agentfootprint 9.131.0 → 9.132.0

package/AGENTS.md

@@ -35,9 +35,9 @@ only *labels* a spinning run; `maxIterations` is the hard stop), and there is **
 automatic re-delivery of an ageing skill body** (`refreshPolicy` is stored and never
 read on any version — use `surfaceMode: 'both'`).
 
-## Subpath map — 17 doors
+## Subpath map — 18 doors
 
-`agentfootprint` (main barrel: `Agent`, `LLMCall`, `defineTool`, control flow, patterns, `defineRAG`, pause/resume) · `/providers` (`mock`, `anthropic`, `openai`, `bedrock`, `ollama`, `mcpClient`, embedders — every provider, so bundlers never walk the vendor SDKs from the main barrel) · `/context` (`defineSkill`, `defineFact`, `defineSteering`, `defineInstruction`, `skillGraph`, `skillsFromDir`, the scorers) · `/memory` (`defineMemory`, `InMemoryStore`, `mockEmbedder`, the stores) · `/rag` (stores + loaders; `defineRAG` itself is on the main barrel) · `/observe` (recorders, tracing, `RunStep`) · `/resilience` (provider decorators) · `/reliability` (the rules-based fail-fast gate) · `/cache` (prefix-cache strategies; importing it registers them) · `/security` · `/hosting` · `/events` · `/skill-graph` (the routing layer with no framework attached, for a host that is not this agent) · `/recipes` (`defineAgentRecipe` — one named, versioned agent setup, applied with `.recipe()`) · `/maps` (`Claim<T>` and the map-engagement vocabulary behind `.maps()`) · `/classify` (the calibrated-classifier port: `Classifier`, `mockClassifier`) · `/ontology` (`defineOntology` — a declared map of the domain, mounted with `.ontology()`). `package.json` `exports` is the complete list; a path not on it does not resolve.
+`agentfootprint` (main barrel: `Agent`, `LLMCall`, `defineTool`, control flow, patterns, `defineRAG`, pause/resume) · `/providers` (`mock`, `anthropic`, `openai`, `bedrock`, `ollama`, `mcpClient`, embedders — every provider, so bundlers never walk the vendor SDKs from the main barrel) · `/context` (`defineSkill`, `defineFact`, `defineSteering`, `defineInstruction`, `skillGraph`, `skillsFromDir`, the scorers) · `/memory` (`defineMemory`, `InMemoryStore`, `mockEmbedder`, the stores) · `/rag` (stores + loaders; `defineRAG` itself is on the main barrel) · `/observe` (recorders, tracing, `RunStep`) · `/resilience` (provider decorators) · `/reliability` (the rules-based fail-fast gate) · `/cache` (prefix-cache strategies; importing it registers them) · `/security` · `/hosting` · `/events` · `/skill-graph` (the routing layer with no framework attached, for a host that is not this agent) · `/recipes` (`defineAgentRecipe` — one named, versioned agent setup, applied with `.recipe()`) · `/maps` (`Claim<T>` and the map-engagement vocabulary behind `.maps()`) · `/classify` (the calibrated-classifier port: `Classifier`, `mockClassifier`) · `/ontology` (`defineOntology` — a declared map of the domain, mounted with `.ontology()`) · `/time` (`convertForTool` + `sugarForms` + `granularityMsOf` — the time layer's own answer to whether and how a tool reads a window, for an app outside a run; the steps `convertExact`, `convertWidened`, `periodFactProblem` too). `package.json` `exports` is the complete list; a path not on it does not resolve.
 
 ## Core Concepts
 

package/CAPABILITIES.md

@@ -55,13 +55,14 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 | a chart or check comparing a dataset's time values as spellings — epoch seconds beside ISO strings, `+02:00` beside `Z`, a wall-clock string with no offset silently read as UTC, two `01:30` rows in the hour the clocks go back; a READ-SIDE view (the stored rows are never rewritten): UTC instants at one precision, sorted, each with its row; an offset-less value under a zone-less axis is counted (`status: 'naive-values'`) or refused (`naive: 'refuse'`), never read as UTC; a fall-back wall time placed by row order and noted, else counted `dstAmbiguous`; a skipped one `dstGap` (the axis is re-exported from `src/artifacts/`) | `normaliseInstants` + `NormalisedAxis` | `src/core/time/axis.ts` | 9.129.0 |
 | a second parser for an instant, a look-back like `30m`/`24h`, a time zone or a `from..to` range inside the library — three separately written grammars used to disagree (an `iso-range` argument took 30 February, a declared period took a lower-case `t`); ONE owner now, with two named instant profiles (`lenient` for a period a result declares, `strict` for a value sent to a tool), a duration grammar with the unit set named per use (look-back `mhdw`, no digit cap; `s` only by opt-in), IANA zones through `Intl` with abbreviations and bare offsets refused, Temporal's four DST words, and one conversion per boundary a half-open range crosses; internal until the run clock ships | `instantOf` + `durationMs` / `spellDuration` + `isZoneName` / `wallToInstant` + `parseRange` / `spellRange` + `fromInclusive` / `toInclusive` | `src/core/time/` | 9.129.0 |
 | a run that reads "now" and the person's time zone from the SERVER — "since 8" answered in the host's zone, a default nobody chose, a resume half an hour later silently re-anchoring the question — the clock as a declared, recorded input: the zone per run (`run({ time: { zone } })`), `.time({ zone })` an optional fallback, a run with neither REFUSED before the turn starts; `now` the app's (the message's time) else the turn's start, recorded `nowSource: 'default'`; one `clock` row per turn on the ledger (with a UI-set `time.window`, `source: 'control'`), one `call` row per dispatched call with `dispatchedAt`, a resume's differing `time` kept out and recorded as `clock-on-resume`; the limits block's `Period:` lines rendered in the run's zone with the zone named (`2026-10-09 08:00–08:40 America/Los_Angeles (UTC-07:00)`) while the typed record keeps the instants; nothing served to the model | `AgentBuilder.time()` + `AgentInput.time` / `AgentRunOptions.time` (`RunTime`) + `TimeClock` + `ClockRow` / `ClockOnResumeRow` / `CallRow` | `src/core/time/clock.ts` | 9.129.0 |
-| an app's date parser silently choosing MDY, reading `8:40` as morning, guessing a year, taking `PST` as a zone, or re-reading a message differently on a resume — the person's words read ONLY through a reader the app arms (`.time({ reader })`, no default), which returns zone-less PARTS and a verbatim quote (checked: an out-of-text quote is refused and keeps no text); the library resolves every candidate window against the run clock (three date orders, am and pm, both instants of a DST overlap or gap, a day word, a look-back, a range read to the end of its grain; an abbreviation is asked, never mapped); a v1 policy (`dateOrder`, `year`, both `'ask'` by default) removes readings and the removal is recorded; one `time-reading` row per mention (or one `mentions: 0` row), once per message — only a message a person wrote, never a composed run's — with the reader's id, version, kind and locale and the tz database version; a resume or retry reads the row, never the reader; a `kind: 'model'` reader's window is never `said` and waits for the person's confirmation; nothing served to the model | `TimeReader` + `TimeParts` + `TimePolicy` + `TimeCandidate` / `ReadingChoice` + `TimeReadingRow` (`.time({ reader, policy })`) | `src/core/time/resolve.ts` | 9.129.0 |
+| an app's date parser silently choosing MDY, reading `8:40` as morning, guessing a year, taking `PST` as a zone, or re-reading a message differently on a resume — the person's words read ONLY through a reader the app arms (`.time({ reader })`, no default), which returns zone-less PARTS and a verbatim quote (checked: an out-of-text quote is refused and keeps no text); the library resolves every candidate window against the run clock (three date orders, am and pm, both instants of a DST overlap or gap, a day word, a look-back, a range read to the end of its grain — an o'clock end ends AT the hour, "8 AM to 9 AM" is one hour; a place named with `time` read as the one zone the tz database names for it; an abbreviation asked unless the app maps it with `policy.abbreviations`, and then offered as its zone AND its letters' offset when they disagree); a v1 policy (`dateOrder`, `year`, both `'ask'` by default) removes readings and the removal is recorded; one `time-reading` row per mention (or one `mentions: 0` row), once per message — only a message a person wrote, never a composed run's — with the reader's id, version, kind and locale and the tz database version; a resume or retry reads the row, never the reader; a `kind: 'model'` reader's window is never `said` and waits for the person's confirmation; nothing served to the model | `TimeReader` + `TimeParts` + `TimePolicy` + `TimeCandidate` / `ReadingChoice` + `TimeReadingRow` (`.time({ reader, policy })`) | `src/core/time/resolve.ts` | 9.129.0 |
 | every app re-checking a time answer the person typed into an ask — a window written backwards, a date-time with no offset, `PST` for a zone, a wall time the clocks skip — and re-asking in silence; a `requestInput` field declares a `format` — `'instant'`, `'time-range'` or `'zone'` — (refused unless `type: 'string'`; a malformed choice or supplied value refused at definition) and the resume door judges the answer with the time layer's one judge: a refused one is NOT taken — the same ask returns with `refused: { answer, reason }` and `repeat: { count }`, the field missing again, nothing run; the reason is a catalog sentence the app can reword (`.time({ messages })`), and only a check the app armed produces one (the DST check needs `.time()`'s zone); `labels` per choice, free entry open unless `strict`; over MCP a range travels as two `date-time` elicitation properties | `InputField.format` / `labels` / `strict` + `defaultTimeAskMessages` + `elicitationOf` / `answerFromElicitation` | `src/core/time/ask.ts` | 9.129.0 |
 | a tool whose period is two epoch-millisecond arguments (or a joined range, a date, a look-back in seconds) being sent the person's window in the wrong shape, rounded silently, or overwritten — and every host tool re-parsing its own argument to say what its read covered; the tool DECLARES every shape its period takes (`forms`: `bounds` · `joined` · `object` · `day` · `lookback` with `units`; today's `{ argument, spelling }` is shorthand, plus `accepts`, `wall-range` + `zoneArgument`) and facts about its source (`direction`, `retention`, `maxRange`, `granularity`, `filtersToAsked`, `wallZone`), judged at definition, dispatch and MCP ingest (`_meta.agentfootprint.period`); under `.time()` a period the model left out is filled from the turn's ONE window of the person's (a settled reading, or a UI `time.window`) into the first form that holds it exactly, filed as theirs (`said` + `matched: 'mention'`; a model reader's as a reading; a UI window as `app`); two mentions fill nothing; a sent window is bound by quote or value, or runs as sent and is recorded `model-chosen` (standing "not sure"); one `call-window` row per call; the tool is handed `ctx.time` (`asked`, `zone`, `now`, `dispatchedAt`; over MCP in the call's `_meta.agentfootprint.time`); the tool's facts join the time answer's re-check | `ToolPeriod.forms` / `PeriodForm` / `PeriodFacts` + `ToolExecutionContext.time` (`TimeContext`) + `CallWindowRow` | `src/core/time/convert.ts` | 9.129.0 |
 | a tool whose period cannot hold the person's window exactly being sent a narrower window, a silently wider one, or a window its source cannot hold — a look-back tool asked for "yesterday", a `day` tool asked for two days, a log store asked for tomorrow, a look-back re-read half an hour later after a pause; under `.time()` the fill takes the first exact form, else the first that holds MORE (a whole day; the covering look-back from now, never over `maxRange`) and records it (`call-window` `sent` + `differs.extra`, or `trimmedByTool` under `filtersToAsked`; the note says wider); a window outside `direction`, wholly beyond `retention`, over `maxRange`, spanning days for a `day`-only tool, or a sent wall time the zone skips is REFUSED before dispatch with a past-tense reason naming the declared fact (`how: 'refused'`); a window partly beyond `retention` runs, marked; after drift past the tool's step the library's own look-back fill is redrawn into an absolute form and the model's runs as sent (`call` row `drift`: `redrawn` or `shifted`) | `PeriodFacts` + `convertWidened` + `driftAtDispatch` + `CallWindowRow` + `CallRow.drift` | `src/core/time/` | 9.129.0 |
-| reading a person's time words with a hand-rolled parser that guesses — `10/09/26` silently MDY, `PST` taken as a zone, "yesterday" read out of "yesterday morning" — then making the model re-derive the window from words, and asking about dates nobody needed; the library's careful English reader (no dependency, `kind: 'rule'`) TOKENIZES a small, closed set (ISO dates and instants, numeric dates with the order left open, clock times, a range of two, a zone written after them, today / yesterday / tomorrow, "last 40 minutes") and says "unreadable" — one mention, the whole phrase — for every other time phrase it recognises; a reading only PROPOSES (owner decision "Always confirm": nothing typed in chat is filed as the person's words) — when a tool that declares a period is about to be called, it is offered as a pre-filled, editable one-click confirmation naming its window AND its zone (the zone asked first for an abbreviation, the readings the tool's facts allow as labelled choices), written into the tool's own arguments and filed `answered` with a `time-answer` row (`confirmed` click or `edited`); from then on the turn's later calls are filled from it and it is served on every tool that declares a period, in that tool's own form, with its source; when every reading breaks the tool's facts the call is refused, nothing asked | `englishTimeReader` + the window field of the batch ask + the `time-answer` row + the served time sentence | `src/core/time/readers/english.ts` | 9.131.0 |
+| reading a person's time words with a hand-rolled parser that guesses — `10/09/26` silently MDY, `PST` taken as a zone, "yesterday" read out of "yesterday morning" — then making the model re-derive the window from words, and asking about dates nobody needed; the library's careful English reader (no dependency, `kind: 'rule'`) TOKENIZES a small, closed set (ISO dates and instants, numeric dates with the order left open, clock times, a range of two, a zone written after them or after a day word — `yesterday London time` included, today / yesterday / tomorrow, "last 40 minutes") and says "unreadable" — one mention, the whole phrase — for every other time phrase it recognises; a reading only PROPOSES (owner decision "Always confirm": nothing typed in chat is filed as the person's words) — when a tool that declares a period is about to be called, it is offered as a pre-filled, editable one-click confirmation naming its window AND its zone (the zone asked first for an abbreviation, the readings the tool's facts allow as labelled choices), written into the tool's own arguments and filed `answered` with a `time-answer` row (`confirmed` click or `edited`); from then on the turn's later calls are filled from it and it is served on every tool that declares a period, in that tool's own form, with its source; when every reading breaks the tool's facts the call is refused, nothing asked | `englishTimeReader` + the window field of the batch ask + the `time-answer` row + the served time sentence | `src/core/time/readers/english.ts` | 9.131.0 |
 | an answer about the person's time window marked "not traced" for `08:41`, `-07:00`, `PDT` or the epoch the call ran with — or, the other way, the model's echo of the library's served time line passing as the person's words; under `.time()` beside the evidence gate, ONE owner says which spelling of a time is whose: the parts the person wrote, at the grain they wrote them ("8 AM" is also `8:00`/`08:00`; a confirmed `10/09/26` is `2026-10-09`), and every part of a window they typed or set in a UI, are theirs (exempt); what the library produced from a reading (an implied year, the abbreviation in effect, offsets, UTC and epoch spellings, the end-of-grain minute, a look-back's duration, the values it filled, the served time line, any part of a `model` reading) is filed as ONE `time-derived` row and folds `derived-from-reading` — "not sure", never "known", never called invented; a time no reading produced is still flagged; the gate's private clock table is retired into the same owner | `timeFormsOf` + `TimeDerivedRow` + `derived-from-reading` + `EvidenceVerdict.derived` | `src/core/time/forms.ts` | 9.131.0 |
 | an answer standing on a read that is not the window the person asked about — a store that clamped 30 days to 7, a covering look-back that read two days for one, a look-back re-read half an hour late after a pause, a model's drill-down reported as the person's window, a window older than the source keeps — while the answer reads as if it covered the ask; under `.time()` the results layer compares each call's READ (the result's declared `period.queried`, read back with the tool's `granularity`; else the widened fill; else the look-back shifted by its drift) with what it ASKED (for a window the model chose, with the person's): `missing` (asked, not read) and `extra` (read, not asked) on the call's `period` row (`differs`, plus `shifted`, `beyondRetention`, `partlyBeyondRetention`), the event names the checks (never a range), the standing folds `period-differs-from-asked` (TQ8: a wider read too, unless the result declares it read exactly what was asked) and `period-beyond-retention` — "not sure" — and the limits block says each in the person's zone; a dataset whose declared axis names a zone files a `source-clock` row and a `Clocks` line (two zones: the clocks differ — a label only); a period's offset is never read as a clock | `PeriodRow.differs` / `shifted` / `beyondRetention` + `period-differs-from-asked` + `period-beyond-retention` + `SourceClockRow` | `src/core/time/check.ts` | 9.131.0 |
+| an app keeping its own copy of the library's period conversion — to preview what a tool would read for the person's window, or to build a call itself — and drifting from what the fill, the time ask and the served line send; the same question the time layer asks of each tool, over the tool's own `period` and a clock the app passes: a fact the window breaks, else the first form that holds it EXACTLY, else the first that reads MORE within `maxRange` (with the range it reads and what it adds, marked when partly older than `retention`), else `multi-day` / `no-form-holds` (`convertForTool`, the forms and step read the run's way by `sugarForms` / `granularityMsOf`); the steps alone too (`convertExact`, `convertWidened`, `periodFactProblem`) — no run, no record, no `.time()` | `convertForTool` + `sugarForms` + `granularityMsOf` (+ `convertExact` / `convertWidened` / `widestMsOf` / `periodFactProblem`) (`agentfootprint/time`) | `src/doors/time.ts` | 9.132.0 |
 | letting the UI draw an artifact without the model naming a component | `registerArtifactComponent` (in the `agentfootprint-lens` package) | — | — |
 | finding which tools the model keeps writing by hand | `agentfootprint.tools.code_run` + `codeShape` | `src/core/codeRunnerTool.ts` | 9.46.0 |
 | a skill wrongly activated by a keyword staying loaded for the whole turn — suspending/parking a map's prompt + tools when its contribution goes unused, WITHOUT touching its cursor, and re-engaging it on evidence | `.maps({ renewalGrace })` (default 3) + `MountedMap.nonParkable` + `advanceEngagement` + `agentfootprint.map.engaged/parked` + skip reason `'parked'` | `src/maps/` | 9.58.0 |

package/ai-instructions/claude-code/SKILL.md

@@ -35,9 +35,9 @@ only *labels* a spinning run; `maxIterations` is the hard stop), and there is **
 automatic re-delivery of an ageing skill body** (`refreshPolicy` is stored and never
 read on any version — use `surfaceMode: 'both'`).
 
-## Subpath map — 17 doors
+## Subpath map — 18 doors
 
-`agentfootprint` (main barrel: `Agent`, `LLMCall`, `defineTool`, control flow, patterns, `defineRAG`, pause/resume) · `/providers` (`mock`, `anthropic`, `openai`, `bedrock`, `ollama`, `mcpClient`, embedders — every provider, so bundlers never walk the vendor SDKs from the main barrel) · `/context` (`defineSkill`, `defineFact`, `defineSteering`, `defineInstruction`, `skillGraph`, `skillsFromDir`, the scorers) · `/memory` (`defineMemory`, `InMemoryStore`, `mockEmbedder`, the stores) · `/rag` (stores + loaders; `defineRAG` itself is on the main barrel) · `/observe` (recorders, tracing, `RunStep`) · `/resilience` (provider decorators) · `/reliability` (the rules-based fail-fast gate) · `/cache` (prefix-cache strategies; importing it registers them) · `/security` · `/hosting` · `/events` · `/skill-graph` (the routing layer with no framework attached, for a host that is not this agent) · `/recipes` (`defineAgentRecipe` — one named, versioned agent setup, applied with `.recipe()`) · `/maps` (`Claim<T>` and the map-engagement vocabulary behind `.maps()`) · `/classify` (the calibrated-classifier port: `Classifier`, `mockClassifier`) · `/ontology` (`defineOntology` — a declared map of the domain, mounted with `.ontology()`). `package.json` `exports` is the complete list; a path not on it does not resolve.
+`agentfootprint` (main barrel: `Agent`, `LLMCall`, `defineTool`, control flow, patterns, `defineRAG`, pause/resume) · `/providers` (`mock`, `anthropic`, `openai`, `bedrock`, `ollama`, `mcpClient`, embedders — every provider, so bundlers never walk the vendor SDKs from the main barrel) · `/context` (`defineSkill`, `defineFact`, `defineSteering`, `defineInstruction`, `skillGraph`, `skillsFromDir`, the scorers) · `/memory` (`defineMemory`, `InMemoryStore`, `mockEmbedder`, the stores) · `/rag` (stores + loaders; `defineRAG` itself is on the main barrel) · `/observe` (recorders, tracing, `RunStep`) · `/resilience` (provider decorators) · `/reliability` (the rules-based fail-fast gate) · `/cache` (prefix-cache strategies; importing it registers them) · `/security` · `/hosting` · `/events` · `/skill-graph` (the routing layer with no framework attached, for a host that is not this agent) · `/recipes` (`defineAgentRecipe` — one named, versioned agent setup, applied with `.recipe()`) · `/maps` (`Claim<T>` and the map-engagement vocabulary behind `.maps()`) · `/classify` (the calibrated-classifier port: `Classifier`, `mockClassifier`) · `/ontology` (`defineOntology` — a declared map of the domain, mounted with `.ontology()`) · `/time` (`convertForTool` + `sugarForms` + `granularityMsOf` — the time layer's own answer to whether and how a tool reads a window, for an app outside a run; the steps `convertExact`, `convertWidened`, `periodFactProblem` too). `package.json` `exports` is the complete list; a path not on it does not resolve.
 
 ## Core Concepts
 

package/dist/core/agent/arguments/ask.js

@@ -56,10 +56,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.settledCalls = exports.WINDOW_ZONE_EXPECTATION = exports.WINDOW_FORM_EXPECTATION = exports.bindAnswer = exports.factExpectation = exports.checkAnswer = exports.memberValue = exports.readAskAnswer = exports.isArgumentAsk = exports.withWaiting = exports.argumentAskDeclaration = exports.judgeAskContextHook = exports.nextAskRound = exports.initialAskState = exports.planAskFields = exports.periodsShareField = exports.convertSpelling = exports.ARGUMENT_REASK_QUESTION = exports.ARGUMENT_ASK_QUESTION = exports.ARGUMENT_ASK_ID = exports.ASK_CONTEXT_CHARS = exports.MAX_ASK_FIELDS = exports.MAX_ASK_ROUNDS = exports.ASK_CONTEXT_KEY = exports.ARGUMENT_ASK_KIND = void 0;
 const inputRequest_js_1 = require("../../inputRequest.js");
 const convert_js_1 = require("../../time/convert.js");
+const rowsBuild_js_1 = require("../../time/rowsBuild.js");
+const instant_js_1 = require("../../time/instant.js");
 const range_js_1 = require("../../time/range.js");
 const resolve_js_1 = require("../../time/resolve.js");
 const readingAsk_js_1 = require("../../time/readingAsk.js");
 const rows_js_1 = require("../../time/rows.js");
+const zone_js_1 = require("../../time/zone.js");
 const toolShownArgs_js_1 = require("../../toolShownArgs.js");
 const toolArgsValidation_js_1 = require("../toolArgsValidation.js");
 const declare_js_1 = require("./declare.js");
@@ -89,21 +92,46 @@ exports.ARGUMENT_ASK_QUESTION = 'Before the next step can run, a few values are
 /** The question of a re-ask, after an answer that did not fit the tool's own schema. */
 exports.ARGUMENT_REASK_QUESTION = 'One answer did not fit what the tool accepts. Please answer that field again.';
 /**
- * The indexes of the choices EVERY member tool's declared facts allow (§ 6.3:
- * "some readings inside the tool's `direction` → the ones inside as choices")
- * — `undefined` when none is left (several tools that disagree: every choice
- * is offered, and the answer is judged against each tool's facts).
+ * Why one member tool cannot read a window the ask would put into it — the
+ * one owner's answer (`core/time/convert.ts` · `convertForTool`: a fact it
+ * breaks, `multi-day`, or `no-form-holds`) — or `undefined` when it can. A
+ * tool whose rules cannot be read has nothing to say here.
  */
-function allowedChoices(choices, members, toolOf, now) {
-    const factsOf = [...new Set(members.map((m) => m.toolName))].map((name) => {
-        const rules = (0, declare_js_1.rulesOf)(toolOf(name));
-        return rules === undefined || (0, declare_js_1.isRefused)(rules) ? {} : (0, declare_js_1.periodFactsOf)(rules.period);
+function unreadableBy(toolName, range, zone, toolOf, time) {
+    const rules = (0, declare_js_1.rulesOf)(toolOf(toolName));
+    if (rules === undefined || (0, declare_js_1.isRefused)(rules))
+        return undefined;
+    const facts = (0, declare_js_1.periodFactsOf)(rules.period);
+    const at = zone ?? time.zone;
+    if (at === undefined) {
+        const problem = (0, convert_js_1.periodFactProblem)(range, facts, time.now);
+        return problem === undefined ? undefined : { refused: problem, facts };
+    }
+    const read = (0, convert_js_1.convertForTool)({ range }, (0, declare_js_1.periodFormsOf)(rules.period), facts, {
+        now: time.now,
+        zone: at,
+        ...(time.appZone !== undefined && { appZone: time.appZone }),
+        granularityMs: (0, convert_js_1.granularityMsOf)(facts),
     });
+    return 'refused' in read ? { refused: read.refused, facts } : undefined;
+}
+/**
+ * The indexes of the choices EVERY member tool can read (§ 6.3: "some
+ * readings inside the tool's `direction` → the ones inside as choices" — and,
+ * by the same law, a reading no form of the tool can hold is not offered) —
+ * `undefined` when none is left (several tools that disagree: every choice
+ * is offered, and the answer is judged against each tool).
+ */
+function allowedChoices(choices, zones, members, toolOf, time) {
+    const names = [...new Set(members.map((m) => m.toolName))];
     const kept = choices.flatMap((value, i) => {
         const range = (0, range_js_1.parseRange)(value);
         if (range === undefined)
             return [];
-        return factsOf.every((facts) => (0, convert_js_1.periodFactProblem)(range, facts, now) === undefined) ? [i] : [];
+        const zone = zones?.[i];
+        return names.every((name) => unreadableBy(name, range, zone, toolOf, time) === undefined)
+            ? [i]
+            : [];
     });
     return kept.length > 0 ? kept : undefined;
 }
@@ -269,7 +297,7 @@ function planAskFields(asks, calls, toolOf, windowPlan) {
     const window = windowFieldOf(windowPlan, windowMembers);
     const kept = window.choices === undefined
         ? undefined
-        : allowedChoices(window.choices, window.members, toolOf, windowPlan.now);
+        : allowedChoices(window.choices, windowPlan.zones, window.members, toolOf, windowPlan);
     return [narrowed(window, kept), ...fields];
 }
 exports.planAskFields = planAskFields;
@@ -559,6 +587,96 @@ function factBroken(toolOf, member, value, time) {
     }
     return undefined;
 }
+/**
+ * The period fields whose answers break a tool's fact only TOGETHER — one
+ * bound of two (`start_time`, `end_time`) is no window, so {@link checkAnswer}
+ * cannot judge it alone (`factBroken` reads single-argument forms only). Per
+ * call, the answers this pass carries and the ones an earlier round bound are
+ * written over the call's own arguments; every `bounds` / `object` form whose
+ * arguments are then all present is read back (`convert.ts` · `readBack`) and
+ * judged against `direction`, `retention` and `maxRange` at the turn's clock
+ * (`periodFactProblem`). A pair that breaks one sends each of its fields
+ * asked in this pass back to be asked again, naming the fact; a pair whose
+ * bounds are all present yet name no window (the end given before the start)
+ * goes back the same way, naming the window form — the same
+ * bounded re-ask a single argument gets, so a future start and end the
+ * person gave never reach a tool whose source holds only the past, with or
+ * without the reader.
+ */
+function pairsBroken(state, values, byId, toolOf, time) {
+    const broken = new Map();
+    const waiting = state.waiting;
+    if (time === undefined || waiting === undefined)
+        return broken;
+    const now = new Map(waiting.fieldIndexes.map((index, k) => [index, values[`f${k + 1}`]]));
+    // Per call: its tool, and each period argument's answer with the field it came from.
+    const perCall = new Map();
+    state.fields.forEach((field, index) => {
+        if (field.window !== undefined)
+            return;
+        const answer = now.has(index) ? now.get(index) : state.progress[index]?.answer;
+        if (answer === undefined)
+            return;
+        for (const member of field.members) {
+            if (member.period !== true)
+                continue;
+            const value = memberValue(field, member, answer);
+            if (value === undefined)
+                continue;
+            for (const id of member.toolCallIds) {
+                const entry = perCall.get(id) ?? { toolName: member.toolName, answers: new Map() };
+                entry.answers.set(member.argument, { value, field: index });
+                perCall.set(id, entry);
+            }
+        }
+    });
+    for (const [id, { toolName, answers }] of perCall) {
+        const call = byId.get(id);
+        const rules = (0, declare_js_1.rulesOf)(toolOf(toolName));
+        if (call === undefined || rules === undefined || (0, declare_js_1.isRefused)(rules))
+            continue;
+        const facts = (0, declare_js_1.periodFactsOf)(rules.period);
+        if (facts.direction === undefined &&
+            facts.retention === undefined &&
+            facts.maxRange === undefined) {
+            continue;
+        }
+        const args = { ...call.args };
+        for (const [argument, { value }] of answers)
+            args[argument] = value;
+        for (const form of (0, declare_js_1.periodFormsOf)(rules.period)) {
+            if (form.kind !== 'bounds' && form.kind !== 'object')
+                continue;
+            // A zone argument the rule assumes is not in the call yet; `readBack` answers without one.
+            const names = (0, convert_js_1.formArguments)(form).map((a) => a.argument);
+            const bounds = (0, convert_js_1.formArguments)(form).filter((a) => a.role !== 'zone');
+            const asked = names.filter((a) => answers.has(a));
+            if (asked.length === 0 || bounds.some((a) => args[a.argument] === undefined))
+                continue;
+            const range = (0, convert_js_1.readBack)(args, form, time);
+            // Every bound is present: no range means the pair names no window (a start not before its
+            // end, a misspelled bound) — never "no problem", or it reaches the tool unjudged. Only a
+            // zone still to come leaves the pair for the zone's own ask.
+            const expectation = range !== undefined
+                ? pairExpectation((0, convert_js_1.periodFactProblem)(range, facts, time.now), facts)
+                : (0, convert_js_1.readBackLacksZone)(args, form, time)
+                    ? undefined
+                    : exports.WINDOW_FORM_EXPECTATION;
+            if (expectation === undefined)
+                continue;
+            for (const a of asked) {
+                const field = answers.get(a).field;
+                if (now.has(field) && !broken.has(field))
+                    broken.set(field, expectation);
+            }
+        }
+    }
+    return broken;
+}
+/** A pair's fact problem in the refusal's words — `undefined` when the pair breaks none. */
+function pairExpectation(problem, facts) {
+    return problem === undefined ? undefined : factExpectation(problem, facts);
+}
 // LENS · tool-result · persistent-history (through `serve.ts` · `unansweredRefusal`)
 // reads: the tool's declared fact the person's answers kept breaking, and its declared value
 // law: names the rule, never the answer; a fact about the source, in the present tense of the source.
@@ -595,6 +713,7 @@ function bindAnswer(state, values, calls, toolOf, stamp, time) {
     const byId = new Map(calls.map((c) => [c.id, c]));
     const progress = [...state.progress];
     const rows = [];
+    const pairs = pairsBroken(state, values, byId, toolOf, time);
     const fields = [...state.fields];
     waiting.fieldIndexes.forEach((index, k) => {
         const field = state.fields[index];
@@ -612,6 +731,12 @@ function bindAnswer(state, values, calls, toolOf, stamp, time) {
                 rows.push(...windowAnsweredRows(field, bound.fills, byId, toolOf, stamp));
                 // The person's window for the mention — the only door a window of words becomes theirs.
                 rows.push((0, rows_js_1.timeAnswerRow)({ mention: field.window.mention, ...bound.answered }, stamp));
+                // Each filled call's window, as it will run: the person's answer, exactly or WIDER (the
+                // covering look-back's `sent` and `extra`) — the call's latest `call-window` row, so the
+                // clock at dispatch, `ctx.time` and the result checks read the window the call carries.
+                for (const [toolCallId, { toolName, decision }] of Object.entries(bound.filled)) {
+                    rows.push((0, rowsBuild_js_1.callWindowRow)({ toolCallId, toolName }, decision, stamp));
+                }
                 return;
             }
             if ('outside' in bound) {
@@ -626,7 +751,10 @@ function bindAnswer(state, values, calls, toolOf, stamp, time) {
             rows.push(...memberCalls(field).map((who) => (0, rows_js_2.askedRowOf)(who, stamp, 'invalid-answer')));
             return;
         }
-        const check = answer === undefined ? { fits: false } : checkAnswer(field, answer, toolOf, time);
+        const alone = answer === undefined ? { fits: false } : checkAnswer(field, answer, toolOf, time);
+        // An answer that fits alone can still break a fact with the other bound of its window.
+        const pair = pairs.get(index);
+        const check = alone.fits && pair !== undefined ? { fits: false, expected: pair } : alone;
         if (answer !== undefined && check.fits) {
             progress[index] = { rounds: was.rounds, answer };
             rows.push(...answeredRows(field, answer, byId, toolOf, stamp));
@@ -672,7 +800,7 @@ function bindWindowAnswer(field, answer, byId, toolOf, time) {
         }
         const row = reading.row;
         // The re-read stays a PROPOSAL: the zone was the person's, the window is still words.
-        const resolution = (0, resolve_js_1.resolveMention)((0, resolve_js_1.withZoneAnswered)(row.parses ?? [], answer), { now: time.now, zone: time.zone }, row.reader, true);
+        const resolution = (0, resolve_js_1.resolveMention)((0, resolve_js_1.withZoneAnswered)(row.parses ?? [], answer, reading.policy), { now: time.now, zone: time.zone }, row.reader, true, reading.policy);
         const choice = (0, resolve_js_1.chooseReading)(resolution, reading.policy, row.reader.kind, undefined, true);
         if (choice.by === 'open') {
             const ask = (0, readingAsk_js_1.timeAskOf)({ ...row, candidates: resolution.candidates, choice }, reading.messages);
@@ -692,10 +820,10 @@ function bindWindowAnswer(field, answer, byId, toolOf, time) {
                 },
             };
             const choices = (ask.field.enum ?? []);
-            const kept = allowedChoices(choices, field.members, toolOf, time.now);
+            const kept = allowedChoices(choices, zones, field.members, toolOf, time);
             if (kept === undefined && field.members.length > 0) {
-                // Every reading breaks a member tool's facts: nothing is asked (§ 6.3) — the reason.
-                const outside = factOutside(choices, field.members, toolOf, time.now);
+                // A member tool can read no reading: nothing is asked (§ 6.3) — the reason.
+                const outside = readingsOutside(choices, zones, field.members, toolOf, time);
                 if (outside !== undefined)
                     return { outside };
             }
@@ -707,57 +835,101 @@ function bindWindowAnswer(field, answer, byId, toolOf, time) {
     if (range === undefined)
         return { expected: exports.WINDOW_FORM_EXPECTATION };
     const at = field.choices?.indexOf(answer) ?? -1;
-    const zone = (at >= 0 ? window.zones?.[at] : undefined) ?? time.zone;
+    const zone = at >= 0 ? window.zones?.[at] ?? time.zone : editedZone(range, window.zones, time.zone);
     if (zone === undefined)
         return { expected: exports.WINDOW_FORM_EXPECTATION };
     const bound = windowFills(field, range, zone, byId, toolOf, time);
     if (!('fills' in bound))
         return bound;
-    return { fills: bound.fills, answered: { range, zone, how: at >= 0 ? 'confirmed' : 'edited' } };
+    return {
+        fills: bound.fills,
+        filled: bound.filled,
+        answered: { range, zone, how: at >= 0 ? 'confirmed' : 'edited' },
+    };
+}
+/**
+ * The zone a window the person TYPED is recorded in: the first of the
+ * offered readings' zones — then the app's — whose offsets at both ends are
+ * the ones typed; else the fixed-offset zone the typed offsets spell
+ * (`Etc/GMT-1` for `+01:00`, `zone.ts` · `fixedOffsetZone`); else the app's.
+ * A London day typed with `+01:00` under an app in Los Angeles is recorded
+ * in Europe/London (the zone the mention named), never in the app's zone.
+ */
+function editedZone(range, offered, appZone) {
+    const from = (0, instant_js_1.instantOf)(range.from, 'lenient');
+    const to = (0, instant_js_1.instantOf)(range.to, 'lenient');
+    if (from === undefined || to === undefined)
+        return appZone;
+    const shows = (zone) => (0, zone_js_1.offsetAt)(zone, from.ms) === from.offsetMinutes && (0, zone_js_1.offsetAt)(zone, to.ms) === to.offsetMinutes;
+    const zones = [...(offered ?? []), ...(appZone !== undefined ? [appZone] : [])];
+    const match = zones.find(shows);
+    if (match !== undefined)
+        return match;
+    const fixed = from.offsetMinutes === to.offsetMinutes ? (0, zone_js_1.fixedOffsetZone)(from.offsetMinutes) : undefined;
+    return fixed ?? appZone;
 }
-/** What the first reading breaks, when EVERY reading breaks one member tool's facts — the refusal's words. */
-function factOutside(choices, members, toolOf, now) {
+/** Why the first reading cannot be read, when ONE member tool can read no reading at all — the refusal's words. */
+function readingsOutside(choices, zones, members, toolOf, time) {
     for (const name of new Set(members.map((m) => m.toolName))) {
-        const rules = (0, declare_js_1.rulesOf)(toolOf(name));
-        if (rules === undefined || (0, declare_js_1.isRefused)(rules))
-            continue;
-        const facts = (0, declare_js_1.periodFactsOf)(rules.period);
-        const problems = choices.map((value) => {
+        const reasons = choices.map((value, i) => {
             const range = (0, range_js_1.parseRange)(value);
-            return range === undefined ? undefined : (0, convert_js_1.periodFactProblem)(range, facts, now);
+            return range === undefined ? undefined : unreadableBy(name, range, zones[i], toolOf, time);
         });
-        const first = problems[0];
-        if (first !== undefined && problems.every((p) => p !== undefined)) {
-            return factExpectation(first, facts);
+        const first = reasons[0];
+        if (first !== undefined && reasons.every((r) => r !== undefined)) {
+            return refusalExpectation(first.refused, first.facts);
         }
     }
     return undefined;
 }
-/** The window written into every member call's forms, after each tool's facts — or what it failed. */
+/** What an answer must be, in the refusal's words, when a tool cannot read it: its fact, else a form that holds it. */
+function refusalExpectation(refused, facts) {
+    return refused === 'time-future' ||
+        refused === 'time-past' ||
+        refused === 'beyond-retention' ||
+        refused === 'over-max-range'
+        ? factExpectation(refused, facts)
+        : exports.WINDOW_FORM_EXPECTATION;
+}
+/**
+ * The window written into every member call's forms — the one owner's answer
+ * per tool (`core/time/convert.ts` · `convertForTool`: exactly, else wider,
+ * after the tool's facts) — or what it failed. Each fill also carries the
+ * decision its `call-window` row records (`filled`, the person's ANSWERED
+ * window, with the wider read's `sent` and `extra`).
+ */
 function windowFills(field, range, zone, byId, toolOf, time) {
     const fills = {};
+    const filled = {};
+    const answered = {
+        source: 'answered',
+        mention: field.window.mention,
+        range,
+        zone,
+    };
     for (const member of field.members) {
         const rules = (0, declare_js_1.rulesOf)(toolOf(member.toolName));
         if (rules === undefined || (0, declare_js_1.isRefused)(rules))
             return { expected: exports.WINDOW_FORM_EXPECTATION };
         const forms = (0, declare_js_1.periodFormsOf)(rules.period);
         const facts = (0, declare_js_1.periodFactsOf)(rules.period);
-        const problem = (0, convert_js_1.periodFactProblem)(range, facts, time.now);
-        if (problem !== undefined)
-            return { expected: factExpectation(problem, facts) };
+        const read = (0, convert_js_1.convertForTool)({ range }, forms, facts, {
+            now: time.now,
+            zone,
+            ...(time.appZone !== undefined && { appZone: time.appZone }),
+            granularityMs: (0, convert_js_1.granularityMsOf)(facts),
+        });
+        if ('refused' in read)
+            return { expected: refusalExpectation(read.refused, facts) };
+        const conversion = read.conversion;
+        const wider = 'sent' in conversion
+            ? facts.filtersToAsked === true
+                ? 'tool-trims'
+                : 'reads-more'
+            : undefined;
         for (const id of member.toolCallIds) {
             if (fills[id] !== undefined || !byId.has(id))
                 continue;
-            const ctx = {
-                now: time.now,
-                zone,
-                ...(time.appZone !== undefined && { appZone: time.appZone }),
-                granularityMs: (0, convert_js_1.granularityMsOf)(facts),
-            };
-            const exact = (0, convert_js_1.convertExact)({ range }, forms, ctx);
-            const conversion = exact ?? (0, convert_js_1.convertWidened)({ range }, forms, ctx, (0, convert_js_1.widestMsOf)(facts));
-            if (conversion === undefined)
-                return { expected: exports.WINDOW_FORM_EXPECTATION };
             for (const [argument, value] of Object.entries(conversion.values)) {
                 if (typeof value === 'object')
                     continue;
@@ -767,15 +939,20 @@ function windowFills(field, range, zone, byId, toolOf, time) {
                     return { expected: expected ?? exports.WINDOW_FORM_EXPECTATION };
                 }
             }
-            fills[id] = {
-                values: conversion.values,
-                ...(exact === undefined && {
-                    wider: facts.filtersToAsked === true ? 'tool-trims' : 'reads-more',
-                }),
+            fills[id] = { values: conversion.values, ...(wider !== undefined && { wider }) };
+            filled[id] = {
+                toolName: member.toolName,
+                decision: {
+                    how: 'filled',
+                    window: answered,
+                    conversion,
+                    ...(wider === 'tool-trims' && { trimmedByTool: true }),
+                    ...(read.partlyBeyondRetention === true && { partlyBeyondRetention: true }),
+                },
             };
         }
     }
-    return { fills };
+    return { fills, filled };
 }
 /** The `answered` rows of a bound window: one per (call, argument) the window filled, in the tool's own view. */
 function windowAnsweredRows(field, fills, byId, toolOf, stamp) {