agentfootprint 9.95.0 → 9.97.0

package/CHANGELOG.md

@@ -5,6 +5,52 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [9.97.0] - 2026-09-13
+
+### Added
+
+- `requestInput()` pauses a collection tool with typed missing fields and a
+  runtime-stamped `awaiting_input` state. Partial replies retain accepted values
+  without model calls; complete replies resume the same tool boundary and skill
+  position through normal result validation, redaction and placement.
+- Hosted typed replies and explicit cancellation preserve session ownership and
+  conversation history. `session-pending` reloads the pending question without
+  exposing the execution checkpoint. Application defaults remain app-owned.
+
+### Fixed
+
+- Hosted cancellation releases the paused session's run resources without
+  executing remaining tools. Run terminals preserve other paused sessions, and
+  teardown events retain the actual registration's run and session identity.
+- Keep documentation within existing browser and export budgets: load only the
+  syntax grammars used by interactive code blocks and prepare SkillGraph demo
+  data on the server while retaining its interactive browser view.
+
+## [9.96.1] - 2026-09-13
+
+### Fixed
+
+- Restore publication within the existing documentation site budget: keep image
+  originals outside the static export and prune duplicate internal error pages
+  only when both public 404 copies match. Public documentation remains available.
+- Includes the evidence recovery option and request-only correction behavior from
+  9.96.0, whose npm publication was blocked by that site budget.
+
+## [9.96.0] - 2026-09-13
+
+### Added
+
+- Optional `recoveryInstruction` on `.namesAndNumbersFromEvidence()` supplies
+  bounded text or a synchronous callback for the existing evidence repair.
+  Applications can ask for missing context without suggesting invented values.
+
+### Changed
+
+- Evidence repair is delivered as request-only system context, with the rejected
+  draft quoted as untrusted data, instead of synthetic conversation turns.
+  Token checks, postures and the one-revision limit remain unchanged. This is
+  lexical checking, not proof of question interpretation or claim semantics.
+
 ## [9.95.0] - 2026-09-12
 
 ### Added

package/CLAUDE.md

@@ -17,6 +17,7 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 
 | If you are about to build… | It is | Where | Since |
 |---|---|---|---|
+| guiding an evidence repair to ask for missing context without inventing values | `recoveryInstruction` + `EvidenceRecoveryContext` | `src/core/agent/evidence/` | 9.96.0 |
 | checking a typed final answer against scoped evidence before streaming or memory delivery — optional host-authored checks with enforce/observe modes, canonical JSON and bounded read-only artifacts | `answerValidation` + `AnswerValidationError` | `src/answer-validation/` | 9.95.0 |
 | turning a written operational procedure (a runbook, a triage playbook) into ONE agent tool whose every answer is EVIDENCE — coverage folded up from the inner tools it calls, rule name+version, verdict rows with GENERATED meanings, and the recorded walk as an artifact ticket, never bytes | `runbookAsTool` — dials: `procedure` (factory, invoked per call with `ctx.tools`) + `resultKind` (`'verdict/*'` arms the rowset projection; anything else ships spine + the chart's `report`) + `rules {name, version}` (default absent ⇒ `rule_version: 'undeclared'`) + `verdicts {decider, maxRows}` (default 50; `verdict_meanings` = statically declared branches + this run's rule labels + the DEFAULT branch's label, which reaches evidence only when the chart calls `decide(s, rules, {branch, label})` — fp ≥9.16.1, the default is chosen by NO rule so nothing else can name it, and inside a generated fan-out branch the static walk is blind too; an undeclared or blank label stays ABSENT from the map, never invented from a branch id, and there is deliberately NO caller-supplied meanings map) + `presentation` (`'prose'` default = ship `table` + `VERDICT_RENDER_NOTE` "output it VERBATIM"; `'panel'` = the HOST renders the rowset, so NO `table` key at all + `PANEL_RENDER_NOTE` "the rows are already on the reader's screen — do not reproduce them"; the rowset half is byte-identical across modes, `table` stays RESERVED in both, an unknown value THROWS at definition) + `walk {cap, recording}` (cap default 500; over-cap ⇒ control-flow projection, declared · `recording: true` or `{label, maxBytes}`, default OFF — ALSO files the inner chart's own `{snapshot, events, structure}` under `recording/run` and puts its ref on the spine as `walk.recording_ref`, because the ROW projection cannot be drawn; snapshot read from the REDACTED mirror so one `redact` means the same for both; over `maxBytes` (`DEFAULT_RECORDING_MAX_BYTES` = 5,000,000) it is REFUSED not truncated; every absence — no store / over size / unserializable / store threw — is STATED in `walk.recording_note`, and the four `recording_*` fields are absent entirely when the dial is off) + `composedOf` (drift-checked at agent BUILD) + kept `recorders`/`keepRecord`/`keepRecordLimit`/`redact`; reserved state keys `verdicts`/`coverage`/`report` (the `report` bag lands BESIDE the spine, never over it — a report field spelling `af_coverage`/`af_provenance`/`rule_version`/`walk`/`report_note` or a live projection key is discarded and NAMED in `result.report_note`; precedence is explicit in `report.ts`, never spread order); inner `absent()` passes through VERBATIM unless the call said `allowAbsent`; walk kind `recording/chart-walk` + `walk_segment` discriminant | `src/core/runbook/` | 9.76.0, recording 9.79.0 |
 | speaking MCP from a BROWSER — the SDK is browser-clean (its client + streamableHttp bundle at `platform:'browser'` with zero `node:` edges and never pull in `client/stdio.js`); the one barrier was that `lazyRequire` gets CALLED there, so the fix is to let the caller supply what the loader would have found | `mcpClient({ sdk })` (`McpSdk` = the two SDK modules you imported statically; the library STILL builds the transport, so headers/fetch/gateway vending/`retryOnThrottle`/`_meta` all keep working) · `mcpClient({ connection })` (`McpConnection` = listTools/callTool/close, deliberately NO `connect` — you already did; the only arm that reaches the SDK's `jsonSchemaValidator`, i.e. CSP) + `McpConnectionOptions`; `refuseConflictingOptions` REFUSES at construction every option a transport would have consumed, naming where it moved (a knob naming a behaviour that no longer happens is the defect class); `transportUrl` resolves a relative `url` against `globalThis.location.href` (absolute takes the identical branch, Node refuses by name); `sdkLoadFailure` classifies the seven load sites so a browser is never told to install a package it has (resolution failure ⇒ byte-identical historical message); `retryingFetch` + `ThrottleFetch` promoted out of `@internal` so the connection arm keeps its 429 handling. stdio keeps `lazyRequire` FOREVER — it spawns a subprocess. ZERO packaging change: no subpath, no `browser` condition (TypeScript is blind to it), peer stays optional (no literal dynamic `import()`). Fenced by `test/lib/mcp/browserGraph.test.ts` | `src/lib/mcp/` | 9.81.0 |
@@ -144,7 +145,7 @@ Traps: `src/observability/` holds the finder IMPLEMENTATIONS (canonical home; `d
 - **Recordings as artifacts (9.26.0)**: `artifacts: { store, recordings: true | { label } }`. `Agent.startRunRecording()` calls the SAME `recordRun` (before `createExecutor` — `attach()` collects for the executor not yet built); `fileRunRecording` mints AFTER `finalizeResult`, awaited, every failure contained to `artifacts.refused`. Pure half in artifacts/recordingArtifact.ts; payload is the recording's JSON TEXT (a live snapshot handed to an in-process store would be a live view into a finished run). No new wire op — `artifact-get` serves it.
 - **Code staging-in (9.26.0)**: `CodeSession.stageInputs?(inputs) → StagedCodeInput[]` — OPTIONAL, feature-detected via `canStageCodeInputs`, and its contract is TWO promises: the payloads are readable at the returned paths, AND every later `execute` exposes the manifest as `STAGED_INPUTS_ENV` (`AF_STAGED_INPUTS`, `name → path`). `CodeInput.name` is the MANIFEST KEY (the wants arg name, so a static description can name it) and `fileName` is the on-disk name — separate fields so the two cannot drift. `codeRunnerTool({ wants })` composes the schema properties + the description clause and refuses BY NAME on a non-staging runner. Implemented by localCodeRunner only.
 - **Repeated-call nudge (9.26.0)**: `core/agent/repeatedCall.ts` (pure `noteRepeatedCall` + `repeatedCallLedgers()`) + the ONE batch-loop hook in toolCalls. Fingerprints (FNV-1a) of stable-stringified args and the tool's OWN delivered result — never values. **The counters are NOT tracked state**: they live in a bounded run-keyed map held by `buildToolCallsHandler` and keyed by `deps.currentRun().runId`, so a turn that repeats nothing is byte-identical in state, commit log, narrative and recordings (a scope key would have changed all four for every agent that merely upgraded); the repeat itself rides `agentfootprint.tools.repeated_call`, the emit channel per-attempt facts belong on. A resume mints a new runId ⇒ counting restarts. Fires at the SECOND identical landing, once. `AgentOptions.repeatedCallNudge: false` disables (threaded value-conditionally; ON is the default). Deliberately NOT applied on the pause-resume dispatch paths.
-- **Evidence gate (9.35.0)** — `.namesAndNumbersFromEvidence({ posture, shapes, exempt, minDigits })`: every name/number in the final answer must appear in a `role:'tool'` result. Postures reuse the routing VOCABULARY (`assist`|`guard`|`rails`) as a SEPARATE option — routing authority ≠ evidence discipline, and overloading `skillGraphCascade.strictness` would deny "strict routing, loose evidence". Wiring is the stepNudge blast radius verbatim: `ResolvedEvidenceGate` (builder-resolved, refusals at the CALL SITE) → Agent ctor trailing param → `buildRouteDeciderStage`'s 4th arg (`judgeEvidence` runs LAST of the three judges — schema > steps > evidence — and NOT on a denied or schema-exhausted answer) → `evidenceRecheckStage` branch (`{loopTo}`, mounted only for a revising posture) → `STAGE_IDS.EVIDENCE_RECHECK` + BOUNDARY_LOCAL_IDS + milestoneFor. TWO deps flags, and the second is the one a reader misses: `evidenceRecheckStage` (branch) AND `hasEvidenceGate` (bubbles `systemPromptInjections` out of sf-llm-call in the GROUPED chart — without it the gate flags the app's own prompt). Per-check facts ride `agentfootprint.agent.evidence_checked` (emit channel); only the terminal verdict is committed (`unsupportedValues`), because the boundary raises off it. `UnsupportedValuesError` joins the TERMINAL-typed-error list in `run()`'s catch (a verdict is not a crash — no retry handle for a wall). **Grounded numbers (9.75.0)** rides the SAME dial: `nudge: true` arms the staged-refs nudge — `toolWantsOf` harvests `Tool.wants` beside the `toolGrounding` harvest in `Agent.buildChart` (same ToolProvider blindness), callLLM appends ONE request-only late line when a placed ticket's kind matches a SERVED `wants` tool (judged on `registeredToolSchemas`, so wrap-up's withheld surface arms nothing; history untouched ⇒ never in the exempt corpus), recorded as `agent.grounding_nudged`; and the recheck correction names the same refs+spender via `buildEvidenceCorrection`'s third arg — threaded whenever a `wants` tool exists, NOT gated on `nudge`, clause INSIDE the authored frame so `isLibraryAuthoredTurn`'s prefix match and values-last both hold.
+- **Evidence gate (9.35.0)** — `.namesAndNumbersFromEvidence({ posture, shapes, exempt, minDigits })`: every name/number in the final answer must appear in a `role:'tool'` result. Postures reuse the routing VOCABULARY (`assist`|`guard`|`rails`) as a SEPARATE option — routing authority ≠ evidence discipline, and overloading `skillGraphCascade.strictness` would deny "strict routing, loose evidence". Wiring is the stepNudge blast radius verbatim: `ResolvedEvidenceGate` (builder-resolved, refusals at the CALL SITE) → Agent ctor trailing param → `buildRouteDeciderStage`'s 4th arg (`judgeEvidence` runs LAST of the three judges — schema > steps > evidence — and NOT on a denied or schema-exhausted answer) → `evidenceRecheckStage` branch (`{loopTo}`, mounted only for a revising posture) → `STAGE_IDS.EVIDENCE_RECHECK` + BOUNDARY_LOCAL_IDS + milestoneFor. TWO deps flags, and the second is the one a reader misses: `evidenceRecheckStage` (branch) AND `hasEvidenceGate` (bubbles `systemPromptInjections` out of sf-llm-call in the GROUPED chart — without it the gate flags the app's own prompt). Per-check facts ride `agentfootprint.agent.evidence_checked` (emit channel); only the terminal verdict is committed (`unsupportedValues`), because the boundary raises off it. `UnsupportedValuesError` joins the TERMINAL-typed-error list in `run()`'s catch (a verdict is not a crash — no retry handle for a wall). **Grounded numbers (9.75.0)** rides the SAME dial: `nudge: true` arms the staged-refs nudge — `toolWantsOf` harvests `Tool.wants` beside the `toolGrounding` harvest in `Agent.buildChart` (same ToolProvider blindness), callLLM appends ONE request-only late line when a placed ticket's kind matches a SERVED `wants` tool (judged on `registeredToolSchemas`, so wrap-up's withheld surface arms nothing; history untouched ⇒ never in the exempt corpus), recorded as `agent.grounding_nudged`; and the recheck names the same refs+spender whenever a `wants` tool exists, NOT gated on `nudge`. Since 9.96.0 `evidence/recovery.ts` · `buildEvidenceRecovery` composes request-only system guidance; `evidenceRecoveryPiece` carries it into the next request without synthetic conversation turns. Optional `recoveryInstruction` adds bounded synchronous guidance; `buildEvidenceCorrection` remains a legacy compatibility helper. Token extraction, exemptions and the single-revision budget are unchanged; this is not semantic validation or streaming draft suppression.
 - **Coverage primitives (this release)** — `absent()` / `coverage()`, both copied from FIELD USE. THE argument is the direction of the error: a *nothing-found* misread as an *outage* costs an investigation, an *outage* misread as *nothing-found* declares a system healthy that was never checked — so the two must not share a shape. Blast radius, and it is the `resultCeiling` radius verbatim: `readCoverageResult` called by `declareCoverage` at BOTH execute boundaries in toolCalls.ts (batch loop + `resolveCredentialAndExecute`), on the UNWRAPPED content and BEFORE the ceiling. FOUR downstream changes and no more: (1) `ToolResultStatus` gained a SEVENTH word `'absent'` — routable by `onToolStatus`, because folding it into `'failure'` is the confusion itself and into `'success'` leaves nothing to route on; (2) two events (`tools.absent`, `tools.coverage_declared`); (3) tracked `AgentState.coverageDeclared` — a limit is a fact about the ANSWER, not about an attempt, which is why it is state and the repeated-call counters are not; (4) the evidence corpus indexes an absence's COVERAGE ONLY (`coverage/evidence.ts` — a failed lookup is the cheapest laundering machine, and `absent()` would have made it cheaper: this is frames.ts's argument on the tool side). Deliberately UNCHANGED: no `error: true`, no retry, no refusal, no gate flag. Survival into the answer is `.limitsTravelWithTheAnswer()` → `attachCoverageLimits` dep → BOTH builders swap the final branch's first stage for `prepareFinalWithLimitsStage` (same id, same position). It APPENDS rather than judges: a check for "did the model state its limits?" needs a second model to decide what counts, which is what evidence/README.md forbids.
 - **Out-of-budget wrap-up (9.56.0)** — `wrapUpAtMaxIterations` (AgentOptions, default ON, `repeatedCallNudge`'s opt-out grammar): the FOURTH Route branch, and the SchemaRetry mechanism verbatim — `STAGE_IDS.WRAP_UP` + same `{loopTo}`, so the last call is one ordinary turn with its own `iteration_start`/`llm_start`/`cost.tick`. Two things are its own: (1) the tools are WITHHELD at REQUEST ASSEMBLY in callLLM (`scope.wrapUpAsked`, the `schemaTool` seam's mirror — the schema tool still rides, so an output contract survives), which is what makes the call terminal BY CONSTRUCTION rather than by a rule, and is why it is exempt from `maxIterations`; (2) the CONDITIONAL MOUNT is on the agent having a TOOL SURFACE (`registryByName.size > 0 || externalToolProvider`) — a limit only cuts a turn short when tool calls were pending, so a toolless agent's chart must not grow a box that can never run. `decideBranch` treats a spent wrap-up as cut-short for every downstream judge (`toolCalls.length > 0 || scope.wrapUpAsked`), or a step nudge / evidence revision would loop past the limit that fired. `wrapUpAsked` is deliberately NOT seeded — a turn that finishes inside its budget commits the exact key set it always did. The record is FOUR channels: `stoppedEarly` (now with `wrappedUp`, corrected on the pass after so `answerWasEmpty` describes the answer the caller GOT), `cost.limit_hit` (unchanged), the new `agent.budget_exhausted {action: 'wrapped-up'|'cut-short'}`, and an optional `turn_end.stoppedEarly` projection.
 - **Closed seams**: Agent chart internals (AgentChartDeps not exported — extend via injections/tools/memory/thinking, never by adding a ReAct stage); ContextSlot (3 slots fixed); ProviderKind factory; dormant ports with no consumer (ContextSourceAdapter, EmbeddingProvider, RiskDetector — adapters/types.ts only); reserved tool names under selfExplain — 8.16.0 made the list DERIVED: `TRACE_TOOL_NAMES` (traceToolpack.ts, 11 names since 9.61.0: run_overview/find_context_errors/find_in_trace/trace_node/trace_slice/backtrack/who_wrote/get_value/inspect_tool_call/inspect_tool_run/read_narrative) is what AgentBuilder.ts:~1560 reserves in inline mode (`explain_run` in delegate mode), so a NEW toolpack tool joins ONE list and the reservation follows — but it must ALSO join the lazy template's mounted set (lazyToolpack builds over `{narrative: [], events: []}` so the catalog shape is fixed at build time) and the count assertion in test/lib/trace-toolpack/selfExplainAgent.test.ts. **8.17.0 `inspect_tool_run`** is the descent THROUGH the tool boundary: `flowchartAsTool({ keepRecord: true })` files each invocation's record in a bounded LRU store (lib/trace-toolpack/innerRunRecords.ts) keyed by the executing `ctx.toolCallId`, riding the `Tool` under the `INNER_RUN_RECORDS` registry symbol; `AgentBuilder.build()` → `collectInnerRuns(registry, injections)` → `SelfExplainSource.getInnerRuns` → `TraceToolpackArtifacts.innerRuns`. The inner views are the pack ITSELF re-run over `openRecording(record.recording)` — do not add a second query implementation. Provider-delivered tools are NOT collected (no build-time list); inner runtimeStageIds are a SEPARATE namespace and only `inspect_tool_run` accepts them. **9.61.0 `find_context_errors`** is the Context Integrity read-out: it reads `agentfootprint.integrity.context_error` + `…disposition` off the artifacts' EVENT TAIL (never re-running a check), joins each finding to the step it was filed at, and mounts UNCONDITIONALLY — a tool that vanished with the tail could not say the evidence channel is ABSENT, which is the one sentence this family forbids collapsing into "no errors found".

package/dist/core/Agent.js

@@ -118,6 +118,7 @@ const routeTurn_js_1 = require("./agent/stages/routeTurn.js");
 const outputFallback_js_1 = require("./outputFallback.js");
 const runCheckpoint_js_1 = require("./runCheckpoint.js");
 const conversation_js_1 = require("./conversation.js");
+const inputRequest_js_1 = require("./inputRequest.js");
 const outputSchema_js_1 = require("./outputSchema.js");
 const runInput_js_1 = require("./runInput.js");
 const outputRetry_js_1 = require("./agent/stages/outputRetry.js");
@@ -419,6 +420,8 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      *  function restores `scope.history` from this instead of starting
      *  fresh. Cleared on first read so subsequent runs start clean. */
     pendingResumeHistory;
+    /** Retried request's repair state; never inherited by a new human turn. */
+    pendingEvidenceRecovery;
     /** Its sibling for the folded spans. A restored conversation that dropped
      *  them would carry summaries nobody could unpack — the evidence would be
      *  destroyed by the act of continuing, which is the one thing retention
@@ -1353,7 +1356,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
                 this.conversationOwner(), 
                 // …and the same graph cursor (SG-C), from the same snapshot reader —
                 // one reader, two carriers, so neither can lose what the other keeps.
-                this.continuityCursorOf(this.getLastSnapshot()?.sharedState));
+                this.continuityCursorOf(this.getLastSnapshot()?.sharedState), this.evidenceRecoveryOf(this.getLastSnapshot()?.sharedState));
                 throw new runCheckpoint_js_1.RunCheckpointError(cause, checkpoint);
             }
             throw cause;
@@ -1375,6 +1378,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             this.pendingResumeHistory = undefined;
             this.pendingResumeFolded = undefined;
             this.pendingResumeSkillCursor = undefined;
+            this.pendingEvidenceRecovery = undefined;
         }
     }
     /**
@@ -1601,6 +1605,38 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         const gate = (0, pause_js_1.pauseDemandsDecision)(checkpoint.pauseData);
         if (gate && !(0, checkin_js_1.isCheckInDecision)(input))
             throw new pause_js_1.DecisionRequiredError(gate, input);
+        // Typed data collection is not consent. Validate before changing any run state.
+        const awaitingInput = gate === undefined ? (0, inputRequest_js_1.readAwaitingInput)(checkpoint.pauseData) : undefined;
+        if (awaitingInput !== undefined) {
+            this.assertNotRunning('Agent.resume');
+            const answered = (0, inputRequest_js_1.applyInputResponse)(awaitingInput, input);
+            if ('cancel' in answered) {
+                throw new TypeError('[input request] Cancel a hosted request through its host, or abandonPause() before starting another run.');
+            }
+            if (answered.missing.length > 0) {
+                const copy = structuredClone(checkpoint);
+                const pauseData = {
+                    ...copy.pauseData,
+                    awaitingInput: answered,
+                };
+                const outcome = {
+                    paused: true,
+                    checkpoint: { ...copy, pauseData },
+                    pauseData,
+                    awaitingInput: answered,
+                };
+                this.recordPendingQuestion(outcome);
+                return outcome;
+            }
+            input = {
+                status: 'input_received',
+                requestId: answered.requestId,
+                values: answered.supplied,
+                origins: answered.origins,
+                origin: answered.origin,
+                ...(answered.context !== undefined && { context: answered.context }),
+            };
+        }
         // And the answer must be about the thing that was asked. Checked HERE, at
         // the same door and before any state moves, because a resume that has begun
         // is a resume that has already used the value.
@@ -1675,7 +1711,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      * Fired for the TURN, not for `currentRunContext.runId` — `resume()` mints a
      * fresh run id, so a pause and its resume are one turn across two runs, and
      * filtering on the id would leave everything a paused turn opened alive
-     * forever. See `ToolSessionTier.fireRun`.
+     * forever. Hosted turns are scoped to their session, preserving other pauses. See `ToolSessionTier.fireRun`.
      *
      * @param outcome what `run()`/`resume()` is about to return, or about to throw.
      */
@@ -1686,7 +1722,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             return;
         if (outcome instanceof Error && outcome.name === 'PauseSignal')
             return;
-        await this.toolSessionTier.fireRun();
+        if (this.currentRunContext.sessionId !== undefined)
+            await this.toolSessionTier.fireSessionRuns(this.currentRunContext.sessionId);
+        else
+            await this.toolSessionTier.fireRun();
     }
     /**
      * The conversation this agent's LAST completed run leaves behind, packed as
@@ -1743,6 +1782,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         const folded = this.foldedSpansOf(state);
         const owner = this.conversationOwner();
         const skillCursor = this.continuityCursorOf(state);
+        const evidenceRecovery = this.evidenceRecoveryOf(state);
         return {
             version: 1,
             runId: this.currentRunContext.runId,
@@ -1761,6 +1801,20 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             // `continuity: 'conversation'`, so every other checkpoint keeps its
             // exact byte shape.
             ...(skillCursor !== undefined && { skillCursor }),
+            ...(evidenceRecovery !== undefined && { evidenceRecovery }),
+        };
+    }
+    /** Both checkpoint doors keep the repair budget separately from conversation text. */
+    evidenceRecoveryOf(state) {
+        if (state?.evidenceRevisionSpent !== true)
+            return undefined;
+        const pending = state.evidenceRecovery;
+        return {
+            revisionSpent: true,
+            ...(pending !== undefined &&
+                state.evidenceRecoveryUsed !== true && {
+                pending: { instruction: pending.instruction },
+            }),
         };
     }
     /**
@@ -1853,6 +1907,12 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         // continuity graph and continued on a `'turn'` one is consumed and
         // ignored, exactly like a `folded` field on an agent that never folds.
         this.pendingResumeSkillCursor = cp.skillCursor;
+        // Same failed request retains its single repair budget. A new user turn
+        // receives neither the rejected draft nor a spent retry allowance.
+        this.pendingEvidenceRecovery =
+            appendMessage === undefined && cp.evidenceRecovery !== undefined
+                ? structuredClone(cp.evidenceRecovery)
+                : undefined;
     }
     /** One turn at a time — see `RunInFlightError`. @internal */
     assertNotRunning(door) {
@@ -1957,6 +2017,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      */
     toolRunFacts() {
         return {
+            runContext: { ...this.currentRunContext },
             runId: this.currentRunContext.runId,
             ...(this.currentRunContext.sessionId !== undefined && {
                 sessionId: this.currentRunContext.sessionId,
@@ -1974,7 +2035,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         if (!this.toolSessionTier) {
             this.toolSessionTier = new toolSessions_js_1.ToolSessionTier({
                 timeoutMs: this.toolTeardownTimeoutMs,
-                report: (report) => this.emitToolSessionReport(report),
+                report: (report, origin) => this.emitToolSessionReport(report, origin),
             });
         }
         return this.toolSessionTier;
@@ -1993,10 +2054,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      * hardcodes `runId: 'consumer-scope'`, and a teardown event stamped that way
      * cannot be joined to the run that OPENED the session — the exact
      * unjoinability 9.4.0 spent a release fixing for credential events. So the
-     * meta comes from `currentRunContext`, with a STATED pseudo-stage, the same
+     * meta comes from the registration-time run context, with a STATED pseudo-stage, the same
      * move as the `'<stageId>#paused'` stamp at the pause boundary.
      */
-    emitToolSessionReport(report) {
+    emitToolSessionReport(report, origin) {
         const type = report.kind === 'closed'
             ? 'agentfootprint.tools.session_closed'
             : 'agentfootprint.tools.session_close_failed';
@@ -2007,7 +2068,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         dispatcher.dispatch({
             type,
             payload,
-            meta: (0, eventMeta_js_1.buildEventMeta)({ runtimeStageId: TOOL_TEARDOWN_STAGE_ID }, this.currentRunContext),
+            meta: (0, eventMeta_js_1.buildEventMeta)({ runtimeStageId: TOOL_TEARDOWN_STAGE_ID }, origin.runContext ?? this.currentRunContext),
         });
     }
     openSkillIds() {
@@ -2975,6 +3036,14 @@ class Agent extends RunnerBase_js_1.RunnerBase {
                 this.pendingResumeHistory = undefined;
                 return h;
             },
+            ...(this.evidenceGate !== undefined &&
+                this.evidenceGate.posture !== 'assist' && {
+                consumePendingEvidenceRecovery: () => {
+                    const recovery = this.pendingEvidenceRecovery;
+                    this.pendingEvidenceRecovery = undefined;
+                    return recovery;
+                },
+            }),
             consumePendingResumeFolded: () => {
                 const f = this.pendingResumeFolded;
                 this.pendingResumeFolded = undefined;
@@ -3306,6 +3375,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         // callLLM extracted to ./agent/stages/callLLM.ts (v2.11.2). Same
         // late-binding pattern as seed for toolSchemas (computed below).
         const callLLM = (0, callLLM_js_1.buildCallLLMStage)({
+            ...(this.evidenceGate !== undefined &&
+                this.evidenceGate.posture !== 'assist' && {
+                hasEvidenceRecovery: true,
+            }),
             ...(this.answerValidationConfig !== undefined && { suppressDraftTokens: true }),
             // The receipt's salt (9.88.0) — read per call, like seed's own accessor.
             getRunId: () => this.currentRunContext?.runId,