ new Map();
 	#emitter;
 	constructor(options) {
+		refuseOptionKeys(options, SCOPE_MANAGER_KEYS, "ScopeManager", "ScopeManagerOptions");
 		this.#emitter = new Emitter(options);
 	}
 	get emitter() {
@@ -5454,6 +5901,7 @@ var SkillManager = class {
 	#emitter;
 	#format;
 	constructor(options) {
+		refuseOptionKeys(options, SKILL_MANAGER_KEYS, "SkillManager", "SkillManagerOptions");
 		this.#emitter = new Emitter(options);
 		this.#format = options?.format;
 	}
@@ -5470,8 +5918,12 @@ var SkillManager = class {
 		return this.#format?.close;
 	}
 	add(input) {
-		if (isArray(input)) return input.map((one) => this.#create(one));
-		return this.#create(input);
+		if (isArray(input)) {
+			const skills = input.map((one) => this.#mint(one));
+			skills.forEach((skill) => this.#store(skill));
+			return skills;
+		}
+		return this.#store(this.#mint(input));
 	}
 	skill(name) {
 		return this.#skills.get(name);
@@ -5490,14 +5942,28 @@ var SkillManager = class {
 		this.#skills.clear();
 		this.#emitter.emit("clear");
 	}
-	#create(input) {
-		const skill = {
+	#mint(input) {
+		const given = isRecord(input) ? input.tools : void 0;
+		const tools = isArray(given) ? Array.from(given) : given;
+		if (tools !== void 0 && !(isArray(tools) && tools.every(isString))) throw new ContractError("SkillManager: tools must be an array of tool names", {
+			code: "placement",
+			context: {
+				path: ["input", "tools"],
+				limit: "readonly string[]",
+				received: preview(given)
+			}
+		});
+		requireRecordInput(input, skillInputContract, "SkillManager", "SkillInput");
+		return {
 			id: crypto.randomUUID(),
 			name: input.name,
 			description: input.description,
 			content: input.content,
-			files: (input.files ?? []).map((file) => createFile(file))
+			files: (input.files ?? []).map((file) => createFile(file)),
+			tools: tools === void 0 ? [] : tools
 		};
+	}
+	#store(skill) {
 		this.#skills.set(skill.name, skill);
 		this.#emitter.emit("add", skill);
 		return skill;
@@ -5694,8 +6160,9 @@ var DatabaseMemoStore = class {
 * {@link ConversationManagerInterface} message source whose active conversation is `messages`, the
 * {@link ToolManagerInterface} registry, and an active {@link ScopeInterface} changed through
 * {@link AgentContextInterface.apply}. `build()` folds the system prompt, the scoped instructions,
-* and the skills index into one system message, the memos index and the active workspace's text into
-* one `user` context message after it, then the conversation, and never reads `tools`.
+* the skills index, and the shown skills' bodies into one system message, the memos index and the
+* rendered workspace's text into one `user` context message after it, then the conversation, and
+* never reads `tools`.
 *
 * @remarks
 * - **Composition.** `system` is the optional system prompt; `instructions` / `skills` / `memos` /
@@ -5714,40 +6181,43 @@ var DatabaseMemoStore = class {
 *   reference, no duplication), and `build()` with no selection folds that conversation's `view()`
 *   (its per-section summaries + live tail) as the authoritative message inclusion — the scope does
 *   not filter the conversation (it owns inclusion through compaction; scope filters only
-*   instructions / skills / memos / tools / workspace files). An agent run binds a conversation at
+*   instructions / skills / memos / tools / workspace files / workspaces). An agent run binds a conversation at
 *   its call, the active one unless the run names another, and builds through a selection over that
 *   conversation, so `conversations.switch(id)` sets the next run's default at any moment and never
 *   moves a live run; `select(conversation, request, signal)` checks the conversation it is given.
 * - **`build()` — the scoped assembly + the format cascade.** It folds, in order,
 *   the system prompt, the scope-filtered instructions (a block: the section's `open` text,
 *   each item's rendering, then any `close` text), then the scope-filtered skills index (a block
-*   whose entries join with a single newline) into one leading `system` message (prepended only
-*   when at least one part exists), then the scope-filtered memos index (the same block) and the
-*   active workspace's text files into one `user` context message (present only when the memos or
-*   workspace section renders), then
+*   whose entries join with a single newline), then the shown skills' bodies, into one leading
+*   `system` message (prepended only when at least one part exists), then the scope-filtered memos
+*   index (the same block), the listed workspace ids, and the rendered workspace's text files into
+*   one `user` context message (present only when one of those sections renders), then
 *   appends the active conversation's `view()` (the conversation owns message inclusion through
 *   compaction — the scope does not filter the conversation). The instruction manager resolves
 *   each `open` / item / `close` most-specific-first: `open` = manager-options-override >
 *   built-in; per item = item-override > manager-options-override > built-in; `close` =
 *   manager-options-override (no built-in ⇒ no closing line when unset) (see
 *   {@link AgentContextInterface.build}). With no override set, each section is its built-in
-*   header + items, no closing line. The active workspace's scoped-in image files' `base64` payload is attached to
+*   header + items, no closing line. The rendered workspace's scoped-in image files' `base64` payload is attached to
 *   the last user message (a vision provider reads images off a user turn); when no user message
 *   exists the attachment is skipped. Built fresh each call (recomputed, never cached), so it
-*   always reflects the current managers / messages / scope / active workspace; it never mutates a
+*   always reflects the current managers / messages / scope / workspaces; it never mutates a
 *   manager or the stored messages. `build(selection)` adds at most one `system` message of its own
 *   and reads the selection's messages as conversation parts without a role check; the select path
 *   refuses a selected `system` role as a `'ROLE'` fault over `view()`; a host's direct
 *   `build(selection)` is host-trusted, and a conversation a host implements itself whose `view()`
 *   holds a `system` message is read as host-trusted too.
-* - **The active workspace, rendered by carrier — the sole document/image context.**
-*   `workspaces.active` (when set) has its {@link import('@orkestrel/workspace').FileInterface} values scope-filtered by `scope.files`,
+* - **The rendered workspace, by carrier — the sole document/image context.**
+*   The rendered workspace has its {@link import('@orkestrel/workspace').FileInterface} values scope-filtered by `scope.files`,
 *   then split: text files fold into a dedicated `## Workspace` section (fenced reference blocks)
 *   in the context message — a `user` message with a minted id, never stored — and image files'
 *   `base64` payload attaches to the last user message of the conversation, never to the context
 *   message. The `system` message holds host-authored text alone: the system prompt, the
-*   instructions, and the skills index. Active-only — never the other registered workspaces; with no
-*   active workspace nothing renders for workspaces. `build()` owns this render (a `Workspace` /
+*   instructions, the skills index, and last the bodies of the skills `options.disclosure` shows.
+*   One workspace renders: the one `options.disclosure` selects, else the active one, and only
+*   while the scope's `workspaces` list admits it; with neither, nothing renders for workspaces.
+*   `options.switchable` adds the admitted workspace ids to the context message, after the memos
+*   index. `build()` never moves the active workspace, and it owns this render (a `Workspace` /
 *   `WorkspaceManager` stays file-focused).
 * - **Tools are structural, not in the prompt.** The registry is advertised to the provider
 *   through `tools.definitions()` (scope-filtered by the loop), never serialized into the
@@ -5774,6 +6244,7 @@ var AgentContext = class {
 	#select;
 	#scope;
 	constructor(options) {
+		refuseOptionKeys(options, CONTEXT_OPTION_KEYS, "AgentContext", "AgentContextOptions");
 		this.#system = options?.system;
 		this.#instructions = options?.instructions ?? new InstructionManager();
 		this.#skills = options?.skills ?? new SkillManager();
@@ -5815,31 +6286,44 @@ var AgentContext = class {
 	apply(scope) {
 		this.#scope = scope;
 	}
-	select(conversation, request, signal) {
-		const handler = this.#scope?.select ?? this.#select;
+	select(conversation, request, signal, scope) {
+		const handler = scope?.select ?? this.#scope?.select ?? this.#select;
 		if (handler === void 0) return void 0;
 		return this.#check(handler, conversation, request, signal);
 	}
-	build(selection) {
-		const scope = this.#scope;
+	build(options) {
+		refuseOptionKeys(options, BUILD_OPTION_KEYS, "AgentContext", "ContextBuildOptions");
+		const scope = intersectFilters(this.#scope, options?.scope);
 		const parts = [];
 		if (this.#system !== void 0) parts.push(this.#system);
-		const instructions = filterAllowList(scope?.instructions, this.#instructions.instructions(), (one) => one.name);
+		const instructions = filterAllowList(scope.instructions, this.#instructions.instructions(), (one) => one.name);
 		const instructed = renderSection(this.#instructions.open, instructions, (one) => this.#instructions.render(one), this.#instructions.close);
 		if (instructed !== void 0) parts.push(instructed);
-		const skills = filterAllowList(scope?.skills, this.#skills.skills(), (one) => one.name);
+		const skills = filterAllowList(scope.skills, this.#skills.skills(), (one) => one.name);
 		const indexed = renderSection(this.#skills.open, skills.length === 0 ? [] : [skills.map((one) => this.#skills.render(one)).join("\n")], (block) => block, this.#skills.close);
 		if (indexed !== void 0) parts.push(indexed);
-		const files = filterAllowList(scope?.files, this.#workspaces.active?.files() ?? [], (one) => one.path);
+		const admitted = new Map(skills.map((one) => [one.name, one]));
+		const bodies = renderSection(LOADED_SECTION_HEADER, [...new Set(options?.disclosure?.skills ?? [])].flatMap((name) => {
+			const skill = admitted.get(name);
+			return skill === void 0 || skill.content.trim() === "" ? [] : [skill];
+		}), renderSkillBody, void 0);
+		if (bodies !== void 0) parts.push(bodies);
+		const workspace = resolveWorkspace(this.#workspaces, options?.disclosure?.workspace, scope.workspaces);
+		const files = filterAllowList(scope.files, workspace?.files() ?? [], (one) => one.path);
 		const documented = renderSection(WORKSPACE_SECTION_HEADER, files.flatMap((file) => isTextContent(file.content) ? [{
 			path: file.path,
 			language: file.content.language,
 			text: file.content.text
 		}] : []), (file) => renderFencedFile(file.path, file.language, file.text), void 0);
-		const memos = filterAllowList(scope?.memos, this.#memos.memos(), (one) => one.name);
+		const memos = filterAllowList(scope.memos, this.#memos.memos(), (one) => one.name);
 		const remembered = renderSection(this.#memos.open, memos.length === 0 ? [] : [memos.map((one) => this.#memos.render(one)).join("\n")], (block) => block, this.#memos.close);
-		const tail = attachUserImages(selection?.messages ?? this.#ensureConversation().view(), collectImageData(files));
-		const slots = [remembered, documented].filter((slot) => slot !== void 0);
+		const tail = attachUserImages(options?.selection?.messages ?? this.#ensureConversation().view(), collectImageData(files));
+		const switchable = options?.switchable === true ? filterAllowList(scope.workspaces, this.#workspaces.workspaces(), (one) => one.id) : [];
+		const slots = [
+			remembered,
+			renderSection(WORKSPACE_INDEX_HEADER, switchable.length === 0 ? [] : [switchable.map((one) => renderIndexLine(one.id)).join("\n")], (block) => block, void 0),
+			documented
+		].filter((slot) => slot !== void 0);
 		const context = slots.length === 0 ? [] : [{
 			id: crypto.randomUUID(),
 			role: "user",
@@ -6160,6 +6644,17 @@ function createAgentContext(options) {
 */
 var DEFAULT_AGENT_LIMIT = 10;
 /**
+* Opens a job tree finding that refuses a whole job, which sets it apart from a finding that names an exceeded member.
+*
+* @remarks
+* The `scanJobTree` helper writes it before the path of a job the contract refuses or a member read
+* makes unreadable, and the `AgentFanout` class reads it to open its refusal with the rule that
+* finding breaks. An
+* exceeded member's finding opens with `job`, so text later in a finding cannot pass for this
+* prefix.
+*/
+var JOB_REFUSAL_PREFIX = "refused ";
+/**
 * Holds the model-facing texts the loop writes after a tool name in a denial result — the
 * `denied` note for a deny with no reason, an evaluate throw, an invalid decision, or a tool
 * changed after its decision; the `refused` note for an ask the approver refused; and the
@@ -6171,8 +6666,74 @@ var AUTHORITY_NOTES = Object.freeze({
 	unanswered: "it needs approval and none was given. Do not call it again; tell the user it needs approval."
 });
 /**
+* Holds the texts the built-ins return on success — `loaded`, `unloaded`, `remembered`, and
+* `switched` — frozen.
+*
+* @remarks
+* `loaded`, `unloaded`, and `switched` are the texts the conversation's stored tool messages are
+* matched against to derive what a run shows, so each is one fixed constant. A stored message
+* counts only under a call to a built-in the run enables.
+*/
+var BUILTIN_NOTES = Object.freeze({
+	loaded: "The skill is loaded. Its instructions and tools are yours from your next step.",
+	unloaded: "The skill is unloaded. Its instructions and tools leave from your next step.",
+	remembered: "The memo is saved. Continue with what you were doing.",
+	switched: "The workspace is selected. Its files are yours from your next step."
+});
+/**
+* Caps each built-in argument in code points, as the built-in argument shapes count them — a `name`
+* (a skill name, a memo name, or a workspace id), a memo `description`, and a memo `content` — and
+* the `candidates` one refusal lists, frozen.
+*/
+var BUILTIN_LIMITS = Object.freeze({
+	name: 128,
+	description: 200,
+	content: 4e3,
+	candidates: 20
+});
+/**
+* Declares each built-in tool's model-facing description and annotations, keyed by its
+* {@link AgentBuiltin} name, frozen.
+*
+* @remarks
+* `memo` is `pure` and `untrusted`, because it returns memo text a model can have written;
+* `remember` is `consequential`, so an `allow` verdict becomes an `ask`. A run's own tools and the
+* definitions `collectBuiltinDefinitions` returns both read their text and annotations here.
+*/
+var BUILTIN_TOOLS = Object.freeze({
+	load: Object.freeze({ description: "Loads one skill from the skills index, so its instructions join yours and its tools become callable from your next step. Example: {\"skill\":\"refunds\"}. Replies with a short acknowledgement, not the instructions; call unload when you no longer need the skill." }),
+	unload: Object.freeze({ description: "Unloads one skill you loaded, so its instructions and tools leave from your next step. Example: {\"skill\":\"refunds\"}. Replies with a short acknowledgement." }),
+	memo: Object.freeze({
+		description: "Reads one memo from the memos index and replies with its full text. Example: {\"name\":\"tone\"}. Reading changes nothing; call remember to write a memo.",
+		annotations: Object.freeze({
+			pure: true,
+			untrusted: true
+		})
+	}),
+	remember: Object.freeze({
+		description: "Saves one memo under a name you are allowed to write: a one-line description for the memos index, and the content. Example: {\"name\":\"tone\",\"description\":\"Reply tone\",\"content\":\"Keep replies brief, because the user asked for that.\"}. Replies with a short acknowledgement; call memo to read a memo back.",
+		annotations: Object.freeze({ consequential: true })
+	}),
+	switch: Object.freeze({ description: "Selects one workspace from the workspaces index, so its files join your context from your next step. Example: {\"workspace\":\"orders\"}. Replies with a short acknowledgement." })
+});
+/**
+* Matches one control, format, line-separator, or paragraph-separator code point — the class
+* `renderArguments` encodes and a memo's one-line name and description may not hold, frozen.
+*
+* @remarks
+* Not global, so a `test` call keeps no state between calls; a global replace builds its own
+* global copy from `source`.
+*/
+var ARGUMENT_CONTROL_PATTERN = Object.freeze(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u);
+/**
+* Matches a text that is blank: empty after white space and default-ignorable code points, such
+* as U+3164, are removed, frozen.
+*/
+var ARGUMENT_BLANK_PATTERN = Object.freeze(/^[\p{White_Space}\p{Default_Ignorable_Code_Point}]*$/u);
+/**
 * Holds the model-facing text the loop writes after a tool name in the denial result of a call
-* outside the active scope's tool allow-list or whose name no definition advertises this turn.
+* outside the turn's tool ceiling, the context scope's tool allow-list intersected with the run
+* scope's, or whose name no definition advertises this turn.
 */
 var SCOPE_NOTE = "it is not one of the listed tools. Use a listed tool or answer with what you have.";
 /**
@@ -6191,6 +6752,92 @@ var MESSAGE_TOKEN_OVERHEAD = 4;
 * exact count.
 */
 var IMAGE_TOKEN_ESTIMATE = 512;
+/**
+* Lists the members `AgentOptions` declares, frozen — the keys the `Agent` constructor admits.
+*
+* @remarks
+* The constructor passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an own
+* enumerable member outside it refuses with a `ContractError` coded `'structure'`.
+*/
+var AGENT_OPTION_KEYS = Object.freeze([
+	"on",
+	"error",
+	"system",
+	"tools",
+	"instructions",
+	"skills",
+	"memos",
+	"workspaces",
+	"scope",
+	"limit",
+	"timeout",
+	"budget",
+	"allowance",
+	"scheduler",
+	"signal",
+	"authority",
+	"conversations",
+	"window",
+	"strict",
+	"select",
+	"builtins",
+	"workspace"
+]);
+/**
+* Lists the members `AgentRunOptions` declares, frozen — the keys the `stream` and `generate`
+* methods admit.
+*
+* @remarks
+* The `stream` method passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an own
+* enumerable member outside it refuses with a `ContractError` coded `'structure'`.
+*/
+var AGENT_RUN_KEYS = Object.freeze([
+	"think",
+	"schema",
+	"limit",
+	"timeout",
+	"budget",
+	"allowance",
+	"signal",
+	"conversation",
+	"prompt",
+	"scope",
+	"workspace"
+]);
+/** Lists the members `AuthorityOptions` declares, frozen — the keys the `Authority` constructor admits. */
+var AUTHORITY_OPTION_KEYS = Object.freeze([
+	"rules",
+	"fallback",
+	"ask"
+]);
+/** Lists the members `AgentRegistryOptions` declares, frozen — the keys the `AgentRegistry` constructor admits. */
+var REGISTRY_OPTION_KEYS = Object.freeze([
+	"providers",
+	"tools",
+	"authorities",
+	"schedulers",
+	"store",
+	"skills",
+	"memos",
+	"workspaces"
+]);
+/** Lists the members `AgentQueueOptions` declares, frozen — the keys `createAgentQueue` admits. */
+var QUEUE_OPTION_KEYS = Object.freeze([
+	"registry",
+	"partial",
+	"concurrency",
+	"retries",
+	"timeout",
+	"store"
+]);
+/** Lists the members `AgentRunnerOptions` declares, frozen — the keys `createAgentRunner` admits. */
+var RUNNER_OPTION_KEYS = Object.freeze([
+	"registry",
+	"partial",
+	"concurrency",
+	"retries",
+	"timeout"
+]);
 // src/core/agents/errors.ts
 /**
 * Reports an {@link AgentInterface} run that ended {@link AgentResult.partial} under a
@@ -6274,6 +6921,9 @@ function isAgentJobError(value) {
 * `'AUTHORITY'` reports an `Authority` built with no valid `fallback`, a rule with no valid `verdict`
 * (its `context` names the `rule` index), and an agent built with `tools` and no `authority`. Each
 * throws at construction, with the options a host passes to correct it in the message.
+* `'BUILTIN'` reports a `builtins` entry that is not a built-in or repeats one, `unload` enabled
+* without `load`, and a tool manager holding a tool under an enabled built-in's name, each thrown
+* at construction.
 * `'CONCURRENCY'` reports a run started while another run on the same agent is live, when the
 * agent carries a `window` (a shared context budget) or when the run's effective `budget` or
 * `allowance` is an instance a live run holds — the second run's `start()` would replace that
@@ -6282,18 +6932,18 @@ function isAgentJobError(value) {
 * `agent` id, and the `conversation` id for a shared conversation. For concurrent runs, use
 * separate agents, or one agent with no `window`, distinct budget and allowance instances per
 * run, and a distinct conversation per run.
-* `'LIMIT'` reports a construction or per-run `limit` that is not a positive safe integer,
-* including one a rehydrated job carries into `build`. `'REGISTRY'` reports a rehydration name
-* absent from its registry pool, on `provider` / `tool` / `authority` / `scheduler` / `build`,
-* whose `context` names the `category` and the `name`, and a job that names `tools` and no
-* `authority` at `build`, whose `context` names the `tools`. `'WINDOW'` reports a `strict` run whose
+* `'LIMIT'` reports a construction or per-run `limit` that is not a positive safe integer.
+* `'REGISTRY'` reports a rehydration name absent from its registry pool, on `provider` / `tool` /
+* `authority` / `scheduler` / `build`, whose `context` names the `category` and the `name`, and a
+* job `build` refuses as a record, whose `context` holds the contract's `faults` or the
+* `refusals` lines `collectJobRefusals` returns. `'WINDOW'` reports a `strict` run whose
 * complete provider request is still over the `window` budget, equal to its `max` included, after
 * the one permitted fold or with no fold possible; it settles the run `error` before the provider
 * is called, and its `context` holds the `agent` id, the measured `consumed`, and the window `max`.
 * Narrow a caught value with {@link isAgentError} and branch on `error.code`.
 */
 var AgentError = class extends Error {
-	/** Names the machine-readable condition — `'APPROVER'`: an `ask` on an authority that has no approver, or one its approver refuses; `'AUTHORITY'`: an authority missing its fallback or a rule's verdict, or tools set with no authority; `'CONCURRENCY'`: a run sharing accounting or a conversation with a live run; `'LIMIT'`: a `limit` that is not a positive safe integer; `'REGISTRY'`: a rehydration name absent from its registry pool; `'WINDOW'`: a strict run whose complete request is still over its window budget. */
+	/** Names the machine-readable condition — `'APPROVER'`: an `ask` on an authority that has no approver, or one its approver refuses; `'AUTHORITY'`: an authority missing its fallback or a rule's verdict, or tools set with no authority; `'BUILTIN'`: a built-in list the agent cannot serve; `'CONCURRENCY'`: a run sharing accounting or a conversation with a live run; `'LIMIT'`: a `limit` that is not a positive safe integer; `'REGISTRY'`: a rehydration name absent from its registry pool; `'WINDOW'`: a strict run whose complete request is still over its window budget. */
 	code;
 	/** Holds the values that locate the failure, such as the `agent` id of a refused run, or `undefined` when none were supplied. */
 	context;
@@ -6332,7 +6982,7 @@ function isAgentError(value) {
 	return holds(() => {
 		if (!(value instanceof Error && INTRINSICS.prototype(value) !== Error.prototype && INTRINSICS.describe(value, Symbol.for("@orkestrel/agent.AgentError"))?.value === value)) return false;
 		const code = INTRINSICS.reflect.read(value, "code");
-		if (!(code === "APPROVER" || code === "AUTHORITY" || code === "CONCURRENCY" || code === "LIMIT" || code === "REGISTRY" || code === "SCHEMA" || code === "WINDOW")) return false;
+		if (!(code === "APPROVER" || code === "AUTHORITY" || code === "BUILTIN" || code === "CONCURRENCY" || code === "LIMIT" || code === "REGISTRY" || code === "SCHEMA" || code === "WINDOW")) return false;
 		const context = INTRINSICS.reflect.read(value, "context");
 		return context === void 0 || isObject(context) || isFunction(context);
 	});
@@ -6343,20 +6993,45 @@ function isAgentError(value) {
 * refuses instead of running an agent without it.
 *
 * @remarks
-* `children` holds JSON records, because each child crosses this shape at its own `build`. `limit`
-* reads as a number here and as a positive safe integer at the agent's construction, which owns that
-* refusal.
+* `children` holds JSON records, because each child crosses this shape at its own `build`. Each
+* bound states what the build reads: `limit` an integer from 1 through `Number.MAX_SAFE_INTEGER`,
+* `timeout` an integer from 0 through `MAX_TIMEOUT_MS`, and `budget` a number of at least 0. A seed
+* message plays a `ConversationRole`, so a `system` message refuses here. A `scope` holds the
+* `skills`, `memos`, and `workspaces` lists, each required, and no other member; `builtins` admits
+* only the names of `AgentBuiltin`, and `collectJobRefusals` reads what a list of them cannot state.
 */
 var agentJobShape = objectShape({
 	provider: stringShape(),
-	messages: optionalShape(arrayShape(messageInputShape)),
+	messages: optionalShape(arrayShape(objectShape({
+		...messageInputShape.properties,
+		role: literalShape(CONVERSATION_ROLES)
+	}))),
 	system: optionalShape(stringShape()),
 	tools: optionalShape(arrayShape(stringShape())),
 	authority: optionalShape(stringShape()),
 	scheduler: optionalShape(stringShape()),
-	limit: optionalShape(numberShape()),
-	timeout: optionalShape(numberShape()),
-	budget: optionalShape(numberShape()),
+	limit: optionalShape(integerShape({
+		min: 1,
+		max: Number.MAX_SAFE_INTEGER
+	})),
+	timeout: optionalShape(integerShape({
+		min: 0,
+		max: MAX_TIMEOUT_MS
+	})),
+	budget: optionalShape(numberShape({ min: 0 })),
+	scope: optionalShape(objectShape({
+		skills: arrayShape(stringShape()),
+		memos: arrayShape(stringShape()),
+		workspaces: arrayShape(stringShape())
+	})),
+	workspace: optionalShape(stringShape()),
+	builtins: optionalShape(arrayShape(literalShape([
+		"load",
+		"unload",
+		"memo",
+		"remember",
+		"switch"
+	]))),
 	children: optionalShape(arrayShape(recordShape(jsonShape())))
 });
 /**
@@ -6426,6 +7101,74 @@ var agentAnswerShape = objectShape({
 	id: stringShape(),
 	approved: booleanShape()
 });
+/**
+* Describes the arguments of the `load` and `unload` built-ins — one `skill` name, non-empty and
+* at most `BUILTIN_LIMITS.name` code points.
+*
+* @remarks
+* The tool's door refuses a missing, empty, over-long, or extra member before the handler runs,
+* and repairs a value that converts to a string without loss, such as a number. A value of white
+* space alone passes the door; the handler refuses it as it refuses any name it cannot use.
+*/
+var loadToolShape = objectShape({ skill: stringShape({
+	min: 1,
+	max: BUILTIN_LIMITS.name,
+	description: "A skill name from the skills index"
+}) });
+/**
+* Describes the arguments of the `memo` built-in — one memo `name`, non-empty and at most
+* `BUILTIN_LIMITS.name` code points.
+*
+* @remarks
+* The tool's door refuses a missing, empty, over-long, or extra member before the handler runs,
+* and repairs a value that converts to a string without loss, such as a number. A value of white
+* space alone passes the door; the handler refuses it as it refuses any name it cannot use.
+*/
+var memoToolShape = objectShape({ name: stringShape({
+	min: 1,
+	max: BUILTIN_LIMITS.name,
+	description: "A memo name from the memos index"
+}) });
+/**
+* Describes the arguments of the `remember` built-in — a memo `name`, the one-line `description`
+* the memos index shows, and the `content`, each non-empty and within its `BUILTIN_LIMITS` cap.
+*
+* @remarks
+* The tool's door refuses a missing, empty, over-long, or extra member before the handler runs,
+* and repairs a value that converts to a string without loss, such as a number. A value of white
+* space alone passes the door; the handler refuses it as it refuses any name it cannot use.
+*/
+var rememberToolShape = objectShape({
+	name: stringShape({
+		min: 1,
+		max: BUILTIN_LIMITS.name,
+		description: "A memo name the host lists for you to write"
+	}),
+	description: stringShape({
+		min: 1,
+		max: BUILTIN_LIMITS.description,
+		description: "One line the memos index shows"
+	}),
+	content: stringShape({
+		min: 1,
+		max: BUILTIN_LIMITS.content,
+		description: "The fact, why it holds, and how to apply it"
+	})
+});
+/**
+* Describes the arguments of the `switch` built-in — one `workspace` id, non-empty and at most
+* `BUILTIN_LIMITS.name` code points.
+*
+* @remarks
+* The tool's door refuses a missing, empty, over-long, or extra member before the handler runs,
+* and repairs a value that converts to a string without loss, such as a number. A value of white
+* space alone passes the door; the handler refuses it as it refuses any name it cannot use.
+*/
+var switchToolShape = objectShape({ workspace: stringShape({
+	min: 1,
+	max: BUILTIN_LIMITS.name,
+	description: "A workspace id from the workspaces index"
+}) });
 // src/core/agents/contracts.ts
 /** Validates and projects agent frames at a JSON wire boundary. */
 var agentFrameContract = createContract(agentFrameShape);
@@ -6435,131 +7178,64 @@ var agentPromptContract = createContract(agentPromptShape);
 var agentJobContract = createContract(agentJobShape);
 /** Validates and projects a page's answers to `ask` frames at a JSON wire boundary. */
 var agentAnswerContract = createContract(agentAnswerShape);
-// src/core/agents/ChannelCell.ts
-/**
-* Holds one value a `Channel` buffers and the cell pushed after it.
-*
-* @remarks
-* A `Channel` keeps its unread values as a chain of these cells, from its `#head` cell to its
-* `#tail` cell, so no public signature names this class. The `#next` field is a latch: the
-* `link` method sets it once, and a later call keeps the first cell.
-*/
-var ChannelCell = class {
-	#value;
-	#next;
-	/**
-	* Holds a value with no next cell.
-	*
-	* @param value - The value the cell holds
-	*/
-	constructor(value) {
-		this.#value = value;
-	}
-	/**
-	* Returns the value the cell holds.
-	*
-	* @returns The value
-	*/
-	get value() {
-		return this.#value;
-	}
-	/**
-	* Returns the cell pushed after this one.
-	*
-	* @returns The next cell, or undefined before one is linked
-	*/
-	get next() {
-		return this.#next;
-	}
-	/**
-	* Links the cell pushed after this one, once.
-	*
-	* @param cell - The cell pushed after this one
-	*/
-	link(cell) {
-		this.#next ??= cell;
-	}
-};
-// src/core/agents/Channel.ts
+/** Checks the arguments of the `load` and `unload` built-ins; its schema is the parameters they advertise. */
+var loadToolContract = createContract(loadToolShape);
+/** Checks the arguments of the `memo` built-in; its schema is the parameters it advertises. */
+var memoToolContract = createContract(memoToolShape);
+/** Checks the arguments of the `remember` built-in; its schema is the parameters it advertises. */
+var rememberToolContract = createContract(rememberToolShape);
+/** Checks the arguments of the `switch` built-in; its schema is the parameters it advertises. */
+var switchToolContract = createContract(switchToolShape);
+/**
+* Pairs each built-in's argument shape, which its tool's door compiles, with its compiled contract,
+* keyed by its {@link AgentBuiltin} name, frozen.
+*
+* @remarks
+* The one map from a built-in to its arguments: `createBuiltinTool` builds the door from `shape`,
+* and `collectBuiltinDefinitions` and `collectDisclosure` read `contract`, so the advertised
+* parameters, the door, and the derivation admit by one rule. The record declares no shape: each
+* `shape` is a reference to the one `shapers.ts` declares, held beside the contract compiled from
+* it, because the tool door takes a shape and the derivation takes a compiled contract. The record
+* is data, as the rest of this file is.
+*/
+var builtinToolContracts = Object.freeze({
+	load: Object.freeze({
+		shape: loadToolShape,
+		contract: loadToolContract
+	}),
+	unload: Object.freeze({
+		shape: loadToolShape,
+		contract: loadToolContract
+	}),
+	memo: Object.freeze({
+		shape: memoToolShape,
+		contract: memoToolContract
+	}),
+	remember: Object.freeze({
+		shape: rememberToolShape,
+		contract: rememberToolContract
+	}),
+	switch: Object.freeze({
+		shape: switchToolShape,
+		contract: switchToolContract
+	})
+});
+// src/core/agents/validators.ts
 /**
-* Buffers chunks in a minimal unbounded async channel — the eager pump writes them in (`push`)
-* and ends it (`close` / `fail`) regardless of consumption, while a consumer reads them back live
-* through the `drain` async-iterator. Decoupling write from read is what lets a producer make
-* progress without a consumer pulling, and it is why an agent's `result` settles whether or not
-* its `events` are drained.
+* Checks whether a value names a built-in: `load`, `unload`, `memo`, `remember`, or `switch`.
 *
-* @remarks
-* A waiting `drain` call parks its void resolver in the `#waiting` field. The `push` method links a
-* cell after the `#tail` cell, and the `close` and `fail` methods flag the end; each then fires and
-* clears every parked resolver, so each parked reader wakes, reads the `#head` cell, and either
-* takes the next chunk, returns (on `close`), throws (on `fail`), or parks again when another
-* reader took the chunk first. Taking a chunk reads its value and moves `#head` to the next cell
-* synchronously, so each value reaches exactly one reader, a push and a take each cost constant
-* time, and every taken cell but the newest is released at once; the `#tail` field holds the newest
-* cell until the next push links after it, so a channel retains at most one taken value. A reader
-* suspended at its `yield` expression holds only the value it took, never a cell, so the bound on
-* retained values covers both the channel's fields and a suspended reader.
-* A `return()` issued while a read is parked waits for the next `push`, `close`, or `fail`.
-* The parked read takes a pushed value before that `return()` settles.
+* @param value - The unknown name candidate
+* @returns True if the value names a built-in; false otherwise
 *
 * @example
 * ```ts
-* import { Channel } from '@orkestrel/agent'
-*
-* const channel = new Channel<number>()
-* channel.push(1)
-* channel.close()
-* for await (const value of channel.drain()) {
-* 	value // 1
-* }
+* isAgentBuiltin('load') // true
+* isAgentBuiltin('open') // false
 * ```
 */
-var Channel = class {
-	#head;
-	#tail;
-	#waiting = [];
-	#closed = false;
-	#failure;
-	push(value) {
-		const cell = new ChannelCell(value);
-		this.#tail?.link(cell);
-		this.#tail = cell;
-		this.#head ??= cell;
-		this.#signal();
-	}
-	close() {
-		this.#closed = true;
-		this.#signal();
-	}
-	fail(error) {
-		if (this.#failure === void 0) this.#failure = { error };
-		this.#closed = true;
-		this.#signal();
-	}
-	async *drain() {
-		for (;;) {
-			while (this.#head !== void 0) {
-				const value = this.#head.value;
-				this.#head = this.#head.next;
-				yield value;
-			}
-			if (this.#failure !== void 0) throw this.#failure.error;
-			if (this.#closed) return;
-			await this.#park();
-		}
-	}
-	#signal() {
-		const waiting = this.#waiting;
-		this.#waiting = [];
-		for (const wake of waiting) wake();
-	}
-	#park() {
-		return new Promise((resolve) => {
-			this.#waiting = [...this.#waiting, resolve];
-		});
-	}
-};
-// src/core/agents/validators.ts
+function isAgentBuiltin(value) {
+	return value === "load" || value === "unload" || value === "memo" || value === "remember" || value === "switch";
+}
 /**
 * Checks whether a value is an authority verdict: `allow`, `ask`, or `deny`.
 *
@@ -6600,6 +7276,35 @@ function isAuthorityDecision(value) {
 		reason: isString
 	}, ["reason"])(value);
 }
+/**
+* Checks whether a value is an agent caller: a plain record whose own keys are exactly `workspace`
+* and `files`, whose `workspace` is `undefined` or an object, and whose `files` is `undefined` or an
+* array of strings.
+*
+* @remarks
+* Total: each member is read once, and an omitted, inherited, or undeclared member, a throwing
+* accessor, and a revoked `Proxy` return false rather than throw. It checks the shape a caller
+* carries, never that `workspace` is a live workspace: a value that crossed a wire passes when it
+* holds that shape, so accept its `workspace` only as the very instance your own registry holds
+* under that id.
+*
+* @param value - The unknown caller candidate, such as `ToolContext.caller`
+* @returns True if the value satisfies the caller contract; false otherwise
+*
+* @example
+* ```ts
+* isAgentCaller({ workspace: undefined, files: undefined }) // true
+* isAgentCaller({ workspace: 'returns' }) // false
+* ```
+*/
+function isAgentCaller(value) {
+	return holds(() => {
+		if (!isRecord(value) || !matchesExactKeys(value, ["workspace", "files"])) return false;
+		const workspace = value.workspace;
+		const files = value.files;
+		return (workspace === void 0 || isObject(workspace)) && (files === void 0 || arrayOf(isString)(files));
+	});
+}
 // src/core/agents/helpers.ts
 /**
 * Projects an unknown value onto a fresh, exact `JSONValue` representation of an
@@ -7080,6 +7785,118 @@ function handleAgentQueueJob(registry, partial, input, context) {
 	return settleAgentJob(registry.build(input, context.signal), partial);
 }
 /**
+* Collects the refusals a job the contract admitted would meet at its build: tools or built-ins with
+* no authority, a `builtins` list `requireBuiltins` refuses, and a built-in its own `tools` name.
+*
+* @remarks
+* Each line names the member first, then the refusal and its remedy. The `builtins` line of a list
+* `requireBuiltins` refuses carries that error's message; a job's tool manager holds exactly its
+* `tools`, so a built-in its `tools` list also names is the name a manager would already hold.
+* `AgentRegistry.build` refuses a job with any line, and `scanJobTree` refuses each such job of a
+* tree before anything spawns.
+*
+* @param job - The `tools`, `builtins`, and `authority` of a job `agentJobContract` admitted
+* @returns One line a refusal, in member order; empty when the job builds
+*
+* @example
+* ```ts
+* collectJobRefusals({ provider: 'main', tools: ['search'] })
+* // ["authority: a job that names tools or builtins and no authority cannot run them; add authority: 'NAME' to the job and register that NAME under authorities"]
+* ```
+*/
+function collectJobRefusals(job) {
+	const tools = job.tools ?? [];
+	const builtins = job.builtins ?? [];
+	const checked = attempt(() => requireBuiltins(job.builtins, { tool: () => void 0 }));
+	const shared = builtins.filter((name) => tools.includes(name));
+	return [
+		(tools.length > 0 || builtins.length > 0) && job.authority === void 0 ? "authority: a job that names tools or builtins and no authority cannot run them; add authority: 'NAME' to the job and register that NAME under authorities" : void 0,
+		checked.success ? void 0 : `builtins: ${errorToMessage(checked.error)}`,
+		shared.length === 0 ? void 0 : `builtins: names ${shared.map((name) => preview(name)).join(", ")}, which its tools also name; rename that tool or leave the name out of builtins`
+	].filter((line) => line !== void 0);
+}
+/**
+* Scans every job under a root for a member that exceeds its own parent's; an empty result clears the tree.
+*
+* @remarks
+* The walk audits each job, the root included, through `agentJobContract` before it reads a member,
+* because a job's `children` cross that contract as JSON records, and then reads each job the
+* contract admits through `collectJobRefusals`. A job the contract refuses yields one finding with its
+* faults, or with an unreadable note when a member read throws; a job its build would refuse yields
+* one finding a refusal, its path, a dot, and the line; and the walk reads nothing under either. A
+* child is within its parent when each of
+* its `tools` is one its parent names (a parent with no `tools` names none), each of its `builtins`
+* is one its parent names (a parent with no `builtins` names none), each name in each list of its
+* `scope` is in its parent's same list (a job with no `scope` holds the three lists empty), its
+* `authority` and `scheduler` are absent or its parent's, its `provider` is its parent's, its `limit`
+* is at most its parent's (an absent `limit` reads `DEFAULT_AGENT_LIMIT`), and, where its parent
+* holds a `timeout` or a `budget`, it holds one no larger. `system`, `messages`, and `workspace` are
+* free: a `workspace` renders nothing its own `scope` omits. A refused job's finding
+* opens with `JOB_REFUSAL_PREFIX` and then the job's path from `job`; an exceeded member's opens
+* with that path, a dot, and the member. The walk is total: an unreadable job yields a finding,
+* never a throw. The `AgentFanout` class runs it on every attempt of a unit, before the unit spawns
+* or runs.
+*
+* @param root - The root job of the tree
+* @returns One finding per refused job and per exceeded member, in walk order
+*
+* @example
+* ```ts
+* scanJobTree({ provider: 'main', children: [{ provider: 'other' }] })
+* // ['job.children[0].provider: "other" differs from its parent\'s, which is "main"']
+* ```
+*/
+function scanJobTree(root) {
+	const findings = [];
+	const pending = [[
+		root,
+		"job",
+		void 0
+	]];
+	for (const [job, path, parent] of pending) {
+		if (!agentJobContract.is(job)) {
+			const faults = attempt(() => agentJobContract.audit(job));
+			findings.push(`${JOB_REFUSAL_PREFIX}${path}: ${faults.success ? describeFaults(faults.value, agentJobContract.schema) : "a member read threw, so the job cannot be read"}`);
+			continue;
+		}
+		const refusals = collectJobRefusals(job);
+		if (refusals.length > 0) {
+			findings.push(...refusals.map((line) => `${JOB_REFUSAL_PREFIX}${path}.${line}`));
+			continue;
+		}
+		if (parent !== void 0) {
+			const held = parent.tools ?? [];
+			const outside = (job.tools ?? []).filter((name) => !held.includes(name));
+			const enabled = parent.builtins ?? [];
+			const extra = (job.builtins ?? []).filter((name) => !enabled.includes(name));
+			const unlisted = [
+				"skills",
+				"memos",
+				"workspaces"
+			].map((list) => [list, (job.scope?.[list] ?? []).filter((name) => !(parent.scope?.[list] ?? []).includes(name))]);
+			const limit = job.limit ?? 10;
+			const bound = parent.limit ?? 10;
+			findings.push(...[
+				outside.length === 0 ? void 0 : `${path}.tools: names ${outside.map((name) => preview(name)).join(", ")}, which its parent does not hold`,
+				extra.length === 0 ? void 0 : `${path}.builtins: names ${extra.map((name) => preview(name)).join(", ")}, which its parent does not hold`,
+				...unlisted.map(([list, names]) => names.length === 0 ? void 0 : `${path}.scope.${list}: names ${names.map((name) => preview(name)).join(", ")}, which its parent does not hold`),
+				job.authority === void 0 || job.authority === parent.authority ? void 0 : `${path}.authority: ${preview(job.authority)} is neither absent nor its parent's, which is ${parent.authority === void 0 ? "none" : preview(parent.authority)}`,
+				job.provider === parent.provider ? void 0 : `${path}.provider: ${preview(job.provider)} differs from its parent's, which is ${preview(parent.provider)}`,
+				job.scheduler === void 0 || job.scheduler === parent.scheduler ? void 0 : `${path}.scheduler: ${preview(job.scheduler)} is neither absent nor its parent's, which is ${parent.scheduler === void 0 ? "none" : preview(parent.scheduler)}`,
+				limit <= bound ? void 0 : `${path}.limit: ${job.limit === void 0 ? `none reads ${limit}, which exceeds` : `${limit} exceeds`} its parent's ${bound}`,
+				parent.timeout === void 0 || job.timeout !== void 0 && job.timeout <= parent.timeout ? void 0 : `${path}.timeout: ${job.timeout ?? "none"} exceeds its parent's ${parent.timeout}`,
+				parent.budget === void 0 || job.budget !== void 0 && job.budget <= parent.budget ? void 0 : `${path}.budget: ${job.budget ?? "none"} exceeds its parent's ${parent.budget}`
+			].filter((finding) => finding !== void 0));
+		}
+		for (const [index, child] of (job.children ?? []).entries()) pending.push([
+			child,
+			`${path}.children[${index}]`,
+			job
+		]);
+	}
+	return findings;
+}
+/**
 * Assembles the settled {@link AgentResult} from a run's {@link AgentRunResult} — `thinking`,
 * `usage`, and `stop` are carried only when the run surfaced them, and the loop-internal
 * `exhausted` flag is left out.
@@ -7162,7 +7979,7 @@ function denyCall(call, reason) {
 function renderArguments(value) {
 	const rendered = attempt(() => canonicalStringify(value));
 	if (!rendered.success || rendered.value === void 0) return void 0;
-	return rendered.value.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, (match) => Array.from({ length: match.length }, (_, index) => `\\u${match.charCodeAt(index).toString(16).padStart(4, "0")}`).join(""));
+	return rendered.value.replace(new RegExp(ARGUMENT_CONTROL_PATTERN.source, "gu"), (match) => Array.from({ length: match.length }, (_, index) => `\\u${match.charCodeAt(index).toString(16).padStart(4, "0")}`).join(""));
 }
 /**
 * Applies the `consequential` floor to one {@link AuthorityDecision} — an `allow` for a tool
@@ -7381,6 +8198,37 @@ function requireConversation(value) {
 	});
 }
 /**
+* Returns a scope a run can bind, or throws a `ContractError` coded `'placement'`; `undefined`
+* passes through.
+*
+* @remarks
+* The check is {@link isScope}, a total guard that reads each member one time and admits any
+* implementation of `ScopeInterface`. `undefined` passes, because an absent option leaves the
+* context scope alone as the run's ceiling. The error's `context` carries the option path, the
+* limit `'ScopeInterface'`, and a preview of the refused value.
+*
+* @param value - The run's `scope` option, or `undefined`
+* @returns The value unchanged
+* @throws {ContractError} Thrown when `value` is defined and does not implement `ScopeInterface` (code `'placement'`)
+*
+* @example
+* ```ts
+* requireScope(createScope({ name: 'reader', tools: ['search'] })) // the scope
+* requireScope({ id: 's1', name: 'reader' }) // throws ContractError ('placement')
+* ```
+*/
+function requireScope(value) {
+	if (value === void 0 || isScope(value)) return value;
+	throw new ContractError("Agent: scope must implement ScopeInterface", {
+		code: "placement",
+		context: {
+			path: ["options", "scope"],
+			limit: "ScopeInterface",
+			received: preview(value)
+		}
+	});
+}
+/**
 * Renders a tool's output as the string content of its tool message, or returns `undefined` when JSON
 * cannot carry it.
 *
@@ -7482,6 +8330,735 @@ function extractQueueOptions(options) {
 		...timeout === void 0 ? {} : { timeout }
 	};
 }
+/**
+* Collects the definitions of the tools an agent serves itself, as a run advertises them.
+*
+* @remarks
+* Each definition carries the name, description, and annotations `BUILTIN_TOOLS` declares and the
+* parameters of the built-in's compiled contract in `builtinToolContracts`, in the order `builtins` lists them, so
+* it equals the definition of the tool `createBuiltinTool` creates. A relay server lists these
+* among its declared definitions to forward a page's built-ins. A name that is no built-in
+* contributes nothing.
+*
+* @param options - The agent options whose `builtins` to project
+* @returns The definitions, empty when `builtins` is absent
+*
+* @example
+* ```ts
+* collectBuiltinDefinitions({ builtins: ['load', 'unload'] }).map((definition) => definition.name) // ['load', 'unload']
+* ```
+*/
+function collectBuiltinDefinitions(options) {
+	return (options.builtins ?? []).filter(isAgentBuiltin).map((name) => {
+		const declared = BUILTIN_TOOLS[name];
+		const parameters = schemaToParameters(builtinToolContracts[name].contract.schema);
+		return {
+			name,
+			description: declared.description,
+			...parameters === void 0 ? {} : { parameters },
+			...declared.annotations === void 0 ? {} : { annotations: declared.annotations }
+		};
+	});
+}
+/**
+* Returns an agent's `builtins` option as an owned, frozen list, or throws a coded error before the
+* agent is built.
+*
+* @remarks
+* `undefined` returns an empty list. The option must be an array of distinct {@link AgentBuiltin}
+* names; `unload` needs `load`, because only a loaded skill can be unloaded; and the host's tool
+* manager may hold no tool under an enabled name, because the run serves that name itself.
+*
+* @param value - The `builtins` option
+* @param tools - The host's tool manager
+* @returns The enabled names, in the order given
+* @throws {AgentError} Thrown when the option is not an array, names something that is no built-in, repeats a name, lists `unload` without `load`, or names a tool the manager holds (code `'BUILTIN'`)
+*
+* @example
+* ```ts
+* requireBuiltins(['load', 'unload'], createToolManager()) // ['load', 'unload']
+* requireBuiltins(['unload'], createToolManager()) // throws AgentError ('BUILTIN')
+* ```
+*/
+function requireBuiltins(value, tools) {
+	if (value === void 0) return Object.freeze([]);
+	if (!isArray(value)) throw new AgentError("BUILTIN", `builtins must be an array; received ${preview(value)}`);
+	const names = [...value].filter(isAgentBuiltin);
+	if (names.length !== value.length) throw new AgentError("BUILTIN", "builtins lists a name that is no built-in; list only 'load', 'unload', 'memo', 'remember', and 'switch'", { context: { received: preview(value) } });
+	if (new Set(names).size !== names.length) throw new AgentError("BUILTIN", "builtins lists a name more than once", { context: { builtins: names } });
+	if (names.includes("unload") && !names.includes("load")) throw new AgentError("BUILTIN", "builtins lists 'unload' without 'load'; add 'load' too", { context: { builtins: names } });
+	const taken = names.filter((name) => tools.tool(name) !== void 0);
+	if (taken.length > 0) throw new AgentError("BUILTIN", `the tool manager holds a tool under the built-in name ${taken.map((name) => `'${name}'`).join(", ")}; rename that tool or leave the name out of builtins`, { context: {
+		builtins: names,
+		taken
+	} });
+	return Object.freeze(names);
+}
+/**
+* Returns a `workspace` option unchanged, or throws a `ContractError` coded `'placement'`;
+* `undefined` passes through.
+*
+* @remarks
+* The check is `isString`. An id the workspace registry does not hold, or the ceiling does not
+* admit, passes here and renders nothing. The error's `context` carries the option path, the limit
+* `'string'`, and a preview of the refused value.
+*
+* @param value - The `workspace` option of an agent, a run, or a ledger's agent, or `undefined`
+* @returns The value unchanged
+* @throws {ContractError} Thrown when `value` is defined and is not a string (code `'placement'`)
+*
+* @example
+* ```ts
+* requireWorkspace('orders') // 'orders'
+* requireWorkspace(7) // throws ContractError ('placement')
+* ```
+*/
+function requireWorkspace(value) {
+	if (value === void 0 || isString(value)) return value;
+	throw new ContractError("Agent: workspace must be a string", {
+		code: "placement",
+		context: {
+			path: ["options", "workspace"],
+			limit: "string",
+			received: preview(value)
+		}
+	});
+}
+/**
+* Returns the definitions a turn advertises from the allow-list, the registered skills, and the
+* shown skills.
+*
+* @remarks
+* The allow-list admits first, as `filterAllowList` does. When no skill is passed, or an allow-list
+* admits no `load` definition, the admitted list returns as it is. Otherwise a tool any registered
+* skill names is held back unless a shown skill names it too; `load` and `unload` are never held
+* back. A caller passes the registered skills only while `load` is enabled, so with no allow-list a
+* ceiling whose empty `skills` list withholds `load` from the candidates still holds the skills'
+* tools back. Holding a tool back is presentation, never authority: a call to it is denied as
+* outside the turn's scope.
+*
+* @param definitions - The candidate definitions, in advertisement order
+* @param names - The turn's `tools` allow-list (`undefined` ⇒ all, `[]` ⇒ none)
+* @param skills - The registered skills whose `tools` gate, or none while `load` is not enabled
+* @param shown - The names of the skills the turn shows
+* @returns The advertised definitions, in candidate order
+*
+* @example
+* ```ts
+* const skills = [{ id: '1', name: 'refunds', description: 'Refunds', content: '', tools: ['refund'], files: [] }]
+* filterAdvertisedTools([{ name: 'load' }, { name: 'refund' }], undefined, skills, []) // [{ name: 'load' }]
+* filterAdvertisedTools([{ name: 'load' }, { name: 'refund' }], undefined, skills, ['refunds']).length // 2
+* ```
+*/
+function filterAdvertisedTools(definitions, names, skills, shown) {
+	const admitted = filterAllowList(names, definitions, (definition) => definition.name);
+	if (skills.length === 0) return admitted;
+	if (names !== void 0 && !admitted.some((definition) => definition.name === "load")) return admitted;
+	const held = new Set(skills.flatMap((skill) => skill.tools));
+	const visible = new Set(shown);
+	const open = new Set(skills.filter((skill) => visible.has(skill.name)).flatMap((skill) => skill.tools));
+	return admitted.filter((definition) => definition.name === "load" || definition.name === "unload" || !held.has(definition.name) || open.has(definition.name));
+}
+/**
+* Returns the definitions a run offers before the allow-list, without `remember` unless the
+* ceiling's `memos` list names a memo, without `switch` unless its `workspaces` list names a
+* workspace, and without `load` and `unload` while its `skills` list is empty.
+*
+* @remarks
+* `remember` writes and `switch` selects only a name its list holds, so an absent list and an empty
+* list each leave the built-in nothing to act on, and it is not advertised. An absent `skills` list
+* admits every registered skill, so `load` and `unload` are withheld only when the list is empty.
+* Every other definition keeps its place.
+*
+* @param definitions - The candidate definitions, in advertisement order
+* @param ceiling - The turn's ceiling
+* @returns The definitions, in candidate order
+*
+* @example
+* ```ts
+* filterBuiltinCandidates([{ name: 'memo' }, { name: 'remember' }], { memos: [] }) // [{ name: 'memo' }]
+* filterBuiltinCandidates([{ name: 'memo' }, { name: 'remember' }], { memos: ['tone'] }).length // 2
+* ```
+*/
+function filterBuiltinCandidates(definitions, ceiling) {
+	const writable = (ceiling.memos ?? []).length > 0;
+	const selectable = (ceiling.workspaces ?? []).length > 0;
+	const loadable = ceiling.skills === void 0 || ceiling.skills.length > 0;
+	return definitions.filter((definition) => (definition.name !== "remember" || writable) && (definition.name !== "switch" || selectable) && (definition.name !== "load" && definition.name !== "unload" || loadable));
+}
+/**
+* Returns the refusal that names a subject and at most `BUILTIN_LIMITS.candidates` of the names a
+* caller can use.
+*
+* @remarks
+* The subject reads after "No", so it names what the caller may use, such as `'skill you can load'`.
+* The text echoes no argument, so an absent name and a name outside the ceiling read byte for byte
+* the same. Each name is JSON-encoded and capped by `preview`, in the order given. Past the cap one
+* fixed sentence sends the reader to the index in its prompt.
+*
+* @param subject - What the caller may name, such as `'skill you can load'`
+* @param names - The names the caller can use, in registry order
+* @returns The refusal text
+*
+* @example
+* ```ts
+* describeCandidates('skill you can load', ['refunds', 'billing'])
+* // 'No skill you can load has that name. Use one of: "refunds", "billing".'
+* ```
+*/
+function describeCandidates(subject, names) {
+	if (names.length === 0) return `No ${subject} has that name, and none is available now.`;
+	return `No ${subject} has that name. Use one of: ${names.slice(0, BUILTIN_LIMITS.candidates).map((name) => preview(name)).join(", ")}.${names.length > BUILTIN_LIMITS.candidates ? " The index in your prompt lists the others." : ""}`;
+}
+/**
+* Checks whether a text is one nonblank line: it holds a code point other than white space and
+* default-ignorable code points (`ARGUMENT_BLANK_PATTERN`), and no control, format, line-separator, or
+* paragraph-separator code point (`ARGUMENT_CONTROL_PATTERN`).
+*
+* @remarks
+* The class is the one `renderArguments` encodes. A memo's name and description render in the memos
+* index one line each, so `remember` refuses a value outside this check.
+*
+* @param text - The text to check
+* @returns True if the text is one nonblank line; false otherwise
+*
+* @example
+* ```ts
+* matchesPlainLine('Reply tone') // true
+* matchesPlainLine('Reply\ntone') // false
+* matchesPlainLine('   ') // false
+* ```
+*/
+function matchesPlainLine(text) {
+	return !ARGUMENT_BLANK_PATTERN.test(text) && !ARGUMENT_CONTROL_PATTERN.test(text);
+}
+/**
+* Checks whether two ceilings carry the same lists of what a head renders: `instructions`,
+* `skills`, `memos`, `files`, and `workspaces`.
+*
+* @remarks
+* Each list compares by its members in order, and an absent list equals only an absent list,
+* because `undefined` admits everything and `[]` admits nothing. The `tools` list is not compared:
+* it reaches the tools block, never the head.
+*
+* @param left - One ceiling's lists
+* @param right - The other ceiling's lists
+* @returns True if every compared list matches; false otherwise
+*
+* @example
+* ```ts
+* matchesHeadLists({ skills: ['refunds'] }, { skills: ['refunds'], tools: [] }) // true
+* matchesHeadLists({ skills: [] }, {}) // false
+* ```
+*/
+function matchesHeadLists(left, right) {
+	return [
+		[left.instructions, right.instructions],
+		[left.skills, right.skills],
+		[left.memos, right.memos],
+		[left.files, right.files],
+		[left.workspaces, right.workspaces]
+	].every(([one, other]) => one === void 0 || other === void 0 ? one === other : one.length === other.length && one.every((key, index) => key === other[index]));
+}
+/**
+* Resolves what a turn shows: the conversation's record, and the given workspace, within the
+* ceiling and the registries.
+*
+* @remarks
+* The caller reads the ceiling, so a turn reads each scope list one time. The skills are those
+* {@link collectDisclosure} reads from the conversation, in load order, keeping each that the skill
+* registry holds and the ceiling's `skills` list admits; an unregistered or excluded name shows
+* nothing. The workspace is the conversation's last switch, else the given one, kept only when the
+* workspace registry holds it and the ceiling's `workspaces` list admits it. The record counts only
+* the built-ins in `builtins`, as {@link collectDisclosure} states.
+*
+* @param context - The agent's context, whose scope, skills, and workspaces it reads
+* @param conversation - The conversation whose record to read
+* @param workspace - The `workspace` option of the run or the agent, or `undefined`
+* @param ceiling - The ceiling the turn read: the context scope intersected with the run scope
+* @param builtins - The built-ins the run enables
+* @returns The shown skills, in order, and the shown workspace when one is
+*
+* @example
+* ```ts
+* resolveDisclosure(agent.context, agent.context.messages, 'orders', {}, []) // { skills: [], workspace: 'orders' } when orders is registered
+* ```
+*/
+function resolveDisclosure(context, conversation, workspace, ceiling, builtins) {
+	const recorded = collectDisclosure(conversation, builtins);
+	const admitted = new Set(filterAllowList(ceiling.skills, context.skills.skills(), (skill) => skill.name).map((skill) => skill.name));
+	const skills = recorded.skills.filter((name) => admitted.has(name));
+	const selected = recorded.workspace ?? workspace;
+	return selected !== void 0 && context.workspaces.workspace(selected) !== void 0 && filterAllowList(ceiling.workspaces, [selected], (id) => id).length > 0 ? {
+		skills,
+		workspace: selected
+	} : { skills };
+}
+/**
+* Collects the loaded skills and the selected workspace a conversation's stored built-in calls
+* record, counting only the built-ins a run enables.
+*
+* @remarks
+* Pure. It reads each section's retained originals, oldest first, then the live tail, and pairs
+* each tool message with the call that owns it through {@link collectToolGroups} and
+* {@link findToolCall}. It then folds the pairs in message order: a `load` whose message content
+* equals `BUILTIN_NOTES.loaded` adds its `skill`, an `unload` with `BUILTIN_NOTES.unloaded` removes
+* it, and a `switch` with `BUILTIN_NOTES.switched` selects its `workspace`. Each call's arguments
+* are admitted through the built-in's contract in `builtinToolContracts`, lossless repairs
+* included, as its tool's door admits them, so a `{ skill: 1 }` the door repaired to `'1'` counts
+* as `'1'`; arguments the contract refuses change nothing. A skill loaded again while shown keeps
+* its place, and one loaded again after its unload goes last. Any other message and a denied or
+* refused call change nothing. The result holds `workspace` only when a switch succeeded.
+*
+* A record counts only while its built-in is in `builtins`, so a host tool that holds a built-in's
+* name on a run that does not enable it shows nothing; with none of `load`, `unload`, and `switch`
+* enabled, nothing is read. A stored record cannot tell its writer, so one a host tool wrote under a
+* built-in's name while that built-in was off counts after a run enables it, bounded by the registry
+* and the ceiling as every record is.
+*
+* @param conversation - The conversation whose stored messages record the calls
+* @param builtins - The built-ins the run enables
+* @returns The skills in load order and the last selected workspace
+*
+* @example
+* ```ts
+* import { collectDisclosure, createConversation } from '@orkestrel/agent'
+*
+* collectDisclosure(createConversation(), ['load', 'unload']) // { skills: [] }
+* ```
+*/
+function collectDisclosure(conversation, builtins) {
+	const counted = new Set(builtins.filter((name) => name === "load" || name === "unload" || name === "switch"));
+	if (counted.size === 0) return { skills: [] };
+	const stored = [...conversation.sections.flatMap((section) => section.messages), ...conversation.messages()];
+	const owners = new Map(collectToolGroups(stored).flatMap((group) => group.flatMap((message) => {
+		const call = findToolCall(group, message);
+		return call === void 0 ? [] : [[message, call]];
+	})));
+	return stored.reduce((shown, message) => {
+		const call = owners.get(message);
+		const name = call?.name;
+		if (call === void 0 || !isAgentBuiltin(name) || !counted.has(name)) return shown;
+		const note = name === "load" ? BUILTIN_NOTES.loaded : name === "unload" ? BUILTIN_NOTES.unloaded : BUILTIN_NOTES.switched;
+		if (message.content !== note) return shown;
+		const admitted = admitValue(builtinToolContracts[name].contract, { ...call.arguments });
+		const skill = admitted.success ? admitted.value.value["skill"] : void 0;
+		const workspace = admitted.success ? admitted.value.value["workspace"] : void 0;
+		if (name === "load") return !isString(skill) || shown.skills.includes(skill) ? shown : {
+			...shown,
+			skills: [...shown.skills, skill]
+		};
+		if (name === "unload") return !isString(skill) ? shown : {
+			...shown,
+			skills: shown.skills.filter((one) => one !== skill)
+		};
+		return !isString(workspace) ? shown : {
+			skills: shown.skills,
+			workspace
+		};
+	}, { skills: [] });
+}
+// src/core/agents/AgentRun.ts
+/**
+* Holds one agent run's own tools and the view its turns and builds share: the ceiling a turn
+* read, what it shows, what it advertises, and what the working head was built with.
+*
+* @remarks
+* `Agent` creates one per run, so no public signature names this class. The run's built-in tools
+* live in a tool manager the run owns and never changes after construction, so a tool a host
+* registers under a built-in's name is never read: `tool` and `execute` answer a built-in's name
+* from the run's manager and every other name from the host's. Each handler reads the ceiling when
+* it runs, the context scope intersected with the run scope at that moment, never a turn's copy.
+* The `caller` each call receives reads the ceiling the same way, as the call starts.
+*/
+var AgentRun = class {
+	#context;
+	#conversation;
+	#scope;
+	#workspace;
+	#enabled;
+	#builtins;
+	#tools;
+	#ceiling = {};
+	#shown = { skills: [] };
+	#ids = [];
+	#files = [];
+	#advertised = [];
+	#snapshot;
+	#selection;
+	#length = 0;
+	#head;
+	/**
+	* Creates the run's own tools for the enabled built-ins.
+	*
+	* @param context - The agent's context
+	* @param conversation - The conversation the run is bound to
+	* @param scope - The run scope, or `undefined`
+	* @param workspace - The workspace the run renders in place of the active one, already checked, or `undefined`
+	* @param builtins - The enabled built-ins, already checked
+	*/
+	constructor(context, conversation, scope, workspace, builtins) {
+		this.#context = context;
+		this.#conversation = conversation;
+		this.#scope = scope;
+		this.#workspace = workspace;
+		this.#enabled = builtins;
+		this.#builtins = new Set(builtins);
+		this.#tools = createToolManager();
+		this.#tools.add(builtins.map((name) => createBuiltinTool(name, (args) => this.#handle(name, args))));
+	}
+	/**
+	* Returns the conversation the run is bound to.
+	*
+	* @returns The conversation
+	*/
+	get conversation() {
+		return this.#conversation;
+	}
+	/**
+	* Returns the run scope.
+	*
+	* @returns The scope, or undefined when the run has none
+	*/
+	get scope() {
+		return this.#scope;
+	}
+	/**
+	* Returns an owned scope holding the run scope's lists as the last `observe` read them, so a build
+	* renders by the turn's one read and never reads the run scope again.
+	*
+	* @returns The owned scope, or undefined when the run has none
+	*/
+	get snapshot() {
+		return this.#snapshot;
+	}
+	/**
+	* Returns the ceiling the last `observe` read: the context scope intersected with the run scope.
+	*
+	* @returns The ceiling's lists
+	*/
+	get ceiling() {
+		return this.#ceiling;
+	}
+	/**
+	* Returns the definitions the last `observe` advertised.
+	*
+	* @returns The advertised definitions
+	*/
+	get advertised() {
+		return this.#advertised;
+	}
+	/**
+	* Returns what a build renders from the last `observe`: the shown skills and workspace, or
+	* undefined when it shows neither.
+	*
+	* @returns The shown value, or undefined
+	*/
+	get disclosure() {
+		return this.#shown.skills.length === 0 && this.#shown.workspace === void 0 ? void 0 : this.#shown;
+	}
+	/**
+	* Returns whether the last `observe` advertised `switch`, which lists the workspaces in the head.
+	*
+	* @returns True if `switch` is advertised; false otherwise
+	*/
+	get switchable() {
+		return this.#advertised.some((definition) => definition.name === "switch");
+	}
+	/**
+	* Returns what a tool call receives as `ToolContext.caller`: the workspace instance the working
+	* head rendered, kept only while the ceiling at this moment admits its id, and that ceiling's
+	* `files` list.
+	*
+	* @remarks
+	* The instance is the one the head's build resolved, never the registry's `active` pointer at the
+	* call, so a host's `switch` made while the provider answers reaches the next turn's head and not
+	* this call. Each read of this getter reads the `workspaces` and `files` lists of the context
+	* scope and the run scope one time each, and no other list, so a call reads them as it starts, a
+	* narrowing made after the turn's decision reaches that call, and a turn still reads its `tools`
+	* list once.
+	*
+	* @returns A fresh caller
+	*/
+	get caller() {
+		const outer = this.#context.scope;
+		const inner = this.#scope;
+		const rendered = this.#head?.rendered;
+		const [workspace] = filterAllowList(intersectKeys(outer?.workspaces, inner?.workspaces), rendered === void 0 ? [] : [rendered], (one) => one.id);
+		return {
+			workspace,
+			files: intersectKeys(outer?.files, inner?.files)
+		};
+	}
+	/**
+	* Returns the selection the working head rendered.
+	*
+	* @returns The selection, or undefined before the first build
+	*/
+	get selection() {
+		return this.#selection;
+	}
+	/**
+	* Returns the length of the array the working head was built as.
+	*
+	* @returns The length, 0 before the first build
+	*/
+	get length() {
+		return this.#length;
+	}
+	/**
+	* Reads the ceiling, resolves what the run shows within it, and computes what it advertises.
+	*
+	* @remarks
+	* The ceiling's lists are each read one time. The conversation's record is read only while
+	* `load`, `unload`, or `switch` is enabled, and only the records of an enabled built-in count.
+	* Registered skills hold their tools back only while `load` is enabled. The view compared with
+	* the working head's is the ceiling's `instructions`, `skills`, `memos`, `files`, and
+	* `workspaces` lists, the shown skills by id, the shown workspace, the files that workspace
+	* renders under the ceiling's `files` list, compared by identity, and whether `switch` is
+	* advertised. An edit to a rendered file, by a tool or by the host, therefore makes the head
+	* stale, and an edit to a file no build renders does not.
+	*
+	* @returns True if the working head was built with another view and must be rebuilt; false otherwise
+	*/
+	observe() {
+		const lists = this.#scope === void 0 ? void 0 : intersectFilters(void 0, this.#scope);
+		const ceiling = intersectFilters(this.#context.scope, lists);
+		this.#snapshot = lists === void 0 ? void 0 : createScope({
+			name: "run",
+			...lists
+		});
+		const shown = resolveDisclosure(this.#context, this.#conversation, this.#workspace, ceiling, this.#enabled);
+		this.#ceiling = ceiling;
+		this.#shown = shown;
+		this.#ids = shown.skills.flatMap((name) => this.#context.skills.skill(name)?.id ?? []);
+		this.#files = filterAllowList(ceiling.files, resolveWorkspace(this.#context.workspaces, shown.workspace, ceiling.workspaces)?.files() ?? [], (file) => file.path);
+		this.#advertised = filterAdvertisedTools(this.#candidates(ceiling), ceiling.tools, this.#builtins.has("load") ? this.#context.skills.skills() : [], shown.skills);
+		const head = this.#head;
+		return head === void 0 || !matchesHeadLists(head.ceiling, ceiling) || head.ids.length !== this.#ids.length || head.ids.some((id, index) => id !== this.#ids[index]) || head.workspace !== shown.workspace || head.switchable !== this.switchable || head.files.length !== this.#files.length || head.files.some((file, index) => file !== this.#files[index]);
+	}
+	/**
+	* Records what the working head was built with: the selection, the built array's length, the
+	* view the last `observe` resolved, and the workspace instance the build rendered.
+	*
+	* @remarks
+	* Call it right after the build: it resolves the rendered workspace from the inputs the build
+	* read, the shown workspace and the context scope's `workspaces` list intersected with the
+	* snapshot's.
+	*
+	* @param selection - The selection the build rendered
+	* @param length - The length of the built array
+	*/
+	record(selection, length) {
+		this.#selection = selection;
+		this.#length = length;
+		this.#head = {
+			ceiling: this.#ceiling,
+			ids: this.#ids,
+			workspace: this.#shown.workspace,
+			switchable: this.switchable,
+			files: this.#files,
+			rendered: resolveWorkspace(this.#context.workspaces, this.#shown.workspace, intersectKeys(this.#context.scope?.workspaces, this.#snapshot?.workspaces))
+		};
+	}
+	/**
+	* Finds the tool a call names: the run's own for a built-in's name, the host's for any other.
+	*
+	* @param name - The tool name
+	* @returns The tool, or undefined when none is registered under the name
+	*/
+	tool(name) {
+		return this.#builtins.has(name) ? this.#tools.tool(name) : this.#context.tools.tool(name);
+	}
+	/**
+	* Executes one call through the run's manager for a built-in's name, and the host's for any other.
+	*
+	* @param call - The call to execute
+	* @param context - The execution context
+	* @returns The correlated result
+	*/
+	execute(call, context) {
+		return this.#builtins.has(call.name) ? this.#tools.execute(call, context) : this.#context.tools.execute(call, context);
+	}
+	#candidates(ceiling) {
+		return [...this.#context.tools.definitions().filter((one) => !this.#builtins.has(one.name)), ...filterBuiltinCandidates(this.#tools.definitions(), ceiling)];
+	}
+	#live() {
+		return intersectFilters(this.#context.scope, this.#scope);
+	}
+	#handle(name, args) {
+		switch (name) {
+			case "load": return this.#load(args.skill);
+			case "unload": return this.#unload(args.skill);
+			case "memo": return this.#memo(args.name);
+			case "remember": return this.#remember(args.name, args.description, args.content);
+			case "switch": return this.#switch(args.workspace);
+		}
+	}
+	#load(skill) {
+		const admitted = filterAllowList(this.#live().skills, this.#context.skills.skills(), (one) => one.name).map((one) => one.name);
+		if (!isString(skill) || !admitted.includes(skill)) throw new ToolError("ARGUMENTS", describeCandidates("skill you can load", admitted));
+		return BUILTIN_NOTES.loaded;
+	}
+	#unload(skill) {
+		const loaded = collectDisclosure(this.#conversation, this.#enabled).skills;
+		if (!isString(skill) || !loaded.includes(skill)) throw new ToolError("ARGUMENTS", describeCandidates("skill you loaded", loaded));
+		return BUILTIN_NOTES.unloaded;
+	}
+	#memo(name) {
+		const admitted = filterAllowList(this.#live().memos, this.#context.memos.memos(), (one) => one.name);
+		const memo = admitted.find((one) => one.name === name);
+		if (memo === void 0) throw new ToolError("ARGUMENTS", describeCandidates("memo you can read", admitted.map((one) => one.name)));
+		return memo.content;
+	}
+	#remember(name, description, content) {
+		const allowed = this.#live().memos;
+		if (allowed === void 0 || allowed.length === 0) throw new ToolError("ARGUMENTS", "No memo can be written here: the host lists no memo name you may write. Continue without saving it.");
+		if (!isString(name) || !allowed.includes(name)) throw new ToolError("ARGUMENTS", describeCandidates("memo you may write", allowed));
+		if (!isString(description) || !isString(content)) throw new ToolError("ARGUMENTS", "Send description and content as text.");
+		if (!matchesPlainLine(name) || !matchesPlainLine(description)) throw new ToolError("ARGUMENTS", "The name and the description must each be one line of visible text, with no line break or control character. Send them again on one line.");
+		const current = this.#context.memos.memo(name);
+		if (current !== void 0 && current.origin?.conversation !== this.#conversation.id) throw new ToolError("ARGUMENTS", "A memo with that name exists and this conversation did not write it, so it stays as it is. Read it with memo, or write a name you created.");
+		this.#context.memos.add({
+			name,
+			description,
+			content,
+			origin: { conversation: this.#conversation.id }
+		});
+		return BUILTIN_NOTES.remembered;
+	}
+	#switch(workspace) {
+		const allowed = this.#live().workspaces;
+		if (allowed === void 0 || allowed.length === 0) throw new ToolError("ARGUMENTS", "No workspace can be selected here: the host lists no workspace you may select. Continue with the workspace you have.");
+		const admitted = filterAllowList(allowed, this.#context.workspaces.workspaces(), (one) => one.id).map((one) => one.id);
+		if (!isString(workspace) || !admitted.includes(workspace)) throw new ToolError("ARGUMENTS", describeCandidates("workspace you can select", admitted));
+		return BUILTIN_NOTES.switched;
+	}
+};
+// src/core/agents/ChannelCell.ts
+/**
+* Holds one value a `Channel` buffers and the cell pushed after it.
+*
+* @remarks
+* A `Channel` keeps its unread values as a chain of these cells, from its `#head` cell to its
+* `#tail` cell, so no public signature names this class. The `#next` field is a latch: the
+* `link` method sets it once, and a later call keeps the first cell.
+*/
+var ChannelCell = class {
+	#value;
+	#next;
+	/**
+	* Holds a value with no next cell.
+	*
+	* @param value - The value the cell holds
+	*/
+	constructor(value) {
+		this.#value = value;
+	}
+	/**
+	* Returns the value the cell holds.
+	*
+	* @returns The value
+	*/
+	get value() {
+		return this.#value;
+	}
+	/**
+	* Returns the cell pushed after this one.
+	*
+	* @returns The next cell, or undefined before one is linked
+	*/
+	get next() {
+		return this.#next;
+	}
+	/**
+	* Links the cell pushed after this one, once.
+	*
+	* @param cell - The cell pushed after this one
+	*/
+	link(cell) {
+		this.#next ??= cell;
+	}
+};
+// src/core/agents/Channel.ts
+/**
+* Buffers chunks in a minimal unbounded async channel — the eager pump writes them in (`push`)
+* and ends it (`close` / `fail`) regardless of consumption, while a consumer reads them back live
+* through the `drain` async-iterator. Decoupling write from read is what lets a producer make
+* progress without a consumer pulling, and it is why an agent's `result` settles whether or not
+* its `events` are drained.
+*
+* @remarks
+* A waiting `drain` call parks its void resolver in the `#waiting` field. The `push` method links a
+* cell after the `#tail` cell, and the `close` and `fail` methods flag the end; each then fires and
+* clears every parked resolver, so each parked reader wakes, reads the `#head` cell, and either
+* takes the next chunk, returns (on `close`), throws (on `fail`), or parks again when another
+* reader took the chunk first. Taking a chunk reads its value and moves `#head` to the next cell
+* synchronously, so each value reaches exactly one reader, a push and a take each cost constant
+* time, and every taken cell but the newest is released at once; the `#tail` field holds the newest
+* cell until the next push links after it, so a channel retains at most one taken value. A reader
+* suspended at its `yield` expression holds only the value it took, never a cell, so the bound on
+* retained values covers both the channel's fields and a suspended reader.
+* A `return()` issued while a read is parked waits for the next `push`, `close`, or `fail`.
+* The parked read takes a pushed value before that `return()` settles.
+*
+* @example
+* ```ts
+* import { Channel } from '@orkestrel/agent'
+*
+* const channel = new Channel<number>()
+* channel.push(1)
+* channel.close()
+* for await (const value of channel.drain()) {
+* 	value // 1
+* }
+* ```
+*/
+var Channel = class {
+	#head;
+	#tail;
+	#waiting = [];
+	#closed = false;
+	#failure;
+	push(value) {
+		const cell = new ChannelCell(value);
+		this.#tail?.link(cell);
+		this.#tail = cell;
+		this.#head ??= cell;
+		this.#signal();
+	}
+	close() {
+		this.#closed = true;
+		this.#signal();
+	}
+	fail(error) {
+		if (this.#failure === void 0) this.#failure = { error };
+		this.#closed = true;
+		this.#signal();
+	}
+	async *drain() {
+		for (;;) {
+			while (this.#head !== void 0) {
+				const value = this.#head.value;
+				this.#head = this.#head.next;
+				yield value;
+			}
+			if (this.#failure !== void 0) throw this.#failure.error;
+			if (this.#closed) return;
+			await this.#park();
+		}
+	}
+	#signal() {
+		const waiting = this.#waiting;
+		this.#waiting = [];
+		for (const wake of waiting) wake();
+	}
+	#park() {
+		return new Promise((resolve) => {
+			this.#waiting = [...this.#waiting, resolve];
+		});
+	}
+};
 // src/core/agents/Agent.ts
 /**
 * Composes a {@link ProviderInterface}, an {@link AgentContext}, and a
@@ -7546,9 +9123,12 @@ var Agent = class {
 	#window;
 	#strict;
 	#emitter;
+	#builtins;
+	#workspace;
 	#settled = "idle";
 	#runs = /* @__PURE__ */ new Map();
 	constructor(provider, options) {
+		refuseOptionKeys(options, AGENT_OPTION_KEYS, "Agent", "AgentOptions");
 		if (options?.tools !== void 0 && options.authority === void 0) throw new AgentError("AUTHORITY", "tools are set and no authority is; pass authority: createAuthority({ fallback: { zone: 'default', verdict: 'allow' } }) to allow every call, or rules with a deny fallback");
 		this.#limit = requireLimit(options?.limit ?? 10);
 		this.#id = crypto.randomUUID();
@@ -7565,6 +9145,9 @@ var Agent = class {
 			...options?.conversations === void 0 ? {} : { conversations: options.conversations },
 			...options?.select === void 0 ? {} : { select: options.select }
 		});
+		this.#builtins = requireBuiltins(options?.builtins, this.#context.tools);
+		if (this.#builtins.length > 0 && options?.authority === void 0) throw new AgentError("AUTHORITY", "builtins are set and no authority is; pass authority: createAuthority({ fallback: { zone: 'default', verdict: 'allow' } }) to allow every call, or rules with a deny fallback");
+		this.#workspace = requireWorkspace(options?.workspace);
 		this.#timeoutMs = options?.timeout;
 		this.#budget = options?.budget;
 		this.#allowance = options?.allowance;
@@ -7591,6 +9174,7 @@ var Agent = class {
 		return this.stream(options).result;
 	}
 	stream(options) {
+		refuseOptionKeys(options, AGENT_RUN_KEYS, "Agent", "AgentRunOptions");
 		const prompt = options?.prompt;
 		if (prompt !== void 0 && !agentPromptContract.is(prompt)) {
 			const faults = attempt(() => describeFaults(agentPromptContract.audit(prompt), agentPromptContract.schema));
@@ -7603,11 +9187,13 @@ var Agent = class {
 				}
 			});
 		}
+		const workspace = requireWorkspace(options?.workspace) ?? this.#workspace;
 		const limit = options?.limit === void 0 ? this.#limit : requireLimit(options.limit);
 		const budget = requireBudget(options?.budget ?? this.#budget, "budget");
 		const allowance = requireBudget(options?.allowance ?? this.#allowance, "allowance");
 		const held = [budget, allowance].filter((one, index, all) => one !== void 0 && all.indexOf(one) === index);
 		if (this.#runs.size > 0 && (this.#window !== void 0 || [...this.#runs.values()].some((live) => live.budgets.some((one) => held.includes(one))))) throw new AgentError("CONCURRENCY", "a live run on this agent holds the window or this budget or allowance instance; use separate agents or distinct instances per run", { context: { agent: this.#id } });
+		const scope = requireScope(options?.scope);
 		const conversation = requireConversation(options?.conversation) ?? this.#context.messages;
 		if ([...this.#runs.values()].some((live) => live.conversation === conversation)) throw new AgentError("CONCURRENCY", "a live run on this agent holds this conversation; await it or bind the run to another conversation", { context: {
 			agent: this.#id,
@@ -7631,7 +9217,8 @@ var Agent = class {
 		this.#emitter.emit("start", this.id);
 		const channel = new Channel();
 		const settled = Promise.withResolvers();
-		this.#drive(abort, conversation, channel, options?.think, options?.schema, limit, budget, allowance).then((outcome) => this.#finish(abort, timeout, channel, settled, limit, outcome), (error) => this.#fail(abort, timeout, channel, settled, error));
+		const run = new AgentRun(this.#context, conversation, scope, workspace, this.#builtins);
+		this.#drive(abort, run, channel, options?.think, options?.schema, limit, budget, allowance).then((outcome) => this.#finish(abort, timeout, channel, settled, limit, outcome), (error) => this.#fail(abort, timeout, channel, settled, error));
 		settled.promise.catch(() => {});
 		return {
 			events: this.#drainEvents(channel, abort),
@@ -7661,10 +9248,10 @@ var Agent = class {
 		settled.reject(error);
 		this.#emitter.emit("error", error);
 	}
-	async #drive(abort, conversation, channel, think, schema, limit, budget, allowance) {
-		const run = this.#execute(abort, conversation, think, schema, limit, budget, allowance);
+	async #drive(abort, run, channel, think, schema, limit, budget, allowance) {
+		const steps = this.#execute(abort, run, think, schema, limit, budget, allowance);
 		for (;;) {
-			const next = await run.next();
+			const next = await steps.next();
 			if (next.done === true) return next.value;
 			channel.push(next.value);
 		}
@@ -7676,15 +9263,16 @@ var Agent = class {
 			abort.abort();
 		}
 	}
-	async *#execute(abort, conversation, think, schema, limit, budget, allowance) {
+	async *#execute(abort, run, think, schema, limit, budget, allowance) {
+		const conversation = run.conversation;
 		const last = conversation.view().at(-1);
 		const request = last?.role === "user" ? last : void 0;
-		const selection = this.#select(conversation, request, abort, budget);
+		run.observe();
+		const selection = this.#select(run, request, abort, budget);
 		const entry = selection === void 0 ? {
-			messages: this.#build(conversation),
+			messages: this.#build(run),
 			usage: void 0
 		} : await selection;
-		const tools = this.#context.tools;
 		const options = think === void 0 && schema === void 0 ? void 0 : {
 			...think === void 0 ? {} : { think },
 			...schema === void 0 ? {} : { schema }
@@ -7693,14 +9281,14 @@ var Agent = class {
 		const turns = [];
 		while (turns.length < limit && (turns.at(-1)?.outcome ?? "tools") === "tools") {
 			const index = turns.length;
-			const base = turns.at(-1)?.messages ?? entry.messages;
+			const prior = turns.at(-1)?.messages ?? entry.messages;
 			const futile = turns.at(-1)?.futile ?? false;
 			const stopped = {
 				content: "",
 				thinking: void 0,
 				usage: void 0,
 				spent: void 0,
-				messages: base,
+				messages: prior,
 				outcome: "cancel",
 				partial: true,
 				futile,
@@ -7719,9 +9307,10 @@ var Agent = class {
 				turns.push(stopped);
 				continue;
 			}
-			const names = this.#context.scope?.tools?.slice();
-			const advertised = filterAllowList(names, tools.definitions(), (definition) => definition.name);
-			const held = new Map(advertised.map((definition) => [definition.name, tools.tool(definition.name)]));
+			const base = run.observe() ? this.#refresh(run, prior) : prior;
+			const names = run.ceiling.tools;
+			const advertised = run.advertised;
+			const held = new Map(advertised.map((definition) => [definition.name, run.tool(definition.name)]));
 			const definitions = advertised.length > 0 ? advertised : void 0;
 			const composed = this.#compose(base, definitions, options);
 			const admitted = this.#window === void 0 ? {
@@ -7729,7 +9318,7 @@ var Agent = class {
 				messages: base,
 				spent: void 0,
 				futile
-			} : await this.#admit(this.#window, conversation, composed, base, request, index > 0, futile, abort, budget);
+			} : await this.#admit(this.#window, run, composed, base, request, index > 0, futile, abort, budget);
 			if (admitted.dispatch === void 0) {
 				turns.push({
 					...stopped,
@@ -7739,12 +9328,25 @@ var Agent = class {
 				});
 				continue;
 			}
+			const dispatch = admitted.dispatch;
+			Object.freeze(dispatch.messages);
+			if (dispatch.tools !== void 0) Object.freeze(dispatch.tools);
+			this.#emitter.emit("request", index, Object.freeze(dispatch), conversation);
+			if (abort.signal.aborted) {
+				turns.push({
+					...stopped,
+					messages: admitted.messages,
+					spent: admitted.spent,
+					futile: admitted.futile
+				});
+				continue;
+			}
 			const streamed = [];
 			const meter = allowance === void 0 ? void 0 : createTokenMeter({
 				budget: allowance,
 				estimator: estimateTokens
 			});
-			const provided = yield* this.#provide(admitted.dispatch, abort.signal, streamed, meter);
+			const provided = yield* this.#provide(dispatch, abort.signal, streamed, meter);
 			const settled = this.#reconcile(provided, abort, streamed, admitted, meter, budget, allowance);
 			if (!provided.success) {
 				turns.push({
@@ -7767,8 +9369,8 @@ var Agent = class {
 			if (result.tools !== void 0 && result.tools.length > 0) {
 				const admittedCalls = filterAllowList(names, result.tools, (call) => call.name);
 				const authorization = this.#authorize(result.tools, admittedCalls, advertised, held);
-				if (authorization.asked.length > 0 && !abort.signal.aborted) yield* this.#approve(tools, authorization, abort.signal);
-				if (!abort.signal.aborted) this.#confirm(tools, authorization, advertised);
+				if (authorization.asked.length > 0 && !abort.signal.aborted) yield* this.#approve(run, authorization, abort.signal);
+				if (!abort.signal.aborted) this.#confirm(run, authorization, advertised);
 				if (abort.signal.aborted) {
 					turns.push({
 						...settled,
@@ -7783,7 +9385,7 @@ var Agent = class {
 					calls: result.tools,
 					...recorded
 				});
-				const results = await this.#dispatch(tools, result.tools, abort.signal, authorization, advertised);
+				const results = await this.#dispatch(run, result.tools, abort.signal, authorization, advertised);
 				const replies = [];
 				for (const [position, call] of result.tools.entries()) {
 					const dispatched = results[position];
@@ -7879,11 +9481,11 @@ var Agent = class {
 	#compose(messages, tools, options) {
 		return {
 			messages: [...stripThinking(messages, this.#replay)],
-			...tools === void 0 ? {} : { tools },
+			...tools === void 0 ? {} : { tools: [...tools] },
 			...options === void 0 ? {} : { options }
 		};
 	}
-	async #admit(window, conversation, composed, messages, request, latch, futile, abort, budget) {
+	async #admit(window, run, composed, messages, request, latch, futile, abort, budget) {
 		window.clear();
 		window.consume(composed);
 		if (!window.exhausted) return {
@@ -7898,15 +9500,16 @@ var Agent = class {
 			spent: void 0,
 			futile
 		};
+		const conversation = run.conversation;
 		if (!conversation.summarizable || futile) return {
 			dispatch: this.#enforce(window, composed),
 			messages,
 			spent: void 0,
 			futile
 		};
-		return conversation.compact({ signal: abort.signal }).then((section) => this.#refold(section, window, conversation, composed, messages, request, latch, abort, budget), (error) => this.#unfold(error, composed, messages, abort));
+		return conversation.compact({ signal: abort.signal }).then((section) => this.#refold(section, window, run, composed, messages, request, latch, abort, budget), (error) => this.#unfold(error, composed, messages, abort));
 	}
-	async #refold(section, window, conversation, composed, messages, request, latch, abort, budget) {
+	async #refold(section, window, run, composed, messages, request, latch, abort, budget) {
 		if (abort.signal.aborted) return {
 			dispatch: void 0,
 			messages,
@@ -7919,9 +9522,9 @@ var Agent = class {
 			spent: void 0,
 			futile: latch
 		};
-		const selection = this.#select(conversation, request, abort, budget);
+		const selection = this.#select(run, request, abort, budget);
 		const rebuilt = selection === void 0 ? {
-			messages: this.#build(conversation),
+			messages: this.#build(run),
 			usage: void 0
 		} : await selection;
 		if (abort.signal.aborted) return {
@@ -7970,47 +9573,61 @@ var Agent = class {
 		} });
 		return request;
 	}
-	#select(conversation, request, abort, budget) {
-		const pending = request === void 0 ? void 0 : this.#context.select(conversation, request, abort.signal);
-		return pending === void 0 ? void 0 : pending.then((selection) => this.#adopt(conversation, selection, abort, budget), (error) => this.#reject(conversation, error, abort));
+	#select(run, request, abort, budget) {
+		const pending = request === void 0 ? void 0 : this.#context.select(run.conversation, request, abort.signal, run.scope);
+		return pending === void 0 ? void 0 : pending.then((selection) => this.#adopt(run, selection, abort, budget), (error) => this.#reject(run, error, abort));
 	}
-	#adopt(conversation, selection, abort, budget) {
+	#adopt(run, selection, abort, budget) {
 		const usage = selection.usage === void 0 ? void 0 : sanitizeUsage(selection.usage);
 		if (usage !== void 0) chargeUsage(budget, usage, 0);
 		if (abort.signal.aborted) return {
-			messages: this.#build(conversation),
+			messages: this.#build(run),
 			usage
 		};
 		if (selection.fault !== void 0) {
 			this.#emitter.emit("fault", selection.fault);
 			if (abort.signal.aborted) return {
-				messages: this.#build(conversation),
+				messages: this.#build(run),
 				usage
 			};
 			if (this.#strict) throw selection.fault;
 		}
-		const messages = this.#build(conversation, selection);
+		const messages = this.#build(run, selection);
 		this.#emitter.emit("select", selection);
 		return {
 			messages,
 			usage
 		};
 	}
-	#reject(conversation, error, abort) {
+	#reject(run, error, abort) {
 		if (!abort.signal.aborted) {
 			this.#emitter.emit("fault", error);
 			if (this.#strict && !abort.signal.aborted) throw error;
 		}
 		return {
-			messages: this.#build(conversation),
+			messages: this.#build(run),
 			usage: void 0
 		};
 	}
-	#build(conversation, selection) {
-		return this.#context.build(selection ?? {
-			messages: conversation.view(),
+	#build(run, selection) {
+		const rendered = selection ?? {
+			messages: run.conversation.view(),
 			judgments: []
+		};
+		const scope = run.snapshot;
+		const disclosure = run.disclosure;
+		const messages = this.#context.build({
+			selection: rendered,
+			...scope === void 0 ? {} : { scope },
+			...disclosure === void 0 ? {} : { disclosure },
+			...run.switchable ? { switchable: true } : {}
 		});
+		run.record(rendered, messages.length);
+		return messages;
+	}
+	#refresh(run, messages) {
+		const added = messages.slice(run.length);
+		return [...this.#build(run, run.selection), ...added];
 	}
 	#authorize(calls, admitted, advertised, held) {
 		const allowed = /* @__PURE__ */ new Map();
@@ -8083,7 +9700,7 @@ var Agent = class {
 		}
 		return success(evaluated.value);
 	}
-	async *#approve(tools, authorization, signal) {
+	async *#approve(run, authorization, signal) {
 		const authority = this.#authority;
 		for (const { index, call, decision, tool } of authorization.asked) {
 			if (signal.aborted) return;
@@ -8112,7 +9729,7 @@ var Agent = class {
 			};
 			const outcome = await raceSignal(answer, signal).catch(() => void 0);
 			if (outcome === void 0 || signal.aborted) return;
-			if (outcome.approved && tools.tool(call.name) === tool) {
+			if (outcome.approved && run.tool(call.name) === tool) {
 				authorization.allowed.set(index, {
 					call,
 					tool
@@ -8124,29 +9741,32 @@ var Agent = class {
 			}
 		}
 	}
-	#changed(tools, call, tool, advertised) {
+	#changed(run, call, tool, advertised) {
 		const same = attempt(() => {
-			const current = tools.tool(call.name);
+			const current = run.tool(call.name);
 			const definition = advertised.find((entry) => entry.name === call.name);
 			return current === tool && current?.annotations?.consequential === true === (definition?.annotations?.consequential === true);
 		});
 		return !same.success || !same.value;
 	}
-	#confirm(tools, authorization, advertised) {
+	#confirm(run, authorization, advertised) {
 		for (const [index, { call, tool }] of authorization.allowed) {
-			if (!this.#changed(tools, call, tool, advertised)) continue;
+			if (!this.#changed(run, call, tool, advertised)) continue;
 			authorization.allowed.delete(index);
 			authorization.denials.set(index, denyCall(call, AUTHORITY_NOTES.denied));
 			this.#emitter.emit("deny", call, `${call.name} changed after its decision`, void 0);
-			this.#confirm(tools, authorization, advertised);
+			this.#confirm(run, authorization, advertised);
 			return;
 		}
 	}
-	async #dispatch(tools, calls, signal, authorization, advertised) {
+	async #dispatch(run, calls, signal, authorization, advertised) {
 		const { allowed, denials } = authorization;
 		const entries = [...allowed].sort(([left], [right]) => left - right);
 		const started = entries.map(([, { call, tool }]) => {
-			if (!this.#changed(tools, call, tool, advertised)) return tools.execute(call, { signal });
+			if (!this.#changed(run, call, tool, advertised)) return run.execute(call, {
+				signal,
+				caller: run.caller
+			});
 			this.#emitter.emit("deny", call, `${call.name} changed after its decision`, void 0);
 			return denyCall(call, AUTHORITY_NOTES.denied);
 		});
@@ -8215,6 +9835,17 @@ var Agent = class {
 * awaited inline, so a bounded runner frees the parent's slot for them. `createAgentRunner`
 * creates one instance per runner and binds its `execute` method as the runner's handler.
 *
+* A child job runs within its parent. Before a unit spawns or runs, on every attempt, the
+* `execute` method walks the whole tree under it through the `scanJobTree` helper and refuses the
+* unit when any job exceeds its own parent on `tools`, `builtins`, `scope`, `authority`,
+* `provider`, `scheduler`, `limit`, `timeout`, or `budget`, or when a job is malformed or its build
+* would refuse it (the lines `collectJobRefusals` returns), so nothing in a refused tree spawns, builds,
+* or runs. A child's `workspace` is free, because it renders nothing its own `scope`
+* omits. Each child is held within its parent alone, so the children of one parent can together
+* spend more than it. A job that needs another provider, another authority, a skill, memo,
+* workspace, or built-in its parent lacks, or more room than its parent is a root job the host
+* enqueues.
+*
 * @example
 * ```ts
 * import type { AgentJobInput, ProviderInterface } from '@orkestrel/agent'
@@ -8244,14 +9875,32 @@ var AgentFanout = class {
 		this.#partial = partial;
 	}
 	/**
-	* Executes one unit: spawns its declared children unless an earlier attempt of the unit already
-	* did, then runs the rehydrated agent and settles it under the partial policy.
+	* Executes one unit: refuses its tree when a job in it is malformed or exceeds its parent, spawns
+	* its declared children unless an earlier attempt of the unit already did, then runs the
+	* rehydrated agent and settles it under the partial policy.
+	*
+	* @remarks
+	* The check runs on every attempt, before the unit spawns or runs, and throws synchronously. The
+	* error's message opens with the rule each kind of finding breaks, a refused job's rule when a
+	* finding opens with `JOB_REFUSAL_PREFIX` and the within-parent rule when a finding names an
+	* exceeded member, then lists every finding, one a line. Its `context.findings` holds the same
+	* findings in walk order.
 	*
 	* @param controller - The runner controller for this unit's attempt
 	* @returns The settled agent result of the unit
+	* @throws {AgentError} Thrown with code `'REGISTRY'` when a job in the unit's tree is malformed or exceeds its parent, or when the registry cannot rehydrate the unit
 	* @throws {AgentJobError} Thrown when the run ended partial and the partial policy is `false`
 	*/
 	execute(controller) {
+		const findings = scanJobTree(controller.input);
+		if (findings.length > 0) {
+			const refused = findings.filter((finding) => finding.startsWith(JOB_REFUSAL_PREFIX));
+			throw new AgentError("REGISTRY", [
+				...refused.length === 0 ? [] : ["every job in a tree must be readable, hold only the declared members of AgentJobInput, and build under its parent; correct each job a following finding names"],
+				...refused.length === findings.length ? [] : ["a child job must stay within its parent on tools, builtins, scope, authority, provider, scheduler, limit, timeout, and budget; enqueue a job that needs more as a root job"],
+				...findings
+			].join("\n"), { context: { findings } });
+		}
 		const children = controller.input.children;
 		if (children !== void 0 && !this.#spawned.has(controller.id)) {
 			this.#spawned = /* @__PURE__ */ new Set([...this.#spawned, controller.id]);
@@ -8305,6 +9954,7 @@ var Authority = class {
 	#handler;
 	constructor(options) {
 		this.#fallback = requireFallback(options);
+		refuseOptionKeys(options, AUTHORITY_OPTION_KEYS, "Authority", "AuthorityOptions");
 		this.#rules = requireRules(options.rules);
 		this.#handler = options.ask;
 	}
@@ -8427,16 +10077,22 @@ var Approver = class {
 *   the message `unknown <category>: <name>` when it is absent — an unknown name in a
 *   rehydrated job is a programmer / config error that must fail loudly at build time, never
 *   silently resolve to `undefined` and run an agent missing a dependency.
-* - **`build` rehydrates.** Resolve the job's `provider`; assemble a fresh
-*   {@link ToolManager} from the `tools` names, which refuses with `code: 'REGISTRY'` when the job
-*   names no `authority`; rebuild the token `budget` from its
-*   ceiling (`createTokenBudget({ max })`); resolve the optional `authority` /
+* - **`build` rehydrates.** Refuse with `code: 'REGISTRY'` a job `agentJobContract` refuses,
+*   its faults under `context.faults`, and a job `collectJobRefusals` refuses, its lines under
+*   `context.refusals`: tools or built-ins with no `authority`, a `builtins` list an agent
+*   refuses, and a built-in the job's `tools` also name. Then resolve the job's `provider`;
+*   assemble a fresh {@link ToolManager} from the `tools` names; rebuild the token `budget` from
+*   its ceiling (`createTokenBudget({ max })`); resolve the optional `authority` /
 *   `scheduler` names; construct the {@link Agent} with `system` / `limit` / `timeout` /
 *   the threaded `signal`; seed its context with the job's `messages`; return it. The
 *   `signal` is the queue attempt's / runner unit's cancel, so a bounded abort propagates
 *   into the agent (which commits a partial — the job's `partial` policy then
-*   decides success vs. retry). A job `limit` that is not a positive safe integer throws an
-*   {@link AgentError} carrying `code: 'LIMIT'` from the agent's construction.
+*   decides success vs. retry). A job is a record, so a malformed `limit`, `timeout`, `budget`,
+*   seed role, or `builtins` list refuses as one, with `code: 'REGISTRY'`.
+* - **A job holds what it names.** A job with a `scope` gets the registry's `skills`, `memos`, and
+*   `workspaces` managers, which every scoped job shares, and a scope named `job` built from its
+*   three lists; a job with no `scope` gets none of them. Its `workspace` and `builtins` pass to
+*   the agent.
 * - **Event-free.** A pure resolver — no Emitter, no events.
 *
 * @example
@@ -8453,12 +10109,19 @@ var AgentRegistry = class {
 	#authorities;
 	#schedulers;
 	#store;
+	#skills;
+	#memos;
+	#workspaces;
 	constructor(options) {
+		refuseOptionKeys(options, REGISTRY_OPTION_KEYS, "AgentRegistry", "AgentRegistryOptions");
 		this.#providers = new Map(Object.entries(options.providers));
 		this.#tools = new Map(Object.entries(options.tools ?? {}));
 		this.#authorities = new Map(Object.entries(options.authorities ?? {}));
 		this.#schedulers = new Map(Object.entries(options.schedulers ?? {}));
 		this.#store = options.store;
+		this.#skills = options.skills;
+		this.#memos = options.memos;
+		this.#workspaces = options.workspaces;
 	}
 	provider(name) {
 		return requireEntry(this.#providers, "provider", name);
@@ -8475,13 +10138,16 @@ var AgentRegistry = class {
 	build(input, signal) {
 		const faults = agentJobContract.audit(input);
 		if (faults.length > 0) throw new AgentError("REGISTRY", `a job must hold only the declared members of AgentJobInput\n${describeFaults(faults, agentJobContract.schema)}`, { context: { faults } });
+		const refusals = collectJobRefusals(input);
+		if (refusals.length > 0) throw new AgentError("REGISTRY", ["a job must build as it is written; correct each member a following line names", ...refusals].join("\n"), { context: { refusals } });
 		const agent = new Agent(this.provider(input.provider), this.#buildOptions(input, signal));
 		for (const message of input.messages ?? []) agent.context.messages.add(message);
 		return agent;
 	}
 	#buildOptions(input, signal) {
 		const names = input.tools ?? [];
-		if (names.length > 0 && input.authority === void 0) throw new AgentError("REGISTRY", "a job that names tools and no authority cannot run them; add authority: 'NAME' to the job and register that NAME under authorities", { context: { tools: names } });
+		const builtins = input.builtins ?? [];
+		const scope = input.scope;
 		const budget = input.budget === void 0 ? void 0 : createTokenBudget({ max: input.budget });
 		return {
 			...names.length === 0 ? {} : { tools: this.#buildToolManager(names) },
@@ -8492,6 +10158,15 @@ var AgentRegistry = class {
 			...input.authority === void 0 ? {} : { authority: this.authority(input.authority) },
 			...input.scheduler === void 0 ? {} : { scheduler: this.scheduler(input.scheduler) },
 			...this.#store === void 0 ? {} : { conversations: new ConversationManager({ store: this.#store }) },
+			...scope === void 0 || this.#skills === void 0 ? {} : { skills: this.#skills },
+			...scope === void 0 || this.#memos === void 0 ? {} : { memos: this.#memos },
+			...scope === void 0 || this.#workspaces === void 0 ? {} : { workspaces: this.#workspaces },
+			...scope === void 0 ? {} : { scope: createScope({
+				name: "job",
+				...scope
+			}) },
+			...input.workspace === void 0 ? {} : { workspace: input.workspace },
+			...builtins.length === 0 ? {} : { builtins },
 			...signal === void 0 ? {} : { signal }
 		};
 	}
@@ -8726,6 +10401,7 @@ function createAgentRegistry(options) {
 * ```
 */
 function createAgentQueue(options) {
+	refuseOptionKeys(options, QUEUE_OPTION_KEYS, "createAgentQueue", "AgentQueueOptions");
 	const { registry, partial = false, store } = options;
 	return createQueue({
 		...extractQueueOptions(options),
@@ -8772,6 +10448,7 @@ function createAgentQueue(options) {
 * ```
 */
 function createAgentRunner(options) {
+	refuseOptionKeys(options, RUNNER_OPTION_KEYS, "createAgentRunner", "AgentRunnerOptions");
 	const { registry, partial = false } = options;
 	const fanout = new AgentFanout(registry, partial);
 	return createRunner({
@@ -8779,6 +10456,38 @@ function createAgentRunner(options) {
 		handler: fanout.execute.bind(fanout)
 	});
 }
+/**
+* Creates the tool a run serves for one built-in: its description and annotations from
+* `BUILTIN_TOOLS`, its argument shape from `builtinToolContracts`, and the given handler.
+*
+* @remarks
+* The tool's door refuses a missing, empty, over-long, or extra argument before the handler runs,
+* and repairs a value that converts to a string without loss, such as a number, so the handler
+* reads only arguments the shape admits. Its definition equals the one `collectBuiltinDefinitions`
+* returns for the same name.
+*
+* @param name - The built-in to create
+* @param execute - The handler the door hands admitted arguments to
+* @returns The tool
+*
+* @example
+* ```ts
+* import { createBuiltinTool } from '@orkestrel/agent'
+*
+* const memo = createBuiltinTool('memo', (args) => `read ${String(args.name)}`)
+* memo.annotations // { pure: true, untrusted: true }
+* ```
+*/
+function createBuiltinTool(name, execute) {
+	const declared = BUILTIN_TOOLS[name];
+	return createTool({
+		name,
+		description: declared.description,
+		...declared.annotations === void 0 ? {} : { annotations: declared.annotations },
+		contract: builtinToolContracts[name].shape,
+		execute
+	});
+}
 // src/core/ledgers/constants.ts
 /**
 * Lists the categories the ledger files a message under, in the order the category question
@@ -8853,19 +10562,25 @@ var LEDGER_QUESTIONS = Object.freeze({
 /**
 * Supplies the text of each ledger note, worded for a model that answers in its final
 * message.
+*
+* @remarks
+* `overflow` names `unload` because a skill the thread shows is the room a model can give back: a
+* successful `unload` reopens every call the room denied in that request.
 */
 var LEDGER_NOTES = Object.freeze({
 	cue: "Give your complete answer to the request now, from what you already have.",
 	results: "Your lookups and recalls in this request returned:",
 	repeat: "You already have this result earlier in this request; give your complete answer now as your final message.",
-	closure: "recall is closed for the rest of this request; give your final answer from what you have"
+	closure: "recall is closed for the rest of this request; give your final answer from what you have",
+	overflow: "there is no room left for it in this request. Unload a skill you no longer need before you call it again, or answer with what you have."
 });
 /**
-* Supplies the default prompt and tail shares.
+* Supplies the default prompt, tail, and skills shares.
 */
 var DEFAULT_LEDGER_SHARE = Object.freeze({
 	prompt: .7,
-	tail: .35
+	tail: .35,
+	skills: .5
 });
 /**
 * Caps the tool-iteration turns of a ledger's agent at 8 turns.
@@ -8902,6 +10617,85 @@ var LEDGER_SCALE_DRIFT = .06;
 var LEDGER_WORD = /[\p{L}\p{N}]+/gu;
 /** Matches the logprob decoding failure `invalid or duplicate top logprob token`, which the ledger holds for the ledger's life. */
 var DETERMINISTIC_JUDGE_ERROR = /invalid or duplicate top logprob token/;
+/**
+* Lists the members `LedgerOptions` declares, frozen — the keys the `Ledger` constructor admits.
+*
+* @remarks
+* The constructor passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an own
+* enumerable member outside it refuses with a `ContractError` coded `'structure'`.
+*/
+var LEDGER_OPTION_KEYS = Object.freeze([
+	"judge",
+	"system",
+	"topics",
+	"questions",
+	"thresholds",
+	"capacity",
+	"predict",
+	"think",
+	"gauge",
+	"lookups",
+	"writes",
+	"share",
+	"recall",
+	"correction",
+	"agent",
+	"snapshot"
+]);
+/**
+* Lists the members the `LedgerAgentOptions` pick declares, frozen — the keys a ledger's `agent`
+* option admits.
+*
+* @remarks
+* The `Ledger` constructor passes the list to `refuseOptionKeys` of `@orkestrel/contract`, so an
+* own enumerable member outside it, an `AgentOptions` member the pick leaves out included, refuses
+* with a `ContractError` coded `'structure'`.
+*/
+var LEDGER_AGENT_KEYS = Object.freeze([
+	"limit",
+	"timeout",
+	"on",
+	"scheduler",
+	"instructions",
+	"skills",
+	"memos",
+	"workspaces",
+	"strict",
+	"authority",
+	"builtins",
+	"workspace"
+]);
+/** Lists the members `ClassifierOptions` declares, frozen — the keys the `Classifier` constructor admits. */
+var CLASSIFIER_OPTION_KEYS = Object.freeze([
+	"strict",
+	"conversation",
+	"judge",
+	"questions",
+	"topics",
+	"thresholds",
+	"assign",
+	"entities",
+	"correction",
+	"scheduler"
+]);
+/** Lists the members `GaugeOptions` declares, frozen — the keys the `Gauge` constructor admits. */
+var GAUGE_OPTION_KEYS = Object.freeze([
+	"scale",
+	"overhead",
+	"capacity",
+	"predict",
+	"replay"
+]);
+/**
+* Sets the 3 UTF-8 bytes one UTF-16 code unit encodes to at most, the divisor that sizes the
+* workspace text a calibration's third call carries.
+*
+* @remarks
+* A tokenizer that falls back to bytes charges at most one token a byte, so workspace text cut to the
+* capacity the call without definitions left, divided by this figure, in characters, reports at most
+* `capacity` apart from a template's few tokens for an added message.
+*/
+var LEDGER_SAMPLE_BYTES = 3;
 // src/core/ledgers/errors.ts
 /**
 * Reports an invalid ledger configuration, failed calibration, or unowned request selection,
@@ -8910,7 +10704,9 @@ var DETERMINISTIC_JUDGE_ERROR = /invalid or duplicate top logprob token/;
 * @remarks
 * A threshold, share, capacity, limit, topic, lookup, write, question, or gauge outside its bounds is a
 * programmer error and throws this with the matching {@link LedgerErrorCode}. A calibration call that reports
-* no prompt usage throws this with `'GAUGE'`. A snapshot option that `isLedgerSnapshot` refuses
+* no prompt usage, or a calibration call, with the tool definitions, without them, or with the workspace text, that reports a prompt
+* over `capacity`, the head included, throws this with `'GAUGE'`; the second holds `capacity` and
+* `prompt` in its `context`. A snapshot option that `isLedgerSnapshot` refuses
 * throws this with `'SNAPSHOT'`, its `context` holding the `faults`. Narrow a caught value with {@link isLedgerError} and
 * branch on `error.code`. A selection without an active `respond` call, for a conversation other
 * than the ledger's, or for a request other than that call's request or a ledger note, reports
@@ -8952,7 +10748,7 @@ function isLedgerError(value) {
 	return holds(() => {
 		if (!(value instanceof Error && INTRINSICS.prototype(value) !== Error.prototype && INTRINSICS.describe(value, Symbol.for("@orkestrel/agent.LedgerError"))?.value === value)) return false;
 		const code = INTRINSICS.reflect.read(value, "code");
-		if (!(code === "REQUEST" || code === "THRESHOLD" || code === "SHARE" || code === "CAPACITY" || code === "LIMIT" || code === "TOPIC" || code === "LOOKUP" || code === "GAUGE" || code === "REFERENCE" || code === "SNAPSHOT" || code === "QUESTION" || code === "WRITE")) return false;
+		if (!(code === "REQUEST" || code === "THRESHOLD" || code === "SHARE" || code === "CAPACITY" || code === "LIMIT" || code === "TOPIC" || code === "LOOKUP" || code === "GAUGE" || code === "REFERENCE" || code === "SNAPSHOT" || code === "QUESTION" || code === "WRITE" || code === "OVERFLOW")) return false;
 		const context = INTRINSICS.reflect.read(value, "context");
 		return context === void 0 || isObject(context) || isFunction(context);
 	});
@@ -8988,9 +10784,10 @@ function digestLedgerWindow(exchanges, messages) {
 * Digests tool definitions as the JSON a provider request carries them, in order.
 *
 * @remarks
-* A ledger stores this digest with its gauge, so a hydrate reuses the gauge only for the same
-* definitions: an added, removed, reordered, or edited definition changes the digest. The digest is
-* a {@link computeLedgerChecksum} checksum and makes no security claim.
+* A ledger stores this digest with its gauge and compares it at a hydrate and at each `respond`
+* call, so it reuses the gauge only for the same definitions: an added, removed, reordered, or
+* edited definition changes the digest. The digest is a {@link computeLedgerChecksum} checksum and
+* makes no security claim.
 *
 * @param definitions - The tool definitions, as a tool manager's `definitions` method returns them
 * @returns The 16-digit hexadecimal digest, or undefined when JSON cannot render the definitions
@@ -9004,6 +10801,82 @@ function digestLedgerTools(definitions) {
 	return text === void 0 ? void 0 : computeLedgerChecksum(text);
 }
 /**
+* Computes the tokens one estimate unit of a definition costs beyond the calibrated set.
+*
+* @remarks
+* The larger of `scale` and the calibrated set's overhead per estimate unit, or `scale` for an
+* empty set or one that estimates 0. A set's estimate is `estimateTokens` over its JSON text.
+*
+* @param calibrated - The definitions the gauge's overhead priced
+* @param gauge - The gauge's scale and overhead
+* @returns The tokens one estimate unit of a definition costs
+* @example
+* ```ts
+* computeToolDensity([], { scale: 1.1, overhead: 400 }) // 1.1
+* ```
+*/
+function computeToolDensity(calibrated, gauge) {
+	const estimate = calibrated.length === 0 ? 0 : estimateTokens(JSON.stringify(calibrated));
+	return estimate > 0 ? Math.max(gauge.scale, gauge.overhead / estimate) : gauge.scale;
+}
+/**
+* Computes what a call's advertised set spares of the calibrated overhead and adds beyond it.
+*
+* @remarks
+* Definitions compare by their JSON text, so a definition replaced under its name by another text
+* is both left out and added. An empty advertised set spares the whole overhead. Otherwise the
+* calibrated definitions the call leaves out spare the lower of `scale` and the calibrated set's
+* overhead per estimate unit, times their estimate, so a credit never exceeds their proportional
+* share of the overhead; the definitions it advertises beyond the calibrated set add
+* {@link computeToolDensity}, the higher of the two, times theirs. A set's estimate is
+* `estimateTokens` over its JSON text, 0 for an empty set. The call's price is
+* `overhead - spared + added`.
+*
+* @param calibrated - The definitions the gauge's overhead priced
+* @param advertised - The definitions the call advertises
+* @param gauge - The gauge's scale and overhead
+* @returns The tokens the call spares and adds
+* @example
+* ```ts
+* computeToolPrice([], [], { scale: 1.1, overhead: 400 }) // { spared: 400, added: 0 }
+* ```
+*/
+function computeToolPrice(calibrated, advertised, gauge) {
+	if (advertised.length === 0) return {
+		spared: gauge.overhead,
+		added: 0
+	};
+	const sent = new Set(advertised.map((definition) => JSON.stringify(definition)));
+	const priced = new Set(calibrated.map((definition) => JSON.stringify(definition)));
+	const hidden = calibrated.filter((definition) => !sent.has(JSON.stringify(definition)));
+	const extra = advertised.filter((definition) => !priced.has(JSON.stringify(definition)));
+	return {
+		spared: hidden.length === 0 ? 0 : Math.min(gauge.scale, gauge.overhead / estimateTokens(JSON.stringify(calibrated))) * estimateTokens(JSON.stringify(hidden)),
+		added: extra.length === 0 ? 0 : computeToolDensity(calibrated, gauge) * estimateTokens(JSON.stringify(extra))
+	};
+}
+/**
+* Computes the tokens loading a skill adds: its body, and the definitions it names beyond an advertised set.
+*
+* @remarks
+* The body is the text `renderSkillBody` renders, priced at `scale`, and a blank `content` renders
+* no body. The caller passes the definitions the skill names that the turn does not advertise,
+* priced as {@link computeToolPrice} prices an addition.
+*
+* @param skill - The skill to load
+* @param added - The definitions the skill names that the advertised set leaves out
+* @param calibrated - The definitions the gauge's overhead priced
+* @param gauge - The gauge's scale and overhead
+* @returns The tokens the load adds
+* @example
+* ```ts
+* computeSkillPrice({ name: 'refunds', content: 'Check the order first.' }, [], [], { scale: 1, overhead: 0 }) // 9
+* ```
+*/
+function computeSkillPrice(skill, added, calibrated, gauge) {
+	return (skill.content.trim() === "" ? 0 : gauge.scale * estimateTokens(renderSkillBody(skill))) + computeToolPrice(calibrated, [...calibrated, ...added], gauge).added;
+}
+/**
 * Computes a checksum of text: two 32-bit FNV-1a lanes over its code points, as 16 hexadecimal digits.
 *
 * @remarks
@@ -9232,23 +11105,6 @@ function splitWords(part) {
 	return part.split(/\s+/).map((word) => word.replace(/^[\p{P}\p{S}]+|[\p{P}\p{S}]+$/gu, "").toLowerCase()).filter((word) => word !== "");
 }
 /**
-* Finds the call that owns a tool message within a collected tool group.
-* @param group - The assistant leader followed by its tool results
-* @param message - The tool result to pair; distinct leader ids pair by result id when any result has one
-* @returns The call matching the result's call id, or its position when the leader repeats an id or every result lacks an id; undefined when unpaired
-* @example
-* ```ts
-* findLedgerCall(group, result)?.arguments
-* ```
-*/
-function findLedgerCall(group, message) {
-	const [leader, ...results] = group;
-	const at = results.findIndex((result) => result.id === message.id);
-	if (message.role !== "tool" || at < 0) return void 0;
-	const calls = leader?.calls ?? [];
-	return !(new Set(calls.map((call) => call.id)).size !== calls.length) && results.some((result) => result.call !== void 0) ? calls.find((call) => call.id === message.call) : calls[at];
-}
-/**
 * Ranks a source the records render for removal before the next prompt.
 *
 * @param group - The planning group: 1 for a topic match, 2 for an off-topic rule or correction, or 3 for a name match
@@ -9942,23 +11798,34 @@ function matchesCutLine(line) {
 /**
 * Renders the tail stub of a lookup result from an earlier request.
 *
+* @remarks
+* A `hidden` stub names the `recall` call that finds its result, with the first string argument,
+* trimmed, or `its id` when no argument is a string or that one is blank, only while `offered` is `true`. The ledger plans the
+* tail with every stub naming `recall`, then renders the tail's stubs again after it admits a window
+* rung, with `offered` set to whether that rung offers `recall` and the scope admits it, so the
+* second render can only shorten a stub and raises no price. `offered` changes no other state.
+*
 * @param name - The lookup tool name
 * @param args - The arguments the call carried; arguments JSON cannot carry leave the call as its bare tool name, per {@link renderLookupCall}
 * @param state - What became of the result: `failed`, `empty`, `shown` in the records, or `hidden` from them
 * @param write - If `true`, the call is a write's, whose `empty` state reads `changed nothing`; if `false`, a lookup's, whose `empty` state reads `no record`. Default: `false`
+* @param offered - If `true`, a `hidden` result names the `recall` route; if `false`, because the admitted rung offers no `recall` or the scope excludes it, it reads `result not shown`. Default: `true`
 * @returns The stub text, which carries the call and its state
 *
 * @example
 * ```ts
 * renderStub('lookup_order', { id: 'BW-5512' }, 'hidden')
 * // 'lookup_order {"id":"BW-5512"}: result not shown; call recall with BW-5512'
+* renderStub('lookup_order', { id: 'BW-5512' }, 'hidden', false, false)
+* // 'lookup_order {"id":"BW-5512"}: result not shown'
 * ```
 */
-function renderStub(name, args, state, write = false) {
+function renderStub(name, args, state, write = false, offered = true) {
 	const head = renderLookupCall(name, args);
 	if (state === "failed") return `${head}: failed`;
 	if (state === "empty") return write ? `${head}: changed nothing` : `${head}: no record`;
 	if (state === "shown") return `${head}: result shown under Records below`;
+	if (!offered) return `${head}: result not shown`;
 	return `${head}: result not shown; call recall with ${(Object.values(args).find(isString) ?? "").trim() || "its id"}`;
 }
 /**
@@ -10328,6 +12195,51 @@ function collectLedgerEvidence(messages, sources, amendments) {
 		]), { ...edge }]))
 	};
 }
+/**
+* Cuts the workspace text a calibration sample adds over its head to a number of characters, or
+* returns `undefined` when the sample adds anything else.
+*
+* @remarks
+* The head and the shown sample are what a context's `build` returns for an empty turn without and
+* with the workspace: the shown sample holds the head's messages with the workspace section appended
+* to the context message, or one context message added where the head holds none. The cut keeps the
+* first `limit` characters of that added text and every other message as the sample holds it. A
+* sample whose messages differ from the head's in any other way, or that adds no text, returns
+* `undefined`.
+*
+* @param head - The head built with no workspace
+* @param shown - The head built with the workspace a request renders
+* @param limit - The characters of added text to keep
+* @returns The cut sample, or `undefined` when the sample adds no trailing text to one message
+*
+* @example
+* ```ts
+* import { cutWorkspaceSample } from '@orkestrel/agent'
+*
+* const head = [{ id: 's', role: 'system', content: 'Serve the desk.' }] as const
+* const shown = [...head, { id: 'c', role: 'user', content: '## Workspace\n\nFile: a.md' }] as const
+* cutWorkspaceSample(head, shown, 12)?.[1]?.content // '## Workspace'
+* ```
+*/
+function cutWorkspaceSample(head, shown, limit) {
+	const at = shown.findIndex((message, index) => message.role !== head[index]?.role || message.content !== head[index]?.content);
+	const added = shown[at];
+	const extended = shown.length === head.length ? head[at] : void 0;
+	const prefix = extended?.content ?? "";
+	const rest = shown.slice(at + 1);
+	const held = head.slice(extended === void 0 ? at : at + 1);
+	if (added === void 0 || shown.length - head.length > 1 || shown.length < head.length) return void 0;
+	if (!added.content.startsWith(prefix) || added.content.length === prefix.length) return void 0;
+	if (rest.length !== held.length || rest.some((message, index) => message.role !== held[index]?.role || message.content !== held[index]?.content)) return void 0;
+	return [
+		...shown.slice(0, at),
+		{
+			...added,
+			content: prefix + added.content.slice(prefix.length, prefix.length + limit)
+		},
+		...rest
+	];
+}
 // src/core/ledgers/Classifier.ts
 /**
 * Files messages through the conversation's judgment manager and reads their categories and corrections.
@@ -10348,6 +12260,7 @@ var Classifier = class {
 	* @param options - The conversation, judge, questions, cutoffs, and handlers
 	*/
 	constructor(options) {
+		refuseOptionKeys(options, CLASSIFIER_OPTION_KEYS, "Classifier", "ClassifierOptions");
 		this.#options = options;
 	}
 	/**
@@ -10724,6 +12637,7 @@ var Gauge = class {
 	* @throws {LedgerError} Thrown when `predict` is not a nonnegative safe integer less than `capacity` (code `'CAPACITY'`)
 	*/
 	constructor(options) {
+		refuseOptionKeys(options, GAUGE_OPTION_KEYS, "Gauge", "GaugeOptions");
 		if (!isFiniteNumber(options.scale) || options.scale <= 0) throw new LedgerError("GAUGE", "gauge scale must be finite and greater than 0");
 		if (!isFiniteNumber(options.overhead) || options.overhead < 0) throw new LedgerError("GAUGE", "gauge overhead must be finite and at least 0");
 		if (!isPositiveSafeInteger(options.capacity)) throw new LedgerError("CAPACITY", "gauge capacity must be a positive safe integer");
@@ -10754,7 +12668,7 @@ var Gauge = class {
 	}
 	remainder(calls) {
 		const call = calls.at(-1);
-		const used = isFiniteNumber(call?.prompt) ? call.prompt + (call.completion ?? 0) - (this.#replay === "none" ? call.thinking ?? 0 : 0) : Math.max(0, this.#overhead - (call?.spared ?? 0)) + this.#scale * (call?.estimate ?? 0);
+		const used = isFiniteNumber(call?.prompt) ? call.prompt + (call.completion ?? 0) - (this.#replay === "none" ? call.thinking ?? 0 : 0) : Math.max(0, this.#overhead - (call?.spared ?? 0)) + (call?.added ?? 0) + this.#scale * (call?.estimate ?? 0);
 		return Math.max(0, this.#capacity - used);
 	}
 	reserve(calls, longest) {
@@ -10774,7 +12688,7 @@ var Gauge = class {
 	}
 	observe(calls, reply) {
 		const first = calls[0];
-		if (first !== void 0 && isFiniteNumber(first.prompt) && first.estimate > 0 && ((first.spared ?? 0) === 0 || (first.spared ?? 0) >= this.#overhead)) {
+		if (first !== void 0 && isFiniteNumber(first.prompt) && first.estimate > 0 && (first.added ?? 0) === 0 && ((first.spared ?? 0) === 0 || (first.spared ?? 0) >= this.#overhead)) {
 			const priced = first.prompt - Math.max(0, this.#overhead - (first.spared ?? 0));
 			if (priced > 0) this.#scale = priced / first.estimate;
 		}
@@ -10982,6 +12896,7 @@ var LedgerRequest = class {
 	#admitted = /* @__PURE__ */ new Set();
 	#denials = /* @__PURE__ */ new Set();
 	#listed = [];
+	#commits = [];
 	#recalls = 0;
 	#closed = false;
 	/**
@@ -11168,6 +13083,23 @@ var LedgerRequest = class {
 	lines(result) {
 		return this.#listed.findLast((listing) => listing.result === result)?.lines;
 	}
+	commit(price, skill) {
+		this.#commits = [...this.#commits, {
+			price,
+			turn: this.calls.length,
+			...skill === void 0 ? {} : { skill }
+		}];
+	}
+	get committed() {
+		return this.#inflight().reduce((sum, entry) => sum + entry.price, 0);
+	}
+	get loads() {
+		return this.#inflight().flatMap((entry) => entry.skill === void 0 ? [] : [entry.skill]);
+	}
+	#inflight() {
+		const turn = this.calls.length;
+		return this.#commits.filter((entry) => entry.turn === turn);
+	}
 };
 // src/core/ledgers/LedgerScan.ts
 /**
@@ -11445,16 +13377,20 @@ var Ledger = class {
 	#share;
 	#conversation;
 	#agent;
+	#record;
+	#builtins;
+	#given;
 	#classifier;
 	#requests = /* @__PURE__ */ new Set();
 	#annotations = /* @__PURE__ */ new Set();
 	#results = /* @__PURE__ */ new Map();
 	#pending = /* @__PURE__ */ new Map();
-	#live = /* @__PURE__ */ new Set();
+	#live = /* @__PURE__ */ new Map();
 	#scans = /* @__PURE__ */ new Set();
 	#calibrations = /* @__PURE__ */ new Set();
 	#gauge;
-	#digest;
+	#measured;
+	#refusal;
 	#window = [];
 	#evidence = collectLedgerEvidence([], /* @__PURE__ */ new Set(), []);
 	/**
@@ -11469,6 +13405,8 @@ var Ledger = class {
 	* @throws {ConversationError} Thrown when `isLedgerSnapshot` admits `snapshot` but its conversation holds a `system` message (code `'ROLE'`) or repeats an id (code `'SNAPSHOT'`)
 	*/
 	constructor(provider, options) {
+		refuseOptionKeys(options, LEDGER_OPTION_KEYS, "Ledger", "LedgerOptions");
+		refuseOptionKeys(options.agent, LEDGER_AGENT_KEYS, "Ledger agent", "LedgerAgentOptions");
 		for (const key of [
 			"category",
 			"topic",
@@ -11546,6 +13484,9 @@ var Ledger = class {
 			}) }),
 			execute: (args) => this.#recall(args)
 		}));
+		this.#builtins = requireBuiltins(options.agent?.builtins, tools);
+		if (this.#builtins.length > 0 && host === void 0) throw new AgentError("AUTHORITY", "agent.builtins are set and no agent.authority is; pass authority: createAuthority({ fallback: { zone: 'default', verdict: 'allow' } }) to allow every call, or rules with a deny fallback");
+		this.#given = requireWorkspace(options.agent?.workspace);
 		const advertised = new Authority({
 			rules: [{
 				match: (context) => names.includes(context.call.name),
@@ -11564,17 +13505,14 @@ var Ledger = class {
 			system: options.system,
 			tools,
 			authority: {
-				evaluate: (context) => this.#current()?.denied(context.call.name, context.call.arguments) === true ? {
-					zone: "ledger",
-					verdict: "deny",
-					reason: LEDGER_NOTES.repeat
-				} : host === void 0 || context.call.name === "recall" || !names.includes(context.call.name) ? advertised.evaluate(context) : host.evaluate(context),
+				evaluate: (context) => this.#evaluate(context, host, advertised, names),
 				ask: (context, decision, signal) => this.#current()?.denied(context.call.name, context.call.arguments) === true ? Promise.resolve(false) : host?.ask === void 0 ? advertised.ask(context, decision, signal) : host.ask(context, decision, signal)
 			},
 			limit: options.agent?.limit ?? 8,
 			select: (conversation, request, signal) => this.#select(conversation, request, signal)
 		});
-		const digest = digestLedgerTools(this.#agent.context.tools.definitions());
+		const calibrated = this.#calibrated();
+		const digest = digestLedgerTools(calibrated);
 		const gauge = options.gauge ?? (snapshot?.gauge?.digest === digest ? snapshot?.gauge : void 0);
 		if (gauge !== void 0) {
 			this.#gauge = new Gauge({
@@ -11584,10 +13522,10 @@ var Ledger = class {
 				predict: this.#predict,
 				replay: this.#replay
 			});
-			this.#digest = digest;
+			this.#measured = calibrated;
 		}
 		this.#agent.emitter.on("deny", (call, _reason, decision) => {
-			if (decision !== void 0 && call.name !== "recall" && names.includes(call.name)) this.#current()?.deny(call.name, call.arguments);
+			if (decision !== void 0 && decision.reason !== LEDGER_NOTES.overflow && call.name !== "recall" && (names.includes(call.name) || this.#enables(call.name))) this.#current()?.deny(call.name, call.arguments);
 		});
 		this.#agent.emitter.on("tool", (call, result) => {
 			this.#flush();
@@ -11600,21 +13538,34 @@ var Ledger = class {
 			const request = this.#current();
 			if (request?.calls.at(-1)?.tools === 0) request.abort();
 			this.#release(call, result);
+			this.#reopen(call, result);
 		});
 		this.#agent.emitter.on("select", (selection) => {
 			if (isLedgerError(selection.fault) && selection.fault.code === "REQUEST") return;
 			this.#current()?.adopt(selection, this.#conversation.messages().length);
 		});
 		this.#agent.emitter.on("fault", (error) => this.#current()?.fault(error));
-		this.#agent.emitter.on("turn", () => this.#observeTurn());
+		this.#agent.emitter.on("request", (index, sent) => {
+			if (this.#gate(index, sent)) this.#observeRequest(sent);
+		});
 		this.#agent.emitter.on("usage", (usage) => this.#current()?.spend(usage));
+		const agent = this.#agent;
+		this.#record = Object.freeze({
+			emitter: agent.emitter,
+			id: agent.id,
+			get status() {
+				return agent.status;
+			},
+			context: agent.context,
+			abort: (reason) => agent.abort(reason)
+		});
 	}
 	/**
-	* Returns the owned request engine.
-	* @returns The engine serving this conversation
+	* Returns the record of the owned request engine, which starts no run.
+	* @returns The frozen record of the agent serving this conversation
 	*/
 	get agent() {
-		return this.#agent;
+		return this.#record;
 	}
 	/**
 	* Returns the owned message history.
@@ -11635,9 +13586,10 @@ var Ledger = class {
 	}
 	/**
 	* Measures message scale and tool overhead from provider prompt usage.
-	* @param signal - The signal bounding both calibration calls; an abort rejects with its reason
+	* @param signal - The signal bounding every calibration call; an abort rejects with its reason
 	* @returns The stored scale and overhead cost
-	* @throws {LedgerError} Thrown when either call reports no prompt usage, or a prompt usage of 0 or less (code `'GAUGE'`)
+	* @throws {LedgerError} Thrown when a calibration call reports no prompt usage, or a prompt usage of 0 or less (code `'GAUGE'`)
+	* @throws {LedgerError} Thrown when a calibration call, with the tool definitions, without them, or with the workspace text, reports a prompt over `capacity`, the head included (code `'GAUGE'`)
 	* @throws {AgentError} Thrown when a request or calibration is active (code `'CONCURRENCY'`)
 	*/
 	async calibrate(signal) {
@@ -11660,7 +13612,7 @@ var Ledger = class {
 		const conversation = this.#conversation.snapshot();
 		const ids = conversation.messages.map((message) => message.id);
 		const gauge = this.gauge;
-		const priced = this.#digest;
+		const priced = this.#digest();
 		const window = {
 			exchanges: this.#window.map((entry) => ({
 				request: entry.request.id,
@@ -11694,13 +13646,15 @@ var Ledger = class {
 	/**
 	* Appends a request and serves it, recovering an unfinished or rejected first pass with one answer pass.
 	* In either pass, a call the model makes in a turn that advertises no tools runs nothing and ends the pass after that generation, whatever the agent's `limit`, and when every call of that turn failed, the ledger stores the reply without its calls: a reply with text ends the pass complete, and one without text ends it partial with empty content.
-	* A calibration call that reports no prompt usage, or a prompt usage of 0 or less, rejects with `LedgerError` code `'GAUGE'`; a provider error during calibration rejects with that error.
+	* A calibration call that reports no prompt usage, or a prompt usage of 0 or less, rejects with `LedgerError` code `'GAUGE'`; a provider error during calibration rejects with that error. A calibration call, with the tool definitions, without them, or with the workspace text, that reports a prompt over `capacity`, the head included, rejects with the same code and stores no request.
 	* When the answer pass rejects, `respond` rejects with that error, and under the default `strict` a judge failure or another selection failure rejects it too. A rejection belongs to its own call: the ledger stays free, and the next call asks the judge again about whatever is still unanswered.
 	* @param content - The request text
 	* @param signal - The caller's cancellation signal; an abort during calibration rejects with its reason
 	* @returns The final pass, the usage of every pass, and the filing attempts of this request alone
 	* @throws {AgentError} Thrown when a request or calibration is active (code `'CONCURRENCY'`)
 	* @throws {LedgerError} Thrown when a calibration call reports no prompt usage, or a prompt usage of 0 or less (code `'GAUGE'`)
+	* @throws {LedgerError} Thrown when a calibration call, with the tool definitions, without them, or with the workspace text, reports a prompt over `capacity`, the head included (code `'GAUGE'`)
+	* @throws {LedgerError} Thrown when the answer pass prices over `capacity - predict` with its note left out, or a host act after the note grows its request past that limit (code `'OVERFLOW'`)
 	* @throws {ContractError} Thrown when `signal` is defined and is not a native `AbortSignal`
 	*/
 	async respond(content, signal) {
@@ -11708,12 +13662,15 @@ var Ledger = class {
 		const caller = createAbort({ ...signal === void 0 ? {} : { signal } }).signal;
 		const request = new LedgerRequest(content, this.#options.recall?.limit);
 		const scope = this.#agent.context.scope;
-		this.#live.add(request);
+		this.#live.set(request, scope);
 		try {
-			if (this.#gauge === void 0) await this.#measureGauge(caller);
+			if (this.#gauge === void 0 || digestLedgerTools(this.#calibrated()) !== this.#digest()) {
+				this.#gauge = void 0;
+				await this.#measureGauge(caller);
+			}
 			const entered = request.enter(this.#conversation);
 			this.#requests.add(entered.id);
-			const first = this.#dropStrayCalls(request, await this.#generatePass(request, caller, this.#options.think).catch((error) => {
+			const first = this.#dropStrayCalls(request, await this.#generatePass(request, caller, this.#options.think, scope).catch((error) => {
 				if (request.faulted(error)) throw error;
 				return {
 					content: "",
@@ -11732,13 +13689,12 @@ var Ledger = class {
 					role: "user",
 					content: LEDGER_NOTES.cue
 				}).id);
-				const previous = this.#agent.context.scope;
+				const filter = intersectFilters(scope, { tools: [] });
 				const answer = createScope({
-					...previous,
+					...filter,
 					name: "answer",
-					tools: [],
 					select: async (conversation, message, runSignal) => {
-						const selection = await this.#select(conversation, message, runSignal);
+						const selection = await this.#select(conversation, message, runSignal, filter);
 						if (selection.fault !== void 0) return selection;
 						return {
 							...selection,
@@ -11746,12 +13702,9 @@ var Ledger = class {
 						};
 					}
 				});
-				this.#agent.context.apply(answer);
-				try {
-					passes.push(this.#dropStrayCalls(request, await this.#generatePass(request, caller, false)));
-				} finally {
-					if (this.#agent.context.scope === answer) this.#agent.context.apply(previous);
-				}
+				passes.push(this.#dropStrayCalls(request, await this.#generatePass(request, caller, false, answer)));
+				const refusal = this.#refusal;
+				if (refusal !== void 0 && !caller.aborted) throw refusal;
 			}
 			const last = passes.at(-1) ?? first;
 			request.think(this.#conversation.messages());
@@ -11777,26 +13730,31 @@ var Ledger = class {
 	}
 	async #measureGauge(signal) {
 		try {
-			const messages = stripThinking(this.#agent.context.build({
-				messages: [...this.#conversation.view(), {
-					id: "calibration",
-					role: "user",
-					content: ""
-				}],
-				judgments: []
-			}), this.#replay).slice(0, -1);
-			const definitions = this.#agent.context.tools.definitions();
+			const messages = this.#agent.context.build({
+				selection: {
+					messages: [],
+					judgments: []
+				},
+				scope: createScope({
+					name: "calibration",
+					workspaces: []
+				})
+			});
+			const definitions = this.#calibrated();
 			const priced = await this.#provider.generate(messages, signal, definitions, { think: false });
+			this.#refuseOverCapacity("with", priced.usage?.prompt);
 			const bare = await this.#provider.generate(messages, signal, void 0, { think: false });
-			if (!isFiniteNumber(priced.usage?.prompt) || priced.usage.prompt <= 0 || !isFiniteNumber(bare.usage?.prompt) || bare.usage.prompt <= 0) throw new LedgerError("GAUGE", "calibration requires prompt usage from both calls");
+			this.#refuseOverCapacity("without", bare.usage?.prompt);
+			if (!isFiniteNumber(priced.usage?.prompt) || priced.usage.prompt <= 0 || !isFiniteNumber(bare.usage?.prompt) || bare.usage.prompt <= 0) throw new LedgerError("GAUGE", "calibration requires prompt usage from each call");
+			const scale = await this.#measureScale(messages, bare.usage.prompt, signal);
 			this.#gauge = new Gauge({
 				capacity: this.#options.capacity,
 				predict: this.#predict,
 				replay: this.#replay,
-				scale: bare.usage.prompt / estimateMessages(messages),
+				scale,
 				overhead: Math.max(0, priced.usage.prompt - bare.usage.prompt)
 			});
-			this.#digest = digestLedgerTools(definitions);
+			this.#measured = definitions;
 			return {
 				scale: this.#gauge.scale,
 				overhead: this.#gauge.overhead
@@ -11806,13 +13764,52 @@ var Ledger = class {
 			throw error;
 		}
 	}
-	async #generatePass(request, signal, think) {
+	async #measureScale(head, bare, signal) {
+		const rate = bare / estimateMessages(head);
+		const workspace = this.#show(intersectFilters(this.#agent.context.scope, void 0)).workspace;
+		const files = (resolveWorkspace(this.#agent.context.workspaces, workspace, void 0)?.files() ?? []).flatMap((file) => isTextContent(file.content) ? [file.path] : []);
+		const shown = this.#agent.context.build({
+			selection: {
+				messages: [],
+				judgments: []
+			},
+			scope: createScope({
+				name: "calibration",
+				files
+			}),
+			disclosure: {
+				skills: [],
+				...workspace === void 0 ? {} : { workspace }
+			}
+		});
+		const whole = estimateMessages(shown) - estimateMessages(head);
+		const cut = cutWorkspaceSample(head, shown, Math.floor((this.#options.capacity - bare) / 3));
+		const part = cut === void 0 ? 0 : estimateMessages(cut) - estimateMessages(head);
+		if (cut === void 0 || whole <= 0 || part <= 0) return rate;
+		const third = await this.#provider.generate(cut, signal, void 0, { think: false });
+		this.#refuseOverCapacity("workspace", third.usage?.prompt);
+		if (!isFiniteNumber(third.usage?.prompt) || third.usage.prompt <= 0) throw new LedgerError("GAUGE", "calibration requires prompt usage from each call");
+		const tokens = bare + (third.usage.prompt - bare) * whole / part;
+		return Math.max(rate, tokens / estimateMessages(shown));
+	}
+	#refuseOverCapacity(call, prompt) {
+		const capacity = this.#options.capacity;
+		const subject = call === "workspace" ? "with the workspace text" : `${call} the tool definitions`;
+		const remedy = call === "workspace" ? "narrow what the scope shows of the workspace, or raise capacity" : "hold tools behind a skill with the `load` built-in, register fewer tools, or raise capacity";
+		if (isFiniteNumber(prompt) && prompt > capacity) throw new LedgerError("GAUGE", `the calibration call ${subject} prices ${prompt} tokens, the head included, over the capacity ${capacity}; ${remedy}`, { context: {
+			capacity,
+			prompt
+		} });
+	}
+	async #generatePass(request, signal, think, scope) {
+		this.#refusal = void 0;
 		request.open(this.#conversation.messages().length);
 		const stop = request.signal;
 		return await this.#agent.generate({
-			signal: stop === void 0 ? signal : AbortSignal.any([signal, stop]),
+			signal: stop === void 0 ? signal : linkSignal(signal, stop),
 			conversation: this.#conversation,
-			...think === void 0 ? {} : { think }
+			...think === void 0 ? {} : { think },
+			...scope === void 0 ? {} : { scope }
 		});
 	}
 	#dropStrayCalls(request, pass) {
@@ -11838,12 +13835,103 @@ var Ledger = class {
 		};
 	}
 	#current() {
-		const [request] = this.#live;
+		const [request] = this.#live.keys();
 		return request?.message === void 0 ? void 0 : request;
 	}
 	#busy() {
 		return this.#live.size > 0 || this.#calibrations.size > 0;
 	}
+	#evaluate(context, host, advertised, names) {
+		const request = this.#current();
+		const { name, arguments: args } = context.call;
+		if (request?.denied(name, args) === true) return {
+			zone: "ledger",
+			verdict: "deny",
+			reason: LEDGER_NOTES.repeat
+		};
+		if (this.#enables(name)) {
+			const admitted = attempt(() => request?.admit(name, args));
+			if (!admitted.success) {
+				if (isError(admitted.error) && admitted.error.message === LEDGER_NOTES.repeat) return {
+					zone: "ledger",
+					verdict: "deny",
+					reason: LEDGER_NOTES.repeat
+				};
+				throw admitted.error;
+			}
+			if (request !== void 0) {
+				const commitment = this.#room(request, name, args);
+				if (commitment === void 0) return {
+					zone: "ledger",
+					verdict: "deny",
+					reason: LEDGER_NOTES.overflow
+				};
+				request.commit(commitment.price, commitment.skill);
+			}
+			return host === void 0 ? advertised.evaluate(context) : host.evaluate(context);
+		}
+		const decision = host === void 0 || name === "recall" || !names.includes(name) ? advertised.evaluate(context) : host.evaluate(context);
+		if (request !== void 0 && decision.verdict !== "deny" && name !== "recall" && names.includes(name)) request.commit(this.#priceResult(request.calls));
+		return decision;
+	}
+	#room(request, name, args) {
+		if (name !== "load" && name !== "remember" && name !== "switch") return { price: 0 };
+		const gauge = this.#gauge;
+		if (gauge === void 0) return void 0;
+		const room = gauge.remainder(request.calls) - this.#predict;
+		const admitted = admitValue(builtinToolContracts[name].contract, { ...args });
+		const values = admitted.success ? admitted.value.value : {};
+		if (name === "remember") {
+			const line = isString(values["name"]) && isString(values["description"]) ? renderIndexEntry({
+				name: values["name"],
+				description: values["description"]
+			}) : "";
+			const price = gauge.scale * estimateTokens(line);
+			return (request.committed + price) * 1.06 > room ? void 0 : { price };
+		}
+		const ceiling = this.#ceiling(request);
+		const shown = this.#show(ceiling);
+		if (name === "switch") {
+			const workspace = values["workspace"];
+			const price = isString(workspace) ? gauge.scale * Math.max(0, this.#estimateHead(request, ceiling, {
+				skills: shown.skills,
+				workspace
+			}) - this.#estimateHead(request, ceiling, shown)) : 0;
+			return (request.committed + price) * 1.06 > room ? void 0 : { price };
+		}
+		const thread = [.../* @__PURE__ */ new Set([...shown.skills, ...request.loads])];
+		const skill = filterAllowList(ceiling.skills, this.#agent.context.skills.skills(), (one) => one.name).find((one) => one.name === values["skill"]);
+		if (skill === void 0 || thread.includes(skill.name)) return { price: 0 };
+		const price = this.#priceSkill(skill, ceiling, this.#advertise(ceiling, thread));
+		const budget = (this.#options.capacity - this.#predict) * this.#share.prompt;
+		return (request.committed + price + this.#priceResult(request.calls)) * 1.06 > room || this.#priceShown({ skills: thread }, ceiling) + price > this.#share.skills * budget ? void 0 : {
+			price,
+			skill: skill.name
+		};
+	}
+	#estimateHead(request, ceiling, shown) {
+		return estimateMessages(stripThinking(this.#agent.context.build({
+			...request.selection === void 0 ? {} : { selection: request.selection },
+			disclosure: shown,
+			switchable: this.#advertise(ceiling, shown.skills).some((tool) => tool.name === "switch")
+		}), this.#replay));
+	}
+	#reopen(call, result) {
+		const request = this.#current();
+		const entered = request?.message;
+		if (request === void 0 || entered === void 0 || !result.success || !this.#enables(call.name)) return;
+		const messages = this.#conversation.messages();
+		const pairs = collectToolGroups(messages.slice(messages.findIndex((message) => message.id === entered.id) + 1)).flatMap((group) => group.slice(1).flatMap((message) => {
+			const owner = findToolCall(group, message);
+			return owner === void 0 ? [] : [{
+				call: owner,
+				content: message.content
+			}];
+		}));
+		const key = canonicalStringify(call.arguments);
+		const reopened = pairs.filter(({ call: earlier, content }) => call.name === "unload" ? earlier.name === "load" && earlier.arguments.skill === call.arguments.skill || content === settleToolResult(denyCall(earlier, LEDGER_NOTES.overflow)).content : call.name === "load" ? earlier.name === "unload" && earlier.arguments.skill === call.arguments.skill : call.name === "switch" ? earlier.name === "switch" && canonicalStringify(earlier.arguments) !== key : call.name === "remember" && earlier.name === "memo" && earlier.arguments.name === call.arguments.name);
+		for (const { call: earlier } of reopened) request.release(earlier.name, earlier.arguments);
+	}
 	#flush() {
 		if (this.#pending.size === 0) return;
 		const messages = this.#conversation.messages();
@@ -11894,7 +13982,7 @@ var Ledger = class {
 		for (const message of messages) {
 			if (!snapshot.failures.includes(message.id)) continue;
 			const group = groups.find((entries) => entries.some((one) => one.id === message.id));
-			const call = group === void 0 ? void 0 : findLedgerCall(group, message);
+			const call = group === void 0 ? void 0 : findToolCall(group, message);
 			this.#results.set(message.id, {
 				success: false,
 				id: call?.id ?? message.call ?? message.id,
@@ -11924,7 +14012,7 @@ var Ledger = class {
 	#readLookups(messages) {
 		this.#flush();
 		return collectToolGroups(messages).flatMap((group) => group.slice(1).flatMap((message) => {
-			const call = findLedgerCall(group, message);
+			const call = findToolCall(group, message);
 			const lookup = this.#options.lookups?.find((one) => one.tool.name === call?.name);
 			const write = this.#options.writes?.find((one) => one.tool.name === call?.name);
 			if (call === void 0 || lookup === void 0 && write === void 0 || this.#results.get(message.id)?.success === false) return [];
@@ -11991,7 +14079,7 @@ var Ledger = class {
 		const start = messages.findIndex((message) => message.id === request.id);
 		return messages.slice(start + 1).filter((message) => message.role !== "assistant" || hasCalls(message) || message.content.trim() !== "");
 	}
-	async #select(conversation, message, signal) {
+	async #select(conversation, message, signal, filter) {
 		const request = this.#current();
 		const selected = request?.message;
 		if (conversation !== this.#conversation || request === void 0 || selected === void 0 || message.id !== selected.id && !this.#annotations.has(message.id)) return this.#refuse(new LedgerError("REQUEST", "ledger selection requires a request owned by an active respond call"), { judgments: [] }, conversation);
@@ -12003,7 +14091,7 @@ var Ledger = class {
 		const scanned = attempt(() => this.#scan(this.#conversation.messages()));
 		if (scanned.success) this.#hold(scanned.value);
 		try {
-			return await this.#classifier.classify(this.#requests, signal).then((classified) => this.#file(classified, request, selected, message), (error) => this.#refuse(error, { judgments: [] }, this.#conversation));
+			return await this.#classifier.classify(this.#requests, signal).then((classified) => this.#file(classified, request, selected, message, filter ?? this.#live.get(request)), (error) => this.#refuse(error, { judgments: [] }, this.#conversation));
 		} finally {
 			const [scan] = this.#scans;
 			if (scan !== void 0) this.#scans.delete(scan);
@@ -12025,11 +14113,11 @@ var Ledger = class {
 		this.#hold(scan);
 		return scan;
 	}
-	#file(classified, request, selected, message) {
+	#file(classified, request, selected, message, filter) {
 		const { attempts, failure, ...filed } = classified;
 		const planned = attempt(() => {
 			if (filed.fault !== void 0) throw filed.fault;
-			const { draft, ...plan } = this.#plan(selected, this.#rescan());
+			const { draft, ...plan } = this.#plan(selected, this.#rescan(), filter);
 			return {
 				draft,
 				selection: {
@@ -12062,7 +14150,7 @@ var Ledger = class {
 		const category = this.#classifier.category(source);
 		return !(role === "user" && !this.#classifier.decisive(source)) && (category === "rule" || category === "correction");
 	}
-	#plan(request, scan) {
+	#plan(request, scan, filter) {
 		const { input, projection } = this.#project(scan);
 		const registry = scan.registry;
 		const links = linkOwners(input.findings, registry.owners);
@@ -12074,10 +14162,20 @@ var Ledger = class {
 			}),
 			topics: [...near]
 		});
-		const total = Math.max(0, (this.#options.capacity - this.#predict) * this.#share.prompt - (this.#gauge?.overhead ?? 0)) / (1 + LEDGER_SCALE_DRIFT);
+		const lists = intersectFilters(void 0, filter);
+		const bound = lists.tools;
+		const disclosure = this.#show(lists);
+		const advertised = this.#advertise(lists, disclosure.skills);
+		const calibrated = this.#measuredSet();
+		const price = computeToolPrice(calibrated, advertised, this.#priced());
+		const total = Math.max(0, (this.#options.capacity - this.#predict) * this.#share.prompt - (this.#priced().overhead - price.spared + price.added) - this.#holdback(lists, disclosure, advertised, [])) / (1 + LEDGER_SCALE_DRIFT);
 		const built = this.#agent.context.build({
-			messages: [request],
-			judgments: []
+			selection: {
+				messages: [request],
+				judgments: []
+			},
+			disclosure,
+			switchable: advertised.some((tool) => tool.name === "switch")
 		});
 		const tail = this.#selectTail(request, total, input, scan);
 		const tailIds = new Set(tail.map((message) => message.id));
@@ -12186,23 +14284,24 @@ var Ledger = class {
 			...rung.window.flatMap((entry) => [entry.request, entry.reply]),
 			buildRequestMessage(built.at(-1) ?? request, rung.rendered.text)
 		], this.#replay)]);
-		const names = this.#agent.context.scope?.tools;
-		const definitions = this.#agent.context.tools.definitions();
 		const offered = rungs.map((rung) => hasHiddenRecall(input, request.id, this.#requests, this.#annotations, [...tail.slice(0, -1), ...rung.window.flatMap((entry) => [entry.request, entry.reply])], [...rung.window.flatMap((entry) => entry.lines), ...rung.rendered.lines]));
 		const longest = this.#findLongest();
 		const closed = probes.map((messages, at) => {
-			const tools = definitions.filter((tool) => (names === void 0 || names.includes(tool.name)) && (tool.name !== "recall" || offered[at]));
+			const tools = advertised.filter((tool) => tool.name !== "recall" || offered[at]);
 			const calls = [{
 				estimate: estimateMessages(messages),
 				tools: tools.length,
-				spared: this.#spared(tools)
+				...computeToolPrice(calibrated, tools, this.#priced())
 			}];
 			return offered[at] === true && this.#gauge !== void 0 && this.#gauge.remainder(calls) - this.#predict < 2 * this.#gauge.reserve(calls, longest);
 		});
 		const prices = probes.map((messages) => this.#price(messages));
 		const admitted = rungs.find((_rung, at) => (prices[at] ?? Infinity) <= total && (closed[2] === true || closed[at] === false)) ?? empty;
-		if (offered[rungs.indexOf(admitted)] === false && (names === void 0 || names.includes("recall"))) {
-			const tools = definitions.filter((tool) => tool.name !== "recall").map((tool) => tool.name);
+		const recall = offered[rungs.indexOf(admitted)] === true;
+		const ceiling = intersectKeys(this.#agent.context.scope?.tools, bound);
+		const admits = ceiling === void 0 || ceiling.includes("recall");
+		if (!recall && admits) {
+			const tools = this.#definitions().filter((tool) => tool.name !== "recall").map((tool) => tool.name);
 			const narrowed = this.#agent.context.scope?.narrow({ tools }) ?? createScope({
 				name: "ledger",
 				tools
@@ -12225,10 +14324,11 @@ var Ledger = class {
 			window: admitted.window
 		};
 		const shown = buildLedgerRenderContext(scan.messages, [...kept, ...admitted.rendered.lines], []).complete;
+		const route = recall && admits;
 		return {
 			draft,
 			messages: [
-				...tail.slice(0, -1).map((message) => message.role === "tool" ? this.#renderTailStub(message, scan, shown) : message),
+				...tail.slice(0, -1).map((message) => message.role === "tool" ? this.#renderTailStub(message, scan, shown, route) : message),
 				...admitted.window.flatMap((entry) => [entry.request, entry.reply]),
 				copy
 			]
@@ -12316,7 +14416,7 @@ var Ledger = class {
 			return [{
 				leader,
 				kept: (leader.calls ?? []).flatMap((call) => {
-					const message = group.slice(1).find((result) => findLedgerCall(group, result) === call);
+					const message = group.slice(1).find((result) => findToolCall(group, result) === call);
 					const result = message === void 0 ? void 0 : this.#results.get(message.id);
 					return message === void 0 || ![...this.#options.lookups ?? [], ...this.#options.writes ?? []].some((entry) => entry.tool.name === call.name) || result?.success === false && result.error === LEDGER_NOTES.repeat ? [] : [{
 						call,
@@ -12361,16 +14461,16 @@ var Ledger = class {
 			amendments: evidence.amendments
 		};
 	}
-	#renderTailStub(message, scan, shown) {
+	#renderTailStub(message, scan, shown, offered = true) {
 		const group = scan.group(message.id);
-		const call = group === void 0 ? void 0 : findLedgerCall(group, message);
+		const call = group === void 0 ? void 0 : findToolCall(group, message);
 		const write = this.#options.writes?.some((one) => one.tool.name === call?.name) === true;
 		const finding = scan.finding(message.id);
 		const hidden = renderStub(call?.name ?? "tool", call?.arguments ?? {}, "hidden");
 		const visible = renderStub(call?.name ?? "tool", call?.arguments ?? {}, "shown");
 		return {
 			...message,
-			content: renderStub(call?.name ?? "tool", call?.arguments ?? {}, this.#results.get(message.id)?.success === false ? "failed" : finding?.result === void 0 ? "empty" : shown === void 0 ? hidden.length > visible.length ? "hidden" : "shown" : scan.findings.some((other) => shown.has(other.id) && matchesLookup(finding, other)) ? "shown" : "hidden", write)
+			content: renderStub(call?.name ?? "tool", call?.arguments ?? {}, this.#results.get(message.id)?.success === false ? "failed" : finding?.result === void 0 ? "empty" : shown === void 0 ? hidden.length > visible.length ? "hidden" : "shown" : scan.findings.some((other) => shown.has(other.id) && matchesLookup(finding, other)) ? "shown" : "hidden", write, offered)
 		};
 	}
 	#release(call, result) {
@@ -12401,26 +14501,71 @@ var Ledger = class {
 		}]);
 		for (const finding of findings) if ((edges.get(finding.id) ?? []).includes(id) && this.#options.lookups?.some((lookup) => lookup.tool.name === finding.name) === true) request.release(finding.name, finding.arguments);
 	}
-	#observeTurn() {
+	#observeRequest(sent) {
 		this.#flush();
 		const request = this.#current();
-		const boundary = request?.boundary;
-		if (request === void 0 || boundary === void 0 || request.aborted) return;
-		const additions = this.#conversation.messages().slice(boundary);
-		const messages = this.#agent.context.build(request.selection);
-		const names = this.#agent.context.scope?.tools;
-		const tools = this.#agent.context.tools.definitions().filter((tool) => names === void 0 || names.includes(tool.name));
+		if (request?.boundary === void 0) return;
+		const tools = sent.tools ?? [];
 		request.observe({
-			estimate: estimateMessages(stripThinking([...messages, ...additions], this.#replay)),
+			estimate: estimateMessages(sent.messages),
 			tools: tools.length,
-			spared: this.#spared(tools)
+			...computeToolPrice(this.#measuredSet(), tools, this.#priced())
 		}, this.#conversation.messages().length);
 	}
-	#spared(tools) {
-		const overhead = this.#gauge?.overhead ?? 0;
-		if (tools.length === 0) return overhead;
-		const missing = this.#agent.context.tools.definitions().filter((tool) => !tools.some((one) => one.name === tool.name));
-		return missing.length === 0 ? 0 : Math.min(overhead, estimateTokens(JSON.stringify(missing)) * (this.#gauge?.scale ?? 1));
+	#priced() {
+		return this.#gauge ?? {
+			scale: 1,
+			overhead: 0
+		};
+	}
+	#measuredSet() {
+		return this.#measured ?? this.#calibrated();
+	}
+	#digest() {
+		return this.#measured === void 0 ? void 0 : digestLedgerTools(this.#measured);
+	}
+	#enables(name) {
+		return this.#builtins.some((one) => one === name);
+	}
+	#definitions() {
+		return [...this.#agent.context.tools.definitions().filter((tool) => !this.#enables(tool.name)), ...collectBuiltinDefinitions({ builtins: this.#builtins })];
+	}
+	#calibrated() {
+		const definitions = this.#definitions();
+		if (!this.#enables("load")) return definitions;
+		const held = new Set(this.#agent.context.skills.skills().flatMap((skill) => skill.tools));
+		return definitions.filter((tool) => !held.has(tool.name));
+	}
+	#show(ceiling) {
+		return resolveDisclosure(this.#agent.context, this.#conversation, this.#given, ceiling, this.#builtins);
+	}
+	#advertise(ceiling, shown) {
+		return filterAdvertisedTools(filterBuiltinCandidates(this.#definitions(), ceiling), ceiling.tools, this.#enables("load") ? this.#agent.context.skills.skills() : [], shown);
+	}
+	#ceiling(request) {
+		return intersectFilters(this.#agent.context.scope, this.#live.get(request));
+	}
+	#priceSkill(skill, ceiling, advertised) {
+		const sent = new Set(advertised.map((tool) => tool.name));
+		return computeSkillPrice(skill, filterAllowList(ceiling.tools, this.#definitions().filter((tool) => skill.tools.includes(tool.name) && !sent.has(tool.name)), (tool) => tool.name), this.#measuredSet(), this.#priced());
+	}
+	#priceShown(shown, ceiling) {
+		const skills = shown.skills.flatMap((name) => this.#agent.context.skills.skill(name) ?? []);
+		const named = new Set(skills.flatMap((skill) => skill.tools));
+		const definitions = filterAllowList(ceiling.tools, this.#definitions().filter((tool) => named.has(tool.name)), (tool) => tool.name);
+		const calibrated = this.#measuredSet();
+		const gauge = this.#priced();
+		return skills.reduce((sum, skill) => sum + computeSkillPrice(skill, [], calibrated, gauge), 0) + computeToolPrice(calibrated, [...calibrated, ...definitions], gauge).added;
+	}
+	#priceResult(calls) {
+		const longest = this.#conversation.messages().filter((message) => message.role === "tool").reduce((found, message) => found === void 0 || message.content.length > found.content.length ? message : found, void 0);
+		const gauge = this.#gauge;
+		return Math.max(this.#priced().scale * (longest === void 0 ? 0 : estimateMessages([longest])), gauge === void 0 ? 0 : gauge.reserve(calls, this.#findLongest()));
+	}
+	#holdback(ceiling, shown, advertised, calls) {
+		if (!advertised.some((tool) => tool.name === "load")) return 0;
+		const loadable = filterAllowList(ceiling.skills, this.#agent.context.skills.skills(), (skill) => skill.name).filter((skill) => !shown.skills.includes(skill.name));
+		return loadable.length === 0 ? 0 : Math.max(...loadable.map((skill) => this.#priceSkill(skill, ceiling, advertised))) + this.#priceResult(calls);
 	}
 	#findLongest() {
 		return this.#conversation.messages().filter((message) => message.role === "assistant").reduce((longest, message) => message.content.length > longest.length ? message.content : longest, "");
@@ -12448,12 +14593,7 @@ var Ledger = class {
 		request?.recall();
 		const guidance = `an owner name, an id, or one of ${renderTopicNames(this.#options.topics)}`;
 		if (topic === "") throw new Error(`recall needs a topic: ${guidance}`);
-		const rate = this.#recallRate(request) * (1 + LEDGER_SCALE_DRIFT);
-		const call = calls.at(-1);
-		const carried = request === void 0 ? 0 : estimateMessages(stripThinking([...this.#agent.context.build(request.selection), ...this.#conversation.messages().slice(request.boundary)], this.#replay));
-		const completion = isFiniteNumber(call?.prompt) ? (call.completion ?? 0) - (this.#replay === "none" ? call.thinking ?? 0 : 0) : 0;
-		const extra = Math.max(0, (carried - (call?.estimate ?? carried)) * rate - completion);
-		const drift = isFiniteNumber(call?.prompt) ? 0 : Math.max(0, (call?.estimate ?? 0) * (rate - (gauge?.scale ?? rate)));
+		const { rate, extra, slack: drift } = this.#carry(request, calls);
 		const siblings = estimateMessages((request?.listings ?? []).filter((listing) => listing.turn === calls.length).map((listing) => ({
 			id: "result",
 			role: "tool",
@@ -12528,7 +14668,7 @@ var Ledger = class {
 		this.#flush();
 		const groups = [...new Set(this.#collectAfter(entered).flatMap((message) => {
 			const result = this.#results.get(message.id);
-			if (message.role !== "tool" || result?.success !== true) return [];
+			if (message.role !== "tool" || result?.success !== true || result.name !== "memo" && this.#enables(result.name)) return [];
 			const recalled = result.name === "recall";
 			if (recalled && /^nothing earlier on /.test(message.content)) return [];
 			const listing = recalled ? request.listings.findLast((one) => one.result === message.content) : void 0;
@@ -12537,7 +14677,7 @@ var Ledger = class {
 		const unique = groups.filter((group, at) => !splitResultLines(group).every((line) => groups.slice(0, at).some((earlier) => splitResultLines(earlier).includes(line))));
 		const digest = unique.length === 0 ? void 0 : `${LEDGER_NOTES.results}\n${unique.join("\n")}`;
 		const omitted = /* @__PURE__ */ new Set();
-		const rate = this.#recallRate(request) * (1 + LEDGER_SCALE_DRIFT);
+		const rate = this.#capacityRate(request) * (1 + LEDGER_SCALE_DRIFT);
 		const allowance = (this.#options.capacity - this.#predict) / rate;
 		const after = this.#collectAfter(entered);
 		const messages = [
@@ -12554,28 +14694,105 @@ var Ledger = class {
 			role: "user",
 			content: digest
 		}];
+		const shown = this.#show(this.#ceiling(request));
 		if (this.#gauge === void 0 || estimateMessages(stripThinking(this.#agent.context.build({
-			messages: [...messages, ...note],
-			judgments: []
+			selection: {
+				messages: [...messages, ...note],
+				judgments: []
+			},
+			disclosure: shown
 		}), this.#replay)) <= allowance) return {
 			digest,
 			omitted
 		};
 		const partials = new Set(after.filter((message) => message.role === "assistant" && !hasCalls(message)).map((message) => message.id));
-		const fitted = cutListing(unique, allowance - estimateMessages(stripThinking(this.#agent.context.build({
-			messages: messages.filter((message) => !partials.has(message.id)),
-			judgments: []
-		}), this.#replay)) - estimateTokens(`${LEDGER_NOTES.results}\n`), "more", false);
+		const base = estimateMessages(stripThinking(this.#agent.context.build({
+			selection: {
+				messages: messages.filter((message) => !partials.has(message.id)),
+				judgments: []
+			},
+			disclosure: shown
+		}), this.#replay));
+		if (base > allowance) throw new LedgerError("OVERFLOW", `the answer pass prices ${Math.ceil(base * rate)} tokens with every cut made, over the capacity ${this.#options.capacity} less predict ${this.#predict}; shorten the request, narrow what the scope shows, or raise capacity`, { context: {
+			capacity: this.#options.capacity,
+			predict: this.#predict,
+			price: base * rate
+		} });
+		const fitted = cutListing(unique, allowance - base - estimateTokens(`${LEDGER_NOTES.results}\n`), "more", false);
+		const cut = fitted === "" ? void 0 : `${LEDGER_NOTES.results}\n${fitted}`;
 		return {
-			digest: fitted === "" ? void 0 : `${LEDGER_NOTES.results}\n${fitted}`,
+			digest: cut !== void 0 && base + estimateMessages([{
+				id: "results",
+				role: "user",
+				content: cut
+			}]) > allowance ? void 0 : cut,
 			omitted: partials
 		};
 	}
+	#carry(request, calls) {
+		const rate = this.#recallRate(request) * (1 + LEDGER_SCALE_DRIFT);
+		const ceiling = request === void 0 ? {} : this.#ceiling(request);
+		const shown = this.#show(ceiling);
+		const carried = request === void 0 ? 0 : estimateMessages(stripThinking([...this.#agent.context.build({
+			...request.selection === void 0 ? {} : { selection: request.selection },
+			disclosure: shown,
+			switchable: this.#advertise(ceiling, shown.skills).some((tool) => tool.name === "switch")
+		}), ...this.#conversation.messages().slice(request.boundary)], this.#replay));
+		return {
+			rate,
+			...this.#terms(calls.at(-1), carried, rate)
+		};
+	}
+	#terms(call, carried, rate) {
+		const reply = isFiniteNumber(call?.prompt) ? (call.completion ?? 0) - (this.#replay === "none" ? call.thinking ?? 0 : 0) : 0;
+		return {
+			extra: Math.max(0, (carried - (call?.estimate ?? carried)) * rate - reply),
+			slack: isFiniteNumber(call?.prompt) ? 0 : Math.max(0, (call?.estimate ?? 0) * (rate - (this.#gauge?.scale ?? rate)))
+		};
+	}
+	#gate(index, sent) {
+		const request = this.#current();
+		if (request?.boundary === void 0) return true;
+		const left = attempt(() => index === 0 ? this.#first(request, sent) : this.#next(request, sent));
+		if (left.success && left.value >= 0) return true;
+		const limit = this.#options.capacity - this.#predict;
+		this.#refusal = new LedgerError("OVERFLOW", left.success ? `the request prices ${Math.ceil(limit - left.value)} tokens, over the capacity ${this.#options.capacity} less predict ${this.#predict}; shorten the request, narrow what the scope shows, or raise capacity` : `the request could not be priced against the capacity ${this.#options.capacity} less predict ${this.#predict}`, { context: {
+			capacity: this.#options.capacity,
+			predict: this.#predict,
+			price: left.success ? limit - left.value : Number.POSITIVE_INFINITY
+		} });
+		this.#agent.abort("overflow");
+		return false;
+	}
+	#first(request, sent) {
+		const gauge = this.#gauge;
+		if (gauge === void 0) throw new LedgerError("GAUGE", "the gate needs a gauge");
+		const tools = computeToolPrice(this.#measuredSet(), sent.tools ?? [], gauge);
+		const rate = request.calls.length === 0 ? gauge.scale : this.#capacityRate(request);
+		return this.#options.capacity - this.#predict - (Math.max(0, gauge.overhead - tools.spared) + tools.added + rate * (1 + LEDGER_SCALE_DRIFT) * estimateMessages(sent.messages));
+	}
+	#next(request, sent) {
+		request.think(this.#conversation.messages());
+		const gauge = this.#gauge;
+		if (gauge === void 0) throw new LedgerError("GAUGE", "the gate needs a gauge");
+		const calls = request.calls;
+		const last = calls.at(-1);
+		if (last === void 0) throw new Error("a later request has no recorded call before it");
+		const measured = this.#measuredSet();
+		const rate = this.#capacityRate(request) * (1 + LEDGER_SCALE_DRIFT);
+		const { extra, slack } = this.#terms(last, estimateMessages(sent.messages), rate);
+		const tools = computeToolPrice(measured, sent.tools ?? [], gauge);
+		const grown = (Math.min(gauge.overhead, Math.max(0, (last.spared ?? 0) - tools.spared) * computeToolDensity(measured, gauge) / gauge.scale) + Math.max(0, tools.added - (last.added ?? 0))) * (1 + LEDGER_SCALE_DRIFT);
+		return gauge.remainder(calls) - this.#predict - extra - slack - grown;
+	}
+	#capacityRate(request) {
+		return Math.max(this.#recallRate(request), this.#gauge?.scale ?? 1);
+	}
 	#recallRate(request) {
 		const gauge = this.#gauge;
 		if (gauge === void 0) return 1;
 		const calls = request?.calls ?? [];
-		const last = calls.findLast((call) => isFiniteNumber(call.prompt));
+		const last = calls.findLast((call) => isFiniteNumber(call.prompt) && (call.added ?? 0) === 0);
 		const measured = last !== void 0 && isFiniteNumber(last.prompt) && last.estimate > 0 && ((last.spared ?? 0) === 0 || (last.spared ?? 0) >= gauge.overhead) ? (last.prompt - Math.max(0, gauge.overhead - (last.spared ?? 0))) / last.estimate : 0;
 		return Math.max(gauge.rate(calls), measured);
 	}
@@ -12596,6 +14813,6 @@ var Ledger = class {
 function createLedger(provider, options) {
 	return new Ledger(provider, options);
 }
-export { AUTHORITY_NOTES, Agent, AgentContext, AgentError, AgentFanout, AgentJobError, AgentJudge, AgentProvider, AgentRegistry, Approver, Authority, CONVERSATION_RECAP_PREFIX, CONVERSATION_ROLES, Channel, Classifier, ContextError, Conversation, ConversationError, ConversationManager, DECISIVE_CATEGORIES, DEFAULT_AGENT_LIMIT, DEFAULT_CONVERSATION_KEEP, DEFAULT_LEDGER_LIMIT, DEFAULT_LEDGER_SHARE, DEFAULT_PROVIDER_TIMEOUT, DEFAULT_RECALL_LIMIT, DEFAULT_RELAY_LIMIT, DETERMINISTIC_JUDGE_ERROR, DatabaseConversationStore, DatabaseMemoStore, Gauge, IMAGE_TOKEN_ESTIMATE, INVALID_RELAY_STATUS, Instruction, InstructionManager, JudgeAbortError, JudgeError, JudgmentManager, LEDGER_CATEGORIES, LEDGER_NOTES, LEDGER_OWNER_PREFIX, LEDGER_QUESTIONS, LEDGER_RECALL_LABELS, LEDGER_RULES_KEY, LEDGER_SCALE_DRIFT, LEDGER_SLICE, LEDGER_WORD, Ledger, LedgerError, LedgerRequest, MAX_ERROR_BODY_LENGTH, MEMO_SECTION_HEADER, MESSAGE_ROLES, MESSAGE_TOKEN_OVERHEAD, MemoManager, MemoryConversationStore, MemoryMemoStore, OVERSIZED_RELAY_STATUS, PLACED_CATEGORIES, ProviderAbortError, ProviderError, QUIET_CATEGORIES, REFUSED_RELAY_CONTENT_TYPE, REFUSED_RELAY_STATUS, RELAY_CONTENT_TYPE, RELAY_PROVIDER_MESSAGE, RelayProvider, RelayStream, SCOPE_NOTE, SKILL_SECTION_HEADER, SYSTEM_ONE_PATH, Scope, ScopeManager, SkillManager, SystemOneJudge, THINK_CLOSE, THINK_OPEN, ThinkSplitter, UNAUTHORIZED_RELAY_STATUS, UPSTREAM_RELAY_STATUS, WORKSPACE_SECTION_HEADER, agentAnswerContract, agentAnswerShape, agentChunkToFrame, agentFrameContract, agentFrameShape, agentJobContract, agentJobShape, agentPromptContract, agentPromptShape, agentResultToFrame, agentResultToJSON, agentStreamToFrames, armReaderAbort, assembleResult, attachImages, attachUserImages, buildJudgeResult, buildJudgments, buildLedgerCut, buildLedgerIndex, buildLedgerLineKey, buildLedgerRenderContext, buildLines, buildProviderHeaders, buildProviderResult, buildRecallMessage, buildRecapMessage, buildRecords, buildRelayRequest, buildRequestMessage, buildSummaryMessage, chargeUsage, collectAmendments, collectExchanges, collectImageData, collectLedgerEvidence, collectLedgerLines, collectLedgerReplies, collectLive, collectNames, collectProjectionIds, collectRecallMessages, collectRegistry, collectRetiredFindings, collectToolGroups, collectWriteSupersessions, computeLedgerChecksum, computeThinking, conversationSnapshotContract, conversationSnapshotShape, copyJSON, createAgent, createAgentContext, createAgentQueue, createAgentRegistry, createAgentRunner, createApprover, createAuthority, createChannel, createConversation, createConversationManager, createDatabaseConversationStore, createDatabaseMemoStore, createInstruction, createInstructionManager, createLedger, createMemoManager, createMemoryConversationStore, createMemoryMemoStore, createRelay, createRelayProvider, createScope, createScopeManager, createSkillManager, createSystemOneJudge, createThinkSplitter, cutListing, denyCall, describeQuestionRefusal, describeRelayRefusal, describeSnapshotRefusal, digestLedgerTools, digestLedgerWindow, estimateMessages, estimateRequest, estimateTokens, extractLiterals, extractQueueOptions, extractSystemOneAnswer, extractSystemOneUsage, extractWords, filterAllowList, findLedgerCall, findLedgerCut, fitSlope, freezeJSON, handleAgentQueueJob, hasCalls, hasHiddenRecall, identifyLookup, inferStop, intersectKeys, isAgentError, isAgentJobError, isAuthorityDecision, isAuthorityVerdict, isContextError, isConversation, isConversationError, isConversationSnapshot, isFraction, isJudgeAbortError, isJudgeAnswer, isJudgeEntry, isJudgeError, isJudgeQuestion, isJudgment, isLedgerError, isLedgerQuestion, isLedgerSnapshot, isLedgerWindowSnapshot, isMemo, isMemoOrigin, isMemoSnapshot, isMessage, isMessageInput, isNonNegativeSafeInteger, isPositiveSafeInteger, isProviderAbortError, isProviderError, isProviderResult, isSection, isSystemOneAnswer, isSystemOneResponse, joinThinking, judgeAnswerContract, judgeAnswerShape, judgeEntryShape, judgeQuestionContract, judgeQuestionShape, judgmentContract, judgmentShape, ledgerSnapshotContract, ledgerSnapshotShape, ledgerWindowContract, ledgerWindowShape, linkOwners, matchEntities, matchesCutLine, matchesJSON, matchesJudgment, matchesLookup, measureAnswer, measureMessage, measureRequest, memoContract, memoShape, memoSnapshotContract, memoSnapshotShape, mergeSupersessions, messageContract, messageInputContract, messageInputShape, messageShape, normalizeArgument, normalizeWord, placeMember, providerRequestContract, providerRequestShape, providerResultContract, providerResultShape, questionToSystemOne, raceSignal, rankLedgerCut, readBodyText, readChunks, readFailure, readJudgeOutcome, readProviderDelta, relayFrameContract, relayFrameShape, releaseReader, removeEntries, renderArguments, renderCauseChain, renderFencedFile, renderIndexEntry, renderJSON, renderLedgerAnnotation, renderLedgerPinned, renderLedgerRecord, renderLookupCall, renderSection, renderStub, renderToolValue, renderTopicNames, requestToRelay, requireAnswer, requireBudget, requireConversation, requireConversationSnapshot, requireCumulative, requireEntry, requireFallback, requireJudgeResult, requireJudgment, requireKeep, requireLimit, requireMessageInput, requireProviderResult, requireRole, requireRules, requireSectionsCap, requireSummary, resolveDecision, resolvePredict, sanitizeToken, sanitizeUsage, scanAmendments, scanJudgmentTies, scanProbability, sectionContract, sectionShape, selectRecords, settleAgentJob, settleToolResult, splitResultLines, splitSentences, splitTopic, splitWords, stripThinking, sumUsage, tokenUsageShape, tokenUsageToJSON, toolCallShape };
+export { AGENT_OPTION_KEYS, AGENT_RUN_KEYS, ARGUMENT_BLANK_PATTERN, ARGUMENT_CONTROL_PATTERN, AUTHORITY_NOTES, AUTHORITY_OPTION_KEYS, Agent, AgentContext, AgentError, AgentFanout, AgentJobError, AgentJudge, AgentProvider, AgentRegistry, Approver, Authority, BUILD_OPTION_KEYS, BUILTIN_LIMITS, BUILTIN_NOTES, BUILTIN_TOOLS, CLASSIFIER_OPTION_KEYS, COMPACT_OPTION_KEYS, CONTEXT_OPTION_KEYS, CONVERSATION_INPUT_KEYS, CONVERSATION_MANAGER_KEYS, CONVERSATION_OPTION_KEYS, CONVERSATION_RECAP_PREFIX, CONVERSATION_ROLES, Channel, Classifier, ContextError, Conversation, ConversationError, ConversationManager, DECISIVE_CATEGORIES, DEFAULT_AGENT_LIMIT, DEFAULT_CONVERSATION_KEEP, DEFAULT_LEDGER_LIMIT, DEFAULT_LEDGER_SHARE, DEFAULT_PROVIDER_TIMEOUT, DEFAULT_RECALL_LIMIT, DEFAULT_RELAY_LIMIT, DETERMINISTIC_JUDGE_ERROR, DatabaseConversationStore, DatabaseMemoStore, GAUGE_OPTION_KEYS, Gauge, IMAGE_TOKEN_ESTIMATE, INSTRUCTION_MANAGER_KEYS, INVALID_RELAY_STATUS, Instruction, InstructionManager, JOB_REFUSAL_PREFIX, JUDGE_INPUT_KEYS, JudgeAbortError, JudgeError, JudgmentManager, LEDGER_AGENT_KEYS, LEDGER_CATEGORIES, LEDGER_NOTES, LEDGER_OPTION_KEYS, LEDGER_OWNER_PREFIX, LEDGER_QUESTIONS, LEDGER_RECALL_LABELS, LEDGER_RULES_KEY, LEDGER_SAMPLE_BYTES, LEDGER_SCALE_DRIFT, LEDGER_SLICE, LEDGER_WORD, LOADED_SECTION_HEADER, Ledger, LedgerError, LedgerRequest, MAX_ERROR_BODY_LENGTH, MEMO_MANAGER_KEYS, MEMO_SECTION_HEADER, MESSAGE_ROLES, MESSAGE_TOKEN_OVERHEAD, MemoManager, MemoryConversationStore, MemoryMemoStore, OVERSIZED_RELAY_STATUS, PLACED_CATEGORIES, PROVIDER_INPUT_KEYS, ProviderAbortError, ProviderError, QUEUE_OPTION_KEYS, QUIET_CATEGORIES, REFERENCE_OPTION_KEYS, REFUSED_RELAY_CONTENT_TYPE, REFUSED_RELAY_STATUS, REGISTRY_OPTION_KEYS, RELAY_CONTENT_TYPE, RELAY_OPTION_KEYS, RELAY_PROVIDER_KEYS, RELAY_PROVIDER_MESSAGE, RELAY_STREAM_KEYS, RUNNER_OPTION_KEYS, RelayProvider, RelayStream, SCOPE_FILTER_KEYS, SCOPE_KEYS, SCOPE_MANAGER_KEYS, SCOPE_NOTE, SKILL_MANAGER_KEYS, SKILL_SECTION_HEADER, STREAM_OPTION_KEYS, SYSTEM_ONE_OPTION_KEYS, SYSTEM_ONE_PATH, Scope, ScopeManager, SkillManager, SystemOneJudge, THINK_CLOSE, THINK_OPEN, ThinkSplitter, UNAUTHORIZED_RELAY_STATUS, UPSTREAM_RELAY_STATUS, WORKSPACE_INDEX_HEADER, WORKSPACE_SECTION_HEADER, agentAnswerContract, agentAnswerShape, agentChunkToFrame, agentFrameContract, agentFrameShape, agentJobContract, agentJobShape, agentPromptContract, agentPromptShape, agentResultToFrame, agentResultToJSON, agentStreamToFrames, armReaderAbort, assembleResult, attachImages, attachUserImages, buildJudgeResult, buildJudgments, buildLedgerCut, buildLedgerIndex, buildLedgerLineKey, buildLedgerRenderContext, buildLines, buildProviderHeaders, buildProviderResult, buildRecallMessage, buildRecapMessage, buildRecords, buildRelayRequest, buildRequestMessage, buildSummaryMessage, builtinToolContracts, chargeUsage, collectAmendments, collectBuiltinDefinitions, collectDisclosure, collectExchanges, collectImageData, collectJobRefusals, collectLedgerEvidence, collectLedgerLines, collectLedgerReplies, collectLive, collectNames, collectProjectionIds, collectRecallMessages, collectRegistry, collectRetiredFindings, collectToolGroups, collectWriteSupersessions, computeLedgerChecksum, computeSkillPrice, computeThinking, computeToolDensity, computeToolPrice, conversationSnapshotContract, conversationSnapshotShape, copyJSON, createAgent, createAgentContext, createAgentQueue, createAgentRegistry, createAgentRunner, createApprover, createAuthority, createBuiltinTool, createChannel, createConversation, createConversationManager, createDatabaseConversationStore, createDatabaseMemoStore, createInstruction, createInstructionManager, createLedger, createMemoManager, createMemoryConversationStore, createMemoryMemoStore, createRelay, createRelayProvider, createScope, createScopeManager, createSkillManager, createSystemOneJudge, createThinkSplitter, cutListing, cutWorkspaceSample, denyCall, describeCandidates, describeQuestionRefusal, describeRelayRefusal, describeSnapshotRefusal, digestLedgerTools, digestLedgerWindow, estimateMessages, estimateRequest, estimateTokens, extractLiterals, extractQueueOptions, extractSystemOneAnswer, extractSystemOneUsage, extractWords, filterAdvertisedTools, filterAllowList, filterBuiltinCandidates, findLedgerCut, findToolCall, fitSlope, freezeJSON, handleAgentQueueJob, hasCalls, hasHiddenRecall, identifyLookup, inferStop, instructionInputContract, instructionInputShape, intersectFilters, intersectKeys, isAgentBuiltin, isAgentCaller, isAgentError, isAgentJobError, isAuthorityDecision, isAuthorityVerdict, isContextError, isConversation, isConversationError, isConversationSnapshot, isFraction, isJudgeAbortError, isJudgeAnswer, isJudgeEntry, isJudgeError, isJudgeQuestion, isJudgment, isLedgerError, isLedgerQuestion, isLedgerSnapshot, isLedgerWindowSnapshot, isMemo, isMemoOrigin, isMemoSnapshot, isMessage, isMessageInput, isNonNegativeSafeInteger, isPositiveSafeInteger, isProviderAbortError, isProviderError, isProviderResult, isScope, isSection, isSystemOneAnswer, isSystemOneResponse, joinThinking, judgeAnswerContract, judgeAnswerShape, judgeEntryShape, judgeQuestionContract, judgeQuestionShape, judgmentContract, judgmentShape, ledgerSnapshotContract, ledgerSnapshotShape, ledgerWindowContract, ledgerWindowShape, linkOwners, loadToolContract, loadToolShape, matchEntities, matchesCutLine, matchesHeadLists, matchesJSON, matchesJudgment, matchesLookup, matchesPlainLine, measureAnswer, measureMessage, measureRequest, memoContract, memoInputContract, memoInputShape, memoShape, memoSnapshotContract, memoSnapshotShape, memoToolContract, memoToolShape, mergeSupersessions, messageContract, messageInputContract, messageInputShape, messageShape, normalizeArgument, normalizeWord, placeMember, providerRequestContract, providerRequestShape, providerResultContract, providerResultShape, questionToSystemOne, raceSignal, rankLedgerCut, readBodyText, readChunks, readFailure, readJudgeOutcome, readProviderDelta, relayFrameContract, relayFrameShape, releaseReader, rememberToolContract, rememberToolShape, removeEntries, renderArguments, renderCauseChain, renderFencedFile, renderIndexEntry, renderIndexLine, renderJSON, renderLedgerAnnotation, renderLedgerPinned, renderLedgerRecord, renderLookupCall, renderSection, renderSkillBody, renderStub, renderToolValue, renderTopicNames, requestToRelay, requireAnswer, requireBudget, requireBuiltins, requireConversation, requireConversationSnapshot, requireCumulative, requireEntry, requireFallback, requireJudgeResult, requireJudgment, requireKeep, requireLimit, requireMessageInput, requireProviderResult, requireRecordInput, requireRole, requireRules, requireScope, requireSectionsCap, requireSummary, requireWorkspace, resolveDecision, resolveDisclosure, resolvePredict, resolveWorkspace, sanitizeToken, sanitizeUsage, scanAmendments, scanJobTree, scanJudgmentTies, scanProbability, sectionContract, sectionShape, selectRecords, settleAgentJob, settleToolResult, skillInputContract, skillInputShape, splitResultLines, splitSentences, splitTopic, splitWords, stripThinking, sumUsage, switchToolContract, switchToolShape, tokenUsageShape, tokenUsageToJSON, toolCallShape };
 
 //# sourceMappingURL=index.js.map