@xema/omni-protocol 0.1.114 → 0.1.116

package/dist/index.d.ts

@@ -30,7 +30,7 @@ export type UserId = string;
  * still speaking about it -- a lead names a member's assignment from another login, so the scope is
  * the provider, not the login. What the platform calls its own record, and whether it reuses that
  * name, is the adapter's business: a platform that reoffers a closed call under the same handle
- * seconds later is why the adapter, not the desk, is held to this. Scope it with `assignmentKey()`.
+ * seconds later is why the adapter, not the agent computer, is held to this. Scope it with `assignmentKey()`.
  */
 export type AssignmentId = string;
 /**
@@ -106,12 +106,12 @@ export type DialOutcome = "answered" | "busy" | "no-answer" | "unreachable" | "r
 export declare const DIAL_OUTCOMES: readonly ["answered", "busy", "no-answer", "unreachable", "rejected", "cancelled", "unexplained"];
 /**
  * How the agent hears the call: on a `softphone`, where the host owns the audio and opens it
- * through `openAudio`, or on a `deskPhone`, a handset the platform rings, where the host opens
+ * through `openAudio`, or on a `hardphone`, a handset the platform rings, where the host opens
  * nothing and only shows the call. A voice manifest lists the phones its platform supports, and
  * the host picks one for the login at authentication.
  */
-export type Phone = "softphone" | "deskPhone";
-export declare const PHONES: readonly ["softphone", "deskPhone"];
+export type Phone = "softphone" | "hardphone";
+export declare const PHONES: readonly ["softphone", "hardphone"];
 /**
  * The device itself, as the platform sees it. `ready` is registered and usable, idle or busy; the
  * other three are the states in which no call can land: the platform has lost the phone's
@@ -138,14 +138,14 @@ export interface PhoneChannel {
  * is on, whether it can take a call, its own mute where the platform observes it, and its channels
  * -- one active at most, any number held. The task side says which of those calls are the agent's
  * work and where each stands; the phone side exists whether or not a task is behind a call. `muted`
- * is the phone's own button as the platform sees it, silencing whatever is active: a desk phone's,
+ * is the phone's own button as the platform sees it, silencing whatever is active: a hardphone's,
  * never a softphone's, whose microphone is the host's and whose mute is the host's report.
  */
 export interface PhoneState {
     /** The agent's phone for this provider, as the host chose it for the login at connect: which of the manifest's phones the agent hears this provider's calls on. */
     phone: Phone;
     status: PhoneStatus;
-    /** The phone's own mute, on a desk phone the platform observes; absent where it does not, or on a softphone. */
+    /** The phone's own mute, on a hardphone the platform observes; absent where it does not, or on a softphone. */
     muted?: true;
     /** When the status began, counted from the provider's clock. Omitted rather than invented. */
     since?: IsoTimestamp;
@@ -195,7 +195,7 @@ export interface Manifest<C extends Channel = Channel> {
     /** Optional provider-clock sampling through Connection.checkTime; absent means unsupported. */
     /**
      * Implements `checkTime`, and states `providerTime` on every snapshot. Required of a provider
-     * that publishes an instant the desk renders as a running duration -- a member's `since`, a
+     * that publishes an instant the agent computer renders as a running duration -- a member's `since`, a
      * lead's `listening.since`, an `onCall.since`, a shift's `signedInAt` -- so every screen counts
      * from the provider's clock and two screens differ by their delay alone.
      */
@@ -569,6 +569,12 @@ export interface HostGuarantees {
     browserUrlVisibility?: true;
     /** A `consent` offer is accepted only by the person's own explicit act, never on their behalf. */
     personConsent?: true;
+    /**
+     * The host's Mute is its own control on any call and is never offered while the task is
+     * `paused`; a mute standing when a hold begins stands through it. Required of a softphone
+     * login's host and refused of any other, since a hardphone's mute is the handset's.
+     */
+    muteUnavailableOnHold?: true;
 }
 export interface ProviderTimeScope {
     providerId: string;
@@ -587,7 +593,7 @@ export interface Host {
     /** Voice softphone recording support; policy and destination remain per task. */
     recording?: HostRecording;
     guarantees: HostGuarantees;
-    /** What pressing Mute does on this host. Stated on a softphone login, where the host holds the microphone; absent on a desk phone and off voice. */
+    /** What pressing Mute does on this host. Stated on a softphone login, where the host holds the microphone; absent on a hardphone and off voice. */
     mute?: HostMute;
     report(): HostReport;
     subscribe(listener: (report: HostReport) => void): Unsubscribe;
@@ -618,7 +624,7 @@ export type ConnectContext = {
     log?: (entry: unknown) => void;
 } & (
 /**
- * On a softphone the host holds the microphone and states what its Mute does; on a desk phone,
+ * On a softphone the host holds the microphone and states what its Mute does; on a hardphone,
  * or off voice, it holds none and states nothing. The arms make the omission a compile error
  * where a live seat would otherwise be the first to find it.
  */
@@ -628,7 +634,7 @@ export type ConnectContext = {
         mute: HostMute;
     };
 } | {
-    phone?: "deskPhone";
+    phone?: "hardphone";
     host: {
         mute?: never;
         recording?: never;
@@ -812,7 +818,7 @@ export type HistoryStep = "queued" | "offered" | "answered" | "held" | "muted" |
 /**
  * The call record: the steps that brought the task here, one entry per occurrence and oldest
  * first, and what they add up to before this agent -- stated by the provider from its own record,
- * never summed by a desk from instants. Each total is present when the provider knows it and
+ * never summed by an agent computer from instants. Each total is present when the provider knows it and
  * absent when it does not; a plausible nought is the fallback the no-fallbacks rule forbids. The
  * record rides on the task and is replaced with it, so a late entry corrects the sums.
  */
@@ -935,7 +941,7 @@ export interface TaskTakenOver {
  * never describes the chain: which levels a person passes through is the structure's to know.
  */
 export type Level = string;
-/** A level the structure has, with the label a desk shows for "who decided". */
+/** A level the structure has, with the label an agent computer shows for "who decided". */
 export interface LevelDeclaration {
     id: Level;
     label: string;
@@ -1028,7 +1034,7 @@ export type Task<C extends Channel = Channel> = {
     /**
      * In `completing`, wherever `wrapAllowance` is stated: how much of the wrap is left, in whole
      * seconds from this publication, restated on every publication that carries it, so a reloaded
-     * desk and a lead's screen count down the same number. Under `provider-automatic` the provider
+     * agent computer and a lead's screen count down the same number. Under `provider-automatic` the provider
      * ends the task when it reaches zero; under `agent-command` it is the expected wrap left, `0`
      * once overrun, and nothing acts on it.
      */
@@ -1405,11 +1411,11 @@ export interface MemberRequest {
     since: IsoTimestamp;
 }
 /**
- * A member's task as the lead sees it: the same task the member's desk holds, less the workspace.
+ * A member's task as the lead sees it: the same task the member's computer holds, less the workspace.
  * The assignment, what the call is and where it stands, the party as the provider shows it to
  * leads, the room, the audio, the completion terms and the whole record are here; the controls,
- * their source and the browsers are the member's desk's alone and never travel. Published to every
- * lead whenever the member's own desk hears of the task.
+ * their source and the browsers are the member's computer's alone and never travel. Published to every
+ * lead whenever the member's own agent computer hears of the task.
  */
 export type MemberTask<C extends Channel = Channel> = {
     assignmentId: AssignmentId;
@@ -1580,7 +1586,7 @@ export type TeamCommandResult = {
 /**
  * The task's real-time audio as the provider holds it: `started` while audio should be attached,
  * `ended` once primary interaction's audio ended, and the field omitted while none should be. The
- * provider's word -- a desk attaches and renders audio from it, never from its own senses.
+ * provider's word -- an agent computer attaches and renders audio from it, never from its own senses.
  */
 export type TaskAudioState = "started" | "ended";
 export interface CallAudio {
@@ -1689,7 +1695,7 @@ export interface Snapshot<C extends Channel = Channel> {
     loginId: string;
     /**
      * The provider's own instant of this read, required of a provider that declares `timeCheck`:
-     * every duration the desk renders off the active call is counted from the provider's clock, and
+     * every duration the agent computer renders off the active call is counted from the provider's clock, and
      * this sample saves a `checkTime` for it. Every envelope's `occurredAt` is a sample too.
      */
     providerTime?: IsoTimestamp;
@@ -1857,7 +1863,7 @@ export type OmniFailureCode = (typeof OMNI_FAILURE_CODES)[number];
 /**
  * What the host refused, told to the adapter that published it: a snapshot the host would not
  * replace its state with, or an event it dropped, and every rule it broke. A refusal the provider
- * never hears of is a desk frozen at its last good state for a shift with nothing wrong on the
+ * never hears of is an agent computer frozen at its last good state for a shift with nothing wrong on the
  * provider's side; this is how both sides see it.
  */
 export interface Refusal {

package/dist/index.js

@@ -16,7 +16,7 @@ export function negotiateProtocolVersion(adapterVersions, hostVersions = OMNI_SU
     return shared.length === 0 ? undefined : Math.max(...shared);
 }
 export const DIAL_OUTCOMES = ["answered", "busy", "no-answer", "unreachable", "rejected", "cancelled", "unexplained"];
-export const PHONES = ["softphone", "deskPhone"];
+export const PHONES = ["softphone", "hardphone"];
 export const PHONE_STATUSES = ["ready", "unregistered", "do-not-disturb", "off-hook"];
 export const PHONE_CHANNEL_STATES = ["ringing", "active", "held"];
 /** Every idle capability a provider may declare. Only voice may `dial`; the channel arm says so. */

package/dist/testing.d.ts

@@ -241,7 +241,7 @@ export declare function assertAudioFollowsTheTask(envelopes: readonly ProviderEv
 export declare function memoryStore(): LoginStore;
 /**
  * A host that reports one thing and never changes: what most adapter tests hand `testAdapter`.
- * A softphone host states what its Mute does; a desk-phone or conversation host has no microphone and states nothing.
+ * A softphone host states what its Mute does; a hardphone or conversation host has no microphone and states nothing.
  */
 export declare function stillHost(report: HostReport, guarantees: HostGuarantees, mute: HostMute): Host & {
     mute: HostMute;

package/dist/testing.js

@@ -324,11 +324,11 @@ export async function testAdapter(adapter, context, options = {}) {
         // testing a host that cannot exist. Its first report and every later one are validated, a
         // voice connection's host reports its audio and no other does, and the host the adapter
         // receives is wrapped so the harness can tell whether the adapter ever asked.
-        violations.push(...validateHostGuarantees(context.host.guarantees, "context.host.guarantees"));
+        violations.push(...validateHostGuarantees(context.host.guarantees, "context.host.guarantees", adapter.manifest.channel === "voice" ? context.phone : undefined));
         // The zone is the host's to state, so a context without one is a host that cannot exist.
         violations.push(...validateTimeZone(context.timeZone, "context.timeZone"));
         // How the agent hears the call decides what the host owns: on a softphone the host has the
-        // audio and reports it; on a desk phone, or off voice, there is none for it to report.
+        // audio and reports it; on a hardphone, or off voice, there is none for it to report.
         violations.push(...validatePhone(context.phone, adapter.manifest, "context.phone"));
         const softphone = adapter.manifest.channel === "voice" && context.phone === "softphone";
         violations.push(...validateHostRecording(context.host.recording, softphone));
@@ -340,7 +340,7 @@ export async function testAdapter(adapter, context, options = {}) {
         }
         if (!softphone && hasAudio) {
             violations.push({ rule: "context.host.audio.unexpected", path: "context.host.audio",
-                message: adapter.manifest.channel === "voice" ? "a desk-phone login has no audio in the host to report" : `a ${adapter.manifest.channel} connection has no audio for the host to report` });
+                message: adapter.manifest.channel === "voice" ? "a hardphone login has no audio in the host to report" : `a ${adapter.manifest.channel} connection has no audio for the host to report` });
         }
         // What the host's Mute does is stated where the host holds a microphone, and nowhere else.
         violations.push(...validateHostMute(context.host.mute, softphone, "context.host.mute"));
@@ -376,11 +376,11 @@ export async function testAdapter(adapter, context, options = {}) {
             // than an `enabled` flag, so its presence is the declaration.
             if (adapter.manifest.idleCapabilities?.dial !== undefined)
                 requireMethod(on, "dial", "the manifest declares dial");
-            // On a softphone the call's audio lands in Omni, so the adapter has to open it; on a desk phone the host opens nothing.
+            // On a softphone the call's audio lands in Omni, so the adapter has to open it; on a hardphone the host opens nothing.
             if (softphone)
                 requireMethod(on, "openAudio", "the login is on a softphone");
             // The microphone is the host's, so on a softphone every call can be muted by it, and the
-            // record of that leg is the provider's to take; on a desk phone the host holds no microphone.
+            // record of that leg is the provider's to take; on a hardphone the host holds no microphone.
             if (softphone)
                 requireMethod(on, "recordStep", "the login is on a softphone, whose microphone the host mutes");
         };
@@ -1804,11 +1804,11 @@ async function testOneCall(call) {
     // 2. A preview: press Call, which is a dial. Where the preview says how long it has, within what
     // the test will wait, the deadline is kept to its atDeadline first: under provider-dials the
     // provider dials when it runs out and the test presses nothing; under host-dials and waits the
-    // preview stands until then, and the test presses Call at zero as the desk would.
+    // preview stands until then, and the test presses Call at zero as the agent computer would.
     if (latestTask().phase === "preview") {
         const left = latestTask().previewEndsInSeconds;
         const atDeadline = latestTask().atDeadline;
-        // Under provider-dials the provider places the call, and the desk presses nothing.
+        // Under provider-dials the provider places the call, and the agent computer presses nothing.
         let pressCall = true;
         if (typeof left === "number" && left * 1000 <= call.timeoutMs && typeof atDeadline === "string") {
             ruleTested("test.preview.deadline");
@@ -1830,7 +1830,7 @@ async function testOneCall(call) {
                 // waits the seconds out and expects the task where it left it.
                 const moved = await updated(t => t.phase !== "preview", "nothing", { ms: left * 1000, onExpiry: () => undefined });
                 if (moved !== undefined) {
-                    refuse("test.preview.deadline", "test.preview", `${taskId} is a preview under ${atDeadline} with ${left}s left, and the provider moved it to ${String(moved.found.phase)} before the deadline: under ${atDeadline} the preview stands until the desk dials, or for as long as the agent needs`);
+                    refuse("test.preview.deadline", "test.preview", `${taskId} is a preview under ${atDeadline} with ${left}s left, and the provider moved it to ${String(moved.found.phase)} before the deadline: under ${atDeadline} the preview stands until the agent computer dials, or for as long as the agent needs`);
                     return found;
                 }
             }
@@ -1903,7 +1903,7 @@ async function testOneCall(call) {
         ruleTested("test.recordStep.rejected", "test.recordStep.failed");
         // The test holds its own report to the contract before it crosses, as a host must.
         const leg = { assignmentId: taskId, step: "muted", mutedBy: "host", ...body };
-        const own = validateHistoryReport(leg, "test.recordStep.report", call.manifest);
+        const own = validateHistoryReport(leg, "test.recordStep.report", call.manifest, latestTask());
         found.push(...own);
         if (own.length > 0)
             return;
@@ -1959,6 +1959,24 @@ async function testOneCall(call) {
                 return found;
         }
     }
+    // The host's Mute is unavailable on hold, and the host promised as much at login: a host holds the
+    // report back (historyReport.muted.held), and an adapter that receives one anyway must refuse it --
+    // so the test sends a mute begun on hold past the validator and expects failed.
+    const muteRefusedOnHold = async () => {
+        ruleTested("test.recordStep.rejected", "test.recordStep.held");
+        const leg = { assignmentId: taskId, step: "muted", mutedBy: "host", at: new Date().toISOString() };
+        let answer;
+        try {
+            answer = await call.connection.recordStep(leg);
+        }
+        catch (error) {
+            refuse("test.recordStep.rejected", "test.recordStep", `recordStep rejected rather than answered: ${String(error)}`);
+            return;
+        }
+        if (isRecord(answer) && answer.status !== "failed") {
+            refuse("test.recordStep.held", "test.recordStep", "the provider recorded the host's mute begun with the caller on hold: the Mute waits for resume, and the adapter is the second gate");
+        }
+    };
     // Ending my part from hold would leave the caller in the hold with nobody coming back to them: a
     // host holds it back (command.endCall.held), and an adapter that receives it anyway must refuse
     // it -- so the test sends it past the validator and expects failed.
@@ -1982,6 +2000,8 @@ async function testOneCall(call) {
     if (latestTask().phase === "in-progress" && offers("hold")) {
         if (await send({ type: call.channel === "chat" ? "pause" : "hold" }) !== undefined) {
             if (await updated(t => t.phase === "paused", "the task pausing after hold") !== undefined) {
+                if (canRecordMute)
+                    await muteRefusedOnHold();
                 if (call.channel === "voice" && offers("endCall"))
                     await endCallRefusedOnHold();
                 // An adapter that ended the agent's part from hold has nothing left to resume; the run goes on from where it put the task.
@@ -2087,7 +2107,7 @@ async function testOneCall(call) {
         if (await send(command) !== undefined) {
             // applied says the provider has completed the task, and its ending follows within the bound
             // the manifest stated. Past it the host resyncs: a snapshot still carrying the task is a task
-            // held open by a provider that said it was done, and the desk shows it as unsettled.
+            // held open by a provider that said it was done, and the agent computer shows it as unsettled.
             ruleTested("test.completion.unsettled");
             const settle = Number(call.manifest.settleMs);
             let unsettled = false;

package/dist/validation.d.ts

@@ -50,7 +50,7 @@ export interface TaskValidationContext {
     /**
      * A member's task on the team member list, trimmed by the provider: the workspace -- controls,
      * their source, browsers, completion terms -- is the member's and may be absent; what is present
-     * is held to the same rules as on the member's own desk.
+     * is held to the same rules as on the member's own agent computer.
      */
     member?: true;
 }
@@ -133,7 +133,7 @@ export declare function validateLinedUp(value: unknown, path?: string, levels?:
 /** The phone as the platform sees it: the agent's device for this provider, whether it can take a call, its own mute where observed. */
 export declare function validatePhoneState(value: unknown, path?: string, context?: ReaderContext): ProtocolViolation[];
 /**
- * What pressing Mute does on this host, stated on a softphone login and nowhere else: on a desk
+ * What pressing Mute does on this host, stated on a softphone login and nowhere else: on an agent computer
  * phone the microphone is the phone's, and off voice there is none. Neither the value nor its
  * absence is inferred from what kind of application the host is.
  */
@@ -146,13 +146,13 @@ export declare function validateHostMute(mute: unknown, softphone: boolean, path
  * What a host promises. Presence is the guarantee, so a key declared `false` is refused: a
  * promise withheld is an absent key, never a false one, exactly as a capability is.
  */
-export declare function validateHostGuarantees(guarantees: unknown, path?: string): ProtocolViolation[];
+export declare function validateHostGuarantees(guarantees: unknown, path?: string, phone?: unknown): ProtocolViolation[];
 /**
  * What the host reports of a leg it performed, as an adapter may validate it before forwarding:
  * a task, a step, when it began, how long so far if the host says, and an explicit end that
  * carries the final duration.
  */
-export declare function validateHistoryReport(report: unknown, path?: string, manifest?: unknown): ProtocolViolation[];
+export declare function validateHistoryReport(report: unknown, path?: string, manifest?: unknown, task?: unknown): ProtocolViolation[];
 export declare function validateHostReport(report: unknown, path?: string): ProtocolViolation[];
 /** Validate the exact interaction/assignment target before provider command dispatch. */
 export declare function validateTaskCommandRequest(request: unknown, task: unknown, path?: string, taskContext?: Omit<TaskValidationContext, "channel">): ProtocolViolation[];

package/dist/validation.js

@@ -86,7 +86,7 @@ const OFFERABLE_PHASES = membersOf({
     pending: true,
 });
 const PREVIEW_DEADLINES = membersOf({ "provider-dials": true, "host-dials": true, waits: true });
-const PHONES = membersOf({ softphone: true, deskPhone: true });
+const PHONES = membersOf({ softphone: true, hardphone: true });
 const PHONE_STATUSES = membersOf({ ready: true, unregistered: true, "do-not-disturb": true, "off-hook": true });
 const PHONE_CHANNEL_STATES = membersOf({ ringing: true, active: true, held: true });
 const LISTENING_MODES = membersOf({ listen: true, coach: true, "join-call": true });
@@ -322,7 +322,7 @@ function validateIdleCapabilities(value, channel, path, into) {
     }
 }
 /**
- * A provider that dials says how a dial can end, both ways: `answered`, or the desk cannot tell
+ * A provider that dials says how a dial can end, both ways: `answered`, or the agent computer cannot tell
  * reached from still ringing, and at least one way of not reaching, or it can never say failed.
  * Off voice nothing dials, and the idle dialpad is a dial, so declaring it is declaring this.
  */
@@ -353,7 +353,7 @@ function validateDialOutcomes(manifest, path, into) {
     }
 }
 /**
- * A voice platform says which phones it can put an agent on -- a softphone in the host, a desk
+ * A voice platform says which phones it can put an agent on -- a softphone in the host, an agent computer
  * phone it rings -- and nothing off voice does, since there is no call to hear.
  */
 function validatePhones(manifest, path, into) {
@@ -363,7 +363,7 @@ function validatePhones(manifest, path, into) {
         return;
     }
     if (!Array.isArray(declared) || declared.length === 0) {
-        into.add("manifest.phones.required", path, "a voice manifest lists the phones its platform can put an agent on: softphone, deskPhone, or both");
+        into.add("manifest.phones.required", path, "a voice manifest lists the phones its platform can put an agent on: softphone, hardphone, or both");
         return;
     }
     declared.forEach((phone, index) => {
@@ -557,7 +557,7 @@ export function validateManifest(manifest, path = "manifest") {
                 }
                 else
                     wellFormed = false;
-                if (!into.filled(level.label, "manifest.orgLevel.label", `${at}.label`, "a level needs the label a desk shows for it"))
+                if (!into.filled(level.label, "manifest.orgLevel.label", `${at}.label`, "a level needs the label an agent computer shows for it"))
                     wellFormed = false;
             });
             if (wellFormed && !ids.has("person")) {
@@ -715,7 +715,7 @@ const levelIds = (levels) => levels ?? DEFAULT_LEVEL_IDS;
 /**
  * What the queue locks is locked on the whole task. Given the locked values, every other field an
  * agent reads -- the title, the reference, an attribute, a custom control's label, a browser URL the
- * desk shows -- is held to carrying none of them. A number is compared by its digits, so no
+ * agent computer shows -- is held to carrying none of them. A number is compared by its digits, so no
  * formatting hides it; anything else by its text, case aside.
  */
 function validateNothingLeaksInto(task, locked, path, into) {
@@ -1157,7 +1157,7 @@ function validateTaskInto(task, context, path, into) {
     // travels exactly when Omni said tasks may be auto-accepted, and only while the task is pending.
     // Work the agent originated -- a dial or connect-back, carrying the host's dialId on onCall; a
     // lead's join, carrying assisting; a listen, carrying listening -- was accepted by the command
-    // that created it, and says so whatever the provisioning: the desk shows no Accept for a call
+    // that created it, and says so whatever the provisioning: the agent computer shows no Accept for a call
     // the agent placed. The provisioning governs work the queue routes, and nothing else.
     const originated = task.phase === "pending" && originatedByTheAgent(task);
     ruleTested("task.acceptance.originated");
@@ -1194,7 +1194,7 @@ function validateTaskInto(task, context, path, into) {
     // How much wrap is left travels with the completing task, restated, so every screen counts the same number.
     if (task.phase === "completing" && task.wrapAllowance !== undefined) {
         if (task.wrapEndsInSeconds === undefined) {
-            into.add("task.completing.wrapEndsInSeconds.required", `${path}.wrapEndsInSeconds`, "a completing task with a wrap allowance says how much of it is left, so a reloaded desk and a lead's screen count down the same number");
+            into.add("task.completing.wrapEndsInSeconds.required", `${path}.wrapEndsInSeconds`, "a completing task with a wrap allowance says how much of it is left, so a reloaded agent computer and a lead's screen count down the same number");
         }
         else {
             into.require(isDurationSeconds(task.wrapEndsInSeconds), "task.completing.wrapEndsInSeconds", `${path}.wrapEndsInSeconds`, "wrapEndsInSeconds is how much wrap is left: a whole number of seconds, zero or more, counted from this publication");
@@ -1245,7 +1245,7 @@ function validateTaskInto(task, context, path, into) {
     // Where the terms came from is stated with them: a host cannot tell "the platform permits
     // nothing" from "the terms could not be read" from the set alone, and the provider knows which.
     if (context.member === true) {
-        // The lead's copy is the record, the room and the terms; the workspace stays on the member's desk.
+        // The lead's copy is the record, the room and the terms; the workspace stays on the member's computer.
         for (const field of ["capabilities", "capabilitySource", "browsers"]) {
             if (task[field] !== undefined)
                 into.add("team.member.task.workspace", `${path}.${field}`, `${field} is the member's workspace, and never travels to a lead`);
@@ -1748,7 +1748,7 @@ function validateTeamMemberInto(member, at, context, into) {
     // The member's own history for the day: about the person, not any one call.
     if (member.shift !== undefined)
         validateShiftInto(member.shift, `${at}.shift`, into, "team.member.shift");
-    // The member's phone as the platform sees it, the same state the member's own desk holds.
+    // The member's phone as the platform sees it, the same state the member's own agent computer holds.
     if (member.phone !== undefined)
         validatePhoneStateInto(member.phone, `${at}.phone`, {}, into);
     // The member's own queue, as their own snapshot carries it.
@@ -1782,7 +1782,7 @@ export function validateSnapshot(snapshot, manifest, path = "snapshot", context
     const levels = context.levels ?? manifestLevels(manifest);
     into.oneOf(snapshot.transport, TRANSPORT_STATUSES, "snapshot.transport", `${path}.transport`);
     // The provider's own instant of the read: required where the provider has a clock to state, and
-    // a clock nobody declared is not one the desk may count from.
+    // a clock nobody declared is not one the agent computer may count from.
     if (isPlainObject(manifest) && manifest.timeCheck === true) {
         into.timestamp(snapshot.providerTime, "snapshot.providerTime", `${path}.providerTime`);
     }
@@ -1833,7 +1833,7 @@ export function validateSnapshot(snapshot, manifest, path = "snapshot", context
                         : task.phase === "pending" || (Array.isArray(task.onCall) && task.onCall.some((who) => isPlainObject(who) && who.role === "party" && who.stage === "ringing"));
                 into.require(agrees, "phone.channel.task", `${here}.state`, `the phone says ${String(channel.state)} and the task ${String(channel.assignmentId)} says ${String(task.phase)}${task.audio === undefined ? "" : ` with audio ${String(task.audio)}`}: the two views of one call agree`);
             });
-            // And a task at work with audio has a channel: the phone carries every call the desk is on.
+            // And a task at work with audio has a channel: the phone carries every call the agent computer is on.
             tasks.forEach((task, index) => {
                 if (task.audio === "started" && !snapshot.phone.channels.some(channel => isPlainObject(channel) && channel.assignmentId === task.assignmentId)) {
                     into.add("phone.channel.missing", `${path}.tasks[${index}]`, `${String(task.assignmentId)} has its audio started and the phone carries no channel for it`);
@@ -2193,7 +2193,7 @@ function validatePreferencesInto(value, path, into, levels) {
     });
 }
 /** The team's policy per capability as the lead sees it: the setting, who set it, who locked it. */
-/** Whether a publication carries an instant the desk renders as a running duration, which the provider's clock reads. */
+/** Whether a publication carries an instant the agent computer renders as a running duration, which the provider's clock reads. */
 function carriesRunningInstant(value) {
     if (!isPlainObject(value))
         return false;
@@ -2218,7 +2218,7 @@ function carriesRunningInstant(value) {
 function requireClockInto(value, manifest, path, into) {
     if (!isPlainObject(manifest) || manifest.timeCheck === true || !carriesRunningInstant(value))
         return;
-    into.add("manifest.timeCheck.required", path, "this publishes an instant the desk renders as a running duration -- a since, a signedInAt -- and the manifest declares no timeCheck: every screen counts such a duration from the provider's clock, so the provider states one");
+    into.add("manifest.timeCheck.required", path, "this publishes an instant the agent computer renders as a running duration -- a since, a signedInAt -- and the manifest declares no timeCheck: every screen counts such a duration from the provider's clock, so the provider states one");
 }
 /** The agent's standing ask for the next call: since when. */
 export function validateNextCall(value, path = "nextCall") {
@@ -2275,7 +2275,7 @@ function validatePhoneStateInto(value, path, context, into) {
     into.oneOf(value.status, PHONE_STATUSES, "phone.status", `${path}.status`);
     if (value.muted !== undefined) {
         into.require(value.muted === true, "phone.muted", `${path}.muted`, "the phone's mute is stated by presence: send true or omit it");
-        // The softphone's microphone is the host's, and its mute is the host's report; the platform observes a desk phone's button, or nothing.
+        // The softphone's microphone is the host's, and its mute is the host's report; the platform observes a hardphone's button, or nothing.
         into.require(value.phone !== "softphone", "phone.muted.softphone", `${path}.muted`, "a softphone's microphone is the host's and its mute is the host's report; the platform echoes nothing of it");
     }
     if (value.since !== undefined)
@@ -2400,11 +2400,11 @@ function validateUnavailable(value, rule, path, into) {
  * check belongs to the host's own tests and to the harness, which validates whatever host a test
  * hands the adapter.
  */
-const HOST_GUARANTEES = membersOf({ browserUrlVisibility: true, personConsent: true });
+const HOST_GUARANTEES = membersOf({ browserUrlVisibility: true, personConsent: true, muteUnavailableOnHold: true });
 const MUTED_BY = membersOf({ host: true, station: true });
 const HOST_MUTES = membersOf({ stream: true, station: true });
 /**
- * What pressing Mute does on this host, stated on a softphone login and nowhere else: on a desk
+ * What pressing Mute does on this host, stated on a softphone login and nowhere else: on an agent computer
  * phone the microphone is the phone's, and off voice there is none. Neither the value nor its
  * absence is inferred from what kind of application the host is.
  */
@@ -2435,7 +2435,7 @@ export function validateHostMute(mute, softphone, path = "host.mute") {
     if (mute === undefined) {
         into.require(!softphone, "host.mute.required", path, "a softphone login's host states what its Mute does: stream or station");
     }
-    else if (into.require(softphone, "host.mute.unexpected", path, "only a softphone login's host holds a microphone to mute; a desk phone's is the phone's, and a conversation has none")) {
+    else if (into.require(softphone, "host.mute.unexpected", path, "only a softphone login's host holds a microphone to mute; a hardphone's is the phone's, and a conversation has none")) {
         into.oneOf(mute, HOST_MUTES, "host.mute", path);
     }
     return into.violations;
@@ -2444,12 +2444,22 @@ export function validateHostMute(mute, softphone, path = "host.mute") {
  * What a host promises. Presence is the guarantee, so a key declared `false` is refused: a
  * promise withheld is an absent key, never a false one, exactly as a capability is.
  */
-export function validateHostGuarantees(guarantees, path = "host.guarantees") {
+export function validateHostGuarantees(guarantees, path = "host.guarantees", phone) {
     const into = new Collector();
     if (!isPlainObject(guarantees)) {
         into.add("host.guarantees.shape", path, "a host declares its guarantees as an object, empty when it makes none");
         return into.violations;
     }
+    // The login's phone decides who holds the mute: a softphone host owns it and promises to keep it
+    // off the hold; a hardphone's is the handset's, and a host off voice has none.
+    if (phone !== undefined) {
+        if (phone === "softphone") {
+            into.require(guarantees.muteUnavailableOnHold === true, "host.guarantee.muteUnavailableOnHold.required", `${path}.muteUnavailableOnHold`, "a softphone login's host holds the mute and promises it is unavailable while the task is paused");
+        }
+        else {
+            into.require(guarantees.muteUnavailableOnHold === undefined, "host.guarantee.muteUnavailableOnHold.unexpected", `${path}.muteUnavailableOnHold`, `a ${describeValue(phone)} login's host holds no mute to promise anything of`);
+        }
+    }
     for (const [name, declared] of Object.entries(guarantees)) {
         if (declared === undefined)
             continue;
@@ -2464,7 +2474,7 @@ export function validateHostGuarantees(guarantees, path = "host.guarantees") {
  * a task, a step, when it began, how long so far if the host says, and an explicit end that
  * carries the final duration.
  */
-export function validateHistoryReport(report, path = "historyReport", manifest) {
+export function validateHistoryReport(report, path = "historyReport", manifest, task) {
     const into = new Collector();
     if (!isPlainObject(report)) {
         into.add("historyReport.shape", path, "a history report must be an object");
@@ -2475,8 +2485,15 @@ export function validateHistoryReport(report, path = "historyReport", manifest)
     into.oneOf(report.step, HISTORY_STEPS, "historyReport.step", `${path}.step`);
     into.timestamp(report.at, "historyReport.at", `${path}.at`);
     // A muted leg says whose the silence was; no other leg has anyone to name for it.
-    if (report.step === "muted")
+    if (report.step === "muted") {
         into.oneOf(report.mutedBy, MUTED_BY, "historyReport.mutedBy", `${path}.mutedBy`);
+        // The host's own Mute is unavailable while the caller is on hold: a leg of it beginning on a paused
+        // task is a control the host promised not to offer. A station mute it observed on hold is a fact and
+        // stands, and so do the running and closing reports of a leg begun before the hold.
+        if (report.mutedBy === "host" && report.ended === undefined && report.seconds === undefined && isPlainObject(task)) {
+            into.require(task.phase !== "paused", "historyReport.muted.held", `${path}.at`, "the caller is on hold: the host's Mute waits for resume, and a mute begun on hold is not recorded");
+        }
+    }
     else if (HISTORY_STEPS.includes(report.step)) {
         into.require(report.mutedBy === undefined, "historyReport.mutedBy.unexpected", `${path}.mutedBy`, "only a muted leg says who silenced the microphone");
     }