agentfootprint 9.91.0 → 9.93.0

package/AGENTS.md

@@ -544,7 +544,7 @@ files `agentfootprint.tools.coverage_declared`; with
 to the final answer, which is how a limit survives a model that would rather not
 mention it.
 
-### Observability — 109 typed events across 24 domains
+### Observability — 111 typed events across 24 domains
 
 ```typescript
 agent.on('agentfootprint.context.injected', (e) =>

package/CHANGELOG.md

@@ -7,6 +7,242 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.93.0] - 2026-09-11
+
+**The receipt says which strategy, and what the window dropped.** Four of the
+seven standing recorded-not-built entries close, one is verified rather than
+rebuilt, and one is assessed and half-built. Every item below is a behaviour
+change to a shipped record — a new receipt key on every minting chart, a gap
+that stops firing on three of them, a field that starts being written — which
+is why this is a minor and not a patch. Nothing that had no name collision, no
+window and no cache strategy records a different byte except the one new key.
+
+### Added
+
+- **`Receipt.cache.strategy: string | null`** — WHICH cache strategy the
+  request went through (its registry `providerName`; `'*'` is the built-in
+  pass-through every agent runs), or `null` where none stood between assembly
+  and the port. WHY: `cache.transform: 'unchanged'` is the honest verdict both
+  when a strategy returned what it was given and when there was no strategy at
+  all, so the served view had no way to know a rewrite was impossible and
+  raised `cache-transform` on every view — including `LLMCall` and the two
+  message-API charts, where a reader was told what a cache strategy may have
+  done beside a call none could touch (entry 8). No fourth `transform` value
+  was added; the fact is its own field, minted by the one owner
+  (`buildReceipt` refuses to mint without it). A receipt from before this
+  release has no key, and a reader treats that as "cannot say", never as
+  `null`.
+  ```ts
+  receiptAt(agent.getSnapshot()!, 1)!.cache.strategy;   // '*'  — an agent on the mock provider
+  receiptAt(llmCall.getSnapshot()!, 1)!.cache.strategy; // null — nothing between assembly and the port
+  ```
+- **`Receipt.omittedForAttention` is written** — by the agent chart's window
+  stage, for every turn it evicts for budget at an iteration's head. WHY: the
+  field was declared in 9.88.0 for "why did the model not know that?" and
+  excused as "no chart in this library supplies it" (entry 9) — a measurement
+  that had looked at the slots, which drop nothing, and not at the window,
+  which does (`context.evicted`, `reason: 'budget'`), and never wrote it. The
+  window hands what left to the call-llm mint on an in-memory handle
+  (`window/evictedTurns.ts`), the seam the compaction meter already crosses —
+  never a scope read, which on every windowless run would be a tracked read of
+  an absent key and a phantom context source per loop. Each hash is the
+  evicted turn's own `messages.entries[].hash`, so a drop on epoch k's receipt
+  pairs with the turn as an earlier receipt served it — the pairing law,
+  driven on a real sliding window. Absent now means nothing was dropped before
+  that call. The field left `UNGAPPED_FIELDS` and is named by
+  `no-receipt-on-chart`, the one gap that can lose it. An agent without a
+  window hands both stages the deps they always had.
+  ```ts
+  const agent = Agent.create({ provider, model }).system('bot').tool(lookup)
+    .window(slidingWindow({ keepRecentTurns: 1 })).build();
+  await agent.run({ message: 'go' });
+  receiptAt(agent.getSnapshot()!, 3)!.omittedForAttention; // { count: 2, hashes: [...] } — the pair that left at this head
+  ```
+
+### Changed
+
+- **`cache-transform` is raised only where a rewrite was possible** — where
+  the receipt names a strategy, or where no receipt can say (a receipt-less
+  view, a pre-9.93.0 receipt, a refused shape). WHY: entry 8 — a sentence
+  about what a strategy may have done was printed where none could run. Only a
+  receipt that SAYS `null` lifts it; absence still raises, so this is not the
+  inference-from-absence the entry refused. Measured: `LLMCall` and both
+  message-API charts with a run id now read `['provider-defaults']`; the
+  receipt-less message-API view still reads
+  `['no-receipt-on-chart', 'cache-transform']`, honestly. The printed sentence
+  is unchanged and every clause of it still holds where it prints.
+  ```ts
+  servedAt(llmCall.getSnapshot()!, 1)!.gaps.map((g) => g.gap); // ['provider-defaults'] (was ['cache-transform', 'provider-defaults'])
+  ```
+- **`cache-transform` names `tools.forced`, `tools.withheld` and
+  `cache.strategy`** — fourteen fields, the whole request the strategy holds
+  (`params` alone stays off, read past it). WHY: entry 7 — both `tools`
+  fields are written from assembly's own decision and never from
+  `preparedRequest`, so a strategy that drops the forced answer tool from
+  `request.tools` leaves a receipt whose `tools.forced` names a tool the port
+  never carried, and the gap did not warn. Driven: an unforcing strategy on a
+  `'tool-forced'` agent — wire has no tool and no forcing, receipt says
+  `tools.forced: 'respond_with_schema'` and `params.toolChoice` absent, the
+  gap names the half that describes the decision. Reading them off the
+  prepared request instead was NOT done: that would describe a different fact
+  under the same name.
+- **The receipt-conformance law checks the cache verdict outright where no
+  strategy ran** — `transform: 'unchanged'`, `transformHash: null`,
+  `markersApplied: []`, and no `cache-transform` excuse; where one ran, the gap
+  must excuse the unrebuildable fields as before.
+- **Byte-identity references regenerated** (`test/core/tools/reference/`),
+  with the whole delta against the 9.92.1 set on record in the test's header:
+  the new `cache.strategy` key on every minting fixture, the gap's longer
+  field list on every agent view, and the gap leaving the three no-strategy
+  views. No message, tool or other key moved on any fixture.
+
+### Verified
+
+- **Recorded-not-built entries 4 and 5 hold under the 9.92.0 law** and are
+  marked built (verified 2026-09-11 against the 9.92.1 `dist`, before any edit
+  of this release). `.selfExplain()`'s `run_overview` against an always-visible
+  skill, a never-activated scoped skill and a stepped skill: dispatch follows
+  the offer on every epoch (the never-activated skill no longer answers the
+  framework's own contract — the framework does), `tools.shadowed` names the
+  wire's party and never `provider(skill-scoped:self-explain)`, and the losing
+  claim is named by `tools.claim_swallowed` on every epoch it lost. The
+  reservation this entry names is deliberately untouched; the measured output
+  is pasted on the entries and pinned as `offer-and-answer.test.ts` §7.
+
+### Assessed
+
+- **Entry 10 ("an assertion can be weaker than its clause") is split, and the
+  mechanical half is built.** Every clause in `gap-sentences.test.ts` declares
+  the fields it is about; a seam hands its assertion a view or receipt with
+  one declared field altered, then removed; a contract requires the assertion
+  to fail under at least one. The first run found one insensitivity and it is
+  fixed. What remains is the quantifier half — a clause about "every field" or
+  "both chart shapes" asserted on fewer runs — which needs per-clause hand
+  work and is named on the entry rather than faked by a mechanism.
+
+## [9.92.1] - 2026-09-11
+
+### Fixed
+
+- **9.92.0 never reached npm; this release is the same code.** Its publish job
+  failed the docs site's deferred-demo gzip ceiling by 0.4 KB (421.0 KB against
+  420.6 KB): the interactive demo bundles the library itself, and 9.92.0's
+  tool-resolution family rides the same main-entry graph as the receipt family
+  did in 9.88.0. The ceiling is re-baselined ~2% over the measurement with the
+  reasoning beside the number, and the docs-truth report regenerated. No
+  library code changes between 9.92.0 and 9.92.1. This is the fourth raise of
+  that ceiling for a family the demo never calls; the dynamic-import fix named
+  in 9.61.0 is the next move rather than a fifth raise.
+
+## [9.92.0] - 2026-09-11
+
+**The offer and the answer are one party.** At every LLM call the model is
+OFFERED a list of tool contracts (the wire; the receipt hashes each one), and
+when it calls a name something ANSWERS. Until this release those two halves
+could come from different parties for one name: the tools slot merges
+`[static, provider, skill, step]` first-occurrence-wins, while dispatch
+consulted the build-time registry first — so a provider's contract on the wire
+was answered by a skill's `execute` (an INACTIVE skill's, even), a provider's
+`skip_step` by the framework's (which then advanced the procedure on a call the
+model made against somebody else's contract), and the report that exists for
+this seam walked `activeInjections` and named the provider on epochs whose wire
+carried the skill's contract. A claimant that lost both the wire and the
+dispatch was simply dead, 22 rows of it in the divergence walk's baseline, with
+nothing on the record. `docs/design/2026-09-the-offer-and-the-answer.md` states
+the law; recorded-not-built entries 1, 2 and 3, the `claim-swallowed` bullet
+under entry 1 and the 9.91.0 tools-slot follow-up are marked built.
+
+**The law:** for every tool name on a call, exactly one party owns the OFFER and
+the same party owns the ANSWER — or the record names the disagreement. Three
+consequences, one example each:
+
+- **Dispatch follows the offer.** `buildToolsSlot.ts` · `mergeWire` is the one
+  pass that produces the wire AND the record of who won each name
+  (`ServedToolParties`, closure-shared like `ProviderToolCache`, never scope
+  state); `toolCalls.ts` · `lookupTool` reads it first. A provider and a
+  never-activated scoped skill both claiming `shared_tool`: the wire carries
+  the provider's contract, the provider's tool answers, and the skill's
+  `execute` answers no call while the provider holds the name — nor after the
+  provider withdraws it, because the skill's contract was never what the
+  model read: that call is REFUSED as a recorded tool result (`toolCalls.ts`
+  · `notServedResult`). A name NOT on this epoch's wire — a held-out step
+  tool, a parked map's tool, a scoped tool named from a restored transcript —
+  still dispatches (the capability law's held-out clause, `epoch-laws.test.ts`
+  1(a)–(e)), but only to the party the model LAST read the name under
+  (`ServedToolParties.lastServed`) or the name's only holder when it was never
+  served; every such dispatch is on the record as the new
+  `agentfootprint.tools.answered_off_wire` (`{ toolName, toolCallId,
+  iteration, answeredBy, answeredById? }`). A pause that re-dispatches on
+  resume (a middleware ask, a check-in, a credential consent) carries the
+  served party on its checkpoint (`pausedToolParty`, pause-path-only), so a
+  resume in a FRESH Agent instance — empty closure, no Compose — cannot fall
+  back to the build-time map's first holder either.
+- **The report's subject is the wire.** `agentfootprint.tools.shadowed` now
+  fires once per contested name per iteration when two contracts COMPETED for
+  the wire, and `schemaFrom`/`dispatchTo` both name the wire's party — they
+  agree by construction. A stepped skill and a provider sharing a name draw
+  `skill 'desk-stepped'` in both halves on every epoch, never `'provider'`.
+  The vocabulary gained `'framework'` (`ToolNameChannel`), so an auto-attach
+  is named as itself.
+- **A dead claim is reported.** New `agentfootprint.tools.claim_swallowed`
+  (`ToolsClaimSwallowedPayload`: `{ toolName, iteration, lostBy, lostById?,
+  wonBy, wonById? }`, names only) fires once per iteration for every party
+  whose claim to a name is held by somebody else — whether its contract
+  competed (an active skill against a provider) or never reached the merge
+  (the same skill while inactive; a provider tool whose name a static
+  `.tool()` owns; the framework's `skip_step` between tenures). Identity is by
+  IMPLEMENTATION: two skills sharing one `Tool` reference (documented-legal)
+  are one claim and draw nothing. Now 111 typed events across 24 domains.
+
+**`skip_step` is a claimant like any other** (`buildToolRegistry.ts` ·
+`toolClaimants`, the registry's new list of every build-time claimant per
+name — a list, not a winner). Its schema still merges last, so it rides the
+wire only when nobody else put the name forward; when a provider serves
+`skip_step`, the provider's tool answers and the step bookkeeping keys on the
+framework's own instance having answered (`toolCalls.ts` ·
+`frameworkSkipStepAnswered`) — the procedure does not advance. The build-time
+refusals (a static `.tool()` or a skill tool named `skip_step`/`present`) stand.
+
+**`buildAgentMessageApiChart` hands the model the declared tool set on every
+turn.** Its tools-slot mount now says `arrayMerge: ArrayMergeMode.Replace`, as
+the agent charts always did; turn 2 no longer serves `['weather','weather']`.
+
+**Byte-identity for every run with no name collision.**
+`test/core/tools/byte-identity.test.ts` drives fifteen collision-free shapes
+(both agent react modes, a skill-graph hop, a stepped skill, a parked map, the
+wrap-up, a tool-forced output, three provider shapes, two skills sharing one
+`Tool` reference, `LLMCall`, both message-API charts) and compares `commitLog`
+and `servedAt(k)` against references under `test/core/tools/reference/`
+generated on the 9.91.0 tree. All fifteen are identical; the
+receipt-conformance suite is unchanged and green on all four chart shapes.
+
+**The divergence walk, re-recorded — and widened.** Every `contract-swap`
+row (12) and every `report-misattributed` row (10) is GONE and ratcheted so
+it cannot reopen quietly; the `claim-swallowed` family is 35 rows, every one
+carrying what `tools.claim_swallowed` said about it. The walk gained the
+cross-epoch × collision cases it never had (walk D: a provider withdrawing a
+name an inactive skill also holds; a fresh-instance resume of a provider's
+call) and a kind for the held-out dispatch the law keeps, `answered-off-wire`
+(4 rows, each carrying the event). The harness moved to
+`test/core/agent/toolDivergenceWalk.harness.ts` so the reproductions in
+`test/core/tools/offer-and-answer.test.ts` — the entries' own, verbatim, each
+red on 9.91.0, plus the review's own shapes — drive the same configurations.
+
+**Consumer-facing changes, stated plainly.** (1) A provider tool that shares a
+name with a skill tool now RUNS where the skill's used to — the contract the
+model read is the one that answers. (2) `tools.shadowed` fires on
+configurations that were silent (a provider against a static `.tool()` or a
+framework auto-attach) and no longer names `'provider'` as `schemaFrom` where
+the wire carried the skill's contract; `dispatchTo` now equals `schemaFrom`.
+(3) Two new events, `tools.claim_swallowed` and `tools.answered_off_wire`.
+(4) A call to a name that left the wire, whose last-served party can no longer
+answer, is refused with a recorded result where it used to be answered by
+whichever party the build-time map held first; the same sentence answers a
+provider-served call resumed in a fresh instance (where it used to read
+`Unknown tool`). (5) Two stale comments in `buildToolsSlot.ts` and
+`buildToolRegistry.ts` corrected in the same diff; `Agent.ts`'s "fresh chart
+per run()" comment corrected — the chart is built once at construction.
+
 ## [9.91.0] - 2026-09-10
 
 **Every chart that serves a model now mints a receipt.** A receipt is the proof

package/CLAUDE.md

@@ -154,7 +154,7 @@ Traps: `src/observability/` holds the finder IMPLEMENTATIONS (canonical home; `d
 - **Embedder fingerprint** (8.9.0) → `Embedder.id` (optional; every shipped embedder sets one, and NONE include dims — the store appends `@<dims>` itself, so an id carrying its own size double-stamps) + `indexDocuments` defaulting `embedderId` to it + `SqliteVectorStore.reconcileFingerprint` (the only comparison site). Rule: dimensions ALWAYS decide, model ids decide only when BOTH sides named themselves — refusing on an absent name would block the majority of callers who never pass `embedderId`.
 - **Retrieval record** (8.8.0) → FOUR stages write one object in sequence: `loadRelevant` (candidates+scores+threshold verdicts) → `pickByBudget` (re-marks admitted→over-budget/over-max-entries) → `formatDefault` (`promptFragment` + `promptPosition`) → the read mount's outputMapper lifts it to root as `retrievalEvidence_<id>`. `memoryRecallInjections` then splits ONE recall into one ActiveInjection PER CHUNK — guarded by a byte-equality check (`fragments.join('\n\n') === systemContent`) that falls back to the single injection rather than change the prompt. `rank` (score order) and `promptPosition` (picker order) are DIFFERENT and both load-bearing: joining fragments in rank order reproduces the right bytes in a sequence the model never saw.
 - **AgentState** → all 8 stages/ files, both builders' mappers, memory-wire STRING-TYPED keys ('runIdentity'/'turnNumber'/… buildAgentChart.ts:177-180 — not refactor-safe), finalizeResult's `reliabilityFail*`/`policyHalt*` reads (rename silently kills the typed errors).
-- **events/** → 109 typed events across 24 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
+- **events/** → 111 typed events across 24 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
 - **Run-configuration manifest (9.41.0)** → `agentfootprint.agent.run_configured`, the JOIN KEY that turns N runs into N labelled ARMS: one event naming the adapters/strategies in play (provider+model, reactMode, each memory's declared strategy/retrieval/embedder, window, graph posture+classifier, evidence posture, artifacts-present). Composed by the PURE `core/agent/runManifest.ts`, dispatched from `Agent.emitRunManifest()` at the END of `createExecutor` — the ONE funnel `run()` AND `resume()` share, both of which mint a fresh runId. Direct `dispatcher.dispatch` with a STATED pseudo-stage (`run-configured#0`), the `emitToolSessionReport` precedent — there is no stage yet, and `minimalMeta()` would make the one joinable-by-design event unjoinable. TWO laws, both tested: NAMES ONLY (a store is reported PRESENT and unnamed rather than identified by a directory/endpoint — `MemoryStore` and `ArtifactStore` declare no id), and ABSENT means "not configured", never a guessed `'default'`. Graph presence is read off `skillGraphNextSkill`, NOT `skillGraphCascade` (a 9.16-style mount sets no cascade and would read as "no graph"). `MemoryDefinition` gained `strategy`/`retrieval`/`embedderId` for it — declared names the compiled pipeline had closed over, the `store`-in-the-open precedent.
 - **adapters/types.ts LLMMessage/LLMRequest** → 62 importers: tool_use round-trip (toolCalls.ts:115-135), wire assembly (callLLM.ts:150-160), providers, cache strategies, security/extractSequence, reliability loop.
 - **Cache** → strategy registration is a MODULE SIDE EFFECT (src/index.ts:15-17); an entry point skipping that import silently falls back to NoOp. Resolved once per Agent at construction (Agent.ts:347).

package/ai-instructions/claude-code/SKILL.md

@@ -252,7 +252,7 @@ const agent = Agent.create({ provider, model })
 agent.on('agentfootprint.context.evaluated', (e) => console.log(e.payload.activeIds));
 ```
 
-**109 typed events across 24 domains.** Two subscription shapes and no third:
+**111 typed events across 24 domains.** Two subscription shapes and no third:
 `'*'` (every event) and `'agentfootprint.<domain>.*'` (one domain). **`'agentfootprint.*'`
 is not a pattern** — TypeScript rejects it, and at runtime it would match nothing.
 

package/dist/core/Agent.js

@@ -50,6 +50,7 @@ const ReliabilityRecorder_js_1 = require("../recorders/core/ReliabilityRecorder.
 const ResilienceRecorder_js_1 = require("../recorders/core/ResilienceRecorder.js");
 const CheckInRecorder_js_1 = require("../recorders/core/CheckInRecorder.js");
 const CompactionMeter_js_1 = require("../recorders/core/CompactionMeter.js");
+const evictedTurns_js_1 = require("./agent/window/evictedTurns.js");
 const durabilityBarrier_js_1 = require("./durabilityBarrier.js");
 const toolSessions_js_1 = require("./toolSessions.js");
 const eventMeta_js_1 = require("../bridge/eventMeta.js");
@@ -264,6 +265,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
     /** The instrument the window stage reads mid-run (adapter-reported usage +
      *  per-message provenance). Only ever created alongside a strategy. */
     compactionMeterHandle;
+    /** The window stage's seam to the receipt (9.93.0): what left the window at
+     *  this iteration's head, read by the call-llm mint in the same iteration.
+     *  Only ever created alongside a strategy, like the meter. */
+    evictedTurnsHandle;
     /** Snapshot read-tracking policy (#18/#14) — forwarded to the internal
      *  executor. Agent default is `'summary'` (cheap markers), NOT
      *  footprintjs's `'full'`. See AgentOptions.readTracking. */
@@ -612,6 +617,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         if (windowStrategy !== undefined) {
             this.windowStrategy = windowStrategy;
             this.compactionMeterHandle = (0, CompactionMeter_js_1.compactionMeter)();
+            this.evictedTurnsHandle = (0, evictedTurns_js_1.createEvictedTurnsHandle)();
         }
         // The two governance chains. Empty arrays (not undefined) so every read
         // site is a plain `.length > 0` test rather than an optional dance.
@@ -2221,6 +2227,9 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         // `conversationId` is deliberately not carried: it is a thread, not a
         // person, and `sessionId` beside it is the fact the transport delivered.
         const actor = runOptions?.identity ?? this.lastRunIdentity;
+        // A fresh run starts with no evictions filed — the previous run's last
+        // visit must not be read as this run's (`window/evictedTurns.ts`).
+        this.evictedTurnsHandle?.clear();
         this.currentRunContext = {
             runStartMs: Date.now(),
             runId: (0, RunnerBase_js_1.makeRunId)(),
@@ -2980,7 +2989,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         // auto-attached `present` tool when a store is attached, 9.22.0) +
         // skill-supplied tools (with autoActivate scoping); validates
         // name uniqueness; produces the dispatch map.
-        const { registryByName, toolSchemas, toolDeclaringSkills } = (0, buildToolRegistry_js_1.buildToolRegistry)(registry, this.injections, {
+        const { registryByName, toolSchemas, toolDeclaringSkills, toolClaimants } = (0, buildToolRegistry_js_1.buildToolRegistry)(registry, this.injections, {
             hasArtifactStore: artifactStore !== undefined,
         });
         // A statically registered tool that declares `wants` on an agent with no
@@ -3137,13 +3146,25 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         const messagesSubflow = (0, buildMessagesSlot_js_1.buildMessagesSlot)({
             ...(budget?.messages !== undefined && { budgetCap: budget.messages }),
         });
-        // Per-run cache shared between buildToolsSlot (writer, each
-        // iteration) and buildToolCallsHandler (reader, same iteration).
-        // Holds the resolved Tool[] from `provider.list(ctx)` so dispatch
-        // doesn't re-invoke `list()` — vital for async network providers.
-        // A fresh chart (and thus fresh cache) is built per `agent.run()`,
-        // so concurrent runs don't share state.
+        // Cache shared between buildToolsSlot (writer, each iteration) and
+        // buildToolCallsHandler (reader, same iteration). Holds the resolved
+        // Tool[] from `provider.list(ctx)` so dispatch doesn't re-invoke `list()`
+        // — vital for async network providers.
+        //
+        // LIFETIME, stated correctly (9.92.0): the chart is built ONCE, at
+        // construction (`initChart`), and reused by every `run()` and `resume()`
+        // of this Agent — so this cache and the record below outlive a run. They
+        // are safe because one Agent runs one turn at a time and the slot
+        // overwrites them every iteration before dispatch reads them. What that
+        // does NOT cover is a resume in a FRESH instance, whose closure is empty
+        // and whose Compose never re-runs before the resumed dispatch — which is
+        // why the pause paths carry `pausedToolParty` on the checkpoint.
         const providerToolCache = { current: [] };
+        // Who put each name on the wire (9.92.0) — the same closure-shared shape,
+        // written by the tools slot's merge and read by dispatch so the party
+        // whose contract the model read is the party that answers. `lastServed`
+        // is the run's memory of the same fact, for a name that left the wire.
+        const servedTools = { current: new Map(), lastServed: new Map() };
         const readSkillFor = this.readSkillOfferFor();
         // Per-role skill visibility. The RESOLVER is handed to the tools slot, which
         // is the fact's one owner: it resolves the ids once per iteration and
@@ -3225,6 +3246,8 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             integrityLedger: this.integrityLedgerHolder,
             ...(this.externalToolProvider && { toolProvider: this.externalToolProvider }),
             ...(this.externalToolProvider && { providerToolCache }),
+            toolClaimants,
+            servedTools,
             ...(readSkillFor && { readSkillFor }),
             ...(hiddenSkillIds && { hiddenSkillIds }),
             ...(budget?.tools !== undefined && { budgetCap: budget.tools }),
@@ -3239,6 +3262,9 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             // …and its off switch. Value-conditional, so an agent on the default
             // hands `callLLM` exactly the dep bag it always did.
             ...(this.recordReceiptValue === false && { recordReceipt: false }),
+            // …and the window's evictions for `omittedForAttention` (9.93.0) — only
+            // an agent with a window strategy has any, and only it hands the seam.
+            ...(this.evictedTurnsHandle !== undefined && { evictedTurns: this.evictedTurnsHandle }),
             provider,
             model,
             ...(temperature !== undefined && { temperature }),
@@ -3313,6 +3339,9 @@ class Agent extends RunnerBase_js_1.RunnerBase {
                 run: (0, window_js_1.buildWindowStage)({
                     strategy: this.windowStrategy,
                     meter: this.compactionMeterHandle,
+                    ...(this.evictedTurnsHandle !== undefined && {
+                        evictedTurns: this.evictedTurnsHandle,
+                    }),
                     agentModel: model,
                     providerName: provider.name,
                     getRunId: () => this.currentRunContext?.runId,
@@ -3397,6 +3426,8 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             }),
             ...(this.externalToolProvider && { externalToolProvider: this.externalToolProvider }),
             ...(this.externalToolProvider && { providerToolCache }),
+            servedTools,
+            toolClaimants,
             ...(permissionChecker && { permissionChecker }),
             ...(credentialProvider && { credentialProvider }),
             // The claim-check store (9.21.0). Absent → not one new line runs in