@paigy/mcp 0.40.20 → 0.40.22

package/dist/{chunk-6MEUSSRH.js → chunk-2ED4GL4N.js}

@@ -4,10 +4,10 @@ import {
   serverInstructions,
   sessionStartHook,
   withSessionStartHook
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-WDZ67U4G.js";
 import {
   agentName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/toolset.ts
 var ONBOARD_DESCRIPTION = "Get this agent talking to Paigy \u2014 call it FIRST, before contact, and any time you're unsure who you are. One call, and it does whatever the situation needs: NOT SET UP \u2192 hatches an identity instantly if this machine holds a device credential (the user ran the Paigy desktop app or harness), otherwise starts the code ceremony; ALREADY SET UP \u2192 returns your current identity and offers the two things left to decide, renaming it or unpairing; TOKEN NO LONGER VALID \u2192 says so, then re-pairs. Pass { name, voice } to choose who you are when hatching, or to RENAME yourself when already set up (voices: rachel, george, jessica, brian, lily). Safe to call any time: idempotent, and it never writes settings \u2014 the tool-allowlist state it reports is read-only. If it returns a `user_code`, print it to the user immediately and call onboard again with the `device_code`. If it returns `enable_command`, PRINT that command for the user to run \u2014 you cannot apply it yourself (it writes your own permission allowlist, which hosts block as privilege escalation), so print it, don't wait for it, and carry on.";

package/dist/{chunk-YNKTKLQD.js → chunk-BFN2GJ42.js}

@@ -6,7 +6,7 @@ import {
   saveToken,
   setIdentity,
   sleep
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/identity.ts
 var CLIENT_LABELS = {

package/dist/{chunk-6C6CO7H3.js → chunk-KSXJCZ2L.js}

@@ -1527,7 +1527,20 @@ var AskInputSchema = z2.object({
   ask: z2.string().trim().min(1).max(1e4).describe(
     "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
   ),
-  options: z2.array(OptionInputSchema).min(1).max(6).optional()
+  options: z2.array(OptionInputSchema).min(1).max(6).optional(),
+  // A CHECKLIST WHEN THE CHOICES ARE INDEPENDENT (owner, 2026-10-02 01:44 UTC: "bring back the
+  // checklist mode of answering"). The answer shape was taken off this surface with the wire form
+  // (#575) on the promise that Paigy would derive it, and the Goal-scoped contact that replaced it
+  // only ever sends pick-one or words (`goal/intake.ts` `answerOf`): three independent fixes went out
+  // as "All three / 1 and 3 only / Just log it", which the person could not read without the text and
+  // could not answer as the ticks he wanted. "many" is the one shape an agent knows and the read does
+  // not: whether its own options exclude each other.
+  select: z2.enum(["one", "many"]).optional().describe(
+    'How the options are answered: "one" (default) to pick one, "many" to tick any number of them. Use "many" when the options are independent things they may want several of \u2014 never combinations of them like "all three" or "1 and 3". Ignored without options.'
+  ),
+  answers: z2.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/).optional().describe(
+    "Your reply answers a question the person asked you: the id the conversation shows for it (8 characters or whole). Their question closes with this reply as its answer, and any decision of yours it was holding back goes back to them. Needs parentId: the Goal the question is on. The reply is sent to them as it is; to also ask something new, send that as its own ask."
+  )
 }).strict();
 var StartContactSchema = z2.object({
   asks: z2.array(AskInputSchema).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
@@ -1536,7 +1549,7 @@ var StartContactSchema = z2.object({
 }).strict();
 var ContactSchema = z2.union([StartContactSchema, z2.object({ deliveryId: z2.string().uuid() }).strict()]);
 var CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
+var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'select', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. Each option's label must stand on its own \u2014 the person may see only the labels \u2014 so never a label that points into your text ('All three', 'Option 2', '1 and 3 only'); when the options are independent and they may want several, pass select:'many' and they get a checklist. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
 var CreateGoalSchema = z3.object({
   outcome: z3.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -1592,11 +1605,11 @@ var GetGoalSchema = z3.object({
   history: z3.boolean().optional(),
   /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
    *  about this work, each answer attributed to the reader that gave it, and every disagreement
-   *  between two of them named. Off by default; `apps/api/src/goal/diagnose-design.md`. */
+   *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: z3.boolean().optional()
 }).strict();
-var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
-var UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. A question in that conversation reads `open` (nothing yet), `answered` (a choice was made, and `answer` carries it), `replied` (they said something and the read settled the question on their words \u2014 NO option of yours was chosen, and the words are the reply line beside it, so read that before you act), or `closed`. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+var UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. A CONTACT ON THIS GOAL MOVES ITS REVISION: a question filed on a Goal is a change to it, so an update prepared before a contact and sent after it is refused as stale (409 goal_revision_conflict) \u2014 re-read the Goal, then write. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
 var CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
 var CHECK_REPLIES_DESCRIPTION = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
 var CheckRepliesSchema = z3.object({}).strict();
@@ -1625,6 +1638,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS = 3 * 6e4;
+var WORKING_MS = 30 * 6e4;
 var ContextSchema = z4.object({
   title: z4.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: z4.array(z4.string().min(1)).describe(
@@ -1651,6 +1665,13 @@ var TransformSchema = z4.enum([
   "summarize"
   // reduce volume, keep decision value — 30-turn cap, spoken briefing
 ]);
+function participantRef(p) {
+  return `${p.kind}:${p.id}`;
+}
+var PAIGY_SELF = { kind: "agent", id: "paigy" };
+function isPaigy(ref) {
+  return ref === participantRef(PAIGY_SELF);
+}
 var VisualSchema = z4.object({
   url: z4.string().url(),
   label: z4.string().optional()
@@ -1695,7 +1716,7 @@ var AttentionSchema = z4.object({
   points: z4.array(z4.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
   blocking: z4.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+  /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
   deadline: z4.string().datetime().nullable().optional()
 });
@@ -1746,7 +1767,7 @@ var NotifyRequestFields = z4.object({
    *  derive agent-side before sealing, so the server only ever shapes plaintext). */
   // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
   // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
   ask: z4.string().min(1).max(1e4).optional().describe(
@@ -1823,7 +1844,7 @@ var UserAnswerSchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("clarify"), chunks: z4.array(z4.string()).min(1) }),
   z4.object({ kind: z4.literal("confirm"), approved: z4.boolean() }),
   z4.object({ kind: z4.literal("turns"), turns: z4.array(TurnSchema).min(1) }),
-  /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+  /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
@@ -1872,7 +1893,7 @@ var AwaitItemSchema = z4.discriminatedUnion("type", [
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
     note: z4.string().optional(),
-    /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+    /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
@@ -1968,10 +1989,11 @@ var AgendaTurnSchema = z4.object({
   agentId: z4.string().optional(),
   select: SelectShapeSchema.optional(),
   options: z4.array(OptionSchema.omit({ id: true })).optional(),
-  /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-   *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-   *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: z4.number().positive().optional(),
+  /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+     paces itself now — a short beat between the sentences of a turn, the longer one at its end
+     (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+     spoken, not where the plan is written, so nothing between the brain and the walk decides
+     anything. A caller's own `beat_s` tuning is what it used to override. */
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -2006,7 +2028,7 @@ var InboxItemSchema = z4.object({
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
   agentStateAt: z4.string().datetime().optional(),
-  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
    *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
    *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
    *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -2067,7 +2089,7 @@ var InboxItemSchema = z4.object({
    *  off the same open list the card came from, so it clears when the Call does. A card is the
    *  backup for a call not taken; while the call has it, the call is where it is answered. */
   onCall: z4.literal(true).optional(),
-  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+  /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
    *  declined, and what the ladder will do next — read off the cron's own row, never computed
    *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
    *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -2098,7 +2120,7 @@ var InboxItemSchema = z4.object({
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
-   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
   blocking: z4.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -2172,9 +2194,17 @@ var UserSettingsSchema = z4.object({
     banner: z4.boolean(),
     push: z4.boolean()
   }),
+  /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+   *  they are an enum on a live column across every account, and the rename is a rename of
+   *  what people read (owner, 2026-09-30). */
   sessionMode: z4.enum(["default", "all_calls", "silent"]),
-  silentPush: z4.boolean(),
-  autoCallback: z4.boolean(),
+  /** `silentPush` lived here until #2813 and is now GONE, field and column both. It was kept as an
+   *  optional long after DateNight stopped reading it, on the theory that a phone on an older
+   *  bundle PATCHing the whole settings object would be REFUSED for sending a key we had stopped
+   *  wanting. That theory was wrong about this schema: these are plain `z.object`s with no
+   *  `.strict()` anywhere in this file, and zod STRIPS unknown keys rather than rejecting them, so
+   *  an old bundle's `silentPush` is accepted and ignored. Worth remembering before keeping the
+   *  next dead field for the same reason. */
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: z4.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
@@ -2185,12 +2215,16 @@ var UserSettingsSchema = z4.object({
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
   voiceMode: z4.enum(["hosted", "on_device"]).optional(),
-  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+  /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
    *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
    *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
    *  object must not silently turn it back on. Absent = leave unchanged on write, true on
    *  read (see store.ts). */
   talk: z4.boolean().optional(),
+  /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+   *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+   *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+  callDiagnostics: z4.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -2199,9 +2233,6 @@ var UserSettingsSchema = z4.object({
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
   voiceTuning: z4.record(z4.string(), z4.union([z4.number(), z4.string()])).optional(),
-  /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-   *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: z4.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -2245,7 +2276,7 @@ var ConnectionSummarySchema = z4.object({
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-   *  apps/api/src/tokens/devices-vs-agents-design.md. */
+   *  docs/server/tokens/devices-vs-agents-design.md. */
   kind: z4.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -2263,7 +2294,7 @@ var ConnectionSummarySchema = z4.object({
    *  user on the agent's own page. null = no ceiling (today's behaviour for every
    *  connection). Android binds importance to a relationship rather than to each message,
    *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema.nullable().optional(),
@@ -2274,7 +2305,14 @@ var ConnectionSummarySchema = z4.object({
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
   lastSeenAt: z4.string().datetime().nullable().optional(),
-  /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+  /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+   *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+   *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+  lastWorkedAt: z4.string().datetime().nullable().optional(),
+  /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+   *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+  oldestReadyAt: z4.string().datetime().nullable().optional(),
+  /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
   runtime: z4.object({
@@ -2282,7 +2320,12 @@ var ConnectionSummarySchema = z4.object({
      *  shows its age here (`apps/desktop/src/update.ts`). */
     version: z4.string().optional(),
     harnesses: z4.array(z4.object({ name: z4.string(), label: z4.string(), status: z4.string() })).optional(),
-    workspaces: z4.array(z4.string()).optional()
+    workspaces: z4.array(z4.string()).optional(),
+    /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+     *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+     *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+     *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+    repos: z4.array(z4.object({ path: z4.string(), remote: z4.string() })).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -2295,7 +2338,8 @@ var ConnectionSummarySchema = z4.object({
 });
 var LedgerItemSchema = z4.object({ id: z4.string(), parentId: z4.string(), title: z4.string(), createdAt: z4.string() });
 var AgentLedgerSchema = z4.object({
-  agent: z4.object({ id: z4.string(), name: z4.string(), revokedAt: z4.string().nullable() }),
+  /** Null when the agent has not named itself yet — never a placeholder (owner, 2026-10-01). */
+  agent: z4.object({ id: z4.string(), name: z4.string().nullable(), revokedAt: z4.string().nullable() }),
   /** Its own questions you have not answered. */
   asks: z4.array(LedgerItemSchema),
   /** Its questions you answered that nobody acted on — still owed to somebody. */
@@ -2365,7 +2409,7 @@ var QueueQuestionSchema = z4.object({
    *  for a settled question whose reply carried nothing readable. */
   answer: z4.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-   *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+   *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
@@ -2457,7 +2501,19 @@ var QueueItemSchema = z4.object({
     said: z4.string(),
     at: z4.string(),
     entryId: z4.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+   *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+   *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+   *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+   *  20261001030911 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  Work tab orders as it did before the migration rather than throwing on the missing key.
+   *
+   *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+   *  minute after the person speaks erases their instant from it, and the durable traces the client
+   *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+   *  Entry with no `about_id` is in neither. */
+  lastPersonAt: z4.string().nullable().optional()
 });
 var COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
 var NoteSourceSchema = z4.enum(["app", "call"]);
@@ -2487,7 +2543,7 @@ var NoteSchema = z4.object({
   assignee: z4.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
   parentId: z4.string().nullable(),
-  /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+  /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
    *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -2749,6 +2805,31 @@ var SnapshotSchema = z4.object({
     computers: z4.array(ComputerRowSchema).nullable()
   }).nullable()
 });
+var CallRecapSchema = z4.object({
+  call: z4.object({
+    status: z4.string(),
+    startedAt: z4.string(),
+    durationMs: z4.number().nullable(),
+    agents: z4.array(z4.object({ id: z4.string(), name: z4.string().nullable() }))
+  }),
+  topics: z4.array(z4.object({
+    goalId: z4.string().uuid(),
+    title: z4.string(),
+    owner: z4.string(),
+    state: z4.string(),
+    questions: z4.array(z4.object({ id: z4.string().uuid(), state: z4.string(), title: z4.string() })),
+    /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+     *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+     *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+     *  own words stay under it. Absent on every line stored before the read wrote them, and on
+     *  anything that is not an answer. */
+    /** `about` is the request the line answered (its question), null for words that answered none —
+     *  the key the screen groups on, so one question is one row however many times it was answered. */
+    lines: z4.array(z4.object({ entryId: z4.string().uuid(), words: z4.string(), headline: z4.string().optional(), about: z4.string().nullable().optional() }))
+  })),
+  unfiled: z4.array(z4.object({ lineId: z4.string().uuid(), words: z4.string(), atMs: z4.number() })),
+  more: z4.object({ lines: z4.number(), entries: z4.number(), topics: z4.number() })
+});
 function sessionSlot(sessionId2) {
   const id = sessionId2 ?? sessionId();
   return `session:${id.slice(0, 8)}`;
@@ -2996,6 +3077,22 @@ async function claimSessions(opts = {}) {
   if (!res.ok) throw new Error(`claim_sessions failed: ${res.status}`);
   return (await res.json()).sessions;
 }
+async function claimSessionEnds(opts = {}) {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/ends/claim`, {
+    headers: { authorization: `Bearer ${authToken(opts.token)}` }
+    // the HOST's identity
+  }));
+  if (!res.ok) throw new Error(`claim_session_ends failed: ${res.status}`);
+  return (await res.json()).ends ?? [];
+}
+async function finishSessionEnd(endId, result, opts = {}) {
+  const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/sessions/ends/${encodeURIComponent(endId)}`, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${authToken(opts.token)}` },
+    body: JSON.stringify({ result })
+  }));
+  if (!res.ok) await fail("finish_session_end", res);
+}
 async function recordDecision(decision, opts = {}) {
   const res = await ensureAuthed(await reach(`${BACKEND_URL}/api/host/decisions`, {
     method: "POST",
@@ -3119,7 +3216,9 @@ async function contact(input, opts = {}) {
       // this cannot see.
       repo: repoFromRemote(a.repo) ?? a.repo ?? currentRepo() ?? void 0,
       ask: a.ask,
-      options: a.options ?? []
+      options: a.options ?? [],
+      ...a.select ? { select: a.select } : {},
+      ...a.answers ? { answers: a.answers } : {}
     }));
     const res = await ensureAuthed(await send2(`${BACKEND_URL}/api/goals/contact`, {
       method: "POST",
@@ -3184,7 +3283,7 @@ async function checkReplies(opts = {}) {
 function compact(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0 && v !== null && v !== "" && !(Array.isArray(v) && v.length === 0)));
 }
-var who = (participant) => participant.startsWith("human:") ? "person" : participant.startsWith("agent:") ? "agent" : participant;
+var who = (participant) => participant.startsWith("human:") ? "person" : isPaigy(participant) ? "paigy" : participant.startsWith("agent:") ? "agent" : participant;
 var at = (iso) => {
   const t = Date.parse(iso);
   return Number.isFinite(t) ? new Date(t).toISOString().replace(/\.\d{3}Z$/, "Z") : iso;
@@ -3204,6 +3303,9 @@ function decided(result) {
       return void 0;
   }
 }
+function stateOf(state, answer, decided2) {
+  return state === "answered" && answer && decided2 === void 0 ? "replied" : state;
+}
 var handle = (entryId) => entryId.slice(0, 8);
 function conversation(e) {
   const answers = new Map((e.answers ?? []).map((a) => [a.decisionNeedId, a]));
@@ -3216,14 +3318,15 @@ function conversation(e) {
     const need = (e.decisionNeeds ?? []).find((n) => n.requestEntryId === entry.entryId);
     const answer = need ? answers.get(need.decisionNeedId) : void 0;
     const decision = answer ? decided(answer.result) : void 0;
+    const owed = need?.state === "open" && entry.authorParticipant.startsWith("human:");
     return compact({
-      id: repliedTo.has(entry.entryId) ? handle(entry.entryId) : void 0,
+      id: repliedTo.has(entry.entryId) || owed ? handle(entry.entryId) : void 0,
       from: who(entry.authorParticipant),
       at: at(entry.createdAt),
       said: sealed ? "[encrypted]" : entryWords(entry).trim(),
       re: entry.aboutId && shown.has(entry.aboutId) ? handle(entry.aboutId) : void 0,
       options,
-      decision: need ? compact({ state: need.state, answer: decision }) : void 0
+      decision: need ? compact({ state: stateOf(need.state, answer, decision), answer: decision }) : void 0
     });
   });
 }
@@ -3239,7 +3342,9 @@ function more(g) {
 function goalView(g) {
   if (!g.goalId) return compact({ state: g.state, next: g.message });
   const lines2 = conversation(g);
-  const newest = [...lines2].reverse().find((l) => l.from !== "person");
+  const owed = lines2.filter((l) => l.from === "person" && l.decision?.state === "open" && l.id);
+  const owes = owed.length ? `The person asked you ${owed.length === 1 ? "a question" : `${owed.length} questions`} (${owed.map((l) => `id ${l.id}: "${l.said.slice(0, 80)}"`).join("; ")}) \u2014 answer with contact({ asks: [{ ask: <your answer>, parentId: "${g.goalId}", answers: "<id>" }] }). ` : "";
+  const newest = [...lines2].reverse().find((l) => l.from === "agent");
   return compact({
     goalId: g.goalId,
     revision: g.revision,
@@ -3263,7 +3368,7 @@ function goalView(g) {
     dueAt: g.dueAt,
     leaseExpiresAt: g.leaseExpiresAt,
     conversation: lines2,
-    next: g.message,
+    next: owes ? `${owes}${g.message ?? ""}`.trim() : g.message,
     more: more(g)
   });
 }
@@ -3283,7 +3388,7 @@ function deliveryView(d) {
     notSent: d.notSent,
     joinedCard: d.joinedCard,
     joinedCall: d.joinedCall,
-    next: d.joinedCall ? `${JOINED_CALL}${d.message ? ` ${d.message}` : ""}` : d.kind === "notification" ? d.joinedCard ? `Added to the open report card on its Goal; no new push was sent. ${answers}` : answers : d.state === "open" && d.decisionNeeds.some((n) => n.state === "open") ? `Decision pending. Call contact(${JSON.stringify({ deliveryId: d.deliveryId })}) now to continue this same Call; do not resend the ask or end your turn merely because this wait window returned. ${d.message ?? ""}`.trim() : d.message
+    next: d.joinedCall ? `${JOINED_CALL}${d.message ? ` ${d.message}` : ""}` : d.kind === "notification" ? d.joinedCard ? `Added to the open report card on its Goal; no new push was sent. ${answers}` : answers : d.state === "open" && d.decisionNeeds.some((n) => n.state === "open") ? `Decision pending. Call contact(${JSON.stringify({ deliveryId: d.deliveryId })}) to continue this same Call \u2014 each call is ONE bounded window, and never resend the ask. When a window comes back with nothing new said, they are not typing: stop rereading, leave the question open, and collect the answer with check_replies or claim_goal on your next wake. ${d.message ?? ""}`.trim() : d.message
   });
 }
 function repliesView(r) {
@@ -3590,6 +3695,8 @@ export {
   NameTakenError,
   setIdentity,
   claimSessions,
+  claimSessionEnds,
+  finishSessionEnd,
   recordDecision,
   heartbeat,
   registerDelivery,

package/dist/{chunk-RLN2B5IZ.js → chunk-WDZ67U4G.js}

@@ -59,7 +59,20 @@ var AskInputSchema = z2.object({
   ask: z2.string().trim().min(1).max(1e4).describe(
     "ONE question, and only what is needed to answer it. Several questions are several asks in the array, one each: an answer settles the one ask it was given in the shape that ask declares, so a person who answers the part of a bundled ask that interested them settles nothing and is asked again. Paigy reads every ask once and takes a bundled one apart into its own cards anyway \u2014 each question a Question on the one Goal the ask lands on, never a Goal of its own \u2014 but the words it splits are its reading, not yours. News, progress and findings are their own contact; ANY contact for a person already on a call JOINS that call, whatever channel you asked for, so several arrive as one call."
   ),
-  options: z2.array(OptionInputSchema).min(1).max(6).optional()
+  options: z2.array(OptionInputSchema).min(1).max(6).optional(),
+  // A CHECKLIST WHEN THE CHOICES ARE INDEPENDENT (owner, 2026-10-02 01:44 UTC: "bring back the
+  // checklist mode of answering"). The answer shape was taken off this surface with the wire form
+  // (#575) on the promise that Paigy would derive it, and the Goal-scoped contact that replaced it
+  // only ever sends pick-one or words (`goal/intake.ts` `answerOf`): three independent fixes went out
+  // as "All three / 1 and 3 only / Just log it", which the person could not read without the text and
+  // could not answer as the ticks he wanted. "many" is the one shape an agent knows and the read does
+  // not: whether its own options exclude each other.
+  select: z2.enum(["one", "many"]).optional().describe(
+    'How the options are answered: "one" (default) to pick one, "many" to tick any number of them. Use "many" when the options are independent things they may want several of \u2014 never combinations of them like "all three" or "1 and 3". Ignored without options.'
+  ),
+  answers: z2.string().trim().regex(/^[0-9a-fA-F-]{8,36}$/).optional().describe(
+    "Your reply answers a question the person asked you: the id the conversation shows for it (8 characters or whole). Their question closes with this reply as its answer, and any decision of yours it was holding back goes back to them. Needs parentId: the Goal the question is on. The reply is sent to them as it is; to also ask something new, send that as its own ask."
+  )
 }).strict();
 var StartContactSchema = z2.object({
   asks: z2.array(AskInputSchema).min(1).describe("The questions to pose, one per object. An ask with a parentId is filed on that Goal as it is; only an ask naming no Goal is placed in the tree by Paigy."),
@@ -68,7 +81,7 @@ var StartContactSchema = z2.object({
 }).strict();
 var ContactSchema = z2.union([StartContactSchema, z2.object({ deliveryId: z2.string().uuid() }).strict()]);
 var CONTACT_SCHEMA = { type: "object", ...mcpInputSchema(ContactSchema) };
-var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
+var CONTACT_DESCRIPTION = "Contact the user with one or more asks/questions. Pass an array of asks (each with 'ask', optional 'options', 'select', 'id', 'parentId', 'repo'), plus channel:'notification'|'call', and waiting:'none'|'hard'. An ask that names a Goal (parentId) goes onto that Goal; one that names none is placed in the person's tree by Paigy. Notification returns immediately; collect durable answers with check_replies. On stdio, a Call holds one cancellable ~45s window; continue with ONLY {deliveryId}. One question per 'ask'; several questions are several objects in 'asks'. A bundled ask is taken apart into its own cards by Paigy's one intake read, every one on the Goal the ask lands on; separate pieces of work are separate asks. An ask with no options that is not blocking is a report, and a report is an UPDATE, never a claim on them: it reaches them and is listed apart from what waits on them, so no answer is owed and none should be awaited. On a Goal whose report card is still open it is added to that card, with no new push; one that only says where your work stands while under way is recorded as the Goal's progress, not sent (the result says so). Send options (or waiting:'hard') when you actually need an answer. Each option's label must stand on its own \u2014 the person may see only the labels \u2014 so never a label that points into your text ('All three', 'Option 2', '1 and 3 only'); when the options are independent and they may want several, pass select:'many' and they get a checklist. If the person is already on a call, your contact joins that call automatically \u2014 whatever channel you asked for, with no ring \u2014 and the Delivery it returns IS that call: reread it with contact({deliveryId}) to see everything answered on it so far, and contact again while it is live to add information or a further question to the same call.";
 var CreateGoalSchema = z3.object({
   outcome: z3.string().trim().min(1).max(1e4),
   /** The work's NAME (#2115) — one to five words, how a person refers to it out loud ("the night
@@ -124,11 +137,11 @@ var GetGoalSchema = z3.object({
   history: z3.boolean().optional(),
   /** WHEN A READ HAS CONFUSED YOU. Adds `diagnosis`: every reader that already answers a question
    *  about this work, each answer attributed to the reader that gave it, and every disagreement
-   *  between two of them named. Off by default; `apps/api/src/goal/diagnose-design.md`. */
+   *  between two of them named. Off by default; `docs/model/goal/diagnose-design.md`. */
   diagnose: z3.boolean().optional()
 }).strict();
-var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
-var UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
+var GET_GOAL_DESCRIPTION = "Read one Goal without claiming it: its outcome, state, revision, progress, blockers, the conversation on it (each question with its options and what was decided), `next`, the one step to take, and `more`, where to read further. A question in that conversation reads `open` (nothing yet), `answered` (a choice was made, and `answer` carries it), `replied` (they said something and the read settled the question on their words \u2014 NO option of yours was chosen, and the words are the reply line beside it, so read that before you act), or `closed`. The conversation carries everything the person said, every open question and your newest entry; your older entries are left out and counted \u2014 history: true reads every entry in full. Another account's Goals, and another agent's Goal that is not below one of yours, are not disclosed.\n\ndiagnose: true is for when a read has CONFUSED you \u2014 not for the working loop. It adds `diagnosis`, which asks every reader that already answers a question about your work and NAMES the reader behind every value, so you never guess which of two places to look: what state your work is really in (the stored `goals.state` beside the derived `goal_execution_state`, which can differ); whether anything is armed to ring and when (`ladder_candidates`, with the ladder's own last decision); whether a wake fired for you and what it did (durable `wake.*` events, beside when your process was last heard from); and what has reached you (`list_waiting` \u2014 review flags, unstarted work, open questions, the person's newest words). Read `diagnosis.disagreements` FIRST: each one is two readers giving different values for the same fact, with both values and both sources, and it never chooses between them \u2014 that is yours to do, from the Goal's own history. `diagnosis.looked` names every reader asked, including any that could not answer, so an empty answer is never confused with a broken one.";
+var UPDATE_GOAL_DESCRIPTION = `Update an owned Goal at an exact revision. State, ownership, dependencies, children, progress, title, and review acknowledgement are explicit; stale revisions are rejected. A CONTACT ON THIS GOAL MOVES ITS REVISION: a question filed on a Goal is a change to it, so an update prepared before a contact and sent after it is refused as stale (409 goal_revision_conflict) \u2014 re-read the Goal, then write. title is the work's name in one to five words, as a person would refer to it out loud (it is spoken on a call and heads every list); null clears it. reviewed: true acknowledges new evidence and closes the Deliveries addressed to you on that Goal, never over an open decision. dueAt (an ISO instant, or null) makes the Goal wait until then; when it passes you are woken for it \u2014 use it for a promise to follow up later. withdraw: [questionId] takes back a question YOU asked on this Goal that is still open \u2014 because you acted on it yourself, it no longer matters, or you asked it wrongly (e.g. waiting: hard when nothing was blocked): it is cancelled, not answered, its card closes and it stops ringing; the id is the one the conversation shows. state: done means the work was accomplished, and it can be reopened: when the person says it is not done ("it's not working"), set state: active on that same Goal instead of starting a new one; its parent reopens with it. state: done while children are still open records your part as done: the Goal waits and closes by itself when its last open child closes. cancelled is final. Returns the Goal as get_goal reads it, at its new revision.`;
 var CLAIM_GOAL_DESCRIPTION = "Claim the oldest runnable or review-pending Goal you own, or pass goalId to claim that Goal. Another agent's Goal that has gone quiet for 3 days (check_replies lists them as stalledOthers) is taken over when you claim it, and becomes yours to finish or cancel. Returns the Goal as get_goal reads it, and creates or renews the execution lease.";
 var CHECK_REPLIES_DESCRIPTION = "What is waiting for you: your open Deliveries (a request the user started toward you, a handoff), one row each with its Goals, how many decisions are still open, and the newest words in brief; `assigned`, your Goals nobody has started yet, however they became yours (claim_goal({goalId}) starts one); and `review`, your Goals with something new on them \u2014 the user's answers and notes are Entries on the Goal, not Deliveries. A pure read with no arguments: nothing is consumed, acknowledged or claimed by reading it, so call it on startup, after a long wait, or whenever you want to know what is outstanding. To act on one, claim its Goal (claim_goal) or reread a Delivery in full with contact({deliveryId}). Once you have acted on what arrived, update_goal with reviewed: true clears the Goal from `review` and closes the Deliveries addressed to you on it.";
 var CheckRepliesSchema = z3.object({}).strict();
@@ -149,7 +162,11 @@ HOW TO ASK:
 1. One question per ask. Five questions are five objects in \`asks\`, in one contact, so each can be answered on its own; one question with five parts settles nothing until all five are answered.
 2. Name the Goal you are working on as the ask's \`parentId\`: the question goes onto that Goal and its answer comes back there. Without one, Paigy places it.
 3. \`waiting: hard\` only for a decision you are blocked on; \`waiting: none\` for a question you can keep working around.
-4. Never hold the process open with while-loops. For an open Call with a pending decision, follow its \`next\` with another bounded \`contact({deliveryId})\` tool call; a returned wait window is not a completed conversation. Otherwise, yield only with a working listener or scheduled wakeup, and collect answers with \`check_replies\` or \`claim_goal\` on that wake.`;
+4. Never hold the process open with while-loops. For an open Call with a pending decision, follow its \`next\` with another bounded \`contact({deliveryId})\` tool call; a returned wait window is not a completed conversation. STOP REREADING when a window comes back with nothing new said \u2014 they are not typing, the question stays open, and its answer reaches you on the Goal. Otherwise, yield only with a working listener or scheduled wakeup, and collect answers with \`check_replies\` or \`claim_goal\` on that wake.
+5. One ask, one row. Never restate a question that is still waiting inside a new contact: keep waiting on the original, or the answer lands on one copy and the other stays open.
+6. Read the Goal's conversation before asking. Never ask again what was answered or already shipped \u2014 and tell its states apart: \`answered\` carries the choice in \`answer\`, while \`replied\` means they said something and chose none of your options, so that question is still yours to settle and their words are the line beside it.
+7. A question carries its options. Without them it reaches the person as a bare title nobody can answer. Each option names its choice in full -- never \`All three\` or \`Option 2\` -- and options they may want several of are \`select: "many"\`, a checklist.
+8. A diagnosis says when, why and how it happens, then proposes one fix. Never options first.`;
 }
 function entryWords(entry) {
   const content = entry.content;
@@ -167,6 +184,7 @@ function entryWords(entry) {
   return entry.sources.map((source) => source.text).join("\n");
 }
 var LIVE_MS = 3 * 6e4;
+var WORKING_MS = 30 * 6e4;
 var ContextSchema = z4.object({
   title: z4.string().min(1).describe("One-line headline of what you need (required, non-empty)."),
   description: z4.array(z4.string().min(1)).describe(
@@ -237,7 +255,7 @@ var AttentionSchema = z4.object({
   points: z4.array(z4.string()).nullable(),
   /** Whether the ask blocks the sender — what lets arbitration escalate it on silence. */
   blocking: z4.boolean(),
-  /** Reserved (MODEL.md lists it): a response deadline. No row column yet — a later Phase 2
+  /** Reserved (docs/model/model.md lists it): a response deadline. No row column yet — a later Phase 2
    *  slice wires it; optional so today's rows/callers project cleanly. */
   deadline: z4.string().datetime().nullable().optional()
 });
@@ -288,7 +306,7 @@ var NotifyRequestFields = z4.object({
    *  derive agent-side before sealing, so the server only ever shapes plaintext). */
   // 10k, not a sentence budget. What the human hears is bounded by the BROKER — it splits
   // the ask into topics and gives each one at most three sentences and one question
-  // (broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
+  // (docs/brain/broker/agenda-design.md) — not by a wire cap the agent has to pre-summarize under.
   // Owner, 2026-07-28: "our actual limitation on how long something is to the user should
   // come from the broker splitting and summarizing." The cap that remains is a size guard.
   ask: z4.string().min(1).max(1e4).optional().describe(
@@ -365,7 +383,7 @@ var UserAnswerSchema = z4.discriminatedUnion("kind", [
   z4.object({ kind: z4.literal("clarify"), chunks: z4.array(z4.string()).min(1) }),
   z4.object({ kind: z4.literal("confirm"), approved: z4.boolean() }),
   z4.object({ kind: z4.literal("turns"), turns: z4.array(TurnSchema).min(1) }),
-  /** An auto-answer derived from the user's PAST decisions (broker/precedent-design.md §2):
+  /** An auto-answer derived from the user's PAST decisions (docs/brain/broker/precedent-design.md §2):
    *  delivered through the same settle/await path as a human answer, carrying the judge's
    *  derivation and the precedent ids it grew from. Always paired with a visible trail
    *  card the user can reply to — the broker never overrides the user. */
@@ -414,7 +432,7 @@ var AwaitItemSchema = z4.discriminatedUnion("type", [
      *  and now knows exactly which call to make. Absent when either half is missing —
      *  a sentence with a hole in it is worse than no sentence. */
     note: z4.string().optional(),
-    /** The call record rendered for THIS agent (`voice/record-design.md`): the words the
+    /** The call record rendered for THIS agent (`docs/brain/voice/record-design.md`): the words the
      *  shaped answer was mapped from, filtered to its own claims. There is no second list
      *  of labels beside it — the acts went 2026-09-04 and `intents` went with them (owner,
      *  2026-09-04): the agent reads the sentence and decides. */
@@ -510,10 +528,11 @@ var AgendaTurnSchema = z4.object({
   agentId: z4.string().optional(),
   select: SelectShapeSchema.optional(),
   options: z4.array(OptionSchema.omit({ id: true })).optional(),
-  /** Pacing (#826, owner 2026-08-03: "how fast we move through them ... are parameters"):
-   *  seconds the floor stays open after this turn speaks. Absent = the bot's defaults
-   *  (the beat for context, the answer window for asks). Clamped bot-side. */
-  pace: z4.number().positive().optional(),
+  /* `pace` STOOD HERE (#826). A turn could carry seconds and the model chose them. The walk
+     paces itself now — a short beat between the sentences of a turn, the longer one at its end
+     (owner, 2026-09-30: "remove the bot deciding pace") — and it does that where the words are
+     spoken, not where the plan is written, so nothing between the brain and the walk decides
+     anything. A caller's own `beat_s` tuning is what it used to override. */
   /** Whether the walk WAITS for an answer before moving on. Absent = derived as today
    *  (a question blocks, context flows). blocking:false on a question = ask and move
    *  on, the claim stays pending; blocking:true on context = hold for a reply. */
@@ -548,7 +567,7 @@ var InboxItemSchema = z4.object({
    *  instant the agent picks it up (#997). Absent = pre-trigger row; fall back to
    *  `createdAt`. */
   agentStateAt: z4.string().datetime().optional(),
-  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (walk/design.md §11, owner
+  /** THE QUESTIONS A CALL CARRIES — the call screen's agenda spine (docs/clients/app/walk/design.md §11, owner
    *  2026-09-22). One per DecisionNeed on the Call, in the Call's order, answered or open (a
    *  superseded or cancelled need is no longer a question anyone is asked). Present only on a
    *  Call's cards, and every card of that Call carries the same list: the call screen reads it
@@ -609,7 +628,7 @@ var InboxItemSchema = z4.object({
    *  off the same open list the card came from, so it clears when the Call does. A card is the
    *  backup for a call not taken; while the call has it, the call is where it is answered. */
   onCall: z4.literal(true).optional(),
-  /** THE RING, ON THE ITEM (walk/design.md §12 §17, #2251): the last ring on this card was
+  /** THE RING, ON THE ITEM (docs/clients/app/walk/design.md §12 §17, #2251): the last ring on this card was
    *  declined, and what the ladder will do next — read off the cron's own row, never computed
    *  on the phone. Present only while a `declined` receipt stands on the card's last Call.
    *  The ladder is ACCOUNT-WIDE (#2259): `anchorAt` and `step` are the account's position;
@@ -640,7 +659,7 @@ var InboxItemSchema = z4.object({
     "Labels for a select:'confirm' paige \u2014 'yesno' (Yes/No) or 'approve' (Approve/Deny). Ignored unless select is 'confirm'."
   ),
   /** Real downstream work is stuck behind this one — set by the agent, independent of
-   *  urgency (see the main README's "premier use case" + notify/states.md). Drives the
+   *  urgency (see the main README's "premier use case" + docs/delivery/notify/states.md). Drives the
    *  inbox's blocking badge and the extra confirm step before dismissing it. */
   blocking: z4.boolean().default(false),
   /** The user's locked-in answer; present only for replied items (GET /api/replied/:id). */
@@ -714,9 +733,17 @@ var UserSettingsSchema = z4.object({
     banner: z4.boolean(),
     push: z4.boolean()
   }),
+  /** LockedIn / Default / DateNight on screen; the stored words are unchanged on purpose —
+   *  they are an enum on a live column across every account, and the rename is a rename of
+   *  what people read (owner, 2026-09-30). */
   sessionMode: z4.enum(["default", "all_calls", "silent"]),
-  silentPush: z4.boolean(),
-  autoCallback: z4.boolean(),
+  /** `silentPush` lived here until #2813 and is now GONE, field and column both. It was kept as an
+   *  optional long after DateNight stopped reading it, on the theory that a phone on an older
+   *  bundle PATCHing the whole settings object would be REFUSED for sending a key we had stopped
+   *  wanting. That theory was wrong about this schema: these are plain `z.object`s with no
+   *  `.strict()` anywhere in this file, and zod STRIPS unknown keys rather than rejecting them, so
+   *  an old bundle's `silentPush` is accepted and ignored. Worth remembering before keeping the
+   *  next dead field for the same reason. */
   /** Opt-in (default false) to using your content to improve Paigy and train models. */
   improveConsent: z4.boolean(),
   missedCall: MissedCallSchema.default("backoff_standard"),
@@ -727,12 +754,16 @@ var UserSettingsSchema = z4.object({
    *  must not silently reset this privacy choice. Absent = leave unchanged on
    *  write, 'hosted' on read (see store.ts). */
   voiceMode: z4.enum(["hosted", "on_device"]).optional(),
-  /** Talk — after you answer, the next step is read aloud (walk/design.md §6). ALWAYS ON until
+  /** Talk — after you answer, the next step is read aloud (docs/clients/app/walk/design.md §6). ALWAYS ON until
    *  turned off (owner, 2026-09-18, #2249): a setting, not a per-walk toggle. Optional, NOT
    *  defaulted, for the same reason `voiceMode` is: a stale client PATCHing the full settings
    *  object must not silently turn it back on. Absent = leave unchanged on write, true on
    *  read (see store.ts). */
   talk: z4.boolean().optional(),
+  /** CALL DIAGNOSTICS (owner, 2026-10-01): the call report carries each listen and the bot's own
+   *  load timings. SERVER-SET, no UI — on for every account that existed on 2026-10-01, off for
+   *  newer ones (migration 20261001132859). Read-only here: the settings PATCH never writes it. */
+  callDiagnostics: z4.boolean().optional(),
   /** Per-user ring budget (#603): calls per rolling day before further calls
    *  degrade to banner. Absent = the global default (25). A number, never a
    *  bypass — every account keeps a ceiling. No UI; set per user for testing. */
@@ -741,9 +772,6 @@ var UserSettingsSchema = z4.object({
    *  slower speaker). No API-side semantics; the bot resolves each key with its
    *  own defaults. Set per user (no UI yet); absent = bot defaults. */
   voiceTuning: z4.record(z4.string(), z4.union([z4.number(), z4.string()])).optional(),
-  /** Opt-in to real-phone (PSTN) calls when the app can't ring. Optional, not
-   *  defaulted — an older client PATCHing the full object must not clobber it. */
-  pstnCalls: z4.boolean().optional(),
   /** The user's IANA timezone (e.g. "America/Bogota"), recorded by the app — it is the
    *  only party that knows it. REMINDERS are why it exists: "remind me at ten" becomes
    *  an absolute `due_at` only if we know whose ten. Optional and never defaulted, for
@@ -787,7 +815,7 @@ var ConnectionSummarySchema = z4.object({
   /** The credential kind: "device" = a paired machine (mint-only — it hosts and mints, it
    *  never talks); "agent" = an identity that sends. The roster and devices surfaces split
    *  on this. Optional/absent reads as "agent" (a row predating the kind column). See
-   *  apps/api/src/tokens/devices-vs-agents-design.md. */
+   *  docs/server/tokens/devices-vs-agents-design.md. */
   kind: z4.enum(["device", "agent"]).optional(),
   /** For an agent, the token id of the DEVICE that minted it — so agents group under their
    *  machine, and revoking a device cascades to them. Null on devices, and on unlinked
@@ -805,7 +833,7 @@ var ConnectionSummarySchema = z4.object({
    *  user on the agent's own page. null = no ceiling (today's behaviour for every
    *  connection). Android binds importance to a relationship rather than to each message,
    *  and that is the thing our roster could not say: "Marlow may always call me; Otto
-   *  never may" (navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
+   *  never may" (docs/clients/app/party/navigation-design.md, gap 2). Clamped in `arbitrateLevel`, so it binds
    *  every surface at once and outranks even `sessionMode: all_calls` — a mode the user
    *  set once must not overrule a rule they set about one agent. */
   reach: NotifyLevelSchema.nullable().optional(),
@@ -816,7 +844,14 @@ var ConnectionSummarySchema = z4.object({
   /** Last presence heartbeat from a running agent process (POST /api/presence) — the
    *  desktop app while open. Null = never seen; stale = offline. */
   lastSeenAt: z4.string().datetime().nullable().optional(),
-  /** What a live desktop can run (companion.md §2.2), advertised on its heartbeat:
+  /** WORKING, NOT JUST CONNECTED (owner, 2026-09-30): the last time the agent itself acted on one of
+   *  its Goals — took its lease or recorded an operation (`tokens.last_worked_at`). Within
+   *  `WORKING_MS` it is working; otherwise it is connected but idle. Null = not seen working yet. */
+  lastWorkedAt: z4.string().datetime().nullable().optional(),
+  /** The oldest of its Goals that is `ready` for it — work handed to it that nobody has started.
+   *  With no work of its own for `WORKING_MS`, an agent sitting on this is not taking its work. */
+  oldestReadyAt: z4.string().datetime().nullable().optional(),
+  /** What a live desktop can run (docs/clients/desktop/companion.md §2.2), advertised on its heartbeat:
    *  harness availabilities + granted workspaces — the option set the phone's
    *  "new session" sheet offers. Absent for ordinary MCP agents. */
   runtime: z4.object({
@@ -824,7 +859,12 @@ var ConnectionSummarySchema = z4.object({
      *  shows its age here (`apps/desktop/src/update.ts`). */
     version: z4.string().optional(),
     harnesses: z4.array(z4.object({ name: z4.string(), label: z4.string(), status: z4.string() })).optional(),
-    workspaces: z4.array(z4.string()).optional()
+    workspaces: z4.array(z4.string()).optional(),
+    /** THE GIT REPOS IN THOSE FOLDERS (2026-10-01, Goal 26982211): each granted folder that is a
+     *  repo, and each repo directly inside one, with its `origin` remote. A session started for
+     *  work on `mauurda/paigy` opens in that repo rather than the folder above it, where the repo's
+     *  own AGENTS.md is never read (`workspaceForRepo`). Absent on hosts that predate it. */
+    repos: z4.array(z4.object({ path: z4.string(), remote: z4.string() })).optional()
   }).optional(),
   /** The tail of this agent's working log, when a harness is driving it — the agent page's
    *  live strip. Absent for anything the desktop harness isn't running (a hatched identity
@@ -837,7 +877,8 @@ var ConnectionSummarySchema = z4.object({
 });
 var LedgerItemSchema = z4.object({ id: z4.string(), parentId: z4.string(), title: z4.string(), createdAt: z4.string() });
 var AgentLedgerSchema = z4.object({
-  agent: z4.object({ id: z4.string(), name: z4.string(), revokedAt: z4.string().nullable() }),
+  /** Null when the agent has not named itself yet — never a placeholder (owner, 2026-10-01). */
+  agent: z4.object({ id: z4.string(), name: z4.string().nullable(), revokedAt: z4.string().nullable() }),
   /** Its own questions you have not answered. */
   asks: z4.array(LedgerItemSchema),
   /** Its questions you answered that nobody acted on — still owed to somebody. */
@@ -907,7 +948,7 @@ var QueueQuestionSchema = z4.object({
    *  for a settled question whose reply carried nothing readable. */
   answer: z4.string().nullable().default(null),
   /** The Goal this question belongs to — a step knows its Goal on its own, not only through
-   *  an `InboxItem`'s `communication.goalIds[0]` (walk/design.md §12 item 3).
+   *  an `InboxItem`'s `communication.goalIds[0]` (docs/clients/app/walk/design.md §12 item 3).
    *  READ BY `apps/client/src/walk/order.ts`, which stamps it onto every `WalkStep`: the walk's
    *  order, its route, home's trees and the list of steps all take a step's Goal from here, so
    *  this is the field they agree through rather than each re-deriving it from the row it
@@ -999,7 +1040,19 @@ var QueueItemSchema = z4.object({
     said: z4.string(),
     at: z4.string(),
     entryId: z4.string()
-  }).nullable().optional()
+  }).nullable().optional(),
+  /** WHEN THIS PERSON LAST PUT A HAND ON IT THEMSELVES (owner, Paigy Goal 16d18f51, 2026-09-30):
+   *  the newest Entry on the Goal they wrote, of any kind — a line they added, a reply to a note, an
+   *  answer to a question, a voice note filed as work. Null when the only hands on it have been its
+   *  agent's; optional, so a hand-built queue (fixtures, the demo) and a door older than
+   *  20261001030911 need not spell it — `work/list.ts`'s `yoursAt` keeps its other sources, so the
+   *  Work tab orders as it did before the migration rather than throwing on the missing key.
+   *
+   *  It is a FACT, not a reconstruction: `latest` holds one Entry, so an agent's progress note a
+   *  minute after the person speaks erases their instant from it, and the durable traces the client
+   *  can see (`replies`, `questions[].answeredAt`) miss a spontaneous note entirely — a `request`
+   *  Entry with no `about_id` is in neither. */
+  lastPersonAt: z4.string().nullable().optional()
 });
 var COLD_AFTER_MS = 3 * 24 * 60 * 60 * 1e3;
 var NoteSourceSchema = z4.enum(["app", "call"]);
@@ -1029,7 +1082,7 @@ var NoteSchema = z4.object({
   assignee: z4.string().nullable(),
   /** The request thread minted at assignment; null until assigned. */
   parentId: z4.string().nullable(),
-  /** REMINDERS (reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
+  /** REMINDERS (docs/model/notes/reminders-design.md): the NOT-BEFORE this becomes eligible to ride a
    *  call — never a deadline. It only ever comes from the user's own words, so when it
    *  passes Paigy rings ONCE (#1293, owner 2026-08-26: a time said out loud is consent to
    *  a ring at that time); after that it rides like any other. Null = "the very next
@@ -1289,6 +1342,31 @@ var SnapshotSchema = z4.object({
     computers: z4.array(ComputerRowSchema).nullable()
   }).nullable()
 });
+var CallRecapSchema = z4.object({
+  call: z4.object({
+    status: z4.string(),
+    startedAt: z4.string(),
+    durationMs: z4.number().nullable(),
+    agents: z4.array(z4.object({ id: z4.string(), name: z4.string().nullable() }))
+  }),
+  topics: z4.array(z4.object({
+    goalId: z4.string().uuid(),
+    title: z4.string(),
+    owner: z4.string(),
+    state: z4.string(),
+    questions: z4.array(z4.object({ id: z4.string().uuid(), state: z4.string(), title: z4.string() })),
+    /** `words` is always what they SAID, verbatim — the record, never replaced. `headline` is
+     *  their answer on one line when the call's read wrote one (owner, 2026-10-01: "render them
+     *  summarized like a pre-made option is"), so the row scans like a chosen option and their
+     *  own words stay under it. Absent on every line stored before the read wrote them, and on
+     *  anything that is not an answer. */
+    /** `about` is the request the line answered (its question), null for words that answered none —
+     *  the key the screen groups on, so one question is one row however many times it was answered. */
+    lines: z4.array(z4.object({ entryId: z4.string().uuid(), words: z4.string(), headline: z4.string().optional(), about: z4.string().nullable().optional() }))
+  })),
+  unfiled: z4.array(z4.object({ lineId: z4.string().uuid(), words: z4.string(), atMs: z4.number() })),
+  more: z4.object({ lines: z4.number(), entries: z4.number(), topics: z4.number() })
+});
 
 // src/listening.ts
 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";

package/dist/{dist-33DA5X2G.js → dist-YAKVSYVQ.js}

@@ -17,12 +17,14 @@ import {
   authToken,
   checkReplies,
   claimGoal,
+  claimSessionEnds,
   claimSessions,
   contact,
   createGoal,
   currentRepo,
   deleteToken,
   dismissTriage,
+  finishSessionEnd,
   getGoal,
   getTriage,
   hatch,
@@ -55,7 +57,7 @@ import {
   updateGoal,
   updateSlot,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 export {
   AGENT_TOOLS,
   AGENT_TOOL_NAMES,
@@ -75,12 +77,14 @@ export {
   authToken,
   checkReplies,
   claimGoal,
+  claimSessionEnds,
   claimSessions,
   contact,
   createGoal,
   currentRepo,
   deleteToken,
   dismissTriage,
+  finishSessionEnd,
   getGoal,
   getTriage,
   hatch,

package/dist/enable.js

@@ -3,9 +3,9 @@ import {
   PAIGY_TOOL_IDS,
   enablePaigyTools,
   installSessionListening
-} from "./chunk-6MEUSSRH.js";
-import "./chunk-RLN2B5IZ.js";
-import "./chunk-6C6CO7H3.js";
+} from "./chunk-2ED4GL4N.js";
+import "./chunk-WDZ67U4G.js";
+import "./chunk-KSXJCZ2L.js";
 
 // src/enable.ts
 function main() {

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-YNKTKLQD.js";
+} from "./chunk-BFN2GJ42.js";
 import {
   ENABLE_COMMAND,
   OnboardSchema,
@@ -15,11 +15,11 @@ import {
   SERVER_INSTRUCTIONS,
   TOOLS,
   paigyToolsAllowlisted
-} from "./chunk-6MEUSSRH.js";
+} from "./chunk-2ED4GL4N.js";
 import {
   decideListen,
   listenerAlive
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-WDZ67U4G.js";
 import {
   clearSurface,
   writeSurface
@@ -39,7 +39,7 @@ import {
   sessionId,
   slotName,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/index.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -50,6 +50,40 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 import { fileURLToPath } from "url";
 import qrcode from "qrcode-generator";
+
+// src/survive.ts
+function detail(cause) {
+  const stack = cause?.stack;
+  return stack ? stack : String(cause);
+}
+function guardTheProcess(proc, log) {
+  proc.on("unhandledRejection", (reason) => {
+    log(
+      `paigy: a promise failed with nobody waiting \u2014 the server stays up and its tools keep working (${detail(reason)})`
+    );
+  });
+  proc.on("uncaughtException", (error) => {
+    log(
+      `paigy: an error escaped every catch \u2014 the server stays up and its tools keep working (${detail(error)})`
+    );
+  });
+}
+function traceTheTransport(transport2, log) {
+  const theirError = transport2.onerror;
+  transport2.onerror = (error) => {
+    log(`paigy: the stdio stream errored \u2014 the host may be dropping this server (${detail(error)})`);
+    theirError?.(error);
+  };
+  const theirClose = transport2.onclose;
+  transport2.onclose = () => {
+    log(
+      "paigy: the stdio stream closed \u2014 the host dropped this server, so its tools are gone from this session until the host restarts it (in Claude Code: `/mcp paigy reconnect`)"
+    );
+    theirClose?.();
+  };
+}
+
+// src/index.ts
 var JOIN_CAP_MS = 45e3;
 function pairedResult(token, sas, note) {
   clearSurface();
@@ -349,5 +383,7 @@ async function beat() {
 }
 void beat();
 setInterval(() => void beat(), 6e4).unref();
+guardTheProcess(process, (line) => console.error(line));
 var transport = new StdioServerTransport();
+traceTheTransport(transport, (line) => console.error(line));
 await server.connect(transport);

package/dist/listen.js

@@ -3,7 +3,7 @@ import {
   entryWords,
   removeListenMark,
   writeListenMark
-} from "./chunk-RLN2B5IZ.js";
+} from "./chunk-WDZ67U4G.js";
 import {
   agentName,
   checkReplies,
@@ -11,7 +11,7 @@ import {
   getGoal,
   slotName,
   subscribeWake
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/listen.ts
 import { spawn } from "child_process";

package/dist/onboard.js

@@ -3,13 +3,13 @@ import {
   resolvePairing,
   startPairing,
   suggestedAgentName
-} from "./chunk-YNKTKLQD.js";
+} from "./chunk-BFN2GJ42.js";
 import {
   autoConfigureClients,
   claudeInstallHint,
   openBrowser
-} from "./chunk-6MEUSSRH.js";
-import "./chunk-RLN2B5IZ.js";
+} from "./chunk-2ED4GL4N.js";
+import "./chunk-WDZ67U4G.js";
 import {
   TOKEN_PATH,
   agentName,
@@ -20,7 +20,7 @@ import {
   saveToken,
   setIdentity,
   whoAmI
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/onboard.ts
 function reportRegistered() {

package/dist/slot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   agentName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/slot.ts
 process.stdout.write(agentName());

package/dist/stalled.js

@@ -29,7 +29,7 @@ async function main() {
   const dir = join(homedir(), ".paigy", "stalled-reminded");
   const mark = join(dir, `${session || "session"}-${day}`);
   if (existsSync(mark)) return;
-  const { checkReplies } = await import("./dist-33DA5X2G.js");
+  const { checkReplies } = await import("./dist-YAKVSYVQ.js");
   const reply = stopReply((await checkReplies()).stalled ?? [], input.hook_event_name ?? "Stop");
   if (!reply) return;
   mkdirSync(dir, { recursive: true });

package/dist/statusline.js

@@ -7,7 +7,7 @@ import {
   readToken,
   sessionSlot,
   slotName
-} from "./chunk-6C6CO7H3.js";
+} from "./chunk-KSXJCZ2L.js";
 
 // src/statusline.ts
 import { realpathSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paigy/mcp",
-  "version": "0.40.20",
+  "version": "0.40.22",
   "description": "Paigy MCP server — the AI agent harness that calls you. Lets an agent notify a user and await their reply.",
   "license": "MIT",
   "type": "module",