@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/heart/core.js

@@ -1,85 +1,153 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasToolIntent = exports.buildSystem = exports.toResponsesTools = exports.toResponsesInput = exports.streamResponsesApi = exports.streamChatCompletion = exports.getToolsForChannel = exports.summarizeArgs = exports.execTool = exports.tools = void 0;
+exports.MAX_PROVIDER_ITERATIONS = void 0;
+exports.validateToolCallBatchAtProductionBoundary = validateToolCallBatchAtProductionBoundary;
 exports.createProviderRegistry = createProviderRegistry;
+exports.getProviderRuntime = getProviderRuntime;
 exports.resetProviderRuntime = resetProviderRuntime;
 exports.getModel = getModel;
 exports.getProvider = getProvider;
 exports.createSummarize = createSummarize;
 exports.getProviderDisplayLabel = getProviderDisplayLabel;
-exports.getFinalAnswerRetryError = getFinalAnswerRetryError;
+exports.createHabitCallbackBuffer = createHabitCallbackBuffer;
+exports.resumeApprovalContinuation = resumeApprovalContinuation;
+exports.isChatStyleChannel = isChatStyleChannel;
+exports.buildPonderResult = buildPonderResult;
+exports.isExternalStateQuery = isExternalStateQuery;
+exports.getSettleRetryError = getSettleRetryError;
 exports.stripLastToolCalls = stripLastToolCalls;
 exports.repairOrphanedToolCalls = repairOrphanedToolCalls;
-exports.isTransientError = isTransientError;
-exports.classifyTransientError = classifyTransientError;
 exports.runAgent = runAgent;
 const config_1 = require("./config");
 const identity_1 = require("./identity");
 const tools_1 = require("../repertoire/tools");
-const channel_1 = require("../mind/friends/channel");
+const tool_arguments_1 = require("../repertoire/tool-arguments");
+const session_events_1 = require("./session-events");
+const tool_approval_1 = require("./tool-approval");
+const friends_1 = require("@ouro.bot/friends");
+const streaming_1 = require("./streaming");
 const runtime_1 = require("../nerves/runtime");
+function validateToolCallBatchAtProductionBoundary(calls, activeTools) {
+    const callIdCounts = new Map();
+    for (const call of calls)
+        callIdCounts.set(call.id, (callIdCounts.get(call.id) ?? 0) + 1);
+    return calls.map((call) => {
+        if (callIdCounts.get(call.id) !== 1)
+            return { call, error: "duplicate tool call id" };
+        const advertised = activeTools.find((tool) => tool.function.name === call.name);
+        if (!advertised || !advertised.function.parameters || typeof advertised.function.parameters !== "object")
+            return { call, error: "tool was not advertised with a valid argument schema" };
+        const validated = (0, tool_arguments_1.validateAdvertisedToolArguments)(call.arguments, advertised.function.parameters);
+        return validated.ok ? { call, advertised, validated: validated.value } : { call, error: validated.reason };
+    });
+}
 const context_1 = require("../mind/context");
+const prompt_budget_1 = require("../mind/prompt-budget");
 const prompt_1 = require("../mind/prompt");
-const associative_recall_1 = require("../mind/associative-recall");
+const kept_notes_1 = require("./kept-notes");
+const error_classification_1 = require("./providers/error-classification");
 const anthropic_1 = require("./providers/anthropic");
 const azure_1 = require("./providers/azure");
 const minimax_1 = require("./providers/minimax");
 const openai_codex_1 = require("./providers/openai-codex");
 const github_copilot_1 = require("./providers/github-copilot");
-const pending_1 = require("../mind/pending");
+const openai_compatible_1 = require("./providers/openai-compatible");
+const orientation_frame_1 = require("./orientation-frame");
 const identity_2 = require("./identity");
 const socket_client_1 = require("./daemon/socket-client");
-const obligations_1 = require("./obligations");
-let _providerRuntime = null;
-function getProviderRuntimeFingerprint() {
-    const provider = (0, identity_1.loadAgentConfig)().provider;
-    /* v8 ignore next -- switch: not all provider branches exercised in CI @preserve */
-    switch (provider) {
-        case "azure": {
-            const { apiKey, endpoint, deployment, modelName, apiVersion, managedIdentityClientId } = (0, config_1.getAzureConfig)();
-            return JSON.stringify({ provider, apiKey, endpoint, deployment, modelName, apiVersion, managedIdentityClientId });
-        }
-        case "anthropic": {
-            const { model, setupToken } = (0, config_1.getAnthropicConfig)();
-            return JSON.stringify({ provider, model, setupToken });
-        }
-        case "minimax": {
-            const { apiKey, model } = (0, config_1.getMinimaxConfig)();
-            return JSON.stringify({ provider, apiKey, model });
-        }
-        case "openai-codex": {
-            const { model, oauthAccessToken } = (0, config_1.getOpenAICodexConfig)();
-            return JSON.stringify({ provider, model, oauthAccessToken });
-        }
-        /* v8 ignore start -- fingerprint: tested via provider init tests @preserve */
-        case "github-copilot": {
-            const { model, githubToken, baseUrl } = (0, config_1.getGithubCopilotConfig)();
-            return JSON.stringify({ provider, model, githubToken, baseUrl });
+const obligations_1 = require("../arc/obligations");
+const tool_loop_1 = require("./tool-loop");
+const packets_1 = require("../arc/packets");
+const tool_friction_1 = require("./tool-friction");
+const provider_models_1 = require("./provider-models");
+const provider_credentials_1 = require("./provider-credentials");
+const habit_session_1 = require("./habits/habit-session");
+const provider_attempt_1 = require("./provider-attempt");
+const openai_codex_token_1 = require("./providers/openai-codex-token");
+// Cache only immutable provider construction inputs. ProviderRuntime owns
+// mutable per-turn state (for example Responses nativeInput), so every caller
+// must receive a fresh instance even when its binding fingerprint is unchanged.
+const _providerRuntimeFactories = {
+    human: null,
+    agent: null,
+};
+function providerLaneForFacing(facing) {
+    return facing === "human" ? "outward" : "inner";
+}
+function resolveRuntimeProviderBinding(facing, owner) {
+    const lane = providerLaneForFacing(facing);
+    const config = (0, identity_1.loadAgentConfig)(owner);
+    const facingConfig = facing === "human" ? config.humanFacing : config.agentFacing;
+    return { lane, provider: facingConfig.provider, model: facingConfig.model };
+}
+async function getProviderRuntimeFingerprint(facing, owner) {
+    const agentName = owner?.agentName ?? (0, identity_2.getAgentName)();
+    const binding = resolveRuntimeProviderBinding(facing, owner);
+    const credential = await (0, provider_credentials_1.readProviderCredentialRecord)(agentName, binding.provider);
+    if (!credential.ok) {
+        throw new Error([
+            `${binding.lane} provider ${binding.provider} (${binding.model}) has no credentials for ${agentName}.`,
+            credential.error,
+            `Run \`ouro auth --agent ${agentName} --provider ${binding.provider}\`.`,
+        ].join("\n"));
+    }
+    let record = credential.record;
+    if (binding.provider === "openai-codex") {
+        const refresh = await (0, openai_codex_token_1.refreshOpenAICodexProviderCredentials)(agentName, {
+            record,
+            reason: "runtime-init",
+        });
+        if (refresh.ok) {
+            record = refresh.record;
         }
-        /* v8 ignore stop */
     }
+    return {
+        binding,
+        fingerprint: JSON.stringify({
+            ...(owner ? { agentName: owner.agentName, agentRoot: owner.agentRoot } : {}),
+            lane: binding.lane,
+            provider: binding.provider,
+            model: binding.model,
+            credentialRevision: record.revision,
+        }),
+        credential: record,
+    };
 }
 function createProviderRegistry() {
-    const factories = {
-        azure: azure_1.createAzureProviderRuntime,
-        anthropic: anthropic_1.createAnthropicProviderRuntime,
-        minimax: minimax_1.createMinimaxProviderRuntime,
-        "openai-codex": openai_codex_1.createOpenAICodexProviderRuntime,
-        "github-copilot": github_copilot_1.createGithubCopilotProviderRuntime,
-    };
     return {
-        resolve() {
-            const provider = (0, identity_1.loadAgentConfig)().provider;
-            return factories[provider]();
+        resolve(provider, model, credential) {
+            const providerConfig = { ...credential.config, ...credential.credentials };
+            switch (provider) {
+                case "azure":
+                    return (0, azure_1.createAzureProviderRuntime)(model, providerConfig);
+                case "anthropic":
+                    return (0, anthropic_1.createAnthropicProviderRuntime)(model, providerConfig);
+                case "minimax":
+                    return (0, minimax_1.createMinimaxProviderRuntime)(model, providerConfig);
+                case "openai-codex":
+                    return (0, openai_codex_1.createOpenAICodexProviderRuntime)(model, providerConfig);
+                case "github-copilot":
+                    return (0, github_copilot_1.createGithubCopilotProviderRuntime)(model, providerConfig);
+                case "openai-compatible":
+                case "openai-compatible-gemini":
+                    return (0, openai_compatible_1.createOpenAICompatibleProviderRuntime)(provider, model, providerConfig);
+            }
         },
     };
 }
-function getProviderRuntime() {
+async function getProviderRuntime(facing = "human", owner) {
+    const scope = owner ? { agentName: owner.agentName, agentRoot: owner.agentRoot } : undefined;
+    let runtime = null;
     try {
-        const fingerprint = getProviderRuntimeFingerprint();
-        if (!_providerRuntime || _providerRuntime.fingerprint !== fingerprint) {
-            const runtime = createProviderRegistry().resolve();
-            _providerRuntime = runtime ? { fingerprint, runtime } : null;
+        const { binding, fingerprint, credential } = await getProviderRuntimeFingerprint(facing, scope);
+        const cached = _providerRuntimeFactories[facing];
+        if (!cached || cached.fingerprint !== fingerprint) {
+            const create = () => createProviderRegistry().resolve(binding.provider, binding.model, credential);
+            runtime = create();
+            _providerRuntimeFactories[facing] = runtime ? { fingerprint, create } : null;
+        }
+        else {
+            runtime = cached.create();
         }
     }
     catch (error) {
@@ -89,43 +157,46 @@ function getProviderRuntime() {
             event: "engine.provider_init_error",
             component: "engine",
             message: msg,
-            meta: {},
+            meta: { facing },
         });
         // eslint-disable-next-line no-console -- pre-boot guard: provider init failure
         console.error(`\n[fatal] ${msg}\n`);
-        process.exit(1);
-        throw new Error("unreachable");
+        throw error instanceof Error ? error : new Error(msg);
     }
-    if (!_providerRuntime) {
+    if (!runtime) {
+        const msg = "provider runtime could not be initialized.";
         (0, runtime_1.emitNervesEvent)({
             level: "error",
             event: "engine.provider_init_error",
             component: "engine",
-            message: "provider runtime could not be initialized.",
-            meta: {},
+            message: msg,
+            meta: { facing },
         });
-        process.exit(1);
-        throw new Error("unreachable");
+        // eslint-disable-next-line no-console -- pre-boot guard: provider init failure
+        console.error(`\n[fatal] ${msg}\n`);
+        throw new Error(msg);
     }
-    return _providerRuntime.runtime;
+    // The shared tool loop supplies approval continuation to every provider adapter.
+    return { ...runtime, capabilities: new Set([...runtime.capabilities, "approval-continuation"]) };
 }
 /**
- * Clear the cached provider runtime so the next access re-creates it from
- * current config. Runtime access also auto-refreshes when the selected
- * provider fingerprint changes on disk.
+ * Clear cached provider construction inputs so the next access re-reads them
+ * from current config. Runtime instances are always per-caller and are never
+ * shared across turns.
  */
 function resetProviderRuntime() {
-    _providerRuntime = null;
+    _providerRuntimeFactories.human = null;
+    _providerRuntimeFactories.agent = null;
 }
-function getModel() {
-    return getProviderRuntime().model;
+function getModel(facing = "human") {
+    return resolveRuntimeProviderBinding(facing).model;
 }
-function getProvider() {
-    return getProviderRuntime().id;
+function getProvider(facing = "human") {
+    return resolveRuntimeProviderBinding(facing).provider;
 }
-function createSummarize() {
+function createSummarize(facing = "human") {
     return async (transcript, instruction) => {
-        const runtime = getProviderRuntime();
+        const runtime = await getProviderRuntime(facing);
         const client = runtime.client;
         const response = await client.chat.completions.create({
             model: runtime.model,
@@ -138,137 +209,593 @@ function createSummarize() {
         return response.choices?.[0]?.message?.content ?? transcript;
     };
 }
-function getProviderDisplayLabel() {
-    const provider = (0, identity_1.loadAgentConfig)().provider;
+function getProviderDisplayLabel(facing = "human") {
+    const binding = resolveRuntimeProviderBinding(facing);
+    const provider = binding.provider;
+    const model = binding.model || "unknown";
     const providerLabelBuilders = {
         azure: () => {
-            const config = (0, config_1.getAzureConfig)();
-            return `azure openai (${config.deployment || "default"}, model: ${config.modelName || "unknown"})`;
+            return `azure openai (model: ${model})`;
         },
-        anthropic: () => `anthropic (${(0, config_1.getAnthropicConfig)().model || "unknown"})`,
-        minimax: () => `minimax (${(0, config_1.getMinimaxConfig)().model || "unknown"})`,
-        "openai-codex": () => `openai codex (${(0, config_1.getOpenAICodexConfig)().model || "unknown"})`,
+        anthropic: () => `anthropic (${model})`,
+        minimax: () => `minimax (${model})`,
+        "openai-codex": () => `openai codex (${model})`,
         /* v8 ignore next -- branch: tested via display label unit test @preserve */
-        "github-copilot": () => `github copilot (${(0, config_1.getGithubCopilotConfig)().model || "unknown"})`,
+        "github-copilot": () => `github copilot (${model})`,
+        "openai-compatible": () => `z.ai openai-compatible (${model})`,
+        "openai-compatible-gemini": () => `gemini openai-compatible (${model})`,
     };
     return providerLabelBuilders[provider]();
 }
-// Re-export tools, execTool, summarizeArgs from ./tools for backward compat
-var tools_2 = require("../repertoire/tools");
-Object.defineProperty(exports, "tools", { enumerable: true, get: function () { return tools_2.tools; } });
-Object.defineProperty(exports, "execTool", { enumerable: true, get: function () { return tools_2.execTool; } });
-Object.defineProperty(exports, "summarizeArgs", { enumerable: true, get: function () { return tools_2.summarizeArgs; } });
-Object.defineProperty(exports, "getToolsForChannel", { enumerable: true, get: function () { return tools_2.getToolsForChannel; } });
-// Re-export streaming functions for backward compat
-var streaming_1 = require("./streaming");
-Object.defineProperty(exports, "streamChatCompletion", { enumerable: true, get: function () { return streaming_1.streamChatCompletion; } });
-Object.defineProperty(exports, "streamResponsesApi", { enumerable: true, get: function () { return streaming_1.streamResponsesApi; } });
-Object.defineProperty(exports, "toResponsesInput", { enumerable: true, get: function () { return streaming_1.toResponsesInput; } });
-Object.defineProperty(exports, "toResponsesTools", { enumerable: true, get: function () { return streaming_1.toResponsesTools; } });
-// Re-export prompt functions for backward compat
-var prompt_2 = require("../mind/prompt");
-Object.defineProperty(exports, "buildSystem", { enumerable: true, get: function () { return prompt_2.buildSystem; } });
-const DELEGATION_REASON_PROSE_HANDOFF = {
-    explicit_reflection: "something in the conversation called for reflection",
-    cross_session: "this touches other conversations",
-    bridge_state: "there's shared work spanning sessions",
-    task_state: "there are active tasks that relate to this",
-    non_fast_path_tool: "this needs tools beyond a simple reply",
-    unresolved_obligation: "there's an unresolved commitment from an earlier conversation",
+function createCallbackBuffer(callbacks, mode) {
+    const events = [];
+    const bufferedCallbacks = {
+        ...callbacks,
+        onTextChunk: (text) => { events.push({ kind: "text", text }); },
+        onClearText: () => { events.push({ kind: "clear" }); },
+        flushNow: () => { events.push({ kind: "flush" }); },
+    };
+    if (mode === "all") {
+        bufferedCallbacks.onModelStreamStart = () => { events.push({ kind: "stream-start" }); };
+        bufferedCallbacks.onReasoningChunk = (text) => { events.push({ kind: "reasoning", text }); };
+    }
+    return {
+        callbacks: bufferedCallbacks,
+        async flush() {
+            for (const event of events.splice(0)) {
+                switch (event.kind) {
+                    case "stream-start":
+                        callbacks.onModelStreamStart();
+                        break;
+                    case "text":
+                        callbacks.onTextChunk(event.text);
+                        break;
+                    case "reasoning":
+                        callbacks.onReasoningChunk(event.text);
+                        break;
+                    case "clear":
+                        callbacks.onClearText?.();
+                        break;
+                    case "flush":
+                        await callbacks.flushNow?.();
+                        break;
+                }
+            }
+        },
+        discard() {
+            events.splice(0);
+        },
+    };
+}
+function createHabitCallbackBuffer(callbacks) {
+    return createCallbackBuffer(callbacks, "all");
+}
+function createFinalOnlyTextBuffer(callbacks) {
+    return createCallbackBuffer(callbacks, "text-only");
+}
+exports.MAX_PROVIDER_ITERATIONS = 8;
+function continuationCallbacks(callbacks, text) {
+    const noop = () => undefined;
+    return {
+        onModelStart: callbacks.onModelStart ?? noop,
+        onModelStreamStart: callbacks.onModelStreamStart ?? noop,
+        onTextChunk: (chunk) => {
+            text.value += chunk;
+            callbacks.onTextChunk?.(chunk);
+        },
+        onReasoningChunk: callbacks.onReasoningChunk ?? noop,
+        onToolStart: callbacks.onToolStart ?? noop,
+        onToolEnd: callbacks.onToolEnd ?? noop,
+        onError: callbacks.onError ?? noop,
+        ...(callbacks.onClearText ? { onClearText: callbacks.onClearText } : {}),
+        ...(callbacks.flushNow ? { flushNow: callbacks.flushNow } : {}),
+        ...(callbacks.settleOutputMode ? { settleOutputMode: callbacks.settleOutputMode } : {}),
+    };
+}
+async function resumeApprovalContinuation(options) {
+    const claim = options.claimContinuation();
+    if (!claim.claimed) {
+        if (claim.interruptedAfterAttempt) {
+            const notice = "the approval continuation was interrupted after provider work began; its outcome is indeterminate and it will not be retried automatically";
+            await options.deliver(notice);
+            (0, runtime_1.emitNervesEvent)({
+                level: "error",
+                component: "engine",
+                event: "engine.approval_continuation_indeterminate",
+                message: "approval continuation interrupted after provider attempt",
+                meta: { approvalId: options.record.approvalId, continuationState: claim.record.continuationState },
+            });
+            return { outcome: "terminal_notice", messages: structuredClone(options.sessionMessages) };
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "engine",
+            event: "engine.approval_continuation_duplicate",
+            message: "approval continuation was already consumed",
+            meta: { approvalId: options.record.approvalId },
+        });
+        return { outcome: "already_continued", messages: structuredClone(options.sessionMessages) };
+    }
+    const materialized = (0, session_events_1.materializeApprovalTerminal)({
+        messages: options.sessionMessages,
+        checkpoint: options.checkpoint,
+        record: options.record,
+        currentSessionRevision: options.currentSessionRevision,
+        materializedApprovalIds: options.materializedApprovalIds,
+    });
+    const recoveredMaterialization = claim.record.continuationState === "materialized";
+    if (!recoveredMaterialization) {
+        await options.persist(materialized.messages);
+        await options.markContinuationMaterialized();
+    }
+    const currentOptions = options.revalidate ? await options.revalidate()
+        : options.runAgentOptions?.toolContext?.relationshipAuthorization ? null : options.runAgentOptions;
+    if (!materialized.resumeProvider || currentOptions === null) {
+        if (currentOptions === null)
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn", component: "engine", event: "engine.approval_continuation_authority_block",
+                message: "approval continuation has no current relationship authority",
+                meta: { approvalId: options.record.approvalId, state: options.record.state },
+            });
+        const effect = options.record.state === "succeeded" ? "the approved action completed"
+            : options.record.state === "failed" ? "the approved action failed" : "the protected action was not executed";
+        await options.deliver(materialized.directNotice ?? `${effect}; current relationship access is unavailable, so no model continuation was run`);
+        await options.completeContinuation();
+        return { outcome: "terminal_notice", messages: materialized.messages };
+    }
+    const outward = { value: "" };
+    const callbacks = continuationCallbacks(options.callbacks, outward);
+    await options.markContinuationAttempted();
+    const result = await options.runAgent(materialized.messages, callbacks, options.channel, options.signal, currentOptions);
+    if (result.outcome === "suspended") {
+        await options.completeContinuation();
+        return { outcome: result.outcome, messages: materialized.messages, suspension: result.suspension };
+    }
+    await options.persist(materialized.messages, result);
+    if (outward.value)
+        await options.deliver(outward.value);
+    await options.completeContinuation();
+    (0, runtime_1.emitNervesEvent)({
+        component: "engine",
+        event: "engine.approval_continuation_completed",
+        message: "approval continuation completed through existing provider loop",
+        meta: { approvalId: options.record.approvalId, outcome: result.outcome },
+    });
+    return { outcome: result.outcome, messages: materialized.messages };
+}
+/**
+ * Strip <think>...</think> blocks for the violation-detection check at the
+ * end of a streaming turn. Used to tell legitimate text-only responses
+ * apart from the MiniMax-M2.7 "only thinking, no tool call" violation
+ * shape. Mirrors the more thorough stripThinkBlocks helper in
+ * senses/shared-turn.ts (which is for operator-facing output) — kept
+ * inline here to avoid pulling senses/ into the core module's import graph.
+ */
+function stripThinkBlocksForViolationCheck(input) {
+    let out = input;
+    for (;;) {
+        const open = out.indexOf("<think>");
+        if (open === -1)
+            break;
+        const close = out.indexOf("</think>", open + "<think>".length);
+        if (close === -1) {
+            out = out.slice(0, open);
+            break;
+        }
+        out = out.slice(0, open) + out.slice(close + "</think>".length);
+    }
+    return out.trim();
+}
+function hasFreshPendingWork(options) {
+    const pendingMessages = options?.pendingMessages;
+    if (!Array.isArray(pendingMessages))
+        return false;
+    return pendingMessages.some((message) => typeof message?.content === "string"
+        && message.content.trim().length > 0);
+}
+const HABIT_CONTROL_TOOLS = new Set(["rest", "ponder", "observe"]);
+function highRiskExternalMutation(profile) {
+    if (profile.risk !== "high")
+        return null;
+    const mutates = typeof profile.mutates === "string" ? [profile.mutates] : [...profile.mutates];
+    return mutates.includes("external_side_effect") ? mutates.join(", ") : null;
+}
+function recordBlockedHabitSurfaceAttempts(habitSession, toolCalls, reason) {
+    if (toolCalls.some((call) => call.name !== "send_message" && call.name !== "surface")) {
+        habitSession?.recordError?.(`blocked habit tool batch: ${reason}`);
+    }
+    if (!habitSession?.recordSurfaceAttempt)
+        return;
+    for (const call of toolCalls) {
+        if (call.name !== "send_message" && call.name !== "surface")
+            continue;
+        // The canonical pre-batch schema gate guarantees object arguments here.
+        const args = JSON.parse(call.arguments);
+        habitSession.recordSurfaceAttempt({
+            recipient: String(args.friendId ?? args.delegationId ?? "unknown"),
+            channel: String(args.channel ?? call.name),
+            reason: "blocked",
+            result: "blocked",
+            rawStatus: "blocked",
+            error: reason,
+        });
+    }
+}
+async function habitToolBatchBlockReason(habitSession, toolCalls, delegatedOrigins, selection) {
+    if (!habitSession)
+        return null;
+    const granted = new Set(habitSession.toolPolicy.grantedTools);
+    const denied = new Set(habitSession.toolPolicy.deniedTools);
+    for (const call of toolCalls) {
+        if (denied.has(call.name))
+            return `habit tool '${call.name}' is denied by this habit session`;
+        if (HABIT_CONTROL_TOOLS.has(call.name))
+            continue;
+        if (!granted.has(call.name))
+            return `habit tool '${call.name}' was not granted to this habit session`;
+        // The canonical pre-batch schema gate guarantees object arguments here.
+        const args = JSON.parse(call.arguments);
+        const riskProfile = (0, tools_1.riskProfileForToolName)(call.name, args, selection);
+        if (!riskProfile)
+            return `habit tool '${call.name}' does not have a known executable risk profile`;
+        const externalMutation = highRiskExternalMutation(riskProfile);
+        if (externalMutation && call.name !== "send_message" && call.name !== "surface") {
+            return `habit tool '${call.name}' has high-risk executable mutation ${externalMutation}: ${riskProfile.reason}`;
+        }
+        if (call.name === "send_message" || call.name === "surface") {
+            const route = await (0, habit_session_1.resolveHabitReturnRoute)({
+                agentRoot: (0, identity_2.getAgentRoot)(),
+                envelope: habitSession.permissionEnvelope,
+                toolName: call.name,
+                args,
+                friendStore: habitSession.friendStore,
+                delegatedOrigins,
+            });
+            if (!route.allowed)
+                return route.reason;
+        }
+    }
+    return null;
+}
+/** Channels that deliberately support mid-turn delivery expose `speak`.
+ *  BlueBubbles is final-only: its adapter owns one accepted visibility boundary.
+ *  The private runtime has `ponder`; MCP returns synchronously; mail is batch. */
+function isChatStyleChannel(channel) {
+    return (0, friends_1.getChannelCapabilities)(channel).chatStyle;
+}
+function bindCurrentIngressEvidenceLocator(toolList, evidence) {
+    if (!evidence
+        || evidence.schemaVersion !== 1
+        || evidence.provider !== "bluebubbles"
+        || !/^[a-f0-9]{64}$/.test(evidence.captureKeyHash))
+        return toolList;
+    const locator = `capture:${evidence.captureKeyHash}`;
+    return toolList.map((tool) => {
+        if (tool.function.name !== "habit_cancel")
+            return tool;
+        const parameters = tool.function.parameters;
+        const properties = parameters.properties;
+        return {
+            ...tool,
+            function: {
+                ...tool.function,
+                parameters: {
+                    ...parameters,
+                    properties: {
+                        ...properties,
+                        evidence: {
+                            ...properties.evidence,
+                            enum: [locator],
+                        },
+                    },
+                },
+            },
+        };
+    });
+}
+// Sole-call tools must be the only tool call in a turn. When they appear
+// alongside other tools, the sole-call tool is rejected with this message.
+const SOLE_CALL_REJECTION = {
+    settle: "rejected: settle must be the only tool call. finish your work first, then call settle alone.",
+    observe: "rejected: observe must be the only tool call. call observe alone when you want to stay silent.",
+    rest: "rejected: rest must be the only tool call. finish your work first, then call rest alone.",
 };
-function buildGoInwardHandoffPacket(params) {
-    const reasons = params.delegationDecision?.reasons ?? [];
-    const reasonProse = reasons.length > 0
-        ? reasons.map((r) => DELEGATION_REASON_PROSE_HANDOFF[r]).join("; ")
-        : "this felt like it needed more thought";
-    const returnAddress = params.currentSession
-        ? `${params.currentSession.friendId}/${params.currentSession.channel}/${params.currentSession.key}`
-        : "no specific return -- just thinking";
-    let obligationLine;
-    if (params.outwardClosureRequired && params.currentSession) {
-        obligationLine = `i need to come back to ${params.currentSession.friendId} with something`;
+function parseSettlePayload(argumentsText) {
+    const parsed = JSON.parse(argumentsText);
+    // Provider finalization validates settle.answer as a string before this
+    // terminal handling path. Keep this parser focused on projection instead
+    // of carrying an unreachable second shape check.
+    const answer = parsed.answer;
+    const rawIntent = parsed.intent;
+    const intent = rawIntent === "complete" || rawIntent === "blocked" || rawIntent === "direct_reply"
+        ? rawIntent
+        : undefined;
+    return { answer, intent };
+}
+function parsePonderPayload(argumentsText) {
+    // The canonical pre-batch schema gate guarantees a valid object payload.
+    return JSON.parse(argumentsText);
+}
+function parseSuccessCriteria(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const criteria = raw
+        .split("\n")
+        .map((line) => line.replace(/^\s*[-*]\s*/, "").trim())
+        .filter((line) => line.length > 0);
+    return criteria.length > 0 ? criteria : null;
+}
+function parsePacketPayload(raw) {
+    if (typeof raw !== "string")
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
     }
-    else {
-        obligationLine = "no obligation -- just thinking";
-    }
-    return [
-        "## what i need to think about",
-        params.content,
-        "",
-        "## why this came up",
-        reasonProse,
-        "",
-        "## where to bring it back",
-        returnAddress,
-        "",
-        "## what i owe",
-        obligationLine,
-        "",
-        "## thinking mode",
-        params.mode,
-    ].join("\n");
-}
-function parseFinalAnswerPayload(argumentsText) {
+    catch {
+        return null;
+    }
+}
+function normalizeLegacyPonderArgs(parsed) {
+    if (typeof parsed.thought !== "string" || parsed.thought.trim().length === 0) {
+        return parsed;
+    }
+    return {
+        action: "create",
+        kind: "reflection",
+        objective: parsed.thought.trim(),
+        summary: typeof parsed.say === "string" ? parsed.say.trim() : "",
+        success_criteria: "- preserve the thread for later work",
+        payload_json: "{}",
+    };
+}
+function messageContentText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((part) => {
+        if (typeof part === "string")
+            return part;
+        if (!part || typeof part !== "object")
+            return "";
+        const maybeText = part.text;
+        return typeof maybeText === "string" ? maybeText : "";
+    })
+        .filter(Boolean)
+        .join("\n");
+}
+function toolResultIndicatesFailure(content) {
+    const normalized = content.trim().toLowerCase();
+    return normalized.startsWith("error:")
+        || normalized.startsWith("invalid tool arguments:")
+        || normalized.startsWith("unknown:")
+        || normalized.startsWith("relationship authorization required:")
+        || normalized.startsWith("orientation hold:")
+        || normalized.startsWith("commerce authority required:")
+        || normalized.startsWith("blocked:")
+        || normalized.startsWith("rejected:");
+}
+function requiredToolResultSucceeded(name, content, args, validate) {
+    if (toolResultIndicatesFailure(content))
+        return false;
+    return validate?.(name, content, args) ?? true;
+}
+function effectFingerprint(name, rawArguments, selection) {
+    let args;
     try {
-        const parsed = JSON.parse(argumentsText);
-        if (typeof parsed === "string") {
-            return { answer: parsed };
+        const parsed = JSON.parse(rawArguments);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        args = { ...parsed };
+    }
+    catch {
+        return null;
+    }
+    const profile = (0, tools_1.riskProfileForToolName)(name, args, selection);
+    if (!profile || profile.mutates === "none")
+        return null;
+    delete args.expectedVersion;
+    return (0, tool_arguments_1.digestJson)({ name, args });
+}
+function historicalFailedEffectsForExactRepeatedRequest(messages, selection) {
+    const userRequests = [];
+    for (let index = 0; index < messages.length; index += 1) {
+        const message = messages[index];
+        if (message?.role !== "user")
+            continue;
+        const text = messageContentText(message.content).replace(/\s+/g, " ").trim();
+        if (!text)
+            continue;
+        userRequests.push({ index, text });
+    }
+    const current = userRequests.at(-1);
+    if (!current)
+        return [];
+    const prior = userRequests.slice(0, -1).find((request) => request.text === current.text);
+    if (!prior)
+        return [];
+    const effectsByCallId = new Map();
+    const failedEffects = new Map();
+    for (let index = prior.index + 1; index < current.index; index += 1) {
+        const message = messages[index];
+        if (message?.role === "assistant" && Array.isArray(message.tool_calls)) {
+            for (const call of message.tool_calls) {
+                if (call.type !== "function" || !call.id || !call.function.name)
+                    continue;
+                const fingerprint = effectFingerprint(call.function.name, call.function.arguments, selection);
+                if (fingerprint)
+                    effectsByCallId.set(call.id, { name: call.function.name, fingerprint });
+            }
+            continue;
+        }
+        if (message?.role !== "tool")
+            continue;
+        const content = messageContentText(message.content);
+        const effect = effectsByCallId.get(message.tool_call_id);
+        if (!effect)
+            continue;
+        if (toolResultIndicatesFailure(content)) {
+            failedEffects.set(effect.fingerprint, effect);
         }
-        if (!parsed || typeof parsed !== "object") {
-            return {};
+        else {
+            failedEffects.delete(effect.fingerprint);
         }
-        const answer = typeof parsed.answer === "string" ? parsed.answer : undefined;
-        const rawIntent = parsed.intent;
-        const intent = rawIntent === "complete" || rawIntent === "blocked" || rawIntent === "direct_reply"
-            ? rawIntent
-            : undefined;
-        return { answer, intent };
     }
-    catch {
-        return {};
+    return [...failedEffects.values()];
+}
+function latestUserMessageText(messages) {
+    for (let i = messages.length - 1; i >= 0; i -= 1) {
+        const message = messages[i];
+        if (message?.role !== "user")
+            continue;
+        const text = messageContentText(message.content).trim();
+        if (text.length > 0)
+            return text;
     }
+    return "";
 }
-function getFinalAnswerRetryError(mustResolveBeforeHandoff, intent, sawSteeringFollowUp, delegationDecision, sawSendMessageSelf, sawGoInward, sawQuerySession, innerJob) {
-    // 1. Delegation adherence: delegate-inward without evidence of inward action
-    if (delegationDecision?.target === "delegate-inward" && !sawSendMessageSelf && !sawGoInward && !sawQuerySession) {
-        (0, runtime_1.emitNervesEvent)({
-            event: "engine.delegation_adherence_rejected",
-            component: "engine",
-            message: "delegation adherence check rejected final_answer",
-            meta: {
-                target: delegationDecision.target,
-                reasons: delegationDecision.reasons,
-            },
-        });
-        return "you're reaching for a final answer, but part of you knows this needs more thought. take it inward -- go_inward will let you think privately, or send_message(self) if you just want to leave yourself a note.";
+function truncatePonderDelegatedContent(value) {
+    return value.length > 120 ? `${value.slice(0, 117)}...` : value;
+}
+function buildPonderDelegatedContent(input) {
+    const primary = (input.summary || input.objective).trim();
+    const sourceRequest = input.sourceRequest.trim();
+    if (!sourceRequest || sourceRequest === primary || sourceRequest === input.objective.trim()) {
+        return truncatePonderDelegatedContent(primary);
+    }
+    return truncatePonderDelegatedContent(`${primary}\nsource request: ${sourceRequest}`);
+}
+function looksLikePrivateReturnRequest(text) {
+    const normalized = text.toLowerCase();
+    return /\b(private|privately|private-attention|think|reflect|reflection)\b/.test(normalized)
+        && /\b(return|bring back|come back|surface|report back)\b/.test(normalized);
+}
+function extractPrivateReturnHeldTokens(text) {
+    const tokens = new Set();
+    for (const match of text.matchAll(/\b[A-Z][A-Z0-9]*(?:_[A-Z0-9]+){2,}\b/g)) {
+        const token = match[0];
+        if (token.length >= 8)
+            tokens.add(token);
+    }
+    return [...tokens];
+}
+function privateReturnAckLeakError(answer, heldTokens) {
+    if (!answer || heldTokens.size === 0)
+        return null;
+    for (const token of heldTokens) {
+        if (answer.includes(token)) {
+            return "private return is queued; do not repeat private markers or requested private-return content in the outward acknowledgement. Say only that the private pass is queued and will return when ready.";
+        }
     }
+    return null;
+}
+function claimsPrivateReturnQueued(answer) {
+    if (!answer)
+        return false;
+    const normalized = answer.toLowerCase();
+    return /\b(queued|queue|will return|return when|when .*complete|when .*completes|private pass|private runtime completes|inner dialog completes|later)\b/.test(normalized)
+        && /\b(private|inner|return|queued|later)\b/.test(normalized);
+}
+function privateReturnMissingPonderError(input) {
+    if (input.sawPonder)
+        return null;
+    if (!looksLikePrivateReturnRequest(input.latestUserRequest))
+        return null;
+    if (!claimsPrivateReturnQueued(input.answer))
+        return null;
+    return "private-return acknowledgement claimed work was queued, but no ponder packet was created this turn. Call ponder(action=create, ...) first so the return has a packet, return obligation, and private-runtime wake; then settle with only a queued acknowledgement. If you cannot create the packet, ask a blocking clarification without saying it is queued.";
+}
+function activeReturnObligationId(agentName, obligationId) {
+    if (!obligationId)
+        return null;
+    const obligation = (0, obligations_1.readReturnObligation)(agentName, obligationId);
+    return obligation?.status === "queued" || obligation?.status === "running" ? obligationId : null;
+}
+function ponderReturnSessionId(packet) {
+    const origin = packet.origin;
+    if (!origin)
+        return "unknown/unknown/unknown";
+    return `${origin.friendId}/${origin.channel}/${origin.key}`;
+}
+function buildPonderReturnPrivateWakeOptions(input) {
+    const sessionId = ponderReturnSessionId(input.packet);
+    return {
+        reason: "ponder return obligation private attention",
+        triggerSource: "ponder-return-obligation",
+        budgetClass: "interactive",
+        idempotencyKey: `ponder-return:${input.agentName}:${input.returnObligationId}:${input.packet.id}:${sessionId}`,
+        originRefs: [
+            { kind: "tool", id: "ponder" },
+            { kind: "ponder-packet", id: input.packet.id },
+            { kind: "return-obligation", id: input.returnObligationId },
+            { kind: "session", id: sessionId },
+        ],
+    };
+}
+function buildPonderResult(packet, action, returnObligationId) {
+    return JSON.stringify({
+        ok: true,
+        packet_id: packet.id,
+        action,
+        status: packet.status,
+        return_obligation_id: returnObligationId,
+        private_return_contract: returnObligationId
+            ? "queued for private-runtime attention; do not present the requested private answer as complete in this same outward turn. if you answer now, only say the private pass is queued and will return when ready."
+            : null,
+    }, null, 2);
+}
+/** Returns true when a tool call queries external state (GitHub, npm registry). */
+function isExternalStateQuery(toolName, args) {
+    if (toolName !== "shell")
+        return false;
+    const cmd = String(args.command ?? "");
+    return /\bgh\s+(pr|run|api|issue)\b/.test(cmd) || /\bnpm\s+(view|info|show)\b/.test(cmd);
+}
+function getSettleRetryError(mustResolveBeforeHandoff, intent, sawSteeringFollowUp, _delegationDecision, sawSendMessageSelf, sawPonder, _sawQuerySession, currentObligation, innerJob, _sawExternalStateQuery) {
+    // Delegation adherence removed: the delegation decision is surfaced in the
+    // system prompt as a suggestion. Hard-gating settle caused infinite
+    // rejection loops where the agent couldn't respond to the user at all.
+    // The agent is free to follow or ignore the delegation hint.
     // 2. Pending obligation not addressed
-    if (innerJob?.obligationStatus === "pending" && !sawSendMessageSelf && !sawGoInward) {
-        return "you're still holding something from an earlier conversation -- someone is waiting for your answer. finish the thought first, or go_inward to keep working on it privately.";
+    if (innerJob?.obligationStatus === "pending" && !sawSendMessageSelf && !sawPonder) {
+        return "you're still holding something from an earlier conversation -- someone is waiting for your answer. finish the thought first, or ponder to keep working on it privately.";
     }
     // 3. mustResolveBeforeHandoff + missing intent
     if (mustResolveBeforeHandoff && !intent) {
-        return "your final_answer is missing required intent. when you must keep going until done or blocked, call final_answer again with answer plus intent=complete, blocked, or direct_reply.";
+        return "your settle is missing required intent. when you must keep going until done or blocked, call settle again with answer plus intent=complete, blocked, or direct_reply.";
     }
     // 4. mustResolveBeforeHandoff + direct_reply without follow-up
     if (mustResolveBeforeHandoff && intent === "direct_reply" && !sawSteeringFollowUp) {
-        return "your final_answer used intent=direct_reply without a newer steering follow-up. continue the unresolved work, or call final_answer again with intent=complete or blocked when appropriate.";
+        return "your settle used intent=direct_reply without a newer steering follow-up. continue the unresolved work, or call settle again with intent=complete or blocked when appropriate.";
+    }
+    // 5. mustResolveBeforeHandoff + complete while a live return loop is still active
+    if (mustResolveBeforeHandoff && intent === "complete" && currentObligation && !sawSteeringFollowUp) {
+        return "you still owe the live session a visible return on this work. don't end the turn yet — continue until you've brought back the external-state update, or use intent=blocked with the concrete blocker.";
     }
-    // 5. Default malformed fallback
-    return "your final_answer was incomplete or malformed. call final_answer again with your complete response.";
+    return null;
 }
-// Re-export kick utilities for backward compat
-var kicks_1 = require("./kicks");
-Object.defineProperty(exports, "hasToolIntent", { enumerable: true, get: function () { return kicks_1.hasToolIntent; } });
-function upsertSystemPrompt(messages, systemText) {
+function upsertSystemPrompt(messages, systemText, protectedSystemMessages = []) {
     const systemMessage = { role: "system", content: systemText };
-    if (messages[0]?.role === "system") {
+    const protectedMessages = new Set(protectedSystemMessages.filter((message) => message.role === "system"));
+    if (messages[0]?.role === "system" && !protectedMessages.has(messages[0])) {
         messages[0] = systemMessage;
     }
     else {
         messages.unshift(systemMessage);
     }
 }
+/**
+ * A prompt refresh failure must not revive any generated text from an older
+ * turn or release. Even the nominally stable region contains actor-scoped trust,
+ * tool, and channel context, so it is not safe to reconstruct. Fail closed to a
+ * neutral base and put the freshly derived trigger first.
+ */
+function repairFallbackSystemPrompt(orientationFrame) {
+    return `${(0, orientation_frame_1.renderOrientationFrame)(orientationFrame)}\n\nYou are a helpful assistant.`;
+}
 // Remove orphan tool_calls from the last assistant message and any
 // trailing tool-result messages that lack a matching tool_call.
 // This keeps the conversation valid after an abort or tool-loop limit.
@@ -297,27 +824,39 @@ const TOOL_SCAN_BOUNDARY_ROLES = new Set(["assistant", "user"]);
 // 1. If an assistant message has tool_calls but missing tool results, inject synthetic error results.
 // 2. If a tool result's tool_call_id doesn't match any tool_calls in a preceding assistant message, remove it.
 // This prevents 400 errors from the API after an aborted turn.
+//
+// Position-aware: a tool result is orphaned when its tool_call_id hasn't been
+// defined by an assistant message AT THIS POSITION yet. MiniMax-M2.7 reuses
+// canonical tool_call_ids across turns, so the global-set check that this
+// function used previously kept misordered tool results that MiniMax then
+// rejected with error 2013 ("tool result's tool id not found"). Walking
+// in order matches what MiniMax actually enforces.
 function repairOrphanedToolCalls(messages) {
-    // Pass 1: collect all valid tool_call IDs from assistant messages
-    const validCallIds = new Set();
-    for (const msg of messages) {
+    // Pass 1: walk in order, accumulate seen tool_call_ids per-position, and
+    // mark tool results for removal if their id hasn't been defined yet.
+    const seenCallIds = new Set();
+    const removeIndices = [];
+    for (let i = 0; i < messages.length; i++) {
+        const msg = messages[i];
         if (msg.role === "assistant") {
             const asst = msg;
             if (asst.tool_calls) {
                 for (const tc of asst.tool_calls)
-                    validCallIds.add(tc.id);
+                    seenCallIds.add(tc.id);
             }
+            continue;
         }
-    }
-    // Pass 2: remove orphaned tool results (tool_call_id not in any assistant's tool_calls)
-    for (let i = messages.length - 1; i >= 0; i--) {
-        if (messages[i].role === "tool") {
-            const toolMsg = messages[i];
-            if (!validCallIds.has(toolMsg.tool_call_id)) {
-                messages.splice(i, 1);
+        if (msg.role === "tool") {
+            const toolMsg = msg;
+            if (!seenCallIds.has(toolMsg.tool_call_id)) {
+                removeIndices.push(i);
             }
         }
     }
+    // Splice from the end so earlier indices stay valid.
+    for (let i = removeIndices.length - 1; i >= 0; i--) {
+        messages.splice(removeIndices[i], 1);
+    }
     // Pass 3: inject synthetic results for tool_calls missing their tool results
     for (let i = 0; i < messages.length; i++) {
         const msg = messages[i];
@@ -339,10 +878,13 @@ function repairOrphanedToolCalls(messages) {
         }
         const missing = asst.tool_calls.filter((tc) => !resultIds.has(tc.id));
         if (missing.length > 0) {
+            // AX rule: the agent must see what happened. Don't say "interrupted"
+            // — that's vague. Tell them the result was lost, possible causes,
+            // and what to do next.
             const syntheticResults = missing.map((tc) => ({
                 role: "tool",
                 tool_call_id: tc.id,
-                content: "error: tool call was interrupted (previous turn timed out or was aborted)",
+                content: "error: this tool call's result was lost — the previous turn ended before the tool finished (provider rejection, daemon interrupt, or the tool itself errored). if the work needs to be done, retry the tool call now.",
             }));
             let insertAt = i + 1;
             while (insertAt < messages.length && messages[insertAt].role === "tool")
@@ -365,51 +907,83 @@ function isContextOverflow(err) {
         return true;
     return false;
 }
-// Detect transient network errors worth retrying
-function isTransientError(err) {
-    if (!(err instanceof Error))
-        return false;
-    const msg = err.message || "";
-    const code = err.code || "";
-    // Node.js network error codes
-    if (["ECONNRESET", "ECONNREFUSED", "ENOTFOUND", "ETIMEDOUT", "EPIPE",
-        "EAI_AGAIN", "EHOSTUNREACH", "ENETUNREACH", "ECONNABORTED"].includes(code))
-        return true;
-    // OpenAI SDK / fetch errors
-    if (msg.includes("fetch failed"))
-        return true;
-    if (msg.includes("network") && !msg.includes("context"))
-        return true;
-    if (msg.includes("ECONNRESET") || msg.includes("ETIMEDOUT"))
-        return true;
-    if (msg.includes("socket hang up"))
-        return true;
-    if (msg.includes("getaddrinfo"))
-        return true;
-    // HTTP 429 / 500 / 502 / 503 / 504
-    const status = err.status;
-    if (status === 429 || status === 500 || status === 502 || status === 503 || status === 504)
-        return true;
-    return false;
+const RETRY_LABELS = {
+    "auth-failure": "auth error",
+    "usage-limit": "usage limit",
+    "rate-limit": "rate limited",
+    "server-error": "server error",
+    "network-error": "network error",
+    "unknown": "error",
+};
+function waitForProviderRetry(delayMs, signal) {
+    if (!signal) {
+        return new Promise((resolve) => {
+            setTimeout(resolve, delayMs);
+        });
+    }
+    return new Promise((resolve, reject) => {
+        let timer;
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new provider_attempt_1.ProviderAttemptAbortError());
+        };
+        timer = setTimeout(() => {
+            signal.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMs);
+        if (signal.aborted) {
+            onAbort();
+            return;
+        }
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+function buildAuthFailureGuidance(provider, model, agentName, detail) {
+    const mismatch = (0, provider_models_1.getProviderModelMismatchMessage)(provider, model);
+    const modelLabel = model
+        ? mismatch
+            ? `${provider} [configured model: ${model}]`
+            : `${provider} (${model})`
+        : provider;
+    const lines = [`${modelLabel} authentication failed.`];
+    const cleanDetail = detail.replace(/\s+/g, " ").trim();
+    if (cleanDetail)
+        lines.push(`provider detail: ${cleanDetail.length > 300 ? `${cleanDetail.slice(0, 297)}...` : cleanDetail}`);
+    lines.push("");
+    lines.push("To keep using this provider:");
+    lines.push(`  1. Run \`ouro auth --agent ${agentName} --provider ${provider}\``);
+    if (mismatch) {
+        const defaultModel = (0, provider_models_1.getDefaultModelForProvider)(provider);
+        lines.push("");
+        lines.push("Config warning:");
+        lines.push(`  - ${mismatch}`);
+        lines.push("  - Repair the configured model with:");
+        lines.push(`    \`ouro use --agent ${agentName} --lane outward --provider ${provider} --model ${defaultModel}\``);
+        lines.push(`    \`ouro use --agent ${agentName} --lane inner --provider ${provider} --model ${defaultModel}\``);
+    }
+    lines.push("");
+    lines.push(`To use another configured provider instead, run \`ouro use --agent ${agentName} --lane <outward|inner> --provider <provider> --model <model>\`.`);
+    return lines.join("\n");
 }
-function classifyTransientError(err) {
-    if (!(err instanceof Error))
-        return "unknown error";
-    const status = err.status;
-    if (status === 429)
-        return "rate limited";
-    if (status === 401 || status === 403)
-        return "auth error";
-    if (status && status >= 500)
-        return "server error";
-    return "network error";
-}
-const MAX_RETRIES = 3;
-const RETRY_BASE_MS = 2000;
 async function runAgent(messages, callbacks, channel, signal, options) {
-    const providerRuntime = getProviderRuntime();
+    const generatedMessages = [];
+    let nextAttemptControls = [];
+    let rejectedAttempt = [];
+    const pushGenerated = (...next) => {
+        messages.push(...next);
+        generatedMessages.push(...structuredClone(next));
+        if (rejectedAttempt.length > 0) {
+            rejectedAttempt = [];
+            providerRuntime.resetTurnState(messages);
+        }
+    };
+    const facing = (0, friends_1.channelToFacing)(channel);
+    const owner = options?.toolContext?.agentName && options.toolContext.agentRoot
+        ? { agentName: options.toolContext.agentName, agentRoot: options.toolContext.agentRoot }
+        : undefined;
+    let providerRuntime = options?.providerRuntimeOverride ?? await getProviderRuntime(facing, owner);
     const provider = providerRuntime.id;
-    const toolChoiceRequired = options?.toolChoiceRequired ?? true;
+    const toolChoiceRequired = options?.hardDisableTools ? false : options?.toolChoiceRequired ?? true;
     const traceId = options?.traceId;
     (0, runtime_1.emitNervesEvent)({
         event: "engine.turn_start",
@@ -428,24 +1002,88 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             currentContext = { ...currentContext, friend: freshFriend };
         }
     }
+    const turnOrientationFrame = options?.orientationFrame
+        ?? (channel ? (0, orientation_frame_1.buildOrientationFrame)({ channel, messages }) : undefined);
+    if (options?.requiredPromptEvidence) {
+        let structuralFloor;
+        try {
+            structuralFloor = (0, prompt_budget_1.assessRequiredPromptEvidenceBudget)({
+                messages,
+                requiredPromptEvidence: options.requiredPromptEvidence,
+                provider: providerRuntime.id,
+                model: providerRuntime.model,
+                contextWindowTokens: (0, config_1.getContextConfig)().maxTokens,
+            });
+        }
+        catch (error) {
+            const invalidEvidenceError = error instanceof Error ? error : new Error(String(error));
+            callbacks.onError(invalidEvidenceError, "terminal");
+            options.captureGeneratedMessages?.([]);
+            (0, runtime_1.emitNervesEvent)({
+                event: "engine.turn_end",
+                trace_id: traceId,
+                component: "engine",
+                message: "runAgent turn completed",
+                meta: { done: true, sawPonder: false, sawQuerySession: false, sawBridgeManage: false },
+            });
+            return {
+                outcome: "errored",
+                error: invalidEvidenceError,
+                errorClassification: "unknown",
+            };
+        }
+        if (structuralFloor.status === "required_evidence_over_budget") {
+            const budgetError = new Error(`required_evidence_over_budget: required current-turn evidence needs ${structuralFloor.estimatedTokens} tokens but the provider input limit is ${structuralFloor.budget.inputTokenLimit}`);
+            callbacks.onError(budgetError, "terminal");
+            options.captureGeneratedMessages?.([]);
+            (0, runtime_1.emitNervesEvent)({
+                event: "engine.turn_end",
+                trace_id: traceId,
+                component: "engine",
+                message: "runAgent turn completed",
+                meta: { done: true, sawPonder: false, sawQuerySession: false, sawBridgeManage: false },
+            });
+            return {
+                outcome: "errored",
+                error: budgetError,
+                errorClassification: "unknown",
+            };
+        }
+    }
     // Refresh system prompt at start of each turn when channel is provided.
-    // If refresh fails, keep existing system prompt (or inject a minimal safe fallback)
-    // so turn execution remains consistent and non-fatal.
+    // If refresh fails, retain only a recognised stable prefix (or inject a
+    // minimal safe fallback) so stale dynamic state cannot regain authority.
+    let structuredSystemPrompt;
     if (channel) {
         try {
             const buildSystemOptions = {
                 ...options,
+                relationshipContextScopes: options?.toolContext?.relationshipAuthorization?.authorizedContextScopes,
+                relationshipProfileId: options?.toolContext?.relationshipAuthorization?.profileId,
+                relationshipToolNames: options?.toolContext?.relationshipAuthorization?.advertisedToolNames,
+                orientationFrame: turnOrientationFrame,
+                resumePriorWork: options?.resumePriorWork === true,
                 providerCapabilities: providerRuntime.capabilities,
                 supportedReasoningEfforts: providerRuntime.supportedReasoningEfforts,
             };
             const refreshed = await (0, prompt_1.buildSystem)(channel, buildSystemOptions, currentContext);
-            upsertSystemPrompt(messages, refreshed);
+            structuredSystemPrompt = refreshed;
+            upsertSystemPrompt(messages, (0, prompt_1.flattenSystemPrompt)(refreshed), [
+                ...(options?.promptOnlyEvidenceMessages ?? []),
+                ...(options?.requiredPromptEvidence?.verifiedPredecessorMessage
+                    ? [options.requiredPromptEvidence.verifiedPredecessorMessage]
+                    : []),
+            ]);
         }
         catch (error) {
             const hadExistingSystemPrompt = messages[0]?.role === "system" && typeof messages[0].content === "string";
-            const existingSystemText = hadExistingSystemPrompt ? messages[0].content : undefined;
-            const fallback = existingSystemText ?? "You are a helpful assistant.";
-            upsertSystemPrompt(messages, fallback);
+            const fallback = repairFallbackSystemPrompt(turnOrientationFrame);
+            upsertSystemPrompt(messages, fallback, [
+                ...(options?.promptOnlyEvidenceMessages ?? []),
+                ...(options?.requiredPromptEvidence?.verifiedPredecessorMessage
+                    ? [options.requiredPromptEvidence.verifiedPredecessorMessage]
+                    : []),
+            ]);
             (0, runtime_1.emitNervesEvent)({
                 level: "warn",
                 event: "mind.step_error",
@@ -460,424 +1098,1374 @@ async function runAgent(messages, callbacks, channel, signal, options) {
             });
         }
     }
-    await (0, associative_recall_1.injectAssociativeRecall)(messages);
+    if (channel && options?.skipKeptNotes !== true) {
+        await (0, kept_notes_1.injectKeptNotes)(messages, {
+            channel,
+            friend: currentContext?.friend,
+            judge: async (input) => (0, kept_notes_1.createKeptNotesJudge)(await getProviderRuntime("agent", owner), signal)(input),
+            signal,
+            traceId,
+        });
+    }
     let done = false;
     let lastUsage;
     let overflowRetried = false;
-    let retryCount = 0;
-    let outcome = "complete";
+    let outcome = "settled";
     let completion;
+    let suspension;
+    let terminalError;
+    let terminalErrorClassification;
     let sawSteeringFollowUp = false;
     let mustResolveBeforeHandoffActive = options?.mustResolveBeforeHandoff === true;
     let currentReasoningEffort = "medium";
     let sawSendMessageSelf = false;
-    let sawGoInward = false;
+    let sawPonder = false;
     let sawQuerySession = false;
     let sawBridgeManage = false;
+    let sawExternalStateQuery = false;
+    const privateReturnHeldTokens = new Set();
+    // Once-per-turn flag for the fresh-work rest gate. Without this, an agent
+    // that called rest, was told "fresh work arrived", processed the items,
+    // and called rest again would get the same message forever — the gate
+    // condition is read from the turn-start snapshot of pendingMessages,
+    // which doesn't update mid-turn. The agent only needs to be told once;
+    // after that, repeated rest attempts mean they've acknowledged.
+    let freshWorkGateFired = false;
+    // Counter for no-tool-call violations. MiniMax reasoning models occasionally
+    // emit only a <think>...</think> block and stop, without any tool call — even
+    // when tool_choice is set to "required". Private-return requests also need
+    // a hard no-tool guard: a text-only "queued" acknowledgement is false unless
+    // a ponder packet created the return obligation in this turn.
+    let noToolCallRetries = 0;
+    const NO_TOOL_CALL_MAX_RETRIES = 2;
+    let unresolvedHistoricalEffects = [];
+    let historicalToolFailureRetries = 0;
+    let providerIterations = 0;
+    const requiredToolCallNames = [...new Set(options?.requiredToolCalls?.names ?? [])];
+    const dispatchedRequiredToolCalls = new Set();
+    const rejectAttempt = (assistant, controls) => {
+        rejectedAttempt = [structuredClone(assistant)];
+        nextAttemptControls = controls;
+    };
+    const rejectToolBatch = (assistant, reasons) => {
+        rejectAttempt(assistant, assistant.tool_calls.map((call, index) => ({
+            role: "tool", tool_call_id: call.id, content: reasons[index],
+        })));
+    };
+    const pendingRequiredToolCalls = () => {
+        const missing = requiredToolCallNames.filter((name) => !dispatchedRequiredToolCalls.has(name));
+        return missing.length > 0
+            ? { missing, message: `${options.requiredToolCalls.retryMessage} Missing required tool calls: ${missing.join(", ")}.` }
+            : null;
+    };
+    const queueRequiredCorrection = (assistant, message, limitContext) => {
+        if (providerIterations >= exports.MAX_PROVIDER_ITERATIONS)
+            throw new Error(`provider iteration limit exhausted at response ${exports.MAX_PROVIDER_ITERATIONS} ${limitContext}`);
+        rejectAttempt(assistant, [{ role: "user", content: message }]);
+    };
+    const toolLoopState = (0, tool_loop_1.createToolLoopState)();
+    const toolFrictionLedger = (0, tool_friction_1.createToolFrictionLedger)();
+    const finishTerminalProviderError = (error, classification) => {
+        terminalError = error;
+        terminalErrorClassification = classification;
+        /* v8 ignore start — auth-failure guidance: tested via provider error classification tests @preserve */
+        if (terminalErrorClassification === "auth-failure") {
+            const agentName = (0, identity_2.getAgentName)();
+            const currentProvider = providerRuntime.id;
+            callbacks.onError(new Error(buildAuthFailureGuidance(currentProvider, providerRuntime.model, agentName, terminalError.message)), "terminal");
+        }
+        else {
+            callbacks.onError(terminalError, "terminal");
+        }
+        /* v8 ignore stop */
+        const errorDetails = (0, error_classification_1.extractProviderErrorDetails)(terminalError);
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            event: "engine.error",
+            trace_id: traceId,
+            component: "engine",
+            message: terminalError.message,
+            meta: {
+                provider: providerRuntime.id,
+                model: providerRuntime.model,
+                errorClassification: terminalErrorClassification,
+                ...(errorDetails.status !== undefined ? { httpStatus: errorDetails.status } : {}),
+                ...(errorDetails.bodyExcerpt ? { bodyExcerpt: errorDetails.bodyExcerpt } : {}),
+                summary: (0, error_classification_1.summarizeProviderError)(terminalError, terminalErrorClassification, providerRuntime.id, providerRuntime.model),
+            },
+        });
+        // Only legacy input can still contain unaccepted calls. Generated output
+        // has crossed acceptance; a later provider failure cannot revoke effects.
+        if (generatedMessages.length === 0)
+            stripLastToolCalls(messages);
+        outcome = "errored";
+        done = true;
+    };
     // Prevent MaxListenersExceeded warning — each iteration adds a listener
     try {
         require("events").setMaxListeners(50, signal);
     }
     catch { /* unsupported */ }
-    const toolPreferences = currentContext?.friend?.toolPreferences;
-    const baseTools = options?.tools ?? (0, tools_1.getToolsForChannel)(channel ? (0, channel_1.getChannelCapabilities)(channel) : undefined, toolPreferences && Object.keys(toolPreferences).length > 0 ? toolPreferences : undefined, currentContext, providerRuntime.capabilities);
-    // Augment tool context with reasoning effort controls from provider
-    const augmentedToolContext = options?.toolContext
-        ? {
-            ...options.toolContext,
-            supportedReasoningEfforts: providerRuntime.supportedReasoningEfforts,
-            setReasoningEffort: (level) => { currentReasoningEffort = level; },
-        }
-        : undefined;
-    // Rebase provider-owned turn state from canonical messages at user-turn start.
-    // This prevents stale provider caches from replaying prior-turn context.
-    providerRuntime.resetTurnState(messages);
-    while (!done) {
-        // When toolChoiceRequired is true (the default), include final_answer
-        // so the model can signal completion. With tool_choice: required, the
-        // model must call a tool every turn — final_answer is how it exits.
-        // Overridable via options.toolChoiceRequired = false (e.g. CLI).
-        const activeTools = toolChoiceRequired
-            ? [...baseTools, tools_1.goInwardTool, ...(currentContext?.isGroupChat ? [tools_1.noResponseTool] : []), tools_1.finalAnswerTool]
-            : baseTools;
-        const steeringFollowUps = options?.drainSteeringFollowUps?.() ?? [];
-        if (steeringFollowUps.length > 0) {
-            const hasSupersedingFollowUp = steeringFollowUps.some((followUp) => followUp.effect === "clear_and_supersede");
-            if (hasSupersedingFollowUp) {
-                mustResolveBeforeHandoffActive = false;
-                options?.setMustResolveBeforeHandoff?.(false);
-                outcome = "superseded";
-                break;
-            }
-            if (steeringFollowUps.some((followUp) => followUp.effect === "set_no_handoff")) {
-                mustResolveBeforeHandoffActive = true;
-                options?.setMustResolveBeforeHandoff?.(true);
-            }
-            sawSteeringFollowUp = true;
-            for (const followUp of steeringFollowUps) {
-                messages.push({ role: "user", content: followUp.text });
-            }
-            providerRuntime.resetTurnState(messages);
-        }
-        // Yield so pending I/O (stdin Ctrl-C) can be processed between iterations
-        await new Promise((r) => setImmediate(r));
-        if (signal?.aborted) {
-            outcome = "aborted";
-            break;
-        }
-        try {
-            callbacks.onModelStart();
-            const result = await providerRuntime.streamTurn({
-                messages,
-                activeTools,
-                callbacks,
-                signal,
-                traceId,
-                toolChoiceRequired,
-                reasoningEffort: currentReasoningEffort,
+    try {
+        const toolPreferences = currentContext?.friend?.toolPreferences;
+        const filterTrustedTools = (tools, selected) => tools.filter((tool) => !selected.engine.some((engine) => engine.function.name === tool.function.name)
+            && (channel !== "inner" || options?.toolProfile === "sanctuary-health-private" || !["send_message", "surface"].includes(tool.function.name)
+                || selected.ordinary.some((definition) => definition.tool.function.name === tool.function.name)));
+        const selectCurrentTools = () => {
+            if (options?.hardDisableTools)
+                return Object.freeze({ ordinary: Object.freeze([]), engine: Object.freeze([]) });
+            const selected = (0, tools_1.selectToolsForChannel)(channel ? (0, friends_1.getChannelCapabilities)(channel) : undefined, toolPreferences, currentContext, providerRuntime.capabilities, options?.mcpManager, providerRuntime.model, { ...options?.toolContext, ...(options?.habitSession ? { habitSession: options.habitSession } : {}) });
+            const ordinary = options?.tools !== undefined && !options.toolContext?.relationshipAuthorization
+                ? filterTrustedTools(options.tools, selected).flatMap((tool) => {
+                    const definition = (0, tools_1.resolveToolDefinition)(tool.function.name, selected) ?? (0, tools_1.resolveToolDefinition)(tool.function.name);
+                    return definition ? [{ ...definition, tool }] : [];
+                })
+                : selected.ordinary;
+            const bound = bindCurrentIngressEvidenceLocator(ordinary.map((definition) => definition.tool), options?.toolContext?.currentIngressEvidence);
+            return Object.freeze({
+                ordinary: Object.freeze(ordinary.map((definition, index) => definition.tool === bound[index]
+                    ? definition : Object.freeze({ ...definition, tool: bound[index] }))),
+                engine: selected.engine,
             });
-            // Track usage from the latest API call
-            if (result.usage)
-                lastUsage = result.usage;
-            retryCount = 0; // reset on success
-            // SHARED: build CC-format assistant message from TurnResult
-            const msg = {
-                role: "assistant",
-            };
-            if (result.content)
-                msg.content = result.content;
-            if (result.toolCalls.length)
-                msg.tool_calls = result.toolCalls.map((tc) => ({
-                    id: tc.id,
-                    type: "function",
-                    function: { name: tc.name, arguments: tc.arguments },
-                }));
-            // Store reasoning items from the API response on the assistant message
-            // so they persist through session save/load and can be restored in toResponsesInput
-            const reasoningItems = result.outputItems.filter((item) => "type" in item && item.type === "reasoning");
-            if (reasoningItems.length > 0) {
-                msg._reasoning_items = reasoningItems;
+        };
+        let toolSelection = selectCurrentTools();
+        const relationship = options?.toolContext?.relationshipAuthorization;
+        if (!options?.hardDisableTools && options?.tools !== undefined) {
+            if (relationship) {
+                toolSelection = (0, tools_1.reduceToolSelection)(toolSelection, options.tools);
             }
-            // Store thinking blocks (Anthropic) on the assistant message for round-tripping
-            const thinkingItems = result.outputItems.filter((item) => "type" in item && (item.type === "thinking" || item.type === "redacted_thinking"));
-            if (thinkingItems.length > 0) {
-                msg._thinking_blocks = thinkingItems;
+        }
+        const unboundBaseTools = !options?.hardDisableTools && !relationship && options?.tools
+            ? filterTrustedTools(options.tools, toolSelection)
+            : toolSelection.ordinary.map((definition) => definition.tool);
+        const relationshipToolNames = options?.toolContext?.relationshipAuthorization?.advertisedToolNames;
+        const relationshipScopedTools = relationshipToolNames
+            ? unboundBaseTools.filter((tool) => relationshipToolNames.includes(tool.function.name))
+            : unboundBaseTools;
+        const baseTools = bindCurrentIngressEvidenceLocator(relationshipScopedTools, options?.toolContext?.currentIngressEvidence);
+        // Augment tool context with reasoning effort controls from provider
+        const baseToolContext = options?.toolContext
+            ?? { signin: async () => undefined, ...(turnOrientationFrame ? { orientationFrame: turnOrientationFrame } : {}) };
+        const habitSession = options?.habitSession ?? baseToolContext?.habitSession;
+        const augmentedToolContext = {
+            ...baseToolContext,
+            supportedReasoningEfforts: providerRuntime.supportedReasoningEfforts,
+            setReasoningEffort: (level) => { currentReasoningEffort = level; },
+            activeWorkFrame: options?.activeWorkFrame,
+            orientationFrame: turnOrientationFrame ?? baseToolContext.orientationFrame,
+            ...(habitSession ? { habitSession } : {}),
+            toolSelection,
+            selectCurrentTools,
+        };
+        const trustedToolContext = options?.toolContext || turnOrientationFrame || habitSession ? augmentedToolContext : undefined;
+        unresolvedHistoricalEffects = historicalFailedEffectsForExactRepeatedRequest(messages, toolSelection);
+        // Rebase provider-owned turn state from canonical messages at user-turn start.
+        // This prevents stale provider caches from replaying prior-turn context.
+        providerRuntime.resetTurnState(messages);
+        while (!done) {
+            // Channel-based tool filtering:
+            // - Private runtime: exclude send_message (delivery via surface), observe (no one to observe)
+            // - All outward channels (1:1, group, reaction): observe available
+            //
+            // ponder, settle/rest, surface, and observe are always assembled based on channel context.
+            // ponder is available in ALL channels (outer: think privately, inner: keep turning).
+            // Private runtime gets restTool instead of settleTool (rest = end turn, gated by attention queue).
+            // toolChoiceRequired only controls whether tool_choice: "required" is set in the API call.
+            const isPrivateRuntimeChannel = channel === "inner";
+            const unscopedOrdinaryActiveTools = [
+                ...baseTools,
+                ...toolSelection.engine,
+            ];
+            const ordinaryActiveTools = relationshipToolNames
+                ? unscopedOrdinaryActiveTools.filter((tool) => relationshipToolNames.includes(tool.function.name))
+                : unscopedOrdinaryActiveTools;
+            const candidateActiveTools = options?.hardDisableTools
+                ? []
+                : options?.toolProfile === "sanctuary-health-private"
+                    ? (() => {
+                        const sendTools = baseTools.filter((tool) => tool.function.name === "send_message");
+                        if (channel !== "inner" || sendTools.length !== 1 || baseTools.length !== 1) {
+                            throw new Error("sanctuary-health-private requires inner channel with exactly one canonical send_message definition");
+                        }
+                        return [sendTools[0], tools_1.restTool];
+                    })()
+                    : ordinaryActiveTools;
+            const candidateToolNames = new Set(candidateActiveTools.map((tool) => tool.function.name));
+            const unadvertisedRequiredTool = requiredToolCallNames.find((name) => !candidateToolNames.has(name));
+            if (unadvertisedRequiredTool) {
+                (0, runtime_1.emitNervesEvent)({ level: "error", component: "engine", event: "engine.required_tool_unadvertised", message: "required tool is not advertised for the active channel", meta: { toolName: unadvertisedRequiredTool, channel: String(channel) } });
+                throw new Error(`required tool is not advertised for this channel: ${unadvertisedRequiredTool}`);
             }
-            // Phase annotation for Codex provider
-            const hasPhaseAnnotation = providerRuntime.capabilities.has("phase-annotation");
-            const isSoleFinalAnswer = result.toolCalls.length === 1 && result.toolCalls[0].name === "final_answer";
-            if (hasPhaseAnnotation) {
-                msg.phase = isSoleFinalAnswer ? "final_answer" : "commentary";
+            const forcedHistoricalToolNames = new Set(unresolvedHistoricalEffects
+                .map((effect) => effect.name)
+                .filter((name) => candidateToolNames.has(name)));
+            const forcingHistoricalEffect = forcedHistoricalToolNames.size > 0;
+            const activeTools = forcingHistoricalEffect
+                ? candidateActiveTools.filter((tool) => forcedHistoricalToolNames.has(tool.function.name))
+                : candidateActiveTools;
+            const activeToolNames = new Set(activeTools.map((tool) => tool.function.name));
+            const steeringFollowUps = options?.drainSteeringFollowUps?.() ?? [];
+            if (steeringFollowUps.length > 0) {
+                const hasSupersedingFollowUp = steeringFollowUps.some((followUp) => followUp.effect === "clear_and_supersede");
+                if (hasSupersedingFollowUp) {
+                    mustResolveBeforeHandoffActive = false;
+                    options?.setMustResolveBeforeHandoff?.(false);
+                    outcome = "superseded";
+                    break;
+                }
+                if (steeringFollowUps.some((followUp) => followUp.effect === "set_no_handoff")) {
+                    mustResolveBeforeHandoffActive = true;
+                    options?.setMustResolveBeforeHandoff?.(true);
+                }
+                sawSteeringFollowUp = true;
+                for (const followUp of steeringFollowUps) {
+                    messages.push({ role: "user", content: followUp.text });
+                }
+                providerRuntime.resetTurnState(messages);
             }
-            if (!result.toolCalls.length) {
-                // No tool calls — accept response as-is.
-                // (Kick detection disabled; tool_choice: required + final_answer
-                // is the primary loop control. See src/heart/kicks.ts to re-enable.)
-                messages.push(msg);
-                done = true;
+            // Yield so pending I/O (stdin Ctrl-C) can be processed between iterations
+            await new Promise((r) => setImmediate(r));
+            if (signal?.aborted) {
+                outcome = "aborted";
+                break;
             }
-            else {
-                // Check for final_answer sole call: intercept before tool execution
-                if (isSoleFinalAnswer) {
-                    // Extract answer from the tool call arguments.
-                    // Supports: {"answer":"text","intent":"..."} or "text" (JSON string).
-                    const { answer, intent } = parseFinalAnswerPayload(result.toolCalls[0].arguments);
-                    const validDirectReply = mustResolveBeforeHandoffActive && intent === "direct_reply" && sawSteeringFollowUp;
-                    const validTerminalIntent = intent === "complete" || intent === "blocked";
-                    const validClosure = answer != null
-                        && (!mustResolveBeforeHandoffActive || validDirectReply || validTerminalIntent);
-                    if (validClosure) {
-                        completion = {
-                            answer,
-                            intent: validDirectReply ? "direct_reply" : intent === "blocked" ? "blocked" : "complete",
-                        };
-                        if (result.finalAnswerStreamed) {
-                            // The streaming layer already parsed and emitted the answer
-                            // progressively via FinalAnswerParser. Skip clearing and
-                            // re-emitting to avoid double-delivery.
+            try {
+                const budgetOptions = {
+                    requiredPromptEvidence: options?.requiredPromptEvidence,
+                    provider: providerRuntime.id,
+                    model: providerRuntime.model,
+                    contextWindowTokens: (0, config_1.getContextConfig)().maxTokens,
+                };
+                const canonicalBudget = (0, prompt_budget_1.applyPromptBudget)({ ...budgetOptions, messages });
+                const currentUserMessage = budgetOptions.requiredPromptEvidence?.currentUserMessage
+                    ?? canonicalBudget.messages.findLast((message) => message.role === "user");
+                // Keep retry controls attached to the genuine request, not to canonical history.
+                let attemptMessages = rejectedAttempt.length > 0
+                    ? [...(0, prompt_budget_1.applyPromptBudget)({
+                            ...budgetOptions,
+                            requiredPromptEvidence: budgetOptions.requiredPromptEvidence ?? (currentUserMessage ? { currentUserMessage } : undefined),
+                            messages: [...canonicalBudget.messages, ...rejectedAttempt, ...nextAttemptControls],
+                        }).messages]
+                    : [...canonicalBudget.messages];
+                if (rejectedAttempt.length > 0 || canonicalBudget.status !== "within_budget")
+                    providerRuntime.resetTurnState(attemptMessages);
+                const turnCallbackBufferRef = { current: null };
+                const callProviderTurn = async () => {
+                    callbacks.onModelStart();
+                    turnCallbackBufferRef.current = habitSession
+                        ? createHabitCallbackBuffer(callbacks)
+                        : callbacks.settleOutputMode === "final_only" || relationship !== undefined
+                            ? createFinalOnlyTextBuffer(callbacks)
+                            : null;
+                    try {
+                        return await providerRuntime.streamTurn({
+                            messages: attemptMessages,
+                            activeTools,
+                            callbacks: turnCallbackBufferRef.current?.callbacks ?? callbacks,
+                            signal,
+                            traceId,
+                            toolChoiceRequired: options?.hardDisableTools ? false : forcingHistoricalEffect || toolChoiceRequired,
+                            reasoningEffort: currentReasoningEffort,
+                            eagerSettleStreaming: true,
+                            systemPrompt: structuredSystemPrompt,
+                        });
+                    }
+                    catch (error) {
+                        turnCallbackBufferRef.current?.discard();
+                        turnCallbackBufferRef.current = null;
+                        if (signal?.aborted)
+                            throw new provider_attempt_1.ProviderAttemptAbortError();
+                        throw error;
+                    }
+                };
+                const callProviderTurnWithOverflowRecovery = async () => {
+                    try {
+                        return await callProviderTurn();
+                    }
+                    catch (error) {
+                        if (error instanceof provider_attempt_1.ProviderAttemptAbortError)
+                            throw error;
+                        if (isContextOverflow(error) && !overflowRetried) {
+                            overflowRetried = true;
+                            const protectedStart = currentUserMessage ? Math.max(0, attemptMessages.indexOf(currentUserMessage)) : 0;
+                            const currentAttempt = attemptMessages.slice(protectedStart);
+                            const overflowMessages = attemptMessages.slice(0, protectedStart).map((message) => message.role === "assistant" ? { ...message } : message);
+                            stripLastToolCalls(overflowMessages);
+                            overflowMessages.push(...currentAttempt);
+                            const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
+                            const trimmed = (0, context_1.trimMessages)(overflowMessages, maxTokens, contextMargin, maxTokens * 2);
+                            const requiredEvidence = options?.requiredPromptEvidence;
+                            const requiredMessages = new Set([
+                                ...(requiredEvidence?.verifiedPredecessorMessage ? [requiredEvidence.verifiedPredecessorMessage] : []),
+                                ...currentAttempt,
+                            ]);
+                            const trimmedMessages = new Set(trimmed);
+                            attemptMessages = requiredMessages.size === 0
+                                ? trimmed
+                                : overflowMessages.filter((message) => trimmedMessages.has(message) || requiredMessages.has(message));
+                            providerRuntime.resetTurnState(attemptMessages);
+                            callbacks.onError(new Error("context trimmed, retrying..."), "transient");
+                            return callProviderTurn();
                         }
-                        else {
-                            // Clear any streamed noise (e.g. refusal text) before emitting.
-                            callbacks.onClearText?.();
-                            // Emit the answer through the callback pipeline so channels receive it.
-                            // Never truncate -- channel adapters handle splitting long messages.
-                            callbacks.onTextChunk(answer);
+                        throw error;
+                    }
+                };
+                const attempt = await (0, provider_attempt_1.runProviderAttempt)({
+                    operation: "turn",
+                    provider: providerRuntime.id,
+                    model: providerRuntime.model,
+                    run: callProviderTurnWithOverflowRecovery,
+                    classifyError: (error) => providerRuntime.classifyError(error),
+                    onRetry: async (record, maxAttempts) => {
+                        const delayMs = record.delayMs;
+                        const seconds = delayMs / 1000;
+                        const cause = RETRY_LABELS[record.classification];
+                        try {
+                            const agentName = owner?.agentName ?? (0, identity_2.getAgentName)();
+                            if (record.provider === "openai-codex" && record.classification === "auth-failure") {
+                                await (0, openai_codex_token_1.refreshOpenAICodexProviderCredentials)(agentName, {
+                                    force: true,
+                                    reason: "turn-auth-failure",
+                                });
+                            }
+                            await (0, provider_credentials_1.refreshProviderCredentialPool)(agentName, {
+                                preserveCachedOnFailure: true,
+                                providers: [record.provider],
+                            });
+                            _providerRuntimeFactories[facing] = null;
+                            providerRuntime = await getProviderRuntime(facing, owner);
+                            providerRuntime.resetTurnState(attemptMessages);
                         }
-                        messages.push(msg);
-                        if (validDirectReply) {
-                            const resumeWork = "direct reply delivered. resume the unresolved obligation now and keep working until you can finish or clearly report that you are blocked.";
-                            messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });
-                            providerRuntime.appendToolOutput(result.toolCalls[0].id, resumeWork);
+                        catch (refreshError) {
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.provider_retry_refresh_failed",
+                                message: "provider credential refresh failed during retry",
+                                meta: { provider: record.provider, model: record.model, reason: refreshError instanceof Error ? refreshError.message : String(refreshError) },
+                            });
                         }
-                        else {
-                            const delivered = "(delivered)";
-                            messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: delivered });
-                            providerRuntime.appendToolOutput(result.toolCalls[0].id, delivered);
-                            outcome = intent === "blocked" ? "blocked" : "complete";
+                        callbacks.onError(new Error(`${cause}, retrying in ${seconds}s (${record.attempt}/${maxAttempts})...`), "transient");
+                    },
+                    sleep: async (delayMs) => {
+                        await waitForProviderRetry(delayMs, signal);
+                        providerRuntime.resetTurnState(attemptMessages);
+                    },
+                });
+                if (!attempt.ok) {
+                    finishTerminalProviderError(attempt.error, attempt.classification);
+                    continue;
+                }
+                const result = attempt.value;
+                nextAttemptControls = [];
+                providerIterations += 1;
+                if (providerIterations === exports.MAX_PROVIDER_ITERATIONS && result.toolCalls.length > 0) {
+                    throw new Error(`provider iteration limit exhausted at response ${exports.MAX_PROVIDER_ITERATIONS} before tool execution`);
+                }
+                const streamCallbackBuffer = turnCallbackBufferRef.current;
+                turnCallbackBufferRef.current = null;
+                if (result.settleFinalization && !result.settleFinalization.ok) {
+                    // A completed settle payload is terminal provider output, not a prompt
+                    // for another model turn. Retractable callbacks have already cleared;
+                    // core-owned callback buffers must be discarded before surfacing the exact
+                    // parser failure through the ordinary terminal-error path.
+                    streamCallbackBuffer?.discard();
+                    finishTerminalProviderError(new Error(result.settleFinalization.errorCode), "unknown");
+                    continue;
+                }
+                // Track usage from the latest API call
+                if (result.usage)
+                    lastUsage = result.usage;
+                // SHARED: build CC-format assistant message from TurnResult
+                const msg = {
+                    role: "assistant",
+                };
+                // Persist assistant content WITHOUT inline <think>...</think> blocks.
+                // Reasoning content already routed through onReasoningChunk for live
+                // surfacing and persisted separately as `_reasoning_items` for
+                // providers that support a reasoning channel; saving it inline AND
+                // alongside tool_calls causes MiniMax to reject the replayed turn
+                // with "tool result's tool id not found" (error code 2013) because
+                // it can't reconcile reasoning-with-tools in the same assistant
+                // message. Strip aggressively at persist so the next replay is
+                // clean; preserve the original reasoning trace on the message via
+                // `_inline_reasoning` so debug/audit paths can still see it.
+                if (result.content) {
+                    const stripped = stripThinkBlocksForViolationCheck(result.content);
+                    if (stripped.length > 0)
+                        msg.content = stripped;
+                    if (stripped.length !== result.content.length) {
+                        msg._inline_reasoning = result.content;
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "info",
+                            component: "engine",
+                            event: "engine.inline_reasoning_stripped",
+                            message: "stripped inline <think> blocks from persisted assistant message; preserved on _inline_reasoning",
+                            meta: {
+                                provider: providerRuntime.id,
+                                model: providerRuntime.model,
+                                originalLength: result.content.length,
+                                strippedLength: stripped.length,
+                            },
+                        });
+                    }
+                }
+                if (result.toolCalls.length)
+                    msg.tool_calls = result.toolCalls.map((tc) => ({
+                        id: tc.id,
+                        type: "function",
+                        function: { name: tc.name, arguments: tc.arguments },
+                    }));
+                // Store reasoning items from the API response on the assistant message
+                // so they persist through session save/load and can be restored in toResponsesInput
+                const reasoningItems = result.outputItems.filter((item) => "type" in item && item.type === "reasoning");
+                if (reasoningItems.length > 0) {
+                    msg._reasoning_items = reasoningItems;
+                }
+                // Store thinking blocks (Anthropic) on the assistant message for round-tripping
+                const thinkingItems = result.outputItems.filter((item) => "type" in item && (item.type === "thinking" || item.type === "redacted_thinking"));
+                if (thinkingItems.length > 0) {
+                    msg._thinking_blocks = thinkingItems;
+                }
+                // Phase annotation for Codex provider
+                const hasPhaseAnnotation = providerRuntime.capabilities.has("phase-annotation");
+                const isSoleSettle = result.toolCalls.length === 1 && result.toolCalls[0].name === "settle";
+                if (hasPhaseAnnotation) {
+                    msg.phase = isSoleSettle ? "settle" : "commentary";
+                }
+                // Detect the MiniMax "only-thinking, no tool call" violation: no tool
+                // calls returned, and the content is empty after stripping
+                // <think>...</think> blocks. This is a narrow check — legitimate
+                // content-only responses (text without think tags, or text outside
+                // think tags) still flow through the original "no tool calls →
+                // accept as-is" path so existing channels and tests are unaffected.
+                const onlyThinkContent = !result.toolCalls.length
+                    && typeof result.content === "string"
+                    && stripThinkBlocksForViolationCheck(result.content).length === 0
+                    && result.content.length > 0;
+                const privateReturnTextAckRetryError = !result.toolCalls.length
+                    ? privateReturnMissingPonderError({
+                        latestUserRequest: latestUserMessageText(messages),
+                        answer: stripThinkBlocksForViolationCheck(result.content),
+                        sawPonder,
+                    })
+                    : null;
+                if (!result.toolCalls.length) {
+                    if (forcingHistoricalEffect) {
+                        streamCallbackBuffer?.discard();
+                        callbacks.onClearText?.();
+                        const retryableHistoricalTools = [...forcedHistoricalToolNames];
+                        if (historicalToolFailureRetries >= NO_TOOL_CALL_MAX_RETRIES) {
+                            const blockedAnswer = `I could not complete the unresolved ${retryableHistoricalTools.join(", ")} effect because the provider repeatedly returned no tool call. I did not treat the requested change as complete.`;
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.historical_tool_failure_retry",
+                                message: "unresolved historical effect exhausted deterministic tool-call retries; failing closed",
+                                meta: { provider: providerRuntime.id, model: providerRuntime.model, toolNames: retryableHistoricalTools, cap: NO_TOOL_CALL_MAX_RETRIES },
+                            });
+                            pushGenerated({ role: "assistant", content: blockedAnswer });
+                            callbacks.onTextChunk(blockedAnswer);
+                            completion = { answer: blockedAnswer, intent: "blocked" };
+                            outcome = "blocked";
                             done = true;
+                            continue;
                         }
+                        historicalToolFailureRetries += 1;
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.historical_tool_failure_retry",
+                            message: "unresolved historical effect returned no tool call; forcing another exact-effect attempt",
+                            meta: {
+                                provider: providerRuntime.id,
+                                model: providerRuntime.model,
+                                toolNames: retryableHistoricalTools,
+                                attempt: historicalToolFailureRetries,
+                                cap: NO_TOOL_CALL_MAX_RETRIES,
+                            },
+                        });
+                        rejectAttempt(msg, [{
+                                role: "user",
+                                content: `this exact request previously reached a tool that is advertised again now. Its unresolved historical effect is through ${retryableHistoricalTools.join(", ")}. Only that tool is available now. Read current state if needed, then retry the exact failed effect. Do not report completion until the effect succeeds.`,
+                            }]);
+                        continue;
                     }
-                    else {
-                        // Answer is undefined -- the model's final_answer was incomplete or
-                        // malformed. Clear any partial streamed text or noise, then push the
-                        // assistant msg + error tool result and let the model try again.
+                    const requiredToolCallsGate = pendingRequiredToolCalls();
+                    if (requiredToolCallsGate) {
+                        streamCallbackBuffer?.discard();
                         callbacks.onClearText?.();
-                        const retryError = getFinalAnswerRetryError(mustResolveBeforeHandoffActive, intent, sawSteeringFollowUp, options?.delegationDecision, sawSendMessageSelf, sawGoInward);
-                        messages.push(msg);
-                        messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: retryError });
-                        providerRuntime.appendToolOutput(result.toolCalls[0].id, retryError);
+                        queueRequiredCorrection(msg, requiredToolCallsGate.message, "before required tool calls completed");
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.required_tool_calls_pending",
+                            message: "terminal response rejected until required tool handlers dispatch",
+                            meta: { missingToolNames: requiredToolCallsGate.missing },
+                        });
+                        continue;
                     }
-                    continue;
-                }
-                // Check for no_response sole call: intercept before tool execution
-                const isSoleNoResponse = result.toolCalls.length === 1 && result.toolCalls[0].name === "no_response";
-                if (isSoleNoResponse) {
-                    let reason;
-                    try {
-                        const parsed = JSON.parse(result.toolCalls[0].arguments);
-                        if (typeof parsed?.reason === "string")
-                            reason = parsed.reason;
+                    const requiredAnswerRejection = options?.requiredToolCalls?.validateTerminalAnswer?.(String(msg.content ?? ""));
+                    if (requiredAnswerRejection) {
+                        streamCallbackBuffer?.discard();
+                        callbacks.onClearText?.();
+                        queueRequiredCorrection(msg, requiredAnswerRejection, "before required terminal answer validation completed");
+                        (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.required_tool_answer_rejected", message: "unsupported terminal answer rejected after required reads", meta: { answerLength: String(msg.content ?? "").length } });
+                        continue;
+                    }
+                    if (privateReturnTextAckRetryError) {
+                        streamCallbackBuffer?.discard();
+                        callbacks.onClearText?.();
+                        if (noToolCallRetries < NO_TOOL_CALL_MAX_RETRIES) {
+                            noToolCallRetries++;
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.no_tool_call_retry",
+                                message: "model returned a text-only private-return acknowledgement without ponder; retrying with corrective nudge",
+                                meta: {
+                                    attempt: noToolCallRetries,
+                                    cap: NO_TOOL_CALL_MAX_RETRIES,
+                                    provider: providerRuntime.id,
+                                    model: providerRuntime.model,
+                                    reason: "private_return_missing_ponder",
+                                    contentLength: result.content.length,
+                                },
+                            });
+                            rejectAttempt(msg, [{
+                                    role: "user",
+                                    content: `${privateReturnTextAckRetryError} Emit the ponder(action=create, ...) tool call now, or ask a blocking clarification without saying the private work is queued.`,
+                                }]);
+                            continue;
+                        }
+                        const blockedAnswer = "I could not start the private pass. No private-attention packet was created, so no return work was queued.";
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "error",
+                            component: "engine",
+                            event: "engine.private_return_missing_ponder_blocked",
+                            message: "private-return text acknowledgement skipped ponder through the retry cap; failing closed",
+                            meta: {
+                                cap: NO_TOOL_CALL_MAX_RETRIES,
+                                provider: providerRuntime.id,
+                                model: providerRuntime.model,
+                                contentLength: result.content.length,
+                            },
+                        });
+                        pushGenerated({ role: "assistant", content: blockedAnswer });
+                        callbacks.onTextChunk(blockedAnswer);
+                        completion = { answer: blockedAnswer, intent: "blocked" };
+                        outcome = "blocked";
+                        done = true;
+                        continue;
                     }
-                    catch { /* ignore */ }
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "engine",
-                        event: "engine.no_response",
-                        message: "agent declined to respond in group chat",
-                        meta: { ...(reason ? { reason } : {}) },
-                    });
-                    messages.push(msg);
-                    const silenced = "(silenced)";
-                    messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: silenced });
-                    providerRuntime.appendToolOutput(result.toolCalls[0].id, silenced);
-                    outcome = "no_response";
+                    if (onlyThinkContent && toolChoiceRequired && noToolCallRetries < NO_TOOL_CALL_MAX_RETRIES) {
+                        streamCallbackBuffer?.discard();
+                        // Provider-level violation: tool_choice was required, model emitted
+                        // only a <think>...</think> block (or empty content) with no tool
+                        // call. Retry with a corrective nudge up to NO_TOOL_CALL_MAX_RETRIES
+                        // times. After cap, accept as-is (the readback path strips think
+                        // tags and surfaces a clear diagnostic).
+                        noToolCallRetries++;
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.no_tool_call_retry",
+                            message: "model returned only <think> content with no tool call despite tool_choice=required; retrying with corrective nudge",
+                            meta: {
+                                attempt: noToolCallRetries,
+                                cap: NO_TOOL_CALL_MAX_RETRIES,
+                                provider: providerRuntime.id,
+                                model: providerRuntime.model,
+                                contentLength: result.content.length,
+                            },
+                        });
+                        rejectAttempt(msg, [{
+                                role: "user",
+                                content: isPrivateRuntimeChannel
+                                    ? augmentedToolContext?.noSend === true
+                                        ? "no tool was called this turn. this is an immutable no-send turn; call rest now without creating a continuation."
+                                        : "no tool was called this turn. you must end every turn by calling rest (or surface, ponder, observe). emit the tool call now."
+                                    : "no tool was called this turn. you must end every turn by calling settle with your answer (or ponder/observe). emit the tool call now.",
+                            }]);
+                        continue;
+                    }
+                    // Legitimate text-only response, or cap reached — accept as-is.
+                    await streamCallbackBuffer?.flush();
+                    pushGenerated(msg);
                     done = true;
-                    continue;
                 }
-                // Check for go_inward sole call: intercept before tool execution
-                const isSoleGoInward = result.toolCalls.length === 1 && result.toolCalls[0].name === "go_inward";
-                if (isSoleGoInward) {
-                    let parsedArgs = {};
-                    try {
-                        parsedArgs = JSON.parse(result.toolCalls[0].arguments);
+                else {
+                    // Reset the retry counter on any successful tool call.
+                    noToolCallRetries = 0;
+                    const preCallMessages = structuredClone(messages.filter((message) => message.role !== "system"));
+                    const validatedCalls = validateToolCallBatchAtProductionBoundary(result.toolCalls, activeTools);
+                    const invalidCall = validatedCalls.find((entry) => "error" in entry);
+                    if (invalidCall) {
+                        streamCallbackBuffer?.discard();
+                        const unadvertisedCall = validatedCalls.find((entry) => !activeToolNames.has(entry.call.name));
+                        const rejections = [];
+                        for (const entry of validatedCalls) {
+                            const detail = "error" in entry ? entry.error : "another call in this batch had invalid arguments";
+                            const rejection = unadvertisedCall
+                                ? `rejected: ${entry.call.name} was not advertised for this channel; no handler was executed.`
+                                : `invalid tool arguments: ${detail}`;
+                            rejections.push(rejection);
+                            options?.toolBoundaryObserver?.({
+                                name: entry.call.name,
+                                reason: activeToolNames.has(entry.call.name) ? "invalid_arguments" : "profile_excluded",
+                                globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(entry.call.name)?.handler === "function",
+                                invoked: false,
+                                sideEffect: false,
+                            });
+                        }
+                        rejectToolBatch(msg, rejections);
+                        if (unadvertisedCall) {
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.unadvertised_tool_blocked",
+                                message: "blocked an unadvertised tool call before batch execution",
+                                meta: { channel: String(channel), toolName: unadvertisedCall.call.name },
+                            });
+                        }
+                        else {
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.tool_arguments_rejected",
+                                message: "tool batch rejected before execution because arguments were invalid",
+                                meta: { toolCallId: invalidCall.call.id, toolName: invalidCall.call.name },
+                            });
+                        }
+                        continue;
+                    }
+                    const validCalls = validatedCalls;
+                    const validatedCallArguments = new Map(validCalls.map((entry) => [
+                        entry.call,
+                        entry.validated.arguments,
+                    ]));
+                    const preflightRejections = new Map();
+                    for (const entry of validCalls) {
+                        if (!relationship && !toolSelection.engine.some((tool) => tool.function.name === entry.call.name))
+                            continue;
+                        const prepared = await (0, tools_1.preflightToolCall)(entry.call.name, validatedCallArguments.get(entry.call), augmentedToolContext);
+                        if (prepared.kind !== "ready")
+                            preflightRejections.set(entry.call.id, prepared.text);
+                    }
+                    if (preflightRejections.size > 0) {
+                        streamCallbackBuffer?.discard();
+                        rejectToolBatch(msg, result.toolCalls.map((call) => preflightRejections.get(call.id)
+                            ?? "rejected: another call in this batch failed current authorization; no handler was executed."));
+                        continue;
+                    }
+                    const habitBlockReason = await habitToolBatchBlockReason(habitSession, result.toolCalls, augmentedToolContext?.delegatedOrigins, toolSelection);
+                    if (habitBlockReason) {
+                        streamCallbackBuffer?.discard();
+                        recordBlockedHabitSurfaceAttempts(habitSession, result.toolCalls, habitBlockReason);
+                        const blockedOutput = `blocked: ${habitBlockReason}. No tool side effects from this assistant message were executed.`;
+                        rejectToolBatch(msg, result.toolCalls.map(() => blockedOutput));
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.habit_tool_batch_blocked",
+                            message: "habit tool batch blocked before side effects",
+                            meta: { reason: habitBlockReason, toolCalls: result.toolCalls.map((call) => call.name) },
+                        });
+                        continue;
                     }
-                    catch { /* ignore */ }
-                    /* v8 ignore next -- defensive: content always string from model @preserve */
-                    const content = typeof parsedArgs.content === "string" ? parsedArgs.content : "";
-                    const answer = typeof parsedArgs.answer === "string" ? parsedArgs.answer : undefined;
-                    const parsedMode = parsedArgs.mode === "reflect" || parsedArgs.mode === "plan" || parsedArgs.mode === "relay"
-                        ? parsedArgs.mode
+                    const soleViolation = result.toolCalls.length > 1
+                        ? result.toolCalls.find((call) => SOLE_CALL_REJECTION[call.name] !== undefined || (0, tools_1.resolveToolDefinition)(call.name, toolSelection)?.terminalProjection?.requiresSoleCall === true)
                         : undefined;
-                    const mode = parsedMode || "reflect";
-                    // Emit outward answer if provided
-                    if (answer) {
-                        callbacks.onClearText?.();
-                        callbacks.onTextChunk(answer);
+                    if (soleViolation) {
+                        streamCallbackBuffer?.discard();
+                        const reason = SOLE_CALL_REJECTION[soleViolation.name] ?? `rejected: ${soleViolation.name} must be the only tool call.`;
+                        rejectToolBatch(msg, result.toolCalls.map(() => reason));
+                        continue;
                     }
-                    // Build handoff packet and enqueue
-                    const handoffContent = buildGoInwardHandoffPacket({
-                        content,
-                        mode,
-                        delegationDecision: options?.delegationDecision,
-                        currentSession: options?.toolContext?.currentSession ?? null,
-                        currentObligation: options?.currentObligation ?? null,
-                        outwardClosureRequired: options?.delegationDecision?.outwardClosureRequired ?? false,
-                    });
-                    const pendingDir = (0, pending_1.getInnerDialogPendingDir)((0, identity_2.getAgentName)());
-                    const currentSession = options?.toolContext?.currentSession;
-                    const isInnerChannel = currentSession?.friendId === "self" && currentSession?.channel === "inner";
-                    const envelope = {
-                        from: (0, identity_2.getAgentName)(),
-                        friendId: "self",
-                        channel: "inner",
-                        key: "dialog",
-                        content: handoffContent,
-                        timestamp: Date.now(),
-                        mode,
-                        ...(currentSession && !isInnerChannel ? {
-                            delegatedFrom: {
-                                friendId: currentSession.friendId,
-                                channel: currentSession.channel,
-                                key: currentSession.key,
-                            },
-                            obligationStatus: "pending",
-                        } : {}),
-                    };
-                    (0, pending_1.queuePendingMessage)(pendingDir, envelope);
-                    if (currentSession && !isInnerChannel) {
+                    const soleTerminalCall = result.toolCalls.length === 1
+                        ? result.toolCalls[0]
+                        : null;
+                    const soleTerminalProjection = soleTerminalCall
+                        ? (0, tools_1.resolveToolDefinition)(soleTerminalCall.name, toolSelection)?.terminalProjection
+                        : undefined;
+                    if (soleTerminalCall && soleTerminalProjection?.mode === "verbatim") {
+                        const terminalArgs = validatedCallArguments.get(soleTerminalCall);
+                        if (soleTerminalProjection.clearBufferedText
+                            || callbacks.settleOutputMode === "final_only") {
+                            streamCallbackBuffer?.discard();
+                        }
+                        else {
+                            await streamCallbackBuffer?.flush();
+                        }
+                        if (soleTerminalProjection.clearBufferedText)
+                            callbacks.onClearText?.();
+                        callbacks.onToolStart(soleTerminalCall.name, terminalArgs);
+                        let terminalResult;
+                        let terminalSucceeded = false;
                         try {
-                            (0, obligations_1.createObligation)((0, identity_2.getAgentRoot)(), {
-                                origin: {
-                                    friendId: currentSession.friendId,
-                                    channel: currentSession.channel,
-                                    key: currentSession.key,
-                                },
-                                content,
-                            });
+                            if (options?.execTool && !relationship) {
+                                terminalResult = await options.execTool(soleTerminalCall.name, terminalArgs, trustedToolContext);
+                                terminalSucceeded = true;
+                            }
+                            else {
+                                const execution = await (0, tools_1.executeTool)(soleTerminalCall.name, terminalArgs, augmentedToolContext, options?.execTool);
+                                terminalResult = "error" in execution
+                                    ? `error: ${execution.error instanceof Error ? execution.error.message : String(execution.error)}`
+                                    : execution.text;
+                                terminalSucceeded = execution.kind === "handler_succeeded";
+                            }
                         }
-                        catch {
-                            /* v8 ignore next -- defensive: obligation store write failure should not break go_inward @preserve */
+                        catch (error) {
+                            terminalResult = error instanceof Error ? `error: ${error.message}` : `error: ${String(error)}`;
                         }
+                        callbacks.onToolEnd(soleTerminalCall.name, (0, tools_1.summarizeArgs)(soleTerminalCall.name, terminalArgs, toolSelection), terminalSucceeded);
+                        pushGenerated(msg);
+                        pushGenerated({ role: "tool", tool_call_id: soleTerminalCall.id, content: terminalResult });
+                        providerRuntime.appendToolOutput(soleTerminalCall.id, terminalResult);
+                        callbacks.onTextChunk(terminalResult);
+                        completion = { answer: terminalResult, intent: terminalSucceeded ? "complete" : "blocked" };
+                        outcome = terminalSucceeded ? "settled" : "blocked";
+                        done = true;
+                        continue;
                     }
-                    try {
-                        await (0, socket_client_1.requestInnerWake)((0, identity_2.getAgentName)());
+                    // Check for settle sole call: intercept before tool execution
+                    if (isSoleSettle) {
+                        const settleArgs = validatedCallArguments.get(result.toolCalls[0]);
+                        callbacks.onToolStart("settle", settleArgs);
+                        const requiredToolCallsGate = pendingRequiredToolCalls();
+                        if (requiredToolCallsGate) {
+                            streamCallbackBuffer?.discard();
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
+                            callbacks.onClearText?.();
+                            queueRequiredCorrection(msg, requiredToolCallsGate.message, "before required tool calls completed");
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.required_tool_calls_pending",
+                                message: "settle rejected until required tool handlers dispatch",
+                                meta: { missingToolNames: requiredToolCallsGate.missing },
+                            });
+                            continue;
+                        }
+                        // Private-runtime attention queue gate: reject settle if items remain
+                        const attentionQueue = augmentedToolContext?.delegatedOrigins;
+                        if (isPrivateRuntimeChannel && attentionQueue && attentionQueue.length > 0) {
+                            streamCallbackBuffer?.discard();
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
+                            callbacks.onClearText?.();
+                            const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you settle. Older transcript claims are historical; only the current held-work frame is the gate.";
+                            rejectToolBatch(msg, [gateMessage]);
+                            continue;
+                        }
+                        // Extract answer from the tool call arguments.
+                        // Supports: {"answer":"text","intent":"..."} or "text" (JSON string).
+                        const { answer, intent } = parseSettlePayload(result.toolCalls[0].arguments);
+                        const requiredAnswerRejection = options?.requiredToolCalls?.validateTerminalAnswer?.(answer);
+                        if (requiredAnswerRejection) {
+                            streamCallbackBuffer?.discard();
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
+                            callbacks.onClearText?.();
+                            queueRequiredCorrection(msg, requiredAnswerRejection, "before required terminal answer validation completed");
+                            (0, runtime_1.emitNervesEvent)({ level: "warn", component: "engine", event: "engine.required_tool_answer_rejected", message: "unsupported settle answer rejected after required reads", meta: { answerLength: answer.length } });
+                            continue;
+                        }
+                        // Private-runtime settle: no CompletionMetadata, "(settled)" ack
+                        if (isPrivateRuntimeChannel) {
+                            streamCallbackBuffer?.discard();
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), true);
+                            pushGenerated(msg);
+                            const settled = "(settled)";
+                            pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: settled });
+                            providerRuntime.appendToolOutput(result.toolCalls[0].id, settled);
+                            outcome = "settled";
+                            done = true;
+                            continue;
+                        }
+                        // The provider finalizer has already established a top-level string
+                        // answer before ordinary settle handling reaches this point.
+                        const deliveredAnswer = answer;
+                        const retryError = privateReturnAckLeakError(deliveredAnswer, privateReturnHeldTokens)
+                            ?? privateReturnMissingPonderError({
+                                latestUserRequest: latestUserMessageText(messages),
+                                answer: deliveredAnswer,
+                                sawPonder,
+                            })
+                            ?? getSettleRetryError(mustResolveBeforeHandoffActive, intent, sawSteeringFollowUp, options?.delegationDecision, sawSendMessageSelf, sawPonder, sawQuerySession, options?.currentObligation ?? null, options?.activeWorkFrame?.inner?.job, sawExternalStateQuery);
+                        const validDirectReply = mustResolveBeforeHandoffActive && intent === "direct_reply" && sawSteeringFollowUp;
+                        if (retryError === null) {
+                            try {
+                                if (!result.settleStreamed) {
+                                    const acceptedOutputCallbacks = streamCallbackBuffer?.callbacks ?? callbacks;
+                                    acceptedOutputCallbacks.onTextChunk(deliveredAnswer);
+                                }
+                                await streamCallbackBuffer?.flush();
+                            }
+                            catch (error) {
+                                callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
+                                streamCallbackBuffer?.discard();
+                                finishTerminalProviderError(new streaming_1.SettleFinalizationCallbackError(error), "unknown");
+                                continue;
+                            }
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), true);
+                            completion = {
+                                answer: deliveredAnswer,
+                                intent: validDirectReply ? "direct_reply" : intent === "blocked" ? "blocked" : "complete",
+                            };
+                            // Retractable owners already hold the validated answer. Final-only
+                            // owners receive it here, after every semantic continuation gate.
+                            pushGenerated(msg);
+                            if (validDirectReply) {
+                                const resumeWork = "direct reply delivered. resume the unresolved obligation now and keep working until you can finish or clearly report that you are blocked.";
+                                pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: resumeWork });
+                                providerRuntime.appendToolOutput(result.toolCalls[0].id, resumeWork);
+                            }
+                            else {
+                                const delivered = "(delivered)";
+                                pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: delivered });
+                                providerRuntime.appendToolOutput(result.toolCalls[0].id, delivered);
+                                outcome = intent === "blocked" ? "blocked" : "settled";
+                                done = true;
+                            }
+                        }
+                        else {
+                            // The payload is structurally final, but a semantic continuation
+                            // gate rejected it. Return that exact gate reason to the model.
+                            streamCallbackBuffer?.discard();
+                            callbacks.onToolEnd("settle", (0, tools_1.summarizeArgs)("settle", settleArgs, toolSelection), false);
+                            callbacks.onClearText?.();
+                            rejectToolBatch(msg, [retryError]);
+                        }
+                        continue;
                     }
-                    catch { /* daemon may not be running */ }
-                    sawGoInward = true;
-                    messages.push(msg);
-                    const ack = "(going inward)";
-                    messages.push({ role: "tool", tool_call_id: result.toolCalls[0].id, content: ack });
-                    providerRuntime.appendToolOutput(result.toolCalls[0].id, ack);
-                    (0, runtime_1.emitNervesEvent)({
-                        component: "engine",
-                        event: "engine.go_inward",
-                        message: "taking thread inward",
-                        meta: { mode, hasAnswer: answer !== undefined, contentSnippet: content.slice(0, 80) },
-                    });
-                    outcome = "go_inward";
-                    done = true;
-                    continue;
-                }
-                messages.push(msg);
-                // SHARED: execute tools (final_answer, no_response, go_inward in mixed calls are rejected inline)
-                for (const tc of result.toolCalls) {
-                    if (signal?.aborted)
-                        break;
-                    // Intercept final_answer in mixed call: reject it
-                    if (tc.name === "final_answer") {
-                        const rejection = "rejected: final_answer must be the only tool call. Finish your work first, then call final_answer alone.";
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: rejection });
-                        providerRuntime.appendToolOutput(tc.id, rejection);
+                    // Check for observe sole call: intercept before tool execution
+                    const isSoleObserve = result.toolCalls.length === 1 && result.toolCalls[0].name === "observe";
+                    if (isSoleObserve) {
+                        streamCallbackBuffer?.discard();
+                        const observeArgs = validatedCallArguments.get(result.toolCalls[0]);
+                        let reason;
+                        if (typeof observeArgs?.reason === "string")
+                            reason = observeArgs.reason;
+                        callbacks.onToolStart("observe", observeArgs);
+                        (0, runtime_1.emitNervesEvent)({
+                            component: "engine",
+                            event: "engine.observe",
+                            message: "agent observed without responding",
+                            meta: { ...(reason ? { reason } : {}) },
+                        });
+                        callbacks.onToolEnd("observe", (0, tools_1.summarizeArgs)("observe", observeArgs, toolSelection), true);
+                        pushGenerated(msg);
+                        const silenced = "(silenced)";
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: silenced });
+                        providerRuntime.appendToolOutput(result.toolCalls[0].id, silenced);
+                        outcome = "observed";
+                        done = true;
                         continue;
                     }
-                    // Intercept no_response in mixed call: reject it
-                    if (tc.name === "no_response") {
-                        const rejection = "rejected: no_response must be the only tool call. call no_response alone when you want to stay silent.";
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: rejection });
-                        providerRuntime.appendToolOutput(tc.id, rejection);
+                    // Check for rest sole call: intercept before tool execution
+                    const isSoleRest = result.toolCalls.length === 1 && result.toolCalls[0].name === "rest";
+                    if (isSoleRest) {
+                        streamCallbackBuffer?.discard();
+                        const restArgs = validatedCallArguments.get(result.toolCalls[0]);
+                        callbacks.onToolStart("rest", restArgs);
+                        // Attention queue gate: reject rest if items remain
+                        const attentionQueue = augmentedToolContext?.delegatedOrigins;
+                        if (attentionQueue && attentionQueue.length > 0) {
+                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), false);
+                            const gateMessage = "current held-work frame still has unsurfaced items — return each listed item with surface(delegationId=...) before you rest. Older transcript claims are historical; only the current held-work frame is the gate.";
+                            rejectToolBatch(msg, [gateMessage]);
+                            continue;
+                        }
+                        if (hasFreshPendingWork(options) && !freshWorkGateFired) {
+                            freshWorkGateFired = true;
+                            callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), false);
+                            const gateMessage = "fresh work arrived for me this turn — inspect the pending messages above and take the next concrete action before you rest.";
+                            rejectToolBatch(msg, [gateMessage]);
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "info",
+                                component: "engine",
+                                event: "engine.fresh_work_gate_fired",
+                                message: "rest deferred once because pending work arrived this turn; agent has been notified",
+                                meta: { pendingCount: options.pendingMessages.length },
+                            });
+                            continue;
+                        }
+                        callbacks.onToolEnd("rest", (0, tools_1.summarizeArgs)("rest", restArgs, toolSelection), true);
+                        pushGenerated(msg);
+                        const ack = "(resting)";
+                        pushGenerated({ role: "tool", tool_call_id: result.toolCalls[0].id, content: ack });
+                        providerRuntime.appendToolOutput(result.toolCalls[0].id, ack);
+                        (0, runtime_1.emitNervesEvent)({
+                            component: "engine",
+                            event: "engine.rested",
+                            message: "resting until next heartbeat",
+                            meta: { ...(typeof restArgs?.status === "string" ? { status: restArgs.status } : {}) },
+                        });
+                        outcome = "rested";
+                        done = true;
                         continue;
                     }
-                    // Intercept go_inward in mixed call: reject it
-                    if (tc.name === "go_inward") {
-                        const rejection = "rejected: go_inward must be the only tool call. finish your other work first, then call go_inward alone.";
-                        messages.push({ role: "tool", tool_call_id: tc.id, content: rejection });
-                        providerRuntime.appendToolOutput(tc.id, rejection);
+                    const requiredDispatchRejections = new Map();
+                    for (const entry of validCalls) {
+                        const requiredArgs = entry.validated.arguments;
+                        const rejection = options?.requiredToolCalls?.validateToolCallBeforeDispatch?.(entry.call.name, requiredArgs);
+                        if (rejection)
+                            requiredDispatchRejections.set(entry.call.id, { name: entry.call.name, args: requiredArgs, message: rejection });
+                    }
+                    if (requiredDispatchRejections.size > 0) {
+                        streamCallbackBuffer?.discard();
+                        for (const rejection of requiredDispatchRejections.values()) {
+                            callbacks.onToolStart(rejection.name, rejection.args);
+                            callbacks.onToolEnd(rejection.name, (0, tools_1.summarizeArgs)(rejection.name, rejection.args, toolSelection), false);
+                            options?.toolBoundaryObserver?.({
+                                name: rejection.name, reason: "dependency_rejected",
+                                globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(rejection.name)?.handler === "function",
+                                invoked: false, sideEffect: false,
+                            });
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn", component: "engine", event: "engine.required_tool_dispatch_rejected",
+                                message: "required tool dependency rejected before approval and handler dispatch",
+                                meta: { toolName: rejection.name },
+                            });
+                        }
+                        rejectToolBatch(msg, result.toolCalls.map((call) => requiredDispatchRejections.get(call.id)?.message
+                            ?? "rejected: another call in this batch has an unsatisfied required dependency; no handler was executed."));
                         continue;
                     }
-                    let args = {};
-                    try {
-                        args = JSON.parse(tc.arguments);
+                    const executionRejections = new Map();
+                    for (const entry of validCalls) {
+                        const args = validatedCallArguments.get(entry.call);
+                        const fingerprint = effectFingerprint(entry.call.name, entry.call.arguments, toolSelection);
+                        if (forcingHistoricalEffect && fingerprint && !unresolvedHistoricalEffects.some((effect) => effect.fingerprint === fingerprint)) {
+                            executionRejections.set(entry.call.id, "rejected: this turn is retrying an unresolved historical effect, and these mutation arguments do not match it. Read current state or retry the exact failed effect.");
+                        }
+                        else if (entry.call.name === "send_message" && args.friendId === "self" && !isPrivateRuntimeChannel && looksLikePrivateReturnRequest(latestUserMessageText(messages))) {
+                            executionRejections.set(entry.call.id, "private-return requests must use ponder, not send_message(friendId=self). Create a typed ponder packet with the marker/source request preserved, then only acknowledge that the private pass is queued.");
+                        }
+                        else if (entry.call.name !== "speak" && entry.call.name !== "ponder") {
+                            const loop = (0, tool_loop_1.detectToolLoop)(toolLoopState, entry.call.name, args);
+                            if (loop.stuck)
+                                executionRejections.set(entry.call.id, `loop guard: ${loop.message}`);
+                        }
                     }
-                    catch {
-                        /* ignore */
+                    if (executionRejections.size > 0) {
+                        streamCallbackBuffer?.discard();
+                        for (const entry of validCalls) {
+                            if (!executionRejections.has(entry.call.id))
+                                continue;
+                            const args = validatedCallArguments.get(entry.call);
+                            callbacks.onToolStart(entry.call.name, args);
+                            callbacks.onToolEnd(entry.call.name, (0, tools_1.summarizeArgs)(entry.call.name, args, toolSelection), false);
+                        }
+                        rejectToolBatch(msg, result.toolCalls.map((call) => executionRejections.get(call.id)
+                            ?? "rejected: another call in this batch was inadmissible; no handler was executed."));
+                        continue;
                     }
-                    if (tc.name === "send_message" && args.friendId === "self") {
-                        sawSendMessageSelf = true;
+                    const approvalCalls = await Promise.all(validCalls.map(async (entry) => {
+                        const classification = await (0, tools_1.classifyApprovalForInvocation)(entry.call.name, entry.validated.arguments, augmentedToolContext);
+                        return {
+                            ...entry,
+                            ...classification,
+                        };
+                    }));
+                    const protectedCall = approvalCalls.find((entry) => entry.policy.kind === "required");
+                    if (protectedCall && result.toolCalls.length !== 1) {
+                        streamCallbackBuffer?.discard();
+                        rejectToolBatch(msg, result.toolCalls.map(() => "rejected: approval-eligible tool must be the sole call; no call in this batch was executed."));
+                        (0, runtime_1.emitNervesEvent)({
+                            level: "warn",
+                            component: "engine",
+                            event: "engine.approval_mixed_batch_rejected",
+                            message: "protected tool batch rejected before every handler",
+                            meta: { toolCallCount: result.toolCalls.length, protectedToolName: protectedCall.call.name },
+                        });
+                        continue;
                     }
-                    /* v8 ignore next -- flag tested via truth-check integration tests @preserve */
-                    if (tc.name === "query_session")
-                        sawQuerySession = true;
-                    /* v8 ignore next -- flag tested via truth-check integration tests @preserve */
-                    if (tc.name === "bridge_manage")
-                        sawBridgeManage = true;
-                    const argSummary = (0, tools_1.summarizeArgs)(tc.name, args);
-                    // Confirmation check for mutate tools
-                    if ((0, tools_1.isConfirmationRequired)(tc.name) && !options?.skipConfirmation) {
-                        let decision = "denied";
-                        if (callbacks.onConfirmAction) {
-                            decision = await callbacks.onConfirmAction(tc.name, args);
-                        }
-                        if (decision !== "confirmed") {
-                            const cancelled = "Action cancelled by user.";
-                            callbacks.onToolStart(tc.name, args);
-                            callbacks.onToolEnd(tc.name, argSummary, false);
-                            messages.push({ role: "tool", tool_call_id: tc.id, content: cancelled });
-                            providerRuntime.appendToolOutput(tc.id, cancelled);
+                    if (protectedCall && protectedCall.policy.kind === "required") {
+                        if (!options?.approvalCoordinator) {
+                            streamCallbackBuffer?.discard();
+                            const rejection = "rejected: this protected tool requires approval, but the approval coordinator is unavailable; the handler was not invoked.";
+                            rejectToolBatch(msg, [rejection]);
+                            (0, runtime_1.emitNervesEvent)({
+                                level: "warn",
+                                component: "engine",
+                                event: "engine.approval_coordinator_unavailable",
+                                message: "protected tool failed closed before handler execution",
+                                meta: { toolName: protectedCall.call.name, toolCallId: protectedCall.call.id },
+                            });
                             continue;
                         }
+                        streamCallbackBuffer?.discard();
+                        const toolDigest = (0, tool_approval_1.digestApprovalToolDefinition)((0, tools_1.resolveToolDefinition)(protectedCall.call.name, toolSelection), protectedCall.validated.schemaDigest, protectedCall.policy.policyId);
+                        const policyDigest = (0, tool_arguments_1.digestJson)({
+                            policyId: protectedCall.policy.policyId,
+                            actionClass: protectedCall.policy.actionClass,
+                            classification: "required",
+                        });
+                        const committed = await options.approvalCoordinator.propose({
+                            toolCall: structuredClone(msg.tool_calls[0]),
+                            arguments: structuredClone(protectedCall.validated.arguments),
+                            preCallMessages,
+                            frozenAssistantMessage: structuredClone(msg),
+                            schemaDigest: protectedCall.validated.schemaDigest,
+                            toolDigest,
+                            policyDigest,
+                            policyId: protectedCall.policy.policyId,
+                            actionClass: protectedCall.policy.actionClass,
+                            liveToolContext: augmentedToolContext,
+                        });
+                        pushGenerated(msg);
+                        suspension = {
+                            approvalId: committed.approvalId,
+                            toolCallId: protectedCall.call.id,
+                            checkpointDigest: committed.checkpointDigest,
+                            suspendedSessionRevision: committed.suspendedSessionRevision,
+                        };
+                        outcome = "suspended";
+                        done = true;
+                        (0, runtime_1.emitNervesEvent)({
+                            component: "engine",
+                            event: "engine.approval_turn_suspended",
+                            message: "agent turn suspended before protected tool execution",
+                            meta: { approvalId: committed.approvalId, toolCallId: protectedCall.call.id },
+                        });
+                        continue;
                     }
-                    callbacks.onToolStart(tc.name, args);
-                    let toolResult;
-                    let success;
-                    try {
-                        const execToolFn = options?.execTool ?? tools_1.execTool;
-                        toolResult = await execToolFn(tc.name, args, augmentedToolContext ?? options?.toolContext);
-                        success = true;
-                    }
-                    catch (e) {
-                        toolResult = `error: ${e}`;
-                        success = false;
+                    await streamCallbackBuffer?.flush();
+                    pushGenerated(msg);
+                    // Every pre-dispatch gate accepted the complete batch.
+                    for (const tc of result.toolCalls) {
+                        if (signal?.aborted)
+                            break;
+                        const args = validatedCallArguments.get(tc);
+                        const currentEffectFingerprint = effectFingerprint(tc.name, tc.arguments, toolSelection);
+                        if (tc.name === "send_message" && args.friendId === "self") {
+                            sawSendMessageSelf = true;
+                        }
+                        if (tc.name === "speak") {
+                            // The canonical pre-batch schema gate guarantees a required string.
+                            const speakArgs = JSON.parse(tc.arguments);
+                            const speakMessage = speakArgs.message;
+                            const argSummary = (0, tools_1.summarizeArgs)("speak", { message: speakMessage }, toolSelection);
+                            callbacks.onToolStart("speak", { message: speakMessage });
+                            if (speakMessage.trim().length === 0) {
+                                const err = "speak requires a non-empty `message` string.";
+                                callbacks.onToolEnd("speak", argSummary, false);
+                                pushGenerated({ role: "tool", tool_call_id: tc.id, content: err });
+                                providerRuntime.appendToolOutput(tc.id, err);
+                                (0, runtime_1.emitNervesEvent)({
+                                    level: "warn",
+                                    component: "engine",
+                                    event: "engine.speak_invalid",
+                                    message: "speak rejected: missing or empty message",
+                                    meta: {},
+                                });
+                                continue;
+                            }
+                            callbacks.onTextChunk(speakMessage);
+                            let speakDeliveryError = null;
+                            try {
+                                await callbacks.flushNow?.();
+                            }
+                            catch (err) {
+                                speakDeliveryError = err instanceof Error ? err : new Error(String(err));
+                            }
+                            if (speakDeliveryError) {
+                                callbacks.onToolEnd("speak", argSummary, false);
+                                const failMsg = `speak delivery failed: ${speakDeliveryError.message}. the message did not reach your friend; do not assume they saw it.`;
+                                pushGenerated({ role: "tool", tool_call_id: tc.id, content: failMsg });
+                                providerRuntime.appendToolOutput(tc.id, failMsg);
+                                (0, runtime_1.emitNervesEvent)({
+                                    level: "error",
+                                    component: "engine",
+                                    event: "engine.speak_delivery_failed",
+                                    message: "speak delivery failed",
+                                    meta: { error: speakDeliveryError.message, messageLength: speakMessage.length },
+                                });
+                                continue;
+                            }
+                            callbacks.onToolEnd("speak", argSummary, true);
+                            const ack = "(spoken)";
+                            pushGenerated({ role: "tool", tool_call_id: tc.id, content: ack });
+                            providerRuntime.appendToolOutput(tc.id, ack);
+                            (0, runtime_1.emitNervesEvent)({
+                                component: "engine",
+                                event: "engine.speak",
+                                message: "agent spoke mid-turn",
+                                meta: { messageLength: speakMessage.length },
+                            });
+                            continue;
+                        }
+                        if (tc.name === "ponder") {
+                            const parsedArgs = normalizeLegacyPonderArgs(parsePonderPayload(tc.arguments));
+                            const argSummary = (0, tools_1.summarizeArgs)(tc.name, parsedArgs, toolSelection);
+                            callbacks.onToolStart(tc.name, parsedArgs);
+                            let toolResult;
+                            let success = false;
+                            try {
+                                const action = parsedArgs.action ?? "create";
+                                const currentSession = augmentedToolContext?.currentSession;
+                                const currentOrigin = currentSession
+                                    ? { friendId: currentSession.friendId, channel: currentSession.channel, key: currentSession.key }
+                                    : undefined;
+                                const isInnerChannel = currentOrigin?.friendId === "self" && currentOrigin?.channel === "inner";
+                                const shouldCreateReturnObligation = !!currentOrigin && !isInnerChannel;
+                                const attentionQueue = augmentedToolContext?.delegatedOrigins ?? [];
+                                const successCriteria = parseSuccessCriteria(parsedArgs.success_criteria);
+                                const payload = parsePacketPayload(parsedArgs.payload_json);
+                                let packet;
+                                let returnObligationId = null;
+                                let resultAction = "created";
+                                let privateReturnSourceRequest = "";
+                                if (action === "create") {
+                                    if (isInnerChannel && attentionQueue.length > 0) {
+                                        throw new Error("private runtime already has held return work in the attention queue; surface the existing delegationId instead of creating a replacement ponder packet.");
+                                    }
+                                    const kind = parsedArgs.kind;
+                                    const objective = typeof parsedArgs.objective === "string" ? parsedArgs.objective.trim() : "";
+                                    const summary = typeof parsedArgs.summary === "string" ? parsedArgs.summary.trim() : "";
+                                    const sourceRequest = currentOrigin && !isInnerChannel ? latestUserMessageText(messages) : "";
+                                    privateReturnSourceRequest = sourceRequest;
+                                    if (!kind || !objective || !successCriteria || !payload) {
+                                        throw new Error("ponder create requires kind, objective, success_criteria, and valid payload_json.");
+                                    }
+                                    const packetPayload = sourceRequest
+                                        ? { ...payload, sourceRequest }
+                                        : payload;
+                                    const createLinkedReturnObligation = (id, packetId) => {
+                                        (0, obligations_1.createReturnObligation)((0, identity_2.getAgentName)(), {
+                                            id,
+                                            origin: currentOrigin,
+                                            status: "queued",
+                                            delegatedContent: buildPonderDelegatedContent({ summary, objective, sourceRequest }),
+                                            packetId,
+                                            createdAt: Date.now(),
+                                        });
+                                    };
+                                    const agentRoot = (0, identity_2.getAgentRoot)();
+                                    let relatedObligationId;
+                                    if (currentOrigin && !isInnerChannel) {
+                                        try {
+                                            const obligation = (0, obligations_1.createObligation)(agentRoot, {
+                                                origin: currentOrigin,
+                                                content: objective,
+                                            });
+                                            relatedObligationId = obligation.id;
+                                        }
+                                        catch {
+                                            relatedObligationId = undefined;
+                                        }
+                                    }
+                                    const frictionSignature = kind === "harness_friction" && typeof packetPayload.frictionSignature === "string"
+                                        ? packetPayload.frictionSignature
+                                        : null;
+                                    const existing = frictionSignature && currentOrigin
+                                        ? (0, packets_1.findHarnessFrictionPacket)(agentRoot, currentOrigin, frictionSignature)
+                                        : null;
+                                    if (existing) {
+                                        resultAction = "revised";
+                                        const existingActiveReturnId = shouldCreateReturnObligation
+                                            ? activeReturnObligationId((0, identity_2.getAgentName)(), existing.relatedReturnObligationId)
+                                            : null;
+                                        returnObligationId = existingActiveReturnId
+                                            ?? (shouldCreateReturnObligation ? (0, obligations_1.generateObligationId)(Date.now()) : null);
+                                        packet = existing.status === "drafting"
+                                            ? (0, packets_1.revisePonderPacket)(agentRoot, existing.id, {
+                                                kind,
+                                                objective,
+                                                summary,
+                                                successCriteria,
+                                                payload: packetPayload,
+                                            })
+                                            : existing;
+                                        if (returnObligationId && returnObligationId !== existing.relatedReturnObligationId) {
+                                            packet = (0, packets_1.advancePonderPacket)(agentRoot, packet.id, { relatedReturnObligationId: returnObligationId });
+                                            createLinkedReturnObligation(returnObligationId, packet.id);
+                                        }
+                                    }
+                                    else {
+                                        returnObligationId = shouldCreateReturnObligation ? (0, obligations_1.generateObligationId)(Date.now()) : null;
+                                        packet = (0, packets_1.createPonderPacket)(agentRoot, {
+                                            kind,
+                                            objective,
+                                            summary,
+                                            successCriteria,
+                                            ...(currentOrigin ? { origin: currentOrigin } : {}),
+                                            ...(relatedObligationId ? { relatedObligationId } : {}),
+                                            ...(returnObligationId ? { relatedReturnObligationId: returnObligationId } : {}),
+                                            ...(parsedArgs.follows_packet_id ? { followsPacketId: parsedArgs.follows_packet_id } : {}),
+                                            payload: packetPayload,
+                                        });
+                                        if (returnObligationId) {
+                                            createLinkedReturnObligation(returnObligationId, packet.id);
+                                        }
+                                    }
+                                }
+                                else {
+                                    const packetId = typeof parsedArgs.packet_id === "string" ? parsedArgs.packet_id.trim() : "";
+                                    const kind = parsedArgs.kind;
+                                    const objective = typeof parsedArgs.objective === "string" ? parsedArgs.objective.trim() : "";
+                                    const summary = typeof parsedArgs.summary === "string" ? parsedArgs.summary.trim() : "";
+                                    if (!packetId || !kind || !objective || !successCriteria || !payload) {
+                                        throw new Error("ponder revise requires packet_id, kind, objective, success_criteria, and valid payload_json.");
+                                    }
+                                    packet = (0, packets_1.revisePonderPacket)((0, identity_2.getAgentRoot)(), packetId, {
+                                        kind,
+                                        objective,
+                                        summary,
+                                        successCriteria,
+                                        payload,
+                                    });
+                                    returnObligationId = packet.relatedReturnObligationId
+                                        && !(packet.origin?.friendId === "self" && packet.origin.channel === "inner")
+                                        ? packet.relatedReturnObligationId
+                                        : null;
+                                    resultAction = "revised";
+                                }
+                                if (returnObligationId) {
+                                    for (const token of extractPrivateReturnHeldTokens(privateReturnSourceRequest)) {
+                                        privateReturnHeldTokens.add(token);
+                                    }
+                                    const agentName = (0, identity_2.getAgentName)();
+                                    await (0, socket_client_1.requestPrivateWake)(agentName, augmentedToolContext?.daemonSocketPath, buildPonderReturnPrivateWakeOptions({ agentName, packet, returnObligationId })).catch(() => undefined);
+                                }
+                                sawPonder = true;
+                                toolResult = buildPonderResult(packet, resultAction, returnObligationId);
+                                success = true;
+                                (0, runtime_1.emitNervesEvent)({
+                                    component: "engine",
+                                    event: "engine.ponder_packet",
+                                    message: "ponder packet touched",
+                                    meta: {
+                                        action: resultAction,
+                                        packetId: packet.id,
+                                        kind: packet.kind,
+                                        status: packet.status,
+                                    },
+                                });
+                            }
+                            catch (error) {
+                                toolResult = error instanceof Error ? error.message : String(error);
+                            }
+                            callbacks.onToolEnd(tc.name, argSummary, success);
+                            pushGenerated({ role: "tool", tool_call_id: tc.id, content: toolResult });
+                            providerRuntime.appendToolOutput(tc.id, toolResult);
+                            continue;
+                        }
+                        /* v8 ignore next -- flag tested via truth-check integration tests @preserve */
+                        if (tc.name === "query_session")
+                            sawQuerySession = true;
+                        /* v8 ignore next -- flag tested via truth-check integration tests @preserve */
+                        if (tc.name === "bridge_manage")
+                            sawBridgeManage = true;
+                        /* v8 ignore next -- flag tested via truth-check integration tests @preserve */
+                        if (isExternalStateQuery(tc.name, args))
+                            sawExternalStateQuery = true;
+                        callbacks.onToolStart(tc.name, args);
+                        let toolResult;
+                        let success;
+                        let invoked = false;
+                        try {
+                            const routineActionSelection = approvalCalls.find((entry) => entry.call.id === tc.id)?.routineActionSelection;
+                            const executionToolContext = routineActionSelection && augmentedToolContext ? { ...augmentedToolContext, routineActionSelection } : augmentedToolContext;
+                            if (options?.execTool && !relationship) {
+                                invoked = true;
+                                toolResult = await options.execTool(tc.name, args, trustedToolContext);
+                                success = true;
+                            }
+                            else {
+                                const execution = await (0, tools_1.executeTool)(tc.name, args, executionToolContext, options?.execTool);
+                                invoked = execution.kind !== "rejected_before_handler";
+                                success = execution.kind === "handler_succeeded";
+                                toolResult = "error" in execution ? `error: ${execution.error}` : execution.text;
+                            }
+                        }
+                        catch (e) {
+                            toolResult = `error: ${e}`;
+                            success = false;
+                        }
+                        if (invoked && requiredToolCallNames.includes(tc.name) && !options?.requiredToolCalls?.requireSuccessfulResults)
+                            dispatchedRequiredToolCalls.add(tc.name);
+                        const modelResult = (0, tool_friction_1.rewriteToolResultForModel)(tc.name, toolResult, toolFrictionLedger);
+                        pushGenerated({ role: "tool", tool_call_id: tc.id, content: modelResult });
+                        providerRuntime.appendToolOutput(tc.id, modelResult);
+                        if (!success)
+                            augmentedToolContext?.habitSession?.recordError?.(toolResult);
+                        const validatedRequiredResult = success && requiredToolCallNames.includes(tc.name) && options?.requiredToolCalls?.requireSuccessfulResults
+                            ? requiredToolResultSucceeded(tc.name, toolResult, args, options.requiredToolCalls.validateRequiredToolResult)
+                            : false;
+                        if (validatedRequiredResult) {
+                            dispatchedRequiredToolCalls.add(tc.name);
+                            for (const requiredName of options?.requiredToolCalls?.requiredToolCallsAfterResult?.(tc.name, args, toolResult) ?? []) {
+                                if (!candidateToolNames.has(requiredName)) {
+                                    (0, runtime_1.emitNervesEvent)({ level: "error", component: "engine", event: "engine.required_tool_unadvertised", message: "dependent required tool is not advertised for the active channel", meta: { toolName: requiredName, channel: String(channel) } });
+                                    throw new Error(`dependent required tool is not advertised for this channel: ${requiredName}`);
+                                }
+                                if (!requiredToolCallNames.includes(requiredName))
+                                    requiredToolCallNames.push(requiredName);
+                            }
+                        }
+                        if (success && currentEffectFingerprint && !toolResultIndicatesFailure(toolResult)) {
+                            unresolvedHistoricalEffects = unresolvedHistoricalEffects.filter((effect) => effect.fingerprint !== currentEffectFingerprint);
+                        }
+                        const resolvedRiskProfile = (0, tools_1.resolveToolDefinition)(tc.name, toolSelection)?.riskProfile;
+                        const toolRiskProfile = typeof resolvedRiskProfile === "function" ? resolvedRiskProfile(args) : resolvedRiskProfile;
+                        options?.toolBoundaryObserver?.({
+                            name: tc.name,
+                            reason: "dispatched",
+                            globallyResolvable: typeof (0, tools_1.resolveToolDefinition)(tc.name, toolSelection)?.handler === "function",
+                            invoked,
+                            sideEffect: success && toolRiskProfile?.mutates !== "none",
+                        });
+                        (0, tool_loop_1.recordToolOutcome)(toolLoopState, tc.name, args, modelResult, success);
+                        callbacks.onToolEnd(tc.name, (0, tools_1.buildToolResultSummary)(tc.name, args, modelResult, success, toolSelection), success);
+                        callbacks.onToolResult?.(messages);
                     }
-                    callbacks.onToolEnd(tc.name, argSummary, success);
-                    messages.push({ role: "tool", tool_call_id: tc.id, content: toolResult });
-                    providerRuntime.appendToolOutput(tc.id, toolResult);
                 }
             }
-        }
-        catch (e) {
-            // Abort is not an error — just stop cleanly
-            if (signal?.aborted) {
-                stripLastToolCalls(messages);
-                outcome = "aborted";
-                break;
-            }
-            // Context overflow: trim aggressively and retry once
-            if (isContextOverflow(e) && !overflowRetried) {
-                overflowRetried = true;
-                stripLastToolCalls(messages);
-                const { maxTokens, contextMargin } = (0, config_1.getContextConfig)();
-                const trimmed = (0, context_1.trimMessages)(messages, maxTokens, contextMargin, maxTokens * 2);
-                messages.splice(0, messages.length, ...trimmed);
-                providerRuntime.resetTurnState(messages);
-                callbacks.onError(new Error("context trimmed, retrying..."), "transient");
-                continue;
-            }
-            // Transient errors: retry with exponential backoff
-            if (isTransientError(e) && retryCount < MAX_RETRIES) {
-                retryCount++;
-                const delay = RETRY_BASE_MS * Math.pow(2, retryCount - 1);
-                const cause = classifyTransientError(e);
-                callbacks.onError(new Error(`${cause}, retrying in ${delay / 1000}s (${retryCount}/${MAX_RETRIES})...`), "transient");
-                // Wait with abort support
-                const aborted = await new Promise((resolve) => {
-                    const timer = setTimeout(() => resolve(false), delay);
-                    if (signal) {
-                        const onAbort = () => { clearTimeout(timer); resolve(true); };
-                        if (signal.aborted) {
-                            clearTimeout(timer);
-                            resolve(true);
-                            return;
-                        }
-                        signal.addEventListener("abort", onAbort, { once: true });
-                    }
-                });
-                if (aborted) {
-                    stripLastToolCalls(messages);
+            catch (e) {
+                // Abort is not an error — just stop cleanly
+                if (e instanceof provider_attempt_1.ProviderAttemptAbortError || signal?.aborted) {
+                    if (generatedMessages.length === 0)
+                        stripLastToolCalls(messages);
                     outcome = "aborted";
                     break;
                 }
-                providerRuntime.resetTurnState(messages);
-                continue;
+                const errorForClassification = e instanceof Error ? e : /* v8 ignore next -- defensive @preserve */ new Error(String(e));
+                let providerClassification;
+                try {
+                    providerClassification = providerRuntime.classifyError(errorForClassification);
+                }
+                catch {
+                    /* v8 ignore next -- defensive: classifyError should not throw @preserve */
+                    providerClassification = "unknown";
+                }
+                finishTerminalProviderError(errorForClassification, providerClassification);
             }
-            callbacks.onError(e instanceof Error ? e : new Error(String(e)), "terminal");
-            (0, runtime_1.emitNervesEvent)({
-                level: "error",
-                event: "engine.error",
-                trace_id: traceId,
-                component: "engine",
-                message: e instanceof Error ? e.message : String(e),
-                meta: {},
-            });
-            stripLastToolCalls(messages);
-            outcome = "errored";
-            done = true;
         }
     }
+    catch (error) {
+        if (!(error instanceof tools_1.ToolSelectionError))
+            throw error;
+        finishTerminalProviderError(error, "unknown");
+    }
+    finally {
+        nextAttemptControls = [];
+        rejectedAttempt = [];
+        providerRuntime.resetTurnState(messages);
+    }
+    options?.captureGeneratedMessages?.(structuredClone(generatedMessages));
     (0, runtime_1.emitNervesEvent)({
         event: "engine.turn_end",
         trace_id: traceId,
         component: "engine",
         message: "runAgent turn completed",
-        meta: { done, sawGoInward, sawQuerySession, sawBridgeManage },
+        meta: { done, sawPonder, sawQuerySession, sawBridgeManage },
     });
-    return { usage: lastUsage, outcome, completion };
+    return {
+        usage: lastUsage,
+        outcome,
+        completion,
+        ...(suspension ? { suspension } : {}),
+        ...(terminalError ? { error: terminalError, errorClassification: terminalErrorClassification } : {}),
+    };
 }