omnius 1.0.667 → 1.0.669

package/dist/index.js

@@ -173686,7 +173686,7 @@ var require_auto = __commonJS({
 // ../node_modules/acme-client/src/client.js
 var require_client = __commonJS({
   "../node_modules/acme-client/src/client.js"(exports, module) {
-    var { createHash: createHash80 } = __require("crypto");
+    var { createHash: createHash81 } = __require("crypto");
     var { getPemBodyAsB64u } = require_crypto();
     var { log: log22 } = require_logger();
     var HttpClient = require_http();
@@ -173997,14 +173997,14 @@ var require_client = __commonJS({
        */
       async getChallengeKeyAuthorization(challenge) {
         const jwk = this.http.getJwk();
-        const keysum = createHash80("sha256").update(JSON.stringify(jwk));
+        const keysum = createHash81("sha256").update(JSON.stringify(jwk));
         const thumbprint = keysum.digest("base64url");
         const result = `${challenge.token}.${thumbprint}`;
         if (challenge.type === "http-01") {
           return result;
         }
         if (challenge.type === "dns-01") {
-          return createHash80("sha256").update(result).digest("base64url");
+          return createHash81("sha256").update(result).digest("base64url");
         }
         if (challenge.type === "tls-alpn-01") {
           return result;
@@ -316684,7 +316684,7 @@ var require_websocket2 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes32, createHash: createHash80 } = __require("crypto");
+    var { randomBytes: randomBytes32, createHash: createHash81 } = __require("crypto");
     var { Duplex: Duplex3, Readable: Readable2 } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate2();
@@ -317344,7 +317344,7 @@ var require_websocket2 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest4 = createHash80("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash81("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest4) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -317711,7 +317711,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter15 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash80 } = __require("crypto");
+    var { createHash: createHash81 } = __require("crypto");
     var extension3 = require_extension2();
     var PerMessageDeflate3 = require_permessage_deflate2();
     var subprotocol3 = require_subprotocol();
@@ -318012,7 +318012,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest4 = createHash80("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash81("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -330819,13 +330819,13 @@ Justification: ${justification || "(none provided)"}`,
         }
         const snapshot = JSON.stringify(this.selfState, null, 2);
         try {
-          const { createHash: createHash80 } = await import("node:crypto");
+          const { createHash: createHash81 } = await import("node:crypto");
           const snapshotDir = join52(this.cwd, ".omnius", "identity", "snapshots");
           await mkdir7(snapshotDir, { recursive: true });
           const version5 = this.selfState.version;
           const snapshotPath = join52(snapshotDir, `v${version5}.json`);
           await writeFile12(snapshotPath, snapshot, "utf8");
-          const hash2 = createHash80("sha256").update(snapshot).digest("hex");
+          const hash2 = createHash81("sha256").update(snapshot).digest("hex");
           await writeFile12(join52(this.cwd, ".omnius", "identity", "latest-hash.txt"), hash2, "utf8");
           let ipfsCid = "";
           try {
@@ -330958,8 +330958,8 @@ New: ${newNarrative.slice(0, 200)}...`,
       }
       // ── Helpers ──────────────────────────────────────────────────────────────
       createDefaultState() {
-        const { createHash: createHash80 } = __require("node:crypto");
-        const machineId = createHash80("sha256").update(this.cwd).digest("hex").slice(0, 12);
+        const { createHash: createHash81 } = __require("node:crypto");
+        const machineId = createHash81("sha256").update(this.cwd).digest("hex").slice(0, 12);
         return {
           self_id: `omnius-${machineId}`,
           version: 1,
@@ -331041,9 +331041,9 @@ New: ${newNarrative.slice(0, 200)}...`,
         let cid;
         if (this.selfState.version > prevVersion) {
           try {
-            const { createHash: createHash80 } = await import("node:crypto");
+            const { createHash: createHash81 } = await import("node:crypto");
             const stateJson = JSON.stringify(this.selfState);
-            const hash2 = createHash80("sha256").update(stateJson).digest("hex").slice(0, 32);
+            const hash2 = createHash81("sha256").update(stateJson).digest("hex").slice(0, 32);
             const cidsPath = join52(this.cwd, ".omnius", "identity", "cids.json");
             const cidsData = { latest: "", hash: hash2, version: this.selfState.version };
             try {
@@ -624569,6 +624569,186 @@ var init_contextBudget = __esm({
   }
 });
 
+// packages/orchestrator/dist/tool-exposure-policy.js
+import { createHash as createHash35 } from "node:crypto";
+function normalizedName(value2) {
+  return String(value2 ?? "").trim();
+}
+function sortedUnique(values) {
+  return [...new Set([...values].map(normalizedName).filter(Boolean))].sort((left, right) => left.localeCompare(right));
+}
+function positiveLimit(value2, fallback) {
+  return typeof value2 === "number" && Number.isFinite(value2) && value2 > 0 ? Math.floor(value2) : fallback;
+}
+function descriptorMap(descriptors2) {
+  const result = /* @__PURE__ */ new Map();
+  for (const raw of descriptors2) {
+    const name10 = normalizedName(raw.name);
+    if (!name10)
+      throw new Error("Progressive tool descriptors require a name.");
+    if (result.has(name10)) {
+      throw new Error(`Duplicate progressive tool descriptor: ${name10}`);
+    }
+    result.set(name10, {
+      name: name10,
+      role: raw.role,
+      requiresCapabilities: sortedUnique(raw.requiresCapabilities ?? [])
+    });
+  }
+  return result;
+}
+function profileAllows(descriptor2, capabilities) {
+  return (descriptor2.requiresCapabilities ?? []).every((capability) => capabilities.has(capability));
+}
+function compileProgressiveToolPolicy(input) {
+  const descriptors2 = descriptorMap(input.tools);
+  const capabilities = new Set(sortedUnique(input.profile.capabilities));
+  const allowed = /* @__PURE__ */ new Set();
+  const unavailable = /* @__PURE__ */ new Set();
+  let dispatcherName = null;
+  for (const descriptor2 of descriptors2.values()) {
+    if (!profileAllows(descriptor2, capabilities)) {
+      unavailable.add(descriptor2.name);
+      continue;
+    }
+    allowed.add(descriptor2.name);
+    if (descriptor2.role === "dispatcher") {
+      if (dispatcherName !== null) {
+        throw new Error(`Progressive tool policy permits only one dispatcher: ${dispatcherName}, ${descriptor2.name}`);
+      }
+      dispatcherName = descriptor2.name;
+    }
+  }
+  const alwaysVisible = /* @__PURE__ */ new Set();
+  const deferred = /* @__PURE__ */ new Set();
+  for (const name10 of sortedUnique(allowed)) {
+    const descriptor2 = descriptors2.get(name10);
+    if (descriptor2.role === "dispatcher")
+      continue;
+    if (descriptor2.role === "specialized")
+      deferred.add(name10);
+    else
+      alwaysVisible.add(name10);
+  }
+  const requestedPromotions = sortedUnique([...input.promotions ?? []].filter((promotion) => promotion.source === "tool_search").map((promotion) => promotion.toolName));
+  const promoted = /* @__PURE__ */ new Set();
+  const rejectedPromotions = [];
+  const maximumPromotedTools = positiveLimit(input.profile.maximumPromotedTools, DEFAULT_MAXIMUM_PROMOTED_TOOLS);
+  for (const name10 of requestedPromotions) {
+    const descriptor2 = descriptors2.get(name10);
+    if (!descriptor2) {
+      rejectedPromotions.push({ toolName: name10, reason: "not-registered" });
+      continue;
+    }
+    if (!allowed.has(name10)) {
+      rejectedPromotions.push({
+        toolName: name10,
+        reason: "profile-capability-denied"
+      });
+      continue;
+    }
+    if (descriptor2.role !== "specialized") {
+      rejectedPromotions.push({ toolName: name10, reason: "not-specialized" });
+      continue;
+    }
+    if (promoted.size >= maximumPromotedTools) {
+      rejectedPromotions.push({
+        toolName: name10,
+        reason: "promotion-budget-exceeded"
+      });
+      continue;
+    }
+    promoted.add(name10);
+    deferred.delete(name10);
+  }
+  const dispatcherRequired = deferred.size > 0;
+  if (dispatcherRequired) {
+    if (!dispatcherName) {
+      throw new Error("Deferred tools require an allowed tool_search dispatcher.");
+    }
+    alwaysVisible.add(dispatcherName);
+  } else if (dispatcherName) {
+    unavailable.add(dispatcherName);
+  }
+  const maximumAlwaysVisibleTools = positiveLimit(input.profile.maximumAlwaysVisibleTools, DEFAULT_MAXIMUM_ALWAYS_VISIBLE_TOOLS);
+  if (alwaysVisible.size > maximumAlwaysVisibleTools) {
+    throw new Error(`Progressive tool core exceeds profile budget (${alwaysVisible.size}/${maximumAlwaysVisibleTools}) for ${input.profile.id}.`);
+  }
+  const alwaysVisibleNames = sortedUnique(alwaysVisible);
+  const promotedNames = sortedUnique(promoted);
+  const deferredNames = sortedUnique(deferred);
+  const unavailableNames = sortedUnique(unavailable);
+  const inline = sortedUnique([...alwaysVisibleNames, ...promotedNames]);
+  const identity3 = JSON.stringify({
+    profileId: input.profile.id,
+    capabilities: sortedUnique(capabilities),
+    alwaysVisible: alwaysVisibleNames,
+    promoted: promotedNames,
+    deferred: deferredNames,
+    unavailable: unavailableNames
+  });
+  return {
+    schema: "omnius.progressive-tool-policy.v1",
+    revision: createHash35("sha256").update(identity3).digest("hex").slice(0, 16),
+    profileId: input.profile.id,
+    alwaysVisible: alwaysVisibleNames,
+    promoted: promotedNames,
+    inline,
+    deferred: deferredNames,
+    unavailable: unavailableNames,
+    rejectedPromotions,
+    dispatcherRequired,
+    dispatcher: dispatcherRequired ? dispatcherName : null,
+    authority: "execution-enforced-separately"
+  };
+}
+function progressiveToolExposureMap(plan) {
+  const result = /* @__PURE__ */ new Map();
+  const alwaysVisible = new Set(plan.alwaysVisible);
+  for (const name10 of plan.inline) {
+    result.set(name10, plan.dispatcherRequired && alwaysVisible.has(name10) && name10 === plan.dispatcher ? "dispatcher" : "inline");
+  }
+  for (const name10 of plan.deferred)
+    result.set(name10, "deferred");
+  return result;
+}
+function measureProgressiveToolSchemas(input) {
+  const definitions = /* @__PURE__ */ new Map();
+  for (const entry of input.definitions) {
+    const name10 = normalizedName(entry.name);
+    if (name10)
+      definitions.set(name10, entry.definition);
+  }
+  const permitted = sortedUnique([...input.plan.inline, ...input.plan.deferred]);
+  const baselineDefinitions = permitted.map((name10) => definitions.get(name10)).filter((definition) => definition !== void 0);
+  const inlineDefinitions = input.plan.inline.map((name10) => definitions.get(name10)).filter((definition) => definition !== void 0);
+  const deferredCatalog = input.deferredCatalog ?? { deferred_tools: input.plan.deferred };
+  const baselineBytes = Buffer.byteLength(JSON.stringify({ tools: baselineDefinitions }), "utf8");
+  const inlineSchemaBytes = Buffer.byteLength(JSON.stringify({ tools: inlineDefinitions }), "utf8");
+  const deferredIndexBytes = input.plan.dispatcherRequired ? Buffer.byteLength(JSON.stringify(deferredCatalog), "utf8") : 0;
+  const progressiveBytes = inlineSchemaBytes + deferredIndexBytes;
+  const savedBytes = Math.max(0, baselineBytes - progressiveBytes);
+  return {
+    baselineBytes,
+    progressiveBytes,
+    inlineSchemaBytes,
+    deferredIndexBytes,
+    savedBytes,
+    savedRatio: baselineBytes > 0 ? savedBytes / baselineBytes : 0,
+    estimatedBaselineTokens: Math.ceil(baselineBytes / 2),
+    estimatedProgressiveTokens: Math.ceil(progressiveBytes / 2),
+    estimatedSavedTokens: Math.max(0, Math.ceil(baselineBytes / 2) - Math.ceil(progressiveBytes / 2))
+  };
+}
+var DEFAULT_MAXIMUM_ALWAYS_VISIBLE_TOOLS, DEFAULT_MAXIMUM_PROMOTED_TOOLS;
+var init_tool_exposure_policy = __esm({
+  "packages/orchestrator/dist/tool-exposure-policy.js"() {
+    "use strict";
+    DEFAULT_MAXIMUM_ALWAYS_VISIBLE_TOOLS = 8;
+    DEFAULT_MAXIMUM_PROMOTED_TOOLS = 8;
+  }
+});
+
 // packages/orchestrator/dist/textSanitize.js
 function cleanScaffolding(text3) {
   if (text3 == null)
@@ -626608,7 +626788,7 @@ var init_integrationClosure = __esm({
 });
 
 // packages/orchestrator/dist/operational-world/reducer.js
-import { createHash as createHash35 } from "node:crypto";
+import { createHash as createHash36 } from "node:crypto";
 function clone(value2) {
   return structuredClone(value2);
 }
@@ -626625,7 +626805,7 @@ function canonicalJson(value2) {
   return JSON.stringify(canonicalize(value2));
 }
 function sha2566(value2) {
-  return createHash35("sha256").update(canonicalJson(value2)).digest("hex");
+  return createHash36("sha256").update(canonicalJson(value2)).digest("hex");
 }
 function graphHash(graph) {
   return sha2566(graph);
@@ -627398,9 +627578,9 @@ var init_persistence = __esm({
 });
 
 // packages/orchestrator/dist/operational-world/reasoningSlice.js
-import { createHash as createHash36 } from "node:crypto";
+import { createHash as createHash37 } from "node:crypto";
 function stableSliceId(graph, focusNodeIds) {
-  const digest4 = createHash36("sha256").update(`${graph.graphId}
+  const digest4 = createHash37("sha256").update(`${graph.graphId}
 ${graph.revision}
 ${[...focusNodeIds].sort().join("\n")}`).digest("hex").slice(0, 20);
   return `reasoning-slice:${digest4}`;
@@ -627730,10 +627910,10 @@ var init_reasoningSlice = __esm({
 });
 
 // packages/orchestrator/dist/operational-world/workGraphProjection.js
-import { createHash as createHash37 } from "node:crypto";
+import { createHash as createHash38 } from "node:crypto";
 function compactId(prefix, value2) {
   const clean7 = String(value2 ?? "").trim().toLowerCase().replace(/[^a-z0-9_.:-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[-.:]+|[-.:]+$/g, "").slice(0, 180);
-  const digest4 = createHash37("sha256").update(String(value2)).digest("hex").slice(0, 12);
+  const digest4 = createHash38("sha256").update(String(value2)).digest("hex").slice(0, 12);
   return `${prefix}:${clean7 || "item"}:${digest4}`.slice(0, 256);
 }
 function edgeId2(kind, source, target) {
@@ -628641,9 +628821,9 @@ var init_workGraphProjection = __esm({
 });
 
 // packages/orchestrator/dist/operational-world/controller.js
-import { createHash as createHash38 } from "node:crypto";
+import { createHash as createHash39 } from "node:crypto";
 function graphId(value2) {
-  const digest4 = createHash38("sha256").update(value2).digest("hex").slice(0, 20);
+  const digest4 = createHash39("sha256").update(value2).digest("hex").slice(0, 20);
   return `work-graph:${digest4}`;
 }
 function validIso(value2) {
@@ -628884,7 +629064,7 @@ var init_run_frontier = __esm({
 });
 
 // packages/orchestrator/dist/capability-contract.js
-import { createHash as createHash39 } from "node:crypto";
+import { createHash as createHash40 } from "node:crypto";
 function normalized2(value2) {
   return String(value2 ?? "").trim().toLowerCase();
 }
@@ -628917,7 +629097,7 @@ function buildRuntimeCapabilityContract(tools, groups = {}, exposureByName = /*
   });
   return {
     schema: "omnius.runtime-capability-contract.v1",
-    revision: createHash39("sha256").update(identity3).digest("hex").slice(0, 16),
+    revision: createHash40("sha256").update(identity3).digest("hex").slice(0, 16),
     tools: entries2,
     groups: activeGroups
   };
@@ -629530,14 +629710,14 @@ var init_completionAutoFinalize = __esm({
 // packages/orchestrator/dist/completionFinalization.js
 import { existsSync as existsSync98, mkdirSync as mkdirSync60, readFileSync as readFileSync77, renameSync as renameSync16, unlinkSync as unlinkSync22, writeFileSync as writeFileSync52 } from "node:fs";
 import { dirname as dirname40, join as join109 } from "node:path";
-import { createHash as createHash40 } from "node:crypto";
+import { createHash as createHash41 } from "node:crypto";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function clean4(value2, max) {
   return String(value2 ?? "").replace(/\s+/g, " ").trim().slice(0, max);
 }
 function sha256File5(path16) {
   try {
-    return createHash40("sha256").update(readFileSync77(path16)).digest("hex");
+    return createHash41("sha256").update(readFileSync77(path16)).digest("hex");
   } catch {
     return null;
   }
@@ -629653,7 +629833,7 @@ function buildCompletionFinalizationRecord(input) {
   return {
     schema: "omnius.completion-finalization.v1",
     phase: "prepared",
-    id: `terminal-${createHash40("sha256").update(identity3).digest("hex").slice(0, 20)}`,
+    id: `terminal-${createHash41("sha256").update(identity3).digest("hex").slice(0, 20)}`,
     runId: input.runId,
     ...typeof input.taskEpoch === "number" ? { taskEpoch: input.taskEpoch } : {},
     status: input.status,
@@ -632503,7 +632683,7 @@ Do not claim certified ASD-STE100 conformance without a qualified human review.`
 });
 
 // packages/orchestrator/dist/reference-contracts.js
-import { createHash as createHash41 } from "node:crypto";
+import { createHash as createHash42 } from "node:crypto";
 function compactSource(source, maxChars) {
   const normalized4 = source.replace(/\r\n/g, "\n").trim();
   if (normalized4.length <= maxChars)
@@ -632523,7 +632703,7 @@ function explicitContractIds(explicitModules = []) {
 }
 function renderContract(definition, phase, reason) {
   const source = loadPrompt(`reference-contracts/${definition.sourcePath}`);
-  const sourceHash = createHash41("sha256").update(source).digest("hex");
+  const sourceHash = createHash42("sha256").update(source).digest("hex");
   const body = compactSource(source, definition.maxChars);
   const rendered = [
     "[REFERENCE CONTRACT v1]",
@@ -632735,7 +632915,7 @@ var init_phase_skill_guidance = __esm({
 });
 
 // packages/orchestrator/dist/deliveryCoverage.js
-import { createHash as createHash42 } from "node:crypto";
+import { createHash as createHash43 } from "node:crypto";
 import { existsSync as existsSync100, readFileSync as readFileSync80 } from "node:fs";
 import { join as join112 } from "node:path";
 import { z as z18 } from "zod";
@@ -632753,7 +632933,7 @@ function duplicates(values) {
   return [...out];
 }
 function manifestHash(manifest) {
-  return createHash42("sha256").update(JSON.stringify(manifest)).digest("hex");
+  return createHash43("sha256").update(JSON.stringify(manifest)).digest("hex");
 }
 function requiredLayers(state5) {
   if (state5 === "simulation_only")
@@ -633594,14 +633774,14 @@ var init_artifact_inspector = __esm({
 // packages/orchestrator/dist/lesson-bank.js
 import { existsSync as existsSync102, mkdirSync as mkdirSync61, appendFileSync as appendFileSync7, readFileSync as readFileSync81 } from "node:fs";
 import { join as join113, dirname as dirname41 } from "node:path";
-import { createHash as createHash43 } from "node:crypto";
+import { createHash as createHash44 } from "node:crypto";
 function tokenize5(text3) {
   if (!text3)
     return [];
   return text3.toLowerCase().split(TOKENIZE_RE).filter((t2) => t2.length >= 3).slice(0, 80);
 }
 function shortHash(s2) {
-  return createHash43("sha256").update(s2).digest("hex").slice(0, 16);
+  return createHash44("sha256").update(s2).digest("hex").slice(0, 16);
 }
 function solicit(args) {
   const { taskGoal, stem, reflections, successOutputPreview } = args;
@@ -633697,7 +633877,7 @@ var init_lesson_bank = __esm({
 // packages/orchestrator/dist/intervention-replay.js
 import { existsSync as existsSync103, mkdirSync as mkdirSync62, readFileSync as readFileSync82, writeFileSync as writeFileSync53, readdirSync as readdirSync32 } from "node:fs";
 import { join as join114, dirname as dirname42 } from "node:path";
-import { createHash as createHash44 } from "node:crypto";
+import { createHash as createHash45 } from "node:crypto";
 function checkpointDir2(workingDir) {
   return workingDir ? join114(workingDir, ".omnius", "checkpoints") : join114(process.env["HOME"] || ".", ".omnius", "checkpoints");
 }
@@ -633731,7 +633911,7 @@ function sanitizeMessagesForCheckpoint(messages2) {
       deduped.push(m2);
       continue;
     }
-    const digest4 = createHash44("sha1").update(content).digest("hex");
+    const digest4 = createHash45("sha1").update(content).digest("hex");
     if (seenSystemDigests.has(digest4))
       continue;
     seenSystemDigests.add(digest4);
@@ -637454,12 +637634,12 @@ var init_codeGraphLink = __esm({
 });
 
 // packages/orchestrator/dist/artifactContract.js
-import { createHash as createHash45 } from "node:crypto";
+import { createHash as createHash46 } from "node:crypto";
 function shortHash3(content) {
   if (!content)
     return "empty";
   try {
-    return createHash45("sha256").update(content.slice(0, 4096)).digest("hex").slice(0, 8);
+    return createHash46("sha256").update(content.slice(0, 4096)).digest("hex").slice(0, 8);
   } catch {
     let h = 2166136261;
     for (let i2 = 0; i2 < Math.min(content.length, 4096); i2++) {
@@ -642101,7 +642281,7 @@ ${body}
 });
 
 // packages/orchestrator/dist/contentAddressedArtifactStore.js
-import { createHash as createHash46 } from "node:crypto";
+import { createHash as createHash47 } from "node:crypto";
 import { existsSync as existsSync112, mkdirSync as mkdirSync67, readFileSync as readFileSync89, readdirSync as readdirSync35, renameSync as renameSync18, statSync as statSync42, unlinkSync as unlinkSync23, writeFileSync as writeFileSync58 } from "node:fs";
 import { join as join122, resolve as resolve58, sep as sep7 } from "node:path";
 function contentAddressedArtifactStoreRoot(cwd4 = process.cwd(), stateDir) {
@@ -642126,7 +642306,7 @@ function parseArtifactReference(reference) {
   return hash2;
 }
 function sha2567(content) {
-  return createHash46("sha256").update(content, "utf8").digest("hex");
+  return createHash47("sha256").update(content, "utf8").digest("hex");
 }
 function byteLength(content) {
   return Buffer.byteLength(content, "utf8");
@@ -642419,7 +642599,7 @@ var init_contentAddressedArtifactStore = __esm({
 });
 
 // packages/orchestrator/dist/request-budget.js
-import { createHash as createHash47 } from "node:crypto";
+import { createHash as createHash48 } from "node:crypto";
 function canonical(value2) {
   if (value2 === null)
     return "null";
@@ -642488,7 +642668,7 @@ function compileOutboundRequestBudget(input) {
   const freeTokens = Math.max(0, modelContextTokens - projectedTotalTokens);
   const freeRatio = modelContextTokens > 0 ? freeTokens / modelContextTokens : 0;
   const requestPayloadFingerprint = payloadFingerprint(auditRequest);
-  const requestFingerprint = createHash47("sha256").update(canonical({ requestPayloadFingerprint, modelContextTokens, outputReservationTokens, safetyMarginTokens: safetyMarginTokens2 })).digest("hex");
+  const requestFingerprint = createHash48("sha256").update(canonical({ requestPayloadFingerprint, modelContextTokens, outputReservationTokens, safetyMarginTokens: safetyMarginTokens2 })).digest("hex");
   return { schemaVersion: 1, requestFingerprint, requestPayloadFingerprint, modelContextTokens, serializedRequestBytes, serializedMessagesBytes, serializedToolSchemaBytes, ...totals, toolSchemaTokens, requestEnvelopeTokens, outputReservationTokens, safetyMarginTokens: safetyMarginTokens2, totalInputTokens, projectedTotalTokens, freeTokens, freeRatio, compactionEligible: modelContextTokens > 0 && freeRatio < 0.4 };
 }
 function snapshotOutboundRequest(request) {
@@ -642506,7 +642686,7 @@ var init_request_budget = __esm({
     contentText = (content) => typeof content === "string" ? content : canonical(content);
     estimateTokens3 = (value2) => value2 ? Math.ceil(value2.length / 4) + 4 : 0;
     serializedBytes = (value2) => Buffer.byteLength(JSON.stringify(value2 ?? null), "utf8");
-    payloadFingerprint = (value2) => createHash47("sha256").update(canonical(value2)).digest("hex");
+    payloadFingerprint = (value2) => createHash48("sha256").update(canonical(value2)).digest("hex");
     RequestFingerprintCache = class {
       values = /* @__PURE__ */ new Map();
       get(fingerprint3) {
@@ -642579,7 +642759,7 @@ var init_context_dump_security = __esm({
 import { existsSync as existsSync113, mkdirSync as mkdirSync68, readdirSync as readdirSync36, readFileSync as readFileSync90, statSync as statSync43, unlinkSync as unlinkSync24, writeFileSync as writeFileSync59, appendFileSync as appendFileSync9, chmodSync as chmodSync5, closeSync as closeSync2, openSync as openSync2, readSync, renameSync as renameSync19 } from "node:fs";
 import { homedir as homedir36 } from "node:os";
 import { join as join123, resolve as resolve59 } from "node:path";
-import { createHash as createHash48 } from "node:crypto";
+import { createHash as createHash49 } from "node:crypto";
 function contextWindowDumpDir(cwd4 = process.cwd()) {
   const envDir = process.env["OMNIUS_CONTEXT_WINDOW_DUMP_DIR"]?.trim();
   if (envDir)
@@ -643178,7 +643358,7 @@ function safeId(value2) {
   return String(value2 || "unknown").replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 160);
 }
 function shortHash4(value2) {
-  return createHash48("sha256").update(value2).digest("hex").slice(0, 10);
+  return createHash49("sha256").update(value2).digest("hex").slice(0, 10);
 }
 function writePrivateFileAtomic(filePath, payload) {
   const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
@@ -643639,12 +643819,12 @@ var init_adversaryStream = __esm({
 });
 
 // packages/orchestrator/dist/context-admission.js
-import { createHash as createHash49 } from "node:crypto";
+import { createHash as createHash50 } from "node:crypto";
 function canonical2(value2) {
   return JSON.stringify(value2 ?? null);
 }
 function fingerprint(request) {
-  return createHash49("sha256").update(canonical2(request)).digest("hex");
+  return createHash50("sha256").update(canonical2(request)).digest("hex");
 }
 function deepClone(value2) {
   return JSON.parse(JSON.stringify(value2));
@@ -644499,7 +644679,7 @@ var init_memory_compiler = __esm({
 
 // packages/orchestrator/dist/debugArtifactLibrary.js
 import { appendFileSync as appendFileSync10, existsSync as existsSync114, mkdirSync as mkdirSync69, readFileSync as readFileSync91, statSync as statSync44, writeFileSync as writeFileSync60 } from "node:fs";
-import { createHash as createHash50 } from "node:crypto";
+import { createHash as createHash51 } from "node:crypto";
 import { basename as basename24, join as join124, relative as relative15, resolve as resolve60 } from "node:path";
 function debugArtifactRoot(cwd4 = process.cwd(), stateDir) {
   const envDir = process.env["OMNIUS_DEBUG_ARTIFACT_DIR"]?.trim();
@@ -645342,7 +645522,7 @@ function safeId2(value2) {
   return String(value2 || "unknown").replace(/[^a-zA-Z0-9_.:-]/g, "_").slice(0, 160);
 }
 function shortHash5(value2) {
-  return createHash50("sha256").update(value2).digest("hex").slice(0, 10);
+  return createHash51("sha256").update(value2).digest("hex").slice(0, 10);
 }
 var DEBUG_LIBRARY_DIR, RUN_EVENTS_LIMIT, PREVIEW_LIMIT;
 var init_debugArtifactLibrary = __esm({
@@ -647600,7 +647780,7 @@ var init_domainDetector = __esm({
 });
 
 // packages/orchestrator/dist/compile-error-fix-loop.js
-import { createHash as createHash51 } from "node:crypto";
+import { createHash as createHash52 } from "node:crypto";
 import path7 from "node:path";
 function rankCompilerDiagnostics(diags) {
   const normalized4 = diags.map((diag, index) => ({
@@ -647881,7 +648061,7 @@ function isCompileFixDiagnostic(value2) {
   return Boolean(value2 && typeof value2.fingerprint === "string" && typeof value2.rank === "number");
 }
 function shortHash6(value2) {
-  return createHash51("sha256").update(value2).digest("hex").slice(0, 10);
+  return createHash52("sha256").update(value2).digest("hex").slice(0, 10);
 }
 function fence(value2) {
   return ["```", value2.trim(), "```"].join("\n");
@@ -648761,7 +648941,7 @@ var init_completion_resolution_verifier = __esm({
 });
 
 // packages/orchestrator/dist/evidenceBranch.js
-import { createHash as createHash52 } from "node:crypto";
+import { createHash as createHash53 } from "node:crypto";
 function buildBranchExtractionBrief(input) {
   const path16 = cleanBriefText(input.path, 320) || "the requested file";
   const intent = fileLocalDiscoveryQuestion(firstBriefText([
@@ -649013,7 +649193,7 @@ function parseExtraction(raw) {
   };
 }
 function sha2568(text3) {
-  return createHash52("sha256").update(text3).digest("hex");
+  return createHash53("sha256").update(text3).digest("hex");
 }
 function lineNumberedExcerpt(lines, startIndex, endIndex, sourceLineOffset, maxLineChars = 240) {
   return lines.slice(startIndex, endIndex + 1).map((line, index) => {
@@ -649998,7 +650178,7 @@ var init_prompt_cache = __esm({
 
 // packages/orchestrator/dist/git-progress.js
 import { existsSync as existsSync115, readFileSync as readFileSync92, statSync as statSync45 } from "node:fs";
-import { createHash as createHash53 } from "node:crypto";
+import { createHash as createHash54 } from "node:crypto";
 import { relative as relative16, resolve as resolve61, sep as sep8 } from "node:path";
 function isRunnerOwnedGitPath(path16) {
   const normalized4 = normalizeGitPath(path16);
@@ -650025,7 +650205,7 @@ function pathHash(repoRoot, relPath) {
     const st = statSync45(absolute);
     if (!st.isFile())
       return `non-file:${st.size}:${Math.floor(st.mtimeMs)}`;
-    return createHash53("sha256").update(readFileSync92(absolute)).digest("hex");
+    return createHash54("sha256").update(readFileSync92(absolute)).digest("hex");
   } catch {
     return void 0;
   }
@@ -650417,7 +650597,7 @@ __export(preflightSnapshot_exports, {
 import { existsSync as existsSync116, readFileSync as readFileSync93, statSync as statSync46, statfsSync as statfsSync6 } from "node:fs";
 import { homedir as homedir37, platform as platform8, arch as arch7, totalmem as totalmem4, freemem as freemem3, hostname as hostname3 } from "node:os";
 import { join as join125 } from "node:path";
-import { createHash as createHash54 } from "node:crypto";
+import { createHash as createHash55 } from "node:crypto";
 function capturePreflightSnapshot(workingDir) {
   const warnings = [];
   const configFingerprints = {};
@@ -650586,7 +650766,7 @@ function expandPath(p2) {
   return p2;
 }
 function sha2569(s2) {
-  return createHash54("sha256").update(s2).digest("hex").slice(0, 16);
+  return createHash55("sha256").update(s2).digest("hex").slice(0, 16);
 }
 function freeDiskBytes(path16 = "/tmp") {
   try {
@@ -652394,13 +652574,25 @@ function brokerQueueDeadlineResponse(err) {
     return null;
   }
   const record = payload;
-  if (record["error"] !== "broker queue deadline expired" || typeof record["request_id"] !== "string" || !record["request_id"] || !record["queue"] || typeof record["queue"] !== "object" || Array.isArray(record["queue"])) {
+  const error = record["error"];
+  const isLegacyError = error === BROKER_QUEUE_DEADLINE_ERROR;
+  const annotationPrefix = `${BROKER_QUEUE_DEADLINE_ERROR}:`;
+  const isAnnotatedError = typeof error === "string" && error.startsWith(annotationPrefix);
+  const retryable = record["retryable"];
+  const reasonCode = record["reason_code"];
+  if (!isLegacyError && !isAnnotatedError || typeof record["request_id"] !== "string" || !record["request_id"] || !record["queue"] || typeof record["queue"] !== "object" || Array.isArray(record["queue"]) || retryable !== void 0 && retryable !== true || reasonCode !== void 0 && typeof reasonCode !== "string") {
     return null;
   }
+  const detail = isAnnotatedError ? error.slice(annotationPrefix.length).trim() : "";
+  if (isAnnotatedError && !detail)
+    return null;
   return {
-    error: "broker queue deadline expired",
+    error: BROKER_QUEUE_DEADLINE_ERROR,
     request_id: record["request_id"],
-    queue: record["queue"]
+    queue: record["queue"],
+    ...detail ? { detail } : {},
+    ...retryable === true ? { retryable: true } : {},
+    ...typeof reasonCode === "string" ? { reason_code: reasonCode } : {}
   };
 }
 function brokerQueueRetryDelayMs(attempt, entropy = Math.random()) {
@@ -652686,11 +652878,12 @@ function classifyThinkOutcome(raw) {
   }
   return null;
 }
-var PRESERVE_MODEL_VISIBLE_HISTORY, TOOL_SUBSETS, TOOL_AUTO_DEMOTE_TURNS, LEGACY_ACTION_REASON_KEYS, CLAIM_TASK_STOPWORDS, TASK_COMPLETE_CLOSEOUT_DESCRIPTION, SYSTEM_PROMPT_COMMON, SYSTEM_PROMPT, SYSTEM_PROMPT_MEDIUM, SYSTEM_PROMPT_SMALL, VISUAL_TOOLS, AUDIO_TOOLS, SOCIAL_TOOLS, SPATIAL_TOOLS, CODE_TOOLS, AgenticRunner, InferenceHttpError, OllamaAgenticBackend;
+var PRESERVE_MODEL_VISIBLE_HISTORY, TOOL_SUBSETS, TOOL_AUTO_DEMOTE_TURNS, LEGACY_ACTION_REASON_KEYS, CLAIM_TASK_STOPWORDS, TASK_COMPLETE_CLOSEOUT_DESCRIPTION, SYSTEM_PROMPT_COMMON, SYSTEM_PROMPT, SYSTEM_PROMPT_MEDIUM, SYSTEM_PROMPT_SMALL, VISUAL_TOOLS, AUDIO_TOOLS, SOCIAL_TOOLS, SPATIAL_TOOLS, CODE_TOOLS, AgenticRunner, BROKER_QUEUE_DEADLINE_ERROR, InferenceHttpError, OllamaAgenticBackend;
 var init_agenticRunner = __esm({
   "packages/orchestrator/dist/agenticRunner.js"() {
     "use strict";
     init_contextBudget();
+    init_tool_exposure_policy();
     init_textSanitize();
     init_text_echo_guard();
     init_permissionRuleset();
@@ -654884,6 +655077,10 @@ runtime_module_sha256=${record.runtimeProvenance.module.sha256 ?? "unknown"}`
           compactionPercent: options2?.compactionPercent,
           deepContext: options2?.deepContext ?? false,
           dynamicContext: options2?.dynamicContext ?? "",
+          progressiveToolPolicy: options2?.progressiveToolPolicy ?? {
+            profile: { id: "legacy", capabilities: [] },
+            descriptors: []
+          },
           memoryPrefix: options2?.memoryPrefix ?? "",
           memoryPrefixHash: options2?.memoryPrefixHash ?? "",
           stateDir: options2?.stateDir ?? "",
@@ -663240,6 +663437,23 @@ Rewrite it now for ${ctx3.model}.`;
           this.registerTool(tool);
         }
       }
+      /**
+       * Replace turn-varying system context and the complete tool registry before
+       * a sequential reuse of this runner. This prevents stale authorization,
+       * relationship context, message-bound tool closures, and promoted schemas
+       * from leaking across Telegram action turns.
+       */
+      prepareReusableRun(configuration) {
+        this.options.dynamicContext = String(configuration.dynamicContext ?? "");
+        this.tools.clear();
+        this._activatedTools.clear();
+        this._toolLastUsedTurn.clear();
+        this._activeCapabilityContract = null;
+        this.registerTools(configuration.tools);
+        if (configuration.workingDirectory !== void 0) {
+          this.setWorkingDirectory(configuration.workingDirectory);
+        }
+      }
       lookupRegisteredTool(name10) {
         const raw = String(name10 ?? "").trim();
         if (!raw)
@@ -668531,8 +668745,8 @@ If you're stuck, try a completely different approach. Do NOT repeat what failed
               if (process.env["OMNIUS_DISABLE_ADAPTIVE_RETRIEVAL"] !== "1") {
                 const goalForSig = (this._taskState.goal || "").slice(0, 200);
                 const recentTools = this._toolSequence.slice(-5).join("|");
-                const { createHash: createHash80 } = await import("node:crypto");
-                const sig = createHash80("sha256").update(`${goalForSig}::${recentTools}`).digest("hex").slice(0, 16);
+                const { createHash: createHash81 } = await import("node:crypto");
+                const sig = createHash81("sha256").update(`${goalForSig}::${recentTools}`).digest("hex").slice(0, 16);
                 if (this._lastPprSig === sig && this._lastPprMemoryLines.length > 0) {
                   compacted.push({
                     role: "system",
@@ -672538,6 +672752,7 @@ ${sr.result.output}`;
                 concurrencySafe: this.resolveToolConcurrencySafe(tc.name, tc.arguments)
               }));
               const batches = partitionToolCalls(batchToolCalls);
+              let progressiveToolExposureChanged = false;
               for (const batch2 of batches) {
                 if (this.aborted || this._pendingSteeringPreemption)
                   break;
@@ -672575,6 +672790,9 @@ ${sr.result.output}`;
                 }, 5);
                 for (const r2 of results) {
                   if (r2) {
+                    if (r2.success && r2.tc.name === "tool_search") {
+                      progressiveToolExposureChanged = true;
+                    }
                     messages2.push(this.buildModelFacingToolMessage(r2.output, r2.tc.id, r2.tc.name, r2.tc.arguments, r2.success));
                     void r2.systemGuidance;
                     if (r2.tc.name === "task_complete") {
@@ -672641,6 +672859,9 @@ ${sr.result.output}`;
                 if (completed || this._completionIncompleteVerification)
                   break;
               }
+              if (progressiveToolExposureChanged && !completed && !this._completionIncompleteVerification) {
+                toolDefs = await this.buildToolDefinitions();
+              }
             }
             if (completed || this._completionIncompleteVerification)
               break;
@@ -679100,7 +679321,7 @@ ${transcript}`
       async buildToolDefinitions() {
         const allTools = Array.from(this.tools.values()).filter((tool) => tool.name !== "tool_search");
         const capabilityContract = buildRuntimeCapabilityContract(allTools, TOOL_SUBSETS);
-        const activeSubsetCatalog = capabilityContract.groups;
+        let activeSubsetCatalog = capabilityContract.groups;
         const tier = this.options.modelTier ?? "large";
         const taskGoal = this._taskState.goal || "";
         const STOPWORDS4 = /* @__PURE__ */ new Set([
@@ -679294,7 +679515,35 @@ Example: ${tool.name}(${JSON.stringify(meta.examples[0].args ?? {})})` : "";
         }
         scored.sort((a2, b) => b.score - a2.score);
         const maxInlineExtra = tier === "small" ? 4 : 8;
-        const inlineExtras = scored.slice(0, maxInlineExtra).filter((s2) => s2.score > 0);
+        const progressiveConfiguration = this.options.progressiveToolPolicy.descriptors.length > 0 ? this.options.progressiveToolPolicy : null;
+        const progressivePlan = progressiveConfiguration ? compileProgressiveToolPolicy({
+          profile: progressiveConfiguration.profile,
+          tools: [
+            ...allTools.map((tool) => progressiveConfiguration.descriptors.find((descriptor2) => descriptor2.name === tool.name) ?? {
+              name: tool.name,
+              role: "specialized"
+            }),
+            progressiveConfiguration.descriptors.find((descriptor2) => descriptor2.name === "tool_search") ?? {
+              name: "tool_search",
+              role: "dispatcher"
+            }
+          ],
+          promotions: [...this._activatedTools].map((toolName) => ({
+            source: "tool_search",
+            toolName
+          }))
+        }) : null;
+        if (progressivePlan) {
+          const permitted = /* @__PURE__ */ new Set([
+            ...progressivePlan.inline,
+            ...progressivePlan.deferred
+          ]);
+          activeSubsetCatalog = Object.fromEntries(Object.entries(activeSubsetCatalog).map(([name10, names]) => [
+            name10,
+            names.filter((toolName) => permitted.has(toolName))
+          ]).filter(([, names]) => names.length > 0));
+        }
+        const inlineExtras = progressivePlan || this._isTelegramSurface() ? [] : scored.slice(0, maxInlineExtra).filter((s2) => s2.score > 0);
         const currentTurn = this._taskState.toolCallCount;
         let demoted = 0;
         for (const promoted of this._activatedTools) {
@@ -679311,12 +679560,12 @@ Example: ${tool.name}(${JSON.stringify(meta.examples[0].args ?? {})})` : "";
             timestamp: (/* @__PURE__ */ new Date()).toISOString()
           });
         }
-        const inlineNames = /* @__PURE__ */ new Set([
+        const inlineNames = progressivePlan ? new Set(progressivePlan.inline.filter((name10) => name10 !== "tool_search")) : /* @__PURE__ */ new Set([
           ...allTools.filter((t2) => CORE_TOOLS3.has(t2.name)).map((t2) => t2.name),
           ...inlineExtras.map((s2) => s2.tool.name),
           ...Array.from(this._activatedTools).filter((name10) => allTools.some((t2) => t2.name === name10))
         ]);
-        const deferred = allTools.filter((t2) => !inlineNames.has(t2.name));
+        const deferred = progressivePlan ? allTools.filter((tool) => progressivePlan.deferred.includes(tool.name)) : allTools.filter((t2) => !inlineNames.has(t2.name));
         const inlineTools = allTools.filter((t2) => inlineNames.has(t2.name));
         const seen = /* @__PURE__ */ new Set();
         const dedupedInline = inlineTools.filter((t2) => {
@@ -680316,6 +680565,7 @@ arguments=` : ""}` + (chunk.toolCallArgs ?? "");
         });
       }
     };
+    BROKER_QUEUE_DEADLINE_ERROR = "broker queue deadline expired";
     InferenceHttpError = class extends Error {
       transport;
       status;
@@ -681397,7 +681647,7 @@ var init_operational_world2 = __esm({
 });
 
 // packages/orchestrator/dist/memory-compiler-replay.js
-import { createHash as createHash55 } from "node:crypto";
+import { createHash as createHash56 } from "node:crypto";
 function stableStringify3(value2) {
   if (value2 === null || typeof value2 !== "object")
     return JSON.stringify(value2);
@@ -681407,7 +681657,7 @@ function stableStringify3(value2) {
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify3(object[key])}`).join(",")}}`;
 }
 function fingerprint2(value2) {
-  return createHash55("sha256").update(stableStringify3(value2)).digest("hex");
+  return createHash56("sha256").update(stableStringify3(value2)).digest("hex");
 }
 function estimateTokens5(chars) {
   return chars > 0 ? Math.ceil(chars / 4) + 4 : 0;
@@ -683255,7 +683505,7 @@ var init_composite_scorer = __esm({
 });
 
 // packages/orchestrator/dist/memory/materialization-policy.js
-import { createHash as createHash56 } from "node:crypto";
+import { createHash as createHash57 } from "node:crypto";
 function materializeMemoryItems(items, options2 = {}) {
   const config = options2.config ?? DEFAULT_WEIGHTING_CONFIG;
   const sorted = [...items].sort((a2, b) => b.weight - a2.weight || a2.id.localeCompare(b.id));
@@ -683493,7 +683743,7 @@ function estimateTokens6(text3) {
   return Math.max(1, Math.ceil(text3.length / 4));
 }
 function hashText2(text3) {
-  return createHash56("sha256").update(text3).digest("hex");
+  return createHash57("sha256").update(text3).digest("hex");
 }
 var init_materialization_policy = __esm({
   "packages/orchestrator/dist/memory/materialization-policy.js"() {
@@ -683657,7 +683907,7 @@ var init_config_loader = __esm({
 });
 
 // packages/orchestrator/dist/memory/stability-tracker.js
-import { createHash as createHash57 } from "node:crypto";
+import { createHash as createHash58 } from "node:crypto";
 import { existsSync as existsSync120, mkdirSync as mkdirSync70, readFileSync as readFileSync96, writeFileSync as writeFileSync62 } from "node:fs";
 import { dirname as dirname47, join as join129 } from "node:path";
 function stabilityFilePath(repoRoot) {
@@ -683721,7 +683971,7 @@ function computeStabilityHash(item) {
     item.scope.name,
     item.topicKey
   ].join("|");
-  return createHash57("sha256").update(normalized4).digest("hex");
+  return createHash58("sha256").update(normalized4).digest("hex");
 }
 function normalizeContent2(content) {
   return content.replace(/\s+/g, " ").trim();
@@ -687756,10 +688006,10 @@ var init_project_arc = __esm({
 });
 
 // packages/orchestrator/dist/dedup-gate.js
-import { createHash as createHash58 } from "node:crypto";
+import { createHash as createHash59 } from "node:crypto";
 function fingerprintCall(name10, args) {
   const canon = canonicalize2(args);
-  return createHash58("sha1").update(`${name10}\0${canon}`).digest("hex").slice(0, 16);
+  return createHash59("sha1").update(`${name10}\0${canon}`).digest("hex").slice(0, 16);
 }
 function canonicalize2(value2) {
   if (value2 === null || typeof value2 !== "object")
@@ -688721,9 +688971,9 @@ var init_subagent_prompt = __esm({
 });
 
 // packages/orchestrator/dist/memory-compiler-trace-import.js
-import { createHash as createHash59 } from "node:crypto";
+import { createHash as createHash60 } from "node:crypto";
 function digest3(value2) {
-  return createHash59("sha256").update(value2).digest("hex");
+  return createHash60("sha256").update(value2).digest("hex");
 }
 function stable(value2) {
   if (value2 === null || typeof value2 !== "object")
@@ -689030,6 +689280,7 @@ __export(dist_exports3, {
   commitTerminalTrajectoryProjection: () => commitTerminalTrajectoryProjection,
   compileOutboundRequestBudget: () => compileOutboundRequestBudget,
   compilePersonalityPrompt: () => compilePersonalityPrompt,
+  compileProgressiveToolPolicy: () => compileProgressiveToolPolicy,
   completionEvidenceDirective: () => completionEvidenceDirective,
   completionFinalizationPath: () => completionFinalizationPath,
   completionFinalizationPreparePath: () => completionFinalizationPreparePath,
@@ -689167,6 +689418,7 @@ __export(dist_exports3, {
   mapClaimsToSpans: () => mapClaimsToSpans,
   materializeMemoryItems: () => materializeMemoryItems,
   measureContextSNR: () => measureContextSNR,
+  measureProgressiveToolSchemas: () => measureProgressiveToolSchemas,
   memoryCosine: () => cosine7,
   mergeDigests: () => mergeDigests,
   mintClaimScopeToken: () => mintClaimScopeToken,
@@ -689199,6 +689451,7 @@ __export(dist_exports3, {
   pressureCheck: () => pressureCheck,
   profileIntensity: () => profileIntensity,
   profileLabel: () => profileLabel,
+  progressiveToolExposureMap: () => progressiveToolExposureMap,
   purgeOldSidecars: () => purgeOldSidecars,
   readContextWindowDump: () => readContextWindowDump,
   readFeaturesManifest: () => readFeaturesManifest,
@@ -689329,6 +689582,7 @@ var init_dist8 = __esm({
     init_mergeRunner();
     init_retryController();
     init_agenticRunner();
+    init_tool_exposure_policy();
     init_ste_communication_policy();
     init_operational_world2();
     init_request_budget();
@@ -690976,7 +691230,7 @@ __export(tray_exports, {
   verifyTrayHelper: () => verifyTrayHelper
 });
 import { spawn as spawn34, spawnSync as spawnSync9 } from "node:child_process";
-import { createHash as createHash60 } from "node:crypto";
+import { createHash as createHash61 } from "node:crypto";
 import {
   closeSync as closeSync5,
   chmodSync as chmodSync6,
@@ -691188,7 +691442,7 @@ function helperBinaryName(platform13 = process.platform) {
   return null;
 }
 function sha256File6(path16) {
-  return createHash60("sha256").update(readFileSync105(path16)).digest("hex");
+  return createHash61("sha256").update(readFileSync105(path16)).digest("hex");
 }
 function verifyTrayHelper() {
   const binName = helperBinaryName();
@@ -703601,7 +703855,7 @@ var require_websocket3 = __commonJS({
     var http6 = __require("http");
     var net5 = __require("net");
     var tls2 = __require("tls");
-    var { randomBytes: randomBytes32, createHash: createHash80 } = __require("crypto");
+    var { randomBytes: randomBytes32, createHash: createHash81 } = __require("crypto");
     var { Duplex: Duplex3, Readable: Readable2 } = __require("stream");
     var { URL: URL3 } = __require("url");
     var PerMessageDeflate3 = require_permessage_deflate3();
@@ -704261,7 +704515,7 @@ var require_websocket3 = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest4 = createHash80("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash81("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest4) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -704628,7 +704882,7 @@ var require_websocket_server2 = __commonJS({
     var EventEmitter15 = __require("events");
     var http6 = __require("http");
     var { Duplex: Duplex3 } = __require("stream");
-    var { createHash: createHash80 } = __require("crypto");
+    var { createHash: createHash81 } = __require("crypto");
     var extension3 = require_extension3();
     var PerMessageDeflate3 = require_permessage_deflate3();
     var subprotocol3 = require_subprotocol2();
@@ -704929,7 +705183,7 @@ var require_websocket_server2 = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest4 = createHash80("sha1").update(key + GUID).digest("base64");
+        const digest4 = createHash81("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -712410,14 +712664,14 @@ var init_voice_session = __esm({
 });
 
 // packages/cli/src/tui/scoped-personality.ts
-import { createHash as createHash61 } from "node:crypto";
+import { createHash as createHash62 } from "node:crypto";
 import { appendFileSync as appendFileSync14, existsSync as existsSync136, mkdirSync as mkdirSync85, readFileSync as readFileSync113, writeFileSync as writeFileSync75 } from "node:fs";
 import { join as join146, resolve as resolve68 } from "node:path";
 function safeName(input) {
   return input.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 80) || "default";
 }
 function scopeHash(scope) {
-  return createHash61("sha1").update(`${scope.kind}:${scope.id}`).digest("hex").slice(0, 16);
+  return createHash62("sha1").update(`${scope.kind}:${scope.id}`).digest("hex").slice(0, 16);
 }
 function scopedPersonalityDir(repoRoot, kind) {
   return resolve68(repoRoot, ".omnius", "scoped-personality", kind);
@@ -712788,7 +713042,7 @@ var init_scoped_personality = __esm({
 });
 
 // packages/cli/src/tui/voice-soul.ts
-import { createHash as createHash62 } from "node:crypto";
+import { createHash as createHash63 } from "node:crypto";
 import { existsSync as existsSync137, readdirSync as readdirSync42, readFileSync as readFileSync114 } from "node:fs";
 import { basename as basename27, join as join147, resolve as resolve69 } from "node:path";
 function compactText(text3, limit2) {
@@ -712803,7 +713057,7 @@ function blockText(text3, limit2) {
 ... [truncated]`;
 }
 function scopeStateKey(scope, surface) {
-  return createHash62("sha1").update(`${surface}:${scope.kind}:${scope.id}`).digest("hex").slice(0, 16);
+  return createHash63("sha1").update(`${surface}:${scope.kind}:${scope.id}`).digest("hex").slice(0, 16);
 }
 function safeName2(input) {
   return input.replace(/[^A-Za-z0-9_.-]/g, "-").slice(0, 80) || "default";
@@ -715463,7 +715717,7 @@ var init_types3 = __esm({
 });
 
 // packages/cli/src/tui/p2p/secret-vault.ts
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes23, scryptSync as scryptSync2, createHash as createHash63 } from "node:crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes23, scryptSync as scryptSync2, createHash as createHash64 } from "node:crypto";
 import { readFileSync as readFileSync116, writeFileSync as writeFileSync77, existsSync as existsSync139, mkdirSync as mkdirSync87 } from "node:fs";
 import { dirname as dirname54 } from "node:path";
 var PLACEHOLDER_PREFIX, PLACEHOLDER_SUFFIX, CIPHER_ALGO, SALT_LEN, IV_LEN, KEY_LEN, SecretVault;
@@ -715707,7 +715961,7 @@ var init_secret_vault = __esm({
       /** Generate a deterministic fingerprint of vault contents (for sync verification) */
       fingerprint() {
         const names = Array.from(this.secrets.keys()).sort();
-        const hash2 = createHash63("sha256");
+        const hash2 = createHash64("sha256");
         for (const name10 of names) {
           hash2.update(name10 + ":");
           hash2.update(this.secrets.get(name10).value);
@@ -715722,7 +715976,7 @@ var init_secret_vault = __esm({
 // packages/cli/src/tui/p2p/peer-mesh.ts
 import { EventEmitter as EventEmitter9 } from "node:events";
 import { createServer as createServer6 } from "node:http";
-import { randomBytes as randomBytes24, createHash as createHash64, generateKeyPairSync } from "node:crypto";
+import { randomBytes as randomBytes24, createHash as createHash65, generateKeyPairSync } from "node:crypto";
 var PING_INTERVAL_MS, PEER_TIMEOUT_MS, GOSSIP_INTERVAL_MS, MAX_PEERS, PeerMesh;
 var init_peer_mesh = __esm({
   "packages/cli/src/tui/p2p/peer-mesh.ts"() {
@@ -715738,7 +715992,7 @@ var init_peer_mesh = __esm({
         const { publicKey: publicKey2, privateKey } = generateKeyPairSync("ed25519");
         this.publicKey = publicKey2.export({ type: "spki", format: "der" });
         this.privateKey = privateKey.export({ type: "pkcs8", format: "der" });
-        this.peerId = createHash64("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
+        this.peerId = createHash65("sha256").update(this.publicKey).digest("base64url").slice(0, 22);
         this.capabilities = options2.capabilities;
         this.displayName = options2.displayName;
         this._authKey = options2.authKey ?? randomBytes24(24).toString("base64url");
@@ -717348,7 +717602,7 @@ __export(omnius_directory_exports, {
 import { appendFileSync as appendFileSync15, cpSync as cpSync2, existsSync as existsSync141, mkdirSync as mkdirSync89, readFileSync as readFileSync118, writeFileSync as writeFileSync79, readdirSync as readdirSync45, statSync as statSync57, unlinkSync as unlinkSync33, openSync as openSync9, closeSync as closeSync9, renameSync as renameSync24, watch as fsWatch3 } from "node:fs";
 import { join as join151, relative as relative19, basename as basename28, dirname as dirname55, resolve as resolve70 } from "node:path";
 import { homedir as homedir48 } from "node:os";
-import { createHash as createHash66 } from "node:crypto";
+import { createHash as createHash67 } from "node:crypto";
 function isGitRoot(dir) {
   const gitPath = join151(dir, ".git");
   if (!existsSync141(gitPath)) return false;
@@ -717581,7 +717835,7 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
     visited.add(dir);
     for (const name10 of CONTEXT_FILES) {
       const filePath = join151(dir, name10);
-      const normalizedName = name10.toLowerCase();
+      const normalizedName2 = name10.toLowerCase();
       if (existsSync141(filePath) && !seen.has(filePath)) {
         seen.add(filePath);
         try {
@@ -717589,7 +717843,7 @@ function discoverContextFiles(repoRoot, maxContentLen = 8e3) {
           if (content.length > maxContentLen) {
             content = content.slice(0, maxContentLen) + "\n\n...(truncated)";
           }
-          const type = normalizedName.includes("agents") ? "agents" : normalizedName === "omnius.md" || normalizedName === ".omnius.md" ? "omnius" : normalizedName.includes("claude") ? "claude" : normalizedName.includes("readme") ? "readme" : normalizedName.includes("architect") ? "architecture" : normalizedName.includes("contribut") ? "contributing" : "other";
+          const type = normalizedName2.includes("agents") ? "agents" : normalizedName2 === "omnius.md" || normalizedName2 === ".omnius.md" ? "omnius" : normalizedName2.includes("claude") ? "claude" : normalizedName2.includes("readme") ? "readme" : normalizedName2.includes("architect") ? "architecture" : normalizedName2.includes("contribut") ? "contributing" : "other";
           found.push({
             path: relative19(repoRoot, filePath) || name10,
             content,
@@ -717846,7 +718100,7 @@ function buildHandoffPrompt(repoRoot) {
   return lines.join("\n");
 }
 function computeDedupeHash(task, savedAt) {
-  return createHash66("sha256").update(`${task}|${savedAt}`).digest("hex").slice(0, 16);
+  return createHash67("sha256").update(`${task}|${savedAt}`).digest("hex").slice(0, 16);
 }
 function generateSessionId() {
   const timestamp = Date.now().toString(36);
@@ -740907,7 +741161,7 @@ var init_voice_room_dsp = __esm({
 
 // packages/cli/src/tui/voicebox.ts
 import {
-  createHash as createHash67,
+  createHash as createHash68,
   randomUUID as randomUUID31
 } from "node:crypto";
 import {
@@ -741067,7 +741321,7 @@ function packageAssetPath(...segments) {
 }
 function fileHash(path16) {
   try {
-    return createHash67("sha256").update(readFileSync133(path16)).digest("hex");
+    return createHash68("sha256").update(readFileSync133(path16)).digest("hex");
   } catch {
     return null;
   }
@@ -741458,13 +741712,13 @@ async function resolveProfile(option, cloneRefPath, referenceTranscript, languag
     if (!stat10.isFile() || stat10.size < 64 || stat10.size > 32 * 1024 * 1024) {
       throw new Error("Voicebox clone reference must be a regular audio file between 64 bytes and 32 MiB");
     }
-    key = createHash67("sha256").update(`${option.id}
+    key = createHash68("sha256").update(`${option.id}
 ${clonePath}
 ${stat10.size}
 ${stat10.mtimeMs}
 ${referenceTranscript}`).digest("hex");
   } else {
-    key = createHash67("sha256").update(`${option.id}
+    key = createHash68("sha256").update(`${option.id}
 ${language}
 ${option.presetVoiceId ?? ""}`).digest("hex");
   }
@@ -746765,7 +747019,7 @@ __export(commands_exports, {
 });
 import * as nodeOs from "node:os";
 import { spawn as nodeSpawn2 } from "node:child_process";
-import { createHash as createHash68 } from "node:crypto";
+import { createHash as createHash69 } from "node:crypto";
 import {
   existsSync as existsSync162,
   readFileSync as readFileSync135,
@@ -760610,7 +760864,7 @@ async function collectSponsorMediaStream(args) {
     };
   }
   if (artifact.sha256) {
-    const sha = createHash68("sha256").update(bytes2).digest("hex");
+    const sha = createHash69("sha256").update(bytes2).digest("hex");
     if (sha !== artifact.sha256)
       return { ok: false, error: `Artifact hash mismatch for ${artifactId}` };
   }
@@ -775413,7 +775667,7 @@ var init_telegram_command_menu = __esm({
 });
 
 // packages/cli/src/tui/telegram-public-media.ts
-import { createHash as createHash69, randomBytes as randomBytes27 } from "node:crypto";
+import { createHash as createHash70, randomBytes as randomBytes27 } from "node:crypto";
 import { lookup as dnsLookup2 } from "node:dns/promises";
 import { link, mkdir as mkdir23, unlink as unlink4, writeFile as writeFile27 } from "node:fs/promises";
 import { request as httpsRequest2 } from "node:https";
@@ -776034,7 +776288,7 @@ ${output2}`,
           responseContentType(response.headers),
           kind
         );
-        const sha25610 = createHash69("sha256").update(response.body).digest("hex");
+        const sha25610 = createHash70("sha256").update(response.body).digest("hex");
         if (this.acquiredFiles >= MAX_ACQUIRED_FILES_PER_RUN) {
           throw new Error(
             `Rejected media: this run already acquired ${MAX_ACQUIRED_FILES_PER_RUN} files.`
@@ -777577,7 +777831,7 @@ import {
   unlinkSync as unlinkSync43
 } from "node:fs";
 import { join as join184 } from "node:path";
-import { createHash as createHash70 } from "node:crypto";
+import { createHash as createHash71 } from "node:crypto";
 function safeFilePart(value2) {
   return value2.replace(/[^A-Za-z0-9_.-]+/g, "_").slice(0, 80) || "telegram";
 }
@@ -777585,7 +777839,7 @@ function daydreamRoot(repoRoot) {
   return join184(repoRoot, ".omnius", "telegram-daydreams");
 }
 function sessionDir(repoRoot, sessionKey) {
-  const hash2 = createHash70("sha1").update(sessionKey).digest("hex").slice(0, 20);
+  const hash2 = createHash71("sha1").update(sessionKey).digest("hex").slice(0, 20);
   return join184(daydreamRoot(repoRoot), safeFilePart(hash2));
 }
 function compactLine2(value2, max = 220) {
@@ -777696,7 +777950,7 @@ function buildReplyOpportunities(input, openQuestions) {
   return opportunities;
 }
 function daydreamOpportunityId(input, trigger) {
-  return createHash70("sha1").update(`${input.sessionKey}:${input.generatedAtMs}:${trigger}`).digest("hex").slice(0, 16);
+  return createHash71("sha1").update(`${input.sessionKey}:${input.generatedAtMs}:${trigger}`).digest("hex").slice(0, 16);
 }
 function clamp0116(value2) {
   if (!Number.isFinite(value2)) return 0;
@@ -778101,7 +778355,7 @@ function buildTelegramChannelDaydream(input, corpus, extraction, extractionCommi
   const seed = `${input.sessionKey}:${input.generatedAtMs}:${input.history.length}`;
   return {
     version: 3,
-    id: createHash70("sha1").update(seed).digest("hex").slice(0, 16),
+    id: createHash71("sha1").update(seed).digest("hex").slice(0, 16),
     sessionKey: input.sessionKey,
     chatId: input.chatId,
     chatTitle: input.chatTitle,
@@ -778413,12 +778667,12 @@ var init_telegram_channel_dmn = __esm({
 });
 
 // packages/cli/src/tui/telegram-reflection-corpus.ts
-import { createHash as createHash71 } from "node:crypto";
+import { createHash as createHash72 } from "node:crypto";
 function telegramReflectionMemoryDbPaths(repoRoot) {
   return omniusMemoryDbPaths(repoRoot);
 }
 function stableHash2(value2, length4 = 16) {
-  return createHash71("sha1").update(value2).digest("hex").slice(0, length4);
+  return createHash72("sha1").update(value2).digest("hex").slice(0, length4);
 }
 function clean5(value2) {
   return String(value2 ?? "").replace(/\s+/g, " ").trim();
@@ -779231,7 +779485,7 @@ var init_telegram_reflection_extraction = __esm({
 });
 
 // packages/cli/src/tui/telegram-social-state-types.ts
-import { createHash as createHash72 } from "node:crypto";
+import { createHash as createHash73 } from "node:crypto";
 function telegramSocialActorKey(actor) {
   if (!actor) return "unknown";
   if (typeof actor.userId === "number") return `user:${actor.userId}`;
@@ -779267,7 +779521,7 @@ function appendUnique(items, value2, max) {
   return next.slice(-max);
 }
 function hashTelegramSocialId(parts) {
-  return createHash72("sha1").update(parts.map((part) => String(part ?? "")).join(":")).digest("hex").slice(0, 16);
+  return createHash73("sha1").update(parts.map((part) => String(part ?? "")).join(":")).digest("hex").slice(0, 16);
 }
 function cleanUsername(value2) {
   if (typeof value2 !== "string") return void 0;
@@ -780522,7 +780776,7 @@ var init_telegram_social_state = __esm({
 });
 
 // packages/cli/src/tui/telegram-social-event-log.ts
-import { createHash as createHash73 } from "node:crypto";
+import { createHash as createHash74 } from "node:crypto";
 import {
   appendFileSync as appendFileSync21,
   existsSync as existsSync175,
@@ -780531,7 +780785,7 @@ import {
 } from "node:fs";
 import { join as join185, resolve as resolve82 } from "node:path";
 function stableEventId2(type, sessionKey, occurredAt, payload) {
-  return createHash73("sha256").update(JSON.stringify({ type, sessionKey, occurredAt, payload })).digest("hex").slice(0, 24);
+  return createHash74("sha256").update(JSON.stringify({ type, sessionKey, occurredAt, payload })).digest("hex").slice(0, 24);
 }
 function createTelegramSocialEvent(type, payload, recordedAt = Date.now()) {
   const sessionKey = String(payload.sessionKey);
@@ -780547,7 +780801,7 @@ function createTelegramSocialEvent(type, payload, recordedAt = Date.now()) {
   };
 }
 function telegramSocialEventLogPath(repoRoot, sessionKey) {
-  const scope = createHash73("sha256").update(sessionKey).digest("hex").slice(0, 24);
+  const scope = createHash74("sha256").update(sessionKey).digest("hex").slice(0, 24);
   return resolve82(repoRoot, ".omnius", "telegram-social-events", `${scope}.jsonl`);
 }
 function appendTelegramSocialEvent(repoRoot, event) {
@@ -781402,7 +781656,7 @@ import {
   mkdir as mkdirAsync,
   writeFile as writeFileAsync
 } from "node:fs/promises";
-import { createHash as createHash74, randomBytes as randomBytes29, randomInt } from "node:crypto";
+import { createHash as createHash75, randomBytes as randomBytes29, randomInt } from "node:crypto";
 function formatModelBytes(bytes2) {
   if (!Number.isFinite(bytes2) || bytes2 <= 0) return "0 B";
   const units = ["B", "KB", "MB", "GB", "TB"];
@@ -782712,7 +782966,7 @@ function buildTelegramRuntimeContext(now2 = /* @__PURE__ */ new Date(), repoRoot
   return buildConversationRuntimeContext(now2, repoRoot);
 }
 function telegramSessionIdFromKey(sessionKey) {
-  return `telegram-${createHash74("sha1").update(sessionKey).digest("hex").slice(0, 16)}`;
+  return `telegram-${createHash75("sha1").update(sessionKey).digest("hex").slice(0, 16)}`;
 }
 function normalizeTelegramSubAgentLimit(value2) {
   const parsed = typeof value2 === "number" ? value2 : typeof value2 === "string" && value2.trim() ? Number(value2.trim()) : TELEGRAM_SUB_AGENT_DEFAULT_LIMIT;
@@ -784975,6 +785229,12 @@ Telegram link integrity contract:
       telegramActiveWorkSessions = /* @__PURE__ */ new Set();
       telegramActiveWorkGenerations = /* @__PURE__ */ new Map();
       telegramActiveWorkStartedAtMs = /* @__PURE__ */ new Map();
+      /**
+       * Native Telegram typing heartbeats owned by the outer work lifecycle.
+       * Group work starts one heartbeat before attention routing and keeps it
+       * alive through the selected reply path and final delivery.
+       */
+      telegramWorkTypingIntervals = /* @__PURE__ */ new Map();
       /** Queued Telegram sessions waiting for a global work slot. */
       telegramQueuedSessionWork = /* @__PURE__ */ new Map();
       telegramQueuedSessionCompletions = /* @__PURE__ */ new Map();
@@ -785466,7 +785726,7 @@ Telegram link integrity contract:
         return !!this.adminAuthChallenge && this.adminAuthChallenge.expiresAtMs > Date.now();
       }
       hashAdminAuthCode(code8) {
-        return createHash74("sha256").update(`omnius-telegram-admin:${code8.trim()}`).digest("hex");
+        return createHash75("sha256").update(`omnius-telegram-admin:${code8.trim()}`).digest("hex");
       }
       viewIdForMessage(msg) {
         return `telegram-${this.sessionKeyForMessage(msg).replace(/[^A-Za-z0-9_-]/g, "-")}`;
@@ -785924,6 +786184,9 @@ No scoped reflection artifact exists yet for this chat. Use <code>/reflect</code
           if (idleMs <= maxIdleMs) continue;
           const generation = this.telegramActiveWorkGenerations.get(sessionKey) ?? 0;
           this.telegramActiveWorkGenerations.set(sessionKey, generation + 1);
+          const typingInterval = this.telegramWorkTypingIntervals.get(sessionKey);
+          if (typingInterval) clearInterval(typingInterval);
+          this.telegramWorkTypingIntervals.delete(sessionKey);
           this.telegramActiveWorkSessions.delete(sessionKey);
           this.telegramActiveWorkStartedAtMs.delete(sessionKey);
           this.refreshActiveTelegramInteractionCount();
@@ -786058,6 +786321,18 @@ No scoped reflection artifact exists yet for this chat. Use <code>/reflect</code
         this.telegramActiveWorkSessions.add(work.sessionKey);
         this.telegramActiveWorkStartedAtMs.set(work.sessionKey, Date.now());
         const generation = this.nextTelegramWorkGeneration(work.sessionKey);
+        let workTypingInterval = null;
+        if (work.msg.chatType !== "private" && this.canUseChatActions(work.msg)) {
+          const staleTypingInterval = this.telegramWorkTypingIntervals.get(
+            work.sessionKey
+          );
+          if (staleTypingInterval) clearInterval(staleTypingInterval);
+          workTypingInterval = this.startTypingIndicator(
+            work.msg.chatId,
+            work.msg.messageThreadId
+          );
+          this.telegramWorkTypingIntervals.set(work.sessionKey, workTypingInterval);
+        }
         this.refreshActiveTelegramInteractionCount();
         const completion = this.telegramQueuedSessionCompletions.get(
           work.sessionKey
@@ -786072,6 +786347,10 @@ No scoped reflection artifact exists yet for this chat. Use <code>/reflect</code
           );
           completion?.reject(err);
         }).finally(() => {
+          if (workTypingInterval && this.telegramWorkTypingIntervals.get(work.sessionKey) === workTypingInterval) {
+            clearInterval(workTypingInterval);
+            this.telegramWorkTypingIntervals.delete(work.sessionKey);
+          }
           this.telegramQueuedSessionCompletions.delete(work.sessionKey);
           if (this.telegramWorkGenerationIsCurrent(work.sessionKey, generation)) {
             this.telegramActiveWorkSessions.delete(work.sessionKey);
@@ -786482,7 +786761,7 @@ ${context2}` : context2;
         };
       }
       telegramIntakePath(sessionKey) {
-        const digest4 = createHash74("sha256").update(sessionKey).digest("hex").slice(0, 20);
+        const digest4 = createHash75("sha256").update(sessionKey).digest("hex").slice(0, 20);
         return join187(
           this.repoRoot ?? process.cwd(),
           ".omnius",
@@ -787977,11 +788256,11 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
         return payload;
       }
       telegramConversationPath(sessionKey) {
-        const safe = createHash74("sha1").update(sessionKey).digest("hex").slice(0, 20);
+        const safe = createHash75("sha1").update(sessionKey).digest("hex").slice(0, 20);
         return join187(this.telegramConversationDir, `${safe}.json`);
       }
       telegramConversationLedgerPath(sessionKey) {
-        const safe = createHash74("sha1").update(sessionKey).digest("hex").slice(0, 20);
+        const safe = createHash75("sha1").update(sessionKey).digest("hex").slice(0, 20);
         return join187(this.telegramConversationDir, `${safe}.events.jsonl`);
       }
       telegramDb() {
@@ -788214,7 +788493,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
           relationships: Array.isArray(raw.relationships) ? raw.relationships.slice(0, TELEGRAM_ASSOCIATIVE_RELATION_LIMIT).map((fact) => this.normalizeTelegramAssociativeFact(fact)) : [],
           actions: Array.isArray(raw.actions) ? raw.actions.slice(-TELEGRAM_ASSOCIATIVE_ACTION_LIMIT).map((action) => ({
             id: String(
-              action.id || createHash74("sha1").update(JSON.stringify(action)).digest("hex").slice(0, 12)
+              action.id || createHash75("sha1").update(JSON.stringify(action)).digest("hex").slice(0, 12)
             ),
             ts: typeof action.ts === "number" ? action.ts : Date.now(),
             role: action.role === "assistant" ? "assistant" : "user",
@@ -788233,7 +788512,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
         const now2 = Date.now();
         return {
           id: String(
-            raw.id || createHash74("sha1").update(text3 || String(now2)).digest("hex").slice(0, 12)
+            raw.id || createHash75("sha1").update(text3 || String(now2)).digest("hex").slice(0, 12)
           ),
           text: text3,
           tags: Array.isArray(raw.tags) ? raw.tags.map(String).slice(0, 16) : [],
@@ -788792,7 +789071,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
       telegramHistoryBackfillMessageId(sessionKey, entry, index) {
         if (typeof entry.messageId === "number" && Number.isFinite(entry.messageId))
           return entry.messageId;
-        const digest4 = createHash74("sha1").update(
+        const digest4 = createHash75("sha1").update(
           `${sessionKey}:${index}:${entry.role}:${entry.ts ?? ""}:${entry.text}`
         ).digest("hex").slice(0, 8);
         return -Number.parseInt(digest4, 16);
@@ -790066,7 +790345,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
         const now2 = entry.ts ?? Date.now();
         memory.updatedAt = now2;
         const speaker = telegramHistorySpeaker(entry);
-        const actionId = createHash74("sha1").update(
+        const actionId = createHash75("sha1").update(
           `${sessionKey}:${entry.role}:${entry.messageId ?? ""}:${now2}:${entry.text}`
         ).digest("hex").slice(0, 16);
         if (!memory.actions.some((action) => action.id === actionId)) {
@@ -790229,7 +790508,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
         let fact = facts.find((item) => item.text.toLowerCase() === key);
         if (!fact) {
           fact = {
-            id: createHash74("sha1").update(`${entry.chatId ?? ""}:${key}`).digest("hex").slice(0, 12),
+            id: createHash75("sha1").update(`${entry.chatId ?? ""}:${key}`).digest("hex").slice(0, 12),
             text: clean7,
             tags: telegramMemoryTags(clean7, entry.mediaSummary),
             speakers: [],
@@ -790314,7 +790593,7 @@ ${antecedents.join("\n")}` : "Immediate antecedents: none.",
           const titleTags = tags.slice(0, 4);
           const title = titleTags.length > 0 ? `${speaker} / ${titleTags.join(" ")}` : `${speaker} / conversation`;
           const card = {
-            id: createHash74("sha1").update(`${sessionKey}:${now2}:${speaker}:${text3}`).digest("hex").slice(0, 12),
+            id: createHash75("sha1").update(`${sessionKey}:${now2}:${speaker}:${text3}`).digest("hex").slice(0, 12),
             title,
             notes: [],
             tags: [],
@@ -792447,7 +792726,7 @@ arguments=` : ""}` + (chunk.toolCallArgs ?? "");
           }
         }
         if (issues.length > 0) return { decision: null, issues };
-        const decisionId = `tgdec-${createHash74("sha256").update(
+        const decisionId = `tgdec-${createHash75("sha256").update(
           JSON.stringify({
             inputId: packet.inputId,
             route: decision2.route,
@@ -792463,26 +792742,6 @@ arguments=` : ""}` + (chunk.toolCallArgs ?? "");
       validateTelegramInteractionDecision(decision2, packet) {
         return this.validateTelegramInteractionDecisionDetailed(decision2, packet).decision;
       }
-      /**
-       * Materialize fields that are logical consequences of the model's chosen
-       * reply basis. The model still decides whether to reply and why. Once it
-       * chooses direct_turn, however, asking it to repeat "self is an addressee"
-       * in two additional fields creates three representations of one decision.
-       * A disagreement between those copies must not spend another inference.
-       */
-      normalizeTelegramInteractionDecisionImplications(decision2, packet) {
-        if (decision2.replyBasis !== "direct_turn") return decision2;
-        return {
-          ...decision2,
-          addressedActorKeys: [
-            .../* @__PURE__ */ new Set([
-              ...decision2.addressedActorKeys ?? [],
-              packet.selfActorKey
-            ])
-          ],
-          selfRole: "addressee"
-        };
-      }
       bindTrustedTelegramDecision(decision2, packet) {
         const bound = {
           ...decision2,
@@ -792547,14 +792806,10 @@ arguments=` : ""}` + (chunk.toolCallArgs ?? "");
             requireShouldReply: true
           });
           if (parsed && evidencePacket) parsed.inputId = evidencePacket.inputId;
-          const normalized4 = parsed && evidencePacket ? this.normalizeTelegramInteractionDecisionImplications(
+          const validation = parsed && evidencePacket ? this.validateTelegramInteractionDecisionDetailed(
             parsed,
             evidencePacket
-          ) : parsed;
-          const validation = normalized4 && evidencePacket ? this.validateTelegramInteractionDecisionDetailed(
-            normalized4,
-            evidencePacket
-          ) : { decision: normalized4, issues: [] };
+          ) : { decision: parsed, issues: [] };
           const validated = validation.decision;
           if (!validated) {
             if (diagnostics) {
@@ -792790,6 +793045,9 @@ ${retryText}`,
             agent.typingInterval = null;
           }
           this.stopTelegramPublicProgressMessage(agent);
+          const workTypingInterval = this.telegramWorkTypingIntervals.get(sessionKey);
+          if (workTypingInterval) clearInterval(workTypingInterval);
+          this.telegramWorkTypingIntervals.delete(sessionKey);
           try {
             agent.runner?.abort?.();
           } catch {
@@ -793146,13 +793404,9 @@ ${this.quoteTelegramContextBlock(msg.text, 1200)}`
             requireShouldReply: true
           });
           if (parsed) parsed.inputId = evidencePacket.inputId;
-          const normalized4 = parsed ? this.normalizeTelegramInteractionDecisionImplications(
+          const initialValidation = parsed ? this.validateTelegramInteractionDecisionDetailed(
             parsed,
             evidencePacket
-          ) : null;
-          const initialValidation = normalized4 ? this.validateTelegramInteractionDecisionDetailed(
-            normalized4,
-            evidencePacket
           ) : {
             decision: null,
             issues: []
@@ -793550,7 +793804,7 @@ ${list}` : "No shared group target is currently known for this sender. Ask in th
       }
       telegramRunnerStateDir(sessionKey) {
         if (!this.repoRoot) return void 0;
-        const safe = createHash74("sha1").update(sessionKey).digest("hex").slice(0, 20);
+        const safe = createHash75("sha1").update(sessionKey).digest("hex").slice(0, 20);
         return join187(this.repoRoot, ".omnius", "telegram-runner-state", safe);
       }
       buildTelegramAdminOverviewContext(currentSessionKey) {
@@ -793995,6 +794249,10 @@ ${TELEGRAM_PUBLIC_ORCHESTRATOR_CONTRACT}`
           );
         }
         this.telegramQueuedSessionCompletions.clear();
+        for (const interval of this.telegramWorkTypingIntervals.values()) {
+          clearInterval(interval);
+        }
+        this.telegramWorkTypingIntervals.clear();
         this.telegramActiveWorkSessions.clear();
         this.telegramActiveWorkGenerations.clear();
         this.telegramActiveWorkStartedAtMs.clear();
@@ -794137,17 +794395,21 @@ ${TELEGRAM_PUBLIC_ORCHESTRATOR_CONTRACT}`
       }
       // ── Typing indicator ──────────────────────────────────────────────────
       /** Start sending "typing" indicator every 4 seconds */
-      startTypingIndicator(chatId) {
-        this.sendChatAction(chatId, "typing").catch(() => {
+      startTypingIndicator(chatId, messageThreadId) {
+        this.sendChatAction(chatId, "typing", messageThreadId).catch(() => {
         });
         return setInterval(() => {
-          this.sendChatAction(chatId, "typing").catch(() => {
+          this.sendChatAction(chatId, "typing", messageThreadId).catch(() => {
           });
         }, 4e3);
       }
       /** Send a chat action (typing indicator) */
-      async sendChatAction(chatId, action) {
-        await this.apiCall("sendChatAction", { chat_id: chatId, action });
+      async sendChatAction(chatId, action, messageThreadId) {
+        await this.apiCall("sendChatAction", {
+          chat_id: chatId,
+          action,
+          ...messageThreadId !== void 0 ? { message_thread_id: messageThreadId } : {}
+        });
       }
       createTelegramGenerativeProgressBridge(chatId, msg) {
         if (chatId === void 0) return void 0;
@@ -795697,8 +795959,11 @@ Join: ${newUrl}`
           subAgent.viewId,
           `✈ Telegram message from @${msg.username}: ${msg.text}`
         );
-        if (this.canUseChatActions(msg)) {
-          subAgent.typingInterval = this.startTypingIndicator(msg.chatId);
+        if (this.canUseChatActions(msg) && !this.telegramWorkTypingIntervals.has(sessionKey)) {
+          subAgent.typingInterval = this.startTypingIndicator(
+            msg.chatId,
+            msg.messageThreadId
+          );
         }
         this.tuiWrite(
           () => renderTelegramSubAgentStart(msg.username, msg.text, isAdminDM)
@@ -796058,8 +796323,11 @@ ${errMsg}`
           `route: chat (${this.interactionMode}) with admin tools`
         );
         this.subAgentViewCallbacks?.onStatus(subAgent.viewId, "running");
-        if (this.canUseChatActions(msg)) {
-          subAgent.typingInterval = this.startTypingIndicator(msg.chatId);
+        if (this.canUseChatActions(msg) && !this.telegramWorkTypingIntervals.has(sessionKey)) {
+          subAgent.typingInterval = this.startTypingIndicator(
+            msg.chatId,
+            msg.messageThreadId
+          );
         }
         this.tuiWrite(
           () => renderTelegramSubAgentEvent(
@@ -796323,8 +796591,11 @@ ${errMsg}`
           `route: chat (${this.interactionMode})`
         );
         this.subAgentViewCallbacks?.onStatus(viewId, "running");
-        if (this.canUseChatActions(msg)) {
-          typingInterval = this.startTypingIndicator(msg.chatId);
+        if (this.canUseChatActions(msg) && !this.telegramWorkTypingIntervals.has(sessionKey)) {
+          typingInterval = this.startTypingIndicator(
+            msg.chatId,
+            msg.messageThreadId
+          );
         }
         this.tuiWrite(
           () => renderTelegramSubAgentEvent(
@@ -799172,7 +799443,7 @@ Scoped workspace: ${scopedRoot}`,
         );
       }
       telegramModerationActionDigest(action) {
-        return createHash74("sha256").update(JSON.stringify(action)).digest("hex");
+        return createHash75("sha256").update(JSON.stringify(action)).digest("hex");
       }
       async requireTelegramModerationGroup(chatId) {
         const result = await this.apiCall("getChat", { chat_id: chatId });
@@ -805907,7 +806178,7 @@ import { cwd } from "node:process";
 import { resolve as resolve85, join as join190, dirname as dirname69, extname as extname23, relative as relative24, sep as sep11 } from "node:path";
 import { createRequire as createRequire9 } from "node:module";
 import { fileURLToPath as fileURLToPath33 } from "node:url";
-import { createHash as createHash75 } from "node:crypto";
+import { createHash as createHash76 } from "node:crypto";
 import {
   readFileSync as readFileSync152,
   writeFileSync as writeFileSync103,
@@ -806780,7 +807051,7 @@ function truncateSubAgentViewText(s2, n2) {
   return s2.length > n2 ? `${s2.slice(0, n2)}…` : s2;
 }
 function childAgentTaskHash(task) {
-  return createHash75("sha256").update(task).digest("hex").slice(0, 12);
+  return createHash76("sha256").update(task).digest("hex").slice(0, 12);
 }
 function stripAnsiForParentContext(value2) {
   return value2.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "");
@@ -816611,13 +816882,13 @@ ${taskInput}`;
       writeContent(() => renderError(errMsg));
       if (failureStore) {
         try {
-          const { createHash: createHash80 } = await import("node:crypto");
+          const { createHash: createHash81 } = await import("node:crypto");
           failureStore.insert({
             taskId: "",
             sessionId: `${Date.now()}`,
             repoRoot,
             failureType: "runtime-error",
-            fingerprint: createHash80("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
+            fingerprint: createHash81("sha256").update(errMsg.slice(0, 200)).digest("hex").slice(0, 16),
             filePath: null,
             errorMessage: errMsg.slice(0, 500),
             context: null,
@@ -818442,14 +818713,14 @@ var init_access_policy = __esm({
 });
 
 // packages/cli/src/api/project-preferences.ts
-import { createHash as createHash76 } from "node:crypto";
+import { createHash as createHash77 } from "node:crypto";
 import { existsSync as existsSync182, mkdirSync as mkdirSync117, readFileSync as readFileSync154, renameSync as renameSync31, writeFileSync as writeFileSync105, unlinkSync as unlinkSync46 } from "node:fs";
 import { homedir as homedir65 } from "node:os";
 import { join as join193, resolve as resolve89 } from "node:path";
 import { randomUUID as randomUUID34 } from "node:crypto";
 function projectKey(root) {
   const canonical3 = resolve89(root);
-  return createHash76("sha256").update(canonical3).digest("hex").slice(0, 16);
+  return createHash77("sha256").update(canonical3).digest("hex").slice(0, 16);
 }
 function projectDir(root) {
   return join193(PROJECTS_DIR, projectKey(root));
@@ -818540,7 +818811,7 @@ import { existsSync as existsSync183, mkdirSync as mkdirSync118, readFileSync as
 import { homedir as homedir66 } from "node:os";
 import { dirname as dirname70, join as join194 } from "node:path";
 import { fileURLToPath as fileURLToPath34 } from "node:url";
-import { createHash as createHash77 } from "node:crypto";
+import { createHash as createHash78 } from "node:crypto";
 function home() {
   return process.env["OMNIUS_HOME"]?.trim() || join194(homedir66(), ".omnius");
 }
@@ -818724,7 +818995,7 @@ async function ensureJetPackTorchvision(python2) {
       "OpenCLIP requires CUDA-compatible torchvision. Install the JetPack vendor torchvision for OMNIUS_VISION_PYTHON, or set OMNIUS_VISION_TORCHVISION_WHEEL to a local wheel and OMNIUS_VISION_TORCHVISION_WHEEL_SHA256 to its SHA-256. Generic PyPI torchvision is intentionally blocked."
     );
   }
-  const actualSha256 = createHash77("sha256").update(readFileSync155(wheel)).digest("hex");
+  const actualSha256 = createHash78("sha256").update(readFileSync155(wheel)).digest("hex");
   if (actualSha256 !== expectedSha256) {
     throw new VisionEmbeddingRuntimeError(
       "vision_runtime_not_ready",
@@ -819654,7 +819925,7 @@ var init_disk_task_output = __esm({
 });
 
 // packages/cli/src/api/http.ts
-import { createHash as createHash78 } from "node:crypto";
+import { createHash as createHash79 } from "node:crypto";
 function problemDetails(opts) {
   const p2 = {
     type: opts.type ?? "about:blank",
@@ -819717,7 +819988,7 @@ function paginated(items, page2, total) {
 }
 function computeEtag(payload) {
   const json2 = typeof payload === "string" ? payload : JSON.stringify(payload);
-  const hash2 = createHash78("sha1").update(json2).digest("hex").slice(0, 16);
+  const hash2 = createHash79("sha1").update(json2).digest("hex").slice(0, 16);
   return `W/"${hash2}"`;
 }
 function checkNotModified(req3, res, etag) {
@@ -843487,7 +843758,7 @@ import {
   readSync as readSync5,
   closeSync as closeSync12
 } from "node:fs";
-import { createHash as createHash79, randomBytes as randomBytes31, randomUUID as randomUUID35, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+import { createHash as createHash80, randomBytes as randomBytes31, randomUUID as randomUUID35, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function memoryDbPaths3(baseDir = process.cwd()) {
   const dir = join206(baseDir, ".omnius");
   return {
@@ -843513,7 +843784,7 @@ function readServerPackageIdentity() {
           return {
             version: pkg.version ?? "0.0.0",
             packagePath: pkgPath,
-            packageHash: createHash79("sha256").update(raw).digest("hex")
+            packageHash: createHash80("sha256").update(raw).digest("hex")
           };
         }
       } catch {
@@ -853315,7 +853586,7 @@ function listScheduledTasks() {
                 );
                 const enabled2 = typeof t2?.enabled === "boolean" ? t2.enabled : true;
                 const realId = typeof t2?.id === "string" && t2.id ? t2.id : null;
-                const fallbackId = createHash79("sha1").update(`${file}#${i2}`).digest("hex").slice(0, 16);
+                const fallbackId = createHash80("sha1").update(`${file}#${i2}`).digest("hex").slice(0, 16);
                 const uid = realId || fallbackId;
                 const key = `${uid}`;
                 if (seen.has(key)) return;
@@ -853453,8 +853724,8 @@ function deleteScheduledById(id2) {
     if (typeof entry?.id === "string" && entry.id && !candidates.includes(entry.id))
       candidates.push(entry.id);
     try {
-      const { createHash: createHash80 } = require4("node:crypto");
-      const fallback = createHash80("sha1").update(`${target.file}#${target.index}`).digest("hex").slice(0, 16);
+      const { createHash: createHash81 } = require4("node:crypto");
+      const fallback = createHash81("sha1").update(`${target.file}#${target.index}`).digest("hex").slice(0, 16);
       if (!candidates.includes(fallback)) candidates.push(fallback);
     } catch {
     }