@corenel/tools-web 0.11.4 → 0.12.0

package/dist/runtime.js

@@ -1,8 +1,8 @@
 import { createWorkerAgent } from './workerClient';
 import { nodeUsageOf } from './nodeUsage';
 import { publishSubagentEvent, publishSubagentParentEnded } from './subagentBus';
-import { foldLive } from './liveFold';
-import { createRunWatchdog } from './runWatchdog';
+import { createChat } from '@corenel/harness/chat/engine';
+import { userText, userImages, outgoingMessages } from '@corenel/harness/chat/messages';
 import { listDocs, deleteDocsForSession } from './contextDocs';
 import { loadedToolNames, setLoadedTools } from './sessionLoadedTools';
 /* Read-only now: a conversation from before the snapshot may carry an explicit
@@ -10,89 +10,82 @@ import { loadedToolNames, setLoadedTools } from './sessionLoadedTools';
  * chat's prompt is decided when it starts. */
 import { sessionSystemPrompt } from './sessionSystemPrompt';
 import { sessionSystemConfig, freezeSessionSystemConfig, clearSessionSystemConfig } from './sessionSystemConfig';
-import { stateDirName, sessionsRoot, isCheckpointTool, unpricedCalleeRefusal } from '@corenel/protocol';
+import { stateDirName, sessionsRoot, isCheckpointTool, unpricedCalleeRefusal, HOOK_ASK_TOOL } from '@corenel/protocol';
 import { listSystemPrompts, resolveSystemPrompt, readSystemPromptSource } from '@corenel/harness/prompts/systemPrompts';
-import { turnsFromSessionMessages, foldPoint, isFoldedTurn } from '@corenel/harness/conversation';
+import { workspaceBlock } from './workspaceBlock';
 import { allTools } from '@corenel/harness/tools/builtins';
 import { applyTodoWrite, addActivity, resolveActivity } from '@corenel/harness/todos';
 import { getPolicy, STANDARD_POLICY } from '@corenel/harness/guardrail';
 import { composeAgentSystem, TOOLS_MARKER } from '@corenel/harness/prompts';
 import { getSystemParts } from '@corenel/harness/systemParts';
-import { CHECKPOINT_MARKER, estimateTokens, COMPACT_AT_FILL } from '@corenel/harness/core/compactHistory';
+import { estimateTokens, COMPACT_AT_FILL } from '@corenel/harness/core/compactHistory';
 import { priceUsageWith, pricedForUsd } from '@corenel/harness/core/pricing';
 import { enabledSkillCatalog } from '@corenel/harness/skills';
-import { alog } from '@corenel/harness/log';
-// The agent's model is the user's picker selection (getModel) — a real
-// catalog entry, so pricing/context come from host.modelInfo, not hardcoded figures.
-const WATCHDOG_MS = 45000;
-/** A session allow is keyed by WHO asked and the tool, so allowing a callee's
- * write never carries to another callee, or to the caller. */
-function allowKey(agent, tool) {
-    return JSON.stringify([agent ?? '', tool]);
-}
 function emptyInternal() {
     return {
         turns: [], live: null, running: false, error: '', mode: 'auto', input: '', attachments: [],
-        pendingPerm: null, pendingAsk: null, approvalSuggestion: null, loaded: false, suggestions: [], recovery: null, abort: null, toolMs: {}, allowed: new Set(),
-        pendingCommand: null, runId: null,
+        pendingPerm: null, pendingAsk: null, approvalSuggestion: null, loaded: false, suggestions: [], recovery: null,
+        pendingCommand: null,
         recEvents: [], injectedIds: [], lastUsage: { promptTokens: 0, completionTokens: 0 },
-        offloadTick: 0, policyNotes: [], degradedModel: null, model: null, modelNotice: null, persistedLen: null,
-        saveBlocked: null, loadMissed: false, mergeTick: 0,
+        offloadTick: 0, policyNotes: [], degradedModel: null, model: null, modelNotice: null,
+        saveBlocked: null, mergeTick: 0,
     };
 }
-/** Build the user message — a plain string, or multimodal parts when images are attached. */
-function buildUserMessage(text, images) {
-    if (!images.length)
-        return { role: 'user', content: text };
-    const parts = [];
-    if (text)
-        parts.push({ type: 'text', text });
-    for (const url of images)
-        parts.push({ type: 'image_url', image_url: { url } });
-    return { role: 'user', content: parts };
+/** Whether `c` is a whole stored session (a save's read hands back the store's
+ * own record) rather than a draft's stand-in. */
+function isSession(c) {
+    const p = c;
+    return typeof p.createdAt === 'number' && typeof p.updatedAt === 'number';
+}
+/* The engine's frozen system prompt (StoredConversation.system, R4) is a daemon
+ * store field. The browser never keeps it: it is left out of every save and
+ * every read, so a reload composes the system afresh. */
+function withoutSystem(c) {
+    if (!('system' in c))
+        return c;
+    const copy = { ...c };
+    Reflect.deleteProperty(copy, 'system');
+    return copy;
 }
-function userText(m) {
-    if (typeof m.content === 'string')
-        return m.content;
-    if (Array.isArray(m.content)) {
-        const t = m.content.find((p) => p.type === 'text');
-        return t && 'text' in t ? t.text : '';
-    }
-    return '';
+/** The ask detail back from the engine, which carries it as unknown: the
+ * worker built it as a PermDetail (already clipped), so only its fields pass. */
+function permInput(x) {
+    if (x === null || typeof x !== 'object')
+        return undefined;
+    const o = x;
+    const out = {};
+    for (const k of ['command', 'path', 'cwd', 'root']) {
+        const v = o[k];
+        if (typeof v === 'string')
+            out[k] = v;
+    }
+    return Object.keys(out).length ? out : undefined;
 }
-function userImages(m) {
-    if (!Array.isArray(m.content))
-        return [];
-    return m.content.filter((p) => p.type === 'image_url').map((p) => ('image_url' in p ? p.image_url.url : '')).filter(Boolean);
+/** A System One ask's detail back from the engine, which carries it as
+ * unknown: the tool, the reasons and an optional result, nothing else. */
+function hookInput(x) {
+    if (x === null || typeof x !== 'object')
+        return undefined;
+    const o = x;
+    if (typeof o.tool !== 'string' || !Array.isArray(o.reasons))
+        return undefined;
+    const reasons = o.reasons.filter((r) => typeof r === 'string');
+    return { tool: o.tool, reasons, ...(typeof o.result === 'string' ? { result: o.result } : {}) };
 }
-/** What a send hands the run: the raw included transcript, or -- once a run
- * has folded -- the newest LIVE seam's folded view plus the included turns
- * after the user turn that produced it. Turns at or before that turn are
- * already in the view; sending them raw again re-folded the whole history
- * every send. A view whose user turn is gone is skipped for the one before it,
- * and with no live view at all the transcript goes raw (the next run re-folds). */
-function outgoingMessages(turns) {
-    const fp = foldPoint(turns);
-    if (fp)
-        return [...fp.view, ...turns.slice(fp.throughIndex + 1).filter((t) => t.included).flatMap((t) => t.messages)];
-    return turns.filter((t) => t.included).flatMap((t) => t.messages);
+/** The event as recordings and host hooks see it: a tool-hooks event without
+ * its blocked result. */
+function withoutBlockedText(e) {
+    if (e.type !== 'tool-hooks' || e.blockedText === undefined)
+        return e;
+    return { type: 'tool-hooks', id: e.id, mark: e.mark };
 }
-/** Stamp a run's folded view on its newest seam, and keep exactly ONE older
- * view: each is a full copy of the window and persist rewrites every turn on
- * every send, so views left on every seam grow without bound in a chat that
- * never ends. The one kept is what `retry` of the folding turn falls back to
- * (retry removes the newest seam with its user turn). */
-function stampFoldedView(turns, seamId, view, through) {
-    const older = turns.filter((t) => t.foldedView && t.id !== seamId).map((t) => t.id);
-    const keep = older[older.length - 1];
-    return turns.map((t) => {
-        if (t.id === seamId)
-            return { ...t, foldedView: view, foldedThrough: through };
-        if (!t.foldedView || t.id === keep)
-            return t;
-        const { foldedView: _view, foldedThrough: _through, ...rest } = t;
-        return rest;
-    });
+/** The engine's permission answer in the worker's terms: a session allow says
+ * so, a deny with a note carries it, and every other answer stays the bare
+ * boolean it always was. */
+function toPermissionAnswer(a) {
+    if (a.by === 'session')
+        return { allow: a.allow, by: 'session' };
+    return !a.allow && a.note ? { allow: a.allow, by: 'human', note: a.note } : a.allow;
 }
 /** Merge a form's freshly-emitted envelope into a per-run override, against the
  * currently saved default. The form only emits the keys it still wants set — a
@@ -185,6 +178,30 @@ export class AgentRuntime {
             writable: true,
             value: new Set()
         });
+        Object.defineProperty(this, "nextPermId", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 1
+        });
+        /** Asks raised while another was on screen, per session, oldest first: each
+         * becomes the shown card (pendingPerm) when the one before it is answered,
+         * so two parallel asks are two cards and an answer reaches only its own. */
+        Object.defineProperty(this, "permQueues", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        /** Tool results a System One check or hook blocked, per session and tool
+         * call id. Memory only, for the life of the page: never saved, recorded or
+         * sent to a model. */
+        Object.defineProperty(this, "blocked", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         Object.defineProperty(this, "_ws", {
             enumerable: true,
             configurable: true,
@@ -197,6 +214,48 @@ export class AgentRuntime {
             writable: true,
             value: null
         });
+        /* ---- the conversation engine ---------------------------------------------
+         *
+         * Turns, the live fold, the run's lifecycle (guard, watchdog, stitch), the
+         * write queue and the merge-by-turn-id save are the harness chat engine's.
+         * This runtime is its browser host (chatHost): it supplies the worker loop,
+         * the session store, the composer, the approval cards and everything else
+         * only a browser has. */
+        Object.defineProperty(this, "chat", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: createChat()
+        });
+        Object.defineProperty(this, "chatHost", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /** Forgotten in the engine (deleteSession, reset), so every engine mutator is
+         * a no-op for them until a load or a turn opens them again. open() reopens
+         * one before this side mutates it. */
+        Object.defineProperty(this, "forgotten", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        /** Sends and retries waiting for the engine to start their turn, oldest first. */
+        Object.defineProperty(this, "pending", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        /** The turn the engine is running per session, from its guard to turnComplete. */
+        Object.defineProperty(this, "active", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
         /** Reuse the most-recent empty saved session if there is one, else open a
          * DRAFT (newDraft): opening the app, or landing after a delete, saves
          * nothing until the user first sends. Concurrent calls are deduped (React
@@ -210,9 +269,10 @@ export class AgentRuntime {
         /* DRAFT CHATS. A draft is a chat id held only here: loaded, empty, in no
          * store and so in no chat list. Its first write (the first send, or a note,
          * a kept console command, /memory) creates it in the store under the SAME
-         * id (materialize), so nothing that already holds the id has to move. A
-         * model picked on a draft stays in memory and is saved with it. Its system
-         * config is frozen then too, so abandoned drafts leave nothing behind. */
+         * id (materialize, from the host's writeConversation), so nothing that
+         * already holds the id has to move. A model picked on a draft stays in
+         * memory and is saved with it. Its system config is frozen then too, so
+         * abandoned drafts leave nothing behind. */
         Object.defineProperty(this, "drafts", {
             enumerable: true,
             configurable: true,
@@ -235,19 +295,7 @@ export class AgentRuntime {
             writable: true,
             value: new WeakMap()
         });
-        /* ---- run ---- */
-        /* One store write at a time per session: every read-modify-write of the
-         * stored chat (persist, the first-send retitle) goes through here. Each
-         * re-reads the session first; two overlapping would let one read the other's
-         * write before persistedLen caught up and take it for another writer, or
-         * write back a list the other had just shortened (a retitle restoring a
-         * cleared chat, R37). */
-        Object.defineProperty(this, "writing", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new Map()
-        });
+        this.chatHost = this.buildChatHost();
         // Availability and the fallback are read live, so every open chat's
         // notice must re-render when either moves.
         if (host.perChatModel)
@@ -274,6 +322,7 @@ export class AgentRuntime {
                 getMemoryProvider: () => this.host.memory?.() ?? null,
                 getCalleeMemoryProvider: (agent) => this.host.calleeMemory?.(agent) ?? null,
                 ...this.host.workerDeps,
+                ...(this.host.mutations ? { mutations: this.host.mutations } : {}),
             });
         return this.worker;
     }
@@ -313,6 +362,40 @@ export class AgentRuntime {
         }
         return s;
     }
+    /** Copy the engine's half of the session onto this side's, so the object a
+     * view holds reads as one SessionState. Only for a session this side holds:
+     * reading the engine creates its entry. */
+    sync(id, s) {
+        const c = this.chat.state(id);
+        s.turns = c.turns;
+        s.live = c.live;
+        s.running = c.running;
+        s.error = c.error;
+        s.loaded = c.loaded;
+        s.pendingCommand = c.pendingCommand;
+        s.lastStopReason = c.lastStopReason;
+        s.injectedIds = c.injectedIds;
+        s.saveBlocked = c.saveBlocked;
+        s.mergeTick = c.mergeTick;
+        return s;
+    }
+    /** The engine's turns for a session this side holds, else none. */
+    turnsOf(id) {
+        return this.map.has(id) ? this.chat.state(id).turns : [];
+    }
+    /** Reopen a session the engine was told to forget, before this side changes
+     * it: the load's first step reopens it at once, and the read it starts
+     * merges what is stored under anything added meanwhile. */
+    open(id) {
+        if (this.forgotten.delete(id))
+            void this.chat.load(id, this.chatHost);
+    }
+    /** A chat known to be empty in the store (a draft, a new chat, an empty saved
+     * one) needs no read: the engine opens it loaded with nothing stored. */
+    markLoadedEmpty(id) {
+        this.forgotten.delete(id);
+        this.chat.seedEmpty(id, this.chatHost);
+    }
     notify(id) { this.subs.get(id)?.forEach((fn) => fn()); }
     notifyGlobal() { this.globalSubs.forEach((fn) => fn()); }
     /** Mutate a session and notify its view; `global` also pokes the running-badge subscribers. */
@@ -336,10 +419,29 @@ export class AgentRuntime {
         return () => { set.delete(cb); };
     }
     subscribeGlobal(cb) { this.globalSubs.add(cb); return () => { this.globalSubs.delete(cb); }; }
+    /** Every session blocked on a tool permission, for a host that shows approvals
+     * outside the chat that asked. The budget pseudo-permission is not a tool ask. */
+    pendingPerms() {
+        const out = [];
+        for (const [sessionId, s] of this.map) {
+            const p = s.pendingPerm;
+            if (!p || p.tool === 'budget')
+                continue;
+            out.push({
+                permId: p.id, sessionId, tool: p.tool, summary: p.summary,
+                ...(p.agent ? { agent: p.agent } : {}), ...(p.caller ? { caller: p.caller } : {}),
+                ...(p.input ? { input: p.input } : {}),
+                // A System One ask is answered once, for its own tool call: never a session allow.
+                checkpoint: isCheckpointTool(p.tool) || p.tool === HOOK_ASK_TOOL, askedAt: p.askedAt,
+            });
+        }
+        return out;
+    }
     getState(id) {
         const s = this.map.get(id);
         if (!s)
             return emptyInternal();
+        this.sync(id, s);
         s.modelNotice = this.modelNotice(id, s);
         return s;
     }
@@ -347,6 +449,7 @@ export class AgentRuntime {
         const s = this.map.get(id);
         if (!s)
             return 'idle';
+        this.sync(id, s);
         if (s.pendingPerm || s.pendingAsk)
             return 'waiting';
         // A running command is a running session. Reporting 'idle' while a command
@@ -361,61 +464,28 @@ export class AgentRuntime {
      * workspace()/fileService() before its mount effect (CraftPage direct load)
      * otherwise hits the default null resolver and the store throws
      * "No file workspace is connected". */
-    /** Lazily load a session's turns from the store the first time it's focused. */
+    /** Lazily load a session's turns from the store the first time it's focused.
+     * The engine merges what is stored before anything this page added, keeps a
+     * miss unloaded (so the next ask reads again) and treats a read that throws
+     * as a miss; onLoaded does this side's part of the read. */
     async load(id) {
         if (!id)
             return;
         this.ws();
-        const s = this.ensure(id);
-        if (s.loaded)
-            return;
-        /* A read that THROWS is a miss, not an error for the caller: send awaits
-         * this, and a rejected load would drop the send outright while the next
-         * attempt fails the same way. As a miss it goes down the path that is
-         * covered: the exchange runs, saveBlocked says it is not kept, and Retry
-         * (retryLoad) reads again. */
-        let ses;
-        try {
-            ses = await this.host.sessions.get(id);
-        }
-        catch {
-            ses = null;
-        }
-        // A concurrent load (the focus effect beside a send) landed first, and its
-        // merge already holds everything; merging again would double the chat.
-        if (s.loaded)
+        this.ensure(id);
+        this.forgotten.delete(id);
+        await this.chat.load(id, this.chatHost);
+    }
+    /** What reading the stored chat for a LOAD means on this side, hit or miss:
+     * the chat's stored model, and the system-config snapshot of a chat from
+     * before the snapshot existed. A concurrent load that landed first already
+     * did both, and merging again is the engine's to refuse. */
+    onLoaded(id, ses) {
+        if (this.chat.state(id).loaded)
             return;
-        /* MERGE, never replace: anything this page added before the stored chat
-         * arrived -- a /model notice, say -- comes after it rather than vanishing.
-         * A miss leaves those turns alone too. */
-        const pre = s.turns;
-        if (ses) {
-            s.turns = [...turnsFromSessionMessages(ses.messages), ...pre];
-            s.persistedLen = ses.messages.length;
-        }
-        s.model = ses?.model ?? null;
-        /* ONLY ON A HIT. A miss used to be cached exactly like a hit, and that made
-         * it permanent: the session could arrive a moment later and this would
-         * never look again, because the guard above returns on `loaded`.
-         *
-         * It arrives a moment later more often than it sounds. A thread MOVED into
-         * a project (the handover offer) is read by the project's runtime, and if
-         * anything asked for it before the move landed, the runtime cached "no such
-         * session, zero turns" and showed an empty transcript for a conversation
-         * that was sitting on disk. Reported as "it brought the chat over but was
-         * empty"; switching away and back appeared to fix it only because that went
-         * through a different runtime.
-         *
-         * Leaving it unloaded costs one more read the next time something asks,
-         * and `load` is called from an effect keyed on the session and the runtime
-         * -- not per render -- so a genuinely absent session does not spin. */
-        if (ses)
-            s.loaded = true;
-        s.loadMissed = !ses;
-        // Loaded with nothing of this page's to save: nothing is unsaved any more.
-        // With something, the persist below clears the flag once it lands.
-        if (ses && !pre.length)
-            s.saveBlocked = null;
+        const s = this.map.get(id);
+        if (s)
+            s.model = ses?.model ?? null;
         /* MIGRATION. A conversation from before the snapshot existed has none, and
          * would otherwise keep following the live Settings default forever. Opening
          * it freezes it at what it would have used at this moment, so nothing
@@ -423,38 +493,18 @@ export class AgentRuntime {
          * freeze would re-decide a live chat at today's defaults. */
         if (!sessionSystemConfig(id))
             this.freezeSystemConfig(id);
-        this.notify(id);
-        // What was added before the load could not be saved then (see persist).
-        if (ses && pre.length)
-            void this.persist(id);
     }
     /** Try the stored chat again after a load failed (the unsaved-chat notice's
      * Retry): load it -- merging what this page added meanwhile after it, as
      * `load` always does -- then save the merged list. True once it is saved;
-     * false when the load missed again (or threw), and `saveBlocked` stays. */
+     * false when the load missed again (or threw), and `saveBlocked` stays. The
+     * engine says so globally, because the session list may have dropped this
+     * chat while its load kept missing. */
     async retryLoad(id) {
-        await this.load(id);
-        const s = this.map.get(id);
-        if (!s?.loaded)
-            return false;
-        // persistNow swallows its own failures; this catch keeps the promise a
-        // Retry button awaits from ever rejecting.
-        await this.persist(id).catch(() => { });
-        /* GLOBAL, because the session list is. While the load kept missing, the
-         * list the page shows (and the header's title, read from it) could drop
-         * this chat; it is back now, and only a global change makes the page
-         * re-read the list. Without it the recovered chat stayed missing from the
-         * list, titled "New chat", until a reload. */
-        this.notifyGlobal();
-        return s.saveBlocked === null;
-    }
-    /** Raise the unsaved-chat flag when `id` is still not loaded after a load
-     * was tried, so the page says its new messages are not being kept. */
-    flagIfUnsaved(id) {
-        const s = this.map.get(id);
-        if (s && !s.loaded && s.loadMissed && s.turns.length && s.saveBlocked !== 'load-failed') {
-            this.patch(id, { saveBlocked: 'load-failed' });
-        }
+        this.ws();
+        this.ensure(id);
+        this.forgotten.delete(id);
+        return this.chat.retryLoad(id, this.chatHost);
     }
     async openInitial() {
         if (this.initInFlight)
@@ -476,15 +526,16 @@ export class AgentRuntime {
             // second one, for two callers asking moments apart.
             if (!empty) {
                 for (const d of this.drafts) {
-                    const st = this.map.get(d);
-                    if (st && st.turns.length === 0 && !st.running)
+                    if (!this.map.has(d))
+                        continue;
+                    const st = this.chat.state(d);
+                    if (st.turns.length === 0 && !st.running)
                         return d;
                 }
             }
             if (empty) {
                 const s = this.ensure(empty.id);
-                s.loaded = true;
-                s.persistedLen = 0;
+                this.markLoadedEmpty(empty.id);
                 // A model picked on this empty chat before the reload is still its model.
                 s.model = empty.model ?? null;
                 return empty.id;
@@ -504,15 +555,14 @@ export class AgentRuntime {
         const id = store?.pendingChat();
         if (!store || !id)
             return null;
-        if (list.some((s) => s.id === id) || (this.map.get(id)?.turns.length ?? 0) > 0) {
+        if (list.some((s) => s.id === id) || this.turnsOf(id).length > 0) {
             store.setPendingChat(null);
             return null;
         }
         if (!(this.map.get(id)?.input ?? store.get(id)))
             return null;
-        const s = this.ensure(id);
-        s.loaded = true;
-        s.persistedLen = 0;
+        this.ensure(id);
+        this.markLoadedEmpty(id);
         this.drafts.add(id);
         return id;
     }
@@ -528,31 +578,31 @@ export class AgentRuntime {
     }
     createDraft() {
         const id = `ses_${Date.now().toString(36)}${Math.floor(Math.random() * 1e6).toString(36)}`;
-        const s = this.ensure(id);
-        s.loaded = true;
-        s.persistedLen = 0;
+        this.ensure(id);
+        this.markLoadedEmpty(id);
         this.drafts.add(id);
         this.host.composerDrafts?.setPendingChat(id);
         return id;
     }
     /** Whether `id` is a draft that has not been saved yet. */
     isDraft(id) { return this.drafts.has(id); }
-    /** Save a draft under its own id; a no-op for any other chat. Concurrent
-     * callers share one create. A failure leaves it a draft, so the next write
-     * tries again. */
+    /** Save a draft under its own id, resolving the created session; null for
+     * any other chat. Concurrent callers share one create. A failure leaves it a
+     * draft, so the next write tries again. */
     materialize(id) {
         if (!this.drafts.has(id))
-            return Promise.resolve();
+            return Promise.resolve(null);
         const inFlight = this.materializing.get(id);
         if (inFlight)
             return inFlight;
         const run = (async () => {
-            await this.host.sessions.create('New chat', this.surface, { id });
+            const created = await this.host.sessions.create('New chat', this.surface, { id });
             this.drafts.delete(id);
             if (this.host.composerDrafts?.pendingChat() === id)
                 this.host.composerDrafts.setPendingChat(null);
             this.freezeSystemConfig(id);
             this.notifyGlobal();
+            return created;
         })();
         this.materializing.set(id, run);
         run.finally(() => this.materializing.delete(id)).catch(() => { });
@@ -568,9 +618,8 @@ export class AgentRuntime {
          * shared list that this narrow fix could not reach. Keying the store is
          * the repair that comment asked for. */
         const ses = await this.host.sessions.create('New chat', this.surface);
-        const s = this.ensure(ses.id);
-        s.loaded = true;
-        s.persistedLen = 0;
+        this.ensure(ses.id);
+        this.markLoadedEmpty(ses.id);
         // The system prompt is the head of the cached prefix, so this conversation's
         // config is decided HERE and read from the snapshot after -- see
         // sessionSystemConfig. Settings decides what the next one starts with.
@@ -580,8 +629,12 @@ export class AgentRuntime {
     }
     async deleteSession(id) {
         this.ws();
-        this.map.get(id)?.abort?.abort();
+        // Aborts its run, and nothing the run writes late lands anywhere.
+        this.denyAllPerms(id);
+        this.chat.forget(id);
+        this.forgotten.add(id);
         this.map.delete(id);
+        this.blocked.delete(id);
         this.subs.delete(id);
         this.drafts.delete(id);
         this.host.composerDrafts?.set(id, '');
@@ -640,13 +693,12 @@ export class AgentRuntime {
      * plus the turns after it -- not the raw transcript, which overstates a chat
      * that has already folded. */
     canHold(id, model) {
-        const s = this.map.get(id);
-        if (!s)
+        if (!this.map.has(id))
             return true;
         const window = this.host.modelInfo(model).contextWindow ?? 128000;
         if (window <= 0)
             return true;
-        return this.fillTokens(s.turns) / window < COMPACT_AT_FILL;
+        return this.fillTokens(this.turnsOf(id)) / window < COMPACT_AT_FILL;
     }
     /** Switch this chat (only) to `model`; null when it switched. Refused, with
      * nothing changed: before the chat has loaded (there is nothing to measure,
@@ -654,16 +706,17 @@ export class AgentRuntime {
      * the model is not available (it would silently run on the fallback); and
      * when it cannot hold the chat (switching never folds, spec 3.5). */
     setChatModel(id, model) {
-        if (!this.map.get(id)?.loaded)
+        if (!this.map.has(id) || !this.chat.state(id).loaded)
             return 'not-loaded';
         if (!this.available(model))
             return 'unavailable';
         if (!this.canHold(id, model))
             return 'too-large';
         this.patch(id, { model });
-        // A draft keeps the pick in memory; picking a model is not using the chat.
+        /* A draft keeps the pick in memory; picking a model is not using the chat.
+         * A saved chat is saved now, carrying the pick (writeConversation stamps it). */
         if (!this.drafts.has(id))
-            void this.persist(id);
+            void this.chat.save(id, this.chatHost);
         return null;
     }
     /* ---- view mutators ---- */
@@ -673,23 +726,23 @@ export class AgentRuntime {
      * starts a fresh recording stream for what follows. */
     clear(id) {
         const s = this.ensure(id);
+        this.open(id);
         s.recId = undefined;
         s.recPrompt = undefined;
         s.recImages = undefined;
         s.recEvents = [];
-        this.patch(id, { turns: [], error: '', suggestions: [], approvalSuggestion: null }, true);
-        void this.persist(id);
+        s.suggestions = [];
+        s.approvalSuggestion = null;
+        this.blocked.delete(id);
+        // The engine empties the transcript, notifies globally and saves.
+        this.chat.clear(id, this.chatHost);
     }
     /** Append a local assistant-style notice turn (e.g. a /model confirmation) — not
      * sent to the model, just shown in the transcript. Returns the turn's id. */
     note(id, text, extra) {
-        const s = this.ensure(id);
-        // The random suffix: two notes in one millisecond (a fold beside a budget
-        // warning) must not share an id, or a later update by id lands on both.
-        const turn = { id: `n${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`, included: false, messages: [{ role: 'assistant', content: text }], ...extra };
-        this.patch(id, { turns: [...s.turns, turn] });
-        void this.persist(id);
-        return turn.id;
+        this.ensure(id);
+        this.open(id);
+        return this.chat.note(id, this.chatHost, text, extra);
     }
     /* The compaction seam. PERMANENT in the transcript, per the `checkpoint`
      * event's contract: compaction is lossy, and a person who cannot see that it
@@ -698,29 +751,21 @@ export class AgentRuntime {
      *
      * Recorded as an unsent note. The collapse already happened inside the run's
      * own message array, so a seam that counted as conversation would describe
-     * the compaction back to the model on every later turn. */
+     * the compaction back to the model on every later turn. The body rides along
+     * so the seam can be READ. */
     noteCheckpoint(id, collapsed, body) {
-        const n = collapsed === 1 ? '1 message' : `${collapsed} messages`;
-        /* CHECKPOINT_MARKER, not the literal it happens to equal: a surface that
-         * recognizes seams (the transcript band, the context strip) looks for the
-         * marker the harness writes, and two copies of one string is how they end
-         * up looking for different things.
-         *
-         * The body rides along so the seam can be READ. It was dropped here before
-         * -- the event carries it, and this took only the count -- which left the
-         * one question a seam raises with no answer anywhere in the UI. */
-        return this.note(id, `${CHECKPOINT_MARKER}${n} collapsed — earlier context is summarized from here`, body ? { checkpoint: body } : undefined);
+        this.ensure(id);
+        this.open(id);
+        return this.chat.noteCheckpoint(id, this.chatHost, collapsed, body);
     }
     /** Show a message in the transcript as YOUR turn, without adding it to what
      * gets sent. Used for injected messages: the real copy is already in the
      * run's own message list (the loop appended it), so an included turn here
      * would send it twice. */
     noteUser(id, text) {
-        const s = this.ensure(id);
-        const turn = { id: `u${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`, included: false, messages: [{ role: 'user', content: text }] };
-        this.patch(id, { turns: [...s.turns, turn] });
-        void this.persist(id);
-        return turn.id;
+        this.ensure(id);
+        this.open(id);
+        return this.chat.noteUser(id, this.chatHost, text);
     }
     setAttachments(id, fn) {
         this.patch(id, { attachments: fn(this.ensure(id).attachments) });
@@ -729,11 +774,9 @@ export class AgentRuntime {
      * refused -- no state change, no persist: the folded view stands for it, so
      * including or dropping it would change nothing the next request carries. */
     toggleInclude(id, turnId) {
-        const s = this.ensure(id);
-        if (isFoldedTurn(s.turns, s.turns.findIndex((t) => t.id === turnId)))
-            return;
-        this.patch(id, { turns: s.turns.map((t) => (t.id === turnId ? { ...t, included: !t.included } : t)) });
-        void this.persist(id);
+        this.ensure(id);
+        this.open(id);
+        this.chat.toggleInclude(id, this.chatHost, turnId);
     }
     /**
      * Ask the user to approve something the HOST is about to do, through the same
@@ -745,19 +788,21 @@ export class AgentRuntime {
      * Two different approval dialogs for the same act is how people learn to click
      * the one that appears more often without reading it.
      *
+     * The session allows are the engine's, so an always-allow given here and one
+     * given to the run answer each other.
+     *
      * Resolves false if the session is gone, so a caller can never read a dropped
      * prompt as consent.
      */
     requestPermission(id, tool, summary) {
-        const s = this.map.get(id);
-        if (!s)
+        if (!this.map.has(id))
             return Promise.resolve(false);
-        if (s.allowed.has(allowKey(undefined, tool)))
+        if (this.chat.isAllowed(id, undefined, tool))
             return Promise.resolve(true);
         return new Promise((resolve) => {
             // 'you': this path exists for something the USER typed (a `>pd` command),
             // never for the run loop, which raises its own asks through onPermission.
-            this.patch(id, { pendingPerm: { tool, summary, requester: 'you', resolve } }, true);
+            this.raisePerm(id, { id: this.nextPermId++, tool, summary, requester: 'you', askedAt: Date.now(), resolve });
         });
     }
     /**
@@ -771,7 +816,7 @@ export class AgentRuntime {
      * already has.
      *
      * IT IS RECORDED OUT OF CONTEXT. Persistence and context-inclusion are
-     * separate switches here - persist() writes every turn, while only `included`
+     * separate switches here - every turn is saved, while only `included`
      * turns are sent to the model - and a command should default to written-down
      * but not re-sent. A transcript message is the most expensive kind of
      * context: it is paid again on every subsequent turn for the rest of the
@@ -783,59 +828,94 @@ export class AgentRuntime {
      */
     /** Mark a console command as running. Paired with recordCommand, which clears
      * it - so the indicator cannot outlive the command even if it fails, since the
-     * failure is itself recorded. */
+     * failure is itself recorded. Global: the session list shows it running. */
     beginCommand(id, command, startedAt) {
-        this.patch(id, { pendingCommand: { command, startedAt } }, true);
+        this.ensure(id);
+        this.open(id);
+        this.chat.beginCommand(id, command, startedAt);
+        this.notify(id);
+        this.notifyGlobal();
     }
     /** Give up on a command that will never settle (the surface unmounted, the
      * session was closed). Clears the indicator WITHOUT recording a result,
      * because there is no honest result to record. */
     abandonCommand(id) {
-        if (!this.map.get(id)?.pendingCommand)
+        if (!this.map.has(id) || !this.chat.state(id).pendingCommand)
             return;
-        this.patch(id, { pendingCommand: null }, true);
+        this.chat.abandonCommand(id);
+        this.notify(id);
+        this.notifyGlobal();
     }
     recordCommand(id, command, output, ok) {
-        const s = this.ensure(id);
-        const callId = `cmd_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
-        const turn = {
-            id: callId,
-            // Not included: kept on disk, out of the context window until Keep.
-            included: false,
-            messages: [
-                {
-                    role: 'assistant',
-                    content: null,
-                    tool_calls: [{
-                            id: callId,
-                            type: 'function',
-                            // `ok` rides along in the arguments deliberately. On a synthetic call
-                            // it is part of the record, and once kept it tells the model the
-                            // command failed - which it would otherwise have to infer from
-                            // whatever the tool happened to print.
-                            function: { name: 'console_command', arguments: JSON.stringify({ command, ok }) },
-                        }],
-                },
-                {
-                    role: 'tool',
-                    tool_call_id: callId,
-                    content: output || (ok ? '(no output)' : '(failed, no output)'),
-                },
-            ],
-        };
-        this.patch(id, { turns: [...s.turns, turn], pendingCommand: null });
-        void this.persist(id);
+        this.ensure(id);
+        this.open(id);
+        this.chat.recordCommand(id, this.chatHost, command, output, ok);
+    }
+    /** Answer a permission only if it is still the request the caller was shown.
+     * Returns false, and changes nothing, when it was answered or replaced. */
+    resolvePermIf(sessionId, permId, allow, always = false, note) {
+        if (this.map.get(sessionId)?.pendingPerm?.id !== permId)
+            return false;
+        this.resolvePerm(sessionId, allow, always, note);
+        return true;
     }
     /** `note` is the person's reason for a deny (the plan sheet's Deny with a
-     * note); it reaches the model after the denial text. Ignored with allow. */
+     * note); it reaches the model after the denial text. Ignored with allow.
+     * An always-allow is the engine's session allow (it never holds a checkpoint). */
     resolvePerm(id, allow, always = false, note) {
         const s = this.map.get(id);
         if (!s?.pendingPerm)
             return;
-        if (allow && always && !isCheckpointTool(s.pendingPerm.tool))
-            s.allowed.add(allowKey(s.pendingPerm.agent, s.pendingPerm.tool));
+        if (allow && always)
+            this.chat.allow(id, s.pendingPerm.agent, s.pendingPerm.tool);
         s.pendingPerm.resolve(allow, allow ? undefined : note);
-        this.patch(id, { pendingPerm: null }, true);
+        // The next queued ask, if any, is the card now.
+        this.patch(id, { pendingPerm: this.permQueues.get(id)?.shift() ?? null }, true);
+    }
+    /** Show an ask, or queue it behind the one on screen. */
+    raisePerm(id, perm) {
+        if (!this.ensure(id).pendingPerm) {
+            this.patch(id, { pendingPerm: perm }, true);
+            return;
+        }
+        let q = this.permQueues.get(id);
+        if (!q) {
+            q = [];
+            this.permQueues.set(id, q);
+        }
+        q.push(perm);
+        this.notifyGlobal();
+    }
+    /** Answer the shown ask and every queued one with a deny, and forget them:
+     * nothing is left waiting on a card that can no longer be shown. */
+    denyAllPerms(id) {
+        const s = this.map.get(id);
+        const shown = s?.pendingPerm ?? null;
+        if (s)
+            s.pendingPerm = null;
+        shown?.resolve(false);
+        for (const p of this.permQueues.get(id)?.splice(0) ?? [])
+            p.resolve(false);
+        this.permQueues.delete(id);
+    }
+    /** Answer `permId` with a deny wherever it waits: on screen (the next one
+     * then shows) or in the queue (it is dropped). */
+    denyPerm(id, permId) {
+        if (this.map.get(id)?.pendingPerm?.id === permId) {
+            this.resolvePerm(id, false);
+            return;
+        }
+        const q = this.permQueues.get(id);
+        const i = q ? q.findIndex((p) => p.id === permId) : -1;
+        if (!q || i < 0)
+            return;
+        const [perm] = q.splice(i, 1);
+        perm.resolve(false);
+    }
+    /** A tool result a System One check or hook blocked in this page, for the
+     * tool card's "Show the result"; undefined once the page has reloaded. */
+    blockedResult(sessionId, callId) {
+        return this.blocked.get(sessionId)?.get(callId);
     }
     resolveAsk(id, answers) {
         const s = this.map.get(id);
@@ -858,115 +938,13 @@ export class AgentRuntime {
             this.note(id, `Could not save that approval: ${String(e?.message || e)}`);
         });
     }
-    stop(id) { this.map.get(id)?.abort?.abort(); }
+    stop(id) { this.chat.stop(id); }
     /** Push user messages into the run already in flight on this session.
      * `hard` cuts the current model stream so they land immediately instead of at
      * the next turn boundary. Returns false when nothing is running -- the caller
      * keeps the message queued rather than losing it. */
     inject(id, messages, hard) {
-        const s = this.map.get(id);
-        if (!s || !s.running || s.runId == null)
-            return false;
-        this.getWorker().inject(s.runId, messages, hard);
-        return true;
-    }
-    queueWrite(id, write) {
-        // Nothing queued: start now, at the same tick as before this queue existed.
-        // A failed write must not stop the ones queued behind it.
-        const prev = this.writing.get(id);
-        const next = prev ? prev.catch(() => { }).then(write) : write();
-        this.writing.set(id, next);
-        next.finally(() => { if (this.writing.get(id) === next)
-            this.writing.delete(id); }).catch(() => { });
-        return next;
-    }
-    persist(id) {
-        return this.queueWrite(id, async () => {
-            // The first write to a draft saves it first; a failed save skips this
-            // write, and the draft stays a draft for the next one.
-            if (this.drafts.has(id)) {
-                try {
-                    await this.materialize(id);
-                }
-                catch {
-                    return;
-                }
-            }
-            await this.persistNow(id);
-        });
-    }
-    async persistNow(id) {
-        const s = this.map.get(id);
-        /* Never before the stored transcript has loaded (ruling R34). Until then
-         * `turns` holds only what this page added -- a /model notice, say -- and
-         * saving it would write that over the whole stored chat. Such notes stay
-         * in memory -- and once a load has actually failed, say so. */
-        if (!s?.loaded) {
-            this.flagIfUnsaved(id);
-            return;
-        }
-        // A read that throws is a save that did not happen: persistedLen and
-        // saveBlocked stay as they are, and the next write tries again.
-        let ses;
-        try {
-            ses = await this.host.sessions.get(id);
-        }
-        catch {
-            return;
-        }
-        if (!ses)
-            return;
-        /* Shorten the stored chat (retry, /clear) only when it is the length this
-         * page last saw (ruling R36). Otherwise another writer appended since, and
-         * this page's shorter list would delete that writer's newer turns. */
-        const known = ses.messages.length === s.persistedLen;
-        let turns = s.turns;
-        if (!known) {
-            /* Another writer changed it since. Saving this page's list as it stands
-             * would write it BY POSITION -- a stale [q0] that sent q3 put q3 at index
-             * 1, over the other tab's q1 -- so merge by turn id instead, over what
-             * was just read: stored order first, this page's version of any turn
-             * both hold (last writer wins per turn), then this page's turns the
-             * store does not have, in this page's order. A flat (daemon) chat's
-             * turns get the same `stored-<i>` ids here as at load, so a turn this
-             * page loaded from it matches and is not added twice.
-             *
-             * The page then shows the merged chat. Nothing it holds is dropped, and
-             * the store loses nothing: the merge holds every stored turn, so the
-             * save may rewrite freely (allowTruncate below), which a flat store's
-             * conversion to turns needs. */
-            const stored = turnsFromSessionMessages(ses.messages);
-            const mine = new Map(s.turns.map((t) => [t.id, t]));
-            const storedIds = new Set(stored.map((t) => t.id));
-            /* Only the FIRST stored turn with an id takes this page's version. A
-             * second one with the same id is another turn that collided (ids are
-             * meant to be unique; turnsFromSessionMessages keeps its synthetic ones
-             * so), and replacing it too would write one turn twice and lose the
-             * other on this rewrite. */
-            const used = new Set();
-            const merged = stored.map((t) => {
-                const own = mine.get(t.id);
-                if (!own || used.has(t.id))
-                    return t;
-                used.add(t.id);
-                return own;
-            });
-            turns = [...merged, ...s.turns.filter((t) => !storedIds.has(t.id))];
-            alog(`session ${id}: stored has ${ses.messages.length} messages, this page last saw ${s.persistedLen}; another writer changed it, so this save merges both by turn (${turns.length} turns)`);
-            this.patch(id, { turns, mergeTick: s.mergeTick + 1 });
-        }
-        ses.messages = turns;
-        if (s.model)
-            ses.model = s.model;
-        try {
-            // Known: this page's list IS the chat, and may shorten it (R36). A
-            // merge: holds every stored turn, so rewriting cannot lose one.
-            await this.host.sessions.save(ses, { allowTruncate: true });
-            s.persistedLen = turns.length;
-            if (s.saveBlocked)
-                this.patch(id, { saveBlocked: null });
-        }
-        catch { /* a failed save leaves persistedLen as it was */ }
+        return this.chat.inject(id, this.chatHost, messages, hard);
     }
     /** Filename of the system prompt this surface will run with next — what the
      * context drawer's active-prompt chip shows. Mirrors composeSystem's own
@@ -1036,21 +1014,7 @@ export class AgentRuntime {
         const s = this.ensure(id);
         // systemExtra (e.g. Craft's document-creation directive) leads the context.
         const blocks = this.systemExtra ? [this.systemExtra] : [];
-        if (svc) {
-            const src = svc.kind === 'directory' ? `local folder "${svc.label}"`
-                : svc.kind === 'sidecar' ? `connected sidecar machine "${svc.label}"`
-                    : `virtual in-browser workspace "${svc.label}"`;
-            const flags = `${svc.isLocalDisk ? "on the user's real disk" : 'in-browser'}, ${svc.writable ? 'writable' : 'read-only'}`;
-            blocks.push(`--- Workspace ---\n` +
-                `Connected source: ${src} (${flags}).\n` +
-                `All file paths are relative to this workspace root (POSIX, no leading slash, e.g. "prompts/base.prmd"). ` +
-                `There is no separate working directory or shell — inspect the workspace with list_files / read_file / ` +
-                `stat_file / search_files, and change it with write_file / create_file / delete_file / rename_file. ` +
-                `The browser does not expose the folder's absolute path, so report locations relative to the root.`);
-        }
-        else {
-            blocks.push(`--- Workspace ---\nNo file workspace is connected, so the file tools are unavailable. Say so rather than guessing about files.`);
-        }
+        blocks.push(workspaceBlock(svc));
         // Host-supplied extra system-context blocks (project instructions, project
         // memory, editor buffer …), resolved per send against the active FileService.
         for (const p of this.host.contextProviders ?? []) {
@@ -1082,526 +1046,120 @@ export class AgentRuntime {
             systemPath,
             systemText,
             contextText: blocks.join('\n\n'),
-            toolsText: p.tools ? TOOLS_MARKER : '',
+            // A user's own prompt that still prints {{ tools }} gets the sent tools there.
+            toolsText: TOOLS_MARKER,
             params: this.host.systemParams?.(),
             memoryIndex: this.host.memoryIndex,
         });
     }
-    /** Send a message and run the agent for `id`. Concurrent with other sessions:
-     * each run is its own AbortController + watchdog and streams into its own slice. */
-    async send(id, text, images, opts) {
-        const s = this.ensure(id);
-        if ((!text && images.length === 0) || s.running)
-            return;
-        /* The stored chat first (ruling R35). Nothing stops the composer before it
-         * lands, and a send built on the empty pre-load list would run with no
-         * history, retitle the chat as if it were new, and then be wiped by the
-         * load or never saved. Also retries a load that missed. */
-        if (!s.loaded) {
-            await this.load(id);
-            // Another send started while this one waited (ruling R37): treat this
-            // one like a send during a run -- nothing happens, the draft stays.
-            if (s.running)
-                return;
+    /* ---- run ---- */
+    /* R4 on this host. The engine freezes a conversation's system after its first
+     * turn; this side drops it before every send and retry, so each turn composes
+     * afresh, as it always has. Nearly every input of composeSystem is something
+     * the person changes between turns, and most of them never pass through this
+     * runtime: the persona and a parts override arrive in SendOpts, the mode is
+     * setMode, and the editor buffer, the current Craft document, the
+     * destination, project instructions, attached documents, the workspace and
+     * the chosen system prompt are read live from the host and its stores. A
+     * reset per user action would miss every one of those it cannot see.
+     * `stored: false`: this host never stores a system (withoutSystem), so the
+     * engine has nothing to remove and does not read the store to look. */
+    recomposeSystem(id) {
+        this.chat.resetSystem(id, { stored: false });
+    }
+    /** A send or retry's context, queued for the engine's guard to start. */
+    queueTurn(id, opts, text, images) {
+        const t = {
+            opts, text, images, ui: this.ensure(id), priorInput: '', priorAttachments: [], allowed: false, userTurnId: '',
+            startedAt: Date.now(), recBuf: [], turnStart: 0, model: '', priced: null,
+            calleeSpend: { inTok: 0, outTok: 0, cost: 0 }, control: null,
+        };
+        const q = this.pending.get(id);
+        if (q)
+            q.push(t);
+        else
+            this.pending.set(id, [t]);
+        return t;
+    }
+    /** A turn that never reached the guard (refused before it started) leaves the queue. */
+    dropTurn(id, t) {
+        const q = this.pending.get(id);
+        if (q) {
+            const at = q.indexOf(t);
+            if (at >= 0)
+                q.splice(at, 1);
+            if (!q.length)
+                this.pending.delete(id);
         }
-        // Only a LOADED empty chat is new. One whose load missed again is empty
-        // because it was never read, and retitling it would write this message's
-        // text over the stored chat's title while every other write is held back.
-        const isFirst = s.loaded && s.turns.length === 0;
-        const userTurn = { id: `t${Date.now().toString(36)}`, included: true, messages: [buildUserMessage(text, images)] };
-        const nextTurns = [...s.turns, userTurn];
-        s.toolMs = {};
-        /* OPTIMISTIC, and the ordering here is the whole point.
-         *
-         * The feature guard used to run FIRST, and on the web host it is a network
-         * call (src/guards/apiGuard.ts fetches /entitlements). For that entire
-         * round trip the composer still held the text, no turn existed and
-         * `running` was false -- pressing send looked like it had done nothing, for
-         * seconds. Reported from use.
-         *
-         * The old order existed so that "a denial loses nothing". That promise is
-         * kept below instead: a denial puts the turn and the draft back. */
-        const priorInput = s.input;
-        const priorAttachments = s.attachments;
+        if (this.active.get(id) === t)
+            this.active.delete(id);
+    }
+    /** The turn the engine is running on `id`; it always started one before asking. */
+    turnFor(id) {
+        const t = this.active.get(id);
+        if (!t)
+            throw new Error(`no turn in flight for ${id}`);
+        return t;
+    }
+    /* OPTIMISTIC, and the ordering here is the whole point.
+     *
+     * The feature guard used to run FIRST, and on the web host it is a network
+     * call (src/guards/apiGuard.ts fetches /entitlements). For that entire round
+     * trip the composer still held the text, no turn existed and `running` was
+     * false -- pressing send looked like it had done nothing, for seconds.
+     * Reported from use.
+     *
+     * The engine shows the turn and reads as running before it asks the guard;
+     * the guard (chatHost.guard) empties the composer in the same tick. The old
+     * order existed so that "a denial loses nothing", and that is kept too: a
+     * denial puts the turn (the engine) and the draft (here) back. */
+    startTurn(id) {
+        const q = this.pending.get(id);
+        if (!q)
+            return null;
+        /* Which waiting send this is: the engine has just put its user turn last.
+         * Two sends that both waited on the load race for it, and the one the
+         * engine refused leaves the queue when its send returns. */
+        const turns = this.chat.state(id).turns;
+        const last = turns[turns.length - 1]?.messages[0];
+        const text = last ? userText(last) : '';
+        const images = last ? userImages(last) : [];
+        const at = q.findIndex((x) => x.text === text && x.images.length === images.length && x.images.every((u, i) => u === images[i]));
+        const [t] = q.splice(at >= 0 ? at : 0, 1);
+        if (!q.length)
+            this.pending.delete(id);
+        if (!t)
+            return null;
+        t.userTurnId = turns[turns.length - 1]?.id ?? '';
+        this.active.set(id, t);
+        const s = t.ui;
+        t.priorInput = s.input;
+        t.priorAttachments = s.attachments;
         /* The box empties only when what it held is what is being sent. A retry,
          * a follow-up chip or a host's own send carries other text, and wiping
          * what the user was typing meanwhile would lose it (the composer clears
          * its own send before calling here, so that path still ends empty). */
-        const keptInput = priorInput.trim() && priorInput.trim() !== text.trim() ? priorInput : '';
-        this.patch(id, {
-            turns: nextTurns, error: '', live: { text: '', tools: [] }, running: true, input: keptInput, attachments: [], suggestions: [],
-            policyNotes: [], degradedModel: null, injectedIds: [], lastStopReason: null,
-        }, true);
-        // Still not loaded after that retry: this exchange runs and shows, but will
-        // not be saved. Flagged once the turn exists, so the notice is up for the
-        // whole run rather than only after it.
-        this.flagIfUnsaved(id);
-        // Feature guard — the runtime is the chokepoint for every /agent run (send
-        // and retry), so a quota/plan guard registered later covers this surface too.
-        const gate = await this.host.guard('llm-execution');
-        if (!gate.allowed) {
-            // Roll the optimism back: drop the turn, restore what was typed (and any
-            // pasted images), and stop reading as running. A turn left behind here is
-            // a message the user believes they sent and the agent never saw.
-            this.patch(id, {
-                turns: this.ensure(id).turns.filter((t) => t.id !== userTurn.id),
-                input: priorInput || text,
-                attachments: priorAttachments.length ? priorAttachments : images,
-                running: false,
-                live: null,
-                error: gate.reason,
-            }, true);
+        const keptInput = t.priorInput.trim() && t.priorInput.trim() !== t.text.trim() ? t.priorInput : '';
+        this.patch(id, { input: keptInput, attachments: [], suggestions: [], policyNotes: [], degradedModel: null }, true);
+        return t;
+    }
+    /** Send a message and run the agent for `id`. Concurrent with other sessions:
+     * each run is its own AbortController + watchdog and streams into its own
+     * slice. The engine loads the stored chat first (ruling R35), refuses a send
+     * while one runs (R37), and settles once every write the turn queued has. */
+    async send(id, text, images, opts) {
+        this.ensure(id);
+        this.forgotten.delete(id);
+        if ((!text && images.length === 0) || this.chat.state(id).running)
             return;
-        }
-        const startedAt = Date.now();
-        // A draft becomes a saved chat now, after the guard allowed the send, so a
-        // refused send leaves nothing behind. A failed save does not stop the run:
-        // its first write after it tries again.
-        if (this.drafts.has(id))
-            await this.materialize(id).catch(() => { });
-        // Title an untitled session from its first message, so the switcher is readable.
-        // A hand-renamed session is locked, so its chosen title is left alone.
-        if (isFirst && text) {
-            await this.queueWrite(id, async () => {
-                const ses = await this.host.sessions.get(id);
-                if (ses && !ses.titleLocked) {
-                    ses.title = text.slice(0, 48);
-                    await this.host.sessions.save(ses).catch(() => { });
-                    this.notifyGlobal();
-                }
-            }).catch(() => { });
-        }
-        const outgoing = outgoingMessages(nextTurns);
-        /* Transcript-only turns noteUser() added for messages injected mid-run.
-         * They exist so the pivot is visible WHILE the run is in flight; once the
-         * run returns, its own copy of each injected message arrives in `created`
-         * and folds into the user turn, so keeping these would render the text a
-         * second time below the final reply, where it reads as unanswered. */
-        const injectedTurnIds = [];
-        /* The seams THIS run wrote. The last one carries the run's folded view
-         * once the run returns, so the next send starts from the fold instead of
-         * re-folding the raw transcript. */
-        const seamIds = [];
-        let verification;
-        let auditIncomplete;
-        const ac = new AbortController();
-        s.abort = ac;
-        // This turn's events append to the session's accumulated stream (one recording
-        // per session, not per turn) — see Internal.recEvents.
-        const recBuf = s.recEvents;
-        // Where THIS turn's events start — so `ok` reflects only this turn (a transient
-        // error in an earlier turn must not mark a recovered session as failed forever).
-        const turnStart = recBuf.length;
-        // Mark a FOLLOW-UP user turn so the replay shows it as a bubble in place. The
-        // first turn's prompt is the recording's `prompt` header, so only record once
-        // the session already has replayable content (avoids duplicating it).
-        if (recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
-            recBuf.push({ at: Date.now(), ev: { type: 'user', content: text, images: images.length ? images.slice() : undefined } });
-        }
-        // Shared wedged-run watchdog (see runWatchdog.ts): soft window while
-        // streaming, paused mid-tool with a hard cap so a never-settling tool
-        // (half-open sidecar socket) can't hang the run forever.
-        const dog = createRunWatchdog((reason) => {
-            ac.abort();
-            this.patch(id, {
-                error: reason === 'tool-hard-cap'
-                    ? 'A tool ran for over 10 minutes without completing — aborted. The connection to it may have dropped.'
-                    : 'No response from the gateway in 45s — aborted. Check that you are signed in and the backend is reachable.',
-            });
-        }, { softMs: WATCHDOG_MS });
-        dog.bump();
+        // The browser never freezes its system: composeSystem reads live inputs each turn.
+        this.recomposeSystem(id);
+        const t = this.queueTurn(id, opts, text, images);
         try {
-            /* The skill catalog travels WITH the run: the worker cannot read skill
-             * files, and the loop owns both the index and `use_skill`. Resolved for
-             * THIS session, so a skill switched off in one conversation is still
-             * offered in every other. Read alongside compose rather than after it,
-             * so it adds no latency ahead of the run. Never fatal: a read failure
-             * costs skills, not the run. */
-            const skillDeny = this.host.capabilities?.skillDeny?.(id) ?? [];
-            const [system, skills] = await Promise.all([
-                this.composeSystem(id, opts.persona, opts.partsOverride),
-                enabledSkillCatalog((name) => !skillDeny.includes(name)).catch(() => []),
-            ]);
-            const model = this.chatModel(id);
-            /* Decided now, from what is true now: the chat's own model is gone and
-             * the one it falls back to cannot hold it. A model picked since load, or
-             * a catalog that has caught up, changes the answer. */
-            const forceFold = !!this.lostModel(s) && !this.canHold(id, model);
-            // The chat now runs on `model`; storing it is what clears the notice.
-            if (this.host.perChatModel && s.model !== model)
-                this.patch(id, { model });
-            // Live model for onBreach pricing — reassigned when a degrade breach
-            // switches the run onto a cheaper model (see onBreach below).
-            let activeModel = model;
-            const priced = this.host.modelInfo(model);
-            const contextWindow = priced.contextWindow ?? 128000;
-            // The surface's constraints default (Task 7), overridden per run when the
-            // caller passes one (a masked-override envelope from `mergeOverride`) —
-            // mirrors AgentPanel's `eff = { ...savedDefault, ...perRunOverride }`.
-            // NOTE: this deliberately reads `this.surface`'s constraints, not a
-            // hardcoded 'agent' — a behavior change for /craft vs. the pre-extraction
-            // class (which always read 'agent'); 'craft' has no saved defaults so the
-            // effective result is unchanged.
-            const constraints = { ...this.host.constraints(this.surface), ...(opts.constraints ?? {}) };
-            const hasBudgetLimits = constraints.maxUsd != null || constraints.maxTokens != null || constraints.maxMs != null;
-            // Capability seam (Task 3): only send toolNames when the host's tools
-            // getter is NOT the default allTools (reference inequality) — this keeps
-            // the default path byte-identical, since every surface today passes
-            // `tools: allTools` (or omits capabilities entirely).
-            const capTools = this.host.capabilities?.tools;
-            const toolNames = capTools && capTools !== allTools ? capTools().map((t) => t.name) : undefined;
-            /* RESOLVED PER RUN, FOR THIS SESSION. The composer popout can switch a
-             * source (an MCP server, a builtin namespace, a skill) off for ONE
-             * conversation, and this is where that choice stops being a UI state and
-             * becomes tools the worker will not offer. Passing the id rather than
-             * reading an "active session" global keeps it correct while two surfaces
-             * run at once. A host that ignores the argument -- crew does -- is
-             * unaffected. */
-            const toolDeny = this.host.capabilities?.toolDeny?.(id);
-            // Resolved per run so an edit to a callee (or its canCall list) applies to
-            // the next delegation without rebuilding the runtime. Never fatal: a read
-            // failure costs delegation, not the run.
-            const resolvedDelegates = await (this.host.capabilities?.delegates?.().catch(() => []) ?? Promise.resolve([]));
-            /* Under a usd cap a callee's turns are priced against this run's meter,
-             * so a callee whose model this host cannot price would spend without
-             * moving it. Refused, with the daemon's words (executor.ts). */
-            const crewDelegates = constraints.maxUsd != null
-                ? resolvedDelegates.map((d) => (d.model && !pricedForUsd(this.host.usdRates?.(d.model) ?? null)
-                    ? { ...d, model: '', refusal: unpricedCalleeRefusal(d.name, d.model) }
-                    : d))
-                : resolvedDelegates;
-            const crewOrchestration = this.host.capabilities?.orchestration?.();
-            const crewTraceRoot = this.host.capabilities?.traceRoot?.();
-            const auditAgent = this.host.capabilities?.agentName?.();
-            /* What this turn's sub-agents (delegated callees) spent, from their
-             * node-event usage (review B-I6). Added to the turn's stats and the
-             * usage ledger, as the daemon's run log does. Only a tally for display:
-             * the budget gate meters the same events itself (workerClient), so
-             * nothing here feeds it. */
-            const calleeSpend = { inTok: 0, outTok: 0, cost: 0 };
-            const res = await this.getWorker().run(outgoing, {
-                model,
-                temperature: this.getTemperature?.(),
-                toolDeny,
-                // What this conversation already found with tool_search, so turn 9
-                // does not search again for what turn 2 loaded.
-                loadedTools: loadedToolNames(id),
-                skills,
-                crewDelegates,
-                crewOrchestration,
-                ...(crewTraceRoot ? { crewTraceRoot } : {}),
-                system,
-                policy: this.host.policy
-                    ? this.host.policy(getPolicy(opts.policyName) ?? STANDARD_POLICY)
-                    : (getPolicy(opts.policyName) ?? STANDARD_POLICY),
-                ...(this.host.sessionsRoot ? { sessionsRoot: this.host.sessionsRoot() } : {}),
-                compression: { mode: this.host.compression(), contextWindow },
-                ...(forceFold ? { forceFold: true } : {}),
-                signal: ac.signal,
-                sessionId: id,
-                toolNames,
-                // Record the worker's run id the instant it exists, so inject() (which
-                // can arrive at any point during this run) has something live to address.
-                onStart: (runId) => { s.runId = runId; },
-                // The queue's only way to tell "landed" from "never made it": the
-                // AgentEvent 'injected' the loop emits per message carries text, not the
-                // caller's id, so a reverting caller (Task 7's queue) reads THIS to know
-                // which of its still-pending ids it must NOT revert (reverting one that
-                // already landed would re-send it as a fresh turn and duplicate it).
-                onInjected: (ids) => { this.patch(id, { injectedIds: [...this.ensure(id).injectedIds, ...ids] }); },
-                onPermission: (req) => new Promise((done) => {
-                    // A checkpoint is asked every time, whatever the session allowed.
-                    if (!isCheckpointTool(req.tool) && s.allowed.has(allowKey(req.agent, req.tool))) {
-                        done({ allow: true, by: 'session' });
-                        return;
-                    }
-                    // A callee's ask names who called it: this chat's own agent.
-                    const caller = req.agent ? (auditAgent ? { caller: auditAgent } : {}) : {};
-                    // A deny with a note carries it; every other answer stays the bare
-                    // boolean it always was.
-                    const resolve = (allow, note) => done(!allow && note ? { allow, by: 'human', note } : allow);
-                    this.patch(id, { pendingPerm: { ...req, ...caller, resolve } }, true);
-                }),
-                // Non-blocking: fires when the approvals bridge records a decision and
-                // offers a standing rule. The context identifies which session/surface
-                // recorded it — the runId is added by the bridge itself.
-                approvalContext: { surface: this.surface, sessionId: id },
-                // The audit log files this run under its session, and under its agent
-                // when the host names one (persona is prompt text, never an identity).
-                auditContext: { session: id, ...(auditAgent ? { agent: auditAgent } : {}) },
-                onApprovalSuggestion: (sug) => this.patch(id, { approvalSuggestion: sug }, true),
-                onAsk: (questions) => new Promise((resolve) => {
-                    dog.pause();
-                    this.patch(id, { pendingAsk: { questions, resolve: (a) => { resolve(a); dog.bump(); } } }, true);
-                }),
-                // Editor-buffer surfaces pass onEditReview/editorFile (Task 4); the
-                // standalone page omits both, so propose_edit keeps its non-blocking
-                // fallback exactly as before.
-                editorFile: opts.editorFile,
-                onNodeEvent: (e) => {
-                    publishSubagentEvent({ sessionId: id, surface: this.surface, event: e });
-                    const c = nodeUsageOf(e);
-                    if (c) {
-                        calleeSpend.inTok += c.usage.promptTokens;
-                        calleeSpend.outTok += c.usage.completionTokens;
-                        const m = c.model ?? model;
-                        // Priced only when this host really knows the model's rates; an
-                        // unknown one still counts its tokens (never an invented cost).
-                        if (pricedForUsd(this.host.usdRates?.(m) ?? null))
-                            calleeSpend.cost += this.host.price(c.usage, m);
-                    }
-                    opts.onNodeEvent?.(e);
-                },
-                onEditReview: opts.onEditReview
-                    ? async (callId) => {
-                        // propose_edit blocks on the user's verdict — pause the watchdog
-                        // (like an open ask form), resume once the host resolves it.
-                        dog.pause();
-                        const r = await opts.onEditReview(callId, ac.signal);
-                        dog.bump();
-                        return r;
-                    }
-                    : undefined,
-                /* start_project offering to bring the conversation with it. The run is
-                 * STILL WRITING, so this cannot be file work the tool does on its own:
-                 * only here is it known which session this run belongs to, and only
-                 * here can the store that is saving it be re-pointed. The host does
-                 * both, or the option is not offered at all. */
-                onMoveSession: this.host.moveSession
-                    ? async (projectRoot) => {
-                        dog.pause();
-                        const message = await this.host.moveSession(id, projectRoot);
-                        dog.bump();
-                        // Its chats moved surfaces: the list this session was in no longer
-                        // holds it, and the one it went to now does.
-                        this.notifyGlobal();
-                        return message;
-                    }
-                    : undefined,
-                constraints: hasBudgetLimits ? constraints : undefined,
-                price: (usage, priceModel) => this.host.price(usage, priceModel),
-                onBreach: constraints.onBreach && this.host.breach
-                    ? async (breach) => {
-                        // Tracks the model actually running (workerClient resets its breach
-                        // latch after a degrade, so a second in-run breach can fire on the
-                        // NEW model) — price the next breach against that, not the model
-                        // captured at run() time.
-                        const r = await this.host.breach.decide(constraints.onBreach, breach, {
-                            currentModel: activeModel,
-                            // Reuse the tool-permission confirm dialog (pendingPerm/resolvePerm) as
-                            // the yes/no "continue past budget?" prompt — same pattern as AgentPanel's
-                            // per-run budget control: a 'budget' pseudo-tool the overlay special-cases.
-                            ask: (m) => new Promise((resolve) => {
-                                dog.pause();
-                                this.patch(id, { pendingPerm: { tool: 'budget', summary: m, resolve: (b) => { resolve(b); dog.bump(); } } }, true);
-                            }),
-                            // Reuse the existing "append a local notice turn" affordance (used
-                            // today for /model confirmations) for a soft warn — ALSO appended to
-                            // policyNotes, unless the caller opted into policyNotes-only
-                            // rendering (see SendOpts.budgetNotices).
-                            warn: (m) => {
-                                if ((opts.budgetNotices ?? 'transcript') === 'transcript')
-                                    this.note(id, m);
-                                this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: m, action: 'warn' }] });
-                            },
-                            cheaperModel: this.host.breach.cheaperModel(() => s.lastUsage),
-                        });
-                        if (r.model) {
-                            activeModel = r.model;
-                            this.patch(id, { degradedModel: r.model });
-                        }
-                        return r;
-                    }
-                    : undefined,
-                onEvent: (e) => {
-                    /* The task list is fed HERE, at the one choke point every surface's
-                     * runtime passes through - not by a host.
-                     *
-                     * It used to be wired in prompd's AgentPanel alone, so `todo_write`
-                     * worked there and nowhere else: on corenel the model dutifully kept a
-                     * plan across a multi-step job and not one surface could read it,
-                     * because nothing was listening. A tool whose entire purpose is to be
-                     * SEEN cannot depend on each host remembering to subscribe.
-                     *
-                     * Other tool calls bucket as activity under whichever task is active,
-                     * which is what gives an expanded task its detail. */
-                    if (e.type === 'tool-call') {
-                        if (e.name === 'todo_write')
-                            applyTodoWrite(id, e.args);
-                        else
-                            addActivity(id, e.id, e.name);
-                    }
-                    else if (e.type === 'tool-result') {
-                        resolveActivity(id, e.id, e.isError);
-                    }
-                    opts.onRunEvent?.(e);
-                    dog.onEvent(e);
-                    recBuf.push({ at: Date.now(), ev: e });
-                    // Heal persistence is centralized in the worker client (host workerDeps
-                    // onHeal) so it captures sub-agent/DAG-node heals too — not tapped here.
-                    // We just surface the live "Recovering…" status (null clears it on recovered).
-                    if (e.type === 'heal') {
-                        this.patch(id, { recovery: this.host.healNote?.(e.record) ?? null });
-                        return;
-                    }
-                    if (e.type === 'offload') {
-                        this.patch(id, { offloadTick: this.ensure(id).offloadTick + 1 });
-                        return;
-                    }
-                    if (e.type === 'checkpoint') {
-                        seamIds.push(this.noteCheckpoint(id, e.collapsed, e.checkpoint));
-                        return;
-                    }
-                    if (e.type === 'tools-loaded') {
-                        setLoadedTools(id, e.names);
-                        return;
-                    }
-                    if (e.type === 'policy-violation') {
-                        this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: e.kind, message: e.message, action: e.action }] });
-                        return;
-                    }
-                    // Neither of these reads `live`, so they belong ABOVE its early
-                    // return -- below it they would silently stop firing the moment a
-                    // run has no live slice.
-                    if (e.type === 'turn-verified') {
-                        verification = e.verification;
-                        return;
-                    }
-                    if (e.type === 'audit-incomplete') {
-                        auditIncomplete = { lost: e.lost, ...(e.unconfirmed ? { unconfirmed: true } : {}) };
-                        return;
-                    }
-                    if (e.type === 'injected') {
-                        injectedTurnIds.push(this.noteUser(id, e.content));
-                        return;
-                    }
-                    if (e.type === 'turn-interrupted') {
-                        // The partial reply already streamed into `live` is never coming
-                        // back -- clear it so the discarded text does not read as a real
-                        // answer sitting above the injected message.
-                        this.patch(id, { live: foldLive(this.ensure(id).live ?? { text: '', tools: [] }, e) });
-                        return;
-                    }
-                    const live = s.live;
-                    if (!live)
-                        return;
-                    if (e.type === 'assistant-delta' || e.type === 'assistant' || e.type === 'tool-call' || e.type === 'tool-result') {
-                        if (e.type === 'tool-result' && typeof e.durationMs === 'number')
-                            s.toolMs[e.id] = e.durationMs;
-                        this.patch(id, e.type === 'assistant-delta' ? { live: foldLive(live, e), recovery: null } : { live: foldLive(live, e) });
-                    }
-                    else if (e.type === 'error')
-                        this.patch(id, { error: e.message });
-                    else if (e.type === 'usage')
-                        s.lastUsage = e.usage;
-                    // Synthetic event workerClient emits when onBreach returned {continue:false}
-                    // — surfaced as a transcript notice via the existing note() affordance,
-                    // AND appended to policyNotes (same warn/stop duality as above, gated
-                    // by SendOpts.budgetNotices).
-                    else if (e.type === 'budget-stop') {
-                        const msg = `Run stopped: budget reached (${this.host.breach.describe(e.breach)}).`;
-                        if ((opts.budgetNotices ?? 'transcript') === 'transcript')
-                            this.note(id, msg);
-                        this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: msg, action: 'stop' }] });
-                    }
-                },
-            });
-            // Stitch each tool call's measured duration onto its tool message (`_ms`).
-            const ms = s.toolMs;
-            /* FROM THE TAIL, by the count the run reports — never an absolute offset
-             * into what we sent.
-             *
-             * This was `res.messages.slice(outgoing.length + 1)`, which assumed the
-             * loop only ever APPENDS to the array it was handed. Rung-2 compaction
-             * rewrites it in place and the rewrite is shorter than the input, so the
-             * offset ran off the end, the slice came back empty, and the reply the
-             * run had just produced was dropped: the transcript kept the user's
-             * message and nothing else, as though the agent never answered. With
-             * compaction on by default in the browser, that was every turn of a
-             * conversation past 86% fill. */
-            const created = res.messages.slice(res.messages.length - res.appended).map((m) => {
-                const tid = m.tool_call_id;
-                return m.role === 'tool' && tid && ms[tid] != null ? { ...m, _ms: ms[tid] } : m;
-            });
-            const u = res.usage ?? { promptTokens: 0, completionTokens: 0 };
-            const stats = u.promptTokens || u.completionTokens || calleeSpend.inTok || calleeSpend.outTok
-                ? {
-                    // This agent's own turns plus every callee's.
-                    inTok: u.promptTokens + calleeSpend.inTok,
-                    outTok: u.completionTokens + calleeSpend.outTok,
-                    // Cache-aware: the hand-rolled in*price it replaced billed cached tokens at the full rate.
-                    cost: (priceUsageWith(u, { inPrice: priced.inPrice, outPrice: priced.outPrice }) ?? 0) + calleeSpend.cost,
-                    ms: Date.now() - startedAt,
-                    ...(res.contextTokens ? { ctxTok: res.contextTokens } : {}),
-                    ...(u.cachedTokens != null ? { cachedTok: u.cachedTokens } : {}),
-                    ...(res.calls ? { calls: res.calls } : {}),
-                }
-                : undefined;
-            const lastSeam = seamIds[seamIds.length - 1];
-            const stitched = s.turns
-                .filter((t) => !injectedTurnIds.includes(t.id))
-                .map((t) => (t.id === userTurn.id ? { ...t, messages: [userTurn.messages[0], ...created], stats, ...(verification ? { verification } : {}), ...(auditIncomplete ? { auditIncomplete } : {}) } : t));
-            this.patch(id, {
-                lastStopReason: res.stopReason,
-                turns: lastSeam ? stampFoldedView(stitched, lastSeam, res.messages.filter((m) => m.role !== 'system'), userTurn.id) : stitched,
-            });
-            void this.persist(id);
-            if (stats) {
-                this.host.recordUsage({ surface: this.surface, provider: priced.provider, model, modelLabel: priced.label, inEst: null, inTok: stats.inTok, outTok: stats.outTok, cost: stats.cost });
-            }
-            // Best-effort follow-up chips for this turn — generated after the reply lands,
-            // dropped if the user starts/aborts another run before it returns.
-            if (this.host.suggestFollowups) {
-                void this.host.suggestFollowups({ messages: res.messages, model, signal: ac.signal }).then((sug) => {
-                    if (sug.length && !ac.signal.aborted)
-                        this.patch(id, { suggestions: sug }, true);
-                });
-            }
-        }
-        catch (e) {
-            // A throw never returns res.messages, so the run's own copy of every
-            // injected message dies with it and only the transcript-only turns
-            // noteUser added are left. Promote those to real history: the queue
-            // drops an entry the worker confirmed landed, so leaving them excluded
-            // would silently delete the correction from what the next turn sends.
-            const turns = this.ensure(id).turns;
-            const patch = { error: String(e?.message || e) };
-            if (injectedTurnIds.length) {
-                patch.turns = turns.map((t) => (injectedTurnIds.includes(t.id) ? { ...t, included: true } : t));
-            }
-            this.patch(id, patch);
-            void this.persist(id);
+            await this.chat.run({ conversationId: id, input: { text, images } }, this.chatHost).done;
         }
         finally {
-            // A run that ends (abort/watchdog/error) while a perm overlay (tool-permission
-            // or budget-breach "continue?") is still open must not leave its promise —
-            // and the caller awaiting it — hanging forever. Treat an unanswered perm as
-            // "no". resolvePerm() already nulls s.pendingPerm once the user answers, so
-            // this is a no-op (idempotent) on the happy path.
-            if (s.pendingPerm) {
-                s.pendingPerm.resolve(false);
-                this.patch(id, { pendingPerm: null }, true);
-            }
-            dog.clear();
-            s.abort = null;
-            s.runId = null;
-            this.patch(id, { running: false, live: null, recovery: null }, true);
-            // Any callee still marked running under this session will never report.
-            publishSubagentParentEnded(id);
-            // Upsert the session recording with everything captured so far (this turn's
-            // events appended to prior turns), under one stable id so the whole session
-            // replays as a single stream. Skipped until something replayable happened.
-            if (this.host.recorder && recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
-                if (!s.recId) {
-                    s.recId = this.host.recorder.newId();
-                    s.recPrompt = text;
-                    s.recImages = images.length ? images.slice() : undefined;
-                }
-                // `ok` is THIS turn's outcome (slice from turnStart); a snapshot copy of the
-                // events so the store doesn't hold the live array that later turns mutate.
-                const ok = !recBuf.slice(turnStart).some((r) => r.ev.type === 'error');
-                this.host.recorder.save({ kind: 'agent', id: s.recId, title: (s.recPrompt || 'Agent run').slice(0, 60), at: Date.now(), ok, prompt: s.recPrompt || text, promptImages: s.recImages, events: recBuf.slice() });
-            }
+            this.dropTurn(id, t);
         }
     }
     /** A host-driven turn: appends the user message, then awaits a host-supplied
@@ -1610,118 +1168,68 @@ export class AgentRuntime {
      * tool calls — used by surfaces that render a live "thinking" placeholder for
      * work the engine itself doesn't perform. */
     async hostTurn(id, userText, produce) {
-        const s = this.ensure(id);
-        if (!userText || s.running)
+        this.ensure(id);
+        this.forgotten.delete(id);
+        if (!userText || this.chat.state(id).running)
             return;
         this.ws();
-        // As in send: never build on a transcript that has not loaded, and never
-        // start a second turn that began while the load was pending.
-        if (!s.loaded) {
-            await this.load(id);
-            if (s.running)
-                return;
-        }
-        // A loaded chat with no turns is new: titled from this turn, as send does.
-        const isFirst = s.loaded && s.turns.length === 0;
-        const userTurn = { id: `t${Date.now().toString(36)}`, included: true, messages: [{ role: 'user', content: userText }] };
-        const ac = new AbortController();
-        s.abort = ac;
-        // Optimistic, for the same reason as `send` above: the guard is a network
-        // call, and a host-driven turn that waits on it looks like nothing happened.
-        this.patch(id, { turns: [...s.turns, userTurn], error: '', live: { text: '', tools: [] }, running: true, suggestions: [] }, true);
-        // As in send: a load that missed again leaves this turn unsaved; say so now.
-        this.flagIfUnsaved(id);
-        const gate = await this.host.guard('llm-execution');
-        if (!gate.allowed) {
-            s.abort = null;
-            this.patch(id, {
-                turns: this.ensure(id).turns.filter((t) => t.id !== userTurn.id),
-                running: false,
-                live: null,
-                error: gate.reason,
-            }, true);
-            return;
-        }
-        try {
-            const content = await produce(ac.signal);
-            this.patch(id, { turns: this.ensure(id).turns.map((t) => (t.id === userTurn.id ? { ...t, messages: [userTurn.messages[0], { role: 'assistant', content }] } : t)) });
-            void this.persist(id);
-            if (isFirst) {
-                // Queued behind the save, which is what creates a draft.
-                void this.queueWrite(id, async () => {
-                    const ses = await this.host.sessions.get(id);
-                    if (ses && !ses.titleLocked) {
-                        ses.title = userText.slice(0, 48);
-                        await this.host.sessions.save(ses).catch(() => { });
-                        this.notifyGlobal();
-                    }
-                }).catch(() => { });
-            }
-        }
-        catch (e) {
-            this.patch(id, { error: String(e?.message || e) });
-        }
-        finally {
-            s.abort = null;
-            this.patch(id, { running: false, live: null }, true);
-        }
+        await this.chat.hostTurn(id, userText, produce, this.chatHost);
     }
     /** Replace the offload stub for `blobId` inside turn `turnId` (session `id`)
-     * with the full content — the context drawer's per-item Restore, transplanted
-     * from the harness/conversation.ts singleton (same marker-matching and
-     * identity-swap semantics; see that module for the rationale). Returns false
-     * (state untouched, no persist) when the turn or the matching stub is absent,
-     * or when the turn is FOLDED (see isFoldedTurn): the folded view stands for
-     * it, so content restored into it would never be sent. */
+     * with the full content — the context drawer's per-item Restore. Returns
+     * false (state untouched, no persist) when the turn or the matching stub is
+     * absent, or when the turn is FOLDED (see isFoldedTurn): the folded view
+     * stands for it, so content restored into it would never be sent. */
     restoreToolResult(id, turnId, blobId, content) {
-        const marker = `recall_result({ id: "${blobId}" })`;
-        const s = this.ensure(id);
-        const at = s.turns.findIndex((t) => t.id === turnId);
-        if (at < 0 || isFoldedTurn(s.turns, at))
-            return false;
-        const turn = s.turns[at];
-        const idx = turn.messages.findIndex((m) => m.role === 'tool' && typeof m.content === 'string' && m.content.includes(marker));
-        if (idx < 0)
-            return false;
-        const next = s.turns.map((t) => {
-            if (t.id !== turnId)
-                return t;
-            const messages = t.messages.slice();
-            messages[idx] = { ...messages[idx], content };
-            return { ...t, messages };
-        });
-        this.patch(id, { turns: next });
-        void this.persist(id);
-        return true;
+        this.ensure(id);
+        this.open(id);
+        return this.chat.restoreToolResult(id, this.chatHost, turnId, blobId, content);
     }
-    /** Re-run a prior user turn: drop it and everything after, then resend it. */
+    /** Re-run a prior user turn: drop it and everything after, then resend it. A
+     * refused retry puts the dropped turns back (the engine). */
     async retry(id, turnId, opts) {
-        const s = this.ensure(id);
-        if (s.running)
+        this.ensure(id);
+        const state = this.chat.state(id);
+        if (state.running)
             return;
-        const idx = s.turns.findIndex((t) => t.id === turnId);
-        if (idx < 0)
-            return;
-        const first = s.turns[idx].messages[0];
+        const first = state.turns.find((t) => t.id === turnId)?.messages[0];
         const text = first ? userText(first) : '';
         const images = first ? userImages(first) : [];
         if (!text && images.length === 0)
             return;
-        this.patch(id, { turns: s.turns.slice(0, idx) });
-        await this.send(id, text, images, opts);
+        // The browser never freezes its system: composeSystem reads live inputs each turn.
+        this.recomposeSystem(id);
+        const t = this.queueTurn(id, opts, text, images);
+        try {
+            await this.chat.retry(id, turnId, this.chatHost).done;
+        }
+        finally {
+            this.dropTurn(id, t);
+        }
     }
     /** Drop all in-memory state and abort every run — called on a scope change so
      * one identity's sessions and runs never carry into another's. */
     reset() {
-        const runningIds = [...this.map.entries()].filter(([, s]) => s.abort).map(([sid]) => sid);
-        for (const s of this.map.values())
-            s.abort?.abort();
+        const held = [...this.map.keys()];
+        const runningIds = held.filter((sid) => this.chat.state(sid).running);
+        // Nothing of the last identity's waits or blocked output outlives the switch.
+        for (const sid of new Set([...held, ...this.permQueues.keys()]))
+            this.denyAllPerms(sid);
+        this.permQueues.clear();
+        this.blocked.clear();
+        // Forgotten, so a run's late writes land nowhere; reopened on next use.
+        for (const sid of held) {
+            this.chat.forget(sid);
+            this.forgotten.add(sid);
+        }
         // The worker is disposed below, which never settles an in-flight run, so
-        // its `finally` (and the parent-ended signal there) never runs: say it here.
+        // its end (and the parent-ended signal there) never comes: say it here.
         for (const sid of runningIds)
             publishSubagentParentEnded(sid);
         const ids = [...this.subs.keys()];
         this.map.clear();
+        this.pending.clear();
+        this.active.clear();
         this.worker?.dispose();
         this.worker = null;
         this._ws = null;
@@ -1737,5 +1245,567 @@ export class AgentRuntime {
         this.offModels?.();
         this.offModels = null;
     }
+    /* ---- the browser host of the chat engine ---- */
+    buildChatHost() {
+        return {
+            /* Feature guard — the runtime is the chokepoint for every /agent run (send
+             * and retry), so a quota/plan guard registered later covers this surface
+             * too. Called once the engine shows the turn: this side's half of the
+             * optimistic start (the composer) happens here, and so does its half of
+             * a denial. */
+            guard: ({ conversationId: id, kind }) => {
+                /* An inject joins the run already going: it is checked as a send is
+                 * (llm-execution), and starts no turn, touches no composer and owes no
+                 * run end. The feature guards only read an entitlement, so it counts
+                 * nothing against a quota; usage is recorded once, at the run's end. */
+                if (kind === 'inject')
+                    return this.host.guard('llm-execution');
+                const t = id && (kind === 'send' || kind === 'retry') ? this.startTurn(id) : null;
+                if (id && kind === 'host-turn')
+                    this.patch(id, { suggestions: [] }, true);
+                /* The host's own promise where nothing waits on it, so a host turn's
+                 * produce starts as soon after the guard as it always did (a stop that
+                 * lands in between still reaches it). */
+                if (!id || !t)
+                    return this.host.guard('llm-execution');
+                // Put back what was typed (and any pasted images): a turn refused here
+                // is a message the user would otherwise believe they sent.
+                const putBack = () => {
+                    this.patch(id, { input: t.priorInput || t.text, attachments: t.priorAttachments.length ? t.priorAttachments : t.images });
+                };
+                return this.host.guard('llm-execution').then((gate) => {
+                    if (!gate.allowed)
+                        putBack();
+                    else {
+                        t.allowed = true;
+                        t.startedAt = Date.now();
+                        t.recBuf = t.ui.recEvents;
+                        t.turnStart = t.recBuf.length;
+                        /* A draft becomes a saved chat now, before the run, so it is in the
+                         * chat list while it runs; a refused send leaves nothing behind. A
+                         * text send's retitle would create it too, an image-only one never.
+                         * A failed save does not stop the run: its first write tries again. */
+                        if (this.drafts.has(id))
+                            return this.materialize(id).then(() => gate, () => gate);
+                    }
+                    return gate;
+                }, (e) => { putBack(); throw e; });
+            },
+            // The browser always names its chat; a new one is a draft until first written.
+            createConversation: () => this.newDraft(),
+            /* A draft is in no store: it reads as an empty chat, so the engine's
+             * first-turn retitle and its save find a record (writeConversation then
+             * creates it). A LOAD's read (the chat is not loaded yet) is where this
+             * side takes the stored model; a save's read-before-write is not. */
+            loadConversation: (id) => {
+                this.ws();
+                if (this.drafts.has(id))
+                    return Promise.resolve({ id, title: 'New chat', messages: [] });
+                const read = this.host.sessions.get(id);
+                if (this.chat.state(id).loaded)
+                    return read.then((ses) => (ses ? withoutSystem(ses) : ses));
+                return read.then((ses) => { this.onLoaded(id, ses); return ses ? withoutSystem(ses) : ses; }, (e) => { this.onLoaded(id, null); throw e; });
+            },
+            /* The first write to a draft saves it first; a failed save fails this
+             * write, and the draft stays a draft for the next one. A save (not the
+             * retitle, which writes the stored record back as read) carries the
+             * chat's model. */
+            writeConversation: (c, { allowTruncate }) => (this.drafts.has(c.id)
+                ? this.materialize(c.id).then((created) => this.writeSession(c, allowTruncate, created))
+                : this.writeSession(c, allowTruncate, null)),
+            runOptions: async ({ conversationId: id }) => this.runOptionsFor(id, this.turnFor(id)),
+            system: ({ conversationId: id }) => {
+                const t = this.turnFor(id);
+                return this.composeSystem(id, t.opts.persona, t.opts.partsOverride);
+            },
+            runLoop: (messages, runOpts, control) => this.runWorker(messages, runOpts, control),
+            injectInto: (runId, messages, hard) => {
+                this.getWorker().inject(Number(runId), messages, hard);
+                return true;
+            },
+            askPermission: (id, req) => new Promise((done) => {
+                // A callee's ask names who called it: this chat's own agent.
+                const auditAgent = this.host.capabilities?.agentName?.();
+                const caller = req.agent ? (auditAgent ? { caller: auditAgent } : {}) : {};
+                // A System One ask keeps its own detail (tool, reasons, result); a tool ask only the clipped PermDetail.
+                const hook = req.tool === HOOK_ASK_TOOL ? hookInput(req.input) : undefined;
+                const input = req.tool === HOOK_ASK_TOOL ? undefined : permInput(req.input);
+                const permId = this.nextPermId++;
+                // The run ended while the card was up or queued: no answer is a deny (Block).
+                const onAbort = () => this.denyPerm(id, permId);
+                // A deny with a note carries it, as the person's reason.
+                const resolve = (allow, note) => {
+                    req.signal.removeEventListener('abort', onAbort);
+                    done(!allow && note ? { allow, by: 'human', note } : { allow });
+                };
+                if (req.signal.aborted) {
+                    resolve(false);
+                    return;
+                }
+                req.signal.addEventListener('abort', onAbort, { once: true });
+                this.raisePerm(id, {
+                    tool: req.tool, summary: req.summary, ...(req.agent ? { agent: req.agent } : {}), ...(input ? { input } : {}),
+                    ...(hook ? { hook } : {}), ...caller, id: permId, askedAt: Date.now(), resolve,
+                });
+            }),
+            askUser: (id, questions, signal) => new Promise((done) => {
+                // The run ended while the form was up: no answer is a decline.
+                const onAbort = () => { if (this.map.get(id)?.pendingAsk === ask)
+                    this.resolveAsk(id, null); };
+                const ask = { questions, resolve: (a) => { signal.removeEventListener('abort', onAbort); done(a); } };
+                signal.addEventListener('abort', onAbort, { once: true });
+                this.patch(id, { pendingAsk: ask }, true);
+            }),
+            /* Unused in the browser: runWorker wires propose_edit through control.paused
+             * with the run's own SendOpts, so the verdict stays typed, bound to the run
+             * that asked, and a surface without onEditReview keeps the non-blocking
+             * fallback. Present because every ChatHost method is required. */
+            reviewEdit: (id, callId, signal) => this.reviewEditFor(this.active.get(id)?.opts, callId, signal),
+            // Best-effort follow-up chips for this turn — generated after the reply lands,
+            // dropped if the user starts/aborts another run before it returns.
+            suggestFollowups: ({ conversationId: id, messages, signal }) => {
+                if (!this.host.suggestFollowups)
+                    return;
+                const model = this.active.get(id)?.model || this.chatModel(id);
+                void this.host.suggestFollowups({ messages, model, signal }).then((sug) => {
+                    if (sug.length && !signal.aborted)
+                        this.patch(id, { suggestions: sug }, true);
+                });
+            },
+            turnComplete: (result) => this.endTurn(result),
+            stateChanged: (id, global) => {
+                const s = this.map.get(id);
+                if (s)
+                    this.sync(id, s);
+                this.notify(id);
+                if (global)
+                    this.notifyGlobal();
+            },
+            /* ---- run events ----
+             *
+             * The engine keeps the live slice, the error, the turn's tool timings and
+             * injection checks, the seams, injected messages, verification and audit
+             * gaps. What only this side keeps is below; every other event is an
+             * explicit no-op. */
+            onTurn: () => { },
+            onAssistantDelta: (_e, { conversationId: id }) => {
+                // Output resumed: the "Recovering…" note is over.
+                if (this.map.get(id)?.recovery != null)
+                    this.patch(id, { recovery: null });
+            },
+            onAssistant: () => { },
+            onInjected: () => { },
+            onTurnInterrupted: () => { },
+            /* The task list is fed HERE, at the one choke point every surface's
+             * runtime passes through - not by a host.
+             *
+             * It used to be wired in prompd's AgentPanel alone, so `todo_write`
+             * worked there and nowhere else: on corenel the model dutifully kept a
+             * plan across a multi-step job and not one surface could read it,
+             * because nothing was listening. A tool whose entire purpose is to be
+             * SEEN cannot depend on each host remembering to subscribe.
+             *
+             * Other tool calls bucket as activity under whichever task is active,
+             * which is what gives an expanded task its detail. */
+            onToolCall: (e, { conversationId: id }) => {
+                if (e.name === 'todo_write')
+                    applyTodoWrite(id, e.args);
+                else
+                    addActivity(id, e.id, e.name);
+            },
+            onToolDelta: () => { },
+            onToolResult: (e, { conversationId: id }) => {
+                resolveActivity(id, e.id, e.isError);
+            },
+            onOffload: (_e, { conversationId: id }) => {
+                this.patch(id, { offloadTick: this.ensure(id).offloadTick + 1 });
+            },
+            // The engine stitches the check onto its tool message (`_check`).
+            onToolCheck: () => { },
+            // The engine stitches the marks (`_hooks`); a blocked result stays here, in memory.
+            onToolHooks: (e, { conversationId: id }) => {
+                if (e.blockedText === undefined)
+                    return;
+                let m = this.blocked.get(id);
+                if (!m) {
+                    m = new Map();
+                    this.blocked.set(id, m);
+                }
+                m.set(e.id, e.blockedText);
+            },
+            // The engine writes the seam (noteCheckpoint) and stamps the folded view.
+            onCheckpoint: () => { },
+            onToolsLoaded: (e, { conversationId: id }) => {
+                // What this conversation found with tool_search, for the next run's loadedTools.
+                setLoadedTools(id, e.names);
+            },
+            onContextPressure: () => { },
+            onPermission: () => { },
+            onPermissionAudit: () => { },
+            onPolicyViolation: (e, { conversationId: id }) => {
+                this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: e.kind, message: e.message, action: e.action }] });
+            },
+            onHeal: (e, { conversationId: id }) => {
+                // Heal persistence is centralized in the worker client (host workerDeps
+                // onHeal) so it captures sub-agent/DAG-node heals too — not tapped here.
+                // We just surface the live "Recovering…" status (null clears it on recovered).
+                this.patch(id, { recovery: this.host.healNote?.(e.record) ?? null });
+            },
+            onUsage: (e, { conversationId: id }) => {
+                // Latest turn's usage, for a degrade breach's next-turn cost projection.
+                const s = this.map.get(id);
+                if (s)
+                    s.lastUsage = e.usage;
+            },
+            onTurnVerified: () => { },
+            onDone: () => { },
+            onArtifact: () => { },
+            onError: () => { },
+            /* Synthetic event workerClient emits when onBreach returned {continue:false}
+             * — surfaced as a transcript notice via the existing note() affordance,
+             * AND appended to policyNotes (same warn/stop duality as the breach warn,
+             * gated by SendOpts.budgetNotices). */
+            onBudgetStop: (e, { conversationId: id }) => {
+                const msg = `Run stopped: budget reached (${this.host.breach.describe(e.breach)}).`;
+                if ((this.active.get(id)?.opts.budgetNotices ?? 'transcript') === 'transcript')
+                    this.note(id, msg);
+                this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: msg, action: 'stop' }] });
+            },
+            onBudgetWarn: () => { },
+            onAuditIncomplete: () => { },
+            onMcpUnavailable: () => { },
+            onAwaitingOwner: () => { },
+            onDontsChecking: () => { },
+            onOwnerDecided: () => { },
+        };
+    }
+    /** Saves a conversation the engine hands over. A save's record is the
+     * store's own session read just before (so every field it holds goes back);
+     * a draft's stand-in takes the session its first write just created. */
+    writeSession(c, allowTruncate, created) {
+        const model = allowTruncate ? this.map.get(c.id)?.model : null;
+        const write = (base) => {
+            const ses = withoutSystem({ ...base, ...c, ...(model ? { model } : {}) });
+            // A save may shorten the stored chat: the engine only asks when this
+            // page's list IS the chat (R36) or holds every stored turn after a merge.
+            return this.host.sessions.save(ses, allowTruncate ? { allowTruncate: true } : undefined);
+        };
+        if (created)
+            return write(created);
+        if (isSession(c))
+            return write(c);
+        return this.host.sessions.get(c.id).then((ses) => {
+            if (!ses)
+                throw new Error(`session ${c.id} is not stored`);
+            return write(ses);
+        });
+    }
+    /** propose_edit blocks on the user's verdict through the surface's own
+     * onEditReview; with none, the review is unsupported and resolves null. */
+    reviewEditFor(opts, callId, signal) {
+        const review = opts?.onEditReview;
+        return review ? review(callId, signal) : Promise.resolve(null);
+    }
+    /** What `send` hands the worker for one turn, beyond what the engine's
+     * control supplies (the system prompt, the signal, the event stream, the
+     * asks). Resolved per run, for THIS session. */
+    async runOptionsFor(id, t) {
+        const s = t.ui;
+        const { opts } = t;
+        // Mark a FOLLOW-UP user turn so the replay shows it as a bubble in place. The
+        // first turn's prompt is the recording's `prompt` header, so only record once
+        // the session already has replayable content (avoids duplicating it).
+        if (t.recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
+            t.recBuf.push({ at: Date.now(), ev: { type: 'user', content: t.text, images: t.images.length ? t.images.slice() : undefined } });
+        }
+        /* The skill catalog travels WITH the run: the worker cannot read skill
+         * files, and the loop owns both the index and `use_skill`. Resolved for
+         * THIS session, so a skill switched off in one conversation is still
+         * offered in every other. Read while the engine composes the system
+         * prompt, so it adds no latency ahead of the run. Never fatal: a read
+         * failure costs skills, not the run. */
+        const skillDeny = this.host.capabilities?.skillDeny?.(id) ?? [];
+        const skills = await enabledSkillCatalog((name) => !skillDeny.includes(name)).catch(() => []);
+        const model = this.chatModel(id);
+        /* Decided now, from what is true now: the chat's own model is gone and
+         * the one it falls back to cannot hold it. A model picked since load, or
+         * a catalog that has caught up, changes the answer. */
+        const forceFold = !!this.lostModel(s) && !this.canHold(id, model);
+        // The chat now runs on `model`; storing it is what clears the notice.
+        if (this.host.perChatModel && s.model !== model)
+            this.patch(id, { model });
+        // Live model for onBreach pricing — reassigned when a degrade breach
+        // switches the run onto a cheaper model (see onBreach below).
+        let activeModel = model;
+        const priced = this.host.modelInfo(model);
+        t.model = model;
+        t.priced = priced;
+        const contextWindow = priced.contextWindow ?? 128000;
+        // The surface's constraints default (Task 7), overridden per run when the
+        // caller passes one (a masked-override envelope from `mergeOverride`) —
+        // mirrors AgentPanel's `eff = { ...savedDefault, ...perRunOverride }`.
+        // NOTE: this deliberately reads `this.surface`'s constraints, not a
+        // hardcoded 'agent' — a behavior change for /craft vs. the pre-extraction
+        // class (which always read 'agent'); 'craft' has no saved defaults so the
+        // effective result is unchanged.
+        const constraints = { ...this.host.constraints(this.surface), ...(opts.constraints ?? {}) };
+        const hasBudgetLimits = constraints.maxUsd != null || constraints.maxTokens != null || constraints.maxMs != null;
+        // Capability seam (Task 3): only send toolNames when the host's tools
+        // getter is NOT the default allTools (reference inequality) — this keeps
+        // the default path byte-identical, since every surface today passes
+        // `tools: allTools` (or omits capabilities entirely).
+        const capTools = this.host.capabilities?.tools;
+        const toolNames = capTools && capTools !== allTools ? capTools().map((x) => x.name) : undefined;
+        /* RESOLVED PER RUN, FOR THIS SESSION. The composer popout can switch a
+         * source (an MCP server, a builtin namespace, a skill) off for ONE
+         * conversation, and this is where that choice stops being a UI state and
+         * becomes tools the worker will not offer. Passing the id rather than
+         * reading an "active session" global keeps it correct while two surfaces
+         * run at once. A host that ignores the argument -- crew does -- is
+         * unaffected. */
+        const toolDeny = this.host.capabilities?.toolDeny?.(id);
+        // Resolved per run so an edit to a callee (or its canCall list) applies to
+        // the next delegation without rebuilding the runtime. Never fatal: a read
+        // failure costs delegation, not the run.
+        const resolvedDelegates = await (this.host.capabilities?.delegates?.().catch(() => []) ?? Promise.resolve([]));
+        /* Under a usd cap a callee's turns are priced against this run's meter,
+         * so a callee whose model this host cannot price would spend without
+         * moving it. Refused, with the daemon's words (executor.ts). */
+        const crewDelegates = constraints.maxUsd != null
+            ? resolvedDelegates.map((d) => (d.model && !pricedForUsd(this.host.usdRates?.(d.model) ?? null)
+                ? { ...d, model: '', refusal: unpricedCalleeRefusal(d.name, d.model) }
+                : d))
+            : resolvedDelegates;
+        const crewOrchestration = this.host.capabilities?.orchestration?.();
+        const crewTraceRoot = this.host.capabilities?.traceRoot?.();
+        const auditAgent = this.host.capabilities?.agentName?.();
+        /* What this turn's sub-agents (delegated callees) spent, from their
+         * node-event usage (review B-I6). Added to the turn's stats and the
+         * usage ledger, as the daemon's run log does. Only a tally for display:
+         * the budget gate meters the same events itself (workerClient), so
+         * nothing here feeds it. */
+        const calleeSpend = t.calleeSpend;
+        // A prompt this side raises holds the run's watchdog while a person decides.
+        const paused = (ask) => (t.control ? t.control.paused(ask) : ask());
+        return {
+            model,
+            temperature: this.getTemperature?.(),
+            toolDeny,
+            // What this conversation already found with tool_search, so turn 9
+            // does not search again for what turn 2 loaded.
+            loadedTools: loadedToolNames(id),
+            skills,
+            crewDelegates,
+            crewOrchestration,
+            ...(crewTraceRoot ? { crewTraceRoot } : {}),
+            policy: this.host.policy
+                ? this.host.policy(getPolicy(opts.policyName) ?? STANDARD_POLICY)
+                : (getPolicy(opts.policyName) ?? STANDARD_POLICY),
+            ...(this.host.sessionsRoot ? { sessionsRoot: this.host.sessionsRoot() } : {}),
+            compression: { mode: this.host.compression(), contextWindow },
+            ...(forceFold ? { forceFold: true } : {}),
+            toolNames,
+            // Non-blocking: fires when the approvals bridge records a decision and
+            // offers a standing rule. The context identifies which session/surface
+            // recorded it — the runId is added by the bridge itself.
+            approvalContext: { surface: this.surface, sessionId: id },
+            // The audit log files this run under its session, and under its agent
+            // when the host names one (persona is prompt text, never an identity).
+            auditContext: { session: id, ...(auditAgent ? { agent: auditAgent } : {}) },
+            onApprovalSuggestion: (sug) => this.patch(id, { approvalSuggestion: sug }, true),
+            // Editor-buffer surfaces pass onEditReview/editorFile (Task 4); the
+            // standalone page omits both, so propose_edit keeps its non-blocking
+            // fallback exactly as before.
+            editorFile: opts.editorFile,
+            onNodeEvent: (e) => {
+                publishSubagentEvent({ sessionId: id, surface: this.surface, event: e });
+                const c = nodeUsageOf(e);
+                if (c) {
+                    calleeSpend.inTok += c.usage.promptTokens;
+                    calleeSpend.outTok += c.usage.completionTokens;
+                    const m = c.model ?? model;
+                    // Priced only when this host really knows the model's rates; an
+                    // unknown one still counts its tokens (never an invented cost).
+                    if (pricedForUsd(this.host.usdRates?.(m) ?? null))
+                        calleeSpend.cost += this.host.price(c.usage, m);
+                }
+                opts.onNodeEvent?.(e);
+            },
+            /* start_project offering to bring the conversation with it. The run is
+             * STILL WRITING, so this cannot be file work the tool does on its own:
+             * only here is it known which session this run belongs to, and only
+             * here can the store that is saving it be re-pointed. The host does
+             * both, or the option is not offered at all. */
+            onMoveSession: this.host.moveSession
+                ? async (projectRoot) => {
+                    const message = await paused(() => this.host.moveSession(id, projectRoot));
+                    // Its chats moved surfaces: the list this session was in no longer
+                    // holds it, and the one it went to now does.
+                    this.notifyGlobal();
+                    return message;
+                }
+                : undefined,
+            constraints: hasBudgetLimits ? constraints : undefined,
+            price: (usage, priceModel) => this.host.price(usage, priceModel),
+            onBreach: constraints.onBreach && this.host.breach
+                ? async (breach) => {
+                    // Tracks the model actually running (workerClient resets its breach
+                    // latch after a degrade, so a second in-run breach can fire on the
+                    // NEW model) — price the next breach against that, not the model
+                    // captured at run() time.
+                    const r = await this.host.breach.decide(constraints.onBreach, breach, {
+                        currentModel: activeModel,
+                        // Reuse the tool-permission confirm dialog (pendingPerm/resolvePerm) as
+                        // the yes/no "continue past budget?" prompt — same pattern as AgentPanel's
+                        // per-run budget control: a 'budget' pseudo-tool the overlay special-cases.
+                        ask: (m) => paused(() => new Promise((resolve) => {
+                            this.raisePerm(id, { id: this.nextPermId++, tool: 'budget', summary: m, askedAt: Date.now(), resolve });
+                        })),
+                        // Reuse the existing "append a local notice turn" affordance (used
+                        // today for /model confirmations) for a soft warn — ALSO appended to
+                        // policyNotes, unless the caller opted into policyNotes-only
+                        // rendering (see SendOpts.budgetNotices).
+                        warn: (m) => {
+                            if ((opts.budgetNotices ?? 'transcript') === 'transcript')
+                                this.note(id, m);
+                            this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: m, action: 'warn' }] });
+                        },
+                        cheaperModel: this.host.breach.cheaperModel(() => s.lastUsage),
+                    });
+                    if (r.model) {
+                        activeModel = r.model;
+                        this.patch(id, { degradedModel: r.model });
+                    }
+                    return r;
+                }
+                : undefined,
+        };
+    }
+    /** One turn of the worker's agent loop, under the engine's control. */
+    async runWorker(messages, runOpts, control) {
+        const id = control.conversationId;
+        const t = this.turnFor(id);
+        t.control = control;
+        const { opts } = t;
+        const review = opts.onEditReview;
+        const res = await this.getWorker().run(messages, {
+            ...runOpts,
+            system: control.system,
+            signal: control.signal,
+            sessionId: id,
+            // Record the worker's run id the instant it exists, so inject() (which
+            // can arrive at any point during this run) has something live to address.
+            onStart: (runId) => control.onStart(String(runId)),
+            // The queue's only way to tell "landed" from "never made it": the
+            // AgentEvent 'injected' the loop emits per message carries text, not the
+            // caller's id, so a reverting caller reads THIS to know which of its
+            // still-pending ids it must NOT revert (reverting one that already
+            // landed would re-send it as a fresh turn and duplicate it).
+            onInjected: (ids) => control.onInjected(ids),
+            // The engine answers from the session allows, or asks (askPermission).
+            onPermission: async (req) => toPermissionAnswer(await control.askPermission({
+                tool: req.tool, summary: req.summary, ...(req.agent ? { agent: req.agent } : {}), ...(req.input ? { input: req.input } : {}),
+                signal: control.signal,
+            })),
+            onAsk: (questions) => control.askUser(questions),
+            // propose_edit blocks on the user's verdict — the watchdog holds (like an
+            // open ask form) until the surface resolves it.
+            onEditReview: review ? (callId) => control.paused(() => this.reviewEditFor(opts, callId, control.signal)) : undefined,
+            onEvent: (e) => {
+                // The engine first (the live slice, then this side's handlers, the task
+                // list among them); a host hook that throws cannot cost it an event.
+                control.onEvent(e);
+                // A blocked result goes no further than this page's memory (onToolHooks above).
+                const kept = withoutBlockedText(e);
+                opts.onRunEvent?.(kept);
+                t.recBuf.push({ at: Date.now(), ev: kept });
+            },
+        });
+        const priced = t.priced ?? this.host.modelInfo(t.model);
+        const spend = t.calleeSpend;
+        const u = res.usage ?? { promptTokens: 0, completionTokens: 0 };
+        const stats = u.promptTokens || u.completionTokens || spend.inTok || spend.outTok
+            ? {
+                // This agent's own turns plus every callee's.
+                inTok: u.promptTokens + spend.inTok,
+                outTok: u.completionTokens + spend.outTok,
+                // Cache-aware: the hand-rolled in*price it replaced billed cached tokens at the full rate.
+                cost: (priceUsageWith(u, { inPrice: priced.inPrice, outPrice: priced.outPrice }) ?? 0) + spend.cost,
+                ms: Date.now() - t.startedAt,
+                ...(res.contextTokens ? { ctxTok: res.contextTokens } : {}),
+                ...(u.cachedTokens != null ? { cachedTok: u.cachedTokens } : {}),
+                ...(res.calls ? { calls: res.calls } : {}),
+            }
+            : undefined;
+        return {
+            messages: res.messages,
+            // FROM THE TAIL, by the count the run reports (stitchTurn): rung-2
+            // compaction rewrites the array shorter than what was sent.
+            appended: res.appended,
+            stopReason: res.stopReason,
+            ...(res.usage ? { usage: res.usage } : {}),
+            ...(stats ? { stats } : {}),
+            // The engine measures every tool's duration from its own events.
+            toolMs: {},
+        };
+    }
+    /** What a run's end owes this side, once the engine has settled the turn.
+     *
+     * The engine calls this once for EVERY turn (R3): one refused before it
+     * started (empty input, or a second send while a run is going), a refused
+     * retry, one stopped before its loop, and a host turn. Only a send or retry
+     * whose loop actually ran owes the run-end effects below (usage, the
+     * auto-deny of an open permission card, the subagent parent-ended signal,
+     * the recording). Anything else only notifies: a refused second send must
+     * not deny or bill the run that IS going. */
+    endTurn(result) {
+        const id = result.conversationId;
+        if (!id)
+            return;
+        const t = this.active.get(id);
+        const mine = t !== undefined && t.userTurnId === result.userTurnId;
+        if (t && mine)
+            this.active.delete(id);
+        if (!t || !mine || !t.allowed || !result.ran || result.kind === 'host-turn') {
+            this.notify(id);
+            return;
+        }
+        const s = t.ui;
+        const { stats } = result;
+        const priced = t.priced;
+        if (stats && priced) {
+            this.host.recordUsage({ surface: this.surface, provider: priced.provider, model: t.model, modelLabel: priced.label, inEst: null, inTok: stats.inTok, outTok: stats.outTok, cost: stats.cost });
+        }
+        // A run that ends (abort/watchdog/error) while a perm overlay (tool-permission
+        // or budget-breach "continue?") is still open must not leave its promise —
+        // and the caller awaiting it — hanging forever. Treat an unanswered perm as
+        // "no". resolvePerm() already nulls s.pendingPerm once the user answers, so
+        // this is a no-op (idempotent) on the happy path. Queued asks go the same way.
+        if (s.pendingPerm) {
+            s.pendingPerm.resolve(false);
+            s.pendingPerm = null;
+        }
+        this.denyAllPerms(id);
+        s.recovery = null;
+        this.notify(id);
+        this.notifyGlobal();
+        // Any callee still marked running under this session will never report.
+        publishSubagentParentEnded(id);
+        // Upsert the session recording with everything captured so far (this turn's
+        // events appended to prior turns), under one stable id so the whole session
+        // replays as a single stream. Skipped until something replayable happened.
+        const recBuf = t.recBuf;
+        if (this.host.recorder && recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
+            if (!s.recId) {
+                s.recId = this.host.recorder.newId();
+                s.recPrompt = t.text;
+                s.recImages = t.images.length ? t.images.slice() : undefined;
+            }
+            // `ok` is THIS turn's outcome (slice from turnStart); a snapshot copy of the
+            // events so the store doesn't hold the live array that later turns mutate.
+            const ok = !recBuf.slice(t.turnStart).some((r) => r.ev.type === 'error');
+            this.host.recorder.save({ kind: 'agent', id: s.recId, title: (s.recPrompt || 'Agent run').slice(0, 60), at: Date.now(), ok, prompt: s.recPrompt || t.text, promptImages: s.recImages, events: recBuf.slice() });
+        }
+    }
 }
 //# sourceMappingURL=runtime.js.map