@paigy/mcp 0.40.11 → 0.40.15

package/dist/{chunk-H5GGWCPS.js → chunk-PHTQITTC.js}

@@ -7,16 +7,18 @@ import { homedir } from "os";
 import { join } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import { setTimeout as sleep2 } from "timers/promises";
+import { z as z4 } from "zod";
+import { z } from "zod";
 import { z as z3 } from "zod";
-import { z as z2 } from "zod";
 import { ZodFirstPartyTypeKind as ZodFirstPartyTypeKind3 } from "zod/v3";
 import { ZodFirstPartyTypeKind } from "zod/v3";
 import { ZodFirstPartyTypeKind as ZodFirstPartyTypeKind2 } from "zod/v3";
-import { z } from "zod";
+import { z as z2 } from "zod";
 import { randomUUID as randomUUID2 } from "crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync as readFileSync2, rmSync, statSync, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+import { execFileSync as execFileSync2 } from "child_process";
 import { randomUUID as randomUUID4 } from "crypto";
 import { WebSocket } from "undici";
 var require2 = __sdkCreateRequire(import.meta.url);
@@ -77,6 +79,9 @@ function isNetworkError(e) {
 async function reach(url, init) {
   return send(url, init, sessionId());
 }
+function reachAs(session) {
+  return (url, init) => send(url, init, session);
+}
 async function send(url, init, session) {
   try {
     const headers = {
@@ -1301,6 +1306,190 @@ var zodToJsonSchema = (schema, options) => {
 };
 var OPTIONS_MIN = 2;
 var OPTIONS_MAX = 6;
+var OptionSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  hint: z.string().max(500).describe("Optional short projection of consequence or action if this option is chosen (e.g. 'Reruns test suite', 'Merges to main').").optional(),
+  // .describe() flows into the MCP contact JSON schema (zodToJsonSchema), so
+  // the constraints below are what an agent reads when deciding to use these.
+  html: z.string().max(16384).describe(
+    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Rendered edge-to-edge in a responsive card that is 200pt tall (about 320pt wide on a phone, with the next option peeking beside it); make your HTML fit that viewport. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
+  ).optional(),
+  image: z.string().url().describe(
+    "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
+  ).optional()
+});
+var OptionInputSchema = OptionSchema.omit({ id: true }).extend({
+  label: z.string().trim().min(1).max(1e3)
+}).strict();
+function tzOffsetMinutes(tz, atMs) {
+  try {
+    const dtf = new Intl.DateTimeFormat("en-US", {
+      timeZone: tz,
+      hour12: false,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit"
+    });
+    const p = {};
+    for (const { type, value } of dtf.formatToParts(new Date(atMs))) p[type] = value;
+    const asUtc = Date.UTC(
+      Number(p["year"]),
+      Number(p["month"]) - 1,
+      Number(p["day"]),
+      Number(p["hour"]) === 24 ? 0 : Number(p["hour"]),
+      Number(p["minute"]),
+      Number(p["second"])
+    );
+    return Math.round((asUtc - atMs) / 6e4);
+  } catch {
+    return null;
+  }
+}
+function instantAt(tz, local) {
+  const naive = Date.UTC(local.y, local.mo - 1, local.d, local.h, local.mi, 0);
+  const first = tzOffsetMinutes(tz, naive);
+  if (first === null) return null;
+  const guess = naive - first * 6e4;
+  const second = tzOffsetMinutes(tz, guess);
+  return second === null ? guess : naive - second * 6e4;
+}
+function localDate(tz, atMs) {
+  const off = tzOffsetMinutes(tz, atMs);
+  if (off === null) return null;
+  const shifted = new Date(atMs + off * 6e4);
+  return {
+    y: shifted.getUTCFullYear(),
+    mo: shifted.getUTCMonth() + 1,
+    d: shifted.getUTCDate(),
+    h: shifted.getUTCHours(),
+    mi: shifted.getUTCMinutes()
+  };
+}
+var PARTS = {
+  earliest: { morning: 8, afternoon: 13, evening: 18, night: 20, noon: 12, midday: 12, lunch: 13 },
+  ring: { morning: 9, afternoon: 13, evening: 18, night: 20, noon: 12, midday: 12, lunch: 13 }
+};
+var END_OF_DAY = 17;
+var VAGUE = /\b(later|in a bit|in a while)\b/i;
+var TODAY_ONLY = /\b(tonight|this evening)\b/i;
+var RELATIVE = /\bin\s+(a\s+couple\s+of|a\s+few|a|an|one|two|three|four|five|six|seven|eight|nine|ten|fifteen|twenty|thirty|forty|forty[- ]five|half\s+an|\d{1,3})\s*(minute|minutes|min|mins|hour|hours|hr|hrs|day|days|week|weeks)\b/i;
+var WORD_NUM = {
+  a: 1,
+  an: 1,
+  one: 1,
+  two: 2,
+  three: 3,
+  four: 4,
+  five: 5,
+  six: 6,
+  seven: 7,
+  eight: 8,
+  nine: 9,
+  ten: 10,
+  fifteen: 15,
+  twenty: 20,
+  thirty: 30,
+  forty: 40,
+  "forty-five": 45,
+  "forty five": 45,
+  // Vague-but-real quantities the SDK's parser read and this one did not (#1367). "A few"
+  // is deliberately small and "a couple" is exactly two — a caller who says either has
+  // named a rough size, and rounding it away to null loses the request entirely.
+  "a couple of": 2,
+  "a few": 3
+};
+var CLOCK = /\b(?:at\s+)?(\d{1,2})(?::(\d{2}))?\s*(a\.?m\.?|p\.?m\.?|o'?clock)?\b/i;
+var SPOKEN_HOUR = {
+  one: 1,
+  two: 2,
+  three: 3,
+  four: 4,
+  five: 5,
+  six: 6,
+  seven: 7,
+  eight: 8,
+  nine: 9,
+  ten: 10,
+  eleven: 11,
+  twelve: 12
+};
+function parseWhen(said2, tz, nowMs, read = "earliest") {
+  const text = said2.trim();
+  if (!text) return null;
+  const rel = RELATIVE.exec(text);
+  if (rel) {
+    const rawN = rel[1].toLowerCase();
+    const half = /half/.test(rawN);
+    const n = half ? 0.5 : WORD_NUM[rawN] ?? Number(rawN);
+    if (Number.isFinite(n) && n > 0) {
+      const unit = rel[2].toLowerCase();
+      const ms = unit.startsWith("min") ? n * 6e4 : unit.startsWith("h") ? n * 36e5 : unit.startsWith("d") ? n * 864e5 : n * 7 * 864e5;
+      return new Date(nowMs + ms).toISOString();
+    }
+  }
+  const today = localDate(tz, nowMs);
+  if (!today) return null;
+  let dayShift = /\btomorrow\b/i.test(text) ? 1 : 0;
+  if (/\bnext week\b/i.test(text)) dayShift = 7;
+  let hour = null;
+  let minute = 0;
+  const spoken = new RegExp(`\\bat\\s+(${Object.keys(SPOKEN_HOUR).join("|")})\\b`, "i").exec(text);
+  const clock2 = CLOCK.exec(text);
+  if (spoken) {
+    hour = SPOKEN_HOUR[spoken[1].toLowerCase()];
+  } else if (clock2 && (clock2[3] || /\bat\s/i.test(clock2[0]))) {
+    hour = Number(clock2[1]);
+    minute = clock2[2] ? Number(clock2[2]) : 0;
+    if (hour > 23 || minute > 59) return null;
+  }
+  if (hour !== null) {
+    const mer = clock2?.[3]?.toLowerCase().replace(/\./g, "") ?? "";
+    const pmWord = /\b(p\.?m\.?|afternoon|evening|tonight|at night)\b/i.test(text);
+    const amWord = /\b(a\.?m\.?|morning)\b/i.test(text);
+    if (mer.startsWith("p") || pmWord && !amWord) {
+      if (hour < 12) hour += 12;
+    } else if (mer.startsWith("a") || amWord) {
+      if (hour === 12) hour = 0;
+    } else if (hour < 12 && dayShift === 0 && hour <= today.h) hour += 12;
+  } else {
+    const parts = PARTS[read];
+    const part = Object.keys(parts).find((k) => new RegExp(`\\b${k}\\b`, "i").test(text));
+    if (/\btonight\b/i.test(text)) hour = parts["night"];
+    else if (part) hour = parts[part];
+    else if (dayShift > 0) hour = 9;
+    else if (/\bend of (the )?day\b|\beod\b/i.test(text)) hour = END_OF_DAY;
+    else if (read === "ring" && VAGUE.test(text)) return new Date(nowMs + 30 * 6e4).toISOString();
+    else return null;
+  }
+  const at2 = instantAt(tz, {
+    y: today.y,
+    mo: today.mo,
+    d: today.d + dayShift,
+    h: hour,
+    mi: minute
+  });
+  if (at2 === null) return null;
+  if (at2 <= nowMs && dayShift === 0 && TODAY_ONLY.test(text)) {
+    return new Date(nowMs + 36e5).toISOString();
+  }
+  const rolled = at2 <= nowMs && dayShift === 0 ? instantAt(tz, {
+    y: today.y,
+    mo: today.mo,
+    d: today.d + 1,
+    h: hour,
+    mi: minute
+  }) : at2;
+  return new Date(rolled ?? at2).toISOString();
+}
+function parseDelay(said2, tz, nowMs, read = "earliest") {
+  const at2 = parseWhen(said2, tz, nowMs, read);
+  if (!at2) return null;
+  return Math.max(0, Math.round((Date.parse(at2) - nowMs) / 1e3));
+}
 var NIGHT = { from: 23, to: 7 };
 function draft2020(node) {
   if (Array.isArray(node)) return node.map(draft2020);
@@ -1331,39 +1520,30 @@ function mcpInputSchema(s) {
   delete schema.$schema;
   return draft2020(schema);
 }
-var AskInputSchema = z.object({
-  id: z.string().optional().describe("Optional idempotency key or client-side ID for this specific ask."),
-  parentId: z.string().uuid().optional().describe("The Goal this question is about \u2014 usually the one you are working on. The question goes onto that Goal and its answer comes back there. Omit it and Paigy places the question in the tree itself."),
-  repo: z.string().optional().describe("Optional repository context."),
-  ask: z.string().trim().min(1).max(1e4).describe(
-    "The question, and only what is needed to answer it. News, progress and findings are their own contact \u2014 a call contact JOINS a call already happening, so several arrive as one call. Do not bundle: a DecisionNeed is settled only by an answer in the shape this ask declares, so someone who answers the part that interested them settles nothing and is asked again."
+var AskInputSchema = z2.object({
+  id: z2.string().optional().describe("Optional idempotency key or client-side ID for this specific ask."),
+  parentId: z2.string().uuid().optional().describe("The Goal this question is about \u2014 usually the one you are working on. The question goes onto that Goal and its answer comes back there. Omit it and Paigy places the question in the tree itself."),
+  repo: z2.string().optional().describe("Optional repository context."),
+  ask: z2.string().trim().min(1).max(1e4).describe(
+    "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 parts of one piece of work under one Goal, separate things as separate Goals \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; a call contact JOINS a call already happening, so several arrive as one call."
   ),
-  options: z.array(z.object({
-    label: z.string().trim().min(1).max(1e3),
-    hint: z.string().trim().max(500).describe("Optional short projection of consequence or action if this option is chosen.").optional(),
-    image: z.string().url().optional(),
-    html: z.string().max(16384).describe("Optional sandboxed HTML/CSS preview. No JavaScript or network; inline CSS and data: URIs only. It renders edge-to-edge in a responsive card 200pt tall (about 320pt wide on a phone, with the next option peeking beside it), so fit the HTML to that viewport.").optional()
-  }).strict()).min(2).max(6).optional()
+  options: z2.array(OptionInputSchema).min(2).max(6).optional()
 }).strict();
-var StartContactSchema = z.object({
-  asks: z.array(AskInputSchema).min(1).describe("The list of asks/questions to pose. They will be semantically clustered by the API."),
-  waiting: z.enum(["none", "hard"]).default("none"),
-  channel: z.enum(["notification", "call"]).default("notification")
+var StartContactSchema = z2.object({
+  asks: z2.array(AskInputSchema).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
+  waiting: z2.enum(["none", "hard"]).default("none"),
+  channel: z2.enum(["notification", "call"]).default("notification")
 }).strict();
-var ContactSchema = z.union([StartContactSchema, z.object({ deliveryId: z.string().uuid() }).strict()]);
+var ContactSchema = z2.union([StartContactSchema, z2.object({ deliveryId: z2.string().uuid() }).strict()]);
 var CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. Never bundle multiple questions into a single 'ask' string; pass them as separate objects in the 'asks' array.";
-var CreateGoalSchema = z2.object({
-  outcome: z2.string().trim().min(1).max(1e4),
+var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read \u2014 parts of one piece of work under one Goal, separate things as separate Goals.";
+var CreateGoalSchema = z3.object({
+  outcome: z3.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
    *  rings"). Omit it and the brain writes one at admission from the outcome. */
-  title: z2.string().trim().min(1).max(80).optional(),
-  ownerParticipant: z2.string().trim().min(1).optional(),
-  idempotencyKey: z2.string().trim().min(1).max(200),
-  /** A past conversation this Goal should be read against — History's "new session from this"
-   *  (owner, on the call of 2026-09-14: "let's do the reference with the threading"). A
-   *  reference only: the owner reads it through `get_thread`, which does its own scoping, and
-   *  the writer refuses a thread belonging to another account. */
+  title: z3.string().trim().min(1).max(80).optional(),
+  ownerParticipant: z3.string().trim().min(1).optional(),
+  idempotencyKey: z3.string().trim().min(1).max(200),
   /** THE GOAL THIS ONE BELONGS UNDER (owner, 2026-09-15: "the ask I gave for the design doc
    *  didn't get created as a child goal of the voice UI goal, which is how it should've
    *  worked"). It could not have been: this door took no parent, so the only route was
@@ -1371,55 +1551,45 @@ var CreateGoalSchema = z2.object({
    *  took the short one. The hierarchy has been modelled since Goals existed and had been used
    *  ZERO times in 2,031 of them. Absent, the server judges it against the caller's open Goals
    *  (`apps/api/src/goal/intake.ts`). The writer refuses a Goal belonging to another account. */
-  parentGoalId: z2.string().uuid().optional(),
+  parentGoalId: z3.string().uuid().optional(),
   /** The repository or project identifier this Goal belongs to (#2280) — e.g. "owner/repo" or
    *  repo name. Delegated work inherits this from its parent Goal when omitted. */
-  repo: z2.string().trim().min(1).max(200).optional()
+  repo: z3.string().trim().min(1).max(200).optional()
 });
 var CreateGoalToolSchema = CreateGoalSchema.extend({
   idempotencyKey: CreateGoalSchema.shape.idempotencyKey.optional().describe("Optional. One is minted per call; pass your own only so a retry lands on the same Goal.")
 }).strict();
 var CREATE_GOAL_DESCRIPTION = 'Create a durable Goal for an outcome. Without parentGoalId it is placed against your open Goals: if one already IS this work, that Goal comes back (existing: true) and nothing new is created \u2014 continue it; if the work belongs under one, it is created there (parentGoalId in the receipt); otherwise it is a root. Pass parentGoalId yourself to put it under a specific Goal. Pass repo to anchor the work to a specific repository ("owner/repo" or repo name); delegated children inherit it. Pass title to name it in one to five words, as a person would refer to it out loud ("the night rings") \u2014 it heads every list and is spoken on a call; without one the brain writes it. Admission only: the owner must claim it before doing work, then update it as it advances. Returns an admission receipt with goalId, current state, revision, ownerParticipant, and the next step; no Goal content or execution lease.';
-var UpdateGoalSchema = z2.object({
-  revision: z2.number().int().positive(),
-  changes: z2.object({
-    outcome: z2.string().trim().min(1).max(1e4).optional(),
+var UpdateGoalSchema = z3.object({
+  revision: z3.number().int().positive(),
+  changes: z3.object({
+    outcome: z3.string().trim().min(1).max(1e4).optional(),
     /** The work's NAME (#2115) — one to five words, how a person refers to it out loud. The
      *  brain writes one at admission; this is the owner saying it better. Null clears it. */
-    title: z2.string().trim().min(1).max(80).nullable().optional(),
-    ownerParticipant: z2.string().trim().min(1).optional(),
-    parentGoalId: z2.string().uuid().nullable().optional(),
-    dependencies: z2.array(z2.object({ goalId: z2.string().uuid(), gate: z2.enum(["start", "finish"]) }).strict()).optional(),
-    children: z2.array(z2.object({ outcome: z2.string().trim().min(1).max(1e4), ownerParticipant: z2.string().trim().min(1), gate: z2.enum(["start", "finish"]).optional() }).strict()).optional(),
-    state: z2.enum(["active", "done", "cancelled"]).optional(),
-    progress: z2.string().trim().min(1).max(1e4).optional(),
-    reviewed: z2.literal(true).optional(),
-    dueAt: z2.string().datetime({ offset: true }).nullable().optional()
+    title: z3.string().trim().min(1).max(80).nullable().optional(),
+    ownerParticipant: z3.string().trim().min(1).optional(),
+    parentGoalId: z3.string().uuid().nullable().optional(),
+    dependencies: z3.array(z3.object({ goalId: z3.string().uuid(), gate: z3.enum(["start", "finish"]) }).strict()).optional(),
+    children: z3.array(z3.object({ outcome: z3.string().trim().min(1).max(1e4), ownerParticipant: z3.string().trim().min(1), gate: z3.enum(["start", "finish"]).optional() }).strict()).optional(),
+    state: z3.enum(["active", "done", "cancelled"]).optional(),
+    progress: z3.string().trim().min(1).max(1e4).optional(),
+    reviewed: z3.literal(true).optional(),
+    dueAt: z3.string().datetime({ offset: true }).nullable().optional()
   }).strict().refine((v) => Object.keys(v).length > 0),
-  reason: z2.string().trim().min(1).max(2e3),
-  operationId: z2.string().uuid().optional()
+  reason: z3.string().trim().min(1).max(2e3),
+  operationId: z3.string().uuid().optional()
 }).strict();
-var UpdateGoalToolSchema = UpdateGoalSchema.omit({ operationId: true }).extend({ goalId: z2.string().uuid() }).strict();
-var ClaimGoalSchema = z2.object({ goalId: z2.string().uuid().optional() }).strict();
-var GetGoalSchema = z2.object({ goalId: z2.string().uuid() }).strict();
+var UpdateGoalToolSchema = UpdateGoalSchema.omit({ operationId: true }).extend({ goalId: z3.string().uuid() }).strict();
+var ClaimGoalSchema = z3.object({ goalId: z3.string().uuid().optional() }).strict();
+var GetGoalSchema = z3.object({ goalId: z3.string().uuid() }).strict();
 var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), and `next`, the one step to take. Foreign or sibling-owned Goals are not disclosed.";
 var UPDATE_GOAL_DESCRIPTION = "Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. Returns the Goal as get_goal reads it, at its new revision.";
-var CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
+var CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
 var CHECK_REPLIES_DESCRIPTION = "Your open Deliveries: every Notification or Call currently addressed to you \u2014 a request the user started toward you, an answer relayed to something you asked, a handoff \u2014 one row each: its Goals, how many decisions are still open, and the newest words in brief. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread it in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true closes the Deliveries addressed to you on that Goal. Your runnable and review-pending Goals come from claim_goal, not from here.";
-var CheckRepliesSchema = z2.object({}).strict();
-var GetThreadSchema = z2.object({
-  parentId: z2.string().describe("The Thread to read \u2014 the parentId of a search_threads hit.")
-}).strict();
-var GET_THREAD_DESCRIPTION = "Read the authorized durable Entries on one conversation Thread \u2014 what you wrote there and what was delivered to you, oldest first. Use claim_goal to find the work to resume and get_goal for the conversation on a Goal; use this only to rehydrate a Thread that a search hit named.";
-var SearchThreadsSchema = z2.object({
-  q: z2.string().describe("What to look for \u2014 plain words or a phrase (e.g. 'the livekit timeout', 'deploy to prod').")
-}).strict();
-var SEARCH_THREADS_DESCRIPTION = `Search your PAST conversations before asking \u2014 "have we discussed this before?". Full-text over your own threads (the asks you sent + the user's answers); returns ranked threads with highlighted snippets, NOT rows: { hits: [{ parentId, at, agentLabel, matches: [{ notificationId, role, snippet }] }] }. The loop this exists for: search first \u2192 get_thread the best hit to rehydrate it \u2192 THEN continue or contact, so you answer with receipts ("last week you said ship it") instead of re-asking. Read-only, safe to call anytime; scoped to your own account's threads.`;
+var CheckRepliesSchema = z3.object({}).strict();
 var AGENT_TOOLS = [
   { name: "contact", description: CONTACT_DESCRIPTION, inputSchema: CONTACT_SCHEMA },
   { name: "check_replies", description: CHECK_REPLIES_DESCRIPTION, inputSchema: mcpInputSchema(CheckRepliesSchema) },
-  { name: "get_thread", description: GET_THREAD_DESCRIPTION, inputSchema: mcpInputSchema(GetThreadSchema) },
-  { name: "search_threads", description: SEARCH_THREADS_DESCRIPTION, inputSchema: mcpInputSchema(SearchThreadsSchema) },
   { name: "create_goal", description: CREATE_GOAL_DESCRIPTION, inputSchema: mcpInputSchema(CreateGoalToolSchema) },
   { name: "claim_goal", description: CLAIM_GOAL_DESCRIPTION, inputSchema: mcpInputSchema(ClaimGoalSchema) },
   { name: "get_goal", description: GET_GOAL_DESCRIPTION, inputSchema: mcpInputSchema(GetGoalSchema) },
@@ -1442,17 +1612,17 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS = 3 * 6e4;
-var ContextSchema = z3.object({
-  title: z3.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
-  description: z3.array(z3.string().min(1)).describe(
+var ContextSchema = z4.object({
+  title: z4.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
+  description: z4.array(z4.string().min(1)).describe(
     "Semantic chunks of detail (each a standalone, non-empty piece). The user can select chunks to ask you to expand. MAY BE EMPTY: a claim whose whole content is its heading \u2014 a single sentence \u2014 has no body, and saying so beats repeating the heading underneath itself. That repeat is what `min(1)` used to force, at 2x the storage, with every reader subtracting it back out at render time."
   )
 });
-var ParticipantSchema = z3.object({
-  kind: z3.enum(["human", "agent"]),
-  id: z3.string()
+var ParticipantSchema = z4.object({
+  kind: z4.enum(["human", "agent"]),
+  id: z4.string()
 });
-var TransformSchema = z3.enum([
+var TransformSchema = z4.enum([
   "structure",
   // shape intent into an answer contract; pick channel/urgency — broker `ask`, `select` shapes, `points`
   "request_more",
@@ -1468,26 +1638,13 @@ var TransformSchema = z3.enum([
   "summarize"
   // reduce volume, keep decision value — 30-turn cap, spoken briefing
 ]);
-var OptionSchema = z3.object({
-  id: z3.string(),
-  label: z3.string(),
-  hint: z3.string().max(500).describe("Optional short projection of consequence or action if this option is chosen (e.g. 'Reruns test suite', 'Merges to main').").optional(),
-  // .describe() flows into the MCP contact JSON schema (zodToJsonSchema), so
-  // the constraints below are what an agent reads when deciding to use these.
-  html: z3.string().max(16384).describe(
-    "Optional sandboxed HTML/CSS preview for a visual 'pick one' (shown in the option card). Untrusted-sandboxed: NO JavaScript, NO external network or images \u2014 inline CSS and data: URIs only; <=16KB. Rendered edge-to-edge in a responsive card that is 200pt tall (about 320pt wide on a phone, with the next option peeking beside it); make your HTML fit that viewport. Use for layout/CSS mockups, tables, diffs. For a hosted image use `image` instead."
-  ).optional(),
-  image: z3.string().url().describe(
-    "Optional image URL rendered as the option's preview (plain image, not sandboxed). For agent-generated HTML/CSS mockups, use `html` instead."
-  ).optional()
+var VisualSchema = z4.object({
+  url: z4.string().url(),
+  label: z4.string().optional()
 });
-var VisualSchema = z3.object({
-  url: z3.string().url(),
-  label: z3.string().optional()
-});
-var NotifyLevelSchema = z3.enum(["inbox", "push", "banner", "call"]);
-var SelectShapeSchema = z3.enum(["one", "many", "rank", "confirm", "text"]);
-var ReceiptEventSchema = z3.enum([
+var NotifyLevelSchema = z4.enum(["inbox", "push", "banner", "call"]);
+var SelectShapeSchema = z4.enum(["one", "many", "rank", "confirm", "text"]);
+var ReceiptEventSchema = z4.enum([
   "delivered",
   // the bundle reached the recipient at some level
   "seen",
@@ -1517,47 +1674,47 @@ var ReceiptEventSchema = z3.enum([
   // be rewound by a writer that forgot to advance it.
   "restarted"
 ]);
-var AttentionSchema = z3.object({
+var AttentionSchema = z4.object({
   urgency: NotifyLevelSchema,
   /** The required answer shape, or null for a plain notify that asks nothing back. */
   select: SelectShapeSchema.nullable(),
   /** Coverage contract (#396) — points the answer must address; null = none declared. */
-  points: z3.array(z3.string()).nullable(),
+  points: z4.array(z4.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
-  blocking: z3.boolean(),
+  blocking: z4.boolean(),
   /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
-  deadline: z3.string().datetime().nullable().optional()
+  deadline: z4.string().datetime().nullable().optional()
 });
-var NotifyRequestFields = z3.object({
+var NotifyRequestFields = z4.object({
   /** Plaintext message content. Present on the plaintext path (today's shape);
    *  ABSENT on the E2EE path, where the sealed `envelope` below carries it. The
    *  superRefine at the bottom enforces exactly one of the two. */
   context: ContextSchema.optional(),
-  options: z3.array(OptionSchema.omit({ id: true })).min(OPTIONS_MIN).max(OPTIONS_MAX).optional().describe(
+  options: z4.array(OptionInputSchema).min(OPTIONS_MIN).max(OPTIONS_MAX).optional().describe(
     "The choices, in order \u2014 required when select is 'one'/'many'/'rank', omitted otherwise. Ids are assigned automatically by position ('1', '2', \u2026); the user's answer references them as optionId(s)."
   ),
-  points: z3.array(z3.string().min(1)).optional().describe(
+  points: z4.array(z4.string().min(1)).optional().describe(
     "The distinct things you need answered, each a short phrase \u2014 on a call the broker keeps the conversation going until each is addressed, and the reply reports which were covered, so a half-answer is never silently returned as final. Omit for single-part asks."
   ),
-  visuals: z3.array(VisualSchema).optional().describe(
+  visuals: z4.array(VisualSchema).optional().describe(
     "Images attached to the message itself \u2014 context for the whole question (a screenshot, a chart). For a preview on one selectable choice, use that option's `html`/`image` instead."
   ),
   /** Git repo the agent is working in ("owner/name"). Local MCP fills this from the checkout — omit unless overriding. */
-  repo: z3.string().optional(),
+  repo: z4.string().optional(),
   /** Git branch the agent is on. Local MCP fills this from the checkout — omit unless overriding. */
-  branch: z3.string().optional(),
+  branch: z4.string().optional(),
   /** Continue an existing conversation — the id of any notification in it (its root
    *  is the conversation's identity). Omitted = start a new conversation. Renamed
    *  from `parentId` (2026-08-03): one linkage system, the parent; the API edge
    *  still accepts the old name from older clients. */
-  parentId: z3.string().uuid().optional(),
+  parentId: z4.string().uuid().optional(),
   /** The durable outcome this contact advances. Optional during the notification-to-Work
    *  migration; when present, a blocking ask creates a DecisionNeed for this Work. */
-  workId: z3.string().uuid().optional(),
+  workId: z4.string().uuid().optional(),
   /** Target Goal scope. During staged migration this is accepted by the shared contract but
    * target delivery activation remains model-gated; workId and goalId are mutually exclusive. */
-  goalId: z3.string().uuid().optional(),
+  goalId: z4.string().uuid().optional(),
   urgency: NotifyLevelSchema.default("inbox").describe(
     "The level you're requesting \u2014 the user's account permissions + session mode can lower it. 'inbox' (default) = sits silently in the inbox for the user to get to. 'push' = a quiet passive push (lands in Notification Center, no sound) \u2014 a gentle heads-up. 'banner' = a time-sensitive banner/lock-screen push with sound (a 'paige') they tap to open \u2014 use when you need them soon-ish but it's not worth ringing them. 'call' = rings the user's phone now (a CallKit voice call) \u2014 use only when you genuinely need them in the moment (blocked and waiting, time-sensitive). context.title is what they see on the banner/ring, so make it specific."
   ),
@@ -1565,7 +1722,7 @@ var NotifyRequestFields = z3.object({
    *  visible and marks it needs_input. Renamed from the old `parentId` (2026-08-03)
    *  when `parentId` became the conversation handle: `parentId` says WHERE, this
    *  says HOW. */
-  clarifies: z3.string().optional(),
+  clarifies: z4.string().optional(),
   select: SelectShapeSchema.optional().describe(
     "How the user answers \u2014 required on the fully-shaped form, pick the shape that fits the question: 'one' = pick one option, 'many' = pick several, 'rank' = pick & order (each needs `options`); 'confirm' = yes/no or approve/deny; 'text' = free-form reply only (status updates, open questions). 'confirm' and 'text' take no options. Omit only when sending the simplified `ask` form \u2014 the broker picks the shape."
   ),
@@ -1579,20 +1736,20 @@ var NotifyRequestFields = z3.object({
   // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
-  ask: z3.string().min(1).max(1e4).optional().describe(
+  ask: z4.string().min(1).max(1e4).optional().describe(
     'SIMPLIFIED FORM \u2014 state in plain prose what you need to learn from the user and why it matters now (e.g. "I need to know whether to deploy the auth fix \u2014 tests are green, staging verified"). Write as much as the situation needs (up to 10k characters) \u2014 Paigy breaks it into topics and reads it back a few sentences at a time; do NOT pre-summarize it into one line. Paigy derives the title, answer shape, options, and delivery channel for you. Mutually exclusive with context/select/options \u2014 send one form or the other.'
   ),
-  needs: z3.array(z3.string().min(1)).optional().describe(
+  needs: z4.array(z4.string().min(1)).optional().describe(
     "With `ask` only: the distinct things you need answered when the ask is multi-part \u2014 becomes the coverage contract (`points`), so a half-answer is never silently final."
   ),
-  urgencyHint: z3.enum(["whenever", "soon", "now"]).optional().describe(
+  urgencyHint: z4.enum(["whenever", "soon", "now"]).optional().describe(
     "With `ask` only: how urgently you need the answer \u2014 'whenever' (inbox), 'soon' (worth a heads-up), 'now' (you're blocked this minute). A hint, not a command: the user's settings still have the final word."
   ),
   /** #575: the ONE self-report that replaces urgencyHint + blocking — what happens
    *  to the agent's work while it waits. Normalized server-side into those two
    *  fields (normalizeWaiting) so everything downstream is untouched; explicit
    *  urgencyHint/blocking win when both are sent. */
-  waiting: z3.enum(["none", "soft", "hard"]).optional().describe(
+  waiting: z4.enum(["none", "soft", "hard"]).optional().describe(
     "With `ask`: what happens to your work while you wait. 'none' = you're just informing the user. 'soft' = you'd like an answer but can keep working. 'hard' = you are stopped until they answer (reaches them urgently and escalates to a real phone call if unanswered). Replaces urgencyHint + blocking \u2014 send this one field."
   ),
   /** Δ9b (#895): HOLD this claim so the sender can correct the plan before anyone is
@@ -1600,98 +1757,98 @@ var NotifyRequestFields = z3.object({
    *  holding by default would charge every quiet claim that minute before any agent could
    *  correct anything. Ignored for `waiting: 'hard'`: a blocking ask rings on what we have,
    *  and the enrichment can still land mid-call (#781 re-plans the unspoken tail). */
-  confirm: z3.boolean().optional().describe(
+  confirm: z4.boolean().optional().describe(
     "Hold this one so you can correct the plan before the user is interrupted. The response comes back with `held: true` and the plan; POST the confirm route to release it (with options/visuals/urgency corrections, or nothing at all). If you never do, it is announced anyway a couple of minutes later. Ignored when waiting is 'hard'."
   ),
   /** #575: a RELAY of the user's explicitly stated preference, never the agent's
    *  choice. Outranks waiting in both directions: 'call' rings even for a
    *  waiting:'none' "call me when it's done"; 'message' never rings even for
    *  waiting:'hard'. */
-  channel: z3.enum(["call", "message"]).optional().describe(
+  channel: z4.enum(["call", "message"]).optional().describe(
     "Only if the user explicitly said how to reach them \u2014 'call me' \u2192 'call', 'just message/text me' \u2192 'message'. Omit otherwise; Paigy picks."
   ),
-  confirmStyle: z3.enum(["yesno", "approve"]).default("yesno").describe(
+  confirmStyle: z4.enum(["yesno", "approve"]).default("yesno").describe(
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
-  blocking: z3.boolean().default(false).describe(
+  blocking: z4.boolean().default(false).describe(
     "Set true when real downstream work is stuck behind this specific decision \u2014 you can't make meaningful progress until it's answered. This is the real signal for how urgently the user should be reached; it's what the premier use case (an agent that stays unblocked instead of going idle) depends on. Independent of `urgency`: a `banner`-level question can still be `blocking` (something IS stuck, just not time-critical enough to ring for immediately) \u2014 if it goes unanswered a while, Paigy escalates it to a real call using this flag rather than guessing from how many other things happen to be pending. Leave false for anything you could work around, defer, or where other useful work exists meanwhile."
   )
 });
 var NotifyRequestSchema = NotifyRequestFields.superRefine((r, ctx) => {
-  if (r.workId && r.goalId) ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["goalId"], message: "pass goalId or workId, not both" });
+  if (r.workId && r.goalId) ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["goalId"], message: "pass goalId or workId, not both" });
   if (r.ask !== void 0) {
     for (const f of ["context", "select", "points"]) {
       if (r[f] !== void 0)
-        ctx.addIssue({ code: z3.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives the answer shape from your prose. Drop ${f} and say it in \`ask\` instead ("should I\u2026" for approve/deny, "which of these\u2026" for a pick), passing \`options\` when you're offering concrete alternatives.` });
+        ctx.addIssue({ code: z4.ZodIssueCode.custom, path: [f], message: `the simplified \`ask\` form takes no ${f} \u2014 the broker derives the answer shape from your prose. Drop ${f} and say it in \`ask\` instead ("should I\u2026" for approve/deny, "which of these\u2026" for a pick), passing \`options\` when you're offering concrete alternatives.` });
     }
     return;
   }
   if (r.needs !== void 0 || r.urgencyHint !== void 0)
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["needs"], message: "needs/urgencyHint belong to the simplified `ask` form \u2014 with a shaped request use points/urgency" });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["needs"], message: "needs/urgencyHint belong to the simplified `ask` form \u2014 with a shaped request use points/urgency" });
   if (!r.context)
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["context"], message: "context is required (plaintext path)" });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["context"], message: "context is required (plaintext path)" });
   if (!r.select)
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["select"], message: "select is required on the shaped form" });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["select"], message: "select is required on the shaped form" });
   const needsOptions = r.select === "one" || r.select === "many" || r.select === "rank";
   if (needsOptions && !r.options?.length)
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' requires options` });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' requires options` });
   if (!needsOptions && r.options?.length)
-    ctx.addIssue({ code: z3.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' takes no options` });
+    ctx.addIssue({ code: z4.ZodIssueCode.custom, path: ["options"], message: `select:'${r.select}' takes no options` });
 });
-var NotifyStatusSchema = z3.enum(["pending", "answered", "ignored"]);
-var AgentStateSchema = z3.enum(["idle", "in_progress", "completed", "needs_input"]);
-var TurnSchema = z3.object({
-  prompt: z3.string(),
-  reply: z3.string()
+var NotifyStatusSchema = z4.enum(["pending", "answered", "ignored"]);
+var AgentStateSchema = z4.enum(["idle", "in_progress", "completed", "needs_input"]);
+var TurnSchema = z4.object({
+  prompt: z4.string(),
+  reply: z4.string()
 });
-var UserAnswerSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("option"), optionId: z3.string(), label: z3.string().optional() }),
-  z3.object({ kind: z3.literal("text"), text: z3.string() }),
-  z3.object({ kind: z3.literal("ignored") }),
-  z3.object({ kind: z3.literal("multi"), optionIds: z3.array(z3.string()), labels: z3.array(z3.string()).optional() }),
-  z3.object({ kind: z3.literal("ranked"), optionIds: z3.array(z3.string()), labels: z3.array(z3.string()).optional() }),
-  z3.object({ kind: z3.literal("clarify"), chunks: z3.array(z3.string()).min(1) }),
-  z3.object({ kind: z3.literal("confirm"), approved: z3.boolean() }),
-  z3.object({ kind: z3.literal("turns"), turns: z3.array(TurnSchema).min(1) }),
+var UserAnswerSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("option"), optionId: z4.string(), label: z4.string().optional() }),
+  z4.object({ kind: z4.literal("text"), text: z4.string() }),
+  z4.object({ kind: z4.literal("ignored") }),
+  z4.object({ kind: z4.literal("multi"), optionIds: z4.array(z4.string()), labels: z4.array(z4.string()).optional() }),
+  z4.object({ kind: z4.literal("ranked"), optionIds: z4.array(z4.string()), labels: z4.array(z4.string()).optional() }),
+  z4.object({ kind: z4.literal("clarify"), chunks: z4.array(z4.string()).min(1) }),
+  z4.object({ kind: z4.literal("confirm"), approved: z4.boolean() }),
+  z4.object({ kind: z4.literal("turns"), turns: z4.array(TurnSchema).min(1) }),
   /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
-  z3.object({ kind: z3.literal("precedent"), answer: z3.string(), derivation: z3.string(), sources: z3.array(z3.string()).min(1) })
+  z4.object({ kind: z4.literal("precedent"), answer: z4.string(), derivation: z4.string(), sources: z4.array(z4.string()).min(1) })
 ]);
-var IntentSchema = z3.object({
+var IntentSchema = z4.object({
   // The full vocabulary the bot's mapper emits (mapper.INTENT_KINDS) — the schema lagged
   // it by two ("detail", "feedback"), and because the settle handler parsed the array
   // all-or-nothing, ONE feedback act silently dropped EVERY intent on the call,
   // questions included. Found auditing five calls' stored feedback, 2026-08-01.
-  kind: z3.enum(["defer", "delegate", "channel", "question", "detail", "feedback", "command", "control"]),
-  detail: z3.string(),
+  kind: z4.enum(["defer", "delegate", "channel", "question", "detail", "feedback", "command", "control"]),
+  detail: z4.string(),
   /** Defer only: seconds until the callback the caller asked for, when something upstream
    *  already read the time. Nothing sets it today (#397 documented an MCP parser that was
    *  never written) — the API reads the defer's `detail` itself with `notes/when.ts`
    *  (`parseDelay`, #1292), and a value here simply wins over that reading. */
-  dueInSeconds: z3.number().int().positive().optional(),
+  dueInSeconds: z4.number().int().positive().optional(),
   /** Feedback only (#812): WHICH failure the complaint names — typed by the mapper that
    *  already read the utterance, so `feedback_from_call.kind` stops defaulting to
    *  'other' on every row. A table that records that something was wrong and nothing
    *  about what cannot answer "is the bot looping less this week?". */
-  fault: z3.enum(["loop", "unanswered", "overridden", "misheard", "slow", "other"]).optional()
+  fault: z4.enum(["loop", "unanswered", "overridden", "misheard", "slow", "other"]).optional()
 });
-var RideAlongSchema = z3.object({
+var RideAlongSchema = z4.object({
   /** The note this came from — assign/clarify/close it through /api/notes/:id. */
-  noteId: z3.string(),
+  noteId: z4.string(),
   /** What to do, in the owner's own words (the note's headline). Never model-rewritten. */
-  text: z3.string(),
+  text: z4.string(),
   /** The thread to report back on, when the note was dispatched over the request rail. */
-  parentId: z3.string().nullable()
+  parentId: z4.string().nullable()
 });
-var AwaitItemSchema = z3.discriminatedUnion("type", [
-  z3.object({
-    type: z3.literal("reply"),
-    parentId: z3.string(),
-    notificationId: z3.string(),
-    workId: z3.string().uuid().optional(),
-    decisionId: z3.string().uuid().optional(),
+var AwaitItemSchema = z4.discriminatedUnion("type", [
+  z4.object({
+    type: z4.literal("reply"),
+    parentId: z4.string(),
+    notificationId: z4.string(),
+    workId: z4.string().uuid().optional(),
+    decisionId: z4.string().uuid().optional(),
     answer: UserAnswerSchema,
     /** WHAT THE AGENT CANNOT KNOW FROM THE FIELDS BESIDE IT (owner, 2026-09-04, issue
      *  #1537). One line, built from the record: the ask and the caller's reply VERBATIM,
@@ -1701,161 +1858,131 @@ var AwaitItemSchema = z3.discriminatedUnion("type", [
      *  "call me back after you merge" in their own words decides for itself what to do,
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
-    note: z3.string().optional(),
+    note: z4.string().optional(),
     /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
-    transcript: z3.string().optional(),
+    transcript: z4.string().optional(),
     /** Coverage report (#396), when the ask declared `points`: which of them this
      *  answer addressed. Missing points = re-ask or proceed knowingly partial. */
-    covered: z3.array(z3.string()).optional(),
+    covered: z4.array(z4.string()).optional(),
     /** Ride-alongs (RideAlongSchema) — pending work for you, attached to the moment you
      *  became free. Only `reply` and `idle` carry it: those are the two outcomes that
      *  END a wait. `remind`, `superseded` and `turn` are mid-flight, and handing an
      *  agent a side-quest while it is still holding the line is how the main thing gets
      *  dropped. Absent/empty = nothing owed. */
-    also: z3.array(RideAlongSchema).optional()
+    also: z4.array(RideAlongSchema).optional()
   }),
-  z3.object({
-    type: z3.literal("remind"),
-    parentId: z3.string(),
-    notificationId: z3.string(),
-    remindAt: z3.string().datetime({ offset: true }),
+  z4.object({
+    type: z4.literal("remind"),
+    parentId: z4.string(),
+    notificationId: z4.string(),
+    remindAt: z4.string().datetime({ offset: true }),
     /** Seconds until remindAt, server-computed — pass straight to ScheduleWakeup. */
-    remindInSeconds: z3.number()
+    remindInSeconds: z4.number()
   }),
   /** The awaited ask was REPLACED by a newer notification on its thread (e.g. a
    *  post-feedback revision, #633) — the user will never answer this id. Stop
    *  awaiting it; the live ask is the thread's newest turn (await that one, or
-   *  re-orient via get_thread / check_replies). */
-  z3.object({
-    type: z3.literal("superseded"),
-    parentId: z3.string(),
-    notificationId: z3.string()
+   *  re-orient via check_replies). */
+  z4.object({
+    type: z4.literal("superseded"),
+    parentId: z4.string(),
+    notificationId: z4.string()
   }),
   /** A LIVE call's turn, streamed as it lands (#783). PROVISIONAL: the user can still
    *  revise any of these until the final reply arrives — partial = intelligence,
    *  settled = authorization. Use it to PREPARE (fetch, draft, warm), never to act
    *  irreversibly. If `acts` carries a question aimed at you and you know the answer,
    *  contact on the same thread right away — the caller hears it on the same call. */
-  z3.object({
-    type: z3.literal("partial"),
-    notificationId: z3.string(),
-    inFlight: z3.literal(true),
-    turn: z3.object({
-      idx: z3.number(),
-      prompt: z3.string(),
-      reply: z3.string(),
-      acts: z3.array(IntentSchema).nullable().optional()
+  z4.object({
+    type: z4.literal("partial"),
+    notificationId: z4.string(),
+    inFlight: z4.literal(true),
+    turn: z4.object({
+      idx: z4.number(),
+      prompt: z4.string(),
+      reply: z4.string(),
+      acts: z4.array(IntentSchema).nullable().optional()
     })
   }),
-  z3.object({
-    type: z3.literal("idle"),
-    also: z3.array(RideAlongSchema).optional(),
+  z4.object({
+    type: z4.literal("idle"),
+    also: z4.array(RideAlongSchema).optional(),
     /** Is a call live for this agent's user right now? The SDK polls the partial stream
      *  (#783) between idle ticks ONLY while this is not `false` — a partial can only exist
      *  during a live call, and polling for one on a banner/message was a wasted HTTP call +
      *  3 queries on every idle tick of every waiting agent (~80% of all traffic at scale).
      *  Absent = an older API → the SDK keeps polling, exactly as before. */
-    inFlight: z3.boolean().optional()
+    inFlight: z4.boolean().optional()
   })
 ]);
-var VoiceKeySchema = z3.enum(["rachel", "george", "jessica", "brian", "lily"]);
-var AgendaTurnSchema = z3.object({
+var VoiceKeySchema = z4.enum(["rachel", "george", "jessica", "brian", "lily"]);
+var AgendaTurnSchema = z4.object({
   /** THE TURN'S IDENTITY (the first-sentence stream, 2026-09-09): the brain call that wrote
    *  it and its place in that reply — `<brainCallId>:<index>`, with `:p` on the first
    *  sentence a re-plan publishes ahead of the rest. A turn is spoken once, by this id: the
    *  completion of a streamed re-plan carries the published sentence again, and the walk
    *  drops what it already said by identity, never by the API's guess of what was polled.
    *  Absent on plans nothing streams (a ring plan, a floor). */
-  id: z3.string().optional(),
+  id: z4.string().optional(),
   /** Twin coverage (#1089): sibling claim ids this asking turn's answer ALSO settles —
    *  the planner declares duplicates instead of asking them twice. */
-  coveredIds: z3.array(z3.string()).optional(),
+  coveredIds: z4.array(z4.string()).optional(),
   /** At most three short spoken sentences. Capped because a turn is a breath: a 1031-char
    *  line went out on 2026-07-28 and the caller could not answer it at all. */
-  info: z3.array(z3.string().min(1)).max(3).default([]),
-  question: z3.string().min(1).nullable(),
+  info: z4.array(z4.string().min(1)).max(3).default([]),
+  question: z4.string().min(1).nullable(),
   /** True on the one turn carrying the agent's own declared question. */
-  asks: z3.boolean().optional(),
+  asks: z4.boolean().optional(),
   /** The claim this turn belongs to (#781) — the RETURN identity: answers route by it.
    *  Absent on a single-claim plan (the session's own claim) and on shared context turns,
    *  which route nothing. */
-  claimId: z3.string().optional(),
+  claimId: z4.string().optional(),
   /** The claim's voice key (#462) — the OUTBOUND identity, audible who-is-asking. */
-  voice: z3.string().optional(),
+  voice: z4.string().optional(),
   /** The claim's AGENT NAME (#838) — the spoken identity. A voice alone doesn't say
    *  whose request this is: an item that folded in from another agent arrived as a bare
    *  non-sequitur ("First real production sign-in is yours to make whenever you want.")
    *  and the owner answered "What?". The bot names the agent before its first turn. */
-  agent: z3.string().optional(),
+  agent: z4.string().optional(),
   /** The claim's agent by ID — the pairing's connection id (`notifications.token_id`), the
    *  same id a face is minted from. A name is not an identity: two pairings may be called
    *  "Claude", and a name cannot be joined on. The record's entries carry it (`agent_id`)
    *  so "who said that" survives the call, and it rides PER TURN because a coalesced call
    *  speaks for several agents — the turn is the only place that knows which. */
-  agentId: z3.string().optional(),
+  agentId: z4.string().optional(),
   select: SelectShapeSchema.optional(),
-  options: z3.array(OptionSchema.omit({ id: true })).optional(),
+  options: z4.array(OptionSchema.omit({ id: true })).optional(),
   /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
    *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
    *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: z3.number().positive().optional(),
+  pace: z4.number().positive().optional(),
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
-  blocking: z3.boolean().optional()
+  blocking: z4.boolean().optional()
 });
 var CLAIM_STALE_MS = 30 * 6e4;
-var InboxItemSchema = z3.object({
-  id: z3.string(),
-  /** The conversation thread + connection this item lives on. Present on the replied
-   *  detail — they power History's "Continue" / "New session from this" (#57/#251). */
-  parentId: z3.string().optional(),
-  /** THE ARRIVAL this row is one unit of (`notifications.ask_id` → `asks`). A claim is one
-   *  arrival and its units are N rows of it, so this — not `parentId` — is what makes a
-   *  multi-part notification one thing on screen. The thread is the whole CONVERSATION: it
-   *  accumulates every message an agent ever sent, so grouping by it renders a day of
-   *  unrelated updates as a single "12-part request". Absent on rows written before the
-   *  `asks` table, and on anything that never went through `notify` — both fall back to the
-   *  thread, which is what the client did for all rows until now. */
-  askId: z3.string().optional(),
-  /** WHERE this unit sat in the message it was cut from (`notifications.seq`). The batch
-   *  shares one `created_at` to the microsecond, so without it the author's order is
-   *  unrecoverable client-side — a four-paragraph briefing rendered opening-paragraph-last
-   *  (live 2026-08-10, D35). The API already orders by it; this lets a reader that
-   *  re-sorts (grouping, filtering) put an arrival back in the order it was written. */
-  seq: z3.number().int().optional(),
-  /** HOW MANY units the arrival was cut into. A device reads a LENS, never the arrival —
-   *  `/api/inbox` serves `open`, so the units already settled are gone from it — and a client
-   *  counting what it can see is counting what is LEFT. Walking a three-unit ask on the answer
-   *  screen read "1 of 3", then "1 of 2", then no chip at all, each answer having removed the
-   *  only evidence of itself. How big an arrival is, is a fact about the arrival, so the
-   *  server that can still see every row states it. Absent on any row with no `askId`: a
-   *  unit knows WHICH ask it came from and WHERE it sat in it, and how many there were is
-   *  the one part of its own arrival a single row cannot answer. */
-  units: z3.number().int().positive().optional(),
-  tokenId: z3.string().optional(),
+var InboxItemSchema = z4.object({
+  id: z4.string(),
+  tokenId: z4.string().optional(),
   status: NotifyStatusSchema,
   context: ContextSchema,
-  options: z3.array(OptionSchema).optional(),
+  options: z4.array(OptionSchema).optional(),
   /** The ask's declared coverage points (#396), when the agent sent them. */
-  points: z3.array(z3.string()).optional(),
-  /** The call's AGENDA (broker/agenda-design.md): the ordered turns it is made of, built at
-   *  ring/enqueue time. Replaces the condensed line + index-aligned phrased points, which
-   *  between them could not express a call as a sequence. `question: null` is a real turn —
-   *  a status update stays a statement instead of being shaped into a yes/no. */
+  points: z4.array(z4.string()).optional(),
   /** Does this claim want an ANSWER, or is it telling you something? Written per row from
    *  `requestAsks` — the agent's own declaration, not a guess. `false` is what earns a card
    *  its acknowledge affordance: without it a status update offers a text box and a dismiss,
    *  and neither of those is "got it" (owner, 2026-08-10). */
-  asks: z3.boolean().optional(),
+  asks: z4.boolean().optional(),
   /** When a live process last pulsed for this row's agent — the liveness input for
    *  "working requires a pulse" (#928): the list said "Working…" from agent_state alone
    *  while the party called the same dead claim stalled. Absent = no token/no data,
    *  which must never CLAIM stalled. */
-  lastSeenAt: z3.string().optional(),
+  lastSeenAt: z4.string().optional(),
   /** WHEN THE AGENT LAST SAID ANYTHING ABOUT THIS CLAIM — the newest `agent_state` row in
    *  the `notification_events` ledger (trigger-written since 20260621010000, so every row a
    *  user can see has one). The age input for `CLAIM_STALE_MS`, and it has to be this rather
@@ -1865,53 +1992,91 @@ var InboxItemSchema = z3.object({
    *  work. Reading the row's birth as the claim's age brands that "No update in 8h" the
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
-  agentStateAt: z3.string().datetime().optional(),
-  agenda: z3.array(AgendaTurnSchema).optional(),
-  visuals: z3.array(VisualSchema).optional(),
+  agentStateAt: z4.string().datetime().optional(),
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+   *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
+   *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
+   *  Call's cards, and every card of that Call carries the same list: the call screen reads it
+   *  once, off the one read it already makes (`GET /api/inbox/:callId`).
+   *
+   *  It counts DECISIONS, not agenda turns: turns include context-only lines and are re-planned
+   *  every cycle, so a spine drawn from them would change length under the caller mid-call.
+   *
+   *  `entryId` is the request Entry — the id the bot calls a CLAIM, and the one it names on the
+   *  `turn` topic (`asking`, `settled`), because the bot never sees a DecisionNeed id. `title` is
+   *  the card's own concise heading; `answer` the accepted answer in words, null while open. It
+   *  REPLACED `agenda` (turns), which nothing ever filled. */
+  questions: z4.array(z4.object({
+    id: z4.string(),
+    entryId: z4.string(),
+    title: z4.string(),
+    state: z4.enum(["open", "answered"]),
+    answer: z4.string().nullable(),
+    /** WHO ASKED IT (owner, 2026-09-23, Goal a345e906: each agenda row wears its agent's face) — the
+     *  request Entry's author, as the same three facts the item's own `tokenId`/`name`/`voice`
+     *  carry for the call's one agent, so the phone draws it with the same seed. Absent when the
+     *  author is not an agent this account holds (unpaired since, or a person). */
+    agent: z4.object({ tokenId: z4.string(), name: z4.string(), voice: VoiceKeySchema.optional() }).optional()
+  })).optional(),
+  visuals: z4.array(VisualSchema).optional(),
   /** The connected agent's name (the single pairing name — user-typed, or the
    *  agent's suggestion, or a default silly name). */
-  name: z3.string(),
+  name: z4.string(),
   /** The pairing's assigned voice (#462); absent = the default voice. */
   voice: VoiceKeySchema.optional(),
-  repo: z3.string().optional(),
-  branch: z3.string().optional(),
-  createdAt: z3.string().datetime(),
-  snoozedUntil: z3.string().datetime().optional(),
+  repo: z4.string().optional(),
+  branch: z4.string().optional(),
+  createdAt: z4.string().datetime(),
+  snoozedUntil: z4.string().datetime().optional(),
   agentState: AgentStateSchema.default("idle"),
   /** Whose action the item is waiting on: "you" = an agent asked you (the default,
    *  every agent→user notification); "agent" = you sent a request and it's awaiting the
    *  agent (held in the inbox until the agent replies on the thread). */
-  turn: z3.enum(["you", "agent"]).default("you"),
+  turn: z4.enum(["you", "agent"]).default("you"),
   /** Hard error reason on an awaiting request (turn="agent") — the wake failed to reach
-   *  the agent (provider-agnostic; set server-side). Absent = no hard error, though the
-   *  client may still flag a stall by age. Drives the inbox error badge + Retry. */
-  error: z3.string().optional(),
-  clarifies: z3.string().optional(),
-  /** The ring ladder ran out while this was still pending — we tried to reach you and
-   *  STOPPED trying (`arbitration/arbitrate.ts` `ringAt` → null). Distinct from an
-   *  agent with nothing to say, which the roster drew identically until now: "nothing to
-   *  say" and "gave up saying it" are opposite situations wearing the same face
-   *  (navigation-design.md, gap 1). False for anything that never rang. */
-  gaveUp: z3.boolean().default(false),
+   *  the agent (provider-agnostic; set server-side). Absent = no hard error. Drives the inbox
+   *  error badge + Retry. */
+  error: z4.string().optional(),
+  /** WHEN THIS AGENT WORK WENT QUIET (turn="agent"), by the one rule (`coldSince`: three days
+   *  with nothing said), or absent while it is not stalled. The inbox's stalled badge reads
+   *  this and nothing else (2026-09-23: a 3-minute age rule badged every live Goal stalled,
+   *  and "dismiss the stalled ones" cancelled 37 pieces of live work). */
+  cold: z4.string().datetime().optional(),
+  clarifies: z4.string().optional(),
+  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+   *  declined, and what the ladder will do next — read off the cron's own row, never computed
+   *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
+   *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
+   *  `nextRingAt` is this card's armed instant (`deliveries.next_ring_at`), null once the cron
+   *  has disarmed it — the curve's end, `inbox`/`dismiss`, or a setting that said no more rings.
+   *  It replaced `gaveUp` (deleted 2026-09-22): "the ladder spent" was a boolean the projection
+   *  never set, and it is `nextRingAt === null` here — the party's *Missed you* (`party/dress.ts`)
+   *  and the roster's `unreached` read `declinedAt`, and stand while it does. */
+  ring: z4.object({
+    declinedAt: z4.string().datetime(),
+    anchorAt: z4.string().datetime(),
+    nextRingAt: z4.string().datetime().nullable(),
+    step: z4.number().int()
+  }).optional(),
   /** Why this arrived the way it did, read back off the delivery receipt (`notify/why.ts`).
    *  Absent for anything never delivered through a push, and for older rows written before
    *  the reason was recorded. Deliberately a debug affordance, shown small (owner,
    *  2026-08-07) — its real job is to give "this didn't need a call" something to be
    *  feedback ABOUT. */
-  why: z3.object({
+  why: z4.object({
     asked: NotifyLevelSchema,
     got: NotifyLevelSchema,
-    because: z3.enum(["unresponsive", "dismissed", "not_permitted", "silent", "coalesced", "agent_capped", "unplanned", "learned_raise"]).optional(),
-    line: z3.string()
+    because: z4.enum(["unresponsive", "dismissed", "not_permitted", "silent", "coalesced", "agent_capped", "unplanned", "learned_raise"]).optional(),
+    line: z4.string()
   }).optional(),
-  select: z3.enum(["one", "many", "rank", "confirm", "text"]).default("one"),
-  confirmStyle: z3.enum(["yesno", "approve"]).default("yesno").describe(
+  select: z4.enum(["one", "many", "rank", "confirm", "text"]).default("one"),
+  confirmStyle: z4.enum(["yesno", "approve"]).default("yesno").describe(
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
    *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
-  blocking: z3.boolean().default(false),
+  blocking: z4.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
   answer: UserAnswerSchema.optional(),
   /** THE TARGET FACTS A CARD RENDERS (#1796 point 5, 2026-09-11): the Delivery it is a view of,
@@ -1919,35 +2084,38 @@ var InboxItemSchema = z3.object({
    *  for a request that asks nothing), whether its content is sealed, and that Goal's state. The
    *  answer writer (`POST /api/entries`) and the disposition (`close_delivery`) take their ids from
    *  here. The server projects it (`apps/api/src/inbox/project.ts`); a client never builds it. */
-  communication: z3.object({
-    deliveryId: z3.string(),
-    kind: z3.enum(["notification", "call"]),
-    entryId: z3.string(),
-    goalIds: z3.array(z3.string()),
-    decisionNeedId: z3.string().optional(),
-    sealed: z3.boolean(),
-    goalState: z3.string().optional()
+  communication: z4.object({
+    deliveryId: z4.string(),
+    kind: z4.enum(["notification", "call"]),
+    entryId: z4.string(),
+    goalIds: z4.array(z4.string()),
+    decisionNeedId: z4.string().optional(),
+    sealed: z4.boolean(),
+    goalState: z4.string().optional(),
+    /** THAT GOAL'S NAME (#2416) — what Activity's row is headed by, since a row there is one Goal
+     *  and the cards it holds sit behind it. Stamped by the same read as `goalState`. */
+    goalTitle: z4.string().optional()
   }).optional()
 });
 var APNS_TOKEN_RE = /^[0-9a-fA-F]{64}$/;
-var PushTokenSchema = z3.object({
-  voipToken: z3.string().min(1).optional(),
-  alertToken: z3.string().min(1).optional(),
-  fcmToken: z3.string().min(1).optional(),
-  platform: z3.enum(["ios", "android"])
+var PushTokenSchema = z4.object({
+  voipToken: z4.string().min(1).optional(),
+  alertToken: z4.string().min(1).optional(),
+  fcmToken: z4.string().min(1).optional(),
+  platform: z4.enum(["ios", "android"])
 }).superRefine((v, ctx) => {
   if (v.platform !== "ios") return;
   for (const field of ["voipToken", "alertToken"]) {
     const token = v[field];
     if (token === void 0 || APNS_TOKEN_RE.test(token)) continue;
     ctx.addIssue({
-      code: z3.ZodIssueCode.custom,
+      code: z4.ZodIssueCode.custom,
       path: [field],
       message: `not an APNs device token (want 64 hex chars, got ${token.length})`
     });
   }
 });
-var MissedCallSchema = z3.enum([
+var MissedCallSchema = z4.enum([
   "retry_10m",
   "retry_30m",
   "retry_60m",
@@ -1959,32 +2127,32 @@ var MissedCallSchema = z3.enum([
 ]);
 var clock = (h) => h === 0 ? "midnight" : h === 12 ? "noon" : h < 12 ? `${h} am` : `${h - 12} pm`;
 var QUIET = ` Nothing rings from ${clock(NIGHT.from)} to ${clock(NIGHT.to)} your time; the count waits for morning.`;
-var BrokerTuningSchema = z3.object({
+var BrokerTuningSchema = z4.object({
   /** 'none' = skip the spoken ack after a mapped answer (power users find it slow). */
-  ackVerbosity: z3.enum(["normal", "none"]).optional(),
+  ackVerbosity: z4.enum(["normal", "none"]).optional(),
   /** How readily the mapper asks its one clarification: 'low' = only when truly
    *  uninterpretable, 'high' = whenever not fully certain. */
-  clarifyEagerness: z3.enum(["low", "normal", "high"]).optional(),
+  clarifyEagerness: z4.enum(["low", "normal", "high"]).optional(),
   /** The user's own shorthand: when they say `say`, they mean `mean`. */
-  phrasebook: z3.array(z3.object({ say: z3.string().min(1).max(60), mean: z3.string().min(1).max(120) })).max(24).optional(),
+  phrasebook: z4.array(z4.object({ say: z4.string().min(1).max(60), mean: z4.string().min(1).max(120) })).max(24).optional(),
   /** The language calls are PLANNED in, when the account has chosen one (#1272). Absent —
    *  which is every account today — means the agent's own words decide, per ask: a call
    *  about an English ask opens in English. This is the only thing that overrides that,
    *  and a live caller who switches language mid-call still outranks it (broker/lang.ts).
    *  Set per user (no UI yet), like `voiceTuning`. */
-  language: z3.enum(["en", "es"]).optional()
+  language: z4.enum(["en", "es"]).optional()
 });
-var UserSettingsSchema = z3.object({
-  permissions: z3.object({
-    call: z3.boolean(),
-    banner: z3.boolean(),
-    push: z3.boolean()
+var UserSettingsSchema = z4.object({
+  permissions: z4.object({
+    call: z4.boolean(),
+    banner: z4.boolean(),
+    push: z4.boolean()
   }),
-  sessionMode: z3.enum(["default", "all_calls", "silent"]),
-  silentPush: z3.boolean(),
-  autoCallback: z3.boolean(),
+  sessionMode: z4.enum(["default", "all_calls", "silent"]),
+  silentPush: z4.boolean(),
+  autoCallback: z4.boolean(),
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
-  improveConsent: z3.boolean(),
+  improveConsent: z4.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
   /** Where voice audio is processed. 'hosted' (default) = Paigy's voice services
    *  (ElevenLabs TTS, faster-whisper STT, the call bot); 'on_device' = the phone
@@ -1992,7 +2160,13 @@ var UserSettingsSchema = z3.object({
    *  Optional, NOT defaulted: a stale client PATCHing the full settings object
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
-  voiceMode: z3.enum(["hosted", "on_device"]).optional(),
+  voiceMode: z4.enum(["hosted", "on_device"]).optional(),
+  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+   *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
+   *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
+   *  object must not silently turn it back on. Absent = leave unchanged on write, true on
+   *  read (see store.ts). */
+  talk: z4.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -2000,10 +2174,10 @@ var UserSettingsSchema = z3.object({
    *  payload['tuning'] (e.g. { silence_s: 3.5 } — a longer pause window for a
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
-  voiceTuning: z3.record(z3.string(), z3.union([z3.number(), z3.string()])).optional(),
+  voiceTuning: z4.record(z4.string(), z4.union([z4.number(), z4.string()])).optional(),
   /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
    *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: z3.boolean().optional(),
+  pstnCalls: z4.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -2012,52 +2186,51 @@ var UserSettingsSchema = z3.object({
    *  that failure reads as the reminder rail being unreliable rather than as a missing
    *  setting. Absent = a spoken time can't be landed, so the reminder rides the next
    *  call — honest about what we know. */
-  timezone: z3.string().min(1).max(64).optional(),
+  timezone: z4.string().min(1).max(64).optional(),
   /** Rung-2 broker tuning (#381). Optional and NOT defaulted, same stale-client
    *  clobber guard as voiceMode: absent = leave unchanged on write. */
   broker: BrokerTuningSchema.optional()
 });
-var HistoryItemSchema = z3.object({
-  id: z3.string(),
-  parentId: z3.string(),
+var HistoryItemSchema = z4.object({
+  id: z4.string(),
   /** 'user' = a request you sent; 'agent' = a notification an agent sent you. */
-  initiator: z3.enum(["user", "agent"]),
-  title: z3.string(),
+  initiator: z4.enum(["user", "agent"]),
+  title: z4.string(),
   /** The agent on the other end (its name). */
-  name: z3.string(),
-  createdAt: z3.string(),
+  name: z4.string(),
+  createdAt: z4.string(),
   /** When the agent fetched your request (user→agent only). */
-  agentAckedAt: z3.string().nullable(),
+  agentAckedAt: z4.string().nullable(),
   /** When you answered the agent's notification (agent→user only). */
-  humanAckedAt: z3.string().nullable()
+  humanAckedAt: z4.string().nullable()
 });
 var ACTIVITY_LINES = 2;
 var ACTIVITY_LINE_MAX = 80;
-var AgentActivitySchema = z3.object({
+var AgentActivitySchema = z4.object({
   /** Oldest first, so the newest line is last — the one that replaces in place. */
-  lines: z3.array(z3.string().max(ACTIVITY_LINE_MAX)).max(ACTIVITY_LINES),
+  lines: z4.array(z4.string().max(ACTIVITY_LINE_MAX)).max(ACTIVITY_LINES),
   /** When the harness observed this tail. Its own timestamp, not the heartbeat's: a beat
    *  that carries an UNCHANGED tail must not make a stalled agent look like it just moved. */
-  at: z3.string().datetime()
+  at: z4.string().datetime()
 });
-var ConnectionSummarySchema = z3.object({
+var ConnectionSummarySchema = z4.object({
   /** The connection = the agent's token id (used to address a request). */
-  id: z3.string(),
+  id: z4.string(),
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
    *  apps/api/src/tokens/devices-vs-agents-design.md. */
-  kind: z3.enum(["device", "agent"]).optional(),
+  kind: z4.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
    *  agents (phone-launched, provider-managed, or minted before the link existed). */
-  mintedByDevice: z3.string().nullable().optional(),
-  device: z3.string().nullable(),
+  mintedByDevice: z4.string().nullable().optional(),
+  device: z4.string().nullable(),
   /** The agent's display name (the single pairing name). */
-  name: z3.string(),
+  name: z4.string(),
   /** For a managed connection, the provider key (e.g. "cma") that agentOrigin maps to a
    *  label; null for a local connection. Sourced from the token's provider, not the name. */
-  provider: z3.string().nullable(),
+  provider: z4.string().nullable(),
   /** The pairing's assigned voice (#462); null = the default voice. */
   voice: VoiceKeySchema.nullable(),
   /** The LOUDEST this agent may ever reach you — a ceiling on `NOTIFY_LADDER`, set by the
@@ -2068,22 +2241,22 @@ var ConnectionSummarySchema = z3.object({
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema.nullable().optional(),
-  createdAt: z3.string().datetime(),
+  createdAt: z4.string().datetime(),
   /** Most recent notification on this connection, either direction. Null = no contact yet.
    *  Drives the agents-page recency grouping (Today / This week / …). */
-  lastContactAt: z3.string().datetime().nullable(),
+  lastContactAt: z4.string().datetime().nullable(),
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
-  lastSeenAt: z3.string().datetime().nullable().optional(),
+  lastSeenAt: z4.string().datetime().nullable().optional(),
   /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
-  runtime: z3.object({
+  runtime: z4.object({
     /** The @paigy/harness this host is running — a machine the self-update has not reached
      *  shows its age here (`apps/desktop/src/update.ts`). */
-    version: z3.string().optional(),
-    harnesses: z3.array(z3.object({ name: z3.string(), label: z3.string(), status: z3.string() })).optional(),
-    workspaces: z3.array(z3.string()).optional()
+    version: z4.string().optional(),
+    harnesses: z4.array(z4.object({ name: z4.string(), label: z4.string(), status: z4.string() })).optional(),
+    workspaces: z4.array(z4.string()).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -2092,148 +2265,178 @@ var ConnectionSummarySchema = z3.object({
   activity: AgentActivitySchema.optional(),
   /** True = a provider-managed agent running in the provider's cloud (e.g. Anthropic CMA);
    *  false = a local MCP connection running on the user's computer (Claude Code/Codex/…). */
-  managed: z3.boolean()
+  managed: z4.boolean()
 });
-var LedgerItemSchema = z3.object({ id: z3.string(), parentId: z3.string(), title: z3.string(), createdAt: z3.string() });
-var AgentLedgerSchema = z3.object({
-  agent: z3.object({ id: z3.string(), name: z3.string(), revokedAt: z3.string().nullable() }),
+var LedgerItemSchema = z4.object({ id: z4.string(), parentId: z4.string(), title: z4.string(), createdAt: z4.string() });
+var AgentLedgerSchema = z4.object({
+  agent: z4.object({ id: z4.string(), name: z4.string(), revokedAt: z4.string().nullable() }),
   /** Its own questions you have not answered. */
-  asks: z3.array(LedgerItemSchema),
+  asks: z4.array(LedgerItemSchema),
   /** Its questions you answered that nobody acted on — still owed to somebody. */
-  answered: z3.array(LedgerItemSchema),
+  answered: z4.array(LedgerItemSchema),
   /** Requests you sent it that it never took. */
-  requests: z3.array(LedgerItemSchema),
-  goals: z3.array(z3.object({ id: z3.string(), outcome: z3.string(), state: z3.string() })),
-  callbacks: z3.array(z3.object({ id: z3.string(), parentId: z3.string(), trigger: z3.string(), note: z3.string(), dueAt: z3.string().nullable() }))
+  requests: z4.array(LedgerItemSchema),
+  goals: z4.array(z4.object({ id: z4.string(), outcome: z4.string(), state: z4.string() })),
+  callbacks: z4.array(z4.object({ id: z4.string(), parentId: z4.string(), trigger: z4.string(), note: z4.string(), dueAt: z4.string().nullable() }))
 });
-var ReassignResultSchema = z3.object({
-  moved: z3.object({ asks: z3.number(), answered: z3.number(), requests: z3.number(), goals: z3.number(), callbacks: z3.number() }),
-  parentId: z3.string().nullable()
+var ReassignResultSchema = z4.object({
+  moved: z4.object({ asks: z4.number(), answered: z4.number(), requests: z4.number(), goals: z4.number(), callbacks: z4.number() }),
+  parentId: z4.string().nullable()
 });
-var MoveRingSchema = z3.enum(["home", "travels", "retired", "quarantined"]);
-var MoveSchema = z3.object({
-  id: z3.string(),
+var MoveRingSchema = z4.enum(["home", "travels", "retired", "quarantined"]);
+var MoveSchema = z4.object({
+  id: z4.string(),
   /** The reusable question, as distill normalized it. */
-  question: z3.string(),
+  question: z4.string(),
   /** The operative ruling. Editable by the user (PATCH) — which resets the ledger. */
-  answer: z3.string(),
+  answer: z4.string(),
   /** The user's stated reason, when they gave one. Null = inherently narrow: the judge is
    *  told so, and the ruling only derives essentially the same question in the same scope. */
-  rationale: z3.string().nullable(),
+  rationale: z4.string().nullable(),
   /** Where the ruling lives: a repo/workspace, or 'global'. */
-  scope: z3.string(),
+  scope: z4.string(),
   ring: MoveRingSchema,
   /** True = the user pinned it with `always` (travel granted by hand, not by evidence). */
-  pinned: z3.boolean(),
+  pinned: z4.boolean(),
   /** True = a pin the user placed was BROKEN by later counter-evidence. Surfaced so the
    *  break is visible instead of a pin silently disappearing. */
-  pinBroken: z3.boolean(),
+  pinBroken: z4.boolean(),
   /** When the ruling was distilled. */
-  learnedAt: z3.string(),
+  learnedAt: z4.string(),
   /** Last time it answered an ask. Null = never fired. */
-  lastUsedAt: z3.string().nullable(),
+  lastUsedAt: z4.string().nullable(),
   /** How many asks it has answered. Instrumentation — deliberately NOT an input to the
    *  evidence curve: firing says the question keeps arising, not that the ruling is right. */
-  usedCount: z3.number(),
+  usedCount: z4.number(),
   /** Ledger: outcomes that said it held up. Saturating — the tenth is worth almost nothing. */
-  confirms: z3.number(),
+  confirms: z4.number(),
   /** Ledger: contradictions, in signal units (a full override = 1, weaker signals less).
    *  Linear and priced above the entire confirmation budget, so any full counter wins. */
-  counters: z3.number(),
+  counters: z4.number(),
   /** The agent that asked the question this move came from, when known. Null for a move
    *  distilled from a clarify ruling (those carry no agent) or one whose source rows are gone. */
-  learnedFrom: z3.object({ id: z3.string(), name: z3.string() }).nullable()
+  learnedFrom: z4.object({ id: z4.string(), name: z4.string() }).nullable()
 });
-var QueueQuestionSchema = z3.object({
+var QueueQuestionSchema = z4.object({
   /** The decision need's id — what an answer is accepted against. */
-  id: z3.string(),
+  id: z4.string(),
   /** The words that were asked, from the request Entry that asked them. */
-  question: z3.string(),
+  question: z4.string(),
   /** Where it was asked — which is where the ruling goes (`POST /api/entries`). Null only
    *  for a need whose request Entry is carried by no interactive Delivery, which nothing
    *  can answer. */
-  deliveryId: z3.string().nullable().default(null),
+  deliveryId: z4.string().nullable().default(null),
   /** The Entry the ruling is about. */
-  aboutId: z3.string().nullable().default(null),
+  aboutId: z4.string().nullable().default(null),
   /** Empty for a free-text question. */
-  options: z3.array(OptionSchema).default([]),
-  select: z3.enum(["one", "many", "rank", "confirm", "text"]).default("text"),
-  askedAt: z3.string(),
+  options: z4.array(OptionSchema).default([]),
+  select: z4.enum(["one", "many", "rank", "confirm", "text"]).default("text"),
+  askedAt: z4.string(),
   /** Null while the question is open — which is how the page tells the two apart. */
-  answeredAt: z3.string().nullable().default(null),
+  answeredAt: z4.string().nullable().default(null),
   /** The ruling in the person's own words, from the contribution that replied — not the
    *  option id, which is not something anyone reads back. Null while it is open, and null
    *  for a settled question whose reply carried nothing readable. */
-  answer: z3.string().nullable().default(null),
+  answer: z4.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
    *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
    *  arrived under. Required because the API projects it on every need it sends. */
-  goalId: z3.string(),
+  goalId: z4.string(),
   /** True only while an unmet START gate holds the Goal — a Goal that merely waits to
    *  *finish* does not stop a person from answering (owner, 2026-09-16: "per need gate from
    *  the API"; §4's dashed node). Not the same fact as `QueueItem.blocked`, which counts any
    *  gate at all. */
-  blocked: z3.boolean().default(false)
+  blocked: z4.boolean().default(false)
+});
+var QueueReplySchema = z4.object({
+  /** The card this note was (`deliveryId:requestEntryId`, minted by the server like every card
+   *  id) — so the phone can tell a reply it just sent from one the queue already carries, and the
+   *  walk can name it in its zoom. */
+  id: z4.string(),
+  /** The Goal the note is on. */
+  goalId: z4.string(),
+  /** What the note said. */
+  note: z4.string(),
+  /** Where it was carried — where a second reply goes (`POST /api/entries`, #2252). */
+  deliveryId: z4.string(),
+  requestEntryId: z4.string(),
+  askedAt: z4.string(),
+  /** When the person last replied — the window's start. */
+  repliedAt: z4.string(),
+  /** The person's latest words about it; null when there is nothing readable in them. */
+  reply: z4.string().nullable()
 });
-var QueueItemSchema = z3.object({
-  id: z3.string(),
+var QueueItemSchema = z4.object({
+  id: z4.string(),
   /** One-line headline — the first sentence of the outcome. */
-  title: z3.string(),
+  title: z4.string(),
   /** The outcome in full, verbatim: the person's own words are what an assignee sees. */
-  intent: z3.string(),
+  intent: z4.string(),
   /** `ready` | `active` | `waiting` | `done` | `cancelled`, straight off the Goal. */
-  state: z3.string(),
+  state: z4.string(),
   /** Who holds it (a participant ref); null when nobody does yet. */
-  assignee: z3.string().nullable().default(null),
+  assignee: z4.string().nullable().default(null),
   /** What the agent last said it was doing; null if it has said nothing. */
-  progress: z3.string().nullable().default(null),
-  reviewPending: z3.boolean().default(false),
-  dueAt: z3.string().nullable().default(null),
+  progress: z4.string().nullable().default(null),
+  /** HOME'S LINE FOR THAT NOTE (owner, 2026-09-23): a few plain words one read wrote from `progress`,
+   *  served only while it was written for the current note. Null means show the Goal's name. */
+  progressLine: z4.string().nullable().optional(),
+  reviewPending: z4.boolean().default(false),
+  dueAt: z4.string().nullable().default(null),
   /** The Goal this one was opened under; null at the root. */
-  parentGoalId: z3.string().nullable().default(null),
+  parentGoalId: z4.string().nullable().default(null),
   /** Goals opened under this one — only those the same list holds. */
-  childGoalIds: z3.array(z3.string()).default([]),
+  childGoalIds: z4.array(z4.string()).default([]),
   /** Goals this one waits on (start or finish gates). */
-  dependencyGoalIds: z3.array(z3.string()).default([]),
+  dependencyGoalIds: z4.array(z4.string()).default([]),
   /** True while any gate is on a Goal that is not done — the walk draws it dashed. */
-  blocked: z3.boolean().default(false),
+  blocked: z4.boolean().default(false),
   /** Every decision need on it, open or settled — the page decides which to show. */
-  questions: z3.array(QueueQuestionSchema).default([]),
+  questions: z4.array(QueueQuestionSchema).default([]),
+  /** Every note on it the person replied to (`QueueReplySchema`) — the page decides which to show.
+   *  Optional, not defaulted: absent is none, and every hand-built queue (fixtures, the demo) need
+   *  not spell an empty list. */
+  replies: z4.array(QueueReplySchema).optional(),
   /** The repository or project identifier this Goal belongs to (#2280), null if untracked. */
-  repo: z3.string().nullable().optional(),
-  createdAt: z3.string(),
-  updatedAt: z3.string().nullable().default(null)
+  repo: z4.string().nullable().optional(),
+  createdAt: z4.string(),
+  updatedAt: z4.string().nullable().default(null),
+  /** When its owner last SAID something about it (`goals.last_progress_at`, written by every
+   *  `update_goal` that changes `progress`). `updatedAt` moves for reasons nobody chose — a
+   *  state recomputed, a review flag — so it cannot tell work in hand from work gone quiet. */
+  lastProgressAt: z4.string().nullable().optional()
 });
-var NoteSourceSchema = z3.enum(["app", "call"]);
-var NoteStatusSchema = z3.enum(["open", "assigned", "in_progress", "done"]);
-var NoteRepeatSchema = z3.enum(["once", "until_done"]);
-var DecisionSchema = z3.object({
-  id: z3.string(),
+var COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
+var NoteSourceSchema = z4.enum(["app", "call"]);
+var NoteStatusSchema = z4.enum(["open", "assigned", "in_progress", "done"]);
+var NoteRepeatSchema = z4.enum(["once", "until_done"]);
+var DecisionSchema = z4.object({
+  id: z4.string(),
   /** The note this decision refines; null = recorded on a bare thread (the
    *  extensibility seam — any conversation can accrue decisions). */
-  noteId: z3.string().nullable(),
+  noteId: z4.string().nullable(),
   /** What was ambiguous — the broker's (or the user's own) question. */
-  question: z3.string(),
+  question: z4.string(),
   /** The user's ruling; null while the question is open. */
-  answer: z3.string().nullable(),
-  decidedAt: z3.string().nullable(),
-  createdAt: z3.string()
+  answer: z4.string().nullable(),
+  decidedAt: z4.string().nullable(),
+  createdAt: z4.string()
 });
-var NoteSchema = z3.object({
-  id: z3.string(),
+var NoteSchema = z4.object({
+  id: z4.string(),
   /** One-line headline (broker-titled; deterministic floor). */
-  title: z3.string(),
+  title: z4.string(),
   /** The original intent, verbatim — assignees always see the user's own words. */
-  intent: z3.string(),
+  intent: z4.string(),
   source: NoteSourceSchema,
   status: NoteStatusSchema,
   /** Who it was assigned to (a participant ref, 'agent:<tokenId>'); null = unassigned. */
-  assignee: z3.string().nullable(),
+  assignee: z4.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
-  parentId: z3.string().nullable(),
+  parentId: z4.string().nullable(),
   /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
@@ -2242,133 +2445,133 @@ var NoteSchema = z3.object({
   //  Defaulted, not required: a Note from an API deploy older than the reminders
   //  migration has none of these, and the defaults ARE what it means — no not-before,
   //  one ride, never ridden. Parsing must not fail across a rolling deploy.
-  dueAt: z3.string().nullable().default(null),
+  dueAt: z4.string().nullable().default(null),
   repeat: NoteRepeatSchema.default("once"),
   /** How many calls have already carried it — the fatigue cap counts rides, not days. */
-  rides: z3.number().int().default(0),
-  lastRideAt: z3.string().nullable().default(null),
-  createdAt: z3.string()
+  rides: z4.number().int().default(0),
+  lastRideAt: z4.string().nullable().default(null),
+  createdAt: z4.string()
 });
-var TriageItemSchema = z3.object({
-  noteId: z3.string(),
+var TriageItemSchema = z4.object({
+  noteId: z4.string(),
   /** The note's headline at run time. */
-  title: z3.string(),
+  title: z4.string(),
   /** WHY, in one short human line, evidence first — this is read on a phone underneath
    *  the note's title: "no movement in 34 days", "worked 3 notes in this repo this week".
    *  Never a model's reasoning transcript, never an id. */
-  why: z3.string()
+  why: z4.string()
 });
-var TriageAssignmentSchema = z3.object({
+var TriageAssignmentSchema = z4.object({
   /** The agent's token id — what `dispatchNote` resolves and what a request is addressed to. */
-  agent: z3.string(),
+  agent: z4.string(),
   /** Its display name at run time (the name on the hatchling's card). Denormalized for the
    *  same reason as `title`: the card must render from the proposal alone. */
-  agentName: z3.string(),
-  notes: z3.array(TriageItemSchema)
+  agentName: z4.string(),
+  notes: z4.array(TriageItemSchema)
 });
-var TriageStatusSchema = z3.enum(["open", "superseded", "dismissed"]);
-var SubmitTriageSchema = z3.object({
+var TriageStatusSchema = z4.enum(["open", "superseded", "dismissed"]);
+var SubmitTriageSchema = z4.object({
   /** Which runtime judged: "ollama" (inference never left the machine) or a harness the
    *  user already runs under their own credentials ("claude" / "codex" / "agy"). Recorded
    *  so the phone can say where the content went — an unattributed privacy claim is worth
    *  nothing, and #1106's promise is precisely "Paigy's servers never see this". */
-  provider: z3.string().min(1).max(60),
+  provider: z4.string().min(1).max(60),
   /** The concrete model when the provider names one (an ollama tag); null otherwise. */
-  model: z3.string().max(200).nullable().optional(),
+  model: z4.string().max(200).nullable().optional(),
   /** How many open notes the run actually looked at — the denominator on the phone
    *  ("6 of 50"), and the honest answer to "did it read the whole queue?". */
-  reviewed: z3.number().int().min(0).max(1e4).default(0),
-  close: z3.array(TriageItemSchema).max(200).default([]),
-  stale: z3.array(TriageItemSchema).max(200).default([]),
-  assign: z3.array(TriageAssignmentSchema).max(50).default([])
+  reviewed: z4.number().int().min(0).max(1e4).default(0),
+  close: z4.array(TriageItemSchema).max(200).default([]),
+  stale: z4.array(TriageItemSchema).max(200).default([]),
+  assign: z4.array(TriageAssignmentSchema).max(50).default([])
 });
 var TriageProposalSchema = SubmitTriageSchema.extend({
-  id: z3.string(),
-  runAt: z3.string(),
+  id: z4.string(),
+  runAt: z4.string(),
   status: TriageStatusSchema,
-  model: z3.string().nullable().default(null)
+  model: z4.string().nullable().default(null)
 });
-var AcceptTriageSchema = z3.discriminatedUnion("group", [
-  z3.object({ group: z3.literal("close"), noteIds: z3.array(z3.string()).max(200).optional() }),
-  z3.object({ group: z3.literal("stale"), noteIds: z3.array(z3.string()).max(200).optional() }),
-  z3.object({
-    group: z3.literal("assign"),
-    agent: z3.string().min(1),
-    noteIds: z3.array(z3.string()).max(200).optional()
+var AcceptTriageSchema = z4.discriminatedUnion("group", [
+  z4.object({ group: z4.literal("close"), noteIds: z4.array(z4.string()).max(200).optional() }),
+  z4.object({ group: z4.literal("stale"), noteIds: z4.array(z4.string()).max(200).optional() }),
+  z4.object({
+    group: z4.literal("assign"),
+    agent: z4.string().min(1),
+    noteIds: z4.array(z4.string()).max(200).optional()
   })
 ]);
-var AcceptTriageResultSchema = z3.object({
-  accepted: z3.array(z3.string()),
-  failed: z3.array(z3.object({ noteId: z3.string(), reason: z3.string() }))
+var AcceptTriageResultSchema = z4.object({
+  accepted: z4.array(z4.string()),
+  failed: z4.array(z4.object({ noteId: z4.string(), reason: z4.string() }))
 });
-var DeliveryModeSchema = z3.enum(["poll", "self_hosted"]);
+var DeliveryModeSchema = z4.enum(["poll", "self_hosted"]);
 var WAKE_EVENT = "wake";
 var wakeChannel = (tokenId) => `wake:${tokenId}`;
-var RegisterDeliverySchema = z3.object({ mode: DeliveryModeSchema });
-var OAuthStartSchema = z3.object({
-  provider: z3.enum(["cma"]),
-  returnTo: z3.string().min(1)
+var RegisterDeliverySchema = z4.object({ mode: DeliveryModeSchema });
+var OAuthStartSchema = z4.object({
+  provider: z4.enum(["cma"]),
+  returnTo: z4.string().min(1)
 });
-var DeliveryConfigSchema = z3.object({
-  tokenId: z3.string(),
+var DeliveryConfigSchema = z4.object({
+  tokenId: z4.string(),
   mode: DeliveryModeSchema,
   /** null when the deployment has no anon key configured. `self_hosted` is then REFUSED
    *  (503 `self_hosted_unavailable`) rather than registered, so a self_hosted config always
    *  carries credentials; only a `poll` registration can come back with null here. */
-  realtime: z3.object({ url: z3.string(), anonKey: z3.string() }).nullable()
+  realtime: z4.object({ url: z4.string(), anonKey: z4.string() }).nullable()
 });
-var WakeNudgeSchema = z3.object({
-  kind: z3.enum(["reply", "request", "callback"]),
-  notificationId: z3.string().optional(),
-  parentId: z3.string()
+var WakeNudgeSchema = z4.object({
+  kind: z4.enum(["reply", "request", "callback"]),
+  notificationId: z4.string().optional(),
+  parentId: z4.string()
 });
-var PairingStatusSchema = z3.enum(["pending", "approved", "denied", "expired"]);
-var DeviceCodeSchema = z3.object({
-  device_code: z3.string(),
-  user_code: z3.string(),
-  verification_uri: z3.string().url(),
-  verification_uri_complete: z3.string().url(),
-  interval: z3.number(),
-  expires_in: z3.number()
+var PairingStatusSchema = z4.enum(["pending", "approved", "denied", "expired"]);
+var DeviceCodeSchema = z4.object({
+  device_code: z4.string(),
+  user_code: z4.string(),
+  verification_uri: z4.string().url(),
+  verification_uri_complete: z4.string().url(),
+  interval: z4.number(),
+  expires_in: z4.number()
 });
-var DeviceInfoSchema = z3.object({
-  code: z3.string(),
+var DeviceInfoSchema = z4.object({
+  code: z4.string(),
   /** The agent's suggested name (from /device/code) — shown on the approval screen,
    *  pre-filling the name field the human can edit. */
-  name: z3.string(),
+  name: z4.string(),
   /** @deprecated Legacy alias of `name` for the pre-#531 embedded bundle in App Store
    *  build 35, whose DeviceFlow renders `info.agent.slice(0, 2)` — without this a FRESH
    *  install crashes on the pairing screen on first launch, before the OTA lands
    *  (seen live: PAIGY-5T, 2026-07-21). Remove once a newer binary is the floor. */
-  agent: z3.string().optional(),
-  device: z3.string().nullable(),
+  agent: z4.string().optional(),
+  device: z4.string().nullable(),
   status: PairingStatusSchema
 });
-var DeviceTokenSchema = z3.object({
-  access_token: z3.string(),
+var DeviceTokenSchema = z4.object({
+  access_token: z4.string(),
   /** The pairing's single name (user-typed at approval, the agent's suggestion, or
    *  a default silly name). */
-  name: z3.string(),
-  device: z3.string().nullable(),
+  name: z4.string(),
+  device: z4.string().nullable(),
   /** The pairing's assigned voice, cached so the desktop can seed the SAME face the phone
    *  draws — voice is the third ingredient of a hatchling's build (party/traits.ts). */
-  voice: z3.string().nullable().optional(),
+  voice: z4.string().nullable().optional(),
   /** The token's server-side id — the face's COLOUR anchor, and the only seed ingredient
    *  that survives a rename. Cached by the host's identity beat. */
-  token_id: z3.string().nullable().optional(),
+  token_id: z4.string().nullable().optional(),
   /** WHERE this identity works — the folder a wake should land it in. Written by the host
    *  at spawn and by `paigy-harness handoff` from a live terminal. Without it every wake
    *  landed in the FIRST granted workspace and the agent rediscovered its own repo from
    *  the thread each time (host.ts, live catch 2026-08-06 — prompt-papered until now). */
-  workspace: z3.string().nullable().optional(),
-  uik_pub: z3.string().nullable().optional()
+  workspace: z4.string().nullable().optional(),
+  uik_pub: z4.string().nullable().optional()
 });
-var SupportRequestSchema = z3.object({
-  email: z3.string().email().max(320),
-  message: z3.string().trim().min(1).max(5e3),
-  name: z3.string().trim().max(120).optional()
+var SupportRequestSchema = z4.object({
+  email: z4.string().email().max(320),
+  message: z4.string().trim().min(1).max(5e3),
+  name: z4.string().trim().max(120).optional()
 });
-var NotificationFeedbackKindSchema = z3.enum([
+var NotificationFeedbackKindSchema = z4.enum([
   "break_down",
   // "This should be more than one ask — break it down."
   "regenerate_options",
@@ -2389,6 +2592,7 @@ function sessionSlot(sessionId2) {
 function agentName() {
   return process.env.PAIGY_AGENT || sessionSlot();
 }
+var PROTO = "paigy-pair-v2|sas=24";
 var TOKEN_PATH = join2(homedir2(), ".paigy", "token.json");
 var KEY_PATH = join2(homedir2(), ".paigy", "key.json");
 function readTokenFile() {
@@ -2429,6 +2633,20 @@ function saveToken(token, agent2 = agentName()) {
     writeFileSync(TOKEN_PATH, JSON.stringify(slots, null, 2) + "\n", { mode: 384 });
   });
 }
+function updateSlot(agent2, patch) {
+  return withTokenLock(() => {
+    const slots = readTokenFile();
+    const existing = slots[agent2];
+    if (!existing) return false;
+    slots[agent2] = { ...existing, ...patch };
+    writeFileSync(TOKEN_PATH, JSON.stringify(slots, null, 2) + "\n", { mode: 384 });
+    return true;
+  });
+}
+function slotIdentity(agent2) {
+  const t = readTokenFile()[agent2];
+  return { name: t?.name ?? null, voice: t?.voice ?? null, tokenId: t?.token_id ?? null, workspace: t?.workspace ?? null };
+}
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function readToken(agent2 = agentName()) {
   if (process.env.PAIGY_TOKEN) return process.env.PAIGY_TOKEN;
@@ -2510,6 +2728,11 @@ var ApiError = class extends Error {
     this.body = body;
   }
 };
+var tokenOverride = null;
+function overrideToken(secret) {
+  tokenOverride = secret;
+}
+var authToken = (explicit) => explicit ?? tokenOverride ?? readToken();
 async function fail(what, res) {
   throw new ApiError(what, res.status, await res.text());
 }
@@ -2546,25 +2769,6 @@ async function updateGoal(goalId, input, opts = {}) {
   return await res.json();
 }
 var AWAIT_WINDOW_MS = 45e3;
-async function getThread(parentId, opts = {}) {
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/thread/${encodeURIComponent(parentId)}`, {
-    headers: { authorization: `Bearer ${authToken(opts.token) ?? ""}`, "x-paigy-model": "goal-entry-v1" }
-  }));
-  if (!res.ok) await fail("get_thread", res);
-  return await res.json();
-}
-async function searchThreads(q, opts = {}) {
-  const res = ensureAuthed(await (opts.reach ?? reach)(`${BACKEND_URL}/api/search?q=${encodeURIComponent(q)}`, {
-    headers: { authorization: `Bearer ${authToken(opts.token) ?? ""}`, "x-paigy-model": "goal-entry-v1" }
-  }));
-  if (!res.ok) await fail("search_threads", res);
-  return await res.json();
-}
-var tokenOverride = null;
-function overrideToken(secret) {
-  tokenOverride = secret;
-}
-var authToken = (explicit) => explicit ?? tokenOverride ?? readToken();
 async function hatch(name, voice = null) {
   const res = ensureAuthed(await reach(`${BACKEND_URL}/api/hatch`, {
     method: "POST",
@@ -2593,6 +2797,14 @@ async function setIdentity(patch, opts = {}) {
   if (!res.ok) throw new Error(`set_identity failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
+async function claimSessions(opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/claim`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+    // the HOST's identity
+  }));
+  if (!res.ok) throw new Error(`claim_sessions failed: ${res.status}`);
+  return (await res.json()).sessions;
+}
 async function heartbeat(runtime, opts = {}) {
   const body = {
     ...runtime !== void 0 ? { runtime } : {},
@@ -2614,6 +2826,79 @@ async function registerDelivery(mode, opts = {}) {
   if (!res.ok) throw new Error(`register_delivery failed: ${res.status} ${await res.text()}`);
   return await res.json();
 }
+async function listNotes(opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/notes`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+  }));
+  if (!res.ok) throw new Error(`list_notes failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function listConnections(opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/tokens`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}`, "x-paigy-model": "goal-entry-v1" }
+  }));
+  if (!res.ok) throw new Error(`list_connections failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function submitTriage(run, opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
+    body: JSON.stringify(run)
+  }));
+  if (!res.ok) throw new Error(`submit_triage failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function getTriage(opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+  }));
+  if (!res.ok) throw new Error(`get_triage failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function acceptTriage(proposalId, body, opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage/${encodeURIComponent(proposalId)}/accept`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
+    body: JSON.stringify(body)
+  }));
+  if (!res.ok) throw new Error(`accept_triage failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+async function dismissTriage(proposalId, opts = {}) {
+  const res = ensureAuthed(await reach(`${BACKEND_URL}/api/triage/${encodeURIComponent(proposalId)}/dismiss`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+  }));
+  if (!res.ok) throw new Error(`dismiss_triage failed: ${res.status} ${await res.text()}`);
+  return await res.json();
+}
+function repoFromRemote(url) {
+  const said = (url ?? "").trim();
+  if (!said) return null;
+  const path = said.replace(/^[a-z+]+:\/\/[^/]+\//i, "").replace(/^[^@]+@[^:]+:/, "").replace(/\.git$/i, "").replace(/\/+$/, "");
+  const parts = path.split("/").filter(Boolean);
+  if (parts.length < 2) return null;
+  const [owner, name] = parts.slice(-2);
+  if (!owner || !name) return null;
+  return `${owner}/${name}`.toLowerCase();
+}
+var asked;
+function currentRepo(cwd = process.cwd()) {
+  if (asked !== void 0) return asked;
+  try {
+    const url = execFileSync2("git", ["remote", "get-url", "origin"], {
+      cwd,
+      encoding: "utf8",
+      timeout: 2e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    asked = repoFromRemote(url);
+  } catch {
+    asked = null;
+  }
+  return asked;
+}
 async function contact(input, opts = {}) {
   const parsed = ContactSchema.parse(input);
   opts.signal?.throwIfAborted();
@@ -2627,7 +2912,11 @@ async function contact(input, opts = {}) {
     const reqAsks = parsed.asks.map((a) => ({
       id: a.id,
       parentId: a.parentId,
-      repo: a.repo,
+      // Derived, not asked for (#2315): the agent's own remote, in one spelling, so a project's
+      // work does not grow three trees for "paigy", "mauurda/paigy" and "Paigy". An explicit one
+      // still wins — normalised the same way — because a caller that names one knows something
+      // this cannot see.
+      repo: repoFromRemote(a.repo) ?? a.repo ?? currentRepo() ?? void 0,
       ask: a.ask,
       options: a.options ?? []
     }));
@@ -2645,6 +2934,9 @@ async function contact(input, opts = {}) {
     if (!res.ok) await fail("batch contact", res);
     const receipt = await res.json();
     deliveries = receipt.deliveries ?? [];
+    if (deliveries.length === 0 && receipt.recorded?.length) {
+      return { recorded: receipt.recorded, message: receipt.message ?? "Recorded as progress on its Goal; nothing was sent to the person." };
+    }
     if (deliveries.length === 0) throw new Error("Goal contact returned no Delivery identities");
     deliveryId = deliveries[0]?.deliveryId ?? "";
     if (!deliveryId) throw new Error("Goal contact returned no valid Delivery identity");
@@ -2736,6 +3028,14 @@ function goalView(g) {
     owner: g.ownerParticipant,
     parentGoalId: g.parentGoalId,
     childGoalIds: g.childGoalIds,
+    // EVERYTHING BELOW, read through this Goal (umbrella reads): one line per Goal, indented by
+    // depth, then each question with its answer — so an agent that asked through an umbrella
+    // reads every answer in one call, whoever owns the child it landed on.
+    subtree: g.subtree?.length ? g.subtree.map((c) => compact({
+      goal: `${"  ".repeat(c.depth - 1)}${c.title} (${c.state})`,
+      goalId: c.goalId,
+      questions: c.questions.length ? c.questions.map((q) => q.answer ? `${q.question} \u2192 ${q.answer}` : `${q.question} \u2192 (open)`) : void 0
+    })) : void 0,
     blockedBy: g.blockedDependencyGoalIds,
     dueAt: g.dueAt,
     leaseExpiresAt: g.leaseExpiresAt,
@@ -2755,18 +3055,10 @@ function deliveryView(d) {
     next: d.kind === "notification" ? "Answers land on the Goal: read them with claim_goal or get_goal. Do not poll this notification." : d.message
   });
 }
-function threadView(t) {
-  return {
-    parentId: t.parentId,
-    turns: (t.turns ?? []).map((turn) => {
-      const lines2 = turn.role === "user" ? [turn.text ?? ""] : [turn.title ?? "", ...turn.description ?? []];
-      const said = lines2.map((l) => l.trim()).filter((l, i, all) => l && all.indexOf(l) === i).join("\n");
-      return compact({ from: turn.role === "user" ? "person" : "agent", at: turn.at ? at(turn.at) : void 0, said });
-    })
-  };
-}
 function repliesView(r) {
   const deliveries = r.deliveries ?? [];
+  const stalled = r.stalled ?? [];
+  const others = r.stalledOthers ?? [];
   return {
     deliveries: deliveries.map((d) => compact({
       deliveryId: d.deliveryId,
@@ -2775,26 +3067,29 @@ function repliesView(r) {
       openDecisions: d.decisionNeeds.filter((n) => n.state === "open").length || void 0,
       latest: "about" in d ? d.about : void 0
     })),
-    next: deliveries.length ? "Act on a Goal with claim_goal; reread one Delivery in full with contact({deliveryId})." : "Nothing is waiting."
+    // YOUR STALLED WORK (#2257): Goals you own with no progress for three days. Named here so an
+    // agent that reads its replies also sees what it left, and says what to do about each.
+    ...stalled.length ? { stalled } : {},
+    // OTHER AGENTS' STALLED WORK (owner, 2026-09-23): any agent may take it over and close it.
+    ...others.length ? { stalledOthers: others } : {},
+    next: [
+      deliveries.length ? "Act on a Goal with claim_goal; reread one Delivery in full with contact({deliveryId})." : "Nothing is waiting.",
+      ...stalled.length ? [`${stalled.length} of your Goals have had no progress for 3 days: update_goal each with progress, finish it, or cancel it.`] : [],
+      ...others.length ? [`${others.length} of other agents' Goals have gone quiet for 3 days: claim_goal({goalId}) takes one over, then finish or cancel it with update_goal.`] : []
+    ].join(" ")
   };
 }
 async function runTool(name, args, opts) {
   const { waits, signal, ...client } = opts;
   const input = args ?? {};
   switch (name) {
-    case "contact":
-      return deliveryView(await contact(input, { ...client, signal, waits }));
+    case "contact": {
+      const sent = await contact(input, { ...client, signal, waits });
+      return "recorded" in sent ? sent : deliveryView(sent);
+    }
     case "check_replies":
       CheckRepliesSchema.parse(input);
       return repliesView(await checkReplies(client));
-    case "get_thread": {
-      const { parentId } = GetThreadSchema.parse(input);
-      return threadView(await getThread(parentId, client));
-    }
-    case "search_threads": {
-      const { q } = SearchThreadsSchema.parse(input);
-      return searchThreads(q, client);
-    }
     case "create_goal": {
       const goal = CreateGoalToolSchema.parse(input);
       return createGoal({ ...goal, idempotencyKey: goal.idempotencyKey ?? randomUUID4() }, client);
@@ -2892,7 +3187,8 @@ function subscribeRealtime(args) {
   };
 }
 async function subscribeWake(onNudge, opts = {}) {
-  const cfg = await registerDelivery("self_hosted", opts);
+  const { release = true, ...client } = opts;
+  const cfg = await registerDelivery("self_hosted", client);
   const { url, anonKey } = cfg.realtime;
   const channel = wakeChannel(cfg.tokenId);
   const ch = subscribeRealtime({
@@ -2907,18 +3203,42 @@ async function subscribeWake(onNudge, opts = {}) {
     channel,
     close: async () => {
       ch.close();
-      await registerDelivery("poll", opts).catch(() => {
+      if (release) await registerDelivery("poll", client).catch(() => {
       });
     }
   };
 }
+function parseDue(detail, now = /* @__PURE__ */ new Date()) {
+  const tz = machineZone();
+  if (!tz) return null;
+  return parseDelay(detail, tz, now.getTime(), "ring");
+}
+function machineZone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;
+  } catch {
+    return null;
+  }
+}
 
 export {
+  BACKEND_URL,
+  NETWORK_MSG,
+  sessionId,
   isNetworkError,
+  reach,
+  reachAs,
+  AGENT_TOOLS,
+  AGENT_TOOL_NAMES,
+  NotifyRequestSchema,
   sessionSlot,
   agentName,
+  PROTO,
   TOKEN_PATH,
+  KEY_PATH,
   saveToken,
+  updateSlot,
+  slotIdentity,
   sleep,
   readToken,
   listSlots,
@@ -2928,14 +3248,31 @@ export {
   requestCode,
   pollToken,
   UnpairedError,
-  getGoal,
+  ApiError,
   overrideToken,
+  authToken,
+  createGoal,
+  claimGoal,
+  getGoal,
+  updateGoal,
+  AWAIT_WINDOW_MS,
   hatch,
   whoAmI,
   setIdentity,
+  claimSessions,
   heartbeat,
+  registerDelivery,
+  listNotes,
+  listConnections,
+  submitTriage,
+  getTriage,
+  acceptTriage,
+  dismissTriage,
+  repoFromRemote,
+  currentRepo,
   contact,
   checkReplies,
   runTool,
-  subscribeWake
+  subscribeWake,
+  parseDue
 };