NetDocuments investigation — implementation plan

2026-09-17 addendum — v5 grounding and continuation (implemented in the lane worktree)

Opened in progress and completed on 2026-09-17; final verification and paid synthetic adjudication are recorded below. Historical implementation metadata and enablement status are unchanged.

1. Implemented prompt/finalizer evidentiary rules without a runtime semantic judge: acts/status evidence is distinct from definitions, obligations and conditional scenarios, with explicit positive/pending and sufficient factual-answer cases.
2. Implemented durable receipt origin/completed-work provenance, conservative legacy handling, retained/superseded partial publication, server-derived recorded coverage and handle-aware guidance. Added explicit historical work scope on replay without changing per-invocation accounting.
3. Implemented monotonic terminal lineage and Lua-derived counter saturation without new generations, TTL refresh, money resets or limit changes. Research get suppresses terminal execution retries; revocation retains terminal authority after source-context withdrawal. Uncertain unpersisted terminal observations retain the existing bounded recovery limitation.
4. Implemented four Opus 5 low synthetic fixtures and exact stored-window reporting with 65,536-byte evidence / 262,144-byte report bounds, omitted refs, truncation withholding, separate answer/finding review and non-semantic mechanical exit. The eval mirror follows per-session ownership and retained 3/30/300 capacity rather than an actor execution mutex.
5. Final verification: runtime 5,194 Vitest + 139 and 77 Bun tests passed, 171 skipped; five scoped suites 369 passed with one opt-in PostgreSQL proof unrun; connector limiter eight passed; eval 72 passed. Fourteen temporary mutants failed at intended assertions and were restored. Concurrent retry survives refundable read saturation; definitive caps, revocation and unknown charged reads remain enforced. bun run lint && bun run typecheck && bun run eval:gate:cheap exited 0. Cheap router gated cases passed 4/4; four nongated boundary cases scored 0/5 versus 5/5 in an earlier run: variability, not a claimed regression fix or all-router-case pass. Memory passed 9/9 with a 48-active versus 20-cap warning.

Final pressure proof after the three-line coverage prompt correction: context 120,992; messages 92,724; system 4,974; tools 14,351; framing 8,192; rejected preflight 120,241; largest accepted preflight 101,952; largest actual model request 85,689 bytes. This run recorded 16 useful reads + 7 refreshes = 23 attempts, 0 denials, 35 HTTP admissions. Request limit remains 120,000 bytes; no budget or runtime policy changed.

Paid synthetic rerun c74b2c690f0018c353de174b53555e6e12100189c3af6359fb27b9a6477b2e72: four fixtures, six reports, six answers and 21 findings; independent Astra LOW and Fable MEDIUM semantic PASS. New corrective generation 1 incorporated one research read and two model calls; replay used zero models, zero research reads and $0 model cost, with four revalidations accounted. All displayed evidence was report-complete.

The first paid run failed whole-report acceptance only on unread-content characterization; the generic three-line prompt correction addressed it, and the final run did not repeat it. An immediately self-corrected lead ID is a minor presentation defect, not a material false claim. The factual zero-hit find result is not independently checkable from the report because query/hits are not exposed; only the operation is corroborated. Exact source-length assertions are not uniformly independently verified. This is semantic acceptance, not blanket metadata verification. Final gates passed with the nongated diagnostics noted above; no CI/PR, merge, deploy or enablement claim. This documentation worker made no paid calls or ledger writes.

2026-09-14 top addendum — direct-first research record, implementation plan (implemented in the lane worktree 2026-09-14; default-off)

Approved, amended after review. Concrete plan for the direct-first design addendum and its seven review amendments, which override any contradictory step below. kwiss approved implementation and the fixed 30-minute retention; the steps below were implemented on 2026-09-14 by the Fable HIGH worker (14 production files: 4 new, 10 modified; tests untouched, owned by the omp @write Astra HIGH seat), with the as-built deviations listed at the end of this addendum. Verification: independent focused suites 216 passed, 2 skipped, 0 failed (research 45 passed; investigation 124 passed, 1 skipped; state 47 passed, 1 skipped); full runtime 5554 passed; cheap eval coverage 11/11, retrieval 27/28, router 4/4, memory 9/9; actual MCP smoke 2 direct reads, save/get, Opus 5 low escalation with 3 findings, 3 citations, 2 documents in 109.7s; exact-quote save/get 4 calls, 2.8s on a 22911-character window; web production build passed. The feature is implemented and stays default-off behind APP_NETDOCS_INVESTIGATION_ENABLED; draft PR #423 is updated, never duplicated. Seat deviation (Devin Fusion Fable 5.1 high + SWE-2 medium, at kwiss's request) is recorded in the spec. Scope estimate: about 12 files; no schema, migration, grant, dependency or new env key (the research tool runs under the existing APP_MCP_READ_TIMEOUT_MS policy, so every save/get verification runs under a bounded deadline: an unfinished check reports unavailable, preserves state and never implies verified. Eight windows per save is the maximum, not a promise that all eight finish within the 45 s budget).

1. Provenance seam (packages/agent-runtime/src/tools)

• netdocs-read-provenance.ts (new leaf): provenanceOf(input, result, now), extracted mechanically from the investigator's observe() (canonical args; fingerprints over identities, titles, material metadata and text; fetch offset, offsetConfirmed, total, incomplete facts) so the investigator and the record fingerprint a read identically. observe() keeps the rendering and calls it; the existing investigator suites cover the extraction.
• netdocs.ts: createNetDocsReadClient gains authorization?: "investigation" | "pooled" (default unchanged; pooled calls resolveAccess without a budget, i.e. the ordinary RLS pool) and read() results carry text (the rendered host reply, on success and on failure). endpoint() is exported for the adapter. The investigator's behaviour is unchanged.

2. Record store, tool and escalation (packages/agent-runtime/src/tools)

• netdocs-research-record.ts (new): RESEARCH_RECORD_LIMITS, researchRecordSchema, researchRecordLua (ops create evicting only the oldest unprotected record (protection starts atomically when escalate persists the nonce, request and selection, covers pending creation and linking, and persists with the link) and refusing when none exists, append with bounded typed-lead retention and explicit record_full / omitted, save with revision CAS, get, escalate persisting the server-generated investigation nonce plus pinned selection and request atomically before any creation, link writing the start handle before model execution, owner-only drop), createResearchRecordStore({redis?, now?, random?, signHandle}) exposing open / append / save / get / escalate / link / drop. A foreign, invalid or mismatched-binding handle returns restart from every op without a write. Reuses the state module's production Redis getter (exported), investigationFingerprint and the identity-digest/handle pattern.
• netdocs-research.ts (new): NETDOCS_RESEARCH_PROCEDURE; verifyResearchCitations(record, citations, readClient, budget) (fresh originating-window re-read, exact substring, located code-point offset); revalidateResearchRecord(record, readClient, budget) (one bounded, deduplicated fresh validation of the carried source observations plus the 3,500-code-point citation rechecks, the investigator's resume policy, shared by get, the escalation import and later resumes; revoked or changed observations withheld, deadline → unavailable with state kept); netDocsResearchTool (LangChain tool, strict op: open | save | get union). Not added to netdocsTools: MCP-only, product toolbelt untouched.
• netdocs-investigation.ts: netDocsInvestigationInputSchema gains {research_handle, model?, effort?}; deps.research?: ResearchRecordStore; the start path loads and authorizes the record, persists the nonce and pinned selection/request, calls the new trusted create-or-recover form of state.start keyed by that nonce (identity, request and selection checked; the immutable researchImport descriptor and snapshot seeded atomically into the new context on creation, never overwriting an existing context, money or unknown liabilities; the same session recovered after pending-before-create, create-before-link or a lost response, a lost create response before the first claim recovering generation zero with its import; one lineage under concurrency), defaults the pair to opus/low, and on a linked record continues from the latest persisted generation resolved read-only (never generation zero); get on a linked record returns checked progress and the current handle without a model call or counter change; appends and saves are refused while the handoff is active; investigate() renders the DATA block from the context's explicit non-citable researchImport field (never fabricated tool messages or sources[]) after the bounded revalidation (refresh attempts); direct observations revalidate at their original exposed range and fingerprint (up to 60,000 characters) while native observations keep 3,500-window semantics, once per retrieval or resume, never per thought. createNetDocsDeepSearchTool wires the store; src/index.ts exports the new public names.

3. MCP surface (apps/mcp-server/src)

• tools/netdocs-research.ts (new def north__netdocs_research): family netdocs, enabled: isNetDocsInvestigationEnabled, read-only/open-world annotations, a description that carries the federated/personal/firm-wide wording and the untrusted-data notice the catalogue test requires of every netdocs def, redactArgs = op plus booleans and counts only, handler under invokeWithinMcpToolBudget("APP_MCP_READ_TIMEOUT_MS", …).
• tools/netdocs-context.ts: invokeRecordedNetDocsRead, same three admission checks as invokeNetDocsTool, pooled typed read, record append, research: first line. tools/netdocs-search.ts, netdocs-fetch.ts, netdocs-find-in-document.ts, netdocs-browse.ts, netdocs-list-attributes.ts: optional research_handle (the append takes typed result IDs, next_page_token, counts and find offsets from the typed result, never the rendered text; browse and list_attributes append schema provenance; no-handle behaviour unchanged), stripped before the inner call, refused netdocs_not_enabled when the flag is off, redacted as a boolean. tools/netdocs-deep-search.ts: third start form, redaction boolean. tools.ts is the central catalogue: add the def to NETDOCS_MCP_TOOL_DEFS (line 254; the guard test derives the hidden set from it, so the name list and the def list must both change) and give north__netdocs_research the same dynamic enabled getter the deep-search def gets at line 587 (connected ∧ authorization posture ∧ pilot registration ∧ feature flag), so the research tool is hidden and re-listed together with deep search, never listed while the connector or the deep feature is hidden. Coherence when capability is hidden: a research_handle on a direct read is refused netdocs_not_enabled whenever north__netdocs_research would not be listed, and the server-instruction lines are conditional on the tool being listed (the instructions already say the current tool list is authoritative). server-instructions.ts: three lines (open a record before NetDocuments research when north__netdocs_research is listed; "verified" means the server's status; escalation signals live in the procedure the tool returns).

4. Tests: real behaviour through existing suites, no wording assertions

• netdocs-research.test.ts (new; reference transport plus the opt-in actual Lua case on the disposable Redis): open/append/save/get round trip with a 60,000-character fetch recorded and the stored envelope proven free of the fixture's body sentinel (sentinels target source observations; host notes are plain JSON by design); exact quote verified with a located offset, paraphrase unobserved, swapped fixture changed, revoked document withholds and invalidates the owner's observation, outage unavailable keeps it; a fresh store instance retrieves by handle; cross-actor, forged and changed-binding handles restart with the owner record and slot sets proven byte-identical afterwards; get withholds a revoked or changed source before exposing metadata and reports unavailable on a deadline with state kept; expiry restart; two saves on one revision, second stale; parallel appends both land in sequence order; append past the byte cap yields record_full while the read text is still returned; a fourth open evicts the oldest unprotected record and is refused when every slot holds a pending or linked escalation; the crash-safety proof interleaves a concurrent fourth open with a lost create response and shows the pending record survives, no second lineage appears, and the retry recovers the same session; typed search IDs, next_page_token, counts and find offsets survive the round trip marked historical, and overflow reports record_full.
• netdocs-investigation.test.ts (existing SDK-and-typed-reads block): start from a handle, first wire request carries the import block and located leads, the model fetches at the located offset and finalizes, published; a retry after each injected failure (pending-before-create, create-before-link, lost create response before the first claim, lost start response, lost finish reply) recovers the same session with money and liabilities untouched, the lost-create case recovering generation zero with its researchImport intact and an existing context proven byte-identical after recovery; a 60,000-character direct observation revalidates at its full original range while a native 3,500-window source keeps its semantics, and two concurrent escalations of one record yield one lineage; a duplicate escalation continues from the latest persisted generation with lifetime models unchanged and no second slot; get during and after the handoff returns checked progress without a model call, and an append during the handoff is refused; revoked cited document at import stops authorization and drops the record; deadline during the recheck stops budget with nothing claimed re-verified; existing resume, replay and revocation contracts unchanged.
• apps/mcp-server/test/netdocs-tools.test.ts: the catalogue lists the new tool only under the flag and hides it with the family; the 18-field search parity test filters the North-owned research_handle; a recorded fetch bypasses the session fixture (source provider) and starts with the research: line; a handle with the flag off is refused; redaction shapes. scripts/eval-netdocs-investigation.ts: one matrix case starting from a record over the synthetic corpus; existing cases unchanged.

As built, 2026-09-14 — deviations from the steps above

• The store has three Lua ops (create, get, put with revision CAS) instead of six: append, save, escalate and link are CAS put writes from TypeScript, and eviction protection is the envelope's protected flag set in the same write as the escalation. There is no drop. A record-full or oversized write is record_full; a stale append retries up to three times.
• revalidateResearchRecord and verifyResearchCitations are the get and save paths of runNetDocsResearch; the investigator's import check is its own validateImport (refresh reads, provenanceOf at the original range). The provenance leaf also owns canonicalArgs, cleanArgs, clipPoints and hitMaterial, which the investigator now imports; observe() is otherwise untouched.
• The recorded direct read is the record op of the netdocs_research LangChain tool, invoked by invokeRecordedNetDocsRead in netdocs-context.ts under the ordinary 45 s read budget with owned drainage; createNetDocsReadClient gained the rendered text on both result kinds rather than an authorization: "pooled" option (the MCP adapter injects resolveAccess with the access it already resolved).
• State: start(identity, request, selection, origin?) is the create-or-recover form (recovery is a read that writes nothing; a seeded context expires no later than the record); inspect returns counters, progress, generation, done/active/exhausted, the receipt status enum and the latest continuation handle, never the answer. The context field is researchImport, an opaque validated JSON string (INVESTIGATION_LIMITS.importBytes).
• MCP: north__netdocs_research is in NETDOCS_MCP_TOOL_DEFS with the same dynamic enabled getter as deep search, so it is hidden with the family and with the flag; research_handle on a direct read with the flag off is refused netdocs_not_enabled; three static instruction lines were added (NETDOCS_RESEARCH_RULES). north__netdocs_deep_search advertises research_handle and redacts it as a boolean.
• Existing tests now needing contract updates (test seat): three exact-equality assertions on failed read-client results in netdocs-capability.test.ts (the additive text), and the MCP catalogue suite (redaction shapes gained research, the flag-off listing expects the research def hidden with deep search, the search parity filter must skip the North-owned field).

Acceptance and release gates (implementation approved)

Acceptance on the owned read-only MCP server with synthetic identity: the original private question, unhinted, through a fresh direct Fable host and a fresh direct Opus host given the procedure; save, then get from another fresh host; a forced unfinished direct search escalated to Opus low carrying provenance and pending work, with no repeated-read claim in the import block; exact-citation rejection; revoked, changed, expired and cross-actor records; two concurrent escalations of one record; a lost escalation response retried from a fresh host recovering the same session; the existing deep-search regression. Gates: the package tests above; root bun run lint and bun run typecheck; bun run eval:gate:cheap (routing changed); independent fresh Fable and omp @review Astra reviews to convergence with the deletions pass; rebase onto current main without force-push; update draft PR #423; CI green; MERGE-READY, never merge or deploy.

2026-09-14 top addendum — pre-R2 actual run and verified repairs (still in progress, default-off)

Actual run (09:28 UTC, pre-R2 server, Opus 5 low on the approved OpenRouter Bedrock pin; Astra still rate-limited upstream): one native context of 26 entries across two generations; 12 model calls; 11 useful reads (8 search, 2 find-in-document, 1 fetch); 154 refresh reads; 24 limiter denials; 301 HTTP; ledger $0.850860 actual, $0 unknown. First receipt inconclusive (9 models, 9 reads, 81 refreshes, 276,681 ms, no findings, insufficient_walltime_for_model_call). The generation-1 finalization was a negative/limited-coverage statement, not a budget answer, and was refused because its coverage_statement (1,035 characters) exceeded the maxLength: 800 disclosed in the tool JSON schema; about 20 s remained. Only one source (about 39k characters) was partially fetched; neither budget workbook was reached. The generation finished server-side but its receipt never reached the client within 360 s; the exact delivery cause is unobserved. No semantic pass; model and route differ from the successful Fable CLI experiment, so context shape alone is not isolated.

Since the live run: R2 (coverage, double-resume) and R3 (text-only ACL) fixes landed in the lane tree and are verified by suites and converged Astra/Fable reviews (268 pass / 2 skip; Lua 1 pass; MCP 40 pass; root lint and typecheck exit 0), not by a rerun of the original question. Kept: source ACL, counters, ids, timestamp/lifecycle/test repairs. Rejected: ignoring file size; the hidden-limit inference. Release stays blocked by the failed acceptance and continuation-delivery uncertainty; PR #423 is a draft with a known conflict; no git action this pass.

Proposed next decision (not approved, not implemented): stop re-reading the entire history before and after each model thought; keep fresh access on new reads, on resume and at citation publication, same actor-bound history. Tradeoff: a source edit or revocation during an active generation would not retroactively remove already-read context before the next model call. The strict policy remains in force until kwiss decides; the recommendation rests on 154 refreshes for 11 useful reads, not on proof it finds the budgets.

2026-09-14 top addendum — native research agent cutover (in progress, default-off)

In progress / default-off; implemented in the lane worktree, not committed, not reviewed, not accepted. kwiss approved the fast-track cutover to a real internal research agent with cumulative context after a 67-second fresh Fable CLI experiment (20 read-only NetDocs calls, 4 cited documents, 7 of 8 exact quotes). Two independent plan reviews (Main and this worker) converged before implementation. Effort deviation, recorded at the start: this cutover was written by a Fable LOW worker seat, below the seat table's Fable high; every other routing rule is unchanged. Product model selectors (astra, opus, grok, muse, efforts) are unchanged.

What replaces what

• The snapshot investigation_decide DSL, the mechanical read queue, the fair scheduler, the eight-window digest and transitive invalidation are deleted from packages/agent-runtime/src/tools/netdocs-investigation.ts and netdocs-investigation-state.ts. The agent chooses the five typed read operations itself (netdocs_search, netdocs_browse, netdocs_list_attributes, netdocs_fetch, netdocs_find_in_document) plus investigation_finalize, over the local LangChain message/tool-loop pattern; agents/research/graph.ts is untouched.
• Redis stores the full ordered transcript (LangChain StoredMessage entries, provider tool IDs and assistant metadata preserved) and one source record per observed tool reply (operation, canonical arguments, material fingerprint, document/offset facts, transcript index). Envelope version 6 → 7 fails closed for content; the money record, three turn slots, attempt.turn and late settlement are untouched by the cutover. The Lua citation check and the eval mirror migrated with the new context, not by constants alone.
• INVESTIGATION_LIMITS.models is 24; every model call (decision, correction, finalization) shares it. Money, read, refresh, HTTP, time and byte guards are unchanged. Fresh tool windows are limited to 3,500 code points at the operation boundary with explicit offset, chars, total, next_offset and incomplete header facts; no workbook is ever claimed whole.
• Up to four calls per assistant turn, executed sequentially; further calls get a truthful REFUSED reason="batch_limit" reply. The bounded OpenRouter wire policy pins parallel_tool_calls to false, so batching is effectively a direct-route capability; on OpenRouter every turn carries one call.
• The batch record (pending → dispatched → completed / refused) is checkpointed before and after every dispatch. On resume, unmatched calls get truthful NOT_EXECUTED or OUTCOME_UNKNOWN replies before any model replay; completed work is never relabelled and unknown charged work is never re-executed blindly.
• Superseded 2026-09-14 by user decision (repeated whole-history reads removed): the per-turn traversal described in this item, and its R2/R3 refinements (validation marks, fresh-coverage notes per turn, the text-only correction guard), are deleted. The approved boundary is: access checks on every new typed read (binding and ACL; a withdrawn document fails closed as authorization/read_revoked), one deduplicated re-verification of carried history when a generation resumes (changed material refuses replay, revoked fails closed, outage keeps the private state), and fresh exact re-reads of cited sources before publication or replay. Historical discovery counters are published as observed when recorded, marked fresh: true only when the resume pass re-ran that search, and historical: true when they drifted. Proof: the same 5-turn contract script now spends 7 attempts / 2 refresh reads (it spent 29 / 24 under the traversal). The paragraph that follows is retained as the historical record of that traversal. Original text: the first implementation re-verified carried history only once, on resume, and dispatched derived reads without a post-model check. Then carried history was re-verified before every model turn and again after the model answers, before any derived dispatch or finalization: identical operations/ranges are deduplicated within a pass, every search and document read is repeated, and a preserved reply is reusable only when exposed identities, titles, content metadata (extension, creator, size, attributes) and text are materially identical; the modified timestamp is shown but non-material. The assistant turn and its batch record are checkpointed before the post-model check, so an interrupted check leaves a durable never-executed record, never an unmatched assistant call. A changed or missing source stops the whole batch before dispatch (invalid/history_changed, terminal), a revoked source fails closed (authorization/history_revoked), an outage keeps the private state (budget/refresh_unavailable, resumable). Cost: about 2 × Σ(sources) refresh attempts over a run; the 200-attempt ceiling can end an investigation before 20 research reads.
• Also corrected: source identity is the server-owned transcript position (s<sequence>); the provider's tool call ID is kept only as correlation, so a provider reusing IDs across turns no longer corrupts state, and interrupted-batch settlement matches only replies recorded after that batch's own assistant turn. Duplicate IDs inside one response are refused as an unusable turn (provider/duplicate_tool_call_ids). A continuation handle is offered only while lifetime model, attempt and research capacity remain, whatever the stop; a freshly validated final answer at the ceiling is still published.
• Exact quotes are re-validated against fresh reads at every publication and replay; a changed cited window withholds the findings (invalid/cited_material_changed). A saturated transcript stops with terminal context_pressure; saturated model, attempt or research ceilings never emit a continuation handle.

Verification in this pass

Targeted package Vitest (synthetic DATABASE_URL/APP_DATABASE_URL): investigator 114 pass / 1 skip, state 47 pass / 1 skip plus the opt-in actual Lua case against the disposable Redis on 16383 (1 pass), eval 60 pass, capability adapter 36 pass, MCP tool contract 40 pass. Package typecheck clean; scoped lint 0 errors. The eval suite drives the real investigator over the synthetic JSON-RPC corpus with Anthropic-shaped wire messages, including the forced continuation and replay. No real provider or model call was made; no live acceptance is claimed.

2026-09-11 top addendum — approved deterministic-loop production integration

In-progress / default-off; approved for implementation after plan-review convergence, not implemented or semantically accepted. The user explicitly approved integration and continuation without interruptions unless post-implementation tests fail; no repeated user-approval gate. The top design addendum governs. Together these supersede prior unproven replacement acceptance and stale limits, including prompt-only/per-read scheduling, first-call-only proof and old 34-path/5,600-line ceilings. Preserve historical evidence and safety failures; none is current acceptance. This correction pass touches only the two top addenda and NetDocs STATE row, at most 120 added lines.

Reference and proof limitations

Private reference SHA256 7948acc3ba06dfe0301041103fbd3932c55d88a4529aacb46e80203ac7090c40 was checked. The clean unhinted run reports 3 model calls / 39 research / 38 refresh / 20 pages / 257 unique candidates / 12 distinct documents / 396,866ms / 418,225 microUSD, zero failures or throttles and fresh validation of every accepted citation. Six pages and 249 reads remained pending; cached continuation windows were withheld. This is one successful scenario, not exhaustive coverage, general reliability, a controlled speed comparison or production-tool acceptance. Keep private source, run artifacts and confidential names/IDs/quotes outside the repository; port behavior, not the experiment's rendered-text parsers or private corpus.

1. Review the contract before implementation

Main obtains two independent plan reviews before assigning code: fresh Fable high in Claude Code and omp reviewer @review Astra high. Planning is @plan Astra medium. Implementation is Fable high via Claude when available; the latest lane routing sends Claude exhaustion to Devin Fable 5.1 low before any different-model fallback, including the fresh Fable review leg. This supersedes the older Astra-writer degraded route below. Record only actual routing deviations with their reason; planned normal routes are not deviations and no new exhaustion probe or worker is launched here.

Reviewers must resolve budget classification, storage fit, interruption-safe invalidation, frozen dependencies and actual start/resume acceptance. Use current source and the unfinished branch's verified findings, not dated green counts. Substantial code review adds Grok xhigh for deletions; fixes use @fix Luna max, gates @gates Sol low, git Main. Both independent code reviews must converge after fixes before merge readiness. No merge or deploy authorization.

Review adjudication: Main verified and kept all six findings: mechanical drainage after model exhaustion, retention versus revocation, durable exposed-slice citations, three-slot money semantics, pre-model refresh admission and cooldown for every typed read. Keep byte-budget planning; reject the overclaim that independent field maxima must fit simultaneously or that contextBytes must automatically increase. The aggregate guard is intentional.

2. Extend existing durable state and accounting together

Owner file: packages/agent-runtime/src/tools/netdocs-investigation-state.ts. Extend investigationContextSchema, emptyInvestigationContext, invalidateInvestigationMaterial, command/reply schemas, createInvestigationState and investigationStateLua in one coherent contract. Queue records need candidate deduplication and originating-page membership, query/window pending positions, unprocessed page remainder, dependency fingerprints, fairness position, priorities/revisits and cooldown. Cumulative counters belong to the fenced whole-investigation ledger and are echoed as trusted progress, not model arithmetic.

• Set approved lifetime active time to 600,000ms, keeping 300,000ms per generation and 15,000ms cleanup. Current source has 300,000ms for both, which cannot cover the 396,866ms reference run. Continue using claim-time allowance reservation, measured unused-time refund and conservative crash charging; resume/replay never restart lifetime.
• Replace current 12-model/16-research ceilings with 5 model decisions and 80 useful research reads per investigation; add 200 total typed read attempts, including refresh/denials. Preserve independent HTTP 440/generation and 488/lifetime, refresh guard, financial admission, expiry and serialized bounds. The reference's useful counter excludes rate-limit denials but includes non-throttle failed research outcomes: document this and report successful evidence separately.
• Current research/refresh commands charge before results, with no total-attempt/outcome schema. Review and implement fenced pre-dispatch attempt admission plus idempotent outcome classification, reserving potential useful work until known; unknown outcomes remain conservatively charged. Update Lua validation, result snapshots, runtime admission and the eval mirror together. Never implement “useful” by simply incrementing only after success without a durable admission reservation.
• Keep production financial guards unchanged: $3.03 full model reservations and $5/generation, $15/lifetime, $50/organization-day guards; settle valid actual usage independently of output validity. The $5 production eval comparison versus $50 aggregate ledger is an engineering configuration/accounting check. Main resolves tool/repo-provided configuration against the already-authorized $50 lane allowance, without asking the user, resetting historical liabilities or implicitly increasing any cap.
• Retain HMAC identity/connection binding, fixed expiry, replay-only claims, leases, CAS and concurrency. Preserve the existing THREE money-turn record slots, generation count and attempt.turn semantics, including old late settlement. The 600,000ms lifetime across these slots suffices for the planned two 300,000ms calls; do not add generations. Any content-version cutover preserves durable money keys and historical liabilities while incompatible content fails closed. No migration, auth-storage change or background jobs.
• Port 12,000-character fetched windows, 3,500-character exposed slices, at most 8 exposed windows and 12 exposed pages, and the 120,000-byte wire guard. Current product retention of 6,000 code points must not silently halve the fetched window; exposure must not silently expand. Define production characters as Unicode code points consistently with existing provider-facing offset/length and slicing semantics, and serialized bytes as UTF-8. Name the Unicode-safe normalization of the reference's JavaScript clipping in review and prove non-BMP boundaries; name and justify any other difference from the successful reference.
• Dynamically admit/retain actual UTF-8 serialized bytes within 524,288-byte context and 2,097,152-byte envelope guards, accounting for queue/provenance, receipts, observations, windows, replay and serialization overhead. Independent field maxima need not fit together: 12 × 12,000 × 4 = 576,000 bytes before receipts. Reserve pending provenance and stop/continuation space before optional evidence; retain resumable unprocessed page work before advancing cursors. Under pressure, evict optional material or yield partial with honest omitted counts, never silently lose candidates or impose fixed smaller search quotas.
• Feasible allocation example, not a new cap: 8 full four-byte windows use 8 × 12,000 × 4 = 384,000 bytes; if all other serialized context fields/escaping cost 100,000 bytes, total 484,000 leaves 40,288 bytes for reserved headroom, including the stop record. Admission measures those costs, not assumptions. A wire example exposes 6 × 3,500 × 4 = 84,000 text bytes plus 20,000 measured bytes of pages/framing/other fields = 104,000, leaving 16,000 under 120,000. Max 8 exposed windows/12 pages are upper bounds, not promised occupancy. Fit actual serialized selections and envelope snapshots dynamically; reserve headroom before admission, not after overflow.

3. Replace per-read model control with the fair scheduler

Owner files: packages/agent-runtime/src/tools/netdocs-investigation.ts and netdocs-investigation-prompt.ts. Rework createNetDocsInvestigator's step, execute, modelDecision, read, refresh, checkpoint, decision/final schemas and result construction. Keep the owned model transport, selected model/effort, reservations/settlement, request guard, zero retries and cancellation/drainage. Remove obsolete direct model-read tool dispatch and its prompt/callers, not a second optional path.

1. Model decisions propose searches, prioritize exact returned IDs and request revisits. Code alternates page/document work and round-robins query pagination. Every candidate remains eligible, including zero-score hits; deduplicate memberships and reads. Model choices reorder work but cannot invent IDs, titles-to-ID aliases, scope or permission.
2. Process bounded research batches between decisions, preserving the reference's fair ordering and explicit priorities. Use remaining global budgets and pending work to schedule the next decision/finalizer, not one model call per read. Do not exhaust all five decisions before evidence can be interpreted; finalization/correction spend the same ceiling.
3. Before each model call, reserve typed-attempt capacity for the exact frozen exposed post-decision refresh set, including its dependency traversal, and wall time for bounded model plus refresh. This ports reference loop.ts:326–329, not an extra strategy. If admission cannot fit, disable further model calls and continue already-authorized mechanical work; do not spend the protected refresh capacity on unrelated dispatch.
4. Checkpoint the selected pending item before dispatch; after success atomically persist its result, newly queued work, fairness position and cursor advancement. A forced yield resumes that exact frontier after fresh authorization. Empty/duplicate advancing pages continue; cycles or unavailable process-local cursors stay explicitly incomplete with bounded restart/deduplication, no counter reset.
5. Apply the same persisted cooldown to EVERY typed read: research, pre-exposure, post-decision and final/replay refresh. Replace immediate refresh-throttle budget stops; retain the same pending item and phase, wait/retry only when retry-after and dispatch fit remaining guards, otherwise yield partial. Missing retry-after or deadline-crossing wait yields partial. Throttle is never permission withdrawal; actual permission denial invalidates dependent work. Count every typed attempt, including denials, separately from HTTP.
6. Model-only exhaustion/admission failure disables further model calls, not already-authorized mechanical traversal. Drain pending reads under remaining read/HTTP/time/access/state guards and applicable financial guards; no sixth model call after decision five. Only a guard blocking that work causes a partial stop with the recoverable frontier and precise reason. No hidden page/window completion cap; an answer with pending pages cannot claim project completeness or absence.

4. Enforce live dependency and exact-exposure evidence

Owner files: runtime investigator/state/prompt plus packages/agent-runtime/src/tools/netdocs.ts. Reuse createNetDocsReadClient.read, never parse rendered MCP text. Source confirms readScope.run, readDocumentSession's scoped cache bypass and fetchNetDocs's requested-ID check. Custody-only authorize is not a fresh document ACL; session timestamps are not permission evidence. Preserve ordinary direct cache behavior and provider-confirmed offset/source fields.

• Before exposure, refresh retained material through originating operations and traverse dependencies with a visited set. Fingerprint titles, metadata, content, IDs and completeness/pagination facts. Persist invalidations incrementally or as an interruption-safe fenced transition before any later exposure/dispatch; never rely on reaching the end of a refresh loop.
• Separate explicit revoked/changed dependency invalidation from ordinary retention eviction in Redis prune (netdocs-investigation-state.ts:722–735): routine window retention changes must not empty snapshots as if access were revoked. Keep pending provenance recoverable; replay independently live-validates every cited source and its dependencies regardless of retained inventory. No stale replay fallback when validation cannot complete.
• Freeze the successfully refreshed exposure and exact displayed substrings. No unrefreshed replacement enters after a failed member is removed. After model return, live-refresh that exact frozen dependency set before derived dispatch/finalization. Changed or missing dependencies reject the decision and invalidate its derivations; stale pending queries cannot run first and validate afterward.
• Bind finalization's ID schema to exposed IDs and require exact exposed quotes. A substring found only in hidden retained text is invalid. Keep provider locations optional/confirmed; internal character matching is not a workbook coordinate. Update investigationCitationSchema, resolveInvestigationCitation, InvestigationWindow, NetDocsInvestigationResult, InvestigationAccounting and consuming renderers as needed, without compatibility aliases.
• Correct Lua resolve (netdocs-investigation-state.ts:514–531), which currently accepts full retained text: durable citation acceptance must bind to the actual frozen exposed slice as well as TypeScript validation. Update persisted exposure/citation schema, command validation, Lua resolver and eval mirror consistently; retained text alone never authorizes a quote.
• Final, partial and replayed receipts require fresh exact-quote validation. Insufficient budget, provider uncertainty, interruption or revocation fails closed for affected evidence. Persist the pruned frontier before durable finish; await owned connection/body cleanup before publishing. Cancellation during any phase suppresses provisional evidence/handles and forbids later dispatch.

5. Migrate the existing entry surfaces, not model semantics

netdocs.ts:createNetDocsDeepSearchTool renders the same authorized findings and partial-coverage contract on product/MCP while keeping audit data redacted. Change packages/agent-runtime/src/index.ts only if exported types change. apps/mcp-server/src/tools/netdocs-deep-search.ts:netDocsDeepSearchDef and apps/mcp-server/src/tool-deadline.ts:invokeWithinMcpToolBudget change only where the state/result/budget contract requires it. Preserve the 330,000ms default deep-search envelope (activeMs + 2 * cleanupMs), 360,000ms clamp, shorter outer deadlines and ownedSettlement; 600,000ms is lifetime, not a larger RPC. Preserve default-off catalogue/call-time guards and public start-selected model/effort pinning through continuation; no REST or auth/connector-storage edits.

6. Verification that earns acceptance

Existing files: packages/agent-runtime/scripts/eval-netdocs-investigation.ts (createEvaluationState, runSyntheticEvaluation, assessSyntheticResult, evaluationExitStatus), its existing test, runtime netdocs-investigation.test.ts/netdocs-investigation-state.test.ts, affected capability/direct/window tests and apps/mcp-server/test/netdocs-tools.test.ts. Use existing typed-read/provider/state seams. Port only meaningful behavior from the nine private synthetic groups; do not add the private receipt parsers, a fixture corpus, a huge DB suite or tests that merely pin implementation wiring/wording.

Do not promote unfinished branch repairs to a green baseline. Current source's text-only window-change check, end-of-walk invalidation and lack of an exact frozen post-model dependency refresh need explicit regression proof. Retain the verified historical causes as acceptance checks even where a repair exists: cold authorization outside owned timing; connector SSE waiting for EOF; inherited implicit model streaming; stale persisted candidate exposure; sibling work deleted on replacement; advancing-page stagnation; MCP count-only answer; missing supported search fields; pre-dispatch body-guard unknown reservations. Review actual causes and deletion impact, not just final happy-path output. Existing narrow connector/MCP tests may cover these; no broad new infrastructure suite.

Offline/package gates: relevant agent-runtime and MCP package tests, connector tests where changed behavior reaches that seam, then root bun run lint and bun run typecheck. Run the targeted cheap routing gate and bun run eval:gate:cheap where required by retrieval/routing changes within established lane authorization and accounting; record any exact waiver, never relabel paid subgates offline. The eval reference mirror does not prove Lua atomicity: exercise the affected existing isolated Lua cases on the permitted disposable target, never the shared database. Main resolves tool/repo-provided configuration without renewed user permission. No large database matrix.

Real acceptance, after fixes and reviews: run the original unhinted question through actual north__netdocs_deep_search using Opus medium, the proven route, following returned continuation handles rather than manufacturing state or bypassing the tool. Also run the existing Astra acceptance flow without changing its model/effort semantics. Recover and cite the relevant identity/evidence chain and supported budget contents; distinguish existence, exact filing scope, latest and approval, with no invented flattened-workbook associations. Report partial coverage and pending/withheld work. Transport success, private bypass and direct fallback are not acceptance. Record per-call/end-to-end time, models, useful reads, attempts, refresh, HTTP, limits, actual/unknown/reserved cost, fresh citation validation and unsupported claims; keep confidential evidence private. Refresh this evidence after fixes, not before them.

Approved continuation, engineering decisions and ownership

The approved integration uses 600,000 active ms lifetime, 300,000ms per call and 5/80/200 ceilings, not a latency SLA. Read-only acceptance under the established lane identity and $50 lane allowance is already authorized. Continue after plan-review convergence without repeated approval or interruptions unless post-implementation tests fail. Main resolves configuration/accounting from available tools/repo information without increasing caps. Dynamic retention requires proof of byte fit; the existing three money-turn slots are unchanged. Name and justify reference differences; no extra search strategy, retry platform, default-model change or broad reliability claim follows from the private run.

Implementation completes only when scheduler, state/Lua/eval contract, consuming types/renderers and affected tests agree, behavioral checks and real-tool acceptance have fresh evidence, and independent reviews converge. Keep in-progress/default-off until accepted; enablement remains separate. Remove obsolete per-read code and temporary proof artifacts after verification, preserve historical documentation and ordinary direct tools. Main owns git and later merge/deploy decisions; none is authorized here. This documentation-only seat stops at PLAN-CORRECTIONS-COMPLETE.

Latest superseding plan — completion-driven investigation, design only

In-progress / default-off. No implementation assignment or acceptance. The user's ok let's try that, then we don't care about the limits to be honest it's a critical feature so we need that, supersede the 34-path/5,600-LOC and 6-model/8-research/35s/3-turn/105s acceptance ceilings. Implement for reliable completion through normal continuation, not a larger arbitrary search quota. The completion-driven spec governs; prior claims below remain historical evidence, not competing instructions.

Routing: Main reports the current Fable probe failed out-of-usage: degraded: fable, no repeat probe. Author @plan Astra medium matches config, not a deviation. Under WORKFLOW's prose/degraded rules, implementation when assigned goes to @write Astra high; plan review requires fresh Astra medium plus Grok xhigh as the different-model/family leg. This is the documented degraded route, not completed reviews. Gates remain @gates Sol low; substantial implementation review requires Astra high and Grok xhigh deletion review plus a fresh same-family session under the degraded rule. Old Astra-only/medium overrides below are history, not current routing. No workers launched here.

Transport addendum — 2026-09-11 multi-model bounded transport (in progress, default-off)

Scope. Owners: packages/agent-runtime/src/model.ts (registry: supported efforts, default effort, temperature and routing policy), model-pricing.ts, tools/netdocs-investigation-selection.ts (pure selector → canonical pair, leaf module), tools/netdocs-investigation.ts (refusal order, pinning, accounting), tools/netdocs-investigation-state.ts (pair stored on the envelope, echoed by every claim) and apps/mcp-server/src/tools/netdocs-deep-search.ts (advertised V3 choices, pre-access refusal). No cursor, DB, cap or continuation-format change; the completion-driven redesign above remains design-only and open. Chat default, chat picker and every Anthropic construction path are unchanged.

Selection contract. A start accepts optional model ∈ astra | opus | grok | muse and optional effort. Supported efforts and defaults come from the registry, never from the tool: Astra and Opus 5 low, medium, high, xhigh, max (defaults low / medium); Grok 4.6 low, medium, high, xhigh (default low); Muse Spark 1.2 minimal, low, medium, high, xhigh (default low). Omitted model keeps the env/default direct-Anthropic policy (AGENT_NETDOCS_INVESTIGATION_MODEL, else claude-sonnet-4-6); a direct-Anthropic model runs with reasoning disabled, internal effort none, which is not a public selector. Fable and the rest of the catalogue are not selectable. An unsupported pair is refused before authorization, state or budget on both surfaces. Resume takes only the existing handle and optional guidance and rejects model/effort. The V3 MCP schema advertises the choices; the canonical strict union still validates first.

Pinning. Every new production or eval start stores the canonical model id and effort; every claim echoes them and the investigator re-validates the stored pair before replay or research, so a later env change cannot switch a running investigation. Old envelopes with both fields absent resolve today's default; a partial or unsupported stored pair stops configuration. accounting.modelId / accounting.effort report the effective pair.

Routing. Astra Azure-only ZDR pin; Opus 5 Amazon Bedrock-only ZDR pin; Grok 4.6 xAI ZDR endpoint under the shared policy; Muse Spark 1.2 the sole approved non-ZDR exception (only: [meta], zdr: false) with data_collection: deny and no fallback retained. Every other unpinned route stays refused; an unavailable route stops configuration, never heals to a default. Chat posture is per model: Astra and Opus 5 are utility/eval-only; Grok 4.6 and Muse Spark 1.2 keep their existing, intentionally preserved ordinary-chat support, neither added nor withdrawn here. The investigation's bounded effort stays utility/eval on every route, with custody and no-fallback unchanged.

Bounded request. Complete serialized body at most 120,000 UTF-8 bytes (the 49,152-byte figure first written here is the historical cap; the canonical contract §6 carries the current 120,000); 4,000 total output tokens including reasoning for every OpenRouter route (direct Anthropic keeps 2,000); zero retries at both the LangChain and SDK layers; non-streaming; the pinned effort sent as OpenRouter's native reasoning: {effort} because the SDK heuristic drops effort for vendor-prefixed slugs; effort raises no limit. Temperature follows the registry: Astra and Opus omit it, Grok and Muse keep the supported setting. A final guard on the SDK-serialized body enforces the exact stripped slug, the model's provider block (data_collection: deny, allow_fallbacks: false, the pin, zdr: true except for the Muse exception), usage.include, tool_choice: auto, parallel_tool_calls: false, and rejects caching directives, model aliases, routing keys and output overrides before dispatch; the existing 404-marking OpenRouter fetch delegates to that guard, then to the owned fetch.

Accounting. The state reservation stays 3,030,000 microUSD per attempt. A bounded-price capability (wire bytes as the input-token ceiling) must fit inside it. At the current 120,000-byte cap with 4,000 output tokens: Astra 1,540,000, Opus 5 770,000, Grok 4.6 264,000, Muse 167,000 microUSD; direct Sonnet with 2,000 output tokens 390,000 microUSD; all inside 3,030,000. Conservative regional ceilings 11/55, 5.5/27.5, 2/6 and 1.25/4.25 USD per million, verified 2026-09-11 separately from the unchanged global price date. The historical 760,672 / 380,336 figures were computed against the 49,152-byte cap and are retained as history only; the existing pricing regression is updated by the core worker, not by this document. OpenRouter actuals come only from the raw owned payload's finite non-negative usage.cost (cache and reasoning included), never from token estimates; missing or invalid cost leaves the attempt unknown. Normalized and native finish reasons plus message.refusal map to refused / provider; the owned fetch and body drainage are awaited before settlement.

Proof, 2026-09-11 real MCP smoke on frozen source (Main-owned, paid, env-selected Astra/Opus). Astra low: 3 receipts, 11 model calls, 18 research, 28 HTTP, $0.327326. Opus 5 medium: 3 receipts, 14 model calls, 13 research, 23 HTTP, $1.120465. Both: zero unknown attempts, zero unresolved reservations, correct accounting.modelId. This proves transport, start/resume and accounting on both routes and stays valid for the same pinned routes. Per-start selection smoke (server default Sonnet, actual tool calls): grok/high and muse/minimal, three receipts each, canonical model and effort correct throughout, both inconclusive with no findings. Those runs exposed a pre-dispatch accounting defect (the local body guard can retain an unknown reservation) now being fixed by a separate worker; no financial proof or final test counts are claimed for these routes until Main re-runs. Known semantic failure: no run produced a finding; semantic retrieval acceptance remains failed and open. Feature remains in progress and default-off.

1. Replace fixed generation/depth admission in the existing state module

packages/agent-runtime/src/tools/netdocs-investigation-state.ts: update createInvestigationState, command/reply schemas and investigationStateLua together. Replace three precomputed hashes/turn arrays and fixed model/research/HTTP/lifetime-active ceilings with demand-minted fenced generations, dynamic financial turn entries and measured counters. Continue within fixed 30-minute expiry, existing limiter, monetary caps and per-call deadline. Keep three replay receipts as bounded retention, not a continuation ceiling. Preserve HMAC identity binding, replay-only claims, CAS, stale-owner exclusion and crash takeover.

Add an authoritative allowance snapshot to claim/admission/checkpoint replies, validated at the state seam: deadlines, expiry, consumed counters, monetary headroom including unresolved reservations, limiting reason and revision. Use a read-only fenced refresh only where existing replies cannot give current admission information. No model-derived budget or untrusted public cap override. Retain $5/turn, $15/lifetime, $50/org-day and full $3.03 reservations; reconcile Lua's observed $5 eval comparison with the separately approved $50 aggregate eval policy. Preserve historical ledger identity and late settlement across content-version cutover; do not reset financial keys.

2. Make the investigator pursue evidence and preserve useful progress

packages/agent-runtime/src/tools/netdocs-investigation.ts: update modelDecision, decision/final schemas, step, execute, validate, checkpoint and result construction. Track cited identity, budget contents, filing scope, latest and approval as separate obligations with provenance. Decisions identify their obligation and expected gain: read anchor → reconcile linked identity/contradiction → discover and inspect alternatives → answer supported claims with gaps. No customer-specific ID, alias or parcel rule.

Build canonical progress over validated state before the current last-24-node/14KB presentation trim. Remove the 25-line repeatedSearchSameLeads projection and its presentation-order assumptions when the replacement owns that contract. Compare equivalent searches with completeness/uncertainty intact; report stagnation to replanning, not fabricated exhaustion. Carry unresolved obligations through compaction and resume; remove obsolete wording-pinning tests instead of preserving a second feedback convention.

Keep discovery = [] single exposure, opaque internal candidates, fresh requested-ID-matched ACLs and transitive pruning. Choose a currently exposed lead for immediate fetch; if it was not fetched before yield, reacquire via the saved authorized query rather than resurrecting its ID. Promote only read-supported identity links and claims. netdocs-investigation-prompt.ts explains the new control/progress fields and evidence sequence; it already requests fetching/aliases, so prompt edits alone are not the fix.

Send trusted remaining-budget/progress controls outside UNTRUSTED_DATA after ACL costs and model admission are accounted for. State snapshots guide planning but never bypass atomic admission. Preserve Sonnet 4.6, 2,000 output tokens, zero hidden retries, 48KiB actual SDK request guard and source injection boundaries; no model upgrade is assumed.

3. Cooperatively yield before the hard stop; retain transport ownership

Replace private graph recursionLimit 9 with an explicit serial completion/progress/deadline loop inside the same module. Initially keep 35s hard-active/40s cleanup and begin cooperative yield at 30s or earlier when the planned operation threatens the five-second active receipt reserve. New research stops at yield; fresh receipt ACLs/checkpoint run within the hard-active envelope. Preserve suppression after hard abort and await withNetDocsConnection close/drain before publishing. Never use cleanup time for research.

apps/mcp-server/src/tools/netdocs-deep-search.ts:handler, runtime run and state claim deadlines must consume one shared policy, not three drifting constants. Keep tool-deadline.ts:invokeWithinMcpToolBudget's 45s default, 5–55s override clamp and ownedSettlement semantics, plus tools/netdocs-context.ts:invokeNetDocsTool identity/cancellation propagation. Shorter outer deadlines shrink all stages. Retain direct 15s/25s operation and 6s provider defaults; no transport-wide timeout lift or new background service.

Extend NetDocsInvestigationResult with semantic progress and a distinct cooperative-yield reason; migrate both existing adapters/renderers and their descriptions together. Return cited findings, outstanding obligations/actions, scope limitations, measured accounting and an opaque expiring continuation. Normal same-tool resume consumes the saved frontier after fresh authorization; duplicates revalidate/replay, not rerun. Finalized supported answers do not force pointless continuation solely because latest/approval remain unknown. Host may resume or offer the user continuation; this plan cannot promise host obedience.

4. Prove behavior through existing test and eval seams

• netdocs-investigation.test.ts: real typed reads with existing syntheticCorpus; anchor fetch, cited alias/contradiction, both financing contents, no fabricated filing/latest/approval/numbers. Shuffled and held-out identities must work without known production IDs. Search repetition must trigger useful replanning independent of presentation order; justified pagination/recovery remains allowed.
• netdocs-investigation-state.test.ts: more than three supported generations and more than old per-turn read counts without resetting counters/money; duplicate replay, expired retained receipts, crash takeover, dynamic-turn late settlements and monetary denial. Old v2 content safely restarts while old financial liabilities and settlement remain intact. Actual Lua verification requires an authorized isolated target; reference tests are not atomicity proof.
• Cross both seams for cooperative yield with cited partial progress and exact resumable obligation, then completion; shortened outer deadline; cancellation during model/read/ACL/finish/held close; no post-cancel dispatch or premature publication. Revoke an anchor between calls and prove aliases, scope, frontier and receipt are pruned. Same bearer does not waive fresh document ACLs.
• apps/mcp-server/test/netdocs-tools.test.ts, runtime capability/direct/window tests and connector test/client.test.ts: actual registered names, start/resume schema compatibility, current catalogue/call-time gates, default-off, ordinary tools unchanged, connection reuse and owned body drainage. Keep the existing synthetic no-alias, different-parcel, injection, empty-page and long flattened-window cases.
• packages/agent-runtime/scripts/eval-netdocs-investigation.ts and its existing test: update reference state and evaluate semantic results over the full supported continuation lifecycle. Remove first-call/three-turn acceptance shortcuts, retain durable aggregate reservations and unrun reporting. Do not substitute mocked findings or make fixture expected facts planner input.

Acceptance: the original private question (kept outside the repository) independently recovers the cited identity chain to the independently linked project identity and both budget contents (two financing alternatives) with relevant source citations and stated limitations; clearly distinguishes project existence, observed filing scope, latest and approval; 43/55 is incomplete coverage, not proof of a third-matter filing. Record per-slice/end-to-end latency, model/research/ACL/HTTP counts, actual/unknown/reserved cost and unsupported claims. The historical experiment's one-deep-call/12-tool harness restriction is removed in the future acceptance driver, not mislabeled a full product failure. Direct fallback success does not pass the investigator.

Review, evidence and authorization gates

Main owns fresh independent plan review and subsequent implementation assignment. After implementation, update the existing canonical provider contract and affected tests/callers; this documentation-only seat leaves them unchanged. Required gates remain root lint/typecheck, affected package tests and eval gates per WORKFLOW/config. The scorecard records that cheap-eval subgates may perform paid/provider/DB work: Main must preserve authorization or record an explicit waiver, not run them blindly. No prior green suite is proof of this proposed behavior.

Main reports latest pair: Opus 5 A 12 direct calls/66.211s/no leads; B 10 direct + 1 deep/106.940s, both expected proformas through DIRECT fallback. Deep: 4 Sonnet calls/8 research/11 HTTP/30.961s, inconclusive budget, zero findings/aliases; requested resume and later reads blocked by harness. Latest ledger: 91 actual attempts, 2,898,528 microUSD, zero unknown/reserved, $50 total authority unchanged. No replay/model/provider call in this design pass.