tapline-host 1.6.2 → 1.7.0

package/dist/tools.js

@@ -9,7 +9,7 @@ import { clusterPercent, composeFilmstrip, diffImages, imageSize } from "./image
 import { briefLines, briefScreen } from "./brief.js";
 import { LINK_NOT_SAVED, classifyMove, placeBefore, placeNow, placeSeen } from "./places.js";
 import { NO_CHANGE_WATCH_MS, noChangeClause, noChangeNote, readPressFacts, saysNoVisibleChange, secondTapSentence, saysRequestsRunning, threwText } from "./nochange.js";
-import { alertNotes, changeParts, networkLine, describeElement, filterLogs, formatElement, formatLogAnswer, formatLogs, formatOffScreenAfterList, formatStatus, formatTree, offScreenLine } from "./format.js";
+import { alertNotes, alertSignature, changeParts, networkLine, describeElement, filterLogs, formatElement, formatLogAnswer, formatLogs, formatOffScreenAfterList, formatStatus, formatTree, offScreenLine, roleOf } from "./format.js";
 import { formatInspect, inspectResultSchema } from "./inspect.js";
 import { AUDIT_TYPES, auditResultSchema, auditTitle, formatAudit } from "./audit.js";
 import { NO_CRASH_TEXT, crashNote, disconnectNote, formatCrash } from "./crash.js";
@@ -19,19 +19,21 @@ import { ANIMATIONS_NOT_PAUSED_NOTE, ANIMATIONS_PAUSED_NOTE, afterPause, animati
 import { mapArgsError, reflexSchema, reflexWords, runMap } from "./mapcmd.js";
 import { MAX_REFLEX_FIRINGS, MAX_REFLEX_SKIPS, fireReflex, isReflexFailure, matchReflex } from "./reflexes.js";
 import { driveArgsError, driveQuietly, startProblem, driveRoute, driveTo, guardOf, parseMoveResult } from "./drive.js";
-import { substituteAccount } from "./accounts.js";
+import { mentionsVault, redactAll, redactContent, substituteAccount } from "./accounts.js";
 import { EYES, IDS_HIDDEN, Journey, DRIVE_ALLOWED, REFLEXES_ALLOWED, FAST_ANIMATIONS_ALLOWED, OPEN_URL, conditionsSchema, exportSchema, summaryLine, summaryNotes, stressSchema, survivesSchema, withoutIds, } from "./journey.js";
 import { JOURNEYS_KEPT, JourneyRecorder, findingsLine, freshFolder, pruneJourneys, screenSignature, writeReport } from "./journeyreport.js";
 import { exportRefusal, exportReport } from "./journeyexport.js";
 import { randomBytes } from "node:crypto";
 import { Confirmations } from "./confirm.js";
-import { askDone, okCaption, plainText } from "./elicit.js";
+import { askDone, draftCaption, okCaption, plainText } from "./elicit.js";
+import { createOtpService, otpReference } from "./otpclient.js";
+import { GrantBook, REACH_WORDS, elementNeverGrantable, grantCaption, grantNameBase, neverGrantable, reachesPeople } from "./grants.js";
 import { DEFAULT_POLICY, UNREADABLE_LINK, elementKey, linkReadable, linkWords, listsFor, matchWord } from "./policy.js";
 import { NO_UX_RULES, formatUxCheck, uxResultSchema } from "./uxcheck.js";
 import { CONFIRM_ERROR, MediaState, mediaShape, runMedia } from "./media.js";
 import { WIRE_TEXT_MAX, conditionsOf, holdsIn, waitParams } from "./conditions.js";
 import { caseTwin, readScript, refStep, scriptSteps } from "./script.js";
-import { escapeParams, routePathOf, routeRunner, routeScript, routeSlug, routeTyped, saveRoute, substituteSteps, variableProblem } from "./routes.js";
+import { escapeParams, loadRoute, routePathOf, routeRunner, routeScript, routeSlug, routeTyped, saveRoute, substituteSteps, variableProblem } from "./routes.js";
 import { badUnderKeys, checkUnder, formatPerfLines, perfFirstLine, perfResultSchema } from "./perf.js";
 import { EXPECT_TIMEOUT_S, MAX_STEPS, RUN_TIMEOUT_MS, RUN_TOOLS, UNDER_KEYS, describeRunStep, expectFailure, ifSchema, parseError, skippedLine, stepNotes, stepSchema, } from "./run.js";
 import { PAIR_CODE_TTL_MS, forgetLink, pairingLink } from "./pairing.js";
@@ -307,6 +309,7 @@ export const toolShapes = {
         account: z.string().optional().describe("With route: a test account's name; the tool types its values, you never see the password"),
         then: z.array(stepSchema).optional().describe("run steps that go on after arriving, in the same call"),
         by: z.enum(["any", "taps", "link"]).optional().describe('"any" (default), "taps" (roads only, never a jump) or "link" (a jump only)'),
+        look: lookField,
         brief: briefField,
         dry_run: dryRunField,
     },
@@ -517,7 +520,7 @@ function stableParams(params, result) {
 }
 /** A step that types an account's value: its text is a placeholder, kept in the script (the value never is). */
 function isAccountStep(step) {
-    return step.method === "type" && typeof step.params["text"] === "string" && step.params["text"].includes("${account.");
+    return step.method === "type" && typeof step.params["text"] === "string" && mentionsVault(step.params["text"]);
 }
 /**
  * The app refused an account's value because of the kind of field (capability `typeKind`; its `data.secure` says
@@ -781,6 +784,24 @@ function appendNote(answer, note) {
         return answer;
     return { ...answer, content: [{ type: "text", text: [top.text.trimEnd(), note].join("\n") }, ...rest] };
 }
+/** Several notes at the end of an answer, in order. */
+function appendNotes(answer, notes) {
+    return notes.reduce((done, note) => appendNote(done, note), answer);
+}
+/** Takes the notes collected so far (a call's grant notes) onto the end of the answer and empties the list. */
+function flushNotes(answer, notes) {
+    return appendNotes(answer, notes.splice(0));
+}
+/**
+ * Codes that say a request was refused before anything was touched: the host never sent it (not connected, app in the background)
+ * or the app refused it before it dispatched (target missing, not touchable, ambiguous, stale, bad arguments). Anything else
+ * (a timeout, a disconnect, an app error, a handler that threw) leaves it uncertain whether the touch was made.
+ */
+const NOT_DELIVERED_CODES = new Set(["not_found", "not_actionable", "ambiguous", "stale", "bad_params", "unsupported", "not_allowed", "not_connected", "in_background", "busy", "paused"]);
+/** True when a request's failure proves the touch was not made. */
+function notDelivered(error) {
+    return error instanceof TaplineError && NOT_DELIVERED_CODES.has(error.code);
+}
 /** The app's refusal when an alert it can't answer is open (a stand-in's own buttons are an ordinary screen). */
 const ALERT_IN_WAY = /behind_alert: (An alert is open|Tapline's own prompt is open)/;
 /** The dialog's text (§11.5): `Needs a person: <what>. I'll go on by myself when <it clears>.` */
@@ -925,6 +946,11 @@ const ELEMENT_ACTIONS = new Set(["tap", "long_press", "type_text", "toggle"]);
 const AGENT_TOUCHES = new Set(["tap", "long_press", "toggle", "back", "open_url", "swipe"]);
 /** What a call answers when the screen is not what the person was asked about (§11.3). */
 const CHANGED_WHILE_WAITING = "Error not_allowed: needs_confirmation: the screen changed while waiting for the OK; ask again.";
+/** What binds a person's OK to the draft they saw: the text. A changed draft is another question. */
+const draftBinding = (draft) => (draft === null ? "" : `|draft|${draft.text}`);
+/** What a grant offer asks for: the counts and days of a grant a person may create after allowing a touch (§19.6). */
+export const GRANT_OFFER_PER_DAY = 3;
+export const GRANT_OFFER_DAYS = 7;
 /** The tool handlers behind the MCP server. They only talk to a TaplineHost, so they are easy to test. */
 export class TaplineTools {
     host;
@@ -976,7 +1002,10 @@ export class TaplineTools {
     dialogs;
     /** Milliseconds this server spent waiting for a person's OK; run's 120 s doesn't count them (§9.3). */
     holdScope = new AsyncLocalStorage();
-    policy;
+    /** Read at each use: a host that reloads its policy (a scheduled run asks for its facts) hands every client the new one. */
+    get policy() {
+        return this.options.policy ?? DEFAULT_POLICY;
+    }
     uxRules;
     /**
      * Hook for the journey (AGENT-TOOLS 1.12 §17): gives `ux_check` the action labels of earlier screens, and is told
@@ -992,6 +1021,8 @@ export class TaplineTools {
     listed = new Set();
     /** Sessions whose previous answer had an alert open, so the next change block can say `Alert: gone`. */
     alertOpen = new Set();
+    /** What each session's open alert said in the previous answer (title, message, buttons), to see a change of the message alone. */
+    alertSeen = new Map();
     /** Per session: how many actions answered with `look: false` since the agent was last given a list or a change block. */
     unlistedActions = new Map();
     /** The route of the latest element list, for recording and checking replays. */
@@ -1025,6 +1056,17 @@ export class TaplineTools {
      * that runs inside it (its own action) can never reset or set the outer action's state.
      */
     okScope = new AsyncLocalStorage();
+    /** Whether a guarded touch's request may have reached the app (AGENT-TOOLS 1.14 §19.4): a grant's use is given back only when it surely did not. */
+    deliveryScope = new AsyncLocalStorage();
+    /** The saved routes running in this call (a drive, a replay): a grant with a `route` covers touches made inside it only (§19.1). */
+    routeScope = new AsyncLocalStorage();
+    /** True inside a route that carries `"draftsOnly": true` (§18.5, §21.3); it nests: a route inside one is drafts-only too. */
+    draftsScope = new AsyncLocalStorage();
+    /** The input the agent last typed into (§21.3): the draft's field. A secure field is never kept. */
+    lastTyped;
+    /** The grant notes of the call in flight (§19.3): they end its answer, before the call's other closing notes. */
+    grantNotes = new AsyncLocalStorage();
+    grantNoticeDone = false;
     setOk(used) {
         const state = this.okScope.getStore();
         if (state !== undefined)
@@ -1091,6 +1133,7 @@ export class TaplineTools {
     journeyBusy;
     clock;
     sleep;
+    otp;
     constructor(host, options) {
         this.host = host;
         this.options = options;
@@ -1099,10 +1142,11 @@ export class TaplineTools {
         this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
         this.confirmations = options.confirmations ?? new Confirmations();
         this.dialogs = options.dialogs;
-        this.policy = options.policy ?? DEFAULT_POLICY;
         this.uxRules = options.uxRules ?? NO_UX_RULES;
         this.actionLog = options.logDir !== undefined ? new ActionLog(options.logDir) : null;
         this.actionLog?.open();
+        this.otp = options.otp ?? createOtpService();
+        this.actionLog?.setBackstop((value) => this.backstop(value));
         this.reloadSettleMs = options.reloadSettleMs ?? 1500;
         this.stillGapMs = options.stillGapMs ?? 150;
         this.stillCapMs = options.stillCapMs ?? 2000;
@@ -1191,7 +1235,7 @@ export class TaplineTools {
     }
     /** Runs a measuring call with fast animations normal, then puts them back, and says so in the answer (E8). */
     async pausingAnimations(run) {
-        const { value, paused, failed } = await withNormalAnimations(this.host, this.host.current()?.id, async () => run());
+        const { value, paused, failed } = await withNormalAnimations(this.host, this.host.current()?.id, async () => run(), this.leased);
         return failed ? appendNote(value, ANIMATIONS_NOT_PAUSED_NOTE) : paused ? appendNote(value, ANIMATIONS_PAUSED_NOTE) : value;
     }
     /** The journey running now, for the stress moments and the report writer (AGENT-TOOLS 1.12 §17). */
@@ -1333,6 +1377,42 @@ export class TaplineTools {
         }
         return null;
     }
+    /**
+     * An agent action on the phone: behind a scheduled run's lease when another holds it, then in the live viewer's queue
+     * (a person goes first; paused refuses).
+     */
+    agentTurn(run) {
+        const control = this.options.control;
+        const go = control !== undefined ? () => control.runAgent(run) : run;
+        return this.leaseGate(go);
+    }
+    /**
+     * Behind a scheduled run's lease: another client's call waits (then answers `busy`) while the lease stands. Only the credential the
+     * run was given gets through; the client label never does (PR 12 Codex cycle 2).
+     */
+    leaseGate(run) {
+        const lease = this.options.lease;
+        if (lease === undefined)
+            return run();
+        const who = (this.clientIdFn ?? this.options.clientId)?.()?.replace(/[^\w .@/-]/g, "").slice(0, 60) ?? "";
+        return lease.run(who, run, this.holdScope.getStore()?.lease);
+    }
+    /** `sendRequest` as a value, for helpers that send requests of their own (the animation switch). */
+    leased = (...args) => this.sendRequest(...args);
+    /** Every request to the app goes through the lease check: a run's call whose lease ran out after it was queued sends nothing (§22.3). */
+    sendRequest(...args) {
+        try {
+            this.checkLease();
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        return this.host.request(...args);
+    }
+    /** Throws `lease_lost` when this call carries a lease credential that is not the standing holder's (right before something is sent). */
+    checkLease() {
+        this.options.lease?.assertCurrent(this.holdScope.getStore()?.lease);
+    }
     /** The MCP server gives the dialog once it can ask its client (the client's capabilities are known after initialize). */
     setDialogs(dialogs) {
         this.dialogs = dialogs;
@@ -1490,13 +1570,22 @@ export class TaplineTools {
         if (map === undefined)
             return fail("Error unsupported: this app reports no id of its own, so it has no map.");
         // As a `run` step a drive builds no screen of its own: the batch answers once (9.1).
-        const given = options.asStep === true ? { ...args, quiet: true } : args;
+        // `look: false` (1.13.3) answers the first line only on arrival; a step's own `look` is ignored (§9.1).
+        const { look: askedLook, ...withoutLook } = args;
+        // With `then`, the run steps answer and take the `look` (drive.ts afterThen).
+        const quietLook = options.asStep !== true && askedLook === false && args.dry_run !== true && args.then === undefined;
+        const given = options.asStep === true ? { ...withoutLook, quiet: true } : quietLook ? { ...args, quiet: true } : args;
         const services = this.driveServices(session, map);
         const routes = this.routeServices(session, args.account, args.brief);
         const drove = () => (given.route !== undefined ? driveRoute(services, routes, given) : driveTo(services, given, routes));
         // A batch keeps only `Note:` lines of a step's answer, so a repair is said as one there.
         const go = async () => {
             const answer = await drove();
+            if (quietLook && answer.isError !== true) {
+                // No list and no changes were given: the next answer's changes cover this call too, and says so.
+                this.markListUnseen();
+                this.unlistedActions.set(session.id, (this.unlistedActions.get(session.id) ?? 0) + 1);
+            }
             if (options.asStep !== true)
                 return answer;
             return { ...answer, content: answer.content.map((block) => (block.type === "text" ? { ...block, text: block.text.replace(/^Road repaired/gm, "Note: Road repaired") } : block)) };
@@ -1526,7 +1615,7 @@ export class TaplineTools {
             known: async () => (session.capabilities.includes("places") ? map.ensureKnown(session.id, () => source.request("places", {})) : (map.knownPlaces() ?? { source: "none", places: [] })),
             tree: async () => {
                 // In a user's eyes a drive reads only what is on the glass (17.1).
-                const tree = treeResultSchema.safeParse(await this.host.request("tree", this.userEyes() ? { glass: true } : {}, { sessionId: session.id }));
+                const tree = treeResultSchema.safeParse(await this.sendRequest("tree", this.userEyes() ? { glass: true } : {}, { sessionId: session.id }));
                 if (!tree.success)
                     throw new TaplineError("internal", "the app returned an element list the host could not read.");
                 return tree.data;
@@ -1537,14 +1626,34 @@ export class TaplineTools {
             screen: (line, brief) => this.withLook(session, line, false, this.briefOn(brief)),
         };
     }
+    /** Runs what a saved route does with its name in scope: a grant that names the route covers touches made inside it (§19.1). */
+    inRoute(route, run, draftsOnly = false) {
+        if (route === undefined)
+            return run();
+        const drafts = draftsOnly || this.draftsScope.getStore() === true;
+        return this.routeScope.run([...(this.routeScope.getStore() ?? []), route], () => this.draftsScope.run(drafts, run));
+    }
+    /** Whether the saved route of that name in this app's map carries `"draftsOnly": true` (§18.5). */
+    routeDraftsOnly(session, route) {
+        const map = route === undefined ? undefined : this.mapOf(session);
+        return route !== undefined && map !== undefined && loadRoute(map.folder(), route)?.draftsOnly === true;
+    }
+    /**
+     * The policy's lists for a touch. In a drafts-only route (§21.3) the words that reach other people ask a person whatever the
+     * policy file lists, so that every such touch stops at a draft.
+     */
+    touchLists(session) {
+        const lists = listsFor(this.policy, session.app);
+        return this.draftsScope.getStore() === true ? { confirm: [...lists.confirm, ...REACH_WORDS], block: lists.block } : lists;
+    }
     routeServices(session, account, brief) {
         return {
             accounts: this.options.accounts?.store ?? undefined,
             probeAccount: (field, named) => {
-                const used = this.accountText("$" + "{account." + field + "}", named, session);
+                const used = this.accountText(field.startsWith("${") ? field : "$" + "{account." + field + "}", named, session);
                 return used !== null && !used.ok ? used.message : null;
             },
-            runSteps: (steps, look) => this.run({ steps, account, brief, ...(look ? {} : { look: false }) }),
+            runSteps: (steps, look, route) => this.inRoute(route, () => this.run({ steps, account, brief, ...(look ? {} : { look: false }) }), this.routeDraftsOnly(session, route)),
             checkSteps: (steps) => {
                 // The call's account is the steps' default account here too, as when `run` runs them.
                 const before = this.runAccount;
@@ -1566,7 +1675,7 @@ export class TaplineTools {
     async driveTouch(session, call) {
         this.logExtra = undefined;
         this.actionStartedAt = Date.now();
-        const lists = listsFor(this.policy, session.app);
+        const lists = this.touchLists(session);
         const { tool, method, params } = call;
         const short = tool === "swipe" && Math.hypot(Number(params["x1"]) - Number(params["x0"]), Number(params["y1"]) - Number(params["y0"])) < 10;
         // A jump's link comes from the map, which an agent can write: its path words are checked as a link-shaped element (§11).
@@ -1609,11 +1718,14 @@ export class TaplineTools {
             waited = ready.waited;
         }
         let granted;
+        let sentDraft = false;
+        let covered;
         const wire = call.pipelined
             ? { method: "move", params: { method, params, ...(guard !== undefined ? { guard } : {}), ...(call.next !== undefined ? { next: call.next } : {}) } }
             : { method, params };
         const timeoutMs = call.pipelined ? (call.next?.capMs ?? 0) + 15_000 : undefined;
         let raw;
+        let moveSent = false;
         try {
             const run = async () => {
                 this.setOk(false);
@@ -1623,14 +1735,28 @@ export class TaplineTools {
                     if ("stop" in gate)
                         throw new PolicyStop(gate.stop);
                     granted = gate.via;
+                    sentDraft = gate.draft === true;
+                    covered = gate.grant;
+                }
+                moveSent = true;
+                try {
+                    return await this.sendRequest(wire.method, wire.params, { sessionId: session.id, ...(timeoutMs !== undefined ? { timeoutMs } : {}) });
+                }
+                catch (error) {
+                    if (notDelivered(error))
+                        moveSent = false;
+                    throw error;
                 }
-                return this.host.request(wire.method, wire.params, { sessionId: session.id, ...(timeoutMs !== undefined ? { timeoutMs } : {}) });
             };
-            raw = this.options.control ? await this.options.control.runAgent(run) : await run();
+            raw = await this.agentTurn(run);
         }
         catch (error) {
+            await this.dropPreUse(waited);
             if (error instanceof PolicyStop)
                 return { kind: "stop", answer: error.answer };
+            // The touch surely wasn't made: the grant's use is given back; a sent or uncertain one stays counted (§19.4).
+            if (covered !== undefined && !moveSent)
+                await this.releaseGrant(covered);
             this.logExtra = undefined;
             const code = error instanceof TaplineError ? error.code : "internal";
             this.showAction("agent", method, undefined, params, code, error instanceof TaplineError ? reasonOf(error.code, error.message) : undefined);
@@ -1641,11 +1767,13 @@ export class TaplineTools {
         this.showAction("agent", method, done, params);
         if (granted !== undefined)
             this.journeyRun?.noteOk(granted);
+        if (covered !== undefined)
+            this.grantNotes.getStore()?.push(covered.line);
         // A jump is a shortcut a user doesn't have; a journey whose `allow` names drive says so in its report (AGENT-TOOLS 1.13 18.12).
         if (call.of === "drive" && tool === "open_url" && this.journeyRun?.userEyes === true)
             this.journeyRun.noteShortcut({ tool: "open_url", what: url });
         const moved = call.pipelined ? parseMoveResult(raw) : { place: null };
-        return { kind: "done", place: moved.place, ...("next" in moved && moved.next !== undefined ? { next: moved.next } : {}), ...(granted !== undefined ? { via: granted } : {}) };
+        return { kind: "done", place: moved.place, ...("next" in moved && moved.next !== undefined ? { next: moved.next } : {}), ...(granted !== undefined ? { via: granted } : {}), ...(sentDraft ? { sent: true } : {}) };
     }
     /** `session_report` (AGENT-TOOLS 1.11 §16.1): where this session's calls went, and the waste in them. */
     sessionReport(args = {}) {
@@ -1668,13 +1796,18 @@ export class TaplineTools {
         const startedWith = this.host.current();
         // Reflexes fired during the call are counted for it, and said in its answer (§18.7).
         const reflexes = { fired: new Map(), lines: [] };
-        return this.noteScope.run(true, () => this.reflexScope.run(reflexes, () => {
+        const grantLines = [];
+        return this.grantNotes.run(grantLines, () => this.noteScope.run(true, () => this.reflexScope.run(reflexes, () => {
             const result = this.personScope.run(new Set(), () => this.afterMoments(run, isDrive));
-            if (result instanceof Promise) {
-                return result.then((answer) => this.withReflexLines(this.withAccountsNote(this.withPersonNote(this.withCrashNotes(answer, mark, startedWith))), reflexes));
+            const finish = (answer) => this.withReflexLines(this.withAccountsNote(this.withPersonNote(this.withCrashNotes(flushNotes(answer, grantLines), mark, startedWith))), reflexes);
+            // The first answer of a session with grants says which grant is refused, and whether the state file is broken (§19.1, §19.4).
+            if (this.options.grants !== undefined && !this.grantNoticeDone) {
+                this.grantNoticeDone = true;
+                const grants = this.options.grants;
+                return Promise.resolve(result).then(async (answer) => finish(appendNotes(answer, GrantBook.noticeLines(await grants.inspect()))));
             }
-            return this.withReflexLines(this.withAccountsNote(this.withPersonNote(this.withCrashNotes(result, mark, startedWith))), reflexes);
-        }));
+            return result instanceof Promise ? result.then(finish) : finish(result);
+        })));
     }
     /** What reflexes did in the call in flight: how often each fired, and the lines the answer carries. */
     reflexScope = new AsyncLocalStorage();
@@ -1718,7 +1851,7 @@ export class TaplineTools {
             let tree;
             let place;
             try {
-                const read = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }));
+                const read = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }));
                 if (!read.success)
                     break;
                 tree = read.data;
@@ -1790,7 +1923,7 @@ export class TaplineTools {
         if ("index" in t || "ref" in t || "x" in t || !("testID" in t || "label" in t || "text" in t))
             return null;
         try {
-            const read = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }));
+            const read = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }));
             return read.success ? candidatesFor(target, read.data.elements) : null;
         }
         catch {
@@ -1978,7 +2111,7 @@ export class TaplineTools {
         const session = this.host.current();
         if (session === undefined)
             return null;
-        const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+        const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
         return tree.success ? (tree.data.alerts ?? []).find((alert) => !alert.standIn) ?? null : null;
     }
     /**
@@ -2009,15 +2142,19 @@ export class TaplineTools {
     /** The first answer of the session says an accounts file was refused (it sits in a git repo), once (AGENT-TOOLS 1.13 §18.6). */
     withAccountsNote(answer) {
         const loaded = this.options.accounts;
-        if (this.accountsNoteDone || loaded === undefined || loaded.store !== null)
+        if (this.accountsNoteDone || loaded === undefined)
+            return answer;
+        // A plain vault file carries its warning (§20.2); a refused one says why.
+        const line = loaded.store !== null ? loaded.note : `Note: ${loaded.blocked}`;
+        if (line === undefined)
             return answer;
         if (answer.content[0]?.type !== "text")
             return answer;
         this.accountsNoteDone = true;
         // An answer that is the refusal itself already says it.
-        if (answer.content[0].text.includes(loaded.blocked))
+        if (loaded.store === null && answer.content[0].text.includes(loaded.blocked))
             return answer;
-        return appendNote(answer, `Note: ${loaded.blocked}`);
+        return appendNote(answer, line);
     }
     /** The first call has been answered, so the "needs a person" note has had its turn. */
     personNoteDone = false;
@@ -2390,6 +2527,10 @@ export class TaplineTools {
                 const used = typeof typed === "string" ? this.accountText(typed, typeof named === "string" ? named : undefined, session) : null;
                 if (used !== null && !used.ok)
                     return fail(`Error ${used.code}: step ${i + 1} (${describeRunStep(step)}): ${used.message}`);
+                // A one-time code names the connected app and nothing else (§20.4); nothing is asked of the daemon before the step runs.
+                const wrongApp = typeof typed === "string" ? this.otpPrecheck(typed, session) : null;
+                if (wrongApp !== null)
+                    return fail(`Error bad_params: step ${i + 1} (${describeRunStep(step)}): ${wrongApp}`);
                 // `as` is checked before any step runs too (§18.5): it goes only while a route records.
                 const as = params.as;
                 const badAs = typeof as === "string" ? this.asRefusal(as, typeof typed === "string" ? typed : "", typeof named === "string" ? named : undefined) : null;
@@ -2560,7 +2701,7 @@ export class TaplineTools {
             let holds;
             if (once) {
                 try {
-                    const raw = await this.host.request("waitFor", params, { sessionId: session.id });
+                    const raw = await this.sendRequest("waitFor", params, { sessionId: session.id });
                     holds = typeof raw === "object" && raw !== null && raw.found === true;
                 }
                 catch {
@@ -2569,7 +2710,7 @@ export class TaplineTools {
                 }
             }
             else {
-                const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+                const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
                 holds = tree.success ? holdsIn(tree.data.elements, condition) : true;
             }
             if (!holds)
@@ -2679,7 +2820,7 @@ export class TaplineTools {
         const session = this.host.current();
         if (session === undefined)
             return null;
-        const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+        const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
         return tree.success && tree.data.route !== undefined ? tree.data.route.names : null;
     }
     /** Null when the expectation holds within its time; else how it failed. */
@@ -2707,7 +2848,7 @@ export class TaplineTools {
         const until = Date.now() + seconds * 1000;
         let actual;
         for (;;) {
-            const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+            const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
             const element = tree.success
                 ? tree.data.elements.find((el) => (e.id !== undefined ? el.testID === e.id : labelOfElement(el).toLowerCase() === (e.label ?? "").toLowerCase()))
                 : undefined;
@@ -2733,7 +2874,7 @@ export class TaplineTools {
             return this.notConnected();
         let raw;
         try {
-            raw = await this.host.request("inspect", { target: toWireTarget(args.target) }, { sessionId: session.id });
+            raw = await this.sendRequest("inspect", { target: toWireTarget(args.target) }, { sessionId: session.id });
         }
         catch (error) {
             return fail(describeError(error));
@@ -2741,7 +2882,7 @@ export class TaplineTools {
         const parsed = inspectResultSchema.safeParse(raw);
         if (!parsed.success)
             return fail("Error internal: the app returned an inspect answer the host could not read.");
-        return text(formatInspect(parsed.data));
+        return text(formatInspect(parsed.data, undefined, (t) => this.scrubSecrets(t)));
     }
     // -- audit (AGENT-TOOLS 1.8 §10)
     async audit(args = {}) {
@@ -2753,7 +2894,7 @@ export class TaplineTools {
         }
         let raw;
         try {
-            raw = await this.host.request("audit", args.types !== undefined ? { types: args.types } : {}, { sessionId: session.id });
+            raw = await this.sendRequest("audit", args.types !== undefined ? { types: args.types } : {}, { sessionId: session.id });
         }
         catch (error) {
             return fail(describeError(error));
@@ -2779,7 +2920,7 @@ export class TaplineTools {
         const earlier = this.uxJourney?.earlier() ?? null;
         let raw;
         try {
-            raw = await this.host.request("uxCheck", { ...(this.userEyes() ? { glass: true } : {}), ...(this.uxRules.wayBack ? { wayBack: true } : {}), ...(earlier !== null ? { earlier } : {}) }, { sessionId: session.id });
+            raw = await this.sendRequest("uxCheck", { ...(this.userEyes() ? { glass: true } : {}), ...(this.uxRules.wayBack ? { wayBack: true } : {}), ...(earlier !== null ? { earlier } : {}) }, { sessionId: session.id });
         }
         catch (error) {
             return fail(describeError(error));
@@ -2826,7 +2967,7 @@ export class TaplineTools {
         return runMedia(args, {
             state: this.mediaState,
             session,
-            request: (params) => this.host.request("media", params, { sessionId: session.id, timeoutMs: 60_000 }),
+            request: (params) => this.sendRequest("media", params, { sessionId: session.id, timeoutMs: 60_000 }),
             describeError,
             askPerson: (message) => this.personForMedia(message),
         });
@@ -2838,7 +2979,7 @@ export class TaplineTools {
             return this.notConnected();
         let raw;
         try {
-            raw = await this.host.request("check", {}, { sessionId: session.id });
+            raw = await this.sendRequest("check", {}, { sessionId: session.id });
         }
         catch (error) {
             return fail(describeError(error));
@@ -2887,10 +3028,9 @@ export class TaplineTools {
         // counts on from the highest one; `look` (onlyChanges false) always restarts at e1.
         const eyes = this.userEyes();
         const treeParams = { ...(askChanges ? { changes: true } : {}), ...(eyes ? { glass: true } : {}) };
-        const treePromise = this.host.request("tree", treeParams, { sessionId: sid });
+        const treePromise = this.sendRequest("tree", treeParams, { sessionId: sid });
         const shotPromise = wantScreenshot && !this.noScreenshot.has(sid)
-            ? this.host
-                .request("screenshot", { format: "jpg", quality: 0.75, maxWidth: width }, { sessionId: sid })
+            ? this.sendRequest("screenshot", { format: "jpg", quality: 0.75, maxWidth: width }, { sessionId: sid })
                 .then((value) => ({ ok: true, value }))
                 .catch((error) => ({ ok: false, error }))
             : Promise.resolve(undefined);
@@ -2919,7 +3059,14 @@ export class TaplineTools {
             this.alertOpen.add(sid);
         else
             this.alertOpen.delete(sid);
-        const changeBlock = askChanges ? changeParts(tree, { alertGone, eyes }) : null;
+        // An alert that was open before and now reads differently (its message alone, say) is a change of the alert.
+        const signature = alertsNow ? alertSignature(tree) : undefined;
+        const alertChanged = signature !== undefined && this.alertSeen.has(sid) && this.alertSeen.get(sid) !== signature;
+        if (signature !== undefined)
+            this.alertSeen.set(sid, signature);
+        else
+            this.alertSeen.delete(sid);
+        const changeBlock = askChanges ? changeParts(tree, { alertGone, alertChanged, eyes }) : null;
         const changesText = changeBlock === null ? null : [changeBlock.label, ...changeBlock.header, ...changeBlock.changes].join("\n");
         // For the call log: the list the agent now has (a change block leaves it as it was, but no longer certain).
         if (changesText === null)
@@ -3026,7 +3173,7 @@ export class TaplineTools {
         return {
             capabilities: session.capabilities,
             latest: () => this.host.sessions().find((s) => s.id === session.id)?.place,
-            request: (method, params) => this.host.request(method, params ?? {}, { sessionId: session.id }),
+            request: (method, params) => this.sendRequest(method, params ?? {}, { sessionId: session.id }),
         };
     }
     /** Notes the place a fresh list shows. A script that replays doesn't change the map (§18.9); a map that fails never fails a call. */
@@ -3159,7 +3306,7 @@ export class TaplineTools {
         if (wire !== undefined && wire.sessionId !== session.id) {
             return fail("Error not_connected: the app changed while the account's value was being prepared; try again.");
         }
-        if (wire === undefined && method === "type" && typeof params === "object" && params !== null && String(params.text ?? "").includes("${account.")) {
+        if (wire === undefined && method === "type" && typeof params === "object" && params !== null && mentionsVault(String(params.text ?? ""))) {
             return fail("Error bad_params: an account value can't be typed as plain text; it needs a loaded account and a connected app.");
         }
         const shortAnswer = this.briefOn(brief);
@@ -3187,10 +3334,21 @@ export class TaplineTools {
                     // `as` is a recording's name for the text, never the app's business.
                     const kept = typeof params === "object" && params !== null ? Object.fromEntries(Object.entries(params).filter(([key]) => key !== "as" && (wire === undefined || key !== "account"))) : params;
                     const sent = wire === undefined ? kept : { ...kept, ...wire.values };
-                    return this.host.request(method, sent, { sessionId: session.id, ...(timeoutMs !== undefined ? { timeoutMs } : {}) });
+                    // From here the request may reach the app; only a failure that proves it didn't takes that back (a grant's use stays counted).
+                    const delivery = this.deliveryScope.getStore();
+                    if (delivery !== undefined)
+                        delivery.sent = true;
+                    try {
+                        return await this.sendRequest(method, sent, { sessionId: session.id, ...(timeoutMs !== undefined ? { timeoutMs } : {}) });
+                    }
+                    catch (error) {
+                        if (delivery !== undefined && notDelivered(error))
+                            delivery.sent = false;
+                        throw error;
+                    }
                 };
                 // With the live viewer, a person watching goes first.
-                result = this.options.control ? await this.options.control.runAgent(run) : await run();
+                result = await this.agentTurn(run);
                 break;
             }
             catch (error) {
@@ -3357,7 +3515,7 @@ export class TaplineTools {
             : null;
         if (!element?.success)
             return chosen;
-        const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId }).catch(() => null));
+        const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId }).catch(() => null));
         if (!tree.success)
             return chosen;
         const t = target;
@@ -3479,7 +3637,7 @@ export class TaplineTools {
         const sid = sessionId ?? this.host.current()?.id;
         if (sid === undefined)
             return null;
-        const parsed = overlaySchema.safeParse(await this.host.request("overlay", {}, { sessionId: sid }));
+        const parsed = overlaySchema.safeParse(await this.sendRequest("overlay", {}, { sessionId: sid }));
         if (!parsed.success)
             return null;
         const { rev, screen, elements } = parsed.data;
@@ -3502,7 +3660,7 @@ export class TaplineTools {
         if (session === undefined)
             return { ok: false, message: "No app is connected." };
         try {
-            await this.host.request("feed", feedParams(on, quality), { sessionId: session.id });
+            await this.sendRequest("feed", feedParams(on, quality), { sessionId: session.id });
             return { ok: true };
         }
         catch (error) {
@@ -3529,7 +3687,7 @@ export class TaplineTools {
             // nothing does (a list moves natively), it scrolls, as before.
             if (swipe !== undefined) {
                 try {
-                    const swiped = await this.host.request("swipe", swipe, { sessionId: session.id });
+                    const swiped = await this.sendRequest("swipe", swipe, { sessionId: session.id });
                     return { ok: true, action: this.describeAction(personKind(input, "swipe"), swiped, point) };
                 }
                 catch (error) {
@@ -3539,7 +3697,7 @@ export class TaplineTools {
                 }
             }
             try {
-                const result = await this.host.request(method, params, { sessionId: session.id });
+                const result = await this.sendRequest(method, params, { sessionId: session.id });
                 return { ok: true, action: this.describeAction(personKind(input, method), result, point) };
             }
             catch (error) {
@@ -3623,7 +3781,7 @@ export class TaplineTools {
         const session = this.host.current();
         if (feed?.on === true && session !== undefined) {
             try {
-                const answer = feedAnswerSchema.safeParse(await this.host.request("feed", feedParams(true, feed.quality), { sessionId: session.id }));
+                const answer = feedAnswerSchema.safeParse(await this.sendRequest("feed", feedParams(true, feed.quality), { sessionId: session.id }));
                 const stats = answer.success ? answer.data.stats : undefined;
                 if (stats !== undefined) {
                     lines.push(`Capture: ${stats.frames} frames, ${Math.round(stats.avgCaptureMs)} ms each on average (longest ${Math.round(stats.maxCaptureMs)} ms). Stutter: ${stats.janky} of ${stats.observedFrames} animation frames were slow, ${stats.jankyWhileCapturing} of them during a capture.`);
@@ -3643,7 +3801,7 @@ export class TaplineTools {
     }
     // -- compare_screen and filmstrip
     async takeShot(sessionId, width, quality) {
-        const raw = await this.host.request("screenshot", { format: "jpg", quality, maxWidth: width }, { sessionId });
+        const raw = await this.sendRequest("screenshot", { format: "jpg", quality, maxWidth: width }, { sessionId });
         const parsed = screenshotResultSchema.safeParse(raw);
         if (!parsed.success)
             throw new TaplineError("internal", "The app returned a screenshot the host could not read.");
@@ -3716,7 +3874,7 @@ export class TaplineTools {
     /** The element list for naming regions and masking, read as a peek: the agent's refs and baseline must stay as they are. */
     async peekElements(sessionId) {
         try {
-            const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId }));
+            const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId }));
             if (tree.success && tree.data.screen)
                 return { scaleBase: tree.data.screen.width, elements: tree.data.elements };
         }
@@ -3731,7 +3889,7 @@ export class TaplineTools {
      */
     async checkAgainstReference(session, name, options) {
         // A comparison, from a step's `expect` too, is made with animations normal (the tools that say so add the note).
-        return (await withNormalAnimations(this.host, session.id, () => this.checkAgainstReferenceNow(session, name, options))).value;
+        return (await withNormalAnimations(this.host, session.id, () => this.checkAgainstReferenceNow(session, name, options), this.leased)).value;
     }
     async checkAgainstReferenceNow(session, name, options) {
         let shot;
@@ -4159,7 +4317,7 @@ export class TaplineTools {
                 // A screenshot takes a few hundred ms on a phone, so frame 1 is the "before".
                 // The tap is a touch like any other: the safety policy decides first.
                 const pressParams = { target: toWireTarget(args.tap), ...(this.userEyes() ? { noScroll: true } : {}) };
-                const tapLists = listsFor(this.policy, session.app);
+                const tapLists = this.touchLists(session);
                 const ready = await this.awaitOk(session, "tap", "press", pressParams, tapLists);
                 if ("stop" in ready)
                     return ready.stop;
@@ -4169,11 +4327,35 @@ export class TaplineTools {
                     const gate = await this.policyGate(session, "tap", "press", pressParams, tapLists, ready.waited);
                     if ("stop" in gate)
                         return gate.stop;
-                    frames.push(await this.takeShot(session.id, frameWidth, 0.8));
-                    await this.host.request("press", pressParams, { sessionId: session.id });
+                    let pressSent = false;
+                    try {
+                        frames.push(await this.takeShot(session.id, frameWidth, 0.8));
+                        pressSent = true;
+                        try {
+                            await this.sendRequest("press", pressParams, { sessionId: session.id });
+                        }
+                        catch (error) {
+                            if (notDelivered(error))
+                                pressSent = false;
+                            throw error;
+                        }
+                    }
+                    catch (error) {
+                        if (gate.grant !== undefined && !pressSent)
+                            await this.releaseGrant(gate.grant);
+                        throw error;
+                    }
+                    if (gate.grant !== undefined)
+                        this.grantNotes.getStore()?.push(gate.grant.line);
                     return null;
                 };
-                const stopped = this.options.control ? await this.options.control.runAgent(turn) : await turn();
+                let stopped;
+                try {
+                    stopped = await this.agentTurn(turn);
+                }
+                finally {
+                    await this.dropPreUse(ready.waited);
+                }
                 if (stopped !== null)
                     return stopped;
             }
@@ -4275,7 +4457,7 @@ export class TaplineTools {
                 };
                 try {
                     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-                    writeFileSync(path, `${JSON.stringify(script, null, 2)}\n`, { mode: 0o600 });
+                    writeFileSync(path, `${JSON.stringify(this.backstop(script), null, 2)}\n`, { mode: 0o600 });
                 }
                 catch (error) {
                     return fail(`Error internal: couldn't save the script: ${error instanceof Error ? error.message : String(error)}`);
@@ -4340,7 +4522,7 @@ export class TaplineTools {
         const script = routeScript({ name: recording.name, app: recording.app.id ?? recording.app.name, start: route.start, end: end?.place.name, steps, variables: route.variables });
         let saved;
         try {
-            saved = await saveRoute(route.map.folder(), script, route.map);
+            saved = await saveRoute(route.map.folder(), this.backstop(script), route.map);
         }
         catch (error) {
             // The recording stays, so stop can be tried again.
@@ -4492,7 +4674,7 @@ export class TaplineTools {
                 update: options.updateReferences === true,
             };
             try {
-                const answer = await this.run({ steps, look: args.look, screenshot: args.screenshot, brief: false });
+                const answer = await this.inRoute(script.version === 2 ? script.name : undefined, () => this.run({ steps, look: args.look, screenshot: args.screenshot, brief: false }), script.version === 2 && script.draftsOnly === true);
                 if (notes.length === 0)
                     return answer;
                 const [top, ...rest] = answer.content;
@@ -4600,7 +4782,7 @@ export class TaplineTools {
             return this.notConnected();
         this.logExtra = undefined;
         this.actionStartedAt = Date.now();
-        const lists = listsFor(this.policy, session.app);
+        const lists = this.touchLists(session);
         if (!dryRun && lists.confirm.length === 0 && lists.block.length === 0)
             return perform();
         const stale = this.staleRef(params);
@@ -4620,7 +4802,16 @@ export class TaplineTools {
                 return fail(this.blockedLine(verdict.element, verdict.word));
             }
             const would = this.wouldLine(tool, shown, resolved.point, resolved.value, resolved.scrolls);
-            const needs = verdict.kind === "confirm" ? ` It needs a person's OK (policy word ${JSON.stringify(verdict.word)}).` : "";
+            let needs = verdict.kind === "confirm" ? ` It needs a person's OK (policy word ${JSON.stringify(verdict.word)}).` : "";
+            if (verdict.kind === "confirm") {
+                // §19.3: a dry run says a grant would allow it, and counts nothing.
+                const grant = await this.grantFor(session, tool, verdict.raw, verdict.word, "peek");
+                if (grant !== null)
+                    needs = ` It is allowed by grant ${JSON.stringify(grant.name)} (${grant.counts} today).`;
+                // §21.3: a touch that sends something stops at a draft first; nothing is shown now.
+                else if ((await this.draftSource(session, verdict.raw, verdict.word)) !== null)
+                    needs = ` It stops at a draft first, and needs a person's OK (policy word ${JSON.stringify(verdict.word)}).`;
+            }
             this.showAction("agent", method, shown !== undefined ? { element: shown } : undefined, params);
             return text([`${would}${needs}`, ...this.takePersonNote()].join("\n"));
         }
@@ -4629,17 +4820,36 @@ export class TaplineTools {
         if ("stop" in ready)
             return ready.stop;
         let granted;
-        const answer = await perform(async () => {
-            const gate = await this.gatePreflight(session, tool, method, params, lists, ready.waited);
-            if ("stop" in gate)
-                return gate.stop;
-            granted = gate.via;
-            return null;
-        });
+        let sentDraft = false;
+        let covered;
+        let answer;
+        const delivery = { sent: false };
+        try {
+            answer = await this.deliveryScope.run(delivery, () => perform(async () => {
+                const gate = await this.gatePreflight(session, tool, method, params, lists, ready.waited);
+                if ("stop" in gate)
+                    return gate.stop;
+                granted = gate.via;
+                sentDraft = gate.draft === true;
+                covered = gate.grant;
+                return null;
+            }));
+        }
+        finally {
+            await this.dropPreUse(ready.waited);
+        }
+        // A use is counted when the touch is made: one that surely wasn't made gives its use back (§19.4). A touch that was sent, or
+        // may have been (a timeout, a failed read after it, a handler that threw), stays counted: a repeat must not beat the limits.
+        if (covered !== undefined && answer.isError === true && !delivery.sent)
+            await this.releaseGrant(covered);
+        const notes = this.grantNotes.getStore();
+        const withNotes = notes !== undefined ? flushNotes(answer, notes) : answer;
+        if (covered !== undefined && answer.isError !== true)
+            return appendNote(withNotes, covered.line);
         if (granted === undefined || answer.isError === true)
-            return answer;
+            return withNotes;
         this.journeyRun?.noteOk(granted);
-        return appendNote(answer, `Note: allowed by a person (in ${granted === "chat" ? "chat" : "the live view"}).`);
+        return appendNote(withNotes, `Note: ${sentDraft ? "sent" : "allowed"} by a person (in ${granted === "chat" ? "chat" : "the live view"}).`);
     }
     /**
      * The check right before a touch, shared by a single call and a drive's move: the policy's verdict, the person's OK used up,
@@ -4649,11 +4859,15 @@ export class TaplineTools {
         const gate = await this.policyGate(session, tool, method, params, lists, waited, known);
         if ("stop" in gate)
             return gate;
+        if (gate.grant !== undefined) {
+            this.logExtra = { ...(this.logExtra ?? {}), grant: gate.grant.name, grant_use: `${gate.grant.counts} today` };
+            return { grant: gate.grant };
+        }
         if (gate.via === undefined)
             return {};
-        this.logExtra = { confirmed: true, confirmed_by: gate.via };
+        this.logExtra = { ...(this.logExtra ?? {}), confirmed: true, confirmed_by: gate.via, ...(gate.draft === true ? { draft: true } : {}) };
         this.setOk(true);
-        return { via: gate.via };
+        return { via: gate.via, ...(gate.draft === true ? { draft: true } : {}) };
     }
     /** What the person was asked for and what the screen showed then; the touch is checked against it right before it happens. */
     fingerprint(element) {
@@ -4680,26 +4894,48 @@ export class TaplineTools {
             return { waited: null };
         if (this.inReflexStep())
             return { stop: this.reflexNeedsPerson(verdict.element, verdict.word) };
+        // A grant that covers the touch asks no one. Its use is taken here, before the dialog stage, so that a use that can't be
+        // taken (the audit line fails) falls back to asking a person; the check right before the touch takes it over (§19.3, §19.4).
+        // §21.3: a touch under a draftsOnly grant, or in a drafts-only route, stops at a draft a person sees first: no grant stands in.
+        const draft = await this.draftOf(session, verdict.raw, verdict.word);
+        const asked = [];
+        const early = draft === null ? await this.grantFor(session, tool, verdict.raw, verdict.word, "use", asked) : null;
+        if (early !== null)
+            return { waited: { fp: this.fingerprint(verdict.raw), pre: { use: early, handed: false } } };
+        // The reason a grant didn't cover goes into the action log with the touch, also after a long wait.
+        const keepAsked = () => {
+            if (asked[0] !== undefined)
+                this.logExtra = { ...(this.logExtra ?? {}), grant_asked: asked[0] };
+        };
         const label = verdict.element.label ?? verdict.element.text ?? undefined;
-        const caption = captionFor(tool, label ?? undefined, params) ?? tool;
-        const key = this.confirmKey(session, tool, verdict.raw);
+        const caption = draft?.caption ?? captionFor(tool, label ?? undefined, params) ?? tool;
+        const key = this.confirmKey(session, tool, verdict.raw) + draftBinding(draft);
         const ask = { kind: tool, caption, word: verdict.word };
-        const fp = this.fingerprint(verdict.raw);
+        const fp = this.fingerprint(verdict.raw) + draftBinding(draft);
         const name = this.shortName(verdict.element, false);
-        const refuse = (tail) => {
+        // `why` is a draft's reason for not being sent (§21.3); without one a draft is waiting in the live view.
+        const refuse = (tail, why) => {
+            keepAsked();
             this.showAction("agent", method, { element: verdict.element }, params, "not_allowed", "needs_confirmation");
+            if (draft !== null)
+                return { stop: fail(this.draftRefusal(name, verdict.word, why, tail)) };
             return { stop: fail(`Error not_allowed: needs_confirmation: ${name} needs a person's OK (policy word ${JSON.stringify(verdict.word)}). ${tail}`) };
         };
         const hold = this.holdScope.getStore();
         const cancelled = hold?.signal;
         const wasCancelled = () => cancelled?.aborted === true;
         if (wasCancelled())
-            return refuse("The call was cancelled before anyone answered.");
+            return refuse("The call was cancelled before anyone answered.", "The call was cancelled before anyone answered.");
         const check = this.confirmations.check(key, ask);
-        if (check.granted)
-            return { waited: { fp, via: check.via } };
+        if (check.granted) {
+            keepAsked();
+            return { waited: { fp, via: check.via, ...(draft !== null ? { draft: draft.source } : {}) } };
+        }
         if ("held" in check) {
+            keepAsked();
             this.showAction("agent", method, { element: verdict.element }, params, "not_allowed", "needs_confirmation");
+            if (draft !== null)
+                return { stop: fail("Error not_allowed: needs_confirmation: the draft wasn't sent (They declined it just now.). Don't ask again by repeating the call: ask your user what they want.") };
             return {
                 stop: fail(`Error not_allowed: needs_confirmation: ${name} needs a person's OK (policy word ${JSON.stringify(verdict.word)}), and they declined it just now. Don't ask again by repeating the call: ask your user what they want.`),
             };
@@ -4708,9 +4944,9 @@ export class TaplineTools {
         const waitStarted = Date.now();
         // The dialog's answer goes through the same request the live view answers: the first one wins, the other is closed.
         const noDialog = new Promise((resolve) => {
-            void dialogs
-                .askOk(okCaption({ word: verdict.word, tool, role: verdict.element.role ?? "", ...(label !== undefined ? { text: label } : {}), app: session.app.name }), abort.signal)
-                .then((answer) => {
+            void (draft !== null
+                ? dialogs.askDraft(draft.caption, draft.word, abort.signal)
+                : dialogs.askOk(okCaption({ word: verdict.word, tool, role: verdict.element.role ?? "", ...(label !== undefined ? { text: label } : {}), app: session.app.name }), abort.signal)).then((answer) => {
                 if (answer === "unavailable")
                     resolve("no_dialog");
                 else if (answer !== "aborted")
@@ -4733,16 +4969,23 @@ export class TaplineTools {
         if (wasCancelled()) {
             if (settled.allow)
                 this.confirmations.check(key, ask);
-            return refuse("The call was cancelled before anyone answered.");
+            return refuse("The call was cancelled before anyone answered.", "The call was cancelled before anyone answered.");
         }
         if (settled.expired)
-            return refuse("Nobody answered. Ask your user, or repeat the call to ask again.");
-        if (!settled.allow)
-            return refuse("They declined. Ask your user what to do.");
+            return refuse("Nobody answered. Ask your user, or repeat the call to ask again.", "Nobody answered.");
+        if (!settled.allow) {
+            this.options.audit?.write({ kind: "approval", app: session.app.id ?? session.app.name, name: verdict.word, detail: "declined" });
+            return refuse("They declined. Ask your user what to do.", "They declined.");
+        }
         const used = this.confirmations.check(key, ask);
         if (!used.granted)
             return { stop: fail(CHANGED_WHILE_WAITING) };
-        return { waited: { fp, via: used.via } };
+        // The person said yes in the chat's own dialog: they may also want it as a standing grant (§19.6).
+        // A draft a person sends doesn't offer a grant: the next one is shown to them too.
+        if (used.via === "chat" && draft === null)
+            await this.offerGrant(session, verdict.word, verdict.raw, asked, cancelled);
+        keepAsked();
+        return { waited: { fp, via: used.via, ...(draft !== null ? { draft: draft.source } : {}) } };
     }
     /** The answer of a reflex's step that the policy flags at the moment it runs: skipped, never asked (§18.7). */
     reflexNeedsPerson(element, word) {
@@ -4763,8 +5006,8 @@ export class TaplineTools {
      * Runs a call of the agent with its own wait counter and, when there is one, the request's abort signal, so a
      * wait for a person's OK is counted for this call only and closes when the call is cancelled.
      */
-    withCall(signal, run) {
-        return this.holdScope.run({ ms: 0, ...(signal !== undefined ? { signal } : {}) }, run);
+    withCall(signal, run, leaseCredential) {
+        return this.holdScope.run({ ms: 0, ...(signal !== undefined ? { signal } : {}), ...(leaseCredential !== undefined ? { lease: leaseCredential } : {}) }, run);
     }
     /**
      * The policy's verdict on a touch about to happen: stop with an answer (blocked, needs a person's OK, or
@@ -4791,39 +5034,237 @@ export class TaplineTools {
         // A reflex never asks (§18.7): what the screen shows now is flagged, so the reflex is skipped, with no dialog and no request.
         if (verdict.kind === "confirm" && this.inReflexStep())
             return { stop: this.reflexNeedsPerson(verdict.element, verdict.word) };
+        // §21.3: read again right before the touch: the OK a person gave is for the text they saw.
+        // Whether a draft applies was decided where the person was asked; a grant made by their answer in this very call is for the next touch.
+        const waiting = waited !== undefined && waited !== null;
+        const draftFrom = waiting ? ("draft" in waited ? waited.draft : undefined) : undefined;
+        let draft = verdict.kind !== "confirm" ? null : waiting ? (draftFrom !== undefined ? await this.draftWith(session, draftFrom, verdict.word) : null) : await this.draftOf(session, verdict.raw, verdict.word);
+        // The reserved grant stopped covering the touch while the call waited (R1): its use is back, and the touch goes the way it would have with no grant.
+        let lostGrant = false;
         if (waited !== undefined && waited !== null) {
             // §11.3: the same element, with the same label, still touchable (the dry run passed), in the same app in front.
             // A call that was cancelled while it waited never touches.
             const same = verdict.kind === "confirm" &&
-                this.fingerprint(verdict.raw) === waited.fp &&
+                this.fingerprint(verdict.raw) + draftBinding(draft) === waited.fp &&
                 this.host.current()?.id === session.id &&
                 this.holdScope.getStore()?.signal?.aborted !== true;
             if (!same) {
                 this.showAction("agent", method, undefined, params, "not_allowed", "needs_confirmation");
                 return { stop: fail(CHANGED_WHILE_WAITING) };
             }
-            return { granted: true, via: waited.via };
+            if ("pre" in waited) {
+                // The grant's use was taken before the dialog stage. The wait for control may have outlasted what it was taken under (a
+                // revocation, draftsOnly, quiet hours, `until`): read the policy again right now, taking no further use.
+                const use = waited.pre.use;
+                let covers = false;
+                try {
+                    covers = this.options.grants !== undefined && (await this.options.grants.stillCovers({ app: session.app, element: verdict.raw, routes: this.routeScope.getStore() ?? [] }, use));
+                }
+                catch {
+                    covers = false;
+                }
+                if (covers) {
+                    // It is this touch's now, and given back if the touch isn't made.
+                    waited.pre.handed = true;
+                    return { granted: false, grant: use };
+                }
+                waited.pre.handed = true;
+                await this.releaseGrant(use);
+                lostGrant = true;
+                draft = verdict.kind === "confirm" ? await this.draftOf(session, verdict.raw, verdict.word) : null;
+            }
+            else {
+                this.approved(session, verdict.word, waited.via, draft !== null);
+                return { granted: true, via: waited.via, ...(draft !== null ? { draft: true } : {}) };
+            }
         }
         if (verdict.kind === "none")
             return { granted: false };
+        // §19.3: where the policy says a person must OK, a grant may stand in for them: it is used up here, right before the touch.
+        // Not for a draft (§21.3): a person sees it first. Not again after the one reserved for this call stopped covering.
+        const grant = draft === null && !lostGrant ? await this.grantFor(session, tool, verdict.raw, verdict.word, "use") : null;
+        if (grant !== null)
+            return { granted: false, grant };
         const label = verdict.element.label ?? verdict.element.text ?? undefined;
-        const caption = captionFor(tool, label ?? undefined, params) ?? tool;
+        const caption = draft?.caption ?? captionFor(tool, label ?? undefined, params) ?? tool;
         // The client is part of the key, so one agent can't use up an OK a person gave for another's call.
-        const check = this.confirmations.check(this.confirmKey(session, tool, verdict.raw), { kind: tool, caption, word: verdict.word });
-        if (check.granted)
-            return { granted: true, via: check.via };
+        const check = this.confirmations.check(this.confirmKey(session, tool, verdict.raw) + draftBinding(draft), { kind: tool, caption, word: verdict.word });
+        if (check.granted) {
+            this.approved(session, verdict.word, check.via, draft !== null);
+            return { granted: true, via: check.via, ...(draft !== null ? { draft: true } : {}) };
+        }
         const name = this.shortName(verdict.element, false);
         if ("held" in check) {
             this.showAction("agent", method, { element: verdict.element }, params, "not_allowed", "needs_confirmation");
+            if (draft !== null)
+                return { stop: fail("Error not_allowed: needs_confirmation: the draft wasn't sent (They declined it just now.). Don't ask again by repeating the call: ask your user what they want.") };
             return {
                 stop: fail(`Error not_allowed: needs_confirmation: ${name} needs a person's OK (policy word ${JSON.stringify(verdict.word)}), and they declined it just now. Don't ask again by repeating the call: ask your user what they want.`),
             };
         }
         this.showAction("agent", method, { element: verdict.element }, params, "not_allowed", "needs_confirmation");
+        if (draft !== null)
+            return { stop: fail(this.draftRefusal(name, verdict.word, undefined, `${this.liveViewLine()}${check.suffix}`)) };
         return {
             stop: fail(`Error not_allowed: needs_confirmation: ${this.shortName(verdict.element, false)} needs a person's OK (policy word ${JSON.stringify(verdict.word)}). ${this.liveViewLine()}${check.suffix}`),
         };
     }
+    /**
+     * AGENT-TOOLS 1.14 §19.3: whether a grant covers this touch, which the policy says needs a person. `use` records the use (and
+     * the audit line) and `peek` counts nothing. A grant that matched but can't cover the touch adds its note to the call's answer.
+     * A touch that is never grantable, or has no grant, answers null: it asks as before.
+     */
+    async grantFor(session, tool, element, word, mode, askedOut) {
+        const book = this.options.grants;
+        if (book === undefined || word === UNREADABLE_LINK)
+            return null;
+        const shown = this.host.redactOut((element.label ?? element.text ?? "").replace(/[\u0000-\u001f\u007f]/g, " ").trim()).slice(0, 80);
+        let decision;
+        try {
+            decision = await book.decide({ app: session.app, element, routes: this.routeScope.getStore() ?? [] }, mode, `${tool} ${JSON.stringify(shown)}`);
+        }
+        catch {
+            return null;
+        }
+        // A draftsOnly grant covers nothing by itself: the touch stops at a draft (§21.3).
+        if (decision.kind === "draft")
+            return null;
+        if (decision.kind === "ask") {
+            const notes = this.grantNotes.getStore();
+            if (notes !== undefined)
+                for (const note of decision.notes)
+                    if (!notes.includes(note))
+                        notes.push(note);
+            if (mode === "use" && decision.asked[0] !== undefined) {
+                askedOut?.push(...decision.asked);
+                this.logExtra = { ...(this.logExtra ?? {}), grant_asked: decision.asked[0] };
+            }
+            return null;
+        }
+        return { name: decision.name, line: decision.line, owner: decision.owner, slots: decision.slots, counts: decision.counts };
+    }
+    /** A person's OK is used up: one `approval` line of the audit log (§23). */
+    approved(session, word, via, draft = false) {
+        this.options.audit?.write({
+            kind: "approval",
+            app: session.app.id ?? session.app.name,
+            name: word,
+            detail: draft ? "draft sent" : `allowed by a person (in ${via === "chat" ? "chat" : "the live view"})`,
+        });
+    }
+    /**
+     * AGENT-TOOLS 1.14 §21.3: why a touch stops at a draft, or null. Under a `draftsOnly` grant that would cover the touch, or in a
+     * route that carries `"draftsOnly": true` for a word that reaches other people. Reads nothing from the phone.
+     */
+    async draftSource(session, element, word) {
+        if (word === UNREADABLE_LINK)
+            return null;
+        if (this.draftsScope.getStore() === true && matchWord(REACH_WORDS, element) !== null)
+            return "route";
+        const book = this.options.grants;
+        if (book === undefined)
+            return null;
+        try {
+            const decision = await book.decide({ app: session.app, element, routes: this.routeScope.getStore() ?? [] }, "peek", "");
+            return decision.kind === "draft" ? "grant" : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** The draft a touch stops at (§21.3), with the question and the field's text as the person will see them; null when none applies. */
+    async draftOf(session, element, word) {
+        const source = await this.draftSource(session, element, word);
+        return source === null ? null : this.draftWith(session, source, word);
+    }
+    /** The draft as the field holds it now. */
+    async draftWith(session, source, word) {
+        const text = await this.draftText(session);
+        return { source, word, text, caption: draftCaption({ word, app: session.app.name, text }) };
+    }
+    /**
+     * The text of the field the agent last typed into on this screen, else the only input that holds text, read from the app now
+     * (Tapline's host reads it from the app, §21.3). Redacted of vault and account values. A secure field is never kept, and what
+     * can't be read is an empty draft.
+     */
+    async draftText(session) {
+        let read;
+        try {
+            read = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id, internal: true }));
+        }
+        catch {
+            return "";
+        }
+        if (!read.success)
+            return "";
+        const inputs = read.data.elements.filter((e) => roleOf(e) === "input" || (e.actions ?? []).includes("type"));
+        const last = this.lastTyped;
+        // By id when it has one: a full look renumbers the refs, so a ref may now name another input.
+        const own = last !== undefined && last.sessionId === session.id ? (last.testID !== undefined ? inputs.find((e) => e.testID === last.testID) : inputs.find((e) => e.ref === last.ref)) : undefined;
+        const filled = inputs.filter((e) => typeof e.value === "string" && e.value !== "");
+        const field = own ?? (filled.length === 1 ? filled[0] : undefined);
+        return typeof field?.value === "string" ? this.host.redactOut(field.value) : "";
+    }
+    /** A draft that wasn't sent, or one that waits in the live view (§21.3). `why` is the reason in parentheses. */
+    draftRefusal(name, word, why, tail) {
+        return why !== undefined
+            ? `Error not_allowed: needs_confirmation: the draft wasn't sent (${why}). Ask your user what to do.`
+            : `Error not_allowed: needs_confirmation: a draft is waiting for a person (${name}, policy word ${JSON.stringify(word)}). ${tail}`;
+    }
+    /** A use taken before the dialog stage that no check took over (the call stopped first): given back. */
+    async dropPreUse(waited) {
+        if (waited === null || waited === undefined || !("pre" in waited) || waited.pre.handed)
+            return;
+        waited.pre.handed = true;
+        await this.releaseGrant(waited.pre.use);
+    }
+    /** Asked once per app and word in a session, whatever the answer: a person who said no isn't asked at every touch. */
+    grantOffers = new Set();
+    /**
+     * AGENT-TOOLS 1.14 §19.6: a person has just allowed a touch in the chat's own dialog; the host offers to make that a standing
+     * grant. The host starts this, the person answers, and the grant is written only from their answers: nothing a model sends
+     * can start, answer or change it. Never offered for what no grant can cover (§19.2), nor where a live grant matched and
+     * ran out (a new grant would only undo its limit); an ended grant is renewed this way.
+     */
+    async offerGrant(session, word, element, asked, signal) {
+        const book = this.options.grants;
+        const dialogs = this.dialogs;
+        if (book === undefined || dialogs === undefined || !dialogs.available() || word === UNREADABLE_LINK || this.inReflexStep())
+            return;
+        if (asked.some((reason) => reason !== "ended"))
+            return;
+        if (neverGrantable(word, listsFor(this.policy, session.app).block) || elementNeverGrantable(element))
+            return;
+        const app = session.app.id ?? session.app.name;
+        const key = `${app}|${word.toLowerCase()}`;
+        if (this.grantOffers.has(key))
+            return;
+        this.grantOffers.add(key);
+        const routes = this.routeScope.getStore() ?? [];
+        const route = routes[routes.length - 1];
+        const spec = {
+            nameBase: grantNameBase(session.app.name, word),
+            app,
+            words: [word],
+            ...(route !== undefined ? { route } : {}),
+            perDay: GRANT_OFFER_PER_DAY,
+            days: GRANT_OFFER_DAYS,
+        };
+        const caption = grantCaption({ words: spec.words, perDay: spec.perDay, until: book.untilFor(spec.days), ...(route !== undefined ? { route } : {}), draftsOnly: reachesPeople(word) }, plainText(session.app.name) || "the app");
+        if ((await dialogs.askGrant(caption, signal)) !== "allow")
+            return;
+        const lift = reachesPeople(word) ? (await dialogs.askLiftDrafts(signal)) === "allow" : false;
+        await book.create({ ...spec, ...(lift ? { draftsOnly: false } : {}) });
+    }
+    /** The touch wasn't made: its use is given back (§19.4). */
+    async releaseGrant(use) {
+        try {
+            await this.options.grants?.release(use);
+        }
+        catch {
+            // a use that can't be given back stays counted: the safe side
+        }
+    }
     /** Which policy word, if any, the elements the target could mean carry: a block word first, then a confirm word. */
     policyWords(lists, resolved) {
         // The words are matched on the raw elements, so a label an account value hides is still the word it is. What the
@@ -4865,7 +5306,7 @@ export class TaplineTools {
         this.actionStartedAt = Date.now();
         let result;
         try {
-            result = await this.host.request(method, { ...params, dryRun: true }, { sessionId: session.id });
+            result = await this.sendRequest(method, { ...params, dryRun: true }, { sessionId: session.id });
         }
         catch (error) {
             this.logExtra = { dry_run: true };
@@ -4905,7 +5346,7 @@ export class TaplineTools {
         if (session.capabilities.includes("dryRun")) {
             let raw;
             try {
-                raw = await this.host.request(method, { ...params, dryRun: true }, { sessionId: session.id, internal: true });
+                raw = await this.sendRequest(method, { ...params, dryRun: true }, { sessionId: session.id, internal: true });
             }
             catch (error) {
                 const reason = error instanceof TaplineError ? reasonOf(error.code, error.message) : undefined;
@@ -4936,7 +5377,7 @@ export class TaplineTools {
         }
         let raw;
         try {
-            raw = await this.host.request("tree", {}, { sessionId: session.id, internal: true });
+            raw = await this.sendRequest("tree", {}, { sessionId: session.id, internal: true });
         }
         catch (error) {
             return { kind: "error", text: describeError(error), code: error instanceof TaplineError ? error.code : "internal" };
@@ -5014,6 +5455,44 @@ export class TaplineTools {
         return this.guarded("long_press", "longPress", params, args.dry_run === true, (preflight) => this.act("longPress", params, (r) => afterScroll(r, `Long-pressed ${this.elementName(r)}.`), args.look, args.screenshot, undefined, undefined, preflight, args.brief, "long_press"));
     }
     typeText(args) {
+        const otpApp = otpReference(args.text);
+        if (otpApp === null)
+            return this.typeTextWith(args, undefined);
+        // A one-time code (§20.4): the same checks as any typed text first, then the code is asked of Tapwright's daemon, and only
+        // for the connected app's own id, only now that a step types it.
+        const hiddenField = this.hiddenTarget(args.target);
+        if (hiddenField !== null)
+            return Promise.resolve(hiddenField);
+        const badAs = this.asRefusal(args.as, args.text, args.account);
+        if (badAs !== null)
+            return Promise.resolve(fail(badAs));
+        if (args.account !== undefined)
+            return Promise.resolve(fail("Error bad_params: a one-time code takes no account; write ${otp.<app>} alone."));
+        const session = this.host.current();
+        if (session === undefined)
+            return Promise.resolve(this.notConnected());
+        const refused = this.otpRefusal(otpApp, session);
+        if (refused !== null)
+            return Promise.resolve(fail(`Error bad_params: ${refused}`));
+        const app = session.app.id ?? session.app.name;
+        // A dry run checks the field and asks for nothing: no code is fetched, and none is spent.
+        if (args.dry_run === true)
+            return this.typeTextWith(args, { value: "", source: undefined, sessionId: session.id });
+        return this.otp.fetch(app).then((got) => got.ok
+            ? this.typeTextWith(args, { value: got.code, source: got.source, sessionId: session.id })
+            : fail(`Error ${got.reason === "none" ? "not_found" : "unsupported"}: ${got.message}`));
+    }
+    /** Why `${otp.<app>}` can't be typed for the connected app, or null: the id must be the connected app's own. */
+    otpRefusal(named, session) {
+        const own = session.app.id ?? session.app.name;
+        return named === own ? null : `\${otp.${named}} names another app than the connected one; a one-time code is typed only for the connected app (${own}), as \${otp.${own}}.`;
+    }
+    /** What `${otp.<app>}` checks before any step runs: the app it names, as for an account. Null when it holds or isn't a code. */
+    otpPrecheck(text, session) {
+        const named = otpReference(text);
+        return named === null ? null : this.otpRefusal(named, session);
+    }
+    typeTextWith(args, otp) {
         const hiddenField = this.hiddenTarget(args.target);
         if (hiddenField !== null)
             return Promise.resolve(hiddenField);
@@ -5021,16 +5500,18 @@ export class TaplineTools {
         if (badAs !== null)
             return Promise.resolve(fail(badAs));
         // A test account's value (§18.6): `params` keeps the placeholder for the log, the viewer and a recording; the
-        // value goes to the app only, through `wire`.
+        // value goes to the app only, through `wire`. A one-time code goes the same way.
         const session = this.host.current();
-        const account = this.accountText(args.text, args.account, session);
+        const account = otp !== undefined
+            ? { ok: true, value: otp.value, kind: undefined, use: undefined }
+            : this.accountText(args.text, args.account, session);
         if (account !== null && !account.ok)
             return Promise.resolve(fail(`Error ${account.code}: ${account.message}`));
         const params = {
             text: args.text,
             replace: args.replace ?? true,
             submit: args.submit ?? false,
-            ...(account !== null ? { account: args.account ?? this.runAccount } : {}),
+            ...(account !== null && args.text.includes("${account.") ? { account: args.account ?? this.runAccount } : {}),
             ...(this.userEyes() ? { noScroll: true } : {}),
         };
         if (args.target !== undefined)
@@ -5038,20 +5519,23 @@ export class TaplineTools {
         if (args.force === true)
             params["force"] = true;
         const wire = account !== null && account.ok && session !== undefined
-            ? { values: { text: account.value, kind: account.kind }, sessionId: session.id }
+            ? { values: { text: account.value, kind: account.kind }, sessionId: otp?.sessionId ?? session.id }
             : undefined;
         // Typing isn't guarded by the policy (§11.1: the form's button is); a dry run still checks the field.
         if (args.dry_run === true) {
             if (wire === undefined) {
                 // A placeholder with no checked account is never sent, not even to be resolved.
-                if (args.text.includes("${account."))
+                if (mentionsVault(args.text))
                     return Promise.resolve(this.notConnected());
                 return this.dryRun("type_text", "type", params);
             }
             const { account: _account, ...plain } = params;
-            return this.dryRun("type_text", "type", { ...plain, text: "", kind: wire.values.kind });
+            return this.dryRun("type_text", "type", { ...plain, text: "", ...(wire.values["kind"] !== undefined ? { kind: wire.values["kind"] } : {}) });
         }
-        return this.act("type", 
+        const use = account !== null && account.ok ? account.use : undefined;
+        // What the audit line says about the field the value went into (§23): the app's own answer says whether it was secure.
+        let secureField;
+        const typed = this.act("type", 
         // `as` is for the recording only: `act` keeps it out of what goes to the app.
         args.as !== undefined ? { ...params, as: args.as } : params, (r) => {
             const value = typeof r === "object" && r !== null && "value" in r ? r.value : undefined;
@@ -5060,9 +5544,40 @@ export class TaplineTools {
             // Journey or not, iOS shows the last character of a password for about a second: remember when (finding 4).
             if (secure)
                 this.secureTypedAt = this.clock();
+            secureField = secure;
+            // The draft's field (§21.3): the last input typed into. A secure field's text is never read back.
+            const typedInto = !secure && typeof r === "object" && r !== null && "element" in r ? elementSchema.safeParse(r.element) : undefined;
+            const typedSession = this.host.current();
+            if (typedInto?.success === true && typedSession !== undefined) {
+                this.lastTyped = { sessionId: typedSession.id, ref: typedInto.data.ref, ...(typedInto.data.testID ? { testID: typedInto.data.testID } : {}) };
+            }
             const shown = secure ? " The value is hidden (secure field)." : typeof value === "string" ? ` Value is now ${JSON.stringify(value)}.` : "";
             return afterScroll(r, `Typed into ${this.elementName(r, "element", shown !== "")}${args.submit ? " and submitted" : ""}.${shown}`);
-        }, args.look, args.screenshot, undefined, undefined, undefined, args.brief, undefined, wire);
+        }, args.look, args.screenshot, undefined, undefined, use?.kind === "card" && session !== undefined ? () => this.cardOk(session, use, params) : undefined, args.brief, undefined, wire);
+        if (otp !== undefined && session !== undefined) {
+            // One `otp` line per code typed: the app and the source, never the code (§20.4, §23). The answer is scrubbed as well,
+            // whatever the app echoed back.
+            return typed.then((answer) => {
+                if (answer.isError !== true) {
+                    this.options.audit?.write({ kind: "otp", app: session.app.id ?? session.app.name, detail: `from ${otp.source ?? "Tapwright"}` });
+                }
+                return { ...answer, content: answer.content.map((part) => (part.type === "text" ? { ...part, text: this.scrubSecrets(part.text) } : part)) };
+            });
+        }
+        if (use === undefined || session === undefined)
+            return typed;
+        // Every use of a vault value is one `vault` line: the entry and the field, never the value (§20.1, §23).
+        return typed.then((answer) => {
+            if (answer.isError !== true) {
+                this.options.audit?.write({
+                    kind: "vault",
+                    app: session.app.id ?? session.app.name,
+                    name: use.name,
+                    detail: `${use.field} into ${secureField === true ? "secure field" : "text field"}`,
+                });
+            }
+            return answer;
+        });
     }
     /** Why `as` can't be used on this typed text (AGENT-TOOLS 1.13 §18.5), or null: it goes only while a route records. */
     asRefusal(as, text, account) {
@@ -5073,10 +5588,84 @@ export class TaplineTools {
         const problem = variableProblem(as);
         if (problem !== null)
             return `Error bad_params: ${problem}`;
-        if (account !== undefined || text.includes("${account."))
+        if (account !== undefined || mentionsVault(text))
             return "Error bad_params: as can't go with an account's value; the route keeps its placeholder already.";
         return null;
     }
+    /**
+     * A card's field is typed only with a person's OK, every time, and no grant covers it (AGENT-TOOLS 1.14 §19.2, §20.1). The
+     * dialog's words name the entry and the field, never the value. Returns an answer that stops the call, or null to go on.
+     */
+    async cardOk(session, use, params) {
+        const { account: _account, ...plain } = params;
+        const resolved = await this.resolveForPolicy(session, "type", { ...plain, text: "" });
+        if (resolved.kind === "error")
+            return fail(resolved.text);
+        const label = resolved.elements[0]?.label ?? resolved.elements[0]?.text ?? undefined;
+        const role = resolved.elements[0]?.role ?? "field";
+        const app = plainText(session.app.name) || "the app";
+        const what = label !== undefined && plainText(label) !== "" ? `"${plainText(label)}"` : `the ${plainText(role, 30) || "field"}`;
+        const caption = `Allow: type card "${use.name}" ${use.field} into ${what} in ${app}?`;
+        const words = `typing card "${use.name}" ${use.field}`;
+        const refuse = (tail) => fail(`Error not_allowed: needs_confirmation: ${words} needs a person's OK, every time (no grant covers a card). ${tail}`);
+        if (this.inReflexStep())
+            return refuse("A reflex never asks.");
+        const key = this.confirmKey(session, `card:${use.name}.${use.field}`, resolved.raw[0] ?? { ref: "", role: "input" });
+        const ask = { kind: "type_text", caption, word: "card" };
+        const check = this.confirmations.check(key, ask);
+        if (check.granted) {
+            this.approved(session, "card", check.via);
+            return null;
+        }
+        if ("held" in check)
+            return refuse("They declined it just now. Don't ask again by repeating the call: ask your user what they want.");
+        const dialogs = this.dialogs;
+        if (dialogs === undefined || !dialogs.available())
+            return refuse(`${this.liveViewLine()}${check.suffix}`);
+        const hold = this.holdScope.getStore();
+        const cancelled = hold?.signal;
+        const abort = new AbortController();
+        const waitStarted = Date.now();
+        const noDialog = new Promise((done) => {
+            void dialogs.askOk(caption, abort.signal).then((answer) => {
+                if (answer === "unavailable")
+                    done("no_dialog");
+                else if (answer !== "aborted")
+                    this.confirmations.answer(check.request.id, answer === "allow", "chat");
+            });
+        });
+        const onCancel = () => this.confirmations.withdraw(check.request.id);
+        cancelled?.addEventListener("abort", onCancel, { once: true });
+        const settled = await Promise.race([this.confirmations.wait(check.request.id), noDialog]);
+        cancelled?.removeEventListener("abort", onCancel);
+        abort.abort();
+        if (hold !== undefined)
+            hold.ms += Date.now() - waitStarted;
+        if (settled === "no_dialog")
+            return refuse(this.liveViewLine());
+        if (cancelled?.aborted === true)
+            return refuse("The call was cancelled before anyone answered.");
+        if (settled.expired)
+            return refuse("Nobody answered. Ask your user, or repeat the call to ask again.");
+        if (!settled.allow) {
+            this.options.audit?.write({ kind: "approval", app: session.app.id ?? session.app.name, name: "card", detail: "declined" });
+            return refuse("They declined. Ask your user what to do.");
+        }
+        const used = this.confirmations.check(key, ask);
+        if (!used.granted)
+            return fail(CHANGED_WHILE_WAITING);
+        this.approved(session, "card", used.via);
+        return null;
+    }
+    /** The backstop at the writers of files (§20.3): content values lose any vault value; keys and `${…}` stay. */
+    backstop(value) {
+        return redactContent(value, (text) => this.scrubSecrets(text));
+    }
+    /** A vault value or a one-time code typed in this session becomes its placeholder. */
+    scrubSecrets(text) {
+        const store = this.options.accounts?.store;
+        return redactAll(store, this.otp.codes, text);
+    }
     /** The batch's account: the default for its steps' `${account.…}` while `run` runs. */
     runAccount;
     /**
@@ -5087,9 +5676,15 @@ export class TaplineTools {
      * Hook for `drive` (task 15): its `account` argument goes through here too, as `named`, for the steps it types.
      */
     accountText(text, named, session) {
-        const mentions = text.includes("${account.");
+        const mentions = mentionsVault(text);
         if (!mentions && named === undefined)
             return null;
+        // `${otp.<app>}` is typed by `typeText` itself and needs no vault file (§20.4); `run` checks its app separately.
+        if (text.includes("${otp.")) {
+            if (otpReference(text) !== null && named === undefined)
+                return null;
+            return { ok: false, code: "bad_params", message: otpReference(text) !== null ? "a one-time code takes no account; write ${otp.<app>} alone." : "a one-time code is the whole text of a step, not part of one." };
+        }
         const loaded = this.options.accounts;
         if (loaded === undefined)
             return { ok: false, code: "bad_params", message: "no accounts are loaded; start Tapline with --accounts FILE." };
@@ -5107,11 +5702,12 @@ export class TaplineTools {
         if (substituted.field === null)
             return null;
         // An older app ignores the kind and would type a password into any field.
-        if (!session.capabilities.includes("typeKind")) {
+        if ((substituted.field === "password" || substituted.field === "username") && !session.capabilities.includes("typeKind")) {
             return { ok: false, code: "unsupported", message: "this app's Tapline is too old to type an account's value safely; update react-native-tapline." };
         }
+        // Only a password and a username are held to a kind of field (§18.6); the rest of the vault goes where the app lets it.
         const field = substituted.field;
-        return { ok: true, value: substituted.text, kind: field === "password" ? "secure" : "plain" };
+        return { ok: true, value: substituted.text, kind: field === "password" ? "secure" : field === "username" ? "plain" : undefined, use: substituted.use ?? { name: named ?? this.runAccount ?? "", kind: "account", field } };
     }
     scroll(args) {
         if (args.to !== undefined && (args.direction !== undefined || args.amount !== undefined)) {
@@ -5198,7 +5794,7 @@ export class TaplineTools {
                 return this.notConnected();
             let raw;
             try {
-                raw = await this.host.request("commands", {}, { sessionId: session.id });
+                raw = await this.sendRequest("commands", {}, { sessionId: session.id });
             }
             catch (error) {
                 return fail(describeError(error));
@@ -5339,7 +5935,7 @@ export class TaplineTools {
         if (entries.length === 0) {
             // Nothing streamed to the host yet; ask the app for the lines it buffered before we connected.
             try {
-                const raw = await this.host.request("logs", args.since !== undefined ? { since: args.since } : {}, { sessionId: session.id });
+                const raw = await this.sendRequest("logs", args.since !== undefined ? { since: args.since } : {}, { sessionId: session.id });
                 const list = typeof raw === "object" && raw !== null && "entries" in raw ? raw.entries : [];
                 entries = z.array(logEntrySchema).catch([]).parse(list);
             }
@@ -5372,7 +5968,7 @@ export class TaplineTools {
             try {
                 // The app goes away on purpose: that is no crash.
                 this.host.expectEnd(session.id);
-                await this.host.request("reload", {}, { sessionId: session.id, timeoutMs: 5000 });
+                await this.sendRequest("reload", {}, { sessionId: session.id, timeoutMs: 5000 });
             }
             catch (error) {
                 // The app dies mid-reload, so a dropped connection or a missing answer means it worked.
@@ -5414,7 +6010,7 @@ export class TaplineTools {
             try {
                 // The app goes away on purpose: that is no crash.
                 this.host.expectEnd(session.id);
-                await this.host.request("reload", {}, { sessionId: session.id, timeoutMs: 5000 });
+                await this.sendRequest("reload", {}, { sessionId: session.id, timeoutMs: 5000 });
             }
             catch (error) {
                 // The app dies mid-reload, so a dropped connection or a missing answer means it worked.
@@ -5453,7 +6049,7 @@ export class TaplineTools {
         // The first settled screen: the app waits until React hasn't committed for a moment (§6).
         // The first settled screen: a launch time is only reported when the app said it settled.
         try {
-            await this.host.request("perfSettle", {}, { sessionId: fresh.id, timeoutMs: 8000 });
+            await this.sendRequest("perfSettle", {}, { sessionId: fresh.id, timeoutMs: 8000 });
         }
         catch (error) {
             return { stop: fail(describeError(error)) };
@@ -5461,12 +6057,12 @@ export class TaplineTools {
         return { session: fresh, seconds: (Date.now() - started) / 1000 };
     }
     /** One measuring window in the app: start, (the tap,) wait out `seconds`, stop. */
-    async measureWindow(session, seconds, press) {
+    async measureWindow(session, seconds, press, delivery) {
         const id = { sessionId: session.id };
         // The window's number: the stop names it, so a call never takes another call's numbers (an older SDK has none).
         let stopParams = {};
         try {
-            const started = await this.host.request("perfStart", {}, id);
+            const started = await this.sendRequest("perfStart", {}, id);
             const windowId = typeof started === "object" && started !== null ? started.id : undefined;
             if (typeof windowId === "number")
                 stopParams = { id: windowId };
@@ -5480,17 +6076,27 @@ export class TaplineTools {
         const started = Date.now();
         try {
             // The caller holds the live view's queue for the whole window when there is a tap (see performance).
-            if (press !== undefined)
-                await this.host.request("press", press, id);
+            if (press !== undefined) {
+                if (delivery !== undefined)
+                    delivery.sent = true;
+                try {
+                    await this.sendRequest("press", press, id);
+                }
+                catch (error) {
+                    if (delivery !== undefined && notDelivered(error))
+                        delivery.sent = false;
+                    throw error;
+                }
+            }
             const rest = seconds * 1000 - (Date.now() - started);
             if (rest > 0)
                 await sleep(rest);
         }
         catch (error) {
-            await this.host.request("perfStop", stopParams, id).catch(() => undefined);
+            await this.sendRequest("perfStop", stopParams, id).catch(() => undefined);
             throw error;
         }
-        const parsed = perfResultSchema.safeParse(await this.host.request("perfStop", stopParams, id));
+        const parsed = perfResultSchema.safeParse(await this.sendRequest("perfStop", stopParams, id));
         if (!parsed.success)
             throw new TaplineError("internal", "the app returned performance numbers the host could not read.");
         return parsed.data;
@@ -5526,7 +6132,7 @@ export class TaplineTools {
                 }
                 let ready = { waited: null };
                 if (press !== undefined) {
-                    const waitedFor = await this.awaitOk(session, "tap", "press", press, listsFor(this.policy, session.app));
+                    const waitedFor = await this.awaitOk(session, "tap", "press", press, this.touchLists(session));
                     if ("stop" in waitedFor)
                         return waitedFor.stop;
                     ready = waitedFor;
@@ -5537,13 +6143,31 @@ export class TaplineTools {
                 const tapped = press;
                 const window = async () => {
                     if (tapped !== undefined) {
-                        const gate = await this.policyGate(session, "tap", "press", tapped, listsFor(this.policy, session.app), ready.waited);
+                        const gate = await this.policyGate(session, "tap", "press", tapped, this.touchLists(session), ready.waited);
                         if ("stop" in gate)
                             return { stop: gate.stop };
+                        const delivery = { sent: false };
+                        try {
+                            const result = await this.measureWindow(session, seconds, tapped, delivery);
+                            if (gate.grant !== undefined)
+                                this.grantNotes.getStore()?.push(gate.grant.line);
+                            return { result };
+                        }
+                        catch (error) {
+                            if (gate.grant !== undefined && !delivery.sent)
+                                await this.releaseGrant(gate.grant);
+                            throw error;
+                        }
                     }
                     return { result: await this.measureWindow(session, seconds, tapped) };
                 };
-                const outcome = tapped !== undefined && this.options.control ? await this.options.control.runAgent(window) : await window();
+                let outcome;
+                try {
+                    outcome = tapped !== undefined ? await this.agentTurn(window) : await window();
+                }
+                finally {
+                    await this.dropPreUse(ready.waited);
+                }
                 if ("stop" in outcome)
                     return outcome.stop;
                 measure = { result: outcome.result };
@@ -5662,7 +6286,7 @@ export class TaplineTools {
                 notes.push(`Note: condition ${name} ${value} was not applied: ${record.failure ?? "the app refused"}.`);
         }
         // A user waits for animations: fast ones end here unless the journey's allow keeps them (PLAN-1.6 F4, E8).
-        if (journey.userEyes && !journey.allows(FAST_ANIMATIONS_ALLOWED) && (await endAnimations(this.host, session.id))) {
+        if (journey.userEyes && !journey.allows(FAST_ANIMATIONS_ALLOWED) && (await endAnimations(this.host, session.id, this.leased))) {
             notes.push("Note: animations were turned off for this journey: a user waits for them. allow fast_animations keeps them on.");
         }
         this.journeyRun = journey;
@@ -5747,7 +6371,7 @@ export class TaplineTools {
                 const session = bound();
                 if (session === undefined)
                     return undefined;
-                const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+                const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
                 if (!tree.success)
                     return undefined;
                 const t = tree.data;
@@ -5766,7 +6390,7 @@ export class TaplineTools {
                     return undefined;
                 try {
                     // The picture is taken with fast animations paused, as a user would see the screen (PLAN-1.6 F4, E8).
-                    return (await withNormalAnimations(this.host, session.id, () => this.takeShot(session.id, width, quality))).value;
+                    return (await withNormalAnimations(this.host, session.id, () => this.takeShot(session.id, width, quality), this.leased)).value;
                 }
                 catch {
                     return undefined;
@@ -5836,7 +6460,7 @@ export class TaplineTools {
             await attempt("the photo picker could not be put back", async () => {
                 const live = this.journeySession();
                 if (live !== undefined && live.capabilities.includes("media"))
-                    await this.host.request("media", { op: "disarm" }, { sessionId: live.id });
+                    await this.sendRequest("media", { op: "disarm" }, { sessionId: live.id });
             });
             const undoLines = [];
             // A network condition a stress moment turned on mid-flow goes back too (one the journey began with is undone above).
@@ -6011,7 +6635,7 @@ export class TaplineTools {
         const session = this.host.current();
         if (session === undefined)
             return null;
-        const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
+        const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true }, { sessionId: session.id }).catch(() => null));
         const screen = tree.success ? tree.data.screen : null;
         return screen ? { width: screen.width, height: screen.height } : null;
     }
@@ -6069,7 +6693,7 @@ export class TaplineTools {
         const session = this.host.current();
         if (session === undefined)
             return this.notConnected();
-        const lists = listsFor(this.policy, session.app);
+        const lists = this.touchLists(session);
         // Resolved inside the agent's turn, right before the press, as a guarded tap does: a queued person's action can't change
         // what is under the target between the check and the touch.
         const refusal = { answer: null };
@@ -6131,7 +6755,7 @@ export class TaplineTools {
         if (session === undefined)
             return { survived: false, why: "the app isn't connected any more." };
         // What a person sees (AGENT-TOOLS 1.12 §17.4): in a user's eyes the glass only; a label a screen reader hears is no proof.
-        const tree = treeResultSchema.safeParse(await this.host.request("tree", { peek: true, ...(this.userEyes() ? { glass: true } : {}) }, { sessionId: session.id }).catch(() => null));
+        const tree = treeResultSchema.safeParse(await this.sendRequest("tree", { peek: true, ...(this.userEyes() ? { glass: true } : {}) }, { sessionId: session.id }).catch(() => null));
         if (!tree.success)
             return { survived: false, why: "the app didn't answer when asked what is on screen." };
         const parts = [];
@@ -6195,7 +6819,7 @@ export class TaplineTools {
             }
         }
         try {
-            const raw = await this.host.request("command", { name: call.command, args: call.args }, { sessionId: session.id });
+            const raw = await this.sendRequest("command", { name: call.command, args: call.args }, { sessionId: session.id });
             const inner = typeof raw === "object" && raw !== null && "result" in raw ? raw.result : undefined;
             const previous = typeof inner === "object" && inner !== null && "previous" in inner ? inner.previous : undefined;
             return { ok: true, ...(typeof previous === "string" && previous !== "" ? { previous } : {}) };