@paigy/mcp 0.40.20 → 0.40.21

package/dist/{chunk-6C6CO7H3.js → chunk-2UEIJRRC.js}

@@ -1592,7 +1592,7 @@ var GetGoalSchema = z3.object({
   history: z3.boolean().optional(),
   /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
    *  about this work, each answer attributed to the reader that gave it, and every disagreement
-   *  between two of them named. Off by default; `apps/api/src/goal/diagnose-design.md`. */
+   *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: z3.boolean().optional()
 }).strict();
 var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
@@ -1625,6 +1625,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS = 3 * 6e4;
+var WORKING_MS = 30 * 6e4;
 var ContextSchema = z4.object({
   title: z4.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: z4.array(z4.string().min(1)).describe(
@@ -1695,7 +1696,7 @@ var AttentionSchema = z4.object({
   points: z4.array(z4.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
   blocking: z4.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+  /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
   deadline: z4.string().datetime().nullable().optional()
 });
@@ -1746,7 +1747,7 @@ var NotifyRequestFields = z4.object({
    *  derive agent-side before sealing, so the server only ever shapes plaintext). */
   // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
   // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
   ask: z4.string().min(1).max(1e4).optional().describe(
@@ -1823,7 +1824,7 @@ var UserAnswerSchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("clarify"), chunks: z4.array(z4.string()).min(1) }),
   z4.object({ kind: z4.literal("confirm"), approved: z4.boolean() }),
   z4.object({ kind: z4.literal("turns"), turns: z4.array(TurnSchema).min(1) }),
-  /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+  /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
@@ -1872,7 +1873,7 @@ var AwaitItemSchema = z4.discriminatedUnion("type", [
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
     note: z4.string().optional(),
-    /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+    /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
@@ -1968,10 +1969,11 @@ var AgendaTurnSchema = z4.object({
   agentId: z4.string().optional(),
   select: SelectShapeSchema.optional(),
   options: z4.array(OptionSchema.omit({ id: true })).optional(),
-  /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-   *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-   *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: z4.number().positive().optional(),
+  /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+     paces itself now — a short beat between the sentences of a turn, the longer one at its end
+     (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+     spoken, not where the plan is written, so nothing between the brain and the walk decides
+     anything. A caller's own `beat_s` tuning is what it used to override. */
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -2006,7 +2008,7 @@ var InboxItemSchema = z4.object({
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
   agentStateAt: z4.string().datetime().optional(),
-  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
    *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
    *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
    *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -2067,7 +2069,7 @@ var InboxItemSchema = z4.object({
    *  off the same open list the card came from, so it clears when the Call does. A card is the
    *  backup for a call not taken; while the call has it, the call is where it is answered. */
   onCall: z4.literal(true).optional(),
-  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+  /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
    *  declined, and what the ladder will do next — read off the cron's own row, never computed
    *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
    *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -2098,7 +2100,7 @@ var InboxItemSchema = z4.object({
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
-   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
   blocking: z4.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -2172,9 +2174,16 @@ var UserSettingsSchema = z4.object({
     banner: z4.boolean(),
     push: z4.boolean()
   }),
+  /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+   *  they are an enum on a live column across every account, and the rename is a rename of
+   *  what people read (owner, 2026-09-30). */
   sessionMode: z4.enum(["default", "all_calls", "silent"]),
-  silentPush: z4.boolean(),
-  autoCallback: z4.boolean(),
+  /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
+   *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
+   *  PATCHes the whole settings object and would be refused for sending a key we stopped
+   *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
+   *  its column once no installed build still sends it. */
+  silentPush: z4.boolean().optional(),
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: z4.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
@@ -2185,12 +2194,16 @@ var UserSettingsSchema = z4.object({
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
   voiceMode: z4.enum(["hosted", "on_device"]).optional(),
-  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+  /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
    *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
    *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
    *  object must not silently turn it back on. Absent = leave unchanged on write, true on
    *  read (see store.ts). */
   talk: z4.boolean().optional(),
+  /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+   *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+   *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+  callDiagnostics: z4.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -2199,9 +2212,6 @@ var UserSettingsSchema = z4.object({
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
   voiceTuning: z4.record(z4.string(), z4.union([z4.number(), z4.string()])).optional(),
-  /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-   *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: z4.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -2245,7 +2255,7 @@ var ConnectionSummarySchema = z4.object({
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-   *  apps/api/src/tokens/devices-vs-agents-design.md. */
+   *  docs/server/tokens/devices-vs-agents-design.md. */
   kind: z4.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -2263,7 +2273,7 @@ var ConnectionSummarySchema = z4.object({
    *  user on the agent's own page. null = no ceiling (today's behaviour for every
    *  connection). Android binds importance to a relationship rather than to each message,
    *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema.nullable().optional(),
@@ -2274,7 +2284,14 @@ var ConnectionSummarySchema = z4.object({
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
   lastSeenAt: z4.string().datetime().nullable().optional(),
-  /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+  /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+   *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+   *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+  lastWorkedAt: z4.string().datetime().nullable().optional(),
+  /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+   *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+  oldestReadyAt: z4.string().datetime().nullable().optional(),
+  /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
   runtime: z4.object({
@@ -2282,7 +2299,12 @@ var ConnectionSummarySchema = z4.object({
      *  shows its age here (`apps/desktop/src/update.ts`). */
     version: z4.string().optional(),
     harnesses: z4.array(z4.object({ name: z4.string(), label: z4.string(), status: z4.string() })).optional(),
-    workspaces: z4.array(z4.string()).optional()
+    workspaces: z4.array(z4.string()).optional(),
+    /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+     *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+     *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+     *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+    repos: z4.array(z4.object({ path: z4.string(), remote: z4.string() })).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -2365,7 +2387,7 @@ var QueueQuestionSchema = z4.object({
    *  for a settled question whose reply carried nothing readable. */
   answer: z4.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-   *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+   *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
@@ -2457,7 +2479,19 @@ var QueueItemSchema = z4.object({
     said: z4.string(),
     at: z4.string(),
     entryId: z4.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+   *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+   *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+   *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+   *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  Work tab orders as it did before the migration rather than throwing on the missing key.
+   *
+   *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+   *  minute after the person speaks erases their instant from it, and the durable traces the client
+   *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+   *  Entry with no `about_id` is in neither. */
+  lastPersonAt: z4.string().nullable().optional()
 });
 var COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
 var NoteSourceSchema = z4.enum(["app", "call"]);
@@ -2487,7 +2521,7 @@ var NoteSchema = z4.object({
   assignee: z4.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
   parentId: z4.string().nullable(),
-  /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+  /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
    *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -2749,6 +2783,29 @@ var SnapshotSchema = z4.object({
     computers: z4.array(ComputerRowSchema).nullable()
   }).nullable()
 });
+var CallRecapSchema = z4.object({
+  call: z4.object({
+    status: z4.string(),
+    startedAt: z4.string(),
+    durationMs: z4.number().nullable(),
+    agents: z4.array(z4.object({ id: z4.string(), name: z4.string().nullable() }))
+  }),
+  topics: z4.array(z4.object({
+    goalId: z4.string().uuid(),
+    title: z4.string(),
+    owner: z4.string(),
+    state: z4.string(),
+    questions: z4.array(z4.object({ id: z4.string().uuid(), state: z4.string(), title: z4.string() })),
+    /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+     *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+     *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+     *  own words stay under it. Absent on every line stored before the read wrote them, and on
+     *  anything that is not an answer. */
+    lines: z4.array(z4.object({ entryId: z4.string().uuid(), words: z4.string(), headline: z4.string().optional() }))
+  })),
+  unfiled: z4.array(z4.object({ lineId: z4.string().uuid(), words: z4.string(), atMs: z4.number() })),
+  more: z4.object({ lines: z4.number(), entries: z4.number(), topics: z4.number() })
+});
 function sessionSlot(sessionId2) {
   const id = sessionId2 ?? sessionId();
   return `session:${id.slice(0, 8)}`;

package/dist/{chunk-6MEUSSRH.js → chunk-B7SEHASI.js}

@@ -4,10 +4,10 @@ import {
   serverInstructions,
   sessionStartHook,
   withSessionStartHook
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-OW65TWMX.js";
 import {
   agentName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/toolset.ts
 var ONBOARD_DESCRIPTION = "Get this agent talking to Paigy \u2014 call it FIRST, before contact, and any time you're unsure who you are. One call, and it does whatever the situation needs: NOT SET UP \u2192 hatches an identity instantly if this machine holds a device credential (the user ran the Paigy desktop app or harness), otherwise starts the code ceremony; ALREADY SET UP \u2192 returns your current identity and offers the two things left to decide, renaming it or unpairing; TOKEN NO LONGER VALID \u2192 says so, then re-pairs. Pass { name, voice } to choose who you are when hatching, or to RENAME yourself when already set up (voices: rachel, george, jessica, brian, lily). Safe to call any time: idempotent, and it never writes settings \u2014 the tool-allowlist state it reports is read-only. If it returns a `user_code`, print it to the user immediately and call onboard again with the `device_code`. If it returns `enable_command`, PRINT that command for the user to run \u2014 you cannot apply it yourself (it writes your own permission allowlist, which hosts block as privilege escalation), so print it, don't wait for it, and carry on.";

package/dist/{chunk-YNKTKLQD.js → chunk-LRN27BMO.js}

@@ -6,7 +6,7 @@ import {
   saveToken,
   setIdentity,
   sleep
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/identity.ts
 var CLIENT_LABELS = {

package/dist/{chunk-RLN2B5IZ.js → chunk-OW65TWMX.js}

@@ -124,7 +124,7 @@ var GetGoalSchema = z3.object({
   history: z3.boolean().optional(),
   /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
    *  about this work, each answer attributed to the reader that gave it, and every disagreement
-   *  between two of them named. Off by default; `apps/api/src/goal/diagnose-design.md`. */
+   *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: z3.boolean().optional()
 }).strict();
 var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
@@ -149,7 +149,11 @@ HOW TO ASK:
 1. One question per ask. Five questions are five objects in \`asks\`, in one contact, so each can be answered on its own; one question with five parts settles nothing until all five are answered.
 2. Name the Goal you are working on as the ask's \`parentId\`: the question goes onto that Goal and its answer comes back there. Without one, Paigy places it.
 3. \`waiting: hard\` only for a decision you are blocked on; \`waiting: none\` for a question you can keep working around.
-4. Never hold the process open with while-loops. For an open Call with a pending decision, follow its \`next\` with another bounded \`contact({deliveryId})\` tool call; a returned wait window is not a completed conversation. Otherwise, yield only with a working listener or scheduled wakeup, and collect answers with \`check_replies\` or \`claim_goal\` on that wake.`;
+4. Never hold the process open with while-loops. For an open Call with a pending decision, follow its \`next\` with another bounded \`contact({deliveryId})\` tool call; a returned wait window is not a completed conversation. Otherwise, yield only with a working listener or scheduled wakeup, and collect answers with \`check_replies\` or \`claim_goal\` on that wake.
+5. One ask, one row. Never restate a question that is still waiting inside a new contact: keep waiting on the original, or the answer lands on one copy and the other stays open.
+6. Read the Goal's conversation before asking. Never ask again what was answered or already shipped.
+7. A question carries its options. Without them it reaches the person as a bare title nobody can answer.
+8. A diagnosis says when, why and how it happens, then proposes one fix. Never options first.`;
 }
 function entryWords(entry) {
   const content = entry.content;
@@ -167,6 +171,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS = 3 * 6e4;
+var WORKING_MS = 30 * 6e4;
 var ContextSchema = z4.object({
   title: z4.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: z4.array(z4.string().min(1)).describe(
@@ -237,7 +242,7 @@ var AttentionSchema = z4.object({
   points: z4.array(z4.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
   blocking: z4.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+  /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
   deadline: z4.string().datetime().nullable().optional()
 });
@@ -288,7 +293,7 @@ var NotifyRequestFields = z4.object({
    *  derive agent-side before sealing, so the server only ever shapes plaintext). */
   // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
   // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
   ask: z4.string().min(1).max(1e4).optional().describe(
@@ -365,7 +370,7 @@ var UserAnswerSchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("clarify"), chunks: z4.array(z4.string()).min(1) }),
   z4.object({ kind: z4.literal("confirm"), approved: z4.boolean() }),
   z4.object({ kind: z4.literal("turns"), turns: z4.array(TurnSchema).min(1) }),
-  /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+  /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
@@ -414,7 +419,7 @@ var AwaitItemSchema = z4.discriminatedUnion("type", [
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
     note: z4.string().optional(),
-    /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+    /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
@@ -510,10 +515,11 @@ var AgendaTurnSchema = z4.object({
   agentId: z4.string().optional(),
   select: SelectShapeSchema.optional(),
   options: z4.array(OptionSchema.omit({ id: true })).optional(),
-  /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-   *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-   *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: z4.number().positive().optional(),
+  /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+     paces itself now — a short beat between the sentences of a turn, the longer one at its end
+     (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+     spoken, not where the plan is written, so nothing between the brain and the walk decides
+     anything. A caller's own `beat_s` tuning is what it used to override. */
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -548,7 +554,7 @@ var InboxItemSchema = z4.object({
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
   agentStateAt: z4.string().datetime().optional(),
-  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
    *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
    *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
    *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -609,7 +615,7 @@ var InboxItemSchema = z4.object({
    *  off the same open list the card came from, so it clears when the Call does. A card is the
    *  backup for a call not taken; while the call has it, the call is where it is answered. */
   onCall: z4.literal(true).optional(),
-  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+  /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
    *  declined, and what the ladder will do next — read off the cron's own row, never computed
    *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
    *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -640,7 +646,7 @@ var InboxItemSchema = z4.object({
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
-   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
   blocking: z4.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -714,9 +720,16 @@ var UserSettingsSchema = z4.object({
     banner: z4.boolean(),
     push: z4.boolean()
   }),
+  /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+   *  they are an enum on a live column across every account, and the rename is a rename of
+   *  what people read (owner, 2026-09-30). */
   sessionMode: z4.enum(["default", "all_calls", "silent"]),
-  silentPush: z4.boolean(),
-  autoCallback: z4.boolean(),
+  /** DEAD, AND ACCEPTED ANYWAY (#2813). DateNight is inbox-only with no way back, so nothing
+   *  reads this. It stays OPTIONAL rather than deleted because a phone on the old bundle
+   *  PATCHes the whole settings object and would be refused for sending a key we stopped
+   *  wanting — the same trap `voiceMode` below already documents. #2813 drops the field and
+   *  its column once no installed build still sends it. */
+  silentPush: z4.boolean().optional(),
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: z4.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
@@ -727,12 +740,16 @@ var UserSettingsSchema = z4.object({
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
   voiceMode: z4.enum(["hosted", "on_device"]).optional(),
-  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+  /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
    *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
    *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
    *  object must not silently turn it back on. Absent = leave unchanged on write, true on
    *  read (see store.ts). */
   talk: z4.boolean().optional(),
+  /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+   *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+   *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+  callDiagnostics: z4.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -741,9 +758,6 @@ var UserSettingsSchema = z4.object({
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
   voiceTuning: z4.record(z4.string(), z4.union([z4.number(), z4.string()])).optional(),
-  /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-   *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: z4.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -787,7 +801,7 @@ var ConnectionSummarySchema = z4.object({
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-   *  apps/api/src/tokens/devices-vs-agents-design.md. */
+   *  docs/server/tokens/devices-vs-agents-design.md. */
   kind: z4.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -805,7 +819,7 @@ var ConnectionSummarySchema = z4.object({
    *  user on the agent's own page. null = no ceiling (today's behaviour for every
    *  connection). Android binds importance to a relationship rather than to each message,
    *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema.nullable().optional(),
@@ -816,7 +830,14 @@ var ConnectionSummarySchema = z4.object({
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
   lastSeenAt: z4.string().datetime().nullable().optional(),
-  /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+  /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+   *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+   *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+  lastWorkedAt: z4.string().datetime().nullable().optional(),
+  /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+   *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+  oldestReadyAt: z4.string().datetime().nullable().optional(),
+  /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
   runtime: z4.object({
@@ -824,7 +845,12 @@ var ConnectionSummarySchema = z4.object({
      *  shows its age here (`apps/desktop/src/update.ts`). */
     version: z4.string().optional(),
     harnesses: z4.array(z4.object({ name: z4.string(), label: z4.string(), status: z4.string() })).optional(),
-    workspaces: z4.array(z4.string()).optional()
+    workspaces: z4.array(z4.string()).optional(),
+    /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+     *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+     *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+     *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+    repos: z4.array(z4.object({ path: z4.string(), remote: z4.string() })).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -907,7 +933,7 @@ var QueueQuestionSchema = z4.object({
    *  for a settled question whose reply carried nothing readable. */
   answer: z4.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-   *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+   *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
@@ -999,7 +1025,19 @@ var QueueItemSchema = z4.object({
     said: z4.string(),
     at: z4.string(),
     entryId: z4.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+   *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+   *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+   *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+   *  20260930222356 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  Work tab orders as it did before the migration rather than throwing on the missing key.
+   *
+   *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+   *  minute after the person speaks erases their instant from it, and the durable traces the client
+   *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+   *  Entry with no `about_id` is in neither. */
+  lastPersonAt: z4.string().nullable().optional()
 });
 var COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
 var NoteSourceSchema = z4.enum(["app", "call"]);
@@ -1029,7 +1067,7 @@ var NoteSchema = z4.object({
   assignee: z4.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
   parentId: z4.string().nullable(),
-  /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+  /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
    *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -1289,6 +1327,29 @@ var SnapshotSchema = z4.object({
     computers: z4.array(ComputerRowSchema).nullable()
   }).nullable()
 });
+var CallRecapSchema = z4.object({
+  call: z4.object({
+    status: z4.string(),
+    startedAt: z4.string(),
+    durationMs: z4.number().nullable(),
+    agents: z4.array(z4.object({ id: z4.string(), name: z4.string().nullable() }))
+  }),
+  topics: z4.array(z4.object({
+    goalId: z4.string().uuid(),
+    title: z4.string(),
+    owner: z4.string(),
+    state: z4.string(),
+    questions: z4.array(z4.object({ id: z4.string().uuid(), state: z4.string(), title: z4.string() })),
+    /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+     *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+     *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+     *  own words stay under it. Absent on every line stored before the read wrote them, and on
+     *  anything that is not an answer. */
+    lines: z4.array(z4.object({ entryId: z4.string().uuid(), words: z4.string(), headline: z4.string().optional() }))
+  })),
+  unfiled: z4.array(z4.object({ lineId: z4.string().uuid(), words: z4.string(), atMs: z4.number() })),
+  more: z4.object({ lines: z4.number(), entries: z4.number(), topics: z4.number() })
+});
 
 // src/listening.ts
 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/{dist-33DA5X2G.js → dist-VVU24KB2.js}

@@ -55,7 +55,7 @@ import {
   updateGoal,
   updateSlot,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 export {
   AGENT_TOOLS,
   AGENT_TOOL_NAMES,

package/dist/enable.js

@@ -3,9 +3,9 @@ import {
   PAIGY_TOOL_IDS,
   enablePaigyTools,
   installSessionListening
-} from "./chunk-6MEUSSRH.js";
-import "./chunk-RLN2B5IZ.js";
-import "./chunk-6C6CO7H3.js";
+} from "./chunk-B7SEHASI.js";
+import "./chunk-OW65TWMX.js";
+import "./chunk-2UEIJRRC.js";
 
 // src/enable.ts
 function main() {

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-YNKTKLQD.js";
+} from "./chunk-LRN27BMO.js";
 import {
   ENABLE_COMMAND,
   OnboardSchema,
@@ -15,11 +15,11 @@ import {
   SERVER_INSTRUCTIONS,
   TOOLS,
   paigyToolsAllowlisted
-} from "./chunk-6MEUSSRH.js";
+} from "./chunk-B7SEHASI.js";
 import {
   decideListen,
   listenerAlive
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-OW65TWMX.js";
 import {
   clearSurface,
   writeSurface
@@ -39,7 +39,7 @@ import {
   sessionId,
   slotName,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/index.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -50,6 +50,40 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { fileURLToPath } from "url";
 import qrcode from "qrcode-generator";
+
+// src/survive.ts
+function detail(cause) {
+  const stack = cause?.stack;
+  return stack ? stack : String(cause);
+}
+function guardTheProcess(proc, log) {
+  proc.on("unhandledRejection", (reason) => {
+    log(
+      `paigy: a promise failed with nobody waiting \u2014 the server stays up and its tools keep working (${detail(reason)})`
+    );
+  });
+  proc.on("uncaughtException", (error) => {
+    log(
+      `paigy: an error escaped every catch \u2014 the server stays up and its tools keep working (${detail(error)})`
+    );
+  });
+}
+function traceTheTransport(transport2, log) {
+  const theirError = transport2.onerror;
+  transport2.onerror = (error) => {
+    log(`paigy: the stdio stream errored \u2014 the host may be dropping this server (${detail(error)})`);
+    theirError?.(error);
+  };
+  const theirClose = transport2.onclose;
+  transport2.onclose = () => {
+    log(
+      "paigy: the stdio stream closed \u2014 the host dropped this server, so its tools are gone from this session until the host restarts it (in Claude Code: `/mcp paigy reconnect`)"
+    );
+    theirClose?.();
+  };
+}
+
+// src/index.ts
 var JOIN_CAP_MS = 45e3;
 function pairedResult(token, sas, note) {
   clearSurface();
@@ -349,5 +383,7 @@ async function beat() {
 }
 void beat();
 setInterval(() => void beat(), 6e4).unref();
+guardTheProcess(process, (line) => console.error(line));
 var transport = new StdioServerTransport();
+traceTheTransport(transport, (line) => console.error(line));
 await server.connect(transport);

package/dist/listen.js

@@ -3,7 +3,7 @@ import {
   entryWords,
   removeListenMark,
   writeListenMark
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-OW65TWMX.js";
 import {
   agentName,
   checkReplies,
@@ -11,7 +11,7 @@ import {
   getGoal,
   slotName,
   subscribeWake
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/listen.ts
 import { spawn } from "child_process";

package/dist/onboard.js

@@ -3,13 +3,13 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-YNKTKLQD.js";
+} from "./chunk-LRN27BMO.js";
 import {
   autoConfigureClients,
   claudeInstallHint,
   openBrowser
-} from "./chunk-6MEUSSRH.js";
-import "./chunk-RLN2B5IZ.js";
+} from "./chunk-B7SEHASI.js";
+import "./chunk-OW65TWMX.js";
 import {
   TOKEN_PATH,
   agentName,
@@ -20,7 +20,7 @@ import {
   saveToken,
   setIdentity,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/onboard.ts
 function reportRegistered() {

package/dist/slot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   agentName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/slot.ts
 process.stdout.write(agentName());

package/dist/stalled.js

@@ -29,7 +29,7 @@ async function main() {
   const dir = join(homedir(), ".paigy", "stalled-reminded");
   const mark = join(dir, `${session || "session"}-${day}`);
   if (existsSync(mark)) return;
-  const { checkReplies } = await import("./dist-33DA5X2G.js");
+  const { checkReplies } = await import("./dist-VVU24KB2.js");
   const reply = stopReply((await checkReplies()).stalled ?? [], input.hook_event_name ?? "Stop");
   if (!reply) return;
   mkdirSync(dir, { recursive: true });

package/dist/statusline.js

@@ -7,7 +7,7 @@ import {
   readToken,
   sessionSlot,
   slotName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-2UEIJRRC.js";
 
 // src/statusline.ts
 import { realpathSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paigy/mcp",
-  "version": "0.40.20",
+  "version": "0.40.21",
   "description": "Paigy MCP server — the AI agent harness that calls you. Lets an agent notify a user and await their reply.",
   "license": "MIT",
   "type": "module",