@securecoms/agent-bridge 0.33.0 → 0.34.0

package/dist/index.js

@@ -17477,7 +17477,17 @@ var CODES = [
   // missed and before any write, so nothing landed. Definite: the committer's
   // work cannot name an agent in a humans-only enclave (admission refuses
   // one), so dropping the commit starts no resend loop.
-  { status: 403, code: "humans_only_enclave" }
+  { status: 403, code: "humans_only_enclave" },
+  // ADR-0024 step 2a PR-E (carry-A ruling §3 A): a V Add or Welcome whose
+  // leaf-key claim map is missing, does not cover exactly the Welcome
+  // targets, or names a key that is not the target's current vendable
+  // KeyPackage's. Refused before any write; definite, so the committer drops
+  // the commit, refetches the KeyPackages and rebuilds instead of resending
+  // the same stale bytes forever.
+  { status: 409, code: "voice_stale_key_package" },
+  // PR-E: a Welcome target already holds a bound leaf in this V group (the
+  // DS-level duplicate-leaf guard). Nothing written; a resend cannot land.
+  { status: 409, code: "voice_leaf_already_bound" }
 ];
 var DISTRIBUTE_DEFINITE_CODES = Object.freeze(CODES.map((c) => Object.freeze({ ...c })));
 var DEFINITE_KEYS = new Set(DISTRIBUTE_DEFINITE_CODES.map((c) => `${c.status} ${c.code}`));
@@ -18524,6 +18534,31 @@ function ownLeafIndexOf(mgr) {
 function tagOf(mgr) {
   return { groupId: new TextDecoder().decode(mgr.groupId), epoch: Number(mgr.epoch) };
 }
+function leafKeyClaims(targets, pkgs) {
+  if (targets.length !== pkgs.length)
+    throw new Error("leafKeyClaims: targets and KeyPackages differ in length");
+  const out = {};
+  targets.forEach((d, i) => {
+    out[d] = bytesToHex22(pkgs[i].leafNode.signaturePublicKey);
+  });
+  return out;
+}
+function leafIndicesForSignatureKey(mgr, keyHex) {
+  const tree = mgr.state?.ratchetTree;
+  if (!tree)
+    return [];
+  const want = keyHex.toLowerCase();
+  const out = [];
+  const numLeaves = Math.floor((tree.length + 1) / 2);
+  for (let i = 0; i < numLeaves; i++) {
+    const node = tree[i * 2];
+    if (!node || node.nodeType !== "leaf")
+      continue;
+    if (bytesToHex22(getSignaturePublicKeyFromLeafIndex2(tree, toLeafIndex2(i))) === want)
+      out.push(i);
+  }
+  return out;
+}
 function tagOfState(state) {
   const m = new MLSGroupManager(state.ciphersuite);
   m.importState(state);
@@ -18550,6 +18585,8 @@ function isEpochConflict(e) {
 var LABEL = "agentvault-connect-v1";
 var DEFAULT_STUCK_THRESHOLD = 2;
 var DEFAULT_QUARANTINE_THRESHOLD = 8;
+var KEPT_WELCOME_COMMIT_DEFER_MS = 24 * 60 * 60 * 1e3;
+var KEPT_WELCOME_COMMIT_DEFER_MAX_ROWS = 32;
 var DELIVERY_PULL_PAGE = 100;
 var DELIVERY_MAX_RETRIES = 5;
 var DrainPageFullError = class extends Error {
@@ -18638,6 +18675,12 @@ var SelfAddRefusedError = class extends Error {
     this.name = "SelfAddRefusedError";
   }
 };
+var VoiceMirrorAddRefusedError = class extends Error {
+  constructor() {
+    super("addMemberToLiveGroup: refusing a voice-channel Add of a device already in the roster mirror (it would mint a duplicate leaf)");
+    this.name = "VoiceMirrorAddRefusedError";
+  }
+};
 var VaultCredentialMismatchError = class extends Error {
   expected;
   got;
@@ -18748,6 +18791,15 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * {@link errorStats}; mutated only through {@link recordDecryptError} /
    * {@link recordDecryptSuccess}.
    */
+  /** {@link KEPT_WELCOME_COMMIT_DEFER_MS}: channel -> when its first commit was
+   *  deferred behind the kept Welcome `welcomeId`. Restarted for a different
+   *  Welcome; cleared when the channel decrypts, or when a pass that saw the
+   *  whole queue kept no Welcome for it (fix round 1, L2: the Welcome
+   *  resolved, so a later re-Welcome gets a fresh, bounded window). An entry
+   *  past its bound stays (expired) until then, so the bound cannot restart
+   *  itself pass after pass. In memory: a reload restarts it, and the
+   *  per-pass row cap is what bounds the page cost across reloads. */
+  keptWelcomeDeferSince = /* @__PURE__ */ new Map();
   errors = /* @__PURE__ */ new Map();
   stuckThreshold;
   /** Consecutive-error threshold at which a wedged channel's row is quarantined
@@ -18966,8 +19018,33 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * channel resumes normal processing and can quarantine again later if it
    * re-wedges (the onWedged guard is reset so the hook can fire again).
    */
+  /** See {@link MlsGroupKeyProviderOpts.deferCommitsWhileWelcomePending}. The
+   *  caller has already established that this pass KEPT a no-state Welcome
+   *  for `channelId`. True: defer the commit row. Never throws. */
+  deferKeptWelcomeCommit(channelId, welcomeId) {
+    const pred = this.o.deferCommitsWhileWelcomePending;
+    if (!pred)
+      return false;
+    let boundMs = 0;
+    try {
+      const v = pred(channelId);
+      boundMs = v === true ? KEPT_WELCOME_COMMIT_DEFER_MS : typeof v === "number" && Number.isFinite(v) && v > 0 ? Math.min(v, KEPT_WELCOME_COMMIT_DEFER_MS) : 0;
+    } catch {
+      boundMs = 0;
+    }
+    if (boundMs <= 0)
+      return false;
+    const now = this.nowMs();
+    const entry = this.keptWelcomeDeferSince.get(channelId);
+    if (entry === void 0 || entry.welcomeId !== welcomeId) {
+      this.keptWelcomeDeferSince.set(channelId, { since: now, welcomeId });
+      return true;
+    }
+    return now - entry.since < boundMs;
+  }
   recordDecryptSuccess(channelId) {
     this.lastDecryptAt.set(channelId, Date.now());
+    this.keptWelcomeDeferSince.delete(channelId);
     const e = this.errors.get(channelId);
     if (!e)
       return;
@@ -19363,6 +19440,12 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * server's REJOIN_THRESHOLD, there was nothing to apply, or a commit would
    * not apply (which means the state is genuinely FORKED, not merely behind,
    * and replay cannot fix a fork).
+   *
+   * THROWS (retryable, never `false`, #1290): CustodyPersistError when the
+   * channel is under the custody hold (nothing applied), and the C2 classes
+   * (PendingCommitUnresolvedError from the guarded MAIN write) after evicting
+   * the advanced cache, so the persisted state is unchanged. A /sync request
+   * that fails also throws, before anything is applied.
    */
   async resyncByReplay(channelId, groupId) {
     if (!await this.hasPersistedChannelState(channelId))
@@ -19382,12 +19465,26 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     let applied = 0;
     try {
       await this.locks.run(channelId, async () => {
+        if (await this.custodyHeld(channelId))
+          throw new CustodyPersistError(channelId);
         const mgr = await this.manager(channelId);
         try {
           for (const c of commits) {
             if (c.epoch <= Number(mgr.epoch))
               continue;
-            await mgr.decrypt(hexToBytes22(c.payload));
+            const commitBytes = hexToBytes22(c.payload);
+            try {
+              await mgr.decrypt(commitBytes);
+            } catch (e) {
+              if (await probeOwnRemoval(mgr, commitBytes) !== null) {
+                this.noteOwnLeafRemoved(channelId, {
+                  group_id: groupId,
+                  epoch: c.epoch,
+                  message_id: c.id
+                });
+              }
+              throw e;
+            }
             applied++;
           }
           if (applied > 0)
@@ -19399,6 +19496,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         }
       });
     } catch (e) {
+      if (isSdkError(e, "CustodyPersistError") || e instanceof CustodyPersistError || e instanceof PendingCommitUnresolvedError || e instanceof GroupSupersededError || e instanceof AttestedOrphanRefusedError) {
+        writeServiceLog("warn", "resync.replay_held", { applied }, e);
+        throw e;
+      }
       writeServiceLog("warn", "resync.replay_commit_failed", { applied }, e);
       return false;
     }
@@ -20127,10 +20228,28 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
    * The row is deliberately NOT acked here — the subsequent ensureSession(join) /
    * joinAndReconcile consumes the same Welcome and acks it after joining.
    */
-  async peekWelcomeChannel(deviceId) {
+  async peekWelcomeChannel(deviceId, opts = {}) {
     const rows = await this.o.backend.pullDelivery(deviceId);
-    const w = rows.find((r) => r.message_type === "welcome" && r.connect_channel_id != null);
-    return w?.connect_channel_id ?? null;
+    const asked = /* @__PURE__ */ new Set();
+    for (const r of rows) {
+      if (r.message_type !== "welcome" || r.connect_channel_id == null)
+        continue;
+      const ch = r.connect_channel_id;
+      if (!opts.accept)
+        return ch;
+      if (asked.has(ch))
+        continue;
+      asked.add(ch);
+      let ok = false;
+      try {
+        ok = await opts.accept(ch) === true;
+      } catch {
+        ok = false;
+      }
+      if (ok)
+        return ch;
+    }
+    return null;
   }
   /**
    * Publish this device's KeyPackage if it holds none; otherwise a no-op that
@@ -20236,10 +20355,17 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     }
     const attempted = [];
     const failed = [];
+    const discarded = [];
     for (const channelId of channelIds) {
       attempted.push(channelId);
       try {
-        await this.ensureSession(channelId, { enclaveId: "welcome-drain", bootstrap: false });
+        await this.ensureSession(channelId, {
+          enclaveId: "welcome-drain",
+          bootstrap: false,
+          onUnopenableWelcome: (groupId) => {
+            discarded.push({ channelId, groupId });
+          }
+        });
       } catch (error) {
         failed.push({ channelId, error });
       }
@@ -20249,7 +20375,7 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       receipt = new DrainReceipt(DRAIN_RECEIPT_TOKEN);
       this.drainReceipts.set(receipt, this.nowMs());
     }
-    return { attempted, failed, skipped, unknown, pageFull, receipt };
+    return { attempted, failed, skipped, unknown, pageFull, receipt, discarded };
   }
   /**
    * Resolve the channel's pending commit record, under the channel lock, and
@@ -20722,7 +20848,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           throw new Error(`ensureSession: no published KeyPackage for device ${d}`);
         return MLSGroupManager.deserializeKeyPackage(hexToBytes22(hex));
       });
-      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+      const creatorLeafSignatureKey = bundle ? bytesToHex22(bundle.publicPackage.leafNode.signaturePublicKey) : void 0;
+      const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId], creatorLeafSignatureKey !== void 0 ? { creatorLeafSignatureKey } : void 0);
       if (init.created === false) {
         if (!this.isAdoptableOrphan(init, others)) {
           if (this.isOrphanShape(init, others))
@@ -20742,7 +20869,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         commit_epoch: Number(mgr.epoch),
         expected_epoch: init.current_epoch,
         member_device_ids: [this.o.deviceId, ...others],
-        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex22(welcome) })) : []
+        welcomes: welcome ? others.map((d) => ({ target_device_id: d, payload: bytesToHex22(welcome) })) : [],
+        // Task 24b (ruling §3 A): exact cover of the Welcome targets ({} when none).
+        added_leaf_signature_keys: leafKeyClaims(welcome ? others : [], welcome ? pkgs : [])
       }, mgr, null);
       const res = await this.commitWithPendingRecord(channelId, rec, mgr);
       if (!res.landed) {
@@ -20756,15 +20885,32 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       const w = rows.find((r) => r.message_type === "welcome" && r.connect_channel_id === channelId);
       if (!w)
         throw new Error("ensureSession(join): no Welcome available yet for this channel");
+      const aborted = () => opts.shouldAbort?.() === true;
+      if (aborted())
+        throw new Error("ensureSession(join): aborted by the caller");
       let mgr;
       try {
         mgr = await this.openWelcome(hexToBytes22(w.payload), [bundle, joinSlot]);
       } catch (err) {
+        if (aborted())
+          throw new Error("ensureSession(join): aborted by the caller");
         this.recordDecryptError(w, err);
         writeServiceLog("warn", "session.unopenable_welcome_discarded", {}, err);
         await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
+        try {
+          opts.onUnopenableWelcome?.(w.group_id);
+        } catch (e) {
+          writeServiceLog("warn", "session.unopenable_welcome_report_failed", {}, e);
+        }
+        try {
+          this.o.onUnopenableWelcomeDiscarded?.({ channelId, groupId: w.group_id });
+        } catch (e) {
+          writeServiceLog("warn", "session.unopenable_welcome_report_failed", {}, e);
+        }
         return;
       }
+      if (aborted())
+        throw new Error("ensureSession(join): aborted by the caller");
       this.managers.set(channelId, mgr);
       await this.saveMain(channelId, mgr);
       await this.o.backend.ackDelivery(this.o.deviceId, [w.queue_id]);
@@ -20975,6 +21121,13 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       await this.refuseUnlessHeldGroupIsActive(channelId, mgr, "addMemberToLiveGroup");
       const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
       groupId = init.group_id;
+      if (this.o.isVoiceChannel?.(channelId) === true) {
+        const mirror = init.member_device_ids;
+        if (!Array.isArray(mirror) || mirror.includes(newDeviceId)) {
+          writeServiceLog("warn", "admission.voice_device_already_in_mirror");
+          throw new VoiceMirrorAddRefusedError();
+        }
+      }
       members = [.../* @__PURE__ */ new Set([...init.member_device_ids ?? [this.o.deviceId], newDeviceId])];
     }
     if (new TextDecoder().decode(mgr.groupId) !== groupId) {
@@ -20993,7 +21146,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       expected_epoch: priorEpoch,
       member_device_ids: members,
       op: "add",
-      welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex22(welcome) }] : []
+      welcomes: welcome ? [{ target_device_id: newDeviceId, payload: bytesToHex22(welcome) }] : [],
+      // Task 24b (ruling §3 A): the exact Welcome cover's leaf keys.
+      added_leaf_signature_keys: leafKeyClaims(welcome ? [newDeviceId] : [], welcome ? [pkg] : [])
     }, mgr, prior), mgr);
     if (!res.landed) {
       const e = res.error;
@@ -21314,6 +21469,181 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
       return this.removeDeviceFromLiveGroupUnlocked(channelId, deviceId, opts, _attempt + 1);
     }
   }
+  /**
+   * ADR-0024 step 2a, round 2 F4 (Task 24): the committer sweep's DEVICE-level
+   * Remove of one leaf the server's committer-work lists in `remove_devices`
+   * (on the hidden voice channel V: a stale device of an agent or relay
+   * identity that is still on V's roster).
+   *
+   * ⛔ WHY NOT {@link removeDeviceFromLiveGroup}. That path resolves a FOREIGN
+   * identity's leaf by add-order position, which RFC 9420's leftmost-blank
+   * refill permutes. Here the identity keeps a CURRENT device, so a wrong guess
+   * evicts the current device's leaf while the distribute's `removed_device_id`
+   * makes the server drop the STALE device from its mirror. The current device
+   * is then in the roster with no leaf, outside the adds delta forever: an
+   * unrecoverable wedge. So this resolves the leaf by EXACT evidence only:
+   *
+   *   - the target device's PUBLISHED KeyPackage, whose LeafNode signature key
+   *     is matched against THIS committer's live tree (the device-level leaf
+   *     predicate, {@link leafIndicesForKeyPackage}). `generateKeyPackage`
+   *     mints a fresh signature keypair per call, so a match names exactly the
+   *     leaf that KeyPackage was Added as;
+   *   - exactly ONE matching leaf, or nothing is committed;
+   *   - that leaf's credential identity is read from the tree, never from the
+   *     server, and is what the distribute names as `removed_identity_id`.
+   *
+   * Outcomes. `"removed"`: one leaf evicted and the distribute landed.
+   * `"unresolved"`: no KeyPackage is published for the device, or it matches no
+   * leaf (the device rotated it after its Add, or the leaf is already gone).
+   * Nothing is committed: the leaf, if any, stays, and is reported, never
+   * guessed. The server's next delta lists it again (the caller's throttle
+   * bounds the retries).
+   *
+   * Refusals (thrown before any commit is built, so nothing is distributed):
+   * the committer's own device (`own_device`), any leaf of the committer's own
+   * identity, the committer's own leaf, or an unknown own leaf
+   * (`own_leaf` / `own_leaf_unknown`, {@link OwnLeafRemoveRefusedError}); two
+   * or more matching leaves; a held group that is not the channel's active
+   * group (#757 binding, checked BEFORE init).
+   */
+  async removeStaleDeviceLeafFromLiveGroup(channelId, deviceId, bound) {
+    return this.locks.run(channelId, () => this.evictOnThrow(channelId, async () => {
+      await this.requirePendingResolvedUnlocked(channelId);
+      return this.removeStaleDeviceLeafUnlocked(channelId, deviceId, 0, bound);
+    }));
+  }
+  async removeStaleDeviceLeafUnlocked(channelId, deviceId, _attempt, bound) {
+    if (await this.custodyHeld(channelId))
+      throw new CustodyPersistError(channelId);
+    if (deviceId === this.o.deviceId)
+      throw new OwnLeafRemoveRefusedError("removeDevice", "own_device");
+    const mgr = await this.manager(channelId);
+    const resolved = bound ? this.resolveBoundDeviceLeaf(mgr, bound) : await this.resolveServedKeyPackageLeaf(mgr, deviceId);
+    if (resolved === "unresolved")
+      return "unresolved";
+    const { leafIndex, leafIdentity } = resolved;
+    await this.refuseUnlessHeldGroupIsActive(channelId, mgr, "removeStaleDeviceLeafFromLiveGroup");
+    const init = await this.o.backend.initConnectChannelGroup(channelId, [this.o.deviceId]);
+    if (new TextDecoder().decode(mgr.groupId) !== init.group_id) {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: group binding mismatch");
+    }
+    const priorEpoch = Number(mgr.epoch);
+    const prior = tagOf(mgr);
+    const { commit } = await mgr.removeMembers([leafIndex]);
+    if (Number(mgr.epoch) !== priorEpoch + 1) {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: unexpected epoch drift before distribute");
+    }
+    const members = init.member_device_ids ?? [this.o.deviceId];
+    const res = await this.commitWithPendingRecord(channelId, this.pendingRecord("remove", init.group_id, {
+      device_id: this.o.deviceId,
+      commit: bytesToHex22(commit),
+      commit_epoch: Number(mgr.epoch),
+      expected_epoch: priorEpoch,
+      member_device_ids: members,
+      op: "remove",
+      removed_identity_id: leafIdentity,
+      removed_device_id: deviceId,
+      welcomes: []
+    }, mgr, prior), mgr);
+    if (!res.landed) {
+      const e = res.error;
+      if (isSupersededRefusal(e))
+        throw new GroupSupersededError(channelId, init.group_id);
+      if (_attempt >= 2 || !isEpochConflict(e))
+        throw e;
+      try {
+        await this.drainChannelCommitsUnlocked(this.o.deviceId, channelId);
+      } catch (e2) {
+        if (e2 instanceof CustodyPersistError)
+          throw e2;
+      }
+      return this.removeStaleDeviceLeafUnlocked(channelId, deviceId, _attempt + 1, bound);
+    }
+    return "removed";
+  }
+  /** F4 (Task 24): the target's PUBLISHED KeyPackage, matched by key against
+   *  the committer's tree. Unchanged from Task 24 and its fix round 1. */
+  async resolveServedKeyPackageLeaf(mgr, deviceId) {
+    const kps = await this.o.backend.fetchKeyPackages([deviceId]);
+    const hex = kps[deviceId];
+    if (!hex) {
+      writeServiceLog("info", "committer.remove_device_unresolved", { no_key_package: true });
+      return "unresolved";
+    }
+    const pkg = MLSGroupManager.deserializeKeyPackage(hexToBytes22(hex));
+    const leaves = leafIndicesForKeyPackage(mgr, pkg);
+    if (leaves.length === 0) {
+      writeServiceLog("info", "committer.remove_device_unresolved", { no_matching_leaf: true });
+      return "unresolved";
+    }
+    if (leaves.length > 1) {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: ambiguous key match (more than one leaf)");
+    }
+    const leafIndex = leaves[0];
+    const tree = mgr.state?.ratchetTree;
+    if (!tree)
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: no local group state");
+    const cred = getCredentialFromLeafIndex(tree, toLeafIndex2(leafIndex));
+    if (cred.credentialType !== "basic") {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: leaf carries no basic credential");
+    }
+    const leafIdentity = new TextDecoder().decode(cred.identity);
+    const ownIdentity = new TextDecoder().decode(this.o.identity);
+    this.refuseOwnLeafRemove(mgr, [leafIndex], "removeDevice");
+    if (!leafIdentity || leafIdentity === ownIdentity) {
+      throw new OwnLeafRemoveRefusedError("removeDevice", "own_leaf");
+    }
+    if (mgr.leafIndicesForIdentity(leafIdentity).length <= 1) {
+      writeServiceLog("warn", "committer.remove_device_refused_last_leaf", {});
+      return "unresolved";
+    }
+    return { leafIndex, leafIdentity };
+  }
+  /**
+   * ADR-0024 step 2a Task 24b (architect ruling "carry A", §3 B and §4 R5):
+   * resolve the leaf by the SERVER-BOUND leaf signature key (committer work's
+   * `remove_device_leaves`). The server recorded the key when the leaf was
+   * born, from the KeyPackage it vended, so it survives the target's
+   * KeyPackage rotation, revocation and deletion, which the served-KeyPackage
+   * path cannot.
+   *
+   *  - Leaves are matched by the bound key ONLY: exactly one match, else
+   *    `unresolved` (zero) or a throw (two or more). ⛔ NEVER a fall back to
+   *    the served KeyPackage: two evidence sources that disagree fail closed.
+   *  - The matched leaf's basic-credential identity must equal the server's
+   *    `identityId` for the device (R4), else a throw.
+   *  - The committer's own leaf index (or an unknown one) is refused
+   *    ({@link refuseOwnLeafRemove}); the own device was refused by the caller.
+   *  - R5: a leaf of the committer's OWN identity is admitted (a sibling
+   *    device: a revoked laptop). The brick class the own-identity refusal
+   *    guards came from positional or identity-level resolution, which this
+   *    exact-key path cannot reach, and the own leaf index is still refused.
+   *  - No last-leaf refusal: the binding is exact evidence, and an identity's
+   *    last leaf is exactly the revoked single-device case (and carry A's
+   *    Remove before its re-Add).
+   * Synchronous and before any commit is built: a refusal distributes nothing.
+   */
+  resolveBoundDeviceLeaf(mgr, bound) {
+    const leaves = leafIndicesForSignatureKey(mgr, bound.leafSignatureKeyHex);
+    if (leaves.length === 0) {
+      writeServiceLog("info", "committer.remove_device_unresolved", { no_bound_leaf: true });
+      return "unresolved";
+    }
+    if (leaves.length > 1) {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: ambiguous bound-key match (more than one leaf)");
+    }
+    const leafIndex = leaves[0];
+    const tree = mgr.state?.ratchetTree;
+    if (!tree)
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: no local group state");
+    const cred = getCredentialFromLeafIndex(tree, toLeafIndex2(leafIndex));
+    const leafIdentity = cred.credentialType === "basic" ? new TextDecoder().decode(cred.identity) : "";
+    if (!leafIdentity || leafIdentity !== bound.identityId) {
+      throw new Error("removeStaleDeviceLeafFromLiveGroup: the bound leaf's credential identity is not the device's identity");
+    }
+    this.refuseOwnLeafRemove(mgr, [leafIndex], "removeDevice");
+    return { leafIndex, leafIdentity };
+  }
   /**
    * Committer-side (owner): evict a SINGLE device leaf from a LIVE VAULT group,
    * targeted by its owner-observed leaf `signaturePublicKey` against the live
@@ -21870,6 +22200,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         out.push({
           queueId: `replay-${m.id}`,
           messageId: envelope.message_id,
+          // #1246 C-1: the group-messages row id is the same mls_messages key.
+          ...typeof m.id === "string" && m.id ? { serverMessageId: m.id } : {},
           channelId,
           plaintext,
           envelope,
@@ -22770,6 +23102,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     const heldBundleRefs = () => heldBundleRefsMemo ??= this.readHeldBundleRefs();
     const w2Acked = /* @__PURE__ */ new Map();
     const w2Kept = /* @__PURE__ */ new Set();
+    const keptWelcomeId = /* @__PURE__ */ new Map();
+    const deferredThisPass = /* @__PURE__ */ new Map();
     const unpinnedRefusals = /* @__PURE__ */ new Map();
     const welcomes = rows.filter((r) => r.message_type === "welcome");
     const nonWelcomes = rows.filter((r) => r.message_type !== "welcome");
@@ -22928,6 +23262,8 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
                 writeServiceLog("warn", "welcome.unopenable");
               } else {
                 w2Kept.add(wcid);
+                if (!keptWelcomeId.has(wcid))
+                  keptWelcomeId.set(wcid, row.queue_id);
                 if (typeof process !== "undefined" && process.env?.SECURECOMS_TRACE_DELIVERY) {
                   writeServiceLog("debug", "delivery.welcome_no_local_state");
                 }
@@ -22938,6 +23274,10 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
           const cid = row.connect_channel_id;
           if (!cid)
             continue;
+          if (w2Kept.has(cid) && (deferredThisPass.get(cid) ?? 0) < KEPT_WELCOME_COMMIT_DEFER_MAX_ROWS && this.deferKeptWelcomeCommit(cid, keptWelcomeId.get(cid) ?? "")) {
+            deferredThisPass.set(cid, (deferredThisPass.get(cid) ?? 0) + 1);
+            continue;
+          }
           let advancedEpoch;
           let custodyHeld = false;
           await this.locks.run(cid, async () => {
@@ -23094,6 +23434,12 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         this.leftStreak.set(cid, { pulls: 1, since: pullNow });
       this.scheduleAutoResolve(cid);
     }
+    if (rows.length < DELIVERY_PULL_PAGE) {
+      for (const cid of [...this.keptWelcomeDeferSince.keys()]) {
+        if (!w2Kept.has(cid))
+          this.keptWelcomeDeferSince.delete(cid);
+      }
+    }
     for (const [cid, gid] of w2Acked) {
       if (w2Kept.has(cid))
         continue;
@@ -23134,6 +23480,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
     if (supersededChannelIds.length) {
       Object.defineProperty(appEntries, "supersededChannelIds", { value: supersededChannelIds, enumerable: false });
     }
+    if (w2Kept.size) {
+      Object.defineProperty(appEntries, "pendingWelcomeChannelIds", { value: [...w2Kept], enumerable: false });
+    }
     return appEntries;
   }
   /**
@@ -23370,7 +23719,9 @@ var MlsGroupKeyProvider = class _MlsGroupKeyProvider {
         voiceDefaultResponder: row.voice_default_responder ?? void 0,
         ...typeof row.identity_signature === "string" && row.identity_signature ? { identitySignature: row.identity_signature } : {},
         payloadHex: row.payload,
-        openedAt
+        openedAt,
+        // #1246 C-1: the server row id, beside the sender-chosen envelope id.
+        ...typeof row.message_id === "string" && row.message_id ? { serverMessageId: row.message_id } : {}
       };
       const custodiedAt = this.nowMs();
       this.custody.set(row.queue_id, entry);
@@ -24925,9 +25276,9 @@ var RestMlsBackend = class {
       current_epoch: j.current_epoch != null ? Number(j.current_epoch) : null
     };
   }
-  async initConnectChannelGroup(channelId, memberDeviceIds) {
+  async initConnectChannelGroup(channelId, memberDeviceIds, opts) {
     const path = `/api/v1/mls/connect-channels/${channelId}/init`;
-    const body = { member_device_ids: memberDeviceIds };
+    const body = opts?.creatorLeafSignatureKey !== void 0 ? { member_device_ids: memberDeviceIds, creator_leaf_signature_key: opts.creatorLeafSignatureKey } : { member_device_ids: memberDeviceIds };
     let j;
     for (let attempt = 0; ; attempt++) {
       try {
@@ -25169,6 +25520,22 @@ var RestMlsBackend = class {
       throw new Error(`unrequested-removals: reports is ${describeType(rows)}`);
     return rows;
   }
+  async signalVoiceLeafUnusable(groupId, deviceId) {
+    const res = await this.fetchBounded("mls_voice_leaf_unusable", "control", this.opts.baseUrl + `/api/v1/mls/groups/${groupId}/voice-leaf-unusable`, { method: "POST", headers: this.headers(), body: JSON.stringify({ device_id: deviceId }) });
+    const text = await res.text().catch(() => "");
+    if (res.ok)
+      return { status: res.status };
+    let parsed = null;
+    if (text) {
+      try {
+        parsed = JSON.parse(text);
+      } catch {
+        parsed = null;
+      }
+    }
+    const code = parseErrorCode(parsed);
+    return code === void 0 ? { status: res.status } : { status: res.status, code };
+  }
   async getCommitterWork(channelId) {
     const j = await this.get("mls_committer_work", `/api/v1/mls/connect-channels/${channelId}/committer-work`);
     const requireList = (field) => {
@@ -25178,7 +25545,29 @@ var RestMlsBackend = class {
       }
       return v.map(String);
     };
-    return { adds: requireList("adds"), removes: requireList("removes") };
+    const work = {
+      adds: requireList("adds"),
+      removes: requireList("removes")
+    };
+    if (j?.remove_devices !== void 0) {
+      work.removeDevices = requireList("remove_devices");
+    }
+    const rawLeaves = j?.remove_device_leaves;
+    if (rawLeaves !== void 0) {
+      if (!Array.isArray(rawLeaves))
+        throw new MalformedCommitterWorkError(channelId, "remove_device_leaves", describeType(rawLeaves));
+      const seen = /* @__PURE__ */ new Set();
+      work.removeDeviceLeaves = rawLeaves.map((e) => {
+        const o = e !== null && typeof e === "object" && !Array.isArray(e) ? e : null;
+        const key = typeof o?.leaf_signature_key === "string" ? o.leaf_signature_key.toLowerCase() : null;
+        if (!o || typeof o.device_id !== "string" || !o.device_id || typeof o.identity_id !== "string" || !o.identity_id || key === null || key.length === 0 || key.length % 2 !== 0 || !/^[0-9a-f]+$/.test(key) || seen.has(o.device_id)) {
+          throw new MalformedCommitterWorkError(channelId, "remove_device_leaves[]", describeType(e));
+        }
+        seen.add(o.device_id);
+        return { deviceId: o.device_id, identityId: o.identity_id, leafSignatureKeyHex: key };
+      });
+    }
+    return work;
   }
   async acquireCommitLease(channelId) {
     try {
@@ -25228,6 +25617,48 @@ var RestMlsBackend = class {
 
 // ../connect-sdk-ts/dist/mls/fake-backend.js
 var DELIVERY_PULL_LIMIT = 100;
+function keyPackageSignatureKeyHex(kpHex) {
+  const b = hexToBytes22(kpHex);
+  let at = 0;
+  const u16 = () => {
+    if (at + 2 > b.length)
+      throw new Error("t");
+    const v = b[at] << 8 | b[at + 1];
+    at += 2;
+    return v;
+  };
+  const opaque = () => {
+    if (at >= b.length)
+      throw new Error("t");
+    const prefix = b[at] >> 6;
+    if (prefix === 3)
+      throw new Error("t");
+    const size = 1 << prefix;
+    if (at + size > b.length)
+      throw new Error("t");
+    let n = b[at] & 63;
+    for (let i = 1; i < size; i++)
+      n = n << 8 | b[at + i];
+    at += size;
+    if (at + n > b.length)
+      throw new Error("t");
+    const out = b.slice(at, at + n);
+    at += n;
+    return out;
+  };
+  try {
+    if (u16() !== 1 || u16() !== 5)
+      return null;
+    u16();
+    u16();
+    opaque();
+    opaque();
+    const sig = opaque();
+    return sig.length > 0 ? bytesToHex22(sig) : null;
+  } catch {
+    return null;
+  }
+}
 var FakeConnectBackend = class _FakeConnectBackend {
   // Key-package store: deviceId → hex-encoded KeyPackage
   kps = /* @__PURE__ */ new Map();
@@ -25312,6 +25743,7 @@ var FakeConnectBackend = class _FakeConnectBackend {
    * server's purge_device_queue. */
   linkIdentityDevice(identityId, deviceId) {
     this.deviceByIdentity.set(identityId, deviceId);
+    this.identityByDevice.set(deviceId, identityId);
   }
   async publishKeyPackage(deviceId, keyPackageHex) {
     this.kps.set(deviceId, keyPackageHex);
@@ -25361,8 +25793,38 @@ var FakeConnectBackend = class _FakeConnectBackend {
       current_epoch: this.epochByChannel.get(channelId) ?? 0
     };
   }
-  async initConnectChannelGroup(channelId, memberDeviceIds) {
+  /** ADR-0024 step 2a (P-7): channel ids the test registers as a hidden
+   *  voice channel V. Init on an EXISTING V returns it unchanged and merges
+   *  nothing, as the real backend does. */
+  voiceChannelIds = /* @__PURE__ */ new Set();
+  /** Task 24b (architect ruling "carry A", §3 A-C), modelled for a channel in
+   *  {@link voiceChannelIds} only, as the PR-E server does for V:
+   *  `channel -> device -> { key (hex), unusableSignaledAt }`, written ONLY
+   *  when a V leaf is born (the creator's init, an Add's Welcome) from the
+   *  verified claim, and deleted when a Remove of that device (or its
+   *  identity) lands. */
+  voiceLeafBindings = /* @__PURE__ */ new Map();
+  /** The device -> identity the server knows (the devices table). Written by
+   *  {@link linkIdentityDevice}; read for `remove_device_leaves`. */
+  identityByDevice = /* @__PURE__ */ new Map();
+  static voiceRefusal(path, code) {
+    return new MlsBackendHttpError(path, 409, code);
+  }
+  /** The current vendable KeyPackage key of `deviceId`, or null. */
+  currentLeafKey(deviceId) {
+    const hex = this.kps.get(deviceId);
+    return hex ? keyPackageSignatureKeyHex(hex) : null;
+  }
+  async initConnectChannelGroup(channelId, memberDeviceIds, opts) {
     const alreadyExists = this.groupIdByChannel.has(channelId);
+    if (!alreadyExists && this.voiceChannelIds.has(channelId)) {
+      const creator = memberDeviceIds[0];
+      const current = creator ? this.currentLeafKey(creator) : null;
+      if (!opts?.creatorLeafSignatureKey || current === null || opts.creatorLeafSignatureKey.toLowerCase() !== current) {
+        throw new Error(`/api/v1/mls/connect-channels/${channelId}/init failed: 409 {"detail":"voice_stale_key_package"}`);
+      }
+      this.voiceLeafBindings.set(channelId, /* @__PURE__ */ new Map([[creator, { key: current, unusableSignaledAt: null }]]));
+    }
     let groupId = this.groupIdByChannel.get(channelId);
     if (!groupId) {
       groupId = `00000000-0000-0000-0000-${String(this.groupIdByChannel.size + 1).padStart(12, "0")}`;
@@ -25370,7 +25832,7 @@ var FakeConnectBackend = class _FakeConnectBackend {
       this.channelByGroup.set(groupId, channelId);
       this.epochByChannel.set(channelId, 0);
     }
-    const members = [.../* @__PURE__ */ new Set([...this.membersByChannel.get(channelId) ?? [], ...memberDeviceIds])];
+    const members = alreadyExists && this.voiceChannelIds.has(channelId) ? [...this.membersByChannel.get(channelId) ?? []] : [.../* @__PURE__ */ new Set([...this.membersByChannel.get(channelId) ?? [], ...memberDeviceIds])];
     this.membersByChannel.set(channelId, members);
     return {
       group_id: groupId,
@@ -25507,6 +25969,27 @@ var FakeConnectBackend = class _FakeConnectBackend {
         throw new MlsBackendHttpError(_FakeConnectBackend.distributePath(groupId), 409, "EPOCH_CONFLICT", "stale_epoch");
       }
     }
+    const vBindings = this.voiceChannelIds.has(channelId) ? this.voiceLeafBindings.get(channelId) ?? /* @__PURE__ */ new Map() : null;
+    let bindNow = [];
+    if (vBindings && req.commit && req.op !== "remove") {
+      const targets = (req.welcomes ?? []).map((w) => w.target_device_id);
+      const claims = req.added_leaf_signature_keys;
+      const path = _FakeConnectBackend.distributePath(groupId);
+      if (!claims)
+        throw _FakeConnectBackend.voiceRefusal(path, "voice_stale_key_package");
+      const claimed = Object.keys(claims);
+      if (claimed.length !== targets.length || targets.some((t) => !(t in claims))) {
+        throw _FakeConnectBackend.voiceRefusal(path, "voice_stale_key_package");
+      }
+      for (const t of targets) {
+        const current = this.currentLeafKey(t);
+        if (current === null || claims[t].toLowerCase() !== current)
+          throw _FakeConnectBackend.voiceRefusal(path, "voice_stale_key_package");
+        if (vBindings.has(t))
+          throw _FakeConnectBackend.voiceRefusal(path, "voice_leaf_already_bound");
+      }
+      bindNow = targets.map((t) => [t, claims[t].toLowerCase()]);
+    }
     if (req.commit) {
       const log = this.commitLog.get(groupId) ?? [];
       log.push({
@@ -25529,6 +26012,12 @@ var FakeConnectBackend = class _FakeConnectBackend {
       this.membersByChannel.set(channelId, remaining);
       if (evictedDevice)
         this.queues.delete(evictedDevice);
+      if (vBindings) {
+        for (const d of [...vBindings.keys()]) {
+          if (d === evictedDevice || !req.removed_device_id && this.identityByDevice.get(d) === req.removed_identity_id)
+            vBindings.delete(d);
+        }
+      }
     } else {
       const members = [.../* @__PURE__ */ new Set([...this.membersByChannel.get(channelId) ?? [], ...req.member_device_ids ?? []])];
       this.membersByChannel.set(channelId, members);
@@ -25552,6 +26041,11 @@ var FakeConnectBackend = class _FakeConnectBackend {
         });
       }
     }
+    if (vBindings && bindNow.length > 0) {
+      for (const [d, k] of bindNow)
+        vBindings.set(d, { key: k, unusableSignaledAt: null });
+      this.voiceLeafBindings.set(channelId, vBindings);
+    }
     for (const w of req.welcomes ?? []) {
       this.q(w.target_device_id).push({
         queue_id: "q-" + this._seq++,
@@ -25612,6 +26106,51 @@ var FakeConnectBackend = class _FakeConnectBackend {
   async getCommitterWork(_channelId) {
     return { adds: [], removes: [] };
   }
+  /** Task 24b (ruling §3 C): the carry-A signal, every call recorded. Gates
+   *  modelled: the group is a V (else 404), a binding exists (else 409), the
+   *  device's current vendable key differs from the bound one (409
+   *  `voice_leaf_key_current` when equal, `voice_no_current_key_package`
+   *  when it has none). An already-signalled row is an idempotent 202. The
+   *  bind and roster gates are the server's (backend tests). */
+  signalVoiceLeafUnusableCalls = [];
+  async signalVoiceLeafUnusable(groupId, deviceId) {
+    this.signalVoiceLeafUnusableCalls.push({ groupId, deviceId });
+    const channelId = this.channelByGroup.get(groupId);
+    if (!channelId || !this.voiceChannelIds.has(channelId))
+      return { status: 404, code: "Not Found" };
+    const row = this.voiceLeafBindings.get(channelId)?.get(deviceId);
+    if (!row)
+      return { status: 409, code: "voice_leaf_binding_missing" };
+    const current = this.currentLeafKey(deviceId);
+    if (current === null)
+      return { status: 409, code: "voice_no_current_key_package" };
+    if (current === row.key)
+      return { status: 409, code: "voice_leaf_key_current" };
+    if (row.unusableSignaledAt === null)
+      row.unusableSignaledAt = this.now();
+    return { status: 202 };
+  }
+  /** Task 24b test seam: V's committer work as the PR-E server derives it,
+   *  for a test's `roster` (the server's roster devices): `adds` = roster
+   *  devices not in the mirror; `remove_devices` / `remove_device_leaves` =
+   *  roster devices whose binding is signalled unusable (NOT in `adds`: they
+   *  are still in the mirror). The re-Add follows only from a later call,
+   *  after the Remove landed and the mirror dropped the device. */
+  voiceCommitterWork(channelId, roster) {
+    const mirror = this.membersByChannel.get(channelId) ?? [];
+    const bindings = this.voiceLeafBindings.get(channelId) ?? /* @__PURE__ */ new Map();
+    const signalled = roster.filter((d) => mirror.includes(d) && bindings.get(d)?.unusableSignaledAt != null);
+    return {
+      adds: roster.filter((d) => !mirror.includes(d)),
+      removes: [],
+      removeDevices: signalled,
+      removeDeviceLeaves: signalled.map((d) => ({
+        deviceId: d,
+        identityId: this.identityByDevice.get(d) ?? "",
+        leafSignatureKeyHex: bindings.get(d).key
+      }))
+    };
+  }
   async acquireCommitLease(_channelId) {
     return "fake-lease-token";
   }
@@ -25704,6 +26243,11 @@ var FakeConnectBackend = class _FakeConnectBackend {
   // Owner-signed tool grants (spec §7.0): like Plan 0's backend, each row carries
   // the envelope's `identity_proof.signature` as `identity_signature` beside the
   // unsigned canonical payload. `omitSignature` models a pre-Plan-0 row.
+  /** `rowMessageId` (#1246 C-1): the server row id to deliver, when it is NOT
+   *  the envelope's id. The REST send path keys the row by the envelope id
+   *  (connect_messages.py, `MLSMessage(id=message_id)`); the WS `message_mls`
+   *  path stores through `store_mls_message`, whose row id is server-generated,
+   *  so there the two differ and the envelope id is the sender's free choice. */
   async ingestApplication(envelope, opts) {
     const channelId = envelope.channel_id;
     const canonical = await canonicalEnvelopeBytes(envelope);
@@ -25715,7 +26259,7 @@ var FakeConnectBackend = class _FakeConnectBackend {
         continue;
       this.q(dev).push({
         queue_id: "q-" + this._seq++,
-        message_id: envelope.message_id,
+        message_id: opts?.rowMessageId ?? envelope.message_id,
         group_id: groupId,
         message_type: "application",
         sender_device_id: senderDeviceId ?? "",
@@ -26099,6 +26643,7 @@ function openSchema(db) {
   ensureRuntimeInboxDeliveryAttempts(db);
   ensureRuntimeReplyIntent(db);
   ensureRuntimeReplyIntentEnvelopeGroup(db);
+  ensureRuntimeReplyIntentCredit(db);
   ensureGroupLink(db);
   ensureMlsCustody(db);
   ensureToolGrantTables(db);
@@ -26179,6 +26724,19 @@ function ensureRuntimeReplyIntentEnvelopeGroup(db) {
     throw e;
   }
 }
+function ensureRuntimeReplyIntentCredit(db) {
+  const hasColumn = () => db.prepare("PRAGMA table_info(runtime_reply_intent)").all().some((c) => c.name === "reply_credit");
+  const cols = db.prepare("PRAGMA table_info(runtime_reply_intent)").all();
+  if (cols.length === 0 || cols.some((c) => c.name === "reply_credit"))
+    return;
+  try {
+    db.exec("ALTER TABLE runtime_reply_intent ADD COLUMN reply_credit TEXT");
+  } catch (e) {
+    if (hasColumn())
+      return;
+    throw e;
+  }
+}
 var RECALL_STATE_COLUMNS = [
   ["recall_enabled", "INTEGER NOT NULL DEFAULT 0"],
   ["recall_mode_epoch", "INTEGER NOT NULL DEFAULT 0"],
@@ -27230,8 +27788,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
     this.db.prepare("DELETE FROM runtime_reply_intent WHERE identity_id=? AND updated_at < ?").run(this.id, now - RUNTIME_REPLY_INTENT_RETENTION_MS);
     const info = this.db.prepare(`INSERT OR IGNORE INTO runtime_reply_intent
          (identity_id, scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-          sealed_body, sealed_envelope, state, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now);
+          sealed_body, sealed_envelope, state, created_at, updated_at, reply_credit)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL, 'pending', ?, ?, ?)`).run(this.id, input.scope, input.part, input.inReplyTo, input.channelId, input.replyMessageId, input.bodyMac, sealed, now, now, input.replyCredit ?? null);
     const count = this.db.prepare("SELECT COUNT(*) AS n FROM runtime_reply_intent WHERE identity_id=?").get(this.id);
     if (count.n > RUNTIME_REPLY_INTENT_MAX) {
       this.db.prepare(`DELETE FROM runtime_reply_intent
@@ -27241,7 +27799,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
          )`).run(this.id, this.id, RUNTIME_REPLY_INTENT_MAX);
     }
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, input.scope, input.part);
     if (!row)
       throw new Error("reply intent vanished after claim");
@@ -27250,7 +27808,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: every intent answering `inReplyTo`, in claim order. */
   async listReplyIntents(inReplyTo) {
     const rows = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND in_reply_to=?
        ORDER BY created_at ASC, rowid ASC`).all(this.id, inReplyTo);
     const out = [];
@@ -27261,7 +27819,7 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
   /** SEC-06 #18: re-read one intent by its key (null when absent). */
   async getReplyIntent(scope, part) {
     const row = this.db.prepare(`SELECT scope, part, in_reply_to, channel_id, reply_message_id, body_mac,
-              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at
+              sealed_body, sealed_envelope, sealed_envelope_group, state, created_at, reply_credit
        FROM runtime_reply_intent WHERE identity_id=? AND scope=? AND part=?`).get(this.id, scope, part);
     return row ? this.openReplyIntent(row) : null;
   }
@@ -27335,7 +27893,8 @@ var SqliteMlsStateStore = class _SqliteMlsStateStore {
       envelope,
       envelopeGroupId: envelopeGroupFor(envelope, await openOrNull(row.sealed_envelope_group)),
       state: row.state === "sent" ? "sent" : row.state === "skipped" ? "skipped" : "pending",
-      createdAt: Number(row.created_at)
+      createdAt: Number(row.created_at),
+      replyCredit: typeof row.reply_credit === "string" ? row.reply_credit : null
     };
   }
   async recordMemory(input) {
@@ -29105,8 +29664,8 @@ function decodeReplyBody(bytes) {
   if (b?.kind === "a2a" && b.a2a && typeof b.a2a === "object") return b;
   throw new Error("reply intent body is malformed");
 }
-function replyBodyMac(key, replyId, channelId, body) {
-  return createHmac("sha256", key).update(JSON.stringify(["reply-body", replyId, channelId])).update("\0").update(body).digest("hex");
+function replyBodyMac(key, replyId, channelId, body, credit) {
+  return createHmac("sha256", key).update(JSON.stringify(credit === void 0 ? ["reply-body", replyId, channelId] : ["reply-body", replyId, channelId, credit])).update("\0").update(body).digest("hex");
 }
 function partOrdinal(part) {
   const m = /^p:(\d+)$/.exec(part);
@@ -34328,6 +34887,8 @@ function checkConfiguredPaths(skillsJson, statFn = (p) => {
   }
   const search = skillsJson.search;
   if (search?.keyFile) paths.push(search.keyFile);
+  const weather = skillsJson.weather;
+  if (weather?.keyFile) paths.push(weather.keyFile);
   return paths.map((path) => {
     let st;
     try {
@@ -34353,7 +34914,7 @@ function parseSecretPathsReport(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
   const r = raw;
   const f = r.outside_by_field;
-  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite)) return void 0;
+  if (r.mode !== "report" && r.mode !== "enforce" || !isCount(r.inside) || !isCount(r.allowlisted) || !isCount(r.outside) || !f || typeof f !== "object" || Array.isArray(f) || !isCount(f.headers_file) || !isCount(f.postgres_url_file) || !isCount(f.search_key_file) || f.sqlite !== void 0 && !isCount(f.sqlite) || f.weather_key_file !== void 0 && !isCount(f.weather_key_file)) return void 0;
   return {
     mode: r.mode,
     inside: r.inside,
@@ -34363,7 +34924,8 @@ function parseSecretPathsReport(raw) {
       headers_file: f.headers_file,
       postgres_url_file: f.postgres_url_file,
       search_key_file: f.search_key_file,
-      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {}
+      ...f.sqlite !== void 0 ? { sqlite: f.sqlite } : {},
+      ...f.weather_key_file !== void 0 ? { weather_key_file: f.weather_key_file } : {}
     }
   };
 }
@@ -34443,6 +35005,7 @@ function readLocalReport(home, identityId) {
     has_search_key: hasSearchKey,
     has_llm_key: hasLlmKey,
     has_extract_provider: doc.has_extract_provider === true,
+    has_weather_key: doc.has_weather_key === true,
     ...ownerDmCap !== void 0 ? { owner_dm_search_cap_effective: ownerDmCap } : {},
     legacy_memory: localLegacySources(doc).map(({ path: _path, content: _content, ...source }) => source),
     secret_paths: parseSecretPathsReport(doc.secret_paths)
@@ -34544,6 +35107,19 @@ function pruneManagedMemory(home, identityId, hashes, deps = REAL_FS) {
   return removed;
 }
 
+// src/reply-credit.ts
+var REPLY_CREDIT_FEATURE = "reply_credit_v1";
+var WEATHER_CREDIT_LINE = "Weather data: WeatherAPI.com. For general information only.";
+var WEATHER_CREDIT_SUFFIX = `
+
+${WEATHER_CREDIT_LINE}`;
+function isReplyCredit(v) {
+  return v === "weatherapi";
+}
+function stripCreditSuffix(text) {
+  return text.endsWith(WEATHER_CREDIT_SUFFIX) ? text.slice(0, text.length - WEATHER_CREDIT_SUFFIX.length) : text;
+}
+
 // src/grants/binding.ts
 import { sha256 as sha25611 } from "@noble/hashes/sha256";
 
@@ -34632,9 +35208,10 @@ function loadOwnerGrantPin(opts) {
 // src/grants/manifest.ts
 var TOOL_GRANTS_DOMAIN = "SECURECOMS-TOOL-GRANTS-V1:";
 var MANIFEST_KNOWN_TOOLS = Object.freeze({
-  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query"]),
+  owner_dm: Object.freeze(["web_search", "web_extract", "fetch_url", "http_request", "sql_query", "weather_forecast", "currency_convert"]),
   // web_extract: owner DM only, never team_room (spec §5.4, D5)
-  team_room: Object.freeze(["web_search"])
+  // Weather/currency spec §6.3 (U5): both utility tools in both audiences, each held behind utility_tools_v1 (TOOL_FEATURE).
+  team_room: Object.freeze(["web_search", "weather_forecast", "currency_convert"])
 });
 function manifestSignedBytes(manifest) {
   const domain = new TextEncoder().encode(TOOL_GRANTS_DOMAIN);
@@ -34958,20 +35535,30 @@ function bindTargets(raw, signed, equals) {
   }
   return { written, mismatches };
 }
-function signedManifestTools(manifest, audience, searchProvidersCapable) {
-  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && (t !== "web_extract" || searchProvidersCapable));
+var NO_FEATURES = Object.freeze(/* @__PURE__ */ new Set());
+var TOOL_FEATURE = Object.freeze({
+  web_extract: "search_providers_v2",
+  weather_forecast: "utility_tools_v1",
+  currency_convert: "utility_tools_v1"
+});
+function toolAllowedByFeatures(tool, features) {
+  if (!Object.hasOwn(TOOL_FEATURE, tool)) return true;
+  return features.has(TOOL_FEATURE[tool]);
+}
+function signedManifestTools(manifest, audience, features) {
+  return MANIFEST_KNOWN_TOOLS[audience].filter((t) => (manifest.grants[audience] ?? []).includes(t) && toolAllowedByFeatures(t, features));
 }
-function manifestPolicyFor(manifest, switches, searchProvidersCapable) {
+function manifestPolicyFor(manifest, switches, features) {
   return {
     v: 1,
     manifest_tools: [.../* @__PURE__ */ new Set([
-      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", searchProvidersCapable) : [],
-      ...switches.room ? signedManifestTools(manifest, "team_room", searchProvidersCapable) : []
+      ...switches.ownerDm ? signedManifestTools(manifest, "owner_dm", features) : [],
+      ...switches.room ? signedManifestTools(manifest, "team_room", features) : []
     ])].sort(),
     secret_path_mode: "enforce"
   };
 }
-function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, searchProvidersCapable = false) {
+function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true, room: true }, features = NO_FEATURES) {
   const mismatches = /* @__PURE__ */ new Set();
   const cfg = manifest.config;
   const out = {};
@@ -35000,7 +35587,8 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
   for (const name of Object.keys(files)) {
     if (name !== LLM_SOURCE && !PERSONA_FILES.includes(name)) mismatches.add("files");
   }
-  const ownerDmTools = signedManifestTools(manifest, "owner_dm", searchProvidersCapable);
+  const ownerDmTools = signedManifestTools(manifest, "owner_dm", features);
+  const ownerDmSearchTools = ownerDmTools.filter((t) => t === "web_search" || t === "web_extract");
   const sj = isObj2(payload.skills_json) ? payload.skills_json : void 0;
   const eps = bindTargets(sj?.endpoints, manifest.endpoints, endpointEquals);
   const dbs = bindTargets(sj?.databases, manifest.databases, databaseEquals);
@@ -35021,17 +35609,20 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     const usablePrior = cfg.search !== void 0 && prior.search?.provider === cfg.search.provider ? prior.search : void 0;
     searchBlock = cfg.search === void 0 ? void 0 : usablePrior ?? Object.freeze({ provider: cfg.search.provider });
   }
+  const pw = isObj2(sj?.weather) ? sj.weather : void 0;
+  const weatherBlock = typeof pw?.keyFile === "string" && pw.keyFile !== "" ? { keyFile: pw.keyFile } : void 0;
   const skillsDoc = {
     endpoints: eps.written,
     databases: dbs.written,
     flags: [...cfg.flags],
     ...deny !== void 0 || cfg.tools_allow !== void 0 ? { tools: { ...deny !== void 0 ? { deny } : {}, ...cfg.tools_allow !== void 0 ? { allow: [...cfg.tools_allow] } : {} } } : {},
     ...searchBlock ? { search: searchBlock } : {},
+    ...weatherBlock ? { weather: weatherBlock } : {},
     // D31: the marker the runtime keys D24 (iii) on; written under every manifest, true when config.search is signed.
     search_signed: cfg.search !== void 0,
     // D36, D39: the signed owner-DM cap, only when the owner-DM switch is on and the manifest grants an owner-DM tool;
     // otherwise none, so the runtime clamps a signed raise to the default. Never read from the payload.
-    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
+    ...cfg.search?.owner_dm_daily_cap !== void 0 && switches.ownerDm && ownerDmSearchTools.length > 0 ? { owner_dm_search_cap: cfg.search.owner_dm_daily_cap } : {}
   };
   out["skills.json"] = JSON.stringify(skillsDoc, null, 2) + "\n";
   const signedMemory = { mode: cfg.memory.mode, ...cfg.memory.recall_days !== void 0 ? { recall_days: cfg.memory.recall_days } : {} };
@@ -35062,7 +35653,7 @@ function bindRuntimeConfig(manifest, payload, prior, switches = { ownerDm: true,
     mismatches.add("legacy_assign");
     legacyDecisions = decisions.filter((d) => isObj2(d) && d.action === "delete");
   }
-  const policy = manifestPolicyFor(manifest, switches, searchProvidersCapable);
+  const policy = manifestPolicyFor(manifest, switches, features);
   return {
     mismatches: CONFIG_BINDING_FIELDS.filter((f) => mismatches.has(f)).sort(),
     targetMismatches: { endpoint: eps.mismatches, database: dbs.mismatches },
@@ -35205,7 +35796,11 @@ var TOOL_ROOM_CLASSES = Object.freeze({
   // D5: spends the owner's key and sends URLs out
   fetch_url: Object.freeze(["egress"]),
   sql_query: Object.freeze(["owner_credential"]),
-  http_request: Object.freeze(["owner_credential", "egress", "side_effect"])
+  http_request: Object.freeze(["owner_credential", "egress", "side_effect"]),
+  // Weather/currency (plan audit r1; supersedes spec §8's values): both send room words to an outside host, and weather
+  // spends the owner's key.
+  weather_forecast: Object.freeze(["owner_credential", "egress"]),
+  currency_convert: Object.freeze(["egress"])
 });
 var LIVE_MEMBER_STATUSES = /* @__PURE__ */ new Set(["active", "add_pending"]);
 function isLiveRow(r) {
@@ -37019,7 +37614,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     let bound;
     try {
-      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable());
+      bound = this.grantWriters.bindRuntimeConfig(manifest, payload, { search: prior }, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.capabilityFeatures());
     } catch (e) {
       bound = null;
       return this.bindFailed(manifest, payload.memory, e);
@@ -37040,7 +37635,7 @@ var BridgeAgent = class _BridgeAgent {
     try {
       this.grantWriters.writeManagedFiles(this.home, this.cfg.identityId, bound.files);
       if (manifest.config.llm === void 0) this.grantWriters.removeManagedLlmSource(this.home, this.cfg.identityId);
-      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.searchProvidersCapable()));
+      this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, this.capabilityFeatures()));
     } catch (e) {
       this.manifestBinding = null;
       throw e;
@@ -37094,6 +37689,7 @@ var BridgeAgent = class _BridgeAgent {
   async postRuntimeConfigReport(base, version, skillsJson) {
     const local = readLocalReport(this.home, this.cfg.identityId);
     const reportedSearchProviders = this.searchProvidersCapable();
+    const reportedUtilityTools = this.utilityToolsCapable();
     const report = {
       applied_version: version,
       paths: checkConfiguredPaths(skillsJson),
@@ -37111,6 +37707,9 @@ var BridgeAgent = class _BridgeAgent {
       // Final review I-2 (controller ruling): AND the current search_providers_v2, so the web never shows extract while
       // the bridge withholds web_extract from the runtime.
       has_extract_provider: (local?.has_extract_provider ?? false) && reportedSearchProviders,
+      // Weather/currency L-1, §8 item 5: AND the current utility_tools_v1, so the web never shows a usable weather key
+      // while the bridge withholds weather_forecast from the runtime.
+      has_weather_key: (local?.has_weather_key ?? false) && reportedUtilityTools,
       // D39: the owner-DM daily cap the runtime enforces, passed through when it reported a valid one; never the signed value.
       ...local?.owner_dm_search_cap_effective !== void 0 ? { owner_dm_search_cap_effective: local.owner_dm_search_cap_effective } : {},
       // Same idea, for the BYOK LLM key file: only the runtime can see
@@ -37158,7 +37757,9 @@ var BridgeAgent = class _BridgeAgent {
         // D28 (§11.1 step 3): a separate key, never a value in the capability enum. False with no runtime attached.
         search_providers_v2: reportedSearchProviders,
         // D19 item 4: content-free; the signed provider is one the attached runtime(s) cannot honour.
-        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders)
+        search_provider_unsupported: this.searchProviderUnsupported(reportedSearchProviders),
+        // Weather/currency §8 item 5: a separate key, false with no runtime attached.
+        utility_tools_v1: reportedUtilityTools
       }
     };
     const reportedVerifyFailures = this.ownerVerifyFailures;
@@ -37180,6 +37781,7 @@ var BridgeAgent = class _BridgeAgent {
     }
     this.ownerVerifyFailures = Math.max(0, this.ownerVerifyFailures - reportedVerifyFailures);
     this.lastReportedSearchProviders = reportedSearchProviders;
+    this.lastReportedUtilityTools = reportedUtilityTools;
     if (version) writeServiceLog2("info", "runtime_config.applied", { version });
     else writeServiceLog2("info", "runtime_config.legacy_memory_reported");
   }
@@ -37249,7 +37851,7 @@ var BridgeAgent = class _BridgeAgent {
     this.startedAt = Date.now();
     await this.restoreRuntimeInbox();
     await this.loadToolGrantState();
-    this.recomputeManifestPolicy(false);
+    this.recomputeManifestPolicy(NO_FEATURES);
     try {
       this.store.pruneRoomSearchCap(utcDayOf(Date.now()));
     } catch (e) {
@@ -38232,13 +38834,13 @@ var BridgeAgent = class _BridgeAgent {
    * absent, because the id is derived.
    */
   async send(channelId, text, messageId, opts = {}) {
-    const body = { kind: "text", text };
+    const body = { kind: "text", text: opts.credit !== void 0 ? text + WEATHER_CREDIT_SUFFIX : text };
     if (this.isIdempotentSend(messageId, opts)) return this.trackReplyWork(this.sendIdempotent(channelId, body, opts));
     const id = resolveMessageId(messageId);
     const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(channelId);
     const replyCapture = this.unifiedReplyCapture(channelId, opts.inReplyTo);
     await this.publishBody(channelId, body, id);
-    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture);
+    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture, text);
     return { message_id: id, status: "sent" };
   }
   /** PR #716 review MEDIUM-5: register reply work so close() can wait for it. */
@@ -38257,7 +38859,7 @@ var BridgeAgent = class _BridgeAgent {
     const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(channelId);
     const replyCapture = this.unifiedReplyCapture(channelId, opts.inReplyTo);
     await this.publishBody(channelId, body, id);
-    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture);
+    this.afterPublish(channelId, body, id, opts, purgeEpochBeforePublish, replyCapture, null);
     return { message_id: id, status: "sent" };
   }
   /**
@@ -38390,18 +38992,24 @@ var BridgeAgent = class _BridgeAgent {
     const meta = this.freshMeta(capChannel);
     if (meta && !meta.is_dm) this.enforceRateFloor("room", capChannel);
   }
-  /** Bookkeeping after a CONFIRMED publish of `body` under `id`. */
-  afterPublish(channelId, body, id, opts, purgeEpoch, replyCapture) {
+  /**
+   * Bookkeeping after a CONFIRMED publish of `body` under `id`. `recordText` (weather/currency Task 17) is what a text
+   * reply is RECORDED as: the published text minus any credit line. Every record site below reads `recorded`, never
+   * `body.text`. Every production caller passes it (pinned by reply-credit.test.ts: text, or null for an a2a body);
+   * undefined is left only for direct test calls of an uncredited body, where the published and record texts are equal.
+   */
+  afterPublish(channelId, body, id, opts, purgeEpoch, replyCapture, recordText) {
+    const recorded = recordText ?? (recordText === void 0 && body.kind === "text" ? body.text : "");
     if (opts.agentTurn !== false) this.agentHops.noteOwnSend(channelId);
     const modality = this.spokenReplyIds.has(id) ? "voice" : "text";
-    const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(body.text);
+    const bridgeLine = this.unifiedOn && body.kind === "text" && isBridgeMemoryLine(recorded);
     if (opts.inReplyTo !== void 0 && this.isOwnerVerifyFailed(opts.inReplyTo)) return;
-    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(body.text) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
-      this.callBuffer.appendAgent(channelId, body.text, "reply");
+    if (body.kind === "text" && opts.callBufferReply === true && opts.inReplyTo !== void 0 && !this.spokenReplyIds.has(id) && !isBridgeMemoryLine(recorded) && this.callBuffer.isVoiceScopedId(opts.inReplyTo)) {
+      this.callBuffer.appendAgent(channelId, recorded, "reply");
     }
     const origin = this.spokenReplyIds.has(id) ? "fast_path" : !this.taintScope(channelId) ? "reply" : opts.inReplyTo !== void 0 && this.cleanTurns.has(opts.inReplyTo) && !this.taintedTurns.has(opts.inReplyTo) ? "reply" : "untrusted";
-    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, body.text, id, modality, purgeEpoch, origin);
-    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, body.text, id, replyCapture ?? null, origin);
+    if (body.kind === "text" && !bridgeLine) void recordOutboundMemory(this.memory, channelId, recorded, id, modality, purgeEpoch, origin);
+    if (this.unifiedOn && body.kind === "text" && !bridgeLine) this.spawnUnifiedReply(channelId, recorded, id, replyCapture ?? null, origin);
   }
   /**
    * Final review bridge I-1 (ledger T25): the agent reply's U11 capture, taken BEFORE the publish await. The clear generation
@@ -38479,14 +39087,14 @@ var BridgeAgent = class _BridgeAgent {
         const k = replyIntentKey({ inReplyTo: opts.inReplyTo, idempotencyKey: opts.idempotencyKey, ordinal: () => 0 });
         if (!k) throw new Error("idempotent send without a key");
         const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes);
-        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes });
+        const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, opts.credit);
+        const { intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit: opts.credit ?? null });
         if (intent.bodyMac !== mac2 || intent.channelId !== channelId || intent.state === "skipped") {
           throw new IdempotencyConflictError();
         }
         return k;
       }
-      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true);
+      return this.claimUnkeyedPart(opts.inReplyTo, channelId, bytes, true, opts.credit ?? null);
     });
     return this.publishIntent(key, opts);
   }
@@ -38495,22 +39103,23 @@ var BridgeAgent = class _BridgeAgent {
    * the reply to `inReplyTo`. Caller holds the scope lock. `matchRetry` false
    * after a slot collision: the body must go to a NEW part.
    */
-  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry) {
+  async claimUnkeyedPart(inReplyTo, channelId, bytes, matchRetry, replyCredit) {
+    const credit = replyCredit ?? void 0;
     const scope = `reply:${inReplyTo}`;
     let latest = null;
     for (const intent of await this.store.listReplyIntents(inReplyTo)) {
       const n = intent.scope === scope ? partOrdinal(intent.part) : null;
       if (n !== null && (latest === null || n > latest.ordinal)) latest = { ordinal: n, intent };
     }
-    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes)) {
+    if (matchRetry && latest && latest.intent.state !== "skipped" && latest.intent.channelId === channelId && latest.intent.bodyMac === replyBodyMac(this.replyIdKey, latest.intent.replyMessageId, channelId, bytes, credit)) {
       return { scope, part: latest.intent.part, inReplyTo };
     }
     let ordinal = latest ? latest.ordinal + 1 : 0;
     for (let i = 0; i < REPLY_MAX_PART_ADVANCES; i++, ordinal++) {
       const k = { scope, part: `p:${ordinal}`, inReplyTo };
       const id = replyMessageId(this.replyIdKey, this.cfg.identityId, channelId, k);
-      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes);
-      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes });
+      const mac2 = replyBodyMac(this.replyIdKey, id, channelId, bytes, credit);
+      const { created, intent } = await this.store.claimReplyIntent({ ...k, channelId, replyMessageId: id, bodyMac: mac2, body: bytes, replyCredit });
       if (created) return k;
       if (matchRetry && intent.state !== "skipped" && intent.bodyMac === mac2 && intent.channelId === channelId) return k;
       writeServiceLog2("info", "reply.part_slot_taken", { attempt: i + 1 });
@@ -38555,6 +39164,12 @@ var BridgeAgent = class _BridgeAgent {
       }
       const bytes = intent.body;
       const body = decodeReplyBody(bytes);
+      const recordText = this.recordTextOf(intent.replyCredit, body);
+      if (recordText === void 0) {
+        writeServiceLog2("error", "reply.intent_integrity_refused");
+        this.store.deletePendingReplyIntent(key.scope, key.part);
+        throw new ReplyIntentIntegrityError();
+      }
       const purgeEpochBeforePublish = this.store.conversationPurgeEpoch(intent.channelId);
       const replyCapture = this.unifiedReplyCapture(intent.channelId, intent.inReplyTo ?? void 0);
       try {
@@ -38583,14 +39198,17 @@ var BridgeAgent = class _BridgeAgent {
           const inReplyTo = intent.inReplyTo;
           const next = await this.withReplyLock(
             JSON.stringify(["scope", key.scope]),
-            () => this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false)
+            () => (
+              // r2 BLOCKER 1: the colliding row's OWN credit (verified above), never `opts`.
+              this.claimUnkeyedPart(inReplyTo, intent.channelId, bytes, false, isReplyCredit(intent.replyCredit) ? intent.replyCredit : null)
+            )
           );
           return this.publishIntent(next, opts, advances + 1);
         }
         throw e;
       }
       this.store.markReplyIntentSent(key.scope, key.part);
-      this.afterPublish(intent.channelId, body, intent.replyMessageId, opts, purgeEpochBeforePublish, replyCapture);
+      this.afterPublish(intent.channelId, body, intent.replyMessageId, opts, purgeEpochBeforePublish, replyCapture, recordText);
       return { message_id: intent.replyMessageId, status: "sent" };
     });
   }
@@ -38600,9 +39218,21 @@ var BridgeAgent = class _BridgeAgent {
    */
   intentVerifies(intent) {
     if (!intent.body) return false;
+    const credit = intent.replyCredit ?? null;
+    if (credit !== null && !isReplyCredit(credit)) return false;
     const id = replyMessageId(this.replyIdKey, this.cfg.identityId, intent.channelId, intent);
     if (id !== intent.replyMessageId) return false;
-    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body) === intent.bodyMac;
+    return replyBodyMac(this.replyIdKey, intent.replyMessageId, intent.channelId, intent.body, credit ?? void 0) === intent.bodyMac;
+  }
+  /**
+   * Weather/currency Task 17: what a verified row's reply is RECORDED as. Null credit: the decoded text unchanged (null
+   * for an a2a body). "weatherapi": the text minus the exact credit suffix. Undefined: the row is refused (an unknown
+   * credit, a credited a2a body, or a credited text without the exact suffix).
+   */
+  recordTextOf(credit, body) {
+    if (credit === null) return body.kind === "text" ? body.text : null;
+    if (!isReplyCredit(credit) || body.kind !== "text" || !body.text.endsWith(WEATHER_CREDIT_SUFFIX)) return void 0;
+    return body.text.slice(0, body.text.length - WEATHER_CREDIT_SUFFIX.length);
   }
   /**
    * SEC-06 #18 item 3: a rate-limited reply retries the PUBLISH in-process
@@ -40009,6 +40639,12 @@ var BridgeAgent = class _BridgeAgent {
    * frozen at receipt) AND a window-eligible turn (voiceWindowEligible), whatever the window size. Two call sites: the voice
    * window flush, and the ingest tap block when the window did not take the turn (off, 0 by default). Like the typed tap, the write-time owner scope's pinned identity must be the speaking identity;
    * otherwise nothing is written (H-4). Logs are content-free (U17). Never throws.
+   *
+   * Bridge 0.33.1 (architect Q2, C5 not accepted): a turn on a voice channel V carries `parent`, its P from the
+   * per-frame verdict. The scope is ownerScopeForWrite(P) (P's pin and roster, as for a turn on P), the item keeps
+   * channelId = V (so V's own capture still guards it in the store), and P's receipt capture is checked at commit,
+   * inside the memory mutex: a purge or room clear of P since receipt writes nothing. No P capture at receipt, or no
+   * persisted V -> P link (the purge of P reaches V's items only through it): nothing is written.
    */
   async tapUnifiedVoice(m, c) {
     const skip = (reason) => this.logUnifiedTapSkip(reason);
@@ -40017,9 +40653,22 @@ var BridgeAgent = class _BridgeAgent {
       if (m.authorization?.relay_speaker !== "owner" || m.speaker === void 0) return skip("audience");
       if (c.stamp === void 0) return skip("stamp_missing");
       if (c.capture.purgeEpoch < 0) return skip("purged");
-      const scopeId = await this.ownerScopeForWrite(m.channel_id);
+      const parent3 = c.parent;
+      const parentCapture = parent3?.capture;
+      if (parent3 === void 0 && this.voiceChannels.isVoice(m.channel_id)) return skip("scope");
+      if (parent3 !== void 0) {
+        if (parentCapture === void 0 || parentCapture.purgeEpoch < 0) return skip("scope");
+        if (this.store.voiceChannelParent(m.channel_id) !== parent3.channelId) return skip("scope");
+      }
+      const scopeId = await this.ownerScopeForWrite(parent3?.channelId ?? m.channel_id);
       if (scopeId === null) return skip("scope");
       if (parseOwnerDmScopeId(scopeId)?.ownerIdentityId !== m.speaker.identityId) return skip("scope");
+      const precommit = parent3 === void 0 || parentCapture === void 0 ? void 0 : () => {
+        const now = this.store.itemCapture(parent3.channelId);
+        if (now.purgeEpoch !== parentCapture.purgeEpoch) return "purged";
+        if (now.roomClearGeneration !== parentCapture.roomClearGeneration) return "room_cleared";
+        return null;
+      };
       const r = await this.items.commit({
         scopeKind: "owner_dm",
         scopeId,
@@ -40030,7 +40679,8 @@ var BridgeAgent = class _BridgeAgent {
         source: "owner_voice",
         trust: OWNER_VOICE_TRUST,
         text: typeof m.text === "string" ? m.text : "",
-        expect: { ...c.capture, clearGeneration: c.stamp }
+        expect: { ...c.capture, clearGeneration: c.stamp },
+        ...precommit ? { precommit } : {}
       });
       return r.ok ? { ok: true } : { ok: false, reason: r.reason };
     } catch {
@@ -42209,11 +42859,20 @@ var BridgeAgent = class _BridgeAgent {
     const purgeEpochAtReceipt = /* @__PURE__ */ new Map();
     const itemCaptureAtReceipt = /* @__PURE__ */ new Map();
     const recallModeEpochAtReceipt = this.store.recallState().modeEpoch;
+    const unifiedVoiceParentAt = (p) => {
+      const cap = itemCaptureAtReceipt.get(p);
+      return { channelId: p, capture: cap === void 0 ? void 0 : { ...cap, purgeEpoch: purgeEpochAtReceipt.get(p) ?? -1 } };
+    };
     for (const m of entries) {
       this.lastInboundAt.set(m.channelId, receivedAt);
       if (m.voiceMode === true) this.heartbeat.noteVoiceActivity();
       if (!purgeEpochAtReceipt.has(m.channelId)) purgeEpochAtReceipt.set(m.channelId, this.store.conversationPurgeEpoch(m.channelId));
       if (this.unifiedOn && !itemCaptureAtReceipt.has(m.channelId)) itemCaptureAtReceipt.set(m.channelId, this.store.itemCapture(m.channelId));
+      const receiptParent = this.voiceChannels.parentOf(m.channelId);
+      if (receiptParent !== void 0) {
+        if (!purgeEpochAtReceipt.has(receiptParent)) purgeEpochAtReceipt.set(receiptParent, this.store.conversationPurgeEpoch(receiptParent));
+        if (this.unifiedOn && !itemCaptureAtReceipt.has(receiptParent)) itemCaptureAtReceipt.set(receiptParent, this.store.itemCapture(receiptParent));
+      }
       this.recallReceipt.set(m.messageId, { purgeEpoch: purgeEpochAtReceipt.get(m.channelId), modeEpoch: recallModeEpochAtReceipt });
       receiptIds.push(m.messageId);
       const stamp = voiceStamp.get(m.channelId);
@@ -42559,6 +43218,7 @@ var BridgeAgent = class _BridgeAgent {
                 pending: Promise.resolve(),
                 purgeEpoch: purgeEpochAtReceipt.get(m.channelId),
                 itemCapture: itemCaptureAtReceipt.get(m.channelId),
+                ...voiceParent !== void 0 ? { voiceParent: unifiedVoiceParentAt(voiceParent) } : {},
                 bufferGeneration
               };
               this.voiceCoalescing.set(windowKey, win);
@@ -42589,7 +43249,7 @@ var BridgeAgent = class _BridgeAgent {
                 const merged = { ...held, text, memory: windowMemory };
                 if (this.unifiedOn) {
                   const snap = win.itemCapture ?? { ...this.store.itemCapture(channelId), purgeEpoch: -1 };
-                  const work = this.tapUnifiedVoice(merged, { stamp: this.ingestGeneration.get(firstId), capture: { ...snap, purgeEpoch: win.purgeEpoch ?? -1 } });
+                  const work = this.tapUnifiedVoice(merged, { stamp: this.ingestGeneration.get(firstId), capture: { ...snap, purgeEpoch: win.purgeEpoch ?? -1 }, ...win.voiceParent ? { parent: win.voiceParent } : {} });
                   this.unifiedWork.add(work);
                   void work.finally(() => this.unifiedWork.delete(work));
                 }
@@ -42679,7 +43339,11 @@ var BridgeAgent = class _BridgeAgent {
                 );
                 if (windowEligible && turnAuthorization.relay_speaker === "owner") {
                   const snap = itemCaptureAtReceipt.get(m.channelId) ?? { ...this.store.itemCapture(m.channelId), purgeEpoch: -1 };
-                  const work = this.tapUnifiedVoice(runtimeEntry(false, { recent: [], facts: [] }), { stamp: this.ingestGeneration.get(m.messageId), capture: { ...snap, purgeEpoch: purgeEpochAtReceipt.get(m.channelId) ?? -1 } });
+                  const work = this.tapUnifiedVoice(runtimeEntry(false, { recent: [], facts: [] }), {
+                    stamp: this.ingestGeneration.get(m.messageId),
+                    capture: { ...snap, purgeEpoch: purgeEpochAtReceipt.get(m.channelId) ?? -1 },
+                    ...voiceParent !== void 0 ? { parent: unifiedVoiceParentAt(voiceParent) } : {}
+                  });
                   this.unifiedWork.add(work);
                   void work.finally(() => this.unifiedWork.delete(work));
                 }
@@ -42692,7 +43356,7 @@ var BridgeAgent = class _BridgeAgent {
               this.memory,
               m.channelId,
               m.envelope.sender_id,
-              parsed.text,
+              m.envelope.sender_id === this.cfg.identityId ? stripCreditSuffix(parsed.text) : parsed.text,
               m.messageId,
               m.voiceMode ? "voice" : "text",
               purgeEpochAtTap
@@ -43490,21 +44154,49 @@ ${channelId}`;
    */
   searchProvidersSockets = /* @__PURE__ */ new Map();
   /**
-   * The D28 value the files were last recomputed for; null until the first socket observation, so that observation
-   * always recomputes (final review I-1), even when it is non-capable.
+   * Weather/currency U6 (H-1): the same AND-over-sockets state for utility_tools_v1, kept separately per socket, so a
+   * runtime that declares search_providers_v2 but not utility_tools_v1 (0.14.0, 0.14.1) keeps web_extract and never
+   * sees a utility name.
+   */
+  utilityToolsSockets = /* @__PURE__ */ new Map();
+  /**
+   * The (search, utility) tuple the files were last recomputed for; null until the first socket observation, so that
+   * observation always recomputes (final review I-1), even when it is non-capable. One trigger keyed on BOTH values.
    */
-  searchProvidersState = null;
+  capabilityState = null;
   searchCapabilityRefetchTimer = null;
   /** When the current burst's first change happened (valid while the timer is set). */
   searchCapabilityBurstStart = 0;
   /** The D28 value in the last report posted (null until one is); a change needs a refetch to reach the web. */
   lastReportedSearchProviders = null;
+  /** U6: the utility_tools_v1 value in the last report posted (null until one is). */
+  lastReportedUtilityTools = null;
   noteSearchProvidersSocket(token, declared) {
     this.searchProvidersSockets.set(token, declared);
-    this.onSearchProvidersMaybeChanged();
+    this.onCapabilityMaybeChanged();
   }
   clearSearchProvidersSocket(token) {
-    if (this.searchProvidersSockets.delete(token)) this.onSearchProvidersMaybeChanged();
+    if (this.searchProvidersSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  noteUtilityToolsSocket(token, declared) {
+    this.utilityToolsSockets.set(token, declared);
+    this.onCapabilityMaybeChanged();
+  }
+  clearUtilityToolsSocket(token) {
+    if (this.utilityToolsSockets.delete(token)) this.onCapabilityMaybeChanged();
+  }
+  /** U6: every attached runtime socket declared utility_tools_v1; no socket attached means absent (false). */
+  utilityToolsCapable() {
+    if (this.utilityToolsSockets.size === 0) return false;
+    for (const v of this.utilityToolsSockets.values()) if (!v) return false;
+    return true;
+  }
+  /** U6: the features every attached runtime socket declared, for the policy functions. */
+  capabilityFeatures() {
+    const out = /* @__PURE__ */ new Set();
+    if (this.searchProvidersCapable()) out.add("search_providers_v2");
+    if (this.utilityToolsCapable()) out.add("utility_tools_v1");
+    return out;
   }
   /** D28: every attached runtime socket declared search_providers_v2; no socket attached means absent (false). */
   searchProvidersCapable() {
@@ -43531,14 +44223,14 @@ ${channelId}`;
    * D35 (P-4): on a capability change, rewrite manifest-policy.json at once from the stored manifest, the kill
    * switches and the new capability, then a debounced refetch (one per burst) only when needed.
    */
-  onSearchProvidersMaybeChanged() {
-    const capable = this.searchProvidersCapable();
-    const prev = this.searchProvidersState;
-    if (capable === prev) return;
-    this.searchProvidersState = capable;
-    this.recomputeManifestPolicy(capable);
+  onCapabilityMaybeChanged() {
+    const next = { search: this.searchProvidersCapable(), utility: this.utilityToolsCapable() };
+    const prev = this.capabilityState;
+    if (prev !== null && prev.search === next.search && prev.utility === next.utility) return;
+    this.capabilityState = next;
+    this.recomputeManifestPolicy(this.capabilityFeatures());
     if (this.closingDown) return;
-    if (prev === null && !capable) return;
+    if (prev === null && !next.search && !next.utility) return;
     const now = Date.now();
     if (this.searchCapabilityRefetchTimer !== null) clearTimeout(this.searchCapabilityRefetchTimer);
     else this.searchCapabilityBurstStart = now;
@@ -43556,7 +44248,7 @@ ${channelId}`;
   searchCapabilityRefetchNeeded() {
     if (!this.bootConfigSettled || this.closingDown) return false;
     const inForce = (this.cfg.ownerGrantPin?.pin ?? null) !== null && this.toolGrantManifest !== null;
-    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable();
+    return inForce || this.lastReportedSearchProviders !== this.searchProvidersCapable() || this.lastReportedUtilityTools !== this.utilityToolsCapable();
   }
   /**
    * D35: the local recompute. Widening (web_extract back in) only while the binding for the in-force manifest stands,
@@ -43564,15 +44256,16 @@ ${channelId}`;
    * lists web_extract loses it at once, so an older runtime never reads it as unreadable (which drops every grant).
    * Content-free; a write failure is logged and the debounced refetch tries again.
    */
-  recomputeManifestPolicy(capable) {
+  recomputeManifestPolicy(features) {
     const pin = this.cfg.ownerGrantPin?.pin ?? null;
     const manifest = pin !== null ? this.toolGrantManifest : null;
     try {
       if (manifest !== null && this.manifestBinding !== null && this.manifestBinding.counter === manifest.counter) {
-        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, capable));
+        this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, manifestPolicyFor(manifest, { ownerDm: this.ownerDmManifestGrants, room: this.roomManifestGrants }, features));
         return;
       }
-      if (capable) return;
+      const withheld = new Set(Object.keys(TOOL_FEATURE).filter((t) => !toolAllowedByFeatures(t, features)));
+      if (withheld.size === 0) return;
       const path = join17(runtimeConfigDir(this.home, this.cfg.identityId), MANIFEST_POLICY_FILE);
       if (!existsSync5(path)) return;
       let doc;
@@ -43582,10 +44275,10 @@ ${channelId}`;
         return;
       }
       const tools = doc?.manifest_tools;
-      if (!Array.isArray(tools) || !tools.includes("web_extract")) return;
+      if (!Array.isArray(tools) || !tools.some((t) => typeof t === "string" && withheld.has(t))) return;
       this.grantWriters.writeManifestPolicy(this.home, this.cfg.identityId, {
         v: 1,
-        manifest_tools: tools.filter((t) => typeof t === "string" && t !== "web_extract"),
+        manifest_tools: tools.filter((t) => typeof t === "string" && !withheld.has(t)),
         secret_path_mode: "enforce"
       });
     } catch (e) {
@@ -44122,6 +44815,9 @@ var BRIDGE_ERRORS = {
   // C9 (spec §4.1.6 step 1): another copy of this agent took its SecureComs
   // session (WS 4409), so this copy stopped. Every local route but /healthz.
   session_superseded: { http: 503, message: "another copy of this agent took its session; this copy stopped" },
+  // Weather/currency Task 17 (OQ-P1): a send frame's credit is not the closed value, or rides an a2a frame. TERMINAL:
+  // the inbound is retired, so the model (and the weather call) never runs again for it.
+  reply_credit_unknown: { http: 400, message: "reply credit not recognised; not sent" },
   internal: { http: 500, message: "internal error" }
 };
 function errorBody(code, detail) {
@@ -44151,6 +44847,7 @@ function withConsumerGrants(m, perToolConsumer) {
 }
 var MANIFEST_GRANTS_FEATURE = "manifest_grants_v1";
 var SEARCH_PROVIDERS_FEATURE = "search_providers_v2";
+var UTILITY_TOOLS_FEATURE = "utility_tools_v1";
 var CONSTANT_TOOL_NAMES = Object.freeze({
   owner_dm: Object.freeze(["current_time", "web_search"]),
   team_room: Object.freeze(["current_time"])
@@ -44182,6 +44879,15 @@ function withSearchCapability(m, consumerHasFeature, signedProvider) {
   if (kept.length === a.tool_grants.length) return m;
   return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
 }
+var UTILITY_TOOL_NAMES = /* @__PURE__ */ new Set(["weather_forecast", "currency_convert"]);
+function withUtilityCapability(m, consumerHasFeature) {
+  if (consumerHasFeature) return m;
+  const a = m.authorization;
+  if (!a) return m;
+  const kept = a.tool_grants.filter((g) => !UTILITY_TOOL_NAMES.has(g.tool));
+  if (kept.length === a.tool_grants.length) return m;
+  return { ...m, authorization: Object.freeze({ ...a, tool_grants: kept.length === 0 ? NO_GRANTS : Object.freeze(kept) }) };
+}
 
 // src/http-server.ts
 function writeSse(res, msgs, onWriteError) {
@@ -44205,7 +44911,7 @@ data: ${JSON.stringify(msgs[i])}
 function deliverSseBatch(res, batch, agent, onWriteError) {
   const withheld = agent.harnessGrantsWithheld();
   const provider = agent.signedSearchProvider();
-  const left3 = writeSse(res, batch.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)), onWriteError);
+  const left3 = writeSse(res, batch.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)), onWriteError);
   const leftIds = new Set(left3.map((message) => message.message_id));
   agent.ackRuntimeMessages(batch.filter((message) => !leftIds.has(message.message_id)).map((message) => message.message_id));
   if (left3.length) agent.requeueFront(batch.filter((message) => leftIds.has(message.message_id)));
@@ -44237,7 +44943,7 @@ var OTHER_CAP = 8 * 1024;
 var a2aSchema = z3.object({
   a2a_version: z3.string().min(1),
   kind: z3.enum(["message", "task", "artifact"]),
-  object: z3.record(z3.unknown())
+  object: z3.record(z3.string(), z3.unknown())
 });
 var sendAttachmentSchema = z3.object({
   channel_id: z3.string().min(1),
@@ -44479,7 +45185,7 @@ function createHttpServer(agent, opts) {
         const drained = await agent.drain(channel, wait);
         const withheld = agent.harnessGrantsWithheld();
         const provider = agent.signedSearchProvider();
-        return json(res, 200, drained.map((m) => withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider)));
+        return json(res, 200, drained.map((m) => withUtilityCapability(withSearchCapability(withManifestCapability(withHarnessGrants(withConsumerGrants(m, false), withheld), false), false, provider), false)));
       }
       if (method === "GET" && path === "/v1/events") {
         const channel = url.searchParams.get("channel_id") ?? void 0;
@@ -44654,6 +45360,7 @@ function attachAgentWebSocket(server, agent, opts) {
       perToolGrants: false,
       manifestGrants: false,
       searchProviders: false,
+      utilityTools: false,
       // helloWaitMs 0 keeps today's synchronous initial flush exactly (the opt-out the existing tests use).
       deliveryOpen: helloWaitMs <= 0,
       deliveryToken: /* @__PURE__ */ new Map(),
@@ -44707,14 +45414,14 @@ function attachAgentWebSocket(server, agent, opts) {
             continue;
           }
           const out = withConsumerNotes(
-            withSearchCapability(
+            withUtilityCapability(withSearchCapability(
               withManifestCapability(
                 withHarnessGrants(withConsumerGrants(batch[i], session.perToolGrants), !session.perToolGrants && agent.harnessGrantsWithheld()),
                 session.manifestGrants
               ),
               session.searchProviders,
               agent.signedSearchProvider()
-            ),
+            ), session.utilityTools),
             batch[i],
             session,
             agent
@@ -44771,6 +45478,7 @@ function attachAgentWebSocket(server, agent, opts) {
       if (session.perToolGrants) agent.clearPerToolConsumer(session);
       if (session.manifestGrants) agent.clearManifestConsumer(session);
       agent.clearSearchProvidersSocket(session);
+      agent.clearUtilityToolsSocket(session);
     };
     current = { sock, cleanup, sweepStale };
     sock.on("close", cleanup);
@@ -44811,7 +45519,10 @@ function sendJson(sock, body) {
   } catch {
   }
 }
+var ReplyCreditUnknownError = class extends Error {
+};
 function sendErrorCode(e) {
+  if (e instanceof ReplyCreditUnknownError) return "reply_credit_unknown";
   if (e instanceof ChannelPendingError) return "channel_pending";
   if (e instanceof RateLimitedError) return "rate_limited";
   if (e instanceof AgentPausedSendError) return "agent_paused";
@@ -44872,6 +45583,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     agent.noteConsumerCapability(manifest ? "ok" : session.harnessClaimed ? "harness_consumer" : "missing");
     session.searchProviders = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(SEARCH_PROVIDERS_FEATURE);
     agent.noteSearchProvidersSocket(session, session.searchProviders);
+    session.utilityTools = session.consumer === "runtime" && session.harnessClaimed !== true && perTool && Array.isArray(m.features) && m.features.includes(UTILITY_TOOLS_FEATURE);
+    agent.noteUtilityToolsSocket(session, session.utilityTools);
     if (session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_NOTES_FEATURE)) {
       agent.noteNotesConsumer();
     }
@@ -44879,7 +45592,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     if (session.recallConsumer) agent.noteRecallConsumer();
     session.unifiedConsumer = agent.unifiedFeatureOn() && session.consumer === "runtime" && session.harnessClaimed !== true && Array.isArray(m.features) && m.features.includes(MEMORY_UNIFIED_FEATURE);
     if (session.unifiedConsumer) agent.noteUnifiedConsumer();
-    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE] });
+    sendJson(sock, { type: "hello", features: ["nack", MEMORY_NOTES_FEATURE, MEMORY_RECALL_FEATURE, ...agent.unifiedFeatureOn() ? [MEMORY_UNIFIED_FEATURE] : [], MANIFEST_GRANTS_FEATURE, SEARCH_PROVIDERS_FEATURE, REPLY_CREDIT_FEATURE] });
     if (!session.deliveryOpen) {
       session.deliveryOpen = true;
       flush();
@@ -44908,7 +45621,8 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
   }
   const replyFailed = (e, inReplyTo) => {
     const code = sendErrorCode(e);
-    if ((code === "agent_paused" || code === "send_forbidden") && typeof inReplyTo === "string") {
+    const terminal = code === "agent_paused" || code === "send_forbidden" || code === "reply_credit_unknown";
+    if (terminal && typeof inReplyTo === "string") {
       inflight.delete(inReplyTo);
       session.deliveryToken.delete(inReplyTo);
       session.shownRecall.delete(inReplyTo);
@@ -44916,7 +45630,7 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
       agent.ackRuntimeMessages([inReplyTo]);
     }
     sendJson(sock, { ...wsErrorFrame(code), ...typeof inReplyTo === "string" ? { in_reply_to: inReplyTo } : {} });
-    if (code === "agent_paused" || code === "send_forbidden") flush();
+    if (terminal) flush();
   };
   if (m.type === "send") {
     if (typeof m.channel_id !== "string" || !m.channel_id) {
@@ -44933,8 +45647,14 @@ async function handleInbound(sock, agent, data, inflight, flush, session) {
     }
     const record = typeof m.in_reply_to === "string" ? inflight.get(m.in_reply_to) : void 0;
     const callBufferReply = session.consumer === "runtime" && session.perToolGrants === true && session.harnessClaimed !== true && typeof m.in_reply_to === "string" && record !== void 0 && session.deliveryToken.get(m.in_reply_to) !== void 0 && record.channel_id === m.channel_id && !agent.isRuntimeMessageRetired(m.in_reply_to);
+    if (m.credit !== void 0 && (m.a2a !== void 0 || !isReplyCredit(m.credit))) {
+      writeServiceLog2("error", "reply.credit_unknown");
+      replyFailed(new ReplyCreditUnknownError(), m.in_reply_to);
+      return;
+    }
     const sendOpts = {
       agentTurn: isAgentTurn(agent, m),
+      ...isReplyCredit(m.credit) ? { credit: m.credit } : {},
       ...typeof m.in_reply_to === "string" ? { inReplyTo: m.in_reply_to } : {},
       ...typeof m.idempotency_key === "string" ? { idempotencyKey: m.idempotency_key } : {},
       ...callBufferReply ? { callBufferReply: true } : {}