agl 40.5.1 → 41.0.0

package/dist_ts_interfaces/fleetworkers.d.ts

@@ -304,6 +304,12 @@ export interface IFleetEvent {
     /** The native session (`harness:nativeId`) a ticket notice addressed. */
     sessionId?: string;
     reportId?: string;
+    /**
+     * The comment on `ticketKey` that holds this event's whole text, by the id the ticket board returned: a worker's report
+     * the fleet commented (`worker.report.mid_turn`, `worker.turn.ended`), the board pump's stall notice, a commented
+     * `ticket.changed`. Read it with `ticket_get` and `commentId`. Absent when no comment holds the text.
+     */
+    commentId?: string;
     turnId?: string;
     status?: string;
     text?: string;

package/dist_ts_interfaces/interfaces.d.ts

@@ -1,6 +1,6 @@
 import type { ILiveBrowserDialog, ILiveBrowserDialogResponse, ILiveVideoOffer, ILiveVideoDescription, ILiveVideoStatistics, ILiveVideoAcceleration } from '@push.rocks/smartbrowser/web';
 import type { IControllerBrowserPaintSource, IControllerBrowserPresentationState, TControllerBrowserPaintAvailability, TControllerBrowserPaintTermination } from './browserpaint.js';
-export declare const controllerProtocolVersion: 45;
+export declare const controllerProtocolVersion: 46;
 export declare const controllerUpgradeManagementVersion: 2;
 export declare const controllerPackageName: 'agl';
 /** The systemd user unit `agl service install` writes; a controller it runs reports it in its status. */

package/dist_ts_interfaces/interfaces.js

@@ -1,4 +1,4 @@
-export const controllerProtocolVersion = 45;
+export const controllerProtocolVersion = 46;
 export const controllerUpgradeManagementVersion = 2;
 export const controllerPackageName = 'agl';
 /** The systemd user unit `agl service install` writes; a controller it runs reports it in its status. */

package/dist_ts_interfaces/requests.tickets.d.ts

@@ -1,5 +1,5 @@
 import type * as plugins from './plugins.js';
-import type { ITicket, ITicketActivity, ITicketAnswer, ITicketAsk, ITicketBoard, ITicketChanges, ITicketComment, ITicketCreate, ITicketFilters, ITicketMove, ITicketQuestion, TTicketLink, TTicketOperation, TTicketReferenceContent, TTicketRequest, TTicketResponse } from './tickets.js';
+import type { ITicket, ITicketAnswer, ITicketAsk, ITicketBoard, ITicketChanges, ITicketComment, ITicketCreate, ITicketDetail, ITicketFilters, ITicketGet, ITicketMove, ITicketQuestion, TTicketLink, TTicketOperation, TTicketReferenceContent, TTicketRequest, TTicketResponse } from './tickets.js';
 export declare const controllerMcpTicketMethods: readonly ['agl.mcp.ticket.list', 'agl.mcp.ticket.board', 'agl.mcp.ticket.search', 'agl.mcp.ticket.get', 'agl.mcp.ticket.comments', 'agl.mcp.ticket.create', 'agl.mcp.ticket.update', 'agl.mcp.ticket.move', 'agl.mcp.ticket.comment', 'agl.mcp.ticket.link', 'agl.mcp.ticket.ask', 'agl.mcp.ticket.answer'];
 export type TControllerMcpTicketMethod = (typeof controllerMcpTicketMethods)[number];
 export type TControllerTicketRequest<TMethod extends TTicketOperation> = {
@@ -54,22 +54,18 @@ export interface IReq_ControllerMcpTicketSearch extends plugins.typedrequestInte
     };
 }
 /**
- * Reads a ticket by its `AGL-<n>` key, with its Markdown comments, source, links, questions and
- * their answers, and its complete activity log.
+ * Reads a ticket by its `AGL-<n>` key with its source, links, all its questions and their answers,
+ * and the newest page of its history (up to `limit` entries, default 50, at most 500, within 256 KiB), oldest first: the
+ * activity entries and the Markdown comments they name, a `commented` entry naming its comment by
+ * id. `historyBefore` is present while older history exists; pass it as `before` for the next page.
+ * `commentId` reads that one comment instead (`comments: [it]`, `activity: []`), without `before` or `limit`.
  */
 export interface IReq_ControllerMcpTicketGet extends plugins.typedrequestInterfaces.implementsTR<TControllerMcpTicketRequest<'get'>, IReq_ControllerMcpTicketGet> {
     method: 'agl.mcp.ticket.get';
-    request: {
-        ticketId: string;
-    } & {
+    request: ITicketGet & {
         ownerToken?: string;
     };
-    response: {
-        ticket: ITicket;
-        comments: ITicketComment[];
-        activity: ITicketActivity[];
-        questions: ITicketQuestion[];
-    };
+    response: ITicketDetail;
 }
 /** Reads a ticket's comments. */
 export interface IReq_ControllerMcpTicketComments extends plugins.typedrequestInterfaces.implementsTR<TControllerMcpTicketRequest<'comments'>, IReq_ControllerMcpTicketComments> {

package/dist_ts_interfaces/tickets.d.ts

@@ -218,6 +218,40 @@ export interface ITicketMove {
     columnId: TTicketColumn;
     beforeTicketId?: string;
 }
+/**
+ * How many history entries one `get` returns unless it names `limit`, the most it may name, and the bytes a page holds
+ * at most (its entries plus the comments they name, serialized; a page holds at least one entry). The budget wins over `limit`.
+ */
+export declare const ticketHistoryPage: {
+    readonly default: 50;
+    readonly maximum: 500;
+    readonly bytes: number;
+};
+/** A ticket and one page of its history: the newest entries, or those older than the entry `before` names, within `ticketHistoryPage`. */
+export interface ITicketGet {
+    ticketId: string;
+    /** An activity id, as `historyBefore` returned it: the page holds only older entries. */
+    before?: string;
+    /** Entries on the page, 1 to 500 (`ticketHistoryPage.maximum`); 50 (`ticketHistoryPage.default`) when absent. */
+    limit?: number;
+    /**
+     * One comment of this ticket, by the id an activity entry or a fleet event names: the response holds the ticket, its
+     * questions and that comment alone (`comments: [it]`, `activity: []`, no `historyBefore`). Excludes `before` and `limit`.
+     */
+    commentId?: string;
+}
+/**
+ * A ticket, all its questions and one page of its history, oldest first. `activity` is the page; `comments` are the
+ * comments its `commented` entries name, whose `changes.comment` holds only `{ after: { id } }` here (the stored
+ * entry keeps the whole comment). `historyBefore` is present while older entries exist: pass it as `before`.
+ */
+export interface ITicketDetail {
+    ticket: ITicket;
+    comments: ITicketComment[];
+    activity: ITicketActivity[];
+    questions: ITicketQuestion[];
+    historyBefore?: string;
+}
 export interface ITicketBoard {
     revision: number;
     columns: {
@@ -250,15 +284,8 @@ export interface ITicketOperations {
         };
     };
     get: {
-        request: {
-            ticketId: string;
-        };
-        response: {
-            ticket: ITicket;
-            comments: ITicketComment[];
-            activity: ITicketActivity[];
-            questions: ITicketQuestion[];
-        };
+        request: ITicketGet;
+        response: ITicketDetail;
     };
     comments: {
         request: {
@@ -369,6 +396,7 @@ export declare const ticketErrorMessages: {
     readonly ticket_ask_forbidden: 'Workers may ask questions only on tickets assigned to their verified session.';
     readonly ticket_answer_forbidden: 'Only the owner or the driver may answer ticket questions.';
     readonly ticket_question_not_found: 'The requested question does not exist on this ticket.';
+    readonly ticket_comment_not_found: 'The requested comment does not exist on this ticket.';
     readonly ticket_question_answered: 'The question already has a different answer; a second answer is refused. Ask a new question instead.';
     readonly ticket_answer_invalid: 'An answer chooses existing option ids (one unless multiSelect) and/or gives free text where the question allows it.';
 };

package/dist_ts_interfaces/tickets.js

@@ -43,6 +43,11 @@ export const ticketAnswerFromCard = (questionArg, answersArg) => {
     return { choices: questionArg.options.filter((optionArg) => choices.includes(optionArg.id)).map((optionArg) => optionArg.id),
         ...(texts.length ? { text: texts.join('\n\n') } : {}) };
 };
+/**
+ * How many history entries one `get` returns unless it names `limit`, the most it may name, and the bytes a page holds
+ * at most (its entries plus the comments they name, serialized; a page holds at least one entry). The budget wins over `limit`.
+ */
+export const ticketHistoryPage = { default: 50, maximum: 500, bytes: 256 * 1024 };
 export const ticketErrorMessages = {
     ticket_revision_conflict: 'The ticket changed since editing began. Reload it before editing again.',
     ticket_identity_required: 'A verified MCP caller is required for this ticket operation. Unidentified callers may only list or get tickets.',
@@ -59,9 +64,10 @@ export const ticketErrorMessages = {
     ticket_ask_forbidden: 'Workers may ask questions only on tickets assigned to their verified session.',
     ticket_answer_forbidden: 'Only the owner or the driver may answer ticket questions.',
     ticket_question_not_found: 'The requested question does not exist on this ticket.',
+    ticket_comment_not_found: 'The requested comment does not exist on this ticket.',
     ticket_question_answered: 'The question already has a different answer; a second answer is refused. Ask a new question instead.',
     ticket_answer_invalid: 'An answer chooses existing option ids (one unless multiSelect) and/or gives free text where the question allows it.',
 };
 export const ticketClientErrorMessages = Object.fromEntries(Object.entries(ticketErrorMessages)
     .map(([codeArg, messageArg]) => [codeArg.toUpperCase(), messageArg]));
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGlja2V0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvdGlja2V0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxhQUFhLEdBQUc7SUFDM0IsU0FBUyxFQUFFLE9BQU8sRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVTtDQUN4RSxDQUFDO0FBaURYLHNGQUFzRjtBQUN0RixNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLGNBQWMsQ0FBVSxDQUFDO0FBRTFELE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBZ0IsRUFBZ0MsRUFBRSxDQUFDLENBQ2xGLGdCQUFzQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FDM0QsQ0FBQztBQUtGLE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRTtJQUNuRyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLEtBQUssSUFBSTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3hFLE1BQU0sS0FBSyxHQUFHLFFBQTRDLENBQUM7SUFDM0QsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLDBCQUEwQixJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxJQUFJLEtBQUssQ0FBQyxlQUFnQixJQUFJLENBQUM7UUFDNUgsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZ0IsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEcsQ0FBQyxDQUFDO0FBMkVGLDhGQUE4RjtBQUM5RixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFdBQTRCLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDMUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLElBQUksRUFBRSxVQUFtQjtJQUN6QixRQUFRLEVBQUUsV0FBVyxDQUFDLFFBQVE7SUFDOUIsT0FBTyxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNoSSxXQUFXLEVBQUUsV0FBVyxDQUFDLFdBQVc7SUFDcEMsV0FBVyxFQUFFLFdBQVcsQ0FBQyxXQUFXO0lBQ3BDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7SUFDNUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ3ZCLFFBQVEsRUFBRSxDQUFDLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxTQUFTLENBQUMsRUFBRSxLQUFLLElBQUksU0FBUyxDQUFDO1lBQ2xKLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDOUUsV0FBVyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7S0FDdkQsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0NBQ1IsQ0FBQyxDQUFDO0FBQ0g7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxXQUE0QixFQUFFLFVBQTZCLEVBQTJDLEVBQUU7SUFDM0ksTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO0lBQzdCLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsS0FBSyxLQUFLLE1BQU0sQ0FBQyxDQUFDO1FBQ25GLElBQUksTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7O1lBQy9ELEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDMUIsQ0FBQztJQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzFILEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7QUFDNUQsQ0FBQyxDQUFDO0FBMkVGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHO0lBQ2pDLHdCQUF3QixFQUFFLHlFQUF5RTtJQUNuRyx3QkFBd0IsRUFBRSxpSEFBaUg7SUFDM0ksZ0JBQWdCLEVBQUUsc0NBQXNDO0lBQ3hELG1CQUFtQixFQUFFLDZFQUE2RTtJQUNsRyxvQkFBb0IsRUFBRSw4SEFBOEg7SUFDcEosNEJBQTRCLEVBQUUsK0NBQStDO0lBQzdFLDJCQUEyQixFQUFFLDhDQUE4QztJQUMzRSw2QkFBNkIsRUFBRSwyREFBMkQ7SUFDMUYsc0JBQXNCLEVBQUUsbUNBQW1DO0lBQzNELHFCQUFxQixFQUFFLGtGQUFrRjtJQUN6RywwQkFBMEIsRUFBRSxxRUFBcUU7SUFDakcscUJBQXFCLEVBQUUsZ0ZBQWdGO0lBQ3ZHLG9CQUFvQixFQUFFLCtFQUErRTtJQUNyRyx1QkFBdUIsRUFBRSwyREFBMkQ7SUFDcEYseUJBQXlCLEVBQUUsdURBQXVEO0lBQ2xGLHdCQUF3QixFQUFFLHNHQUFzRztJQUNoSSxxQkFBcUIsRUFBRSxxSEFBcUg7Q0FDcEksQ0FBQztBQUVYLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQztLQUM1RixHQUFHLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBMkMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGlja2V0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvdGlja2V0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSxhQUFhLEdBQUc7SUFDM0IsU0FBUyxFQUFFLE9BQU8sRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVTtDQUN4RSxDQUFDO0FBaURYLHNGQUFzRjtBQUN0RixNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLGNBQWMsQ0FBVSxDQUFDO0FBRTFELE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBZ0IsRUFBZ0MsRUFBRSxDQUFDLENBQ2xGLGdCQUFzQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FDM0QsQ0FBQztBQUtGLE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRTtJQUNuRyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLEtBQUssSUFBSTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3hFLE1BQU0sS0FBSyxHQUFHLFFBQTRDLENBQUM7SUFDM0QsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLDBCQUEwQixJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxJQUFJLEtBQUssQ0FBQyxlQUFnQixJQUFJLENBQUM7UUFDNUgsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZ0IsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDaEcsQ0FBQyxDQUFDO0FBMkVGLDhGQUE4RjtBQUM5RixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFdBQTRCLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDMUUsRUFBRSxFQUFFLFdBQVcsQ0FBQyxFQUFFO0lBQ2xCLElBQUksRUFBRSxVQUFtQjtJQUN6QixRQUFRLEVBQUUsV0FBVyxDQUFDLFFBQVE7SUFDOUIsT0FBTyxFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNoSSxXQUFXLEVBQUUsV0FBVyxDQUFDLFdBQVc7SUFDcEMsV0FBVyxFQUFFLFdBQVcsQ0FBQyxXQUFXO0lBQ3BDLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7SUFDNUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ3ZCLFFBQVEsRUFBRSxDQUFDLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxTQUFTLENBQUMsRUFBRSxLQUFLLElBQUksU0FBUyxDQUFDO1lBQ2xKLEdBQUcsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDOUUsV0FBVyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7S0FDdkQsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0NBQ1IsQ0FBQyxDQUFDO0FBQ0g7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxXQUE0QixFQUFFLFVBQTZCLEVBQTJDLEVBQUU7SUFDM0ksTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO0lBQzdCLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsS0FBSyxLQUFLLE1BQU0sQ0FBQyxDQUFDO1FBQ25GLElBQUksTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7O1lBQy9ELEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDMUIsQ0FBQztJQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzFILEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7QUFDNUQsQ0FBQyxDQUFDO0FBZ0NGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLEVBQUUsT0FBTyxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLEdBQUcsSUFBSSxFQUFXLENBQUM7QUFxRTNGLE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHO0lBQ2pDLHdCQUF3QixFQUFFLHlFQUF5RTtJQUNuRyx3QkFBd0IsRUFBRSxpSEFBaUg7SUFDM0ksZ0JBQWdCLEVBQUUsc0NBQXNDO0lBQ3hELG1CQUFtQixFQUFFLDZFQUE2RTtJQUNsRyxvQkFBb0IsRUFBRSw4SEFBOEg7SUFDcEosNEJBQTRCLEVBQUUsK0NBQStDO0lBQzdFLDJCQUEyQixFQUFFLDhDQUE4QztJQUMzRSw2QkFBNkIsRUFBRSwyREFBMkQ7SUFDMUYsc0JBQXNCLEVBQUUsbUNBQW1DO0lBQzNELHFCQUFxQixFQUFFLGtGQUFrRjtJQUN6RywwQkFBMEIsRUFBRSxxRUFBcUU7SUFDakcscUJBQXFCLEVBQUUsZ0ZBQWdGO0lBQ3ZHLG9CQUFvQixFQUFFLCtFQUErRTtJQUNyRyx1QkFBdUIsRUFBRSwyREFBMkQ7SUFDcEYseUJBQXlCLEVBQUUsdURBQXVEO0lBQ2xGLHdCQUF3QixFQUFFLHNEQUFzRDtJQUNoRix3QkFBd0IsRUFBRSxzR0FBc0c7SUFDaEkscUJBQXFCLEVBQUUscUhBQXFIO0NBQ3BJLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUM7S0FDNUYsR0FBRyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQTJDLENBQUMifQ==

package/dist_ts_interfaces/workercallers.d.ts

@@ -4,6 +4,8 @@ export declare const workerCallerLaunchGenerationEnvironmentVariable = "AGL_MCP_
 export interface IFleetWorkerCallerLaunchBase {
     launchId: string;
     projectId: string;
+    /** The fleet worker the launch identifies, `${projectId}:${name}`: a worker holds one current launch. */
+    workerId: string;
 }
 /**
  * The Codex app-server connection that created the worker's thread: a controller connection profile, or the fleet's
@@ -28,12 +30,18 @@ export interface IFleetClaudeProcess {
     pid: number;
     startTicks: string;
 }
-export type TFleetWorkerCallerBinding = IFleetWorkerCallerLaunchBase & {
+export type TFleetWorkerCallerBinding = Omit<IFleetWorkerCallerLaunchBase, 'workerId'> & {
     nativeSessionId: string;
     expectedBindingRevision: number;
-} & ({
+} & (
+/**
+ * A Claude launch binds to its background job and to the job's current process; a job whose process already exited
+ * binds without one, and the next process of the same job proves itself when its bridge enrolls.
+ */
+{
     harnessId: 'claude';
-    claudeProcess: IFleetClaudeProcess;
+    claudeJobId: string;
+    claudeProcess?: IFleetClaudeProcess;
 } | {
     harnessId: 'codex';
 });
@@ -58,11 +66,42 @@ export interface IFleetWorkerCallerHooks {
         ticketSessionId: string;
     }>;
     getWorkerCallerStatus(launchId: string): IWorkerCallerReadiness;
-    revokeWorkerCaller(request: {
+    /**
+     * Revokes one launch, or the current launch of a worker, also one the controller kept from before a restart. Every
+     * reason but `generation_change` revokes it for good: its kept binding is deleted with it.
+     */
+    revokeWorkerCaller(request: ({
         launchId: string;
+    } | {
+        workerId: string;
+    }) & {
         reason: 'failure' | 'stop' | 'replacement' | 'generation_change' | 'cancelled';
     }): Promise<void>;
 }
+/** The background job a Claude worker's launch is bound to, as the controller asks the fleet about it. */
+export interface IWorkerClaudeJobRequest {
+    workerId: string;
+    projectId: string;
+    nativeSessionId: string;
+    jobId: string;
+}
+/**
+ * What a fresh Claude inventory shows of that job: `running` in one process, `settled` without a process, `ended` for
+ * this worker (the worker is gone or archived, continues in another session, or the session continues as another job),
+ * or `unproven` when the registry or the inventory could not be read or did not list the session once.
+ */
+export type TWorkerClaudeJobObservation = {
+    state: 'running';
+    process: IFleetClaudeProcess;
+} | {
+    state: 'settled';
+} | {
+    state: 'ended';
+    reason: string;
+} | {
+    state: 'unproven';
+    reason: string;
+};
 export interface IWorkerCallerSubject {
     kind: 'worker_launch';
     launchId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agl",
-  "version": "40.5.1",
+  "version": "41.0.0",
   "controllerUpgradeManagementVersion": 2,
   "private": false,
   "description": "Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions",
@@ -24,7 +24,7 @@
     "@api.global/typedsocket": "8.10.0",
     "@apiclient.xyz/docker": "10.1.3",
     "@aws-sdk/client-s3": "^3.1136.0",
-    "@design.estate/dees-catalog": "^23.1.0",
+    "@design.estate/dees-catalog": "^23.4.0",
     "@design.estate/dees-comms": "^2.1.0",
     "@design.estate/dees-element": "4.0.2",
     "@jitl/quickjs-ng-wasmfile-release-sync": "0.32.0",
@@ -32,11 +32,11 @@
     "@lossless.org/nosqldb": "10.8.0",
     "@lossless.org/objectstorage": "10.7.1",
     "@modelcontextprotocol/sdk": "1.30.0",
-    "@modelprofile.com/catalog": "^1.0.0",
-    "@modelprofile.com/flexharness": "16.3.0",
-    "@modelprofile.com/flexharness-agent": "16.3.0",
-    "@modelprofile.com/flexharness-models": "16.3.0",
-    "@modelprofile.com/flexharness-providers": "16.3.0",
+    "@modelprofile.com/catalog": "^1.1.0",
+    "@modelprofile.com/flexharness": "16.4.0",
+    "@modelprofile.com/flexharness-agent": "16.4.0",
+    "@modelprofile.com/flexharness-models": "16.4.0",
+    "@modelprofile.com/flexharness-providers": "16.4.0",
     "@modelprofile.com/mcp-crossharness": "5.9.0",
     "@modelprofile.com/mcp-system": "3.1.0",
     "@opencode-ai/sdk": "1.18.15",

package/readme.md

@@ -76,6 +76,8 @@ The browser receives normalized AGL data. It never receives the OpenCode server
 
 Controller protocol v28 sends bounded live Assistant text and reasoning deltas when the browser already owns the exact preceding transcript revision. Every delta carries its stream epoch, revision, and UTF-8 coordinates; Flex deltas also carry the harness's authoritative transcript order. The browser applies only contiguous, correctly sized updates to the canonical transcript; a gap, stale owner, invalid coordinate, or queue overflow blocks further deltas from that epoch and requests authoritative session-detail hydration instead. Only adjacent compatible pending deltas may be coalesced, so interleaved updates retain their original order.
 
+Each browser receives controller events through its own ordered queue, one event in flight at a time, so a tab that acknowledges slowly or not at all delays only itself. A queue that passes 512 events or 16 MiB collapses for that browser alone: it keeps the newest event of each state, drops live text, reasoning and tool content, and ends with a conversation refresh for each harness whose live content it dropped. A streamed Flex reply notifies a conversation change at its parts' starts and ends and its run's lifecycle, not with every delta.
+
 Streaming text is rendered without Markdown parsing. AGL refreshes the affected messages and enables normal Markdown rendering after the harness reports terminal state or authoritative hydration settles the transcript. This keeps long responses responsive without creating a second browser-side message graph.
 
 Consecutive Assistant messages containing only reasoning share one header and time range. Each thought keeps its own disclosure and active thinking state; user messages, text, tools and attention requests end the group.
@@ -328,6 +330,8 @@ agl proxy run codex --model <catalog-model> -- exec 'Explain this repository'
 agl proxy run claude --                       # Claude Code on Claude accounts
 agl proxy run claude --provider openai --model <catalog-model> --
 agl proxy run opencode --model <catalog-model> -- run 'Explain this repository'
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> claude -p   # Claude Code in a container
+agl proxy confined end <run id>
 ```
 
 Every client -- `codex`, `claude`, `opencode`, or a name of your own -- has one credential. The proxy keeps it
@@ -434,7 +438,8 @@ pool and keeps its credential. `agl proxy run claude` uses Claude accounts unles
 ChatGPT models behind Claude Code; `run codex` and `run opencode` use ChatGPT accounts.
 
 The listener binds only `127.0.0.1` and requires the exact host and port, no browser Origin, and
-`Authorization: Bearer <credential>` (or `x-api-key`).
+`Authorization: Bearer <credential>` (or `x-api-key`). Claude Code in a container reaches the proxy through a second
+listener, a Unix socket that serves confined runs alone (see [Confined containers](#confined-containers)).
 
 - A ChatGPT pool serves `/openai/v1/responses` and `/openai/v1/models` (the pooled Codex catalog in Codex's
   own shape when Codex names its `client_version`), and `/anthropic/v1/messages` and `/anthropic/v1/models`
@@ -701,6 +706,65 @@ proxy's binding with it, and the sessions it served move at their next request.
 pool, 16 requests in flight per session, 256 per client credential, 512 in all, 32 MiB per request and 8 MiB
 per inspected response event (or non-streaming JSON response).
 
+#### Confined containers
+
+`agl proxy confined run` runs Claude Code in a Docker container that reaches AGL through one route only: the proxy's
+confined listener, a Unix socket alone in a directory of its own (`agl-proxy-confined/proxy.sock` beside the proxy's
+control socket; `agl proxy status` names it). The listener serves the Claude pool's three endpoints Claude Code uses --
+`GET /anthropic/v1/models`, `POST /anthropic/v1/messages` and `POST /anthropic/v1/messages/count_tokens` -- exactly as
+the loopback listener serves a Claude client, and refuses every other path, method and pool with 404 before anything is
+read or routed; nothing else of AGL is reachable through it. It accepts confined runs' credentials alone: a request
+without a credential, with one the proxy does not know, or with a credential of the loopback listener (any client's or
+lease's) is refused with 401, and a confined run's credential is refused on the loopback listener alike.
+
+```sh
+agl proxy confined run -- docker run --rm --user "$(id -u):$(id -g)" -i <image> \
+  claude -p --model claude-opus-5-5 --output-format json < prompt.txt
+agl proxy status                  # names the confined listener and lists the runs by id
+agl proxy confined end <run id>   # ends a run's credential at once
+```
+
+Before the container starts, the command asks the proxy for the run's credential: one for this run alone, a lease of
+the Claude pool (the Claude accounts first, then the Anthropic API keys) whose sessions are those of the client
+`confined`, so its requests are placed, moved and counted (token usage under `confined`) like any other Claude
+client's. Right after `docker run` it adds the listener's directory as a read-only mount at `/run/agl-proxy` and what
+Claude Code inside needs to reach it, each variable passed by name so the credential appears on no command line:
+
+- `ANTHROPIC_UNIX_SOCKET=/run/agl-proxy/proxy.sock`: Claude Code sends its API requests through the socket, as plain
+  HTTP, so no relay runs in the container (Claude Code's own setting, which `claude ssh` uses; verified with Claude Code
+  2.1.288, the release of AGL's Agent SDK);
+- `ANTHROPIC_BASE_URL=http://localhost/anthropic`: the path Claude Code puts on its requests; the host is not used;
+- `ANTHROPIC_AUTH_TOKEN`: the run's credential;
+- `CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1` and `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`, as `agl proxy run
+  claude` sets them.
+
+It prints the run's id on standard error (`AGL proxy confined run <id>: …`), passes its standard input and output
+through, and exits with the container's status. The container never receives an account token, the control socket or
+any other part of the AGL home: the mount holds the socket alone, and the variables that would give Claude Code another
+login or route (`CLAUDE_CODE_OAUTH_TOKEN`, `ANTHROPIC_API_KEY`, …) are removed from the environment `docker` runs with,
+so a `-e NAME` of one of them passes nothing. What the launcher names itself after `docker run` is its own: it must not
+set the variables above. The command takes `docker run` and `docker container run` only, with the image and its
+command after the options.
+
+The socket and its directory are the proxy user's alone (0600 and 0700), so the container's processes connect as that
+user: `--user` with its uid and gid under a Docker daemon that runs as root, or the container's own root under rootless
+Docker, which maps it to that user; another uid, or a container whose user namespace maps it elsewhere, cannot connect.
+Root in a container of a rootful daemon connects as well while it keeps Docker's default capabilities, since
+`CAP_DAC_OVERRIDE` passes the socket's mode (with `--cap-drop ALL` it is refused): the mode keeps the host's other users
+out, and only the containers a run started have the mount at all. The directory, not the socket file, is mounted, so a
+proxy restart, which replaces the socket, does not cut the container off.
+
+The credential lives as long as the command. When the container exits the command ends it, and the proxy refuses it
+from then on and forgets it. Like a lease it survives a restart of the proxy, which keeps only its SHA-256 digest and
+serves it again at once while the command takes it back. `agl proxy confined end <run id>` ends it at once: requests in
+flight end, the next one is refused, and the command stops the container (`docker run` passes its SIGTERM on) and exits
+with the reason; it does the same when the proxy does not hand the credential back after a restart.
+
+Downgrade: an earlier proxy refuses to start while its store keeps a confined run's credential, which its check of the
+kept leases does not know. Let every confined run end before downgrading; if an earlier proxy's start already failed,
+start this release once with no confined run going and wait out the 60-second reclaim window, which ends the kept
+credential, then downgrade.
+
 ## Native Codex Harness
 
 Choose **New → Chat session** and pick the Codex harness to use Codex inside AGL. Native threads support text and reasoning streaming, tool activity, the Codex model and reasoning-effort catalog, command and file approvals, ordinary user-input questions, interruption, history pagination, rename, archive, and deletion. AGL Ask/Yolo controls apply to the exact pending native approval request; approvals never outlive its server request.
@@ -1212,7 +1276,12 @@ native completion; archive requires a settled worker. A worker whose start was r
 native session, and archiving it touches no harness. Claude archive marks only the AGL
 registry, preserving the transcript and native worktree. Codex archives its native thread.
 Watch retains native `reportId` alongside `workerId` so consumers can correlate reports
-and updates without treating each watch cursor as a new report. A failed observation, a
+and updates without treating each watch cursor as a new report. An event whose whole text is a
+ticket comment names it as `commentId`: the fleet comments a ticketed worker's report before it
+publishes the report's event (`worker.report.mid_turn`, `worker.turn.ended`), the board pump's
+`ticket.stalled` names its notice, and a commented `ticket.changed` its comment. Read it with
+`ticket_get` and `commentId` (`agl ticket get AGL-<n> --comment <id>`), however long the
+ticket's history is. A report whose comment was not written names none. A failed observation, a
 transcript gap for example, is published once as `worker.observation.failed`; the fleet then
 requests a fresh report itself: the worker's next poll starts from a new baseline, and its
 newest report, when it has one, is published as `worker.report.mid_turn` and commented on its
@@ -1532,8 +1601,13 @@ While the board changed within the last hour, the driver keeps its prompt cache
 next turn reads the cached prefix instead of writing it again. Every board change (a ticket
 created, changed, moved, commented, answered or assigned) sets the driver session's warm
 deadline to one hour from then, and Flex runs a warm-up turn before the provider's cache would
-expire. An hour after the last board change, warming stops until the next one. Warm-up turns
-add nothing to the driver's conversation: no message in its transcript, no `working` status,
+expire. On a Claude model the driver's requests ask Anthropic for one-hour cache breakpoints
+(`cache: { retention: '1h' }`), so an idle hour costs one warm-up turn, a minute before the hour
+ends, instead of one every four minutes; writing an hour's breakpoint costs 2× the input price
+instead of 1.25×. Other sessions keep the five-minute default for their newest breakpoint. On a
+ChatGPT account the cache lives in memory for about five minutes and takes no retention, so
+warm-up turns still come every four minutes. An hour after the last board change, warming stops until the next one. Warm-up turns
+add nothing to the driver's conversation: nothing its model sees on later turns, no message in its transcript, no `working` status,
 no unread turn and no batch of fleet events. They leave the session's state as its last real
 turn left it, so a driver whose last turn failed still shows that error. The controller logs each
 warm-up turn with the tokens it read from the cache. `keepCacheWarm: false` turns warming off
@@ -1553,8 +1627,14 @@ and `driver_notes_update`, the shell and file tools
 every Flex session has, and the [AGL API](#agl-api-for-flex-sessions) without its ticket methods. The controller runs each of these tool calls as the driver: actor
 `driver:<controller id>` with the ticket role `driver`. A tool that changes fleet or ticket
 state first asks for the `agl.driver` permission, which the session can remember. The notes
-are the driver session's scratchpad. They are added to its system prompt on every run, so the
-driver's working state survives compaction and restarts.
+are the driver session's scratchpad, so the driver's working state survives compaction and
+restarts. They are not part of the driver's system prompt, which holds its instructions only:
+they reach the model as Flex's pinned context `driver-notes`, named by the scratchpad's
+revision. A turn whose context does not show the current revision gets it right before its
+prompt, and a compaction ends its summary with it, so the driver sees its notes when they change
+and after a compaction, and a notes update leaves the cached prompt in front of it unchanged.
+Empty notes are pinned as a note that they are empty, so clearing them replaces the text saved
+before.
 
 `ticket_question_answer` records the owner's answer to an open ticket question as the driver,
 with the schema of `agl ticket answer`; the MCP server has no such tool, so a worker cannot
@@ -1583,7 +1663,15 @@ finished or failed releases, failed or unknown ticket effects, others' ticket ch
 (`ticket.notification.failed`, naming the session), stalled tickets the board pump found
 (`ticket.stalled`) and Claude Code releases newer than the verified one
 (`harness.release.discovered`). Worker status changes, host-load samples,
-applied ticket effects and delivered ticket notices are not delivered. A batch waits 15
+applied ticket effects and delivered ticket notices are not delivered. Each event reads as one
+header line -- `- [event <id>] <time> <kind>` with its ticket, worker, session, report id, turn id,
+status, repo, version and operation -- then its error and its text, quoted. A text longer than
+3 KiB is relayed as a digest: every report marker line (`result:`, `needs input:`, `owner
+question:` and the others the fleet reads as a report), each at most 1 KiB, then the text's end,
+in order, with `[… N lines …]` where lines were left out. A note then says where the whole text
+is: a ticketed worker's report is the fleet comment of that report id on its ticket, and a
+stalled ticket's notice or another's change is on its ticket, all read with `ticket_get`. A
+report longer than 32 KiB is kept by the fleet from its end only, which the note says. A batch waits 15
 seconds for further events and is delivered at most once a minute. It waits while the driver runs a turn, including permission waits, using the current session state.
 If a batch is still queued when further events arrive, they merge into that same message,
 keeping its position and sender. The merged text is stored before the merge is acknowledged,
@@ -1636,6 +1724,10 @@ as `ticket.notified` when the answers reached the worker, and reaches the driver
 relay. The pump never starts a worker, never moves a ticket and never answers a question, and its
 comments are not relayed to the assignee as ticket notices.
 
+Each pass reads the board list once. A ticket's history and questions are read again only when its
+revision moved since the pass that last read them; every comment, question, answer and other change
+moves it, so a pass over an unchanged board reads no ticket's history.
+
 The pump is on by default; configure it in the Configuration master:
 
 ```json
@@ -1668,8 +1760,8 @@ has full access; the CLI reuses `agl config`'s short-lived local-owner capabilit
 is no automatic dispatch. Attachment URLs must use HTTP or HTTPS; AGL stores the
 reference and does not fetch its payload.
 
-Unidentified local MCP callers may use `tickets_list` and `ticket_get`, including comments
-and activity returned with the ticket. Their Mine filter is empty and every returned ticket
+Unidentified local MCP callers may use `tickets_list` and `ticket_get`, including the comments
+and activity of the history page returned with the ticket. Their Mine filter is empty and every returned ticket
 permission is false. Every mutation refuses with `TICKET_IDENTITY_REQUIRED`; neither a
 claimed name nor a native session id supplies identity. Plain Claude background sessions
 started outside AGL stay unidentified. The web board still requires owner authentication.
@@ -1737,11 +1829,12 @@ superseded origins refuse preparation.
 - Revoke on failure, stop, replacement, cancellation or controller-generation change.
   Revocation fences new admissions immediately, removes credentials, and waits for already
   admitted ticket requests. Native-ID uniqueness and binding revision checks fence races.
-  Controller restart invalidates every old handle; existing native workers remain
-  unidentified until fleet performs an authorized controlled resume/relaunch with a fresh
-  overlay. Hooks do not automatically terminate or adopt outside sessions. Revoked launch IDs
-  stay recorded so they are never prepared again; the oldest give way once 65,536 launches
-  are recorded.
+  Controller restart invalidates every credential. A Claude launch's binding to its job
+  outlives it (below); a Codex launch does not, and its worker is bound again at its next
+  steer. Every reason but a controller-generation change revokes a launch for good and
+  deletes its kept binding. Hooks do not automatically terminate or adopt outside sessions.
+  Revoked launch IDs stay recorded so they are never prepared again; the oldest give way
+  once 65,536 launches are recorded.
 
 Fleet workers use these hooks themselves, so a worker's MCP ticket writes are admitted as
 that worker, not as the driver or anonymously:
@@ -1753,16 +1846,40 @@ that worker, not as the driver or anonymously:
   the worker id), passed as `--mcp-config <file> -- <prompt>`. Claude Code saves that path and reads it
   again at every wake, so the fleet rewrites it before each one; the launch ID and
   generation reach only the `agl` MCP server's environment, never the Claude process's.
-  Once the agents listing shows the job's process, the fleet binds the launch to it. A start,
-  wake or relaunch that fails at any step revokes its launch. Stop revokes the launch and archive removes the overlay. A start fails closed before Claude
-  runs when the Configuration master has no `agl` MCP server.
+  Once the agents listing shows the job's process, the fleet binds the launch to the job and
+  that process; a job that already settled after a quick turn is bound without a process. A
+  start, wake or relaunch that fails at any step revokes its launch. Stop revokes the launch
+  and archive also removes the overlay. A start fails closed before Claude runs when the
+  Configuration master has no `agl` MCP server.
 - Fleet Codex workers prepare the launch on the fleet's own connection before
   `thread/start` and bind it before the first `turn/start`. Before steering a thread whose
   launch is unbound, from an earlier connection or from before a controller restart, the
   fleet loads the thread and binds a fresh launch; a refusal fails the steer undispatched.
-- Launches live in memory. After a controller restart a Claude worker stays unidentified
-  until its next fleet start, steer or resume, and a Codex worker is bound again at its next
-  steer.
+- A Claude launch belongs to its background job, not to one process. Claude Code retires an
+  idle job's process and starts a new one for the same job when someone writes to it in
+  Claude Code; that process reads the same overlay. The controller keeps each Claude
+  launch's binding in its store (`agl_worker_caller_bindings`, one record per worker:
+  digests of the launch ID and generation, the job and session IDs, the binding revision, the
+  proved process's PID, start and snapshot digest, and the approved bridge command; never a
+  credential). When a bridge enrolls under another process than the bound one, or after a
+  controller restart, the fleet reads a fresh Claude inventory (one read at a time) and the
+  launch is bound to the bridge's process only when the inventory lists the worker's session,
+  once, as the same background job in exactly that process, the process runs the approved
+  Claude Code executable, and the bridge is its direct child running the recorded command
+  over its own connection. A launch a restarted controller restores is proved the same way
+  before its first write, also when its process still runs. Every other process stays
+  unverified, and a refused bridge is not proved again at every call: for the life of that
+  process image, or for five seconds when the job showed no process yet, the inventory could
+  not be read, or the inventory still named another process for the job (Claude Code may just
+  have replaced it).
+  When the inventory shows the worker's session as another job, or the fleet no longer binds
+  the worker to it (archived, moved to another session), the launch is revoked for good.
+  An upgrade moves every bridge in place onto the new build (`process.execve`: the same PID and
+  start, a new image from the new install's path), and the image it became is proved afresh:
+  its command is the one recorded with the launch or the one the restarted controller resolves
+  itself from its configured `agl` MCP entry, never one the bridge names, and a new command is
+  kept with the binding's next revision. Each reason an enrollment stays unverified is written once to the controller log,
+  naming the worker and its session, never the launch ID or a credential.
 
 The bridge exchanges credentials only through the private controller endpoint after Linux
 direct-loopback socket-inode ownership, approved executable/argv and current native
@@ -1778,7 +1895,7 @@ entry. Ambiguous entries, wrapper commands, static caller credentials and secret
 definitions fail closed. Fleet owns spawning, native observations and hook calls.
 
 MCP tools are `tickets_list` (mine/project/status/label/text filters), `ticket_get` (ticket,
-comments, complete activity and questions), `ticket_create`, `ticket_update`, `ticket_move`,
+questions and one page of history), `ticket_create`, `ticket_update`, `ticket_move`,
 `ticket_comment`, `ticket_link` and `ticket_question_ask`. `ticket_comment.body` accepts markdown text or the
 kanban's text/reference-content array. A Claude worker's assignment uses
 `claude:<agent-session-id>` and a Codex worker's uses `codex:<native-id>`; the same value
@@ -1794,6 +1911,8 @@ agl ticket list --project agl --json
 agl ticket link AGL-1 --repo modelprofile.com/agl --branch feat/tickets --sha <full-sha> --json
 agl ticket move AGL-1 --column review --json
 agl ticket get AGL-1 --json
+agl ticket get AGL-1 --limit 20 --before <historyBefore> --json
+agl ticket get AGL-1 --comment <comment-id> --json
 agl ticket comment AGL-1 --body '**Checks passed**' --json
 agl ticket update AGL-1 --expected-revision <revision-from-get> --changes '{"priority":"high","labels":["backend"]}' --json
 agl ticket ask AGL-1 --text 'Which store?' --options '["Memory",{"label":"Database","description":"Durable"}]' --json
@@ -1801,6 +1920,18 @@ agl ticket list --label openQuestion --json
 agl ticket answer AGL-1 --question Q1 --choice 2 --text 'Keep it **small**.' --json
 ```
 
+`ticket_get` (`agl ticket get`, `agl.mcp.ticket.get`, `controller.ticket.get`) returns the
+ticket, all its questions and the newest page of its history, oldest first: `activity` holds
+up to `limit` entries (default 50, at most 500), cut earlier so that the entries and the comments
+they name stay within 256 KiB (always at least one entry), and `comments` the comments those
+entries name. A `commented` entry names its comment as `changes.comment: { after: { id } }`, so
+each comment body appears once (stored activity keeps the whole comment). While older history exists the response
+carries `historyBefore`; pass it as `before` (`--before`) to read the next older page. To read the
+one comment an activity entry or a fleet event names, pass its id as `commentId` (`--comment`)
+instead: the answer holds the ticket, its questions and that comment alone (`activity` empty, no
+`historyBefore`); it cannot be combined with `before` or `limit`, and an id that is not a comment
+of the ticket is refused with `ticket_comment_not_found`. The board in the browser reads every page.
+
 All ten CLI actions accept `--port` and `--json`; `agl ticket --help` documents their
 options. The running controller is required. `update` and `assign` require `--expected-revision`
 from the ticket the editor read; neither command fetches a newer revision before saving.
@@ -2283,7 +2414,7 @@ Deleting a managed OpenCode conversation deletes the selected OpenCode conversat
 
 ### Models And Provider Accounts
 
-AGL stores an independent default model for OpenCode, FlexHarness, Codex and Claude Code. A conversation can override its harness default without changing other conversations.
+AGL stores an independent default model for OpenCode, FlexHarness, Codex and Claude Code. A conversation can override its harness default without changing other conversations. **Settings → General** shows each harness's default as one button that says the model and its effort (`openai/gpt-5.6-sol · max`, without the harness the row already names) and opens both choices in a speech bubble; a saved default the harness no longer offers gives the button the warning tone.
 
 A stored default names a model as the harness offered it then, so AGL resolves it against the harness's live model list whenever a conversation is created or sent without a model of its own. While the harness offers it, it is sent. A stored default the harness no longer offers is never sent: the harness's own default stands in -- OpenCode's or Codex's configured model, or for Flex the catalog default of the account placement takes -- and when the harness offers no default AGL can name, OpenCode, Codex and Claude Code run their own default unnamed, while Flex, which has none of its own, asks for an account and model in the composer. The stored setting stays as the owner wrote it; `models_list` reports it as `unavailableSetting`, and Settings says under the default model that it is no longer offered and what new conversations run on instead.
 
@@ -2860,6 +2991,8 @@ Backend isolation is mandatory. Proxy mode binds the controller to all interface
 - Permission auto-accept is an explicit server policy, never an assumption based on an open browser.
 - Questions are never auto-answered.
 - Unknown, malformed, concurrent, or unverifiable lifecycle state fails closed.
+- The inference proxy's confined listener is a Unix socket of the proxy's user alone; it accepts only confined runs'
+  credentials and serves them only the Claude pool's three Claude Code endpoints.
 
 The global **auto-accept permissions (yolo)** setting replies once to pending permissions across registered projects and writes those replies to the audit log. Each conversation also has a run-local Ask/Yolo switch. For an active managed OpenCode root, that switch covers its currently active direct children under the same exact family authority. For an active managed Flex root, it covers admitted descendants through their exact active parent-run authority chain; a relationship alone grants nothing. Terminal children are never auto-accepted. Disabling either policy seals new automatic replies and drains already admitted replies before returning. Neither mode creates persistent broad provider grants.
 
@@ -2910,7 +3043,7 @@ A run that fails keeps its evidence before its root goes: when a test of the fil
 The suite guards, end to end: opening every harness's conversation across page reloads without a harness child being replaced, recovering the Flex child after `SIGKILL` within 15 seconds, rejoining the shared Codex daemon on its own after that daemon restarts (the conversation opens and answers again within one rejoin backoff step, without **Reconnect**), starting the controller again (as the same and as the next build) with a browser resource attached to a Codex, Flex and OpenCode chat, listing a project's resources right after a browser is attached to each new chat and after a restart, the Flex model list carrying the account's current catalog, a Flex conversation answering, and opening and answering again after a restart, in a project whose id begins with `-` or `_` (the file creates projects until one does), and an `agl mcp` bridge answering tool calls from the same process after the controller moves to the next build. It is the test step of `gitzone release` (`release.preflight` in `.smartconfig.json`) and takes about eight minutes.
 
 
-Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
+Host prerequisites: Linux, Chrome (`google-chrome`, `chromium` or `chromium-browser`), `openssl`, `ss` (iproute2, to name the process behind a refused connection) and `codex` 0.156.0 or newer on `PATH`. `e2e.proxyconfined` also runs a Docker container (a daemon this user may use and the `ubuntu:24.04` image already on the host, which the case never pulls) and skips with the missing prerequisite named without them. Set `AGL_E2E_PACKAGE_ROOT` to another installed and built checkout, for example an earlier release, to run a scenario against it and prove it fails there:
 
 ```sh
 AGL_E2E_PACKAGE_ROOT=/path/to/agl-32.15.1 pnpm exec tsrepo test test/e2e/e2e.conversations.node.ts --verbose --timeout 900

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: 'agl',
-  version: '40.5.1',
+  version: '41.0.0',
   description: 'Agent Gateway Layer for OpenCode, FlexHarness, and Codex sessions'
 }