agentfootprint 9.100.0 → 9.102.0

package/AGENTS.md

@@ -544,7 +544,7 @@ files `agentfootprint.tools.coverage_declared`; with
 to the final answer, which is how a limit survives a model that would rather not
 mention it.
 
-### Observability — 111 typed events across 24 domains
+### Observability — 113 typed events across 25 domains
 
 ```typescript
 agent.on('agentfootprint.context.injected', (e) =>

package/CHANGELOG.md

@@ -5,6 +5,349 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [9.102.0] - 2026-09-17
+
+### Added — a declared fact stays in the window; noise leaves first
+
+- The window reads the findings ledger. On an agent with `.findings()` and a
+  window strategy, a turn whose tool result the model declared a `fact` is
+  HELD beyond `keepRecentTurns` — newest first, up to `keepLedgerFacts`
+  (default 4; `false` or `0` for no hold) — and the refusal is on the record
+  by name: `WindowRefusalReason` gains `'ledger-fact'`. It is a bounded hold
+  in the refusal engine, the content-aware sibling of the last-tool-result
+  pin (`ledgerFactPinsOf` beside `toolResultPinsOf`, admitted by the same
+  ceiling-spender in `planRemoval`), so `slidingWindow`, `tokenBudget`,
+  `summarizeOldest` and a consumer-written strategy all inherit it through
+  `planRemoval` — no new strategy file, none of the three shipped ones changed
+  a byte, the contiguous span, the drop ladder and the meter's single-seam
+  rebase untouched. 'Noise first' follows with no second mechanism: noise,
+  ruled-out, open and undeclared turns are unpinned and leave oldest-first as
+  they always did, and a judged noise turn that outlives a fact is already a
+  ticket on the wire. Why: the served piece restored a declared fact to the
+  answer turn, but under a window the fact's RESULT still left by recency —
+  the refusal engine saw a declared fact and a declared noise result as the
+  same bytes. By the model's claim only: a turn is the removal unit and its
+  standing is its most valuable result's (`fact > open > undeclared >
+  ruled-out > noise`); a result the model never named is undeclared and is not
+  held; the library reads no result's text to decide otherwise.
+- A fact hold never exists without its ceiling and its stand-down. The
+  ceiling is spent newest first and a held turn already inside
+  `keepRecentTurns` spends no slot (the free-pin law); the turns it turned away
+  are `yielded` on the record; nothing at or before the current request is
+  pinnable. The stand-down is the pin's: when the two previous visits removed
+  nothing and named only pins, the fact pins release for one visit and the
+  record says so. It reads BOTH pin names (`'last-tool-result'` and/or
+  `'ledger-fact'`), because a turn held by both pins is reported under the
+  recency pin's name — a fact stand-down reading only its own would never see
+  that turn blocking, and the two pins would alternate under each other's
+  name with the window never shrinking (derived, pinned by test, never
+  shipped). The recency pin's own stand-down reads only its own name, so its
+  9.57.0 rule is unchanged.
+- The record says what was held and whose standing left. `WindowRecord`
+  gains two optional keys, present only on an armed agent and filed by the
+  STAGE so a consumer-written strategy's record carries them too:
+  `ledgerFacts` (the `WindowObservations` shape — `pinned`, `yielded`,
+  `limit` = `keepLedgerFacts`, `standDown: true` on the visit it released)
+  and `droppedStandings` (`{ toolCallId, standing? }` for every tool result
+  that left; `standing` absent is undeclared, never a verdict the library
+  inferred). `WindowStrategyInput.standingOf?` hands a strategy a turn's
+  declared standing, bound by the stage from ONE read of the ledger and
+  absent on an unarmed agent — a strategy never reads scope for it; it is for
+  ordering or reporting among what the engine left removable, never for
+  inferring. What the model is TOLD about a drop is unchanged: the notice
+  names tools and counts, never a standing, never the model's own line.
+- `keepLedgerFacts` is live: `.findings({ keepLedgerFacts })` and
+  `Agent.create({ keepLedgerFacts })` (the `.findings()` door wins when both
+  are given), resolved once at build and validated there — a negative or
+  non-integer value is refused, never mid-run. Without `.findings()` the
+  option is accepted and does nothing (the keepLastToolResults-without-a-window
+  precedent). Exported from the root: `LedgerFactPin` (the candidate a hold is
+  built from: `toolCallIds`, `toolName`, `turnIndex`, `messageIndex`, `chars`),
+  beside the widened `WindowRefusalReason` and the `WindowRecord` additions.
+- Measured (`npm run bench:findings`, mock provider, 30 tool calls, a planted
+  fact every third, a sliding window keeping 6 turns): the results of 2 of 10
+  planted facts reached the answer turn verbatim by recency alone, 6 under the
+  default ceiling and 8 under a ceiling of 6, while the piece carried 9 of 10
+  on every armed row (the last batch is undeclared by the no-outputSchema law)
+  and the noise share of tool-result bytes on the wire stayed at the collapsed
+  level; every noise result left on every armed row, so the hold changed WHICH
+  facts left, not whether noise did. The design page has the print and its
+  reading; no real-model number exists yet.
+
+### Unchanged — an agent without `.findings()` plans, records and sends the bytes it did before
+
+- The hold, the ledger read, `standingOf`, `ledgerFacts` and `droppedStandings`
+  are all gated on the door: an unarmed window stage never reads
+  `findingsLedger` (pinned by a getter counting reads), hands its strategy the
+  exact input it always did, files the exact record it always did, and sends
+  the same request bytes — even when the model emits `_findings` on its own.
+  The 16 byte-identity references under `test/core/tools/reference/` pass
+  untouched; ONE new reference, `agent-findings-window`, was generated alone,
+  with what it holds read back from its bytes on the test file's header.
+- `keepLedgerFacts: false` plans exactly as the unarmed window (the bench
+  checks it: same facts verbatim, same tool messages, same receipt count, no
+  fact held), so the hold is an addition to the plan, never a rewrite of it.
+
+### Added — the ids the model may name are in the schema; the proposition before the call; a bench that can measure
+
+- The offer. On a hosted model the ask "by its tool_result id" produced
+  standings named by ORDINAL (`"0"`, `"1"`), recorded honestly as `unknownId`
+  and settling nothing (`docs/design/2026-09-findings-ledger-real-model.md`).
+  So from the second call on, the reserved `_findings` property on every
+  served schema binds the ids the model may name: `previous[].toolCallId`
+  carries `enum: <the tool results on the wire with no standing yet, newest
+  first, at most 32>` and says "one of the ids listed; a result not listed
+  cannot be named here"; a clipped list states the cap. The list is what the
+  model can still READ: a result with no standing, a `fact` (stood on in the
+  piece, served verbatim under the default mode) and an `open` result (served
+  verbatim, carrying what would settle it) stay listed, so a later call can
+  REVISE a standing — `open` → `fact` when a call settles it, `fact` →
+  `ruled-out` when a conflict resolves; the fold's last-wins law is reachable
+  through the enum. A result the model declared `noise` or `ruled-out` leaves
+  the list: it is a ticket on the wire under every serve mode and the piece
+  carries a count or one line, so there is nothing left to re-judge (a wrong
+  `ruled-out` is answered by a new call). The instruction asks the model to
+  name a result again only to change its standing. An evicted result is not
+  on the list, and the first call — with nothing to name — serves the base
+  property by reference, byte-identical to 9.101.0. ONE owner of the two sets
+  (`findings/offer.ts`: `offeredResultIds` for the enum, `undeclaredIds` for
+  the piece's `undeclared:` line — the honest absence, a subset of the offer),
+  computed at the Tools mount, where the served history and the ledger meet
+  (the slot is an isolated subflow), under the same arm that decorates; bound
+  at the ONE decoration site and committed with the tool list, so
+  `servedAt(k).tools.schemas` holds exactly what was offered and
+  `receipt.tools.schemaHashes` moves when the offer does. The law holds at
+  the schema AND at the row: the offer is what the model may COPY, never what
+  the library resolves — an id outside it still files as written, `unknownId:
+  true`, never mapped to a position or a tool name — and every id INSIDE it
+  resolves, because a standing is identified against the same served history
+  the offer was read from (`findings/offer.ts · knownResults`: the served
+  `role: 'tool'` messages plus the previous batch), so an id copied from the
+  offer files with its tool name whichever batch the result came from (the
+  first cut resolved against the last batch only, and an offered older id
+  filed as `unknownId` — caught in review, never released). The instruction
+  asks the JSON answer, which has no schema to bind, for the id exactly as
+  the schema listed it.
+- Named, not measured: from the second call on, an armed agent's tool schemas
+  vary per call (the enum), so a `'tools'` cache breakpoint cannot hit on such
+  a run and, on a prefix-cached wire, every breakpoint after it misses with
+  it — the system piece already moved the block on every declaring call
+  (step 3's recorded cost); the offer moves the tools prefix ahead of it. No
+  bench in the tree counts cache tokens; the lever not taken (the offer in
+  the request-only system piece, below the tools breakpoint — prose, which is
+  what failed on the real model) is on the design page.
+- The proposition. `FindingsDeclaration` gains `proposition?: string` (what
+  the call tests; the schema recommends it when `basis` is `'exploratory'`)
+  and `predicts?: string` (what the result should show if it holds), declared
+  on the call before its result exists; both land on the `BasisRow`, each cut
+  at 240 chars with the cut stated in the text. `FindingsDeclaredPayload`
+  gains `hasProposition?: true` — a flag, never the text. The served piece
+  quotes the judged call's own proposition on `open` and `ruled-out` lines
+  (`… — tested: <proposition>`), never on a fact line; `predicts` is
+  record-only.
+- The shuffle bench can measure (`bench/findings-shuffle.mjs`): `NOISE_AT`
+  (end / start / spread), `NOISE_SIZE` (about 250 / 1000 / 4000 tokens of
+  padding per noise record), noise values within 5% of a fact and never equal,
+  a `standing-accuracy` column (the share of the actor's standings on known
+  ids that agree with the planted truth — the harness knows the truth, so no
+  judge), and `--matrix` (24 cells for one model per invocation, the cost line
+  printed before the first call). Default mode prints the pre-packet numbers
+  to the digit and the mock smoke stays green. No hosted run was made in
+  this release; the real-model page holds the pre-offer tables and names the
+  number that must move.
+
+### Changed — `.findings()` refuses `reactMode: 'classic'`
+
+- The offer needs the tools slot recomposed every call, so `.findings()` is
+  REFUSED at build under `reactMode: 'classic'` — through both doors
+  (`.findings()` and `Agent.create({ findings })`), the `selfExplain` twin:
+  classic selects the Tools branch on turn 1 only, so an armed classic agent
+  would have served the offer-less base on every call and filed every
+  standing as `unknownId`, the number this packet exists to move silently
+  stuck at zero. 9.101.x accepted the combination and degraded it silently;
+  the message names the fix. `'dynamic'` (the default) and `'dynamic-grouped'`
+  are unchanged.
+
+### Fixed — the choice seam's enum fence read the decorated schema
+
+- Since 9.101.0, `withoutFindingsArgument` recognised the library's
+  decoration by REFERENCE only (`properties._findings ===
+  FINDINGS_ARGUMENT_SCHEMA`), and the reference never holds on the live path:
+  the served list `callLLM` reads is the committed `dynamicToolSchemas`, a
+  `structuredClone` of what the slot planted. So the choice seam's enum fence
+  (`declaredEnumValuesOf(withoutFindingsArgument(schema))`, the
+  `unsupported-argument` check) judged the model's argument values against a
+  schema that still carried `_findings`, and a value equal to one of the
+  findings vocabulary words — `direct`, `exploratory`, `low`, `medium`,
+  `high`, `fact`, `open`, `noise`, `ruled-out` — was excused as a declared
+  enum value the model was entitled to. The decoration is recognised by its
+  versioned marker now (the first sentence of the reserved property's
+  description), so the frozen base, an offer copy and a committed clone of
+  either are all peeled, and an author's own `_findings` is still read as
+  written. An armed agent may therefore file an `unsupported-argument`
+  finding it previously suppressed. Its unit test had passed because it
+  handed the function the live reference; `test/core/agent/findings/
+  reserved.test.ts` now pins the clone.
+
+### Unchanged — the unarmed agent, and the two armed references regenerated alone
+
+- An agent without `.findings()` maps no new key on the Tools mount, reads
+  neither `history` nor `findingsLedger` there, and serves and records the
+  bytes it did before: the 16 unarmed byte-identity references pass
+  untouched. `agent-findings` and `agent-findings-window` were regenerated
+  each alone (the rest copied aside and `cmp`-equal after) and their delta is
+  on the test file's header: the enum on every epoch after the first, a
+  `dynamicToolSchemas` write on each such epoch where an unchanged list used
+  to be an empty commit, the two new properties and the instruction's two new
+  lines, and the sizes that follow; regenerated once more, each alone, in the
+  second review for the revisable offer (a declared fact stays listed) and
+  the instruction's revised line. No message, ticket, ledger row, window
+  record or gap moved.
+
+## [9.101.1] - 2026-09-16
+
+### Fixed — the docs site's export-file ceiling
+
+- 9.101.0 never reached npm: its publish workflow stopped at the docs site's
+  performance budget (`docs-next/scripts/check-site-budget.mjs`), where the
+  generated API-reference routes for the findings ledger's new exports took the
+  static export past the file-count ceiling. The ceiling is raised to the
+  measured count plus the same thin headroom; no byte ceiling moved. The library
+  is byte-identical to 9.101.0; the entry below is what ships.
+
+## [9.101.0] - 2026-09-16
+
+### Added — the model's own findings, on the record, at zero extra calls
+
+- `.findings()` on the agent builder (`AgentBuilder.findings`) — every
+  SERVED tool schema gains one reserved optional argument, `_findings`
+  (`RESERVED_ARGUMENT`): the model declares a `basis` for each call before
+  the result exists (`direct` when it expects the answer, `exploratory` when
+  it is looking; optional `expect`: `low` / `medium` / `high`) and, on its
+  next tool call or as a top-level `_findings.previous` on a JSON answer,
+  the STANDING of each earlier tool result by its tool_result id — `fact`
+  with the assertions it stands on, `open` with what would settle it,
+  `ruled-out` with one line, `noise` with nothing. The library peels the
+  argument off before the tool, the middleware chain, the argument
+  validator, the permission gate and every pause carrier see the call, files
+  the rows through ONE writer as an append-only `AgentState.findingsLedger`
+  (`basis` / `standing` / `conflict` rows — a conflict is `conflictsOf`'s
+  fact about two stood-on readings that disagree, witnesses by identity),
+  and leaves the assistant turn in history verbatim. Read it back with
+  `Agent.findings()` (detached; `undefined` when unarmed or when the model
+  declared nothing — never an empty array standing in for "no findings").
+  Why: a long tool loop serves every result back in full on every call and
+  what the model already judged is nowhere but in its head; asking a second
+  model would cost a call per result and put a second voice on the record.
+  Nothing is inferred (a call with no declaration files no row; a result
+  nobody names has no standing — undeclared, never `open`); what the answer
+  turn is then SERVED from the record is the next block; and the always-on
+  `findings-ledger` instruction is a system piece hashed on every receipt,
+  so a reworded ask is a different hash a bench can name. `keepLedgerFacts`
+  is accepted now so no public name changes later and is inert until
+  standing-aware eviction lands.
+- Two typed events — `agentfootprint.findings.declared` (one per basis row)
+  and `agentfootprint.findings.standing` (one per standing row) — carry
+  identities, enums and counts only; assertion values, `settles` and `line`
+  live in the committed key under whatever redaction the run configured.
+- The checkpoint carries `findingsLedger` only when present, and
+  `continueFrom` re-seeds it, so a continued conversation never reports its
+  earlier declarations as undeclared. `validateCheckpoint` checks each row's
+  shape per kind — shape only, never the values.
+- A registry tool that declares its own `_findings` property is refused at
+  build, naming the tool, and only when `.findings()` is armed; a provider-
+  or MCP-ingested schema that carries the name is left undecorated (the
+  author's property wins, recorded by the committed schema itself), and a
+  call to that tool is not peeled — the value runs as the author's argument
+  and files no row.
+- The answer that stands is the peeled JSON; a re-ask (`output-retry`,
+  `step-nudge`, `evidence-recheck`) quotes the emission — the string the
+  provider returned — into the conversation, never the peeled form. A policy
+  halt hands the app the peeled args (`PolicyHaltError.proposed.args`), the
+  same carrier law every pause carrier follows.
+- Exported from the root: `RESERVED_ARGUMENT` and the row types
+  (`FindingsLedger`, `FindingsRow`, `BasisRow`, `StandingRow`,
+  `ConflictRow`, `ConflictWitness`, `FindingsDeclaration`, `Basis`,
+  `Expect`, `Standing`).
+
+### Added — served from the ledger
+
+- The answer turn reads the ledger. Once the model has declared at least one
+  standing, every later call on an armed agent is served a request-only
+  system piece composed from the folded ledger — `source: 'findings'` on the
+  receipt's `system.pieces` and on `servedAt(snapshot, k).system.pieces` —
+  headed by the context contract's own field meanings and holding `facts`,
+  `limitations`, `evidenceRefs` and `nextSteps`, each bucket marked "declared
+  by the model" and quoting the declaration (a conflict names both witnesses
+  and no verdict; a ruled-out branch is its one line), then `noise` as a count
+  and `undeclared` for the results nobody named — the honest absence, never
+  `open`. Bounded, every overflow stated, an empty bucket omitted. On the
+  wire, and only on the wire, a tool result the model judged `noise` or
+  `ruled-out` is served as a ticket, `{"collapsed":true,"standing":…,
+  "toolCallId":…}`, in place of its content; `open` and undeclared results
+  stay verbatim; nothing is dropped or reordered, and `toolName` /
+  `toolCallId` are untouched, so the tool_use/tool_result pair stays
+  wire-valid. `history` never changes — the window stage stays its only
+  writer — and `servedAt` rebuilds the piece and the collapse with the same
+  functions in the same order, so `receiptAt(k)` agrees by construction on
+  an armed run with a collapsed entry; no new served gap, `withheld`
+  untouched. Why a piece and a ticket rather than a rewritten history: the
+  record must keep the emission, and a judged result's bytes should not be
+  read again at full size on every call after the model said what it was.
+- `.findings({ serve })` chooses how much of the pile stays:
+  `'ledger-and-facts'` (the default — facts, open and undeclared results
+  verbatim beside the piece; noise and ruled-out as tickets) or
+  `'ledger-only'` (fact results as tickets too; the model answers from the
+  piece, its own paraphrase). The second is BENCH-GATED: shipped so
+  `bench/findings-shuffle.mjs` can measure it on a real model, not a
+  recommendation, and never a default until that run shows the answer does
+  not drift when the same evidence arrives in a different order. The run
+  constant `findingsServe` is committed on every armed run so a served view
+  knows which dial produced the wire.
+- The piece carries no per-call byte — it is a function of the folded
+  ledger and the wire's tool ids and nothing else — because it joins the ONE
+  system block the cache marker covers (`systemPromptCachePolicy` is
+  `'always'` by default, and the Anthropic adapters mark the whole joined
+  system prompt as one block). A re-ask is served the same system bytes and
+  the same system hash as the call before it. What that does NOT save: a
+  model that declares on every call moves the ledger on every call, so from
+  the first standing on each such call writes a new system cache entry and
+  reads none, and on Anthropic's wire the message breakpoints behind it miss
+  too. The feature's claim is wire bytes, not cache reads; no bench in the
+  tree counts cache tokens yet, and the design page names the trade.
+- Measured (`npm run bench:findings`, mock provider, 20 tool calls, a
+  planted fact every 3rd): the piece carries all 6 planted facts at the
+  answer turn on every armed row — including under a sliding window that had
+  evicted 4 of them — and 13 of the 14 noise results are tickets, the noise
+  share of tool-result bytes on the wire falling from 93.5% to 15.2% with no
+  window; the fourteenth is the last batch's, undeclared by the
+  no-outputSchema law and served in full. The design page has the printed
+  table and its reading; no real-model number exists yet.
+- Grounding is unchanged: the evidence gate keeps indexing raw history, so a
+  faithful ledger fact grounds through the result it cites and an invented
+  value is flagged. The choice seam no longer credits the whole system prompt
+  while a request-only piece is joined, so a subject id invented in a `fact`
+  assertion cannot excuse an argument equal to it; an unarmed agent takes the
+  branch it always did. The grouped chart carries `findingsLedger` across the
+  call-llm boundary, so both chart shapes serve byte-equal text.
+
+### Unchanged — an agent without `.findings()` records the bytes it recorded before
+
+- Every decoration, peel, write, piece and event is gated on the door. The
+  15 byte-identity references under `test/core/tools/reference/` were run on
+  this tree first and pass untouched; ONE new reference, `agent-findings`,
+  was generated alone — and regenerated alone for the served piece, its
+  delta (the run constant, the piece on one receipt, nothing else) on the
+  test file's header. `npm run bench:findings` runs each configuration
+  unarmed, armed with the mock declaring, and armed with the mock declaring
+  NOTHING, and exits non-zero if any of the six baseline columns moves under
+  that silent arm — they do not: an armed agent whose model declares no
+  standing is served the bytes it always was, plus the instruction.
+- The name was proved before it shipped: `_findings` survives every
+  provider's `inputSchema` mapping byte-for-byte, `required` untouched —
+  Anthropic, OpenAI, Gemini, Bedrock, Ollama, Foundry (hosted and local) and
+  both browser providers (`test/adapters/reservedArgumentSurvives.test.ts`).
+
 ## [9.100.0] - 2026-09-16
 
 ### Added — the delivered answer names its shape guarantee

package/CLAUDE.md

@@ -157,7 +157,7 @@ Traps: `src/observability/` holds the finder IMPLEMENTATIONS (canonical home; `d
 - **Embedder fingerprint** (8.9.0) → `Embedder.id` (optional; every shipped embedder sets one, and NONE include dims — the store appends `@<dims>` itself, so an id carrying its own size double-stamps) + `indexDocuments` defaulting `embedderId` to it + `SqliteVectorStore.reconcileFingerprint` (the only comparison site). Rule: dimensions ALWAYS decide, model ids decide only when BOTH sides named themselves — refusing on an absent name would block the majority of callers who never pass `embedderId`.
 - **Retrieval record** (8.8.0) → FOUR stages write one object in sequence: `loadRelevant` (candidates+scores+threshold verdicts) → `pickByBudget` (re-marks admitted→over-budget/over-max-entries) → `formatDefault` (`promptFragment` + `promptPosition`) → the read mount's outputMapper lifts it to root as `retrievalEvidence_<id>`. `memoryRecallInjections` then splits ONE recall into one ActiveInjection PER CHUNK — guarded by a byte-equality check (`fragments.join('\n\n') === systemContent`) that falls back to the single injection rather than change the prompt. `rank` (score order) and `promptPosition` (picker order) are DIFFERENT and both load-bearing: joining fragments in rank order reproduces the right bytes in a sequence the model never saw.
 - **AgentState** → all 8 stages/ files, both builders' mappers, memory-wire STRING-TYPED keys ('runIdentity'/'turnNumber'/… buildAgentChart.ts:177-180 — not refactor-safe), finalizeResult's `reliabilityFail*`/`policyHalt*` reads (rename silently kills the typed errors).
-- **events/** → 111 typed events across 24 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
+- **events/** → 113 typed events across 25 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
 - **Run-configuration manifest (9.41.0)** → `agentfootprint.agent.run_configured`, the JOIN KEY that turns N runs into N labelled ARMS: one event naming the adapters/strategies in play (provider+model, reactMode, each memory's declared strategy/retrieval/embedder, window, graph posture+classifier, evidence posture, artifacts-present). Composed by the PURE `core/agent/runManifest.ts`, dispatched from `Agent.emitRunManifest()` at the END of `createExecutor` — the ONE funnel `run()` AND `resume()` share, both of which mint a fresh runId. Direct `dispatcher.dispatch` with a STATED pseudo-stage (`run-configured#0`), the `emitToolSessionReport` precedent — there is no stage yet, and `minimalMeta()` would make the one joinable-by-design event unjoinable. TWO laws, both tested: NAMES ONLY (a store is reported PRESENT and unnamed rather than identified by a directory/endpoint — `MemoryStore` and `ArtifactStore` declare no id), and ABSENT means "not configured", never a guessed `'default'`. Graph presence is read off `skillGraphNextSkill`, NOT `skillGraphCascade` (a 9.16-style mount sets no cascade and would read as "no graph"). `MemoryDefinition` gained `strategy`/`retrieval`/`embedderId` for it — declared names the compiled pipeline had closed over, the `store`-in-the-open precedent.
 - **adapters/types.ts LLMMessage/LLMRequest** → 62 importers: tool_use round-trip (toolCalls.ts:115-135), wire assembly (callLLM.ts:150-160), providers, cache strategies, security/extractSequence, reliability loop.
 - **Cache** → strategy registration is a MODULE SIDE EFFECT (src/index.ts:15-17); an entry point skipping that import silently falls back to NoOp. Resolved once per Agent at construction (Agent.ts:347).

package/README.md

@@ -931,6 +931,7 @@ The flowchart, recorders, and tests don't change between dev and prod.
 - Human-in-the-loop pause / resume — a tool calls `pauseHere(...)` (or `askHuman(...)`); `isPaused(result)` hands you a JSON-serializable checkpoint, and `agent.resume(checkpoint, input)` continues hours later on a different server
 - Resilience primitives — `withRetry`, `withFallback`, `withCircuitBreaker`, `.outputFallback`, `agent.resumeOnError`
 - Context Integrity — deterministic checks at the seams where a run contradicts ITSELF: a tool parked but still on the wire, a tool offered after the results grounding it were evicted, an answer field that disagrees with the fact it claims to report (`.claims()`, requires `.outputSchema()`). Nothing is blocked or rewritten — each defect is one typed finding, and every run files a disposition ledger so "no findings" and "no check ran" stay different states. `integrityPosture: 'dev'` adds the liveness proofs (a start-of-run canary; `CheckerDeadError` instead of a green report from a checker that never ran). Read it back with `find_context_errors` over a recording — [Context Integrity](https://agentfootprint.dev/docs/monitor/context-integrity/)
+- Findings ledger — `.findings()` adds one reserved optional argument, `_findings`, to every served tool schema: the model declares why it makes each call (`basis`: `direct` or `exploratory`) and, on its next call or as a top-level key of a JSON answer, the standing of each earlier result by its tool_result id (`fact` with the assertions it stands on, `open`, `ruled-out`, `noise`). Zero extra model calls. The argument is peeled off before the tool, the middleware or the validator sees the call; the rows land as one append-only `findingsLedger` on the run's state (`agent.findings()`), with a `conflict` row whenever two stood-on readings disagree. Nothing is inferred — a call that declares nothing files nothing — and nothing is served differently yet: the ledger is a record. An agent that never calls `.findings()` is byte-identical to one built before it existed
 - 60+ typed observability events — `agent` · `composition` · `context` · `stream` · `tools` · `skill` · `memory` · `cache` · `cost` · `permission` · `eval` · `embedding` · `pause` · `error` · `fallback` · `resilience` · `reliability` · `risk`
 
 **Debugging & compliance** (`agentfootprint/observe`)

package/ai-instructions/claude-code/SKILL.md

@@ -252,7 +252,7 @@ const agent = Agent.create({ provider, model })
 agent.on('agentfootprint.context.evaluated', (e) => console.log(e.payload.activeIds));
 ```
 
-**111 typed events across 24 domains.** Two subscription shapes and no third:
+**113 typed events across 25 domains.** Two subscription shapes and no third:
 `'*'` (every event) and `'agentfootprint.<domain>.*'` (one domain). **`'agentfootprint.*'`
 is not a pattern** — TypeScript rejects it, and at runtime it would match nothing.