@stratusagent/gateway 0.14.2 → 0.14.4

package/dist/index.js

@@ -9,9 +9,10 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm } from 'node:fs/promises';
 import path from 'node:path';
-import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, CONTEXT_FLOOR_METADATA_KEY, CONTEXT_SUMMARY_METADATA_KEY, PENDING_APPROVAL_METADATA_KEY, SESSION_TAINTED_BY_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, } from '@stratusagent/core';
-import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, DELEGATE_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
+import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, InMemorySessionStore, MEMORY_PASS_MAX_MODEL_CALLS, MEMORY_PASS_RULES, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, CONTEXT_FLOOR_METADATA_KEY, CONTEXT_SUMMARY_METADATA_KEY, PENDING_APPROVAL_METADATA_KEY, SESSION_TAINTED_BY_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, resolveToolRisk, } from '@stratusagent/core';
+import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, DELEGATE_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageSayTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
 import { createFleetReader } from "./fleet.js";
+import { createMemoryPassHost } from "./memory-passes.js";
 import { createEventIntake, summarizeEvents, } from "./event-intake.js";
 import { SqliteEventStore } from "./events.js";
 import { createSchedulerRuntime, isScheduleSessionId, SqliteScheduleStore, SCHEDULE_SESSION_ID_PREFIX, } from "./schedules.js";
@@ -23,7 +24,7 @@ export { SqliteEventStore, EVENT_BLOCK_MAX_BYTES, EVENT_DEDUP_WINDOW_MS, EVENT_D
 export { createEventIntake, mapGithubDelivery, parseStandardWebhookEvent, verifyGithubSignature, verifyStandardWebhookSignature, DEFAULT_EVENT_MAX_BODY_BYTES, EVENT_SOURCE_REQUESTS_PER_MINUTE, } from "./event-intake.js";
 import { createLocalCommandExecutor } from '@stratusagent/executor-local';
 import { loadPlugins, } from '@stratusagent/plugins';
-import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, grantSoulCredential, withSoulFileLock, addNamedCredential, appendCredentialAudit, replaceNamedCredential, NamedCredentialMissingError, namedCredentialSource, NamedCredentialExistsError, CREDENTIAL_NAME_PATTERN, quoteShellArg, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, stratusHomePath, intakeStatePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, syncDirectory, writeFileSynced, } from '@stratusagent/state';
+import { BUILTIN_EXECUTOR_NAME, BUILTIN_MEMORY_STORE_NAME, BUILTIN_PROVIDER_NAMES, createDemoTool, createFileCredentialResolver, resolveDaemonCredential, createHomeMemoryStore, drainSharedMemory, hasBracketedLegacyStateIn, createRuntimeProvider, describeServingModel, DEFAULT_STRATUS_AGENT, isRegisteredProviderName, loadChannelTransportSecrets, registeredProviderNameOf, loadOperatorSkills, loadRosterSouls, FALLBACK_ACTIVE_METADATA_KEY, loadSoulFile, grantSoulCredential, withSoulFileLock, addNamedCredential, appendCredentialAudit, replaceNamedCredential, NamedCredentialMissingError, namedCredentialSource, NamedCredentialExistsError, CREDENTIAL_NAME_PATTERN, quoteShellArg, migrateLegacyMemory, PROVIDER_STATE_METADATA_KEYS, ConfigFileError, loadConfigFile, resolveConfigLocation, resolveConfiguredSoul, resolveRuntimeConfig, runsOnHarness, applySoulPins, assertStateCompatible, unlistedToolsFor, stratusHomePath, intakeStatePath, fleetDbIn, createAgentWorkspaces, createPluginStateDirectories, createHostProtectedPaths, foldedAgentId, syncDirectory, writeFileSynced, } from '@stratusagent/state';
 const DEFAULT_IDLE_TIMEOUT_MS = 120_000;
 /**
  * How long a parked call waits for a person. Long enough to survive a
@@ -419,6 +420,8 @@ export const createGateway = (options = {}) => {
     // process-global.
     const fileMemory = createHomeMemoryStore(env);
     let selectedMemory = fileMemory;
+    // The built-in store takes a list in `supersedes`; a plugin's says so.
+    let selectedMemorySupersedesMany = true;
     const memory = createRoutedMemoryStore(() => selectedMemory);
     let selectedExecutor;
     // What loaded plugins contributed besides tools and skills. The loader
@@ -985,15 +988,27 @@ export const createGateway = (options = {}) => {
     // the file on disk is temporarily broken (an operator mid-edit).
     let lastGoodConfigSnapshot;
     /**
-     * Said at load, because the allowlist fails open: `tools` omitted is
-     * every registered tool, the opposite of what `skills` and `credentials`
-     * do when omitted, and a soul that never wrote the key holds `shell.run`
-     * the moment that plugin is enabled. The built-in agent is exempt — it
-     * has no file to add the key to.
+     * Read from the home once, on first use, which is after the migrations
+     * `serve` runs before it starts the gateway. It changes only when 0005
+     * first records it, and that happens before a daemon of this build runs.
+     */
+    let unlistedToolsRead;
+    const unlistedTools = () => options.unlistedTools ?? (unlistedToolsRead ??= unlistedToolsFor(env));
+    /**
+     * Said at load, because an omitted `tools` list is a quiet downgrade on a
+     * home this build set up: it is only the tools registered as safe, so an
+     * agent whose soul never wrote the key cannot run a shell, write a file
+     * or send a message, and nothing else says why. On a home an older build
+     * set up it is every tool, as it always was there, and the line says so
+     * the way it always did. The built-in agent is exempt: it has no file,
+     * and says `tools: ["*"]` in code.
      */
     const warnNoToolsList = (agentId, soulPath) => {
-        warn(`agent ${agentId} has no tools: list, so it may call every tool this daemon loads — `
-            + `add tools: [...] to ${soulPath} to say which`);
+        warn(unlistedTools() === 'every'
+            ? `agent ${agentId} has no tools: list, so it may call every tool this daemon loads — `
+                + `add tools: [...] to ${soulPath} to say which`
+            : `agent ${agentId} has no tools: list, so it gets only safe tools (reads and memory) — `
+                + `add tools: [...] to ${soulPath} to give it more, or tools: ["*"] for every tool`);
     };
     const defaultAgentId = async () => {
         // Identity only — never full runtime resolution: credential checks do
@@ -1432,6 +1447,23 @@ export const createGateway = (options = {}) => {
         const ts = typeof posted === 'object' && posted !== null ? posted.ts : undefined;
         return typeof ts === 'string' && ts.length > 0 ? { id: ts } : {};
     }, { defaultThread: (session, destination) => scheduler.reportThreadFor(session, destination) }));
+    // A mid-task message goes where the conversation is, through the channel
+    // carrying this agent there, and nowhere else (card 1009). A session no
+    // channel started (a terminal run, a schedule nobody watches) has nobody
+    // to say it to before the reply.
+    tools.register(createMessageSayTool(async ({ session, text }) => {
+        const agentId = session.agent.id;
+        const kind = session.metadata?.channel;
+        const { adapter } = typeof kind === 'string'
+            ? channelCarrying(kind, agentId, (candidate) => candidate.say !== undefined)
+            : { adapter: undefined };
+        if (!adapter?.say) {
+            throw new Error(typeof kind === 'string'
+                ? `This conversation's channel (${kind}) cannot take a mid-task message. Say it in your reply.`
+                : 'This conversation is not in a channel that can take a mid-task message. Say it in your reply.');
+        }
+        await adapter.say({ sessionId: session.id, agentId, text });
+    }));
     // The same carrying rule again: a channel is created by the asking
     // agent's own app, whose token never leaves the adapter, and so becomes
     // that app's to post in and read.
@@ -1722,7 +1754,13 @@ export const createGateway = (options = {}) => {
         // bearer credential the model is handed, and whoever it reaches can
         // store a key and amend the soul. That is the operator's to allow.
         const allowlist = session.agent.tools ?? registry.get(agentId)?.tools;
-        const linkAllowed = allowlist === undefined || matchesToolAllowlist(CREDENTIAL_REQUEST_TOOL_NAME, allowlist);
+        // An omitted list grants the safe tools, this one among them, but a
+        // link is the operator's to allow by naming it, so only a list says yes.
+        // On a home an older build set up an omitted list is every tool, and
+        // has always allowed a link there.
+        const linkAllowed = allowlist === undefined
+            ? unlistedTools() === 'every'
+            : matchesToolAllowlist(CREDENTIAL_REQUEST_TOOL_NAME, allowlist);
         // Why no form went up, said to the agent beside the link that replaces
         // it, so it can tell the person why they are getting a link instead.
         let formUnavailable;
@@ -2125,7 +2163,9 @@ export const createGateway = (options = {}) => {
         if (!Array.isArray(requested) || requested.some((name) => typeof name !== 'string' || name.length === 0)) {
             return 'A sub-agent\'s tools are a list of tool names.';
         }
-        const allowlist = parent.agent.tools;
+        // Read the way the runner reads it for the parent's own calls: the
+        // session's copy, else the registered agent's.
+        const allowlist = parent.agent.tools ?? registry.get(parent.agent.id)?.tools;
         for (const name of requested) {
             if (/[*?]/.test(name)) {
                 return `A sub-agent's tools are exact names, and ${name} is a pattern.`;
@@ -2133,12 +2173,21 @@ export const createGateway = (options = {}) => {
             if (subAgentNeverGets(name)) {
                 return `${name} is never given to a sub-agent, even by an agent that holds it.`;
             }
-            if (!tools.get(name)) {
+            const tool = tools.get(name);
+            if (!tool) {
                 return `There is no tool named ${name}.`;
             }
             // The parent's allowlist as its running turn holds it: a slice can
-            // only narrow what that turn may already do.
-            if (allowlist !== undefined && !matchesToolAllowlist(name, allowlist)) {
+            // only narrow what that turn may already do. With no list, that is
+            // the tools registered as safe (every tool on a home an older build
+            // set up), and the slice is held to the same rule: naming a gated
+            // tool must not hand it to the sub-agent.
+            if (allowlist === undefined) {
+                if (unlistedTools() !== 'every' && resolveToolRisk(tool) !== 'safe') {
+                    return `${name} is not a safe tool, and ${parent.agent.id}'s soul has no tools: list, so it gets only safe tools and a sub-agent of it cannot have ${name}.`;
+                }
+            }
+            else if (!matchesToolAllowlist(name, allowlist)) {
                 return `${name} is not one of ${parent.agent.id}'s tools, so a sub-agent of it cannot have it.`;
             }
         }
@@ -2319,6 +2368,7 @@ export const createGateway = (options = {}) => {
             // Asking a person for a key is harmless to grant: they decide
             // everything after the question, so no soul has to list it.
             grantedToEveryAgent: subAgent ? [] : [CREDENTIAL_REQUEST_TOOL_NAME],
+            unlistedTools: unlistedTools(),
             ...(subAgent ? {} : { skills: skillCatalog, memory }),
             streaming: true,
             ...(maxTurns !== undefined ? { maxTurns } : {}),
@@ -2861,7 +2911,13 @@ export const createGateway = (options = {}) => {
      * soul. Only that path passes it.
      */
     const dispatchInternal = async (input, absorbedKeys = [], subAgent, 
-    /** See `RunInput.steer`; passed by `dispatch` for an opted-in caller. */
+    /**
+     * See `RunInput.steer`; passed by `dispatch` for an opted-in caller.
+     * Handed the turn's own signal — the one the runner was given, which
+     * the watchdog, `abortTurns` and a restart's window abort as well as
+     * the callers — so it takes nothing into a turn that is already
+     * stopping (card 959).
+     */
     steer) => {
         // Re-read on every turn, not once at start: a newer build that stamps
         // the home while this daemon is serving has formats this build does not
@@ -2982,12 +3038,13 @@ export const createGateway = (options = {}) => {
                     userMessage: input.userMessage,
                     ...(input.images !== undefined ? { images: input.images } : {}),
                     ...(input.addressed !== undefined ? { addressed: input.addressed } : {}),
+                    ...(input.replyOptional === true ? { replyOptional: true } : {}),
                     ...(input.idempotencyKey !== undefined ? { idempotencyKey: input.idempotencyKey } : {}),
                     ...(absorbedKeys.length > 0 ? { absorbedKeys: [...absorbedKeys] } : {}),
                     ...(hostedLoop ? { hostedLoop } : {}),
                     ...(input.metadata ? { metadata: input.metadata } : {}),
                     runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata),
-                    ...(steer !== undefined ? { steer } : {}),
+                    ...(steer !== undefined ? { steer: () => steer(signal) } : {}),
                     signal,
                 });
             }
@@ -2997,13 +3054,14 @@ export const createGateway = (options = {}) => {
                 userMessage: input.userMessage,
                 ...(input.images !== undefined ? { images: input.images } : {}),
                 ...(input.addressed !== undefined ? { addressed: input.addressed } : {}),
+                ...(input.replyOptional === true ? { replyOptional: true } : {}),
                 ...(input.idempotencyKey !== undefined ? { idempotencyKey: input.idempotencyKey } : {}),
                 ...(absorbedKeys.length > 0 ? { absorbedKeys: [...absorbedKeys] } : {}),
                 ...(hostedLoop ? { hostedLoop } : {}),
                 ...(input.earlier !== undefined && input.earlier.length > 0 ? { earlier: input.earlier } : {}),
                 metadata,
                 runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata, subAgent !== undefined),
-                ...(steer !== undefined ? { steer } : {}),
+                ...(steer !== undefined ? { steer: () => steer(signal) } : {}),
                 signal,
             });
         }));
@@ -3627,6 +3685,88 @@ export const createGateway = (options = {}) => {
         });
         return turn;
     };
+    // ---- memory passes (spec 962) -------------------------------------------
+    /**
+     * A pass's one model turn: the agent's provider and credentials, exactly
+     * the model asked for and never the fallback (cost stays what the
+     * operator chose), only the pass's two tools, no persona, skills, memory
+     * injection or delegates, and a session that is never stored. Its calls
+     * go through the same provider-call guards as every turn, and its events
+     * through the same bus, so a budget sees and counts them.
+     */
+    const runMemoryPassModel = async (run) => {
+        const source = await refreshAgent(run.agentId);
+        const resolved = await runtimeForAgent(source);
+        const { fallback: _fallback, ...primary } = resolved;
+        const config = (run.model !== undefined ? { ...primary, model: run.model } : primary);
+        const tools = new ToolRegistry();
+        for (const tool of run.tools) {
+            tools.register(tool);
+        }
+        // A step budget of n is n tool steps and one wrap-up, so this is the
+        // pass's model-call cap.
+        const maxTurns = MEMORY_PASS_MAX_MODEL_CALLS - 1;
+        let passRunner;
+        const provider = createRuntimeProvider(config, () => { }, async (session, call, context) => {
+            if (!passRunner) {
+                throw new Error('The Stratus runtime is not ready to execute tools yet.');
+            }
+            return passRunner.executeHostedToolCall(session, call, context);
+        }, maxTurns, async () => { }, providerContributions);
+        passRunner = new AgentRunner({
+            provider,
+            tools,
+            store: new InMemorySessionStore(),
+            bus,
+            maxTurns,
+            providerCallGuards,
+        });
+        const definition = {
+            id: source.definition.id,
+            name: source.definition.name,
+            instructions: MEMORY_PASS_RULES,
+            tools: run.tools.map((tool) => tool.name),
+            skills: [],
+            delegates: [],
+            ...(source.definition.credentials !== undefined ? { credentials: [...source.definition.credentials] } : {}),
+        };
+        await passRunner.run({
+            sessionId: run.sessionId,
+            agent: definition,
+            userMessage: run.prompt,
+            metadata: {
+                provider: config.provider,
+                ...(config.provider !== 'demo' && config.model !== undefined ? { model: config.model } : {}),
+                // The slice's label: the pass reads at the conversation's trust.
+                [SENDER_TRUST_METADATA_KEY]: run.trust,
+            },
+            signal: run.signal,
+        });
+    };
+    const memoryPassHost = createMemoryPassHost({
+        // Beside each agent's memory.jsonl, under the home the memory store uses.
+        stateDir: stratusHomePath(env),
+        stateHome: stratusHomePath(env),
+        run: randomUUID(),
+        memory,
+        supersedesMany: () => selectedMemorySupersedesMany,
+        sessions: store,
+        chain: {
+            idle: (sessionId) => !sessionChains.has(sessionId),
+            queue: (sessionId, work) => onSessionChain(sessionId, work),
+        },
+        hasAgent: (agentId) => sources.has(agentId),
+        isSubAgentSession: (session) => isSubAgentSession(session),
+        defaultModel: async (agentId) => {
+            const config = await runtimeForAgent(await refreshAgent(agentId));
+            return config.provider !== 'demo' ? config.model : undefined;
+        },
+        runModel: runMemoryPassModel,
+        emit: (event) => {
+            void bus.emit(event);
+        },
+        log,
+    });
     /**
      * A scheduled firing's own dispatch — single-flight and stopping-aware
      * like the public one, but permitted into the reserved `schedule:`
@@ -3923,6 +4063,7 @@ export const createGateway = (options = {}) => {
                 ...(head.input.agentId !== undefined ? { agentId: head.input.agentId } : {}),
                 userMessage: runnable.map((part) => part.input.userMessage).join(MERGED_SEPARATOR),
                 ...(images.length > 0 ? { images } : {}),
+                ...(runnable.every((part) => part.input.replyOptional === true) ? { replyOptional: true } : {}),
                 ...(head.input.earlier !== undefined ? { earlier: head.input.earlier } : {}),
                 ...(metadata !== undefined ? { metadata } : {}),
                 ...(signal !== undefined ? { signal } : {}),
@@ -3983,9 +4124,15 @@ export const createGateway = (options = {}) => {
             // the others' answer with it. A turn with a caller who cannot cancel
             // has no signal to join.
             const joint = turnInput.signal !== undefined ? joinableSignal([turnInput.signal]) : undefined;
+            // Admitted on the turn's own signal, not only the callers' joint one:
+            // the watchdog, `abortTurns` and a restart's window stop the turn
+            // without touching its callers, and a batch taken into a turn stopped
+            // while the store was read would share its failure instead of running
+            // next (card 959). The turn's signal follows the joint one, so this
+            // covers every caller giving up too.
             const steer = mergeable
-                ? () => takeSteered(input.sessionId, input.agentId, steered, (parts) => {
-                    if (joint?.signal.aborted === true) {
+                ? (turnSignal) => takeSteered(input.sessionId, input.agentId, steered, (parts) => {
+                    if (turnSignal.aborted) {
                         return false;
                     }
                     for (const part of parts) {
@@ -4191,6 +4338,7 @@ export const createGateway = (options = {}) => {
             log,
             warn,
             subAgents,
+            memoryPasses: memoryPassHost.handle,
             // Metadata only, from the reads the control API makes, with a log
             // line per read naming the plugin. See `createFleetReader`.
             fleet: (packageName) => createFleetReader({
@@ -4290,6 +4438,7 @@ export const createGateway = (options = {}) => {
                     + `. Enable the plugin that contributes it, or set memoryStore to ${BUILTIN_MEMORY_STORE_NAME}.`);
             }
             selectedMemory = contribution.store;
+            selectedMemorySupersedesMany = contribution.supersedesMany === true;
             log(`memory store ${memoryName} selected, from ${contributorOf('memory', memoryName) ?? 'a plugin'}`);
         }
     };
@@ -4361,6 +4510,10 @@ export const createGateway = (options = {}) => {
                 + `${reconciled.released.length} claim(s) released`);
         }
         await loadRoster();
+        // Agents loaded and the memory store chosen: a plugin that turned memory
+        // passes on in its setup had neither, so the claims a crash left open
+        // are settled now, before any turn can end and ask for a pass.
+        await memoryPassHost.ready();
         intakeState = await readIntakeState(env, warn);
         if (intakeState.paused) {
             log(`intake is paused (since ${intakeState.since ?? 'unknown'}); new work will be refused until it resumes`);
@@ -4604,6 +4757,12 @@ export const createGateway = (options = {}) => {
         // already past its `stopping` check loses to `dispatch`'s own
         // refusal — the second gate is why this needs no handshake.
         scheduler.stop();
+        // Memory passes are low priority: aborted at once rather than drained,
+        // settled from what they wrote, then the stop records. Awaited before
+        // the stores close, since a settle reads the memory store.
+        const passesClosed = memoryPassHost.close().catch((error) => {
+            warn(`memory passes did not close cleanly: ${error instanceof Error ? error.message : String(error)}`);
+        });
         // Deny what is parked before draining, or the drain waits out every
         // outstanding approval timeout — a shutdown would hang for as long as
         // the longest request had left. Each denial is a real decision the
@@ -4642,6 +4801,7 @@ export const createGateway = (options = {}) => {
             return channelsStopping;
         };
         const drain = (async () => {
+            await passesClosed;
             // A promotion still connecting channels finishes first, so every
             // channel it started is in the list stopped below; seeing `stopping`,
             // it starts nothing after that.
@@ -4710,11 +4870,12 @@ export const createGateway = (options = {}) => {
         // up: the wrapper it would wait for is around the very turn that
         // ignored its abort.
         const schedulerDrain = scheduler.drain();
+        const schedulerWindow = remaining();
         if (drained || abortAfterMs === undefined) {
             await schedulerDrain;
         }
-        else if (!(await settlesWithin(schedulerDrain, remaining()))) {
-            warn(`${kind}: a scheduled firing did not stop after being aborted; shutting down around it`);
+        else if (!(await settlesWithin(schedulerDrain, schedulerWindow))) {
+            warn(`${kind}: a scheduled firing did not stop within ${schedulerWindow}ms after being aborted; shutting down around it`);
         }
         // After the turns that might still be using them. A plugin holding a
         // browser is the reason this exists, and closing it out from under a
@@ -5064,6 +5225,12 @@ export const createGateway = (options = {}) => {
         eventDeliveries(options = {}) {
             return eventStore?.deliveries(options) ?? [];
         },
+        memoryPasses(agentId) {
+            return memoryPassHost.passes(agentId);
+        },
+        memoryPass(agentId, passId) {
+            return memoryPassHost.pass(agentId, passId);
+        },
         tools() {
             // From the registry, not from the load records: the risk reported is
             // the one a call will actually be judged at, floor applied, and a