agentfootprint 9.85.0 → 9.86.1

package/dist/esm/lib/injection-engine/types.js

@@ -34,11 +34,12 @@ export function toolResultsOf(ctx) {
  * The messages in `ctx.history` a PERSON actually wrote, in order (9.84.0).
  * THE one reader for a predicate that judges what was said.
  *
- * Five kinds of `role: 'user'` message in that list came from this library,
+ * Seven kinds of `role: 'user'` message in that list came from this library,
  * not from anybody: a compaction frame, a drop notice, the two in-loop
- * corrections, and a message an Injection delivered. They are ours, they are
- * in the person's voice, one of them names tools and two quote text the model
- * or a validator produced — so a rule written as
+ * corrections, the out-of-budget wrap-up instruction, the stepped-skill nudge,
+ * and a message an Injection delivered. They are ours, they are in the
+ * person's voice, two of them name tools and two quote text the model or a
+ * validator produced — so a rule written as
  *
  * ```ts
  * activeWhen: (ctx) => ctx.history.some((m) => m.content.includes('refund'))

package/dist/esm/lib/injection-engine/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA8TrD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAqB;IAMjD,OAAO,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAC5C,CAAC;AAoMD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAc,EACd,GAA2D;IAE3D,qEAAqE;IACrE,+DAA+D;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAEJ,CAAC;IACd,wEAAwE;IACxE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,YAAY,GAChB,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;QAC7D,CAAC,CAAC,GAAG,KAAK,SAAS;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC;QAChD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,MAAM,GAAG,GAAoB;QAC3B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAA6C,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI;YACxB,YAAY,EAAE,IAAI,CAAC,YAA+C;SACnE,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAiC;SAC9C,CAAC;QACF,MAAM,EAAE;YACN,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;gBACtB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE;oBACvB,WAAW,EAAE,GAAG,CAAC,EAAE;iBACpB,CAAC,CAAC;aACJ,CAAC;SACH;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA+TrD;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAqB;IAMjD,OAAO,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAqB;IAChD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAC5C,CAAC;AAoMD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAc,EACd,GAA2D;IAE3D,qEAAqE;IACrE,+DAA+D;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,IAAI,GAAG,GAAG,CAAC,QAEJ,CAAC;IACd,wEAAwE;IACxE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,YAAY,GAChB,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;QAC7D,CAAC,CAAC,GAAG,KAAK,SAAS;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC;QAChD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;IAC9B,MAAM,GAAG,GAAoB;QAC3B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAA6C,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,EAAE,YAAY,IAAI;YACxB,YAAY,EAAE,IAAI,CAAC,YAA+C;SACnE,CAAC;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI;YAC/B,KAAK,EAAE,IAAI,CAAC,KAAiC;SAC9C,CAAC;QACF,MAAM,EAAE;YACN,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI;gBACtB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAClC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE;oBACvB,WAAW,EAAE,GAAG,CAAC,EAAE;iBACpB,CAAC,CAAC;aACJ,CAAC;SACH;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/esm/lib/saidByPerson.d.ts

@@ -6,20 +6,24 @@
  *          imports, no state, no clock.
  * Role:    Leaf. Several layers ask the same question and must not answer it
  *          differently: the window's refusal engine (`currentRequest.ts`,
- *          which will not let a strategy drop the request), the four authors
+ *          which will not let a strategy drop the request), the six authors
  *          of library-written user turns (`window/notice.ts`,
- *          `window/summarize.ts`, `outputEnforcement.ts`, `evidence/gate.ts`
- *          — they own the sentences and take the markers from here), and —
- *          since 9.84.0 — a rule author reading `InjectionContext.history`
- *          (`saidByPerson(ctx)`).
+ *          `window/summarize.ts`, `outputEnforcement.ts`, `evidence/gate.ts`,
+ *          `stages/wrapUp.ts`, and `skillSteps.ts` for the nudge
+ *          `stages/stepNudge.ts` appends — they own the sentences and take
+ *          the markers from here), and — since 9.84.0 — a rule author reading
+ *          `InjectionContext.history` (`saidByPerson(ctx)`).
  * Emits:   N/A.
  *
  * ## Why this is a leaf and not a private helper
  *
- * This library writes FIVE kinds of `role: 'user'` message that nobody said:
+ * This library writes SEVEN kinds of `role: 'user'` message that nobody said:
  * a compaction frame, a drop notice, a schema-check correction, an
- * evidence-check correction, and a message an Injection delivered. The window
- * layer knew two of them and the marker; the evidence layer knew the other two
+ * evidence-check correction, a budget wrap-up instruction, a stepped-skill
+ * nudge, and a message an Injection delivered. Six of the seven are read off
+ * the OPENING they carry ({@link LIBRARY_AUTHORED_PREFIXES}); the delivered
+ * one carries an `injectedBy` marker instead. The window layer knew two of the
+ * openings and the marker; the evidence layer knew two more
  * (`evidence/frames.ts`); neither list was reachable from the routing layer at
  * all — the skill-graph fence forbids it from importing the agent loop, and
  * rightly. So a predicate reading `history` could filter some of the classes
@@ -32,12 +36,27 @@
  * wrote. That is a fixable bug in one place only: the rule has to be one
  * implementation both sides import, not two that agree until they do not.
  *
- * The markers move here with it, as a LIST rather than four constants in four
- * files. A prefix is what the recognizer matches AND what the writer emits;
- * separating those is how a prefix silently stops being recognized, and a
- * sixth authored frame that lands anywhere else is a hole nobody will see
- * until a rule fires on it. Adding one means adding it to
- * {@link LIBRARY_AUTHORED_PREFIXES}, and every reader is fixed at once.
+ * The two frames added in 9.86.0 are the same bug found again, and found by
+ * counting rather than by reading: 9.84.0 registered four openings and wrote
+ * "five classes" in prose, while the tree already had SEVEN producers of a
+ * user-role message that reach `scope.history`. The budget wrap-up
+ * (`stages/wrapUp.ts`) carried an unprefixed sentence containing "Do not
+ * request tools", and the stepped-skill nudge (`stages/stepNudge.ts`) carries
+ * a skill id and every unrun step's TOOL NAME — so both were credited to a
+ * person, a `saidByPerson(ctx).some(m => m.content.includes(…))` rule matched
+ * on them, and the window could anchor its refusal on the wrap-up frame.
+ *
+ * The markers live here, as a LIST rather than one constant per writing file.
+ * A prefix is what the recognizer matches AND what the writer emits;
+ * separating those is how a prefix silently stops being recognized, and an
+ * authored frame that lands anywhere else is a hole nobody will see until a
+ * rule fires on it. Adding one means adding it to
+ * {@link LIBRARY_AUTHORED_PREFIXES}, and every reader is fixed at once —
+ * which is why the count is no longer asserted in prose alone:
+ * `test/lib/injection-engine/userTurnProducers.test.ts` WALKS the tree for
+ * every `role: 'user'` construction site and fails, with the file and line, on
+ * one that is neither registered here, nor a person's own turn, nor
+ * wire-only.
  */
 /**
  * The fields authorship is decided from — structural, so both
@@ -65,6 +84,14 @@ export declare const SCHEMA_CHECK_FRAME_PREFIX = "[schema check";
 /** Opening of the authored frame the evidence gate writes. Stable — tests,
  *  docs and readers match on it. Written by `buildEvidenceCorrection`. */
 export declare const EVIDENCE_CHECK_FRAME_PREFIX = "[evidence check";
+/** Opening of the authored instruction the out-of-budget WRAP-UP call carries.
+ *  Stable — tests and readers match on it. Written by `wrapUpStage`
+ *  (`WRAP_UP_INSTRUCTION`). */
+export declare const WRAP_UP_FRAME_PREFIX = "[budget exhausted";
+/** Opening of the authored frame the stepped-skill NUDGE carries. Stable —
+ *  tests and readers match on it. Written by `nudgeTeachingMessage`, appended
+ *  by `buildStepNudgeStage`. */
+export declare const STEP_NUDGE_FRAME_PREFIX = "[steps unrun";
 /**
  * Every opening this library puts on a `role: 'user'` message it wrote itself.
  *
@@ -76,7 +103,13 @@ export declare const EVIDENCE_CHECK_FRAME_PREFIX = "[evidence check";
  *
  * The two correction frames both QUOTE untrusted text after their label (a
  * validator's error, the model's own flagged values), which is exactly why
- * they are matched by PREFIX and never by anything further in.
+ * they are matched by PREFIX and never by anything further in. The nudge is
+ * the same shape for a different reason: its body is a list of a skill's own
+ * step notes and tool names, which is exactly the text a rule watches for.
+ *
+ * The list is frozen because it is a registry, not a scratch array: a consumer
+ * holds the same object this library's own readers hold, and a `push` into it
+ * would change what every reader calls a person's message.
  */
 export declare const LIBRARY_AUTHORED_PREFIXES: readonly string[];
 /** True when this user-role message opens with a frame this library authored. */

package/dist/esm/lib/saidByPerson.js

@@ -6,20 +6,24 @@
  *          imports, no state, no clock.
  * Role:    Leaf. Several layers ask the same question and must not answer it
  *          differently: the window's refusal engine (`currentRequest.ts`,
- *          which will not let a strategy drop the request), the four authors
+ *          which will not let a strategy drop the request), the six authors
  *          of library-written user turns (`window/notice.ts`,
- *          `window/summarize.ts`, `outputEnforcement.ts`, `evidence/gate.ts`
- *          — they own the sentences and take the markers from here), and —
- *          since 9.84.0 — a rule author reading `InjectionContext.history`
- *          (`saidByPerson(ctx)`).
+ *          `window/summarize.ts`, `outputEnforcement.ts`, `evidence/gate.ts`,
+ *          `stages/wrapUp.ts`, and `skillSteps.ts` for the nudge
+ *          `stages/stepNudge.ts` appends — they own the sentences and take
+ *          the markers from here), and — since 9.84.0 — a rule author reading
+ *          `InjectionContext.history` (`saidByPerson(ctx)`).
  * Emits:   N/A.
  *
  * ## Why this is a leaf and not a private helper
  *
- * This library writes FIVE kinds of `role: 'user'` message that nobody said:
+ * This library writes SEVEN kinds of `role: 'user'` message that nobody said:
  * a compaction frame, a drop notice, a schema-check correction, an
- * evidence-check correction, and a message an Injection delivered. The window
- * layer knew two of them and the marker; the evidence layer knew the other two
+ * evidence-check correction, a budget wrap-up instruction, a stepped-skill
+ * nudge, and a message an Injection delivered. Six of the seven are read off
+ * the OPENING they carry ({@link LIBRARY_AUTHORED_PREFIXES}); the delivered
+ * one carries an `injectedBy` marker instead. The window layer knew two of the
+ * openings and the marker; the evidence layer knew two more
  * (`evidence/frames.ts`); neither list was reachable from the routing layer at
  * all — the skill-graph fence forbids it from importing the agent loop, and
  * rightly. So a predicate reading `history` could filter some of the classes
@@ -32,12 +36,27 @@
  * wrote. That is a fixable bug in one place only: the rule has to be one
  * implementation both sides import, not two that agree until they do not.
  *
- * The markers move here with it, as a LIST rather than four constants in four
- * files. A prefix is what the recognizer matches AND what the writer emits;
- * separating those is how a prefix silently stops being recognized, and a
- * sixth authored frame that lands anywhere else is a hole nobody will see
- * until a rule fires on it. Adding one means adding it to
- * {@link LIBRARY_AUTHORED_PREFIXES}, and every reader is fixed at once.
+ * The two frames added in 9.86.0 are the same bug found again, and found by
+ * counting rather than by reading: 9.84.0 registered four openings and wrote
+ * "five classes" in prose, while the tree already had SEVEN producers of a
+ * user-role message that reach `scope.history`. The budget wrap-up
+ * (`stages/wrapUp.ts`) carried an unprefixed sentence containing "Do not
+ * request tools", and the stepped-skill nudge (`stages/stepNudge.ts`) carries
+ * a skill id and every unrun step's TOOL NAME — so both were credited to a
+ * person, a `saidByPerson(ctx).some(m => m.content.includes(…))` rule matched
+ * on them, and the window could anchor its refusal on the wrap-up frame.
+ *
+ * The markers live here, as a LIST rather than one constant per writing file.
+ * A prefix is what the recognizer matches AND what the writer emits;
+ * separating those is how a prefix silently stops being recognized, and an
+ * authored frame that lands anywhere else is a hole nobody will see until a
+ * rule fires on it. Adding one means adding it to
+ * {@link LIBRARY_AUTHORED_PREFIXES}, and every reader is fixed at once —
+ * which is why the count is no longer asserted in prose alone:
+ * `test/lib/injection-engine/userTurnProducers.test.ts` WALKS the tree for
+ * every `role: 'user'` construction site and fails, with the file and line, on
+ * one that is neither registered here, nor a person's own turn, nor
+ * wire-only.
  */
 /** Opening of the authored notice a DROP leaves behind. Stable — tests and
  *  readers match on it. Written by `buildDropNotice`. */
@@ -51,6 +70,14 @@ export const SCHEMA_CHECK_FRAME_PREFIX = '[schema check';
 /** Opening of the authored frame the evidence gate writes. Stable — tests,
  *  docs and readers match on it. Written by `buildEvidenceCorrection`. */
 export const EVIDENCE_CHECK_FRAME_PREFIX = '[evidence check';
+/** Opening of the authored instruction the out-of-budget WRAP-UP call carries.
+ *  Stable — tests and readers match on it. Written by `wrapUpStage`
+ *  (`WRAP_UP_INSTRUCTION`). */
+export const WRAP_UP_FRAME_PREFIX = '[budget exhausted';
+/** Opening of the authored frame the stepped-skill NUDGE carries. Stable —
+ *  tests and readers match on it. Written by `nudgeTeachingMessage`, appended
+ *  by `buildStepNudgeStage`. */
+export const STEP_NUDGE_FRAME_PREFIX = '[steps unrun';
 /**
  * Every opening this library puts on a `role: 'user'` message it wrote itself.
  *
@@ -62,14 +89,22 @@ export const EVIDENCE_CHECK_FRAME_PREFIX = '[evidence check';
  *
  * The two correction frames both QUOTE untrusted text after their label (a
  * validator's error, the model's own flagged values), which is exactly why
- * they are matched by PREFIX and never by anything further in.
+ * they are matched by PREFIX and never by anything further in. The nudge is
+ * the same shape for a different reason: its body is a list of a skill's own
+ * step notes and tool names, which is exactly the text a rule watches for.
+ *
+ * The list is frozen because it is a registry, not a scratch array: a consumer
+ * holds the same object this library's own readers hold, and a `push` into it
+ * would change what every reader calls a person's message.
  */
-export const LIBRARY_AUTHORED_PREFIXES = [
+export const LIBRARY_AUTHORED_PREFIXES = Object.freeze([
     DROP_NOTICE_PREFIX,
     COMPACTED_FRAME_PREFIX,
     SCHEMA_CHECK_FRAME_PREFIX,
     EVIDENCE_CHECK_FRAME_PREFIX,
-];
+    WRAP_UP_FRAME_PREFIX,
+    STEP_NUDGE_FRAME_PREFIX,
+]);
 /** True when this user-role message opens with a frame this library authored. */
 export function isLibraryAuthoredFrame(msg) {
     return (msg !== undefined &&

package/dist/esm/lib/saidByPerson.js.map

@@ -1 +1 @@
-{"version":3,"file":"saidByPerson.js","sourceRoot":"","sources":["../../../src/lib/saidByPerson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAiBH;yDACyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAErD;6DAC6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;uEACuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,kBAAkB;IAClB,sBAAsB;IACtB,yBAAyB;IACzB,2BAA2B;CAC5B,CAAC;AAEF,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,GAAgC;IACrE,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,IAAI,KAAK,MAAM;QACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAgC;IAC3D,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,GAAgC;IACjE,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAgC;IAC7D,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,IAAI,KAAK,MAAM;QACnB,GAAG,CAAC,UAAU,KAAK,SAAS;QAC5B,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"saidByPerson.js","sourceRoot":"","sources":["../../../src/lib/saidByPerson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAiBH;yDACyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAErD;6DAC6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;uEACuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAEzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,2BAA2B,GAAG,iBAAiB,CAAC;AAE7D;;+BAE+B;AAC/B,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAExD;;gCAEgC;AAChC,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACxE,kBAAkB;IAClB,sBAAsB;IACtB,yBAAyB;IACzB,2BAA2B;IAC3B,oBAAoB;IACpB,uBAAuB;CACxB,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,GAAgC;IACrE,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,IAAI,KAAK,MAAM;QACnB,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAgC;IAC3D,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAChG,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,GAAgC;IACjE,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,GAAgC;IAC7D,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,IAAI,KAAK,MAAM;QACnB,GAAG,CAAC,UAAU,KAAK,SAAS;QAC5B,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAC7B,CAAC;AACJ,CAAC"}

package/dist/esm/lib/spokenIds.d.ts

@@ -0,0 +1,52 @@
+/**
+ * A set a model-facing sentence is allowed to NAME, after the role filter has
+ * run over it (9.86.0) — and the one fact a filtered list cannot be written
+ * without.
+ *
+ * ── OMIT, NEVER DENY ────────────────────────────────────────────────────
+ *
+ * A narrowing may take a name off a sentence. It may not turn that name's
+ * absence into a claim that the thing is gone: the graph, the dispatch map and
+ * the menu are all still holding it, and a model told "no skill was reachable"
+ * stops asking for the one it may not be told about. Omission costs nothing and
+ * is always true; the negative sentence is a denial of what the run holds.
+ *
+ * Every composer took plain arrays and branched on `length > 0`, so "the set
+ * was empty" and "the filter emptied it" produced the SAME sentence — one
+ * shape, two facts, in three separate places. `held` is that missing fact, and
+ * it is REQUIRED rather than optional on purpose: the compiler now asks every
+ * caller the question the call sites each forgot to answer.
+ *
+ * ── WHY THIS IS A LEAF AND NOT A HELPER IN THE GATE ─────────────────────
+ *
+ * It lived in `core/agent/stages/toolCalls.ts`, which put it on the wrong side
+ * of the skill-graph fence: `read_skill`'s DESCRIPTION is composed inside
+ * `src/lib/injection-engine/`, which may not import the agent loop, so the one
+ * surface the model reads to CHOOSE a skill could not use the fact its own
+ * refusals were being repaired with — and it went on printing "Nothing is
+ * reachable from here" over a graph whose only hop the role filter had removed.
+ * The same reason `src/lib/saidByPerson.ts` is a leaf: the writer and the
+ * recogniser share one rule, so they cannot drift.
+ *
+ * @example
+ * ```ts
+ * const hidden = new Set(['beta']);
+ * const hops = spoken(['beta'], (id) => !hidden.has(id));
+ * // → { named: [], held: true } — the clause is DROPPED, not negated.
+ * ```
+ */
+export interface SpokenIds {
+    /** The members this sentence may name — what survived the filter. */
+    readonly named: readonly string[];
+    /** Did the UNFILTERED set hold anything? `true` with an empty `named` is the
+     *  filtered-to-empty case: the clause is omitted rather than negated. */
+    readonly held: boolean;
+}
+/**
+ * Apply the role filter to one set and keep both halves (9.86.0).
+ *
+ * `mayName` is the caller's visibility predicate — skill ids test membership of
+ * `scope.hiddenSkillIds`, tool names test whether every skill declaring them is
+ * hidden. Both questions have one answer shape, and this is it.
+ */
+export declare function spoken(all: readonly string[], mayName: (id: string) => boolean): SpokenIds;

package/dist/esm/lib/spokenIds.js

@@ -0,0 +1,11 @@
+/**
+ * Apply the role filter to one set and keep both halves (9.86.0).
+ *
+ * `mayName` is the caller's visibility predicate — skill ids test membership of
+ * `scope.hiddenSkillIds`, tool names test whether every skill declaring them is
+ * hidden. Both questions have one answer shape, and this is it.
+ */
+export function spoken(all, mayName) {
+    return { named: all.filter(mayName), held: all.length > 0 };
+}
+//# sourceMappingURL=spokenIds.js.map

package/dist/esm/lib/spokenIds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spokenIds.js","sourceRoot":"","sources":["../../../src/lib/spokenIds.ts"],"names":[],"mappings":"AA6CA;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,GAAsB,EAAE,OAAgC;IAC7E,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/esm/lib/trace-toolpack/traceToolpack.js

@@ -1714,12 +1714,13 @@ function buildInspectToolCall(artifacts, reader) {
             const lines = [`TOOL CALL ${toolCallId} — ${facts.toolName ?? '(unnamed tool)'}`];
             lines.push(facts.runtimeStageId !== undefined
                 ? `step: ${facts.runtimeStageId} — drill with trace_node('${facts.runtimeStageId}')`
-                : `step: ⚠ not resolvable — no event tail, and no committed step carries this call's ` +
-                    `result (the turn may have ended before it landed).`);
+                : `step: ⚠ not resolvable — no event tail, and no committed step carries the result ` +
+                    `of call '${toolCallId}' (the turn may have ended before it landed).`);
             lines.push(facts.proposedArgs !== undefined
                 ? `proposed by the model: ${displayText(renderPreview(boundedPreview(facts.proposedArgs, TOOL_RESULT_PREVIEW_CHARS)))}`
-                : `proposed by the model: ⚠ not recorded — the assistant turn carrying this call is ` +
-                    `not in the committed history (a window strategy may have folded it away).`);
+                : `proposed by the model: ⚠ not recorded — the assistant turn carrying call ` +
+                    `'${toolCallId}' is not in the committed history (a window strategy may have ` +
+                    `folded it away).`);
             // Ran-with args: the ledger is the ONLY record of a rule rewriting
             // them. No ledger row means no rule changed anything — say that
             // plainly rather than leaving the reader to assume it.
@@ -1736,12 +1737,14 @@ function buildInspectToolCall(artifacts, reader) {
                 lines.push('ran with: the proposed arguments, unchanged (rules looked and allowed them).');
             }
             else {
-                lines.push('ran with: the proposed arguments — no governance rule filed a row for this call.');
+                lines.push(`ran with: the proposed arguments — no governance rule filed a row for call ` +
+                    `'${toolCallId}'.`);
             }
             lines.push(facts.result !== undefined
                 ? `result: ${displayText(renderPreview(boundedPreview(facts.result, TOOL_RESULT_PREVIEW_CHARS), `get_value('${facts.runtimeStageId ?? '<step>'}', 'history') for the full turn`))}`
-                : `result: ⚠ no result recorded for this call in the committed history — it may have ` +
-                    `been denied before it ran, or the turn ended (paused/failed) before it landed.`);
+                : `result: ⚠ no result recorded for call '${toolCallId}' in the committed history — ` +
+                    `it may have been denied before it ran, or the turn ended (paused/failed) before ` +
+                    `it landed.`);
             // Outcome + duration: the event tail is the only clock a run has.
             const denial = rows.find((row) => row.outcome === 'deny');
             const end = eventsOf('agentfootprint.stream.tool_end').find((event) => event.payload.toolCallId === toolCallId);
@@ -1755,7 +1758,7 @@ function buildInspectToolCall(artifacts, reader) {
                 outcome = 'error — the tool threw or returned a failure';
             }
             else if (checkIn && end === undefined) {
-                outcome = 'paused — a check-in asked a human and this call has no recorded end';
+                outcome = `paused — a check-in asked a human and call '${toolCallId}' has no recorded end`;
             }
             else if (facts.result !== undefined) {
                 outcome = 'ok';
@@ -1765,8 +1768,12 @@ function buildInspectToolCall(artifacts, reader) {
             }
             lines.push(`outcome: ${outcome}`);
             if (invalid) {
-                lines.push(`⚠ the arguments failed schema validation on this call — see the validation event / ` +
-                    `the tool result, which carries the correction the model was given.`);
+                // Anchored to the call by ID, not by "this call" (9.86.0): the line
+                // lands in a tool result, and a model re-reading it three calls later
+                // resolves "this call" to whichever call it is answering then.
+                lines.push(`⚠ the arguments failed schema validation on call '${toolCallId}' — see the ` +
+                    `validation event / the tool result, which carries the correction the model was ` +
+                    `given.`);
             }
             if (artifacts.events === undefined) {
                 lines.push(`duration: ⚠ unavailable — these artifacts carry no event tail. The commit log records ` +
@@ -1776,8 +1783,8 @@ function buildInspectToolCall(artifacts, reader) {
                 lines.push(`duration: ${end.payload.durationMs}ms`);
             }
             else {
-                lines.push(`duration: ⚠ no tool_end event for this call in the retained tail (it may have been ` +
-                    `dropped by the tail cap, or the call never finished).`);
+                lines.push(`duration: ⚠ no tool_end event for call '${toolCallId}' in the retained tail (it may ` +
+                    `have been dropped by the tail cap, or the call never finished).`);
             }
             // THE DESCENT RUNG. The boundary marker below is honest for a tool
             // that called someone else's system, and needlessly honest for one
@@ -1934,7 +1941,7 @@ function buildInspectToolRun(artifacts, reader, options) {
                 `INSIDE TOOL CALL ${toolCallId} — '${record.toolName}' ran a recorded flowchart ` +
                     `(${record.steps} committed step(s), ${record.outcome}).`,
                 body,
-                `next inside this call: inspect_tool_run({ toolCallId: '${toolCallId}', ` +
+                `next inside call '${toolCallId}': inspect_tool_run({ toolCallId: '${toolCallId}', ` +
                     `runtimeStageId: '<inner id>' }) opens a step · add 'key' for a value in full · ` +
                     `'variable' asks why an inner value is what it is · 'find' searches this inner run.`,
                 `⚠ the ids above are INNER ids — they name steps of ${record.toolName}'s own chart, not ` +
@@ -1964,15 +1971,18 @@ function unknownInnerRunMessage(toolCallId, lookup, reader) {
     const outer = reader.knownCalls().find((call) => call.id === toolCallId);
     if (outer === undefined) {
         lines.push(`⚠ the outer run does not record a call with that id either — check ` +
-            `inspect_tool_call('${toolCallId}') first; it names every id this run made.`);
+            `inspect_tool_call('${toolCallId}') first; it names every id the outer run recorded.`);
     }
     else {
         lines.push(`That call ran '${outer.name}', which either does not keep records (only ` +
             `flowchartAsTool({ keepRecord: true }) does) or had this one dropped.`);
     }
     if (kept.length === 0) {
-        lines.push(`No inner runs are held right now. A tool that keeps records has simply not been called ` +
-            `yet in the turn this trace covers.`);
+        // Past tense, anchored to the lookup that was answered (9.86.0). "Right
+        // now" pointed at the moment of READING, and this string is a tool result
+        // the model re-reads on every later call of the debugging turn.
+        lines.push(`No inner run was held when inspect_tool_run('${toolCallId}') was answered. A tool that ` +
+            `keeps records had not been called in the turn this trace covers.`);
     }
     else {
         const sample = kept
@@ -1984,9 +1994,13 @@ function unknownInnerRunMessage(toolCallId, lookup, reader) {
             '.');
     }
     if (lookup.dropped > 0) {
-        lines.push(`⚠ ${lookup.dropped} older record(s) were dropped to stay under the retention cap of ` +
-            `${lookup.limit} — this call may be one of them. Raise it with keepRecordLimit, or ask ` +
-            `sooner after the call.`);
+        lines.push(
+        // Named by id, not "this call" (9.86.1): the same repair the
+        // schema-validation line above got in 9.86.0, on the arm the checker
+        // could not see because its rule only knew `on this call`.
+        `⚠ ${lookup.dropped} older record(s) were dropped to stay under the retention cap of ` +
+            `${lookup.limit} — call '${toolCallId}' may be one of them. Raise it with ` +
+            `keepRecordLimit, or ask sooner after the call.`);
     }
     return lines.join('\n');
 }