@deepstrike/sdk 0.2.49 → 0.2.51

package/dist/runtime/runner.js

@@ -1,13 +1,15 @@
+import { createHash } from "node:crypto";
 import { extractSessionMemories } from "../memory/extraction.js";
 import { resolvePermissionRequest } from "./execution-plane.js";
 import { GroupBudgetScope } from "./run-group.js";
 import { getKernel } from "../kernel.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
-import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, recoverWorkflowNodeOutcomes, recoverSubmittedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
+import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, } from "./session-repair.js";
 import { KernelPrimitivesDashboard } from "./kernel-primitives-dashboard.js";
-import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, entropySampleFromObservation, durableKernelAction, durableKernelApply, durableKernelMaybeAction, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, workflowBudgetNote, workflowNodeOutcomeFromKernel, workflowNodeStatusFromTermination, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "../types/agent.js";
+import { capabilityMarker, capabilitySkill, capabilityTool, capabilityCommandMount, capabilityCommandUnmount, entropySampleFromObservation, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
+import { CanonicalKernelRejectedError, CanonicalRunnerRuntime, canonicalKernelAction, canonicalKernelApply, canonicalKernelMaybeAction, canonicalStartAgent, canonicalStartWorkflow, } from "./canonical-kernel-step.js";
+import { agentRunSpecToKernel, MILESTONE_UNVERIFIED_REASON, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowBudgetNote, workflowNodeSpecToKernel, workflowNodeOutcomeFromKernel, workflowNodeStatusFromTermination, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "../types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
 import { resolveReducer } from "./reducers.js";
@@ -15,7 +17,7 @@ import { loopInstruction, classifyInstruction, judgeGoal, dependencyOutputsNote,
 import { governancePolicyToKernelEvent, governanceFilterSchema } from "../governance.js";
 import { kernelObservationToSessionEvent } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
-import { LargeResultSpool } from "./large-result-spool.js";
+import { PayloadStore } from "./payload-store.js";
 import { formatToolError } from "../tools/errors.js";
 import { ManagedTaskScope } from "./reliability.js";
 import { contextPolicyV1, normalizeContextPolicyV1, } from "./context-policy.js";
@@ -36,13 +38,45 @@ export function schedulerPolicyToKernel(policy) {
         token_cost_weight: policy.tokenCostWeight,
     };
 }
-/** Kernel observation kinds owned by the memory lifecycle consumer (journal + store mirror). */
-function isMemoryLifecycleObservation(obs) {
-    return obs.kind === "memory_written"
-        || obs.kind === "memory_queried"
-        || obs.kind === "memory_validation_failed"
-        || obs.kind === "memory_recalled"
-        || obs.kind === "promotion_suggested";
+function kernelReliabilityToKernel(policy) {
+    const allowed = new Set(["providerRecoveryAttempts", "outputRecoveryAttempts", "maxInputBytes"]);
+    const unknown = Object.keys(policy).filter(key => !allowed.has(key));
+    if (unknown.length > 0) {
+        throw new TypeError(`unknown kernel reliability field(s): ${unknown.join(", ")}`);
+    }
+    return {
+        ...(policy.providerRecoveryAttempts !== undefined
+            ? { provider_recovery_attempts: policy.providerRecoveryAttempts }
+            : {}),
+        ...(policy.outputRecoveryAttempts !== undefined
+            ? { output_recovery_attempts: policy.outputRecoveryAttempts }
+            : {}),
+        ...(policy.maxInputBytes !== undefined ? { max_input_bytes: policy.maxInputBytes } : {}),
+    };
+}
+function memoryPolicyToKernel(policy) {
+    const allowed = new Set([
+        "staleWarningDays",
+        "retrievalTopK",
+        "validationEnabled",
+        "maxContentBytes",
+        "maxNameLength",
+        "promotionRecallThreshold",
+    ]);
+    const unknown = Object.keys(policy).filter(key => !allowed.has(key));
+    if (unknown.length > 0) {
+        throw new TypeError(`unknown memory policy field(s): ${unknown.join(", ")}`);
+    }
+    return {
+        ...(policy.staleWarningDays !== undefined ? { stale_warning_days: policy.staleWarningDays } : {}),
+        ...(policy.retrievalTopK !== undefined ? { retrieval_top_k: policy.retrievalTopK } : {}),
+        ...(policy.validationEnabled !== undefined ? { validation_enabled: policy.validationEnabled } : {}),
+        ...(policy.maxContentBytes !== undefined ? { max_content_bytes: policy.maxContentBytes } : {}),
+        ...(policy.maxNameLength !== undefined ? { max_name_length: policy.maxNameLength } : {}),
+        ...(policy.promotionRecallThreshold !== undefined
+            ? { promotion_recall_threshold: policy.promotionRecallThreshold }
+            : {}),
+    };
 }
 function controlRequestRejection(observations, operation) {
     const rejected = observations.find(observation => observation.kind === "control_request_rejected"
@@ -71,6 +105,17 @@ function pendingCallIds(action) {
             return "effectId" in action ? [action.effectId] : [];
     }
 }
+function utf8Prefix(value, maxBytes) {
+    if (maxBytes <= 0)
+        return "";
+    const bytes = Buffer.from(value, "utf8");
+    if (bytes.byteLength <= maxBytes)
+        return value;
+    let end = maxBytes;
+    while (end > 0 && (bytes[end] & 0xC0) === 0x80)
+        end -= 1;
+    return bytes.subarray(0, end).toString("utf8");
+}
 export class RuntimeRunner {
     opts;
     interrupted = false;
@@ -81,6 +126,7 @@ export class RuntimeRunner {
     activeGroupBudgetScope;
     pendingObservations = [];
     currentSessionId = null;
+    fallbackPayloadStore = null;
     /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
     injectedSignals = [];
     /** Skill names whose content has already been pushed into the durable `knowledge` slot this
@@ -92,9 +138,6 @@ export class RuntimeRunner {
     activePageOutArchive;
     /** K4: the active run's goal, kept for the renewal-boundary memory re-query. */
     currentGoal = "";
-    /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
-     *  at the next safe point (after the tool turn resolves, kernel back in Reason — not suspended). */
-    pendingAuthoredWorkflows = [];
     workflowContinuation = null;
     dashboard = null;
     /** Most recent kernel entropy sample of the active/last run (see `latestEntropy`). */
@@ -110,6 +153,10 @@ export class RuntimeRunner {
         if (!Number.isInteger(schemaAttempts) || schemaAttempts < 1 || schemaAttempts > 16) {
             throw new RangeError("workflowSchemaValidationAttempts must be an integer between 1 and 16");
         }
+        if (opts.kernelReliability)
+            kernelReliabilityToKernel(opts.kernelReliability);
+        if (opts.memoryPolicy)
+            memoryPolicyToKernel(opts.memoryPolicy);
         this.composedSystemPrompt = composeSystemPrompt(opts.systemPrompt, opts.instructions);
         if (opts.enableDiagnosticsDashboard) {
             const originalAppend = opts.sessionLog.append.bind(opts.sessionLog);
@@ -148,14 +195,23 @@ export class RuntimeRunner {
             throw new Error("durable kernel transitions require a session id");
         return resolved;
     }
-    async commitKernelApply(runtime, pending, event, sessionId) {
-        return durableKernelApply(runtime, this.opts.sessionLog, this.durableSessionId(sessionId), pending, event);
+    async commitKernelApply(runtime, pending, event, _sessionId) {
+        return canonicalKernelApply(runtime, pending, event);
     }
-    async commitKernelMaybeAction(runtime, pending, event, sessionId) {
-        return durableKernelMaybeAction(runtime, this.opts.sessionLog, this.durableSessionId(sessionId), pending, event);
+    async commitKernelMaybeAction(runtime, pending, event, _sessionId) {
+        return canonicalKernelMaybeAction(runtime, pending, event);
     }
-    async commitKernelAction(runtime, pending, event, sessionId) {
-        return durableKernelAction(runtime, this.opts.sessionLog, this.durableSessionId(sessionId), pending, event);
+    async commitKernelAction(runtime, pending, event, _sessionId) {
+        return canonicalKernelAction(runtime, pending, event);
+    }
+    async startKernelAgent(runtime, pending, task, runSpec) {
+        return canonicalStartAgent(runtime, pending, task, runSpec);
+    }
+    payloadStore() {
+        if (this.opts.payloadStore)
+            return this.opts.payloadStore;
+        this.fallbackPayloadStore ??= new PayloadStore();
+        return this.fallbackPayloadStore;
     }
     async persistMemoryToStore(memory, agentId) {
         if (!this.opts.dreamStore)
@@ -169,31 +225,14 @@ export class RuntimeRunner {
             .slice(0, requestedK);
     }
     /**
-     * T5: run one memory query through the kernel's `query_memory → memory_query_result`
-     * effect lifecycle on the given runtime. The kernel injects each routed hit into history
-     * itself and derives the recall lifecycle (`memory_recalled`, edge-triggered
-     * `promotion_suggested`) from the routed hits — the store stays a pure query.
-     *
-     * `seenRecordIds` is one dedupe horizon: a record hit by several queries of the same
-     * prefetch is routed (recalled, injected) once. The kernel derives counts statelessly from
-     * each hit's payload, so host-side pre-filtering is the only place duplicates can be stopped.
-     *
-     * The recall lifecycle is consumed immediately rather than via the per-turn drain: the store
-     * must be up to date before any same-turn re-query, and a renewal prefetch fires inside the
-     * drain loop where queued observations would not be consumed until the next boundary.
-     * Non-memory observations are forwarded to `leftovers` (the run's pending queue) when given,
-     * and discarded for detached syscall runtimes (their kernel is throwaway).
+     * Route a host-originated renewal prefetch into canonical knowledge commands. This is not an
+     * agent syscall: the host selects records from its store, then the kernel owns the only mutation
+     * of live semantic context. `seenRecordIds` is the prefetch's dedupe horizon.
      */
-    async queryMemoryThroughKernel(runtime, query, agentId, sessionId, seenRecordIds, leftovers) {
-        const observations = [];
-        const action = await this.commitKernelAction(runtime, observations, { kind: "query_memory", query }, sessionId);
-        if (action.kind !== "query_memory") {
-            throw new Error(`query_memory returned unexpected kernel effect: ${action.kind}`);
-        }
+    async prefetchMemoryIntoKnowledge(runtime, query, agentId, sessionId, seenRecordIds, leftovers) {
         let hits = [];
-        let ioError;
         try {
-            hits = await this.retrieveMemoryFromStore(query, action.requestedK, agentId);
+            hits = await this.retrieveMemoryFromStore(query, query.top_k, agentId);
             if (seenRecordIds) {
                 hits = hits.filter(hit => {
                     const id = hit.record.record_id;
@@ -203,77 +242,94 @@ export class RuntimeRunner {
                     return true;
                 });
             }
-        }
-        catch (cause) {
-            ioError = cause;
-        }
-        // Close the kernel effect even when the store failed — never leave a dangling query.
-        // The result commit resumes the kernel's reasoning path (`resume_after_preload`), which
-        // re-emits the next loop action with the routed hits now in history — callers on a live
-        // run kernel must adopt it (a query is a preload, not a detached side-channel).
-        const resumed = await this.commitKernelMaybeAction(runtime, observations, {
-            kind: "memory_query_result",
-            effect_id: action.effectId,
-            hits,
-            ...(ioError ? { error: formatToolError(ioError) } : {}),
-        }, sessionId);
-        await this.consumeMemoryLifecycleObservations(sessionId, observations);
-        if (leftovers) {
-            for (const obs of observations) {
-                if (!isMemoryLifecycleObservation(obs))
-                    leftovers.push(obs);
+            for (const hit of hits) {
+                await this.commitKernelApply(runtime, leftovers ?? [], {
+                    kind: "add_knowledge_message",
+                    key: `memory:${hit.record.record_id}`,
+                    content: hit.record.content,
+                    tokens: Math.max(1, Math.ceil(hit.record.content.length / 4)),
+                }, sessionId);
             }
+            await this.applyHostMemoryRecallLifecycle(hits, agentId);
+            await this.logMemoryRetrievalResult(sessionId, hits);
         }
-        if (ioError)
-            throw ioError;
-        return { hits, action: resumed };
+        catch {
+            return { hits: [], action: runtime.resumeAction() };
+        }
+        return { hits, action: runtime.resumeAction() };
     }
     async writeMemory(memory, opts = {}) {
         const sessionId = opts.sessionId ?? this.currentSessionId;
         const agentId = opts.agentId ?? this.opts.agentId;
         if (!this.opts.dreamStore || !agentId)
             return;
-        const durableSessionId = this.durableSessionId(sessionId);
-        const observations = [];
-        const runtime = this.createSyscallRuntime();
-        const action = await this.commitKernelMaybeAction(runtime, observations, { kind: "write_memory", memory }, durableSessionId);
-        if (!action) {
-            await this.consumeMemoryLifecycleObservations(sessionId, observations);
-            return;
-        }
-        if (action.kind !== "persist_memory") {
-            throw new Error(`write_memory returned unexpected kernel effect: ${action.kind}`);
+        const policy = this.opts.memoryPolicy;
+        if (policy?.validationEnabled !== false) {
+            const error = !memory.name.trim()
+                ? "memory name must not be empty"
+                : memory.name.length > (policy?.maxNameLength ?? 100)
+                    ? `memory name exceeds ${policy?.maxNameLength ?? 100} characters`
+                    : Buffer.byteLength(memory.content, "utf8") > (policy?.maxContentBytes ?? 10_000)
+                        ? `memory content exceeds ${policy?.maxContentBytes ?? 10_000} bytes`
+                        : undefined;
+            if (error) {
+                if (sessionId) {
+                    await this.opts.sessionLog.append(sessionId, {
+                        kind: "memory_validation_failed",
+                        turn: this.activeKernel?.turn() ?? 0,
+                        record_id: memory.record_id,
+                        error,
+                    });
+                }
+                return;
+            }
         }
-        let ioError;
-        try {
-            await this.persistMemoryToStore(action.memory, agentId);
+        await this.persistMemoryToStore(memory, agentId);
+        if (sessionId) {
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "memory_written",
+                turn: this.activeKernel?.turn() ?? 0,
+                record_id: memory.record_id,
+                scope: memory.scope,
+                memory_kind: memory.kind,
+                name: memory.name,
+                size_bytes: Buffer.byteLength(memory.content, "utf8"),
+            });
         }
-        catch (cause) {
-            ioError = cause;
-        }
-        await this.commitKernelApply(runtime, observations, {
-            kind: "memory_persist_result",
-            effect_id: action.effectId,
-            ...(ioError ? { error: formatToolError(ioError) } : {}),
-        }, durableSessionId);
-        await this.consumeMemoryLifecycleObservations(durableSessionId, observations);
-        if (ioError)
-            throw ioError;
     }
     async queryMemory(query, opts = {}) {
         const sessionId = opts.sessionId ?? this.currentSessionId;
         const agentId = opts.agentId ?? this.opts.agentId;
         if (!this.opts.dreamStore || !agentId)
             return [];
-        const durableSessionId = this.durableSessionId(sessionId);
-        // Detached syscall runtime: the kernel's history injection and resumed action are inert
-        // (the kernel is throwaway), but the recall lifecycle is identical to an in-run query
-        // (T5 parity).
-        const runtime = this.createSyscallRuntime();
-        const { hits } = await this.queryMemoryThroughKernel(runtime, query, agentId, durableSessionId);
-        await this.logMemoryRetrievalResult(durableSessionId, hits);
+        const hits = await this.retrieveMemoryFromStore(query, query.top_k, agentId);
+        await this.applyHostMemoryRecallLifecycle(hits, agentId);
+        await this.logMemoryRetrievalResult(sessionId, hits);
         return hits;
     }
+    async applyHostMemoryRecallLifecycle(hits, agentId) {
+        if (hits.length === 0)
+            return;
+        const recalls = hits.map(hit => ({
+            record_id: hit.record.record_id,
+            recall_count: hit.record.recall_count + 1,
+            last_recalled_at: Date.now(),
+        }));
+        await this.opts.dreamStore?.recordRecall?.(agentId, recalls);
+        const threshold = this.opts.memoryPolicy?.promotionRecallThreshold;
+        if (threshold === undefined)
+            return;
+        for (let index = 0; index < hits.length; index += 1) {
+            const before = hits[index].record.recall_count;
+            const after = recalls[index].recall_count;
+            if (before < threshold && after >= threshold) {
+                this.opts.onPromotionSuggested?.({
+                    recordId: recalls[index].record_id,
+                    recallCount: after,
+                });
+            }
+        }
+    }
     async logMemoryRetrievalResult(sessionId, hits) {
         if (!sessionId)
             return;
@@ -284,16 +340,35 @@ export class RuntimeRunner {
             hits,
         });
     }
-    createSyscallRuntime() {
-        const { KernelRuntime } = getKernel();
-        return new KernelRuntime({
-            maxTokens: this.opts.maxTokens,
+    createCanonicalRuntime(runId = crypto.randomUUID(), sessionId = this.durableSessionId()) {
+        const { CanonicalKernel } = getKernel();
+        return new CanonicalRunnerRuntime(new CanonicalKernel(), this.resolveKernelJournal(), `node-operation-${runId}`, {
+            maxContextTokens: this.opts.maxTokens,
             maxTurns: this.opts.maxTurns,
-            // M4/G5: per-node token cap → child run's cumulative token budget.
-            maxTotalTokens: this.opts.maxTotalTokens !== undefined ? BigInt(this.opts.maxTotalTokens) : undefined,
-            timeoutMs: this.opts.timeoutMs !== undefined ? BigInt(this.opts.timeoutMs) : undefined,
+            maxTotalTokens: this.opts.maxTotalTokens,
+            maxWallMs: this.opts.timeoutMs,
+            memoryBindingId: `node-memory-${this.opts.agentId ?? "root"}`,
+            persistPayload: async (callId, content, previewBytes) => {
+                const digest = `sha256:${createHash("sha256").update(content).digest("hex")}`;
+                const payloadRef = `payload:${digest.slice("sha256:".length, "sha256:".length + 32)}`;
+                await this.payloadStore().persistPayload(sessionId, payloadRef, content);
+                return {
+                    payloadRef,
+                    digest,
+                    originalSize: String(Buffer.byteLength(content, "utf8")),
+                    preview: utf8Prefix(content, previewBytes),
+                };
+            },
         });
     }
+    resolveKernelJournal() {
+        const embedded = this.opts.sessionLog.kernelJournal;
+        const journal = this.opts.kernelJournal ?? embedded;
+        if (!journal) {
+            throw new Error("RuntimeOptions.kernelJournal is required when SessionLog has no canonical journal");
+        }
+        return journal;
+    }
     groupBudgetRequest(includeTokens = true) {
         const tokens = includeTokens ? this.opts.maxTotalTokens : undefined;
         const subagents = this.opts.resourceQuota?.maxTotalSubagents;
@@ -313,7 +388,10 @@ export class RuntimeRunner {
         };
     }
     async settleGroupBudget(scope, actual) {
-        const retries = this.opts.kernelReliability?.hostEffectRetryAttempts ?? 3;
+        const retries = this.opts.groupBudgetSettlementRetries ?? 3;
+        if (!Number.isInteger(retries) || retries < 0 || retries > 16) {
+            throw new RangeError("groupBudgetSettlementRetries must be an integer in 0..16");
+        }
         for (let attempt = 0;; attempt += 1) {
             try {
                 await scope.settle(actual);
@@ -327,9 +405,9 @@ export class RuntimeRunner {
     }
     /**
      * Lower the declarative governance / attention / scheduler-budget / resource-quota policies into a
-     * freshly-created kernel. Shared by `execute()` (full agent run) and `bootstrapWorkflowKernel()`
+     * freshly-created kernel. Shared by `execute()` (full agent run) and `initializeWorkflowKernel()`
      * (standalone host-driven workflow) so a workflow's DAG-node spawns are gated, queued, and quota'd
-     * exactly as a mid-run spawn would be. Must run BEFORE `start_run` so the in-kernel gate enforces
+     * exactly as a mid-run spawn would be. Must run before the canonical root start so the gate enforces
      * every policy from the first spawn. No config ⇒ the native-profile defaults (铁律: defaults only).
      */
     async applyKernelPolicies(runtime, groupBudgetScope) {
@@ -348,39 +426,7 @@ export class RuntimeRunner {
             config.context_policy = normalizeContextPolicyV1(contextPolicyV1(this.opts.contextPolicy));
         }
         if (this.opts.kernelReliability) {
-            const reliability = this.opts.kernelReliability;
-            config.reliability = {
-                ...(reliability.eventReplayCapacity !== undefined
-                    ? { event_replay_capacity: reliability.eventReplayCapacity }
-                    : {}),
-                ...(reliability.completedEffectReplayCapacity !== undefined
-                    ? { completed_effect_replay_capacity: reliability.completedEffectReplayCapacity }
-                    : {}),
-                ...(reliability.providerRecoveryAttempts !== undefined
-                    ? { provider_recovery_attempts: reliability.providerRecoveryAttempts }
-                    : {}),
-                ...(reliability.outputRecoveryAttempts !== undefined
-                    ? { output_recovery_attempts: reliability.outputRecoveryAttempts }
-                    : {}),
-                ...(reliability.hostEffectRetryAttempts !== undefined
-                    ? { host_effect_retry_attempts: reliability.hostEffectRetryAttempts }
-                    : {}),
-                ...(reliability.spoolThresholdBytes !== undefined
-                    ? { spool_threshold_bytes: reliability.spoolThresholdBytes }
-                    : {}),
-                ...(reliability.spoolPreviewBytes !== undefined
-                    ? { spool_preview_bytes: reliability.spoolPreviewBytes }
-                    : {}),
-                ...(reliability.snapshotInputLimit !== undefined
-                    ? { snapshot_input_limit: reliability.snapshotInputLimit }
-                    : {}),
-                ...(reliability.maxInputBytes !== undefined
-                    ? { max_input_bytes: reliability.maxInputBytes }
-                    : {}),
-                ...(reliability.snapshotJournalBytesLimit !== undefined
-                    ? { snapshot_journal_bytes_limit: reliability.snapshotJournalBytesLimit }
-                    : {}),
-            };
+            config.reliability = kernelReliabilityToKernel(this.opts.kernelReliability);
         }
         config.signal_policy = {
             version: 1,
@@ -438,6 +484,11 @@ export class RuntimeRunner {
         if (this.opts.criteriaGate !== undefined) {
             config.criteria_gate = this.opts.criteriaGate;
         }
+        // P1: fail-closed dispatch selector (absent ⇒ kernel default "exposed"). "registered" is the
+        // escape hatch back to permissive dispatch; the kernel rejects any other value.
+        if (this.opts.toolDispatchGate !== undefined) {
+            config.tool_dispatch_gate = this.opts.toolDispatchGate;
+        }
         // K2: knowledge budget ratio (absent ⇒ kernel default 0.25; 0 disables).
         if (this.opts.knowledgeBudgetRatio !== undefined) {
             config.knowledge_budget_ratio = this.opts.knowledgeBudgetRatio;
@@ -457,9 +508,7 @@ export class RuntimeRunner {
         await this.commitKernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
     }
     /**
-     * Mirror one kernel memory-lifecycle observation into the durable store / host callbacks.
-     * Shared by the main run drain, the prefetch path, and the host memory syscalls so every
-     * query route has identical recall + promotion semantics (T5).
+     * Mirror one agent-syscall memory-lifecycle observation into the durable store / host callbacks.
      *
      * M3: `memory_recalled` carries the kernel-derived count — the runner never computes
      * `recall_count + 1` itself. M4: `promotion_suggested` is advisory and already
@@ -479,19 +528,6 @@ export class RuntimeRunner {
             });
         }
     }
-    async consumeMemoryLifecycleObservations(sessionId, observations) {
-        const turn = this.activeKernel?.turn() ?? 0;
-        for (const obs of observations) {
-            if (!isMemoryLifecycleObservation(obs))
-                continue;
-            await this.mirrorMemoryLifecycle(obs);
-            if (!sessionId)
-                continue;
-            const event = kernelObservationToSessionEvent(obs, turn);
-            if (event)
-                await this.opts.sessionLog.append(sessionId, event);
-        }
-    }
     /** Mount a tool capability on the currently-running kernel runtime. No-op if not running. */
     async mountTool(schema) {
         if (!this.activeKernel)
@@ -549,48 +585,6 @@ export class RuntimeRunner {
         // Re-arm the SDK-side push guard so a re-activation re-pins the content.
         this.knowledgePushedSkills.delete(name);
     }
-    /**
-     * Spawn an isolated sub-agent via the kernel, run it on the host, and feed the result back.
-     * Requires an active parent run (`run()` / `wake()` in progress or paused at milestone).
-     */
-    async *spawnSubAgent(spec) {
-        if (!this.activeKernel || !this.currentSessionId) {
-            throw new Error("spawnSubAgent requires an active parent run");
-        }
-        const parentSessionId = this.currentSessionId;
-        const runtime = this.activeKernel;
-        const observations = await this.commitKernelApply(runtime, this.pendingObservations, {
-            kind: "spawn_sub_agent",
-            spec: agentRunSpecToKernel(spec),
-            parent_session_id: parentSessionId,
-        });
-        this.nextArchiveStart = await this.appendObservations(parentSessionId, runtime, this.nextArchiveStart);
-        const spawned = findSpawnProcessObservation(observations);
-        if (!spawned) {
-            const rejected = controlRequestRejection(observations, "spawn_sub_agent");
-            if (rejected) {
-                yield { type: "error", message: `spawn_sub_agent denied: ${rejected.reason}` };
-                return;
-            }
-            throw new Error("spawn_sub_agent did not emit agent_process_changed");
-        }
-        const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
-        const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
-        const result = await orchestrator.run({
-            parentOpts: this.opts,
-            parentSessionId,
-            spec,
-            manifest,
-            sessionLog: this.opts.sessionLog,
-            toolAccess: spec.toolAccess,
-            ...(this.opts.subAgentHarness ? { harness: this.opts.subAgentHarness } : {}),
-        });
-        await this.commitKernelApply(runtime, this.pendingObservations, {
-            kind: "sub_agent_completed",
-            result: subAgentResultToKernel(result),
-        });
-        yield { type: "done", iterations: result.result.turnsUsed, totalTokens: result.result.totalTokensUsed, status: result.result.termination };
-    }
     /**
      * G3: run one workflow node, enforcing its `output_schema` (if any). Without a schema this is a
      * plain `orchestrator.run`. With one, the node's agent is instructed to emit conforming JSON, its
@@ -620,8 +614,8 @@ export class RuntimeRunner {
             spec: { ...baseSpec, goal: withBudget(goal) },
             manifest,
             sessionLog: this.opts.sessionLog,
-            // M5 v2.1: this child IS a workflow node — its `start_workflow` flattens to this kernel (the
-            // workflow it would author joins the running DAG) rather than bootstrapping a nested pivot.
+            // This child is a workflow node, so capability resolution applies workflow-node quarantine
+            // semantics instead of treating it as an independently spawned agent.
             isWorkflowNode: true,
             // W-N1: trusted workflow nodes run on the parent's execution plane (they carry no grant list
             // by design — filtering on the missing list ran every DAG node TOOL-LESS); quarantined nodes
@@ -731,7 +725,7 @@ export class RuntimeRunner {
      */
     async runWorkflow(spec, opts) {
         // Standalone entry: with no active parent run (e.g. a stateless HTTP handler), auto-bootstrap a
-        // kernel that owns the DAG — start_run + the same governance/quota/attention policies a full run
+        // kernel that owns the DAG — canonical configure + root start with the same policies a full run
         // gets — then tear it down on completion so the runner is reusable. Mid-run callers (activeKernel
         // already set by an in-flight `run()`) keep the original in-place behavior with no teardown.
         const bootstrapped = !this.activeKernel || !this.currentSessionId;
@@ -739,6 +733,7 @@ export class RuntimeRunner {
         try {
             if (bootstrapped) {
                 const sessionId = opts?.sessionId ?? `wf-${crypto.randomUUID()}`;
+                const runId = crypto.randomUUID();
                 // A standalone workflow reserves a bounded slice before its kernel schedules any node.
                 // Mid-run callers reuse their parent run's already-active reservation.
                 if (this.opts.runGroup) {
@@ -749,46 +744,56 @@ export class RuntimeRunner {
                 // Resume depends on this fact. Do not dispatch any node until it is durable.
                 await this.opts.sessionLog.append(sessionId, {
                     kind: "run_started",
-                    run_id: crypto.randomUUID(),
+                    run_id: runId,
                     goal: `workflow:${spec.nodes.length} nodes`,
                     criteria: [],
                     agent_id: this.opts.agentId,
                 });
-                await this.bootstrapWorkflowKernel(sessionId, groupBudgetScope);
+                await this.initializeWorkflowKernel(sessionId, runId, groupBudgetScope);
             }
             const parentSessionId = this.currentSessionId;
             const runtime = this.activeKernel;
             const observationStart = this.pendingObservations.length;
-            const initialAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
-                kind: "load_workflow",
-                spec: workflowSpecToKernel(spec),
-                parent_session_id: parentSessionId,
-                // Exact typed terminal outcomes plus control-flow signals recovered from the journal.
-                ...(opts?.resumedOutcomes?.length
-                    ? {
-                        resumed_outcomes: opts.resumedOutcomes.map(r => ({
-                            agent_id: r.agentId,
-                            status: r.status,
-                            termination: r.termination,
-                            ...(r.output ? { output: messageToKernelMessage(r.output) } : {}),
-                            ...(r.classifyBranch !== undefined ? { classify_branch: r.classifyBranch } : {}),
-                            ...(r.tournamentWinner !== undefined ? { tournament_winner: r.tournamentWinner } : {}),
-                            ...(r.loopContinue !== undefined ? { loop_continue: r.loopContinue } : {}),
-                        })),
-                    }
-                    : {}),
-                // R3-1: re-apply recorded runtime submissions so dynamically-appended nodes are reconstructed.
-                ...(opts?.resumedSubmissions?.length ? { resumed_submissions: opts.resumedSubmissions } : {}),
-                ...(opts?.resumedSubmissionBases?.length ? { resumed_submission_bases: opts.resumedSubmissionBases } : {}),
-            });
+            let initialAction;
+            try {
+                initialAction = await canonicalStartWorkflow(runtime, this.pendingObservations, workflowSpecToKernel(spec));
+            }
+            catch (error) {
+                if (!(error instanceof CanonicalKernelRejectedError))
+                    throw error;
+                return {
+                    nodeOutcomes: [],
+                    outputs: {},
+                    rejection: {
+                        operation: "start_workflow",
+                        reason: String(error.fault.message ?? error.message),
+                    },
+                };
+            }
             const observations = this.pendingObservations.slice(observationStart);
-            const outcome = await this.driveWorkflow(initialAction, observations, parentSessionId, runtime, recoveredOutputs(opts?.resumedOutcomes));
+            const outcome = await this.driveWorkflow(initialAction, observations, parentSessionId, runtime, new Map());
             if (bootstrapped) {
-                const terminal = await this.commitKernelAction(runtime, this.pendingObservations, { kind: "complete_run" });
+                let terminal = runtime.resumeAction();
+                if (!terminal)
+                    throw new Error("completed canonical workflow has no terminal action");
+                if (terminal.kind !== "done" && this.interrupted) {
+                    terminal = await this.commitKernelAction(runtime, this.pendingObservations, {
+                        kind: "cancel_operation",
+                        effect_id: terminal.effectId,
+                        reason: this.cancellationReason ?? "user",
+                    });
+                }
                 if (terminal.kind !== "done") {
-                    throw new Error("complete_run did not produce a terminal kernel action");
+                    throw new Error("canonical workflow did not produce a terminal kernel action");
                 }
                 await this.appendObservations(parentSessionId, runtime, 0);
+                if (groupBudgetScope && !groupBudgetScope.isClosed) {
+                    await this.settleGroupBudget(groupBudgetScope, {
+                        tokens: terminal.result.totalTokensUsed,
+                        subagents: runtime.localSubagentsSpawned(),
+                    });
+                    this.activeGroupBudgetScope = undefined;
+                }
             }
             return outcome;
         }
@@ -811,81 +816,22 @@ export class RuntimeRunner {
     /**
      * Bootstrap a standalone kernel for a host-driven workflow with NO active parent run — the path a
      * stateless request handler takes when it calls `runWorkflow(spec)` directly. Mirrors `execute()`'s
-     * pre-run kernel setup (governance / attention / quota via `applyKernelPolicies`, then `start_run`)
+     * pre-run kernel setup (governance / attention / quota via `applyKernelPolicies`, then root start)
      * after `runWorkflow` has durably recorded `run_started`. Sets `activeKernel` / `currentSessionId`;
      * `runWorkflow` is responsible for tearing them down.
      */
-    async bootstrapWorkflowKernel(sessionId, groupBudgetScope) {
+    async initializeWorkflowKernel(sessionId, runId, groupBudgetScope) {
         this.interrupted = false;
         this.abortController = new AbortController();
         this.pendingObservations = [];
         this.pendingPageOutArchives = [];
         this.activePageOutArchive = undefined;
         this.currentSessionId = sessionId;
-        const runtime = this.createSyscallRuntime();
+        const runtime = this.createCanonicalRuntime(runId, sessionId);
         this.activeKernel = runtime;
         await this.applyKernelPolicies(runtime, groupBudgetScope);
-        // ABI v2 has one lifecycle: standalone workflows start a real run before loading their DAG.
-        // The initial provider effect is superseded by the workflow load; no self-bootstrap escape hatch.
-        await this.commitKernelAction(runtime, this.pendingObservations, {
-            kind: "start_run",
-            task: { goal: `workflow session ${sessionId}`, criteria: [] },
-        });
         return runtime;
     }
-    /**
-     * M5/G1: bootstrap an **agent-authored** workflow ("the model writes its own harness"). Unlike
-     * `runWorkflow` (the host fires the privileged `load_workflow`), this routes the spec through the
-     * agent-reachable `Syscall::LoadWorkflow` (the `submit_workflow` event): with no workflow active the
-     * kernel **bootstraps** the DAG; if one is already active it **flattens** the spec's nodes onto it
-     * (bootstrap-or-flatten — one kernel, one quota, never a workflow stack). Gated by the same
-     * `max_workflow_nodes` backstop as runtime submission, so an authored harness can't overgrow the run.
-     * The resulting batches are driven by the same shared driver as `runWorkflow`.
-     */
-    async bootstrapWorkflow(spec, opts) {
-        if (!this.activeKernel || !this.currentSessionId) {
-            throw new Error("bootstrapWorkflow requires an active parent run");
-        }
-        const parentSessionId = this.currentSessionId;
-        const runtime = this.activeKernel;
-        const observationStart = this.pendingObservations.length;
-        const initialAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, submitWorkflowToKernel(spec, parentSessionId, opts?.submitterAgentId));
-        const observations = this.pendingObservations.slice(observationStart);
-        // W-3: persist the agent-authored batch (bootstrap base 0 / flatten base N — the kernel now
-        // announces BOTH) so an interrupted authored workflow reconstructs on resume; the host never
-        // had this spec, unlike the `runWorkflow` path.
-        const submitted = observations.find(o => o.kind === "workflow_nodes_submitted");
-        if (submitted) {
-            await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
-                turn: runtime.turn(),
-                nodes: workflowSpecToKernel(spec).nodes ?? [],
-                baseIndex: submitted.base,
-                submitterAgentId: opts?.submitterAgentId,
-            }));
-        }
-        return this.driveWorkflow(initialAction, observations, parentSessionId, runtime);
-    }
-    /**
-     * M5 v2.1: drive the sub-workflow(s) a top-level agent authored via `start_workflow`. Called at the
-     * verified-safe point (right after the tool turn resolved to `call_provider` — kernel in Reason, not
-     * suspended). For each authored spec: `bootstrapWorkflow` runs it in THIS kernel (the kernel resumes
-     * the agent reason loop on `workflow_completed` — `finish_workflow` sets phase=Reason), then the
-     * outcome is injected as a user message so the agent's next turn sees the result. Returns a fresh
-     * `call_provider` synthesized from the updated context (the workflow drive consumed its own kernel
-     * actions, so we re-render — the same pattern as the reactive-compact retry path).
-     */
-    async driveAuthoredWorkflows(runtime, action) {
-        const specs = this.pendingAuthoredWorkflows;
-        this.pendingAuthoredWorkflows = [];
-        this.workflowContinuation = null;
-        for (const spec of specs) {
-            await this.bootstrapWorkflow(spec);
-        }
-        const continuation = this.workflowContinuation;
-        if (!continuation)
-            throw new Error("authored workflow completed without a provider continuation");
-        return continuation;
-    }
     /**
      * #2-B-ii: while a workflow batch is in flight, poll the signal source. A Critical `InterruptNow`
      * routes through the kernel (which, with the root suspended in `SubAgentAwait`, preempts — marks the
@@ -896,9 +842,48 @@ export class RuntimeRunner {
      */
     async monitorWorkflowPreemption(runtime, controllers, batchState) {
         const source = this.opts.signalSource;
-        if (!source)
-            return null;
         while (!batchState.settled) {
+            if (this.interrupted) {
+                const observationStart = this.pendingObservations.length;
+                let cancellation = await this.commitKernelAction(runtime, this.pendingObservations, {
+                    kind: "cancel_operation",
+                    reason: this.cancellationReason ?? "user",
+                });
+                let preemptedAgentIds = [...controllers.keys()];
+                if (cancellation.kind === "preempt_sub_agents") {
+                    preemptedAgentIds = cancellation.agentIds;
+                    for (const id of cancellation.agentIds) {
+                        controllers.get(id)?.abort(this.cancellationReason ?? "user");
+                    }
+                    cancellation = await this.commitKernelAction(runtime, this.pendingObservations, {
+                        kind: "preempt_result",
+                        effect_id: cancellation.effectId,
+                    });
+                }
+                else {
+                    for (const controller of controllers.values()) {
+                        controller.abort(this.cancellationReason ?? "user");
+                    }
+                }
+                if (cancellation.kind !== "done") {
+                    throw new Error(`workflow cancellation returned unexpected effect: ${cancellation.kind}`);
+                }
+                const observations = this.pendingObservations.slice(observationStart);
+                const completed = observations.find(o => o.kind === "workflow_completed");
+                if (completed) {
+                    return (completed.node_outcomes ?? []).map(workflowNodeOutcomeFromKernel);
+                }
+                const preempted = observations.find(o => o.kind === "agent_preempted");
+                return (preempted?.agent_ids ?? preemptedAgentIds).map(nodeId => ({
+                    nodeId,
+                    status: "failed",
+                    termination: "user_abort",
+                }));
+            }
+            if (!source) {
+                await new Promise(resolve => setTimeout(resolve, 5));
+                continue;
+            }
             // O2: injected notes participate in the monitor too, so a host `injectNote` mid-batch is not
             // stranded until the batch settles (the drain order matches `nextInboundSignal`).
             const delivery = await this.nextInboundSignal();
@@ -931,6 +916,8 @@ export class RuntimeRunner {
             }
             const preempted = observations.find(o => o.kind === "agent_preempted");
             if (preempted) {
+                this.interrupted = true;
+                this.cancellationReason ??= "user";
                 for (const id of preempted.agent_ids ?? [])
                     controllers.get(id)?.abort();
                 const wc = observations.find(o => o.kind === "workflow_completed");
@@ -940,10 +927,8 @@ export class RuntimeRunner {
         return null;
     }
     /**
-     * Shared workflow driver for `runWorkflow` (host `load_workflow`) and `bootstrapWorkflow` (agent
-     * `submit_workflow`): given the observations from the initial load/bootstrap, run each kernel-emitted
-     * batch in parallel, feed completions back (appending any agent-submitted nodes first), and loop
-     * until the kernel reports the workflow complete. Returns typed terminal node outcomes.
+     * Drive a canonical root or provider-authored workflow from kernel effects only: run each
+     * emitted batch, resolve its launch/completion/preemption effects, and stop at the kernel terminal.
      */
     async driveWorkflow(initialAction, initial, parentSessionId, runtime, seedOutputs) {
         let observations = initial;
@@ -988,9 +973,16 @@ export class RuntimeRunner {
         // W-1: on resume it is pre-seeded from the persisted node outputs, so post-resume dependents
         // still see their (pre-crash) dependencies' outputs.
         const outputs = new Map(seedOutputs ?? []);
+        const completedNodeOutcomes = [];
         for (;;) {
             if (nodes.length === 0)
                 return { nodeOutcomes: [], outputs: Object.fromEntries(outputs) }; // nothing to run (e.g. all gated)
+            for (const node of nodes) {
+                for (const [agentId, output] of Object.entries(node.dependency_outputs ?? {})) {
+                    if (!outputs.has(agentId))
+                        outputs.set(agentId, output);
+                }
+            }
             // Run the currently-runnable nodes in parallel — each is independent within a round.
             const roundBudget = budget;
             // #2-B-ii: per-node abort controllers + a concurrent preemption monitor. While the batch is in
@@ -1003,8 +995,9 @@ export class RuntimeRunner {
             const results = await Promise.all(nodes.map(node => this.runWorkflowNode(node, parentSessionId, orchestrator, roundBudget, outputs, controllers.get(node.agent_id)?.signal)));
             batchState.settled = true;
             const preempted = await monitor;
-            if (preempted)
+            if (preempted !== null) {
                 return { nodeOutcomes: preempted, outputs: Object.fromEntries(outputs) };
+            }
             // Feed completions back one at a time. The kernel's run-queue executor may spawn a node's
             // dependents the moment *that* node completes (per-node unblock), so each feed can emit its
             // own `workflow_batch_spawned`; ACCUMULATE them across the round rather than keeping only the
@@ -1018,61 +1011,17 @@ export class RuntimeRunner {
                 const outContent = result.result.finalMessage?.content;
                 const outText = typeof outContent === "string" ? outContent : outContent != null ? JSON.stringify(outContent) : "";
                 outputs.set(result.agentId, outText);
+                completedNodeOutcomes.push({
+                    nodeId: result.agentId,
+                    status: workflowNodeStatusFromTermination(result.result.termination),
+                    termination: result.result.termination,
+                    ...(result.result.finalMessage ? { output: result.result.finalMessage } : {}),
+                });
                 // A loop iteration completes under `wf-node{N}-i{k}` but its dependents consume the STABLE
                 // node id `wf-node{N}` — alias it so the LAST iteration's output is what dependents see.
                 const stableId = result.agentId.replace(/-i\d+$/, "");
                 if (stableId !== result.agentId)
                     outputs.set(stableId, outText);
-                // R3-1: if this node's agent submitted more nodes, append them to the parent DAG BEFORE
-                // reporting the node's completion — the workflow is still active (the kernel hasn't seen this
-                // node finish), so even a submission from the last running node keeps the DAG alive. The
-                // appended nodes' `workflow_batch_spawned` is collected into this round like any other.
-                if (result.submittedNodes?.length) {
-                    // G1: stamp the submitting node's agent id so the kernel can coerce a quarantined
-                    // submitter's nodes to quarantined (no topological privilege escalation).
-                    const submitEvent = submitWorkflowNodesToKernel(result.submittedNodes, result.agentId);
-                    const observationStart = this.pendingObservations.length;
-                    const submitAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, submitEvent);
-                    const subObs = this.pendingObservations.slice(observationStart);
-                    const rejected = controlRequestRejection(subObs, "submit_workflow_nodes")
-                        ?? (subObs.find(o => o.kind === "nodes_rejected")
-                            ? { operation: "submit_workflow_nodes", reason: String(subObs.find(o => o.kind === "nodes_rejected")?.reason ?? "request denied") }
-                            : undefined);
-                    if (rejected) {
-                        const denial = `workflow node submission denied: ${rejected.reason}`;
-                        result.result = {
-                            ...result.result,
-                            termination: "error",
-                            finalMessage: { role: "assistant", content: denial, toolCalls: [] },
-                        };
-                        outputs.set(result.agentId, denial);
-                        if (stableId !== result.agentId)
-                            outputs.set(stableId, denial);
-                    }
-                    if (submitAction?.kind === "spawn_workflow") {
-                        nextNodes.push(...submitAction.nodes);
-                        budget = submitAction.budget ?? budget;
-                        const accepted = await acceptSpawn(submitAction);
-                        const submittedDone = findDone([...subObs, ...accepted]);
-                        if (submittedDone)
-                            done = submittedDone;
-                    }
-                    else if (submitAction) {
-                        throw new Error(`workflow node submission returned unexpected effect: ${submitAction.kind}`);
-                    }
-                    // R3-1: persist the submission (kernel-shape nodes) + its kernel-reported base index
-                    // so resume can re-apply the batch at the exact original graph position. W-N3: also the
-                    // submitter, so resume drops batches whose submitter re-runs (it will re-submit).
-                    const submitted = subObs.find(o => o.kind === "workflow_nodes_submitted");
-                    if (submitted) {
-                        await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
-                            turn: runtime.turn(),
-                            nodes: submitEvent.nodes ?? [],
-                            baseIndex: submitted.base,
-                            submitterAgentId: result.agentId,
-                        }));
-                    }
-                }
                 const observationStart = this.pendingObservations.length;
                 const completionAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
                     kind: "sub_agent_completed",
@@ -1087,9 +1036,28 @@ export class RuntimeRunner {
                 else if (completionAction?.kind === "call_provider") {
                     this.workflowContinuation = completionAction;
                 }
+                else if (completionAction?.kind === "done") {
+                    return {
+                        nodeOutcomes: completedNodeOutcomes,
+                        outputs: Object.fromEntries(outputs),
+                    };
+                }
                 else if (completionAction) {
                     throw new Error(`workflow completion returned unexpected effect: ${completionAction.kind}`);
                 }
+                // ABI v3: child-authored DAG additions ride on ChildCompleted.parent_requests. Admission is
+                // independent of the completion fact; only an admitted request emits this observation.
+                if (result.submittedNodes?.length) {
+                    const submitted = obs.find(o => o.kind === "workflow_nodes_submitted");
+                    if (submitted) {
+                        await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
+                            turn: runtime.turn(),
+                            nodes: result.submittedNodes.map(workflowNodeSpecToKernel),
+                            baseIndex: submitted.base,
+                            submitterAgentId: result.agentId,
+                        }));
+                    }
+                }
                 const d = findDone(obs);
                 if (d)
                     done = d;
@@ -1116,39 +1084,6 @@ export class RuntimeRunner {
             nodes = nextNodes;
         }
     }
-    /**
-     * Resume a workflow from the parent session's completed nodes.
-     * Reads the session log, extracts completed workflow node records (with their W-1 control
-     * signals + outputs), and calls runWorkflow so the kernel skips those nodes, replays control
-     * flow (classify prune / loop stop), and the driver re-seeds its outputs map.
-     */
-    async resumeWorkflow(spec, opts) {
-        // Standalone resume: a stateless handler passes the prior `sessionId` to pick up an interrupted
-        // workflow from the session log. Mid-run callers omit it and resume the active session.
-        const sessionId = opts?.sessionId ?? this.currentSessionId;
-        if (!sessionId) {
-            throw new Error("resumeWorkflow requires an active parent run or an explicit sessionId");
-        }
-        const events = await this.opts.sessionLog.read(sessionId);
-        const resumedOutcomes = recoverWorkflowNodeOutcomes(events);
-        const completedIds = new Set(resumedOutcomes.map(r => r.agentId));
-        const recovered = recoverSubmittedWorkflowNodes(events);
-        // W-N3: DROP batches whose submitter did NOT complete — that node re-runs on resume and will
-        // re-submit its batch; replaying the logged copy too would duplicate its nodes in the DAG.
-        // Exact bases keep later graph indices stable while dropped slots remain inert placeholders.
-        let { submissions, bases } = recovered;
-        if (submissions.length > 0) {
-            const keep = recovered.submitters.map(s => s === undefined || completedIds.has(s));
-            submissions = submissions.filter((_, i) => keep[i]);
-            bases = bases.filter((_, i) => keep[i]);
-        }
-        return this.runWorkflow(spec, {
-            resumedOutcomes,
-            resumedSubmissions: submissions,
-            resumedSubmissionBases: bases,
-            sessionId,
-        });
-    }
     interrupt(reason = "user") {
         this.interrupted = true;
         this.cancellationReason = reason;
@@ -1213,7 +1148,7 @@ export class RuntimeRunner {
             const dispositions = this.pendingObservations.slice(observationStart).filter(observation => observation.kind === "signal_delivery_disposed"
                 && observation.delivery_id === delivery.deliveryId
                 && observation.attempt === delivery.deliveryAttempt);
-            if (dispositions.length !== 1) {
+            if (dispositions.length > 1) {
                 throw new Error("kernel did not return the matching signal delivery disposition");
             }
             if (!await delivery.ack())
@@ -1227,8 +1162,24 @@ export class RuntimeRunner {
     }
     async *run(req) {
         const prior = req.inheritEvents ?? await this.opts.sessionLog.read(req.sessionId);
-        const midRun = isMidRun(prior);
         const resumedStart = [...prior].reverse().find(entry => entry.event.kind === "run_started");
+        // SessionLog is an audit projection. A forged/stale run_terminal must not mint a new
+        // operation while the canonical journal still has a live chain — same authority as wake().
+        // Inherited parent events are transcript input for a fresh child operation, never recovery
+        // evidence for the child's own canonical journal.
+        let midRun = req.inheritEvents ? false : isMidRun(prior);
+        if (!midRun
+            && resumedStart?.event.kind === "run_started"
+            && !req.inheritEvents) {
+            const operationId = `node-operation-${resumedStart.event.run_id}`;
+            const head = await this.resolveKernelJournal().head(operationId);
+            if (head) {
+                const authoritative = this.createCanonicalRuntime(resumedStart.event.run_id, req.sessionId);
+                await authoritative.restore();
+                if (!authoritative.isTerminal())
+                    midRun = true;
+            }
+        }
         const runId = midRun && resumedStart?.event.kind === "run_started"
             ? resumedStart.event.run_id
             : crypto.randomUUID();
@@ -1253,12 +1204,26 @@ export class RuntimeRunner {
     }
     async *wake(sessionId, extensions) {
         const events = await this.opts.sessionLog.read(sessionId);
-        if (events.some(e => e.event.kind === "run_terminal"))
-            return;
-        const startEntry = [...events].reverse().find(e => e.event.kind === "run_started");
+        const startIndex = events.reduce((latest, entry, index) => entry.event.kind === "run_started" ? index : latest, -1);
+        const startEntry = startIndex >= 0 ? events[startIndex] : undefined;
         if (!startEntry)
             throw new Error(`No run_started event for session: ${sessionId}`);
         const start = startEntry.event;
+        const projectedTerminal = events
+            .slice(startIndex + 1)
+            .some(e => e.event.kind === "run_terminal");
+        if (projectedTerminal) {
+            const operationId = `node-operation-${start.run_id}`;
+            const journal = this.resolveKernelJournal();
+            const head = await journal.head(operationId);
+            if (!head) {
+                throw new Error("run_terminal projection has no canonical journal");
+            }
+            const authoritative = this.createCanonicalRuntime(start.run_id, sessionId);
+            await authoritative.restore();
+            if (authoritative.isTerminal())
+                return;
+        }
         yield* this.execute(sessionId, start.goal, start.criteria, extensions, events, true, start.attachments, start.run_id);
     }
     /** Execute a kernel-owned approval effect and return the correlated decision lists. */
@@ -1339,62 +1304,6 @@ export class RuntimeRunner {
         }
         return { approved, denied, events };
     }
-    /**
-     * O7: resolve a `read_result` meta-tool call to the full text of a previously-evicted tool
-     * output. Resolution order: (a) the on-disk result spool committed by the explicit
-     * `spool_large_result` host effect, then (b) a session-log scan for the original
-     * `tool_completed` event carrying that `call_id`. Slices the
-     * resolved text by `[offset, offset + maxBytes)` (plain string slice — "bytes-ish").
-     */
-    async resolveReadResult(sessionId, argsJson) {
-        let callId = "";
-        let offset = 0;
-        let maxBytes = 4000;
-        try {
-            const args = JSON.parse(argsJson || "{}");
-            callId = typeof args.call_id === "string" ? args.call_id : "";
-            if (typeof args.offset === "number" && Number.isFinite(args.offset))
-                offset = args.offset;
-            if (typeof args.max_bytes === "number" && Number.isFinite(args.max_bytes))
-                maxBytes = args.max_bytes;
-        }
-        catch {
-            // malformed arguments — callId stays empty, falls through to "not found" below
-        }
-        let full;
-        const spool = this.opts.resultSpool ?? new LargeResultSpool();
-        try {
-            full = await spool.findByCallId(sessionId, callId);
-        }
-        catch {
-            full = undefined;
-        }
-        if (full === undefined) {
-            try {
-                const events = await this.opts.sessionLog.read(sessionId);
-                for (const { event } of events) {
-                    if (event.kind !== "tool_completed")
-                        continue;
-                    const match = event.results.find(r => r.call_id === callId);
-                    if (match)
-                        full = match.output;
-                }
-            }
-            catch {
-                full = undefined;
-            }
-        }
-        if (full === undefined) {
-            return { text: `no stored output for call_id "${callId}"`, isError: true };
-        }
-        const start = Math.max(0, offset);
-        const end = Math.min(full.length, start + Math.max(0, maxBytes));
-        const slice = full.slice(start, end);
-        return {
-            text: `[read_result ${callId}: chars ${start}–${end} of ${full.length}]\n${slice}`,
-            isError: false,
-        };
-    }
     async *execute(sessionId, goal, criteria, extensions, priorEvents, resumeMidRun = false, attachments, runId = crypto.randomUUID()) {
         this.interrupted = false;
         this.cancellationReason = undefined;
@@ -1406,7 +1315,6 @@ export class RuntimeRunner {
         if (this.opts.enableDiagnosticsDashboard) {
             this.dashboard = new KernelPrimitivesDashboard(sessionId);
         }
-        const kernel = getKernel();
         const ext = { ...this.opts.extensions, ...(extensions ?? {}) };
         const providerState = this.opts.provider.createRunState?.();
         let nextCompressedArchiveStart = nextArchivedSeqStart(priorEvents);
@@ -1423,200 +1331,167 @@ export class RuntimeRunner {
         const taskScope = new ManagedTaskScope(operation, this.opts.onBackgroundTaskError);
         let groupBudgetScope;
         try {
-            const runtime = new kernel.KernelRuntime({
-                maxTokens: this.opts.maxTokens,
-                maxTurns: effectiveMaxTurns,
-                timeoutMs: effectiveTimeoutMs !== undefined ? BigInt(effectiveTimeoutMs) : undefined,
-                maxTotalTokens: this.opts.maxTotalTokens !== undefined ? BigInt(this.opts.maxTotalTokens) : undefined,
-            });
+            const runtime = this.createCanonicalRuntime(runId, sessionId);
+            if (resumeMidRun)
+                await runtime.restore();
             this.activeKernel = runtime;
             this.nextArchiveStart = nextCompressedArchiveStart;
-            if (this.opts.tokenizer) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "set_tokenizer",
-                    name: this.opts.tokenizer,
-                });
-            }
-            if (this.opts.enablePlanTool !== undefined) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "set_plan_tool_enabled",
-                    enabled: this.opts.enablePlanTool,
-                });
-            }
-            await this.commitKernelApply(runtime, this.pendingObservations, {
-                kind: "set_tools",
-                tools: this.opts.executionPlane.schemas().map(toolSchemaToKernel),
-            });
-            if (this.composedSystemPrompt) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "add_system_message",
-                    content: this.composedSystemPrompt,
-                    tokens: Math.max(1, Math.ceil(this.composedSystemPrompt.length / 4)),
-                });
-            }
-            if (this.opts.initialMemory) {
-                for (const mem of this.opts.initialMemory) {
+            if (!resumeMidRun) {
+                if (this.opts.tokenizer) {
                     await this.commitKernelApply(runtime, this.pendingObservations, {
-                        kind: "add_knowledge_message",
-                        content: mem,
-                        tokens: Math.max(1, Math.ceil(mem.length / 4)),
+                        kind: "set_tokenizer",
+                        name: this.opts.tokenizer,
+                    });
+                }
+                if (this.opts.enablePlanTool !== undefined) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "set_plan_tool_enabled",
+                        enabled: this.opts.enablePlanTool,
                     });
                 }
-            }
-            if (this.opts.skillDir) {
-                const { scanSkillDir } = await import("../skills/loader.js");
-                const metas = await scanSkillDir(this.opts.skillDir);
-                // S2 host-layer skill allowlist: keep only scanned skills named in `skillFilter` before feeding
-                // the catalog. Absent ⇒ feed all (identical to the pre-feature message); empty ⇒ feed none. The
-                // `set_available_skills` message is ALWAYS sent when a skillDir exists (shape preserved) — only
-                // the list narrows; the no-skillDir path stays untouched.
-                const filter = this.opts.skillFilter;
-                const selected = filter === undefined ? metas : metas.filter(m => filter.includes(m.name));
-                // P1-B: pass the full SkillMetadata (incl. `allowedTools`) straight through — re-mapping it
-                // field-by-field previously dropped `allowedTools`.
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "set_available_skills",
-                    skills: selected.map(m => skillMetadataToKernel(m)),
-                });
-            }
-            // P1-B/D: configure the stable-core tool ids (always exposed under skill gating). Empty/absent
-            // ⇒ skills narrow to exactly their declared tools + meta-tools.
-            if (this.opts.stableCoreToolIds?.length) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "set_stable_core_tools",
-                    tool_ids: this.opts.stableCoreToolIds,
-                });
-            }
-            if (this.opts.dreamStore && this.opts.agentId) {
-                await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_memory_enabled", enabled: true });
-            }
-            // Install optional memory policy. Maps the ergonomic camelCase option onto the kernel's
-            // snake_case `set_memory_policy` event; omitted fields fall back to kernel defaults.
-            if (this.opts.memoryPolicy) {
-                const m = this.opts.memoryPolicy;
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "set_memory_policy",
-                    ...(m.memoryPath !== undefined ? { memory_path: m.memoryPath } : {}),
-                    ...(m.staleWarningDays !== undefined ? { stale_warning_days: m.staleWarningDays } : {}),
-                    ...(m.retrievalTopK !== undefined ? { retrieval_top_k: m.retrievalTopK } : {}),
-                    ...(m.validationEnabled !== undefined ? { validation_enabled: m.validationEnabled } : {}),
-                    ...(m.maxContentBytes !== undefined ? { max_content_bytes: m.maxContentBytes } : {}),
-                    ...(m.maxNameLength !== undefined ? { max_name_length: m.maxNameLength } : {}),
-                    ...(m.promotionRecallThreshold !== undefined
-                        ? { promotion_recall_threshold: m.promotionRecallThreshold }
-                        : {}),
-                });
-            }
-            if (this.opts.knowledgeSource) {
-                await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_knowledge_enabled", enabled: true });
-            }
-            if (this.opts.milestoneContract) {
-                await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "load_milestone_contract",
-                    contract: {
-                        phases: this.opts.milestoneContract.phases.map(p => ({
-                            id: p.id,
-                            criteria: p.criteria ?? [],
-                            unlocks: p.unlocks ?? [],
-                            required_evidence: p.requiredEvidence ?? [],
-                            ...(p.verifier ? { verifier: p.verifier } : {}),
-                        })),
-                    },
-                });
-            }
-            const maxBytes = runtime.recoveryContentBytes();
-            if (priorEvents && priorEvents.length > 0) {
-                const repaired = repairEventsForRecovery(priorEvents, maxBytes);
-                seedProviderReplayFromEvents(this.opts.provider, repaired);
-                const loadArchive = this.opts.compressionStore
-                    ? (ref) => this.opts.compressionStore.read(ref)
-                    : undefined;
-                const replayed = await replayMessagesAsync(repaired, maxBytes, loadArchive);
                 await this.commitKernelApply(runtime, this.pendingObservations, {
-                    kind: "preload_history",
-                    messages: replayed.map(messageToKernelMessage),
+                    kind: "set_tools",
+                    tools: this.opts.executionPlane.schemas().map(toolSchemaToKernel),
                 });
-                // P1-B B3: rebuild active-skill gating after a wake by re-emitting SkillActivated for each
-                // `skill` tool call in the replayed history (active_skills is not snapshotted — graceful).
-                // The catalog (set_available_skills) was already fed above, so allowed_tools resolves.
-                // `knowledge` isn't snapshotted either (same graceful-reset philosophy) — best-effort re-push
-                // the skill's content from its replayed tool_result so the durable copy survives a wake too.
-                const toolResultByCallId = new Map();
-                for (const m of replayed) {
-                    for (const part of m.contentParts ?? []) {
-                        if (part.type === "tool_result")
-                            toolResultByCallId.set(part.callId, part.output);
-                    }
+                if (this.composedSystemPrompt) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "add_system_message",
+                        content: this.composedSystemPrompt,
+                        tokens: Math.max(1, Math.ceil(this.composedSystemPrompt.length / 4)),
+                    });
                 }
-                for (const m of replayed) {
-                    for (const tc of m.toolCalls ?? []) {
-                        if (tc.name !== "skill")
-                            continue;
-                        try {
-                            const name = JSON.parse(tc.arguments || "{}").name;
-                            if (!name)
-                                continue;
-                            await this.commitKernelApply(runtime, this.pendingObservations, {
-                                kind: "skill_activated",
-                                name,
-                                ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
-                            });
-                            const output = toolResultByCallId.get(tc.id);
-                            if (output && !this.knowledgePushedSkills.has(name)) {
-                                this.knowledgePushedSkills.add(name);
-                                // K1: keyed — the kernel-side upsert is the authoritative dedup, so a wake re-push
-                                // of a skill already pinned live can never double-pin (the in-run Set resets with
-                                // each runner instance; the key does not).
-                                await this.pushKnowledge({ role: "system", content: output, toolCalls: [] }, undefined, { key: `skill:${name}` });
-                            }
-                        }
-                        catch { /* malformed skill args — skip */ }
+                if (this.opts.initialMemory) {
+                    for (const mem of this.opts.initialMemory) {
+                        await this.commitKernelApply(runtime, this.pendingObservations, {
+                            kind: "add_knowledge_message",
+                            content: mem,
+                            tokens: Math.max(1, Math.ceil(mem.length / 4)),
+                        });
                     }
                 }
+                if (this.opts.skillDir) {
+                    const { scanSkillDir } = await import("../skills/loader.js");
+                    const metas = await scanSkillDir(this.opts.skillDir);
+                    // S2 host-layer skill allowlist: keep only scanned skills named in `skillFilter` before feeding
+                    // the catalog. Absent ⇒ feed all (identical to the pre-feature message); empty ⇒ feed none. The
+                    // `set_available_skills` message is ALWAYS sent when a skillDir exists (shape preserved) — only
+                    // the list narrows; the no-skillDir path stays untouched.
+                    const filter = this.opts.skillFilter;
+                    const selected = filter === undefined ? metas : metas.filter(m => filter.includes(m.name));
+                    // P1-B: pass the full SkillMetadata (incl. `allowedTools`) straight through — re-mapping it
+                    // field-by-field previously dropped `allowedTools`.
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "set_available_skills",
+                        skills: selected.map(m => skillMetadataToKernel(m)),
+                    });
+                }
+                // P1-B/D: configure the stable-core tool ids (always exposed under skill gating). Empty/absent
+                // ⇒ skills narrow to exactly their declared tools + meta-tools.
+                if (this.opts.stableCoreToolIds?.length) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "set_stable_core_tools",
+                        tool_ids: this.opts.stableCoreToolIds,
+                    });
+                }
+                if (this.opts.dreamStore && this.opts.agentId) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_memory_enabled", enabled: true });
+                }
+                // Install optional memory policy. Maps the ergonomic camelCase option onto the kernel's
+                // snake_case `set_memory_policy` event; omitted fields fall back to kernel defaults.
+                if (this.opts.memoryPolicy) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "set_memory_policy",
+                        ...memoryPolicyToKernel(this.opts.memoryPolicy),
+                    });
+                }
+                if (this.opts.knowledgeSource) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_knowledge_enabled", enabled: true });
+                }
+                if (this.opts.milestoneContract) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "load_milestone_contract",
+                        contract: {
+                            phases: this.opts.milestoneContract.phases.map(p => ({
+                                id: p.id,
+                                criteria: p.criteria ?? [],
+                                unlocks: p.unlocks ?? [],
+                                required_evidence: p.requiredEvidence ?? [],
+                                ...(p.verifier ? { verifier: p.verifier } : {}),
+                            })),
+                        },
+                    });
+                }
+            }
+            if (priorEvents && priorEvents.length > 0) {
+                seedProviderReplayFromEvents(this.opts.provider, priorEvents);
+                if (!resumeMidRun) {
+                    const loadArchive = this.opts.compressionStore
+                        ? (ref) => this.opts.compressionStore.read(ref)
+                        : undefined;
+                    const replayed = await replayMessagesAsync(priorEvents, runtime.recoveryContentBytes(), loadArchive);
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "preload_history",
+                        messages: replayed.map(messageToKernelMessage),
+                    });
+                }
             }
             const sessionStart = Date.now();
-            const startPayload = {
-                kind: "start_run",
-                task: { goal, criteria },
-            };
-            // P0-A: lower an explicit `runSpec` and/or the `allowedToolIds` profile to the kernel's
-            // `capability_filter`. `allowedToolIds` augments an explicit spec's filter, else synthesizes
-            // a minimal top-level spec carrying just the filter (reuses the existing run_spec wire — no
-            // new ABI). Unset on both ⇒ no run_spec ⇒ no gating (铁律: no config = old behavior).
+            const startTask = { goal, criteria };
+            let startRunSpec;
+            // P0-A: lower an explicit `runSpec`, the `allowedToolIds` ceiling, and/or the `baselineToolIds`
+            // pre-activation surface to the kernel run spec. Each augments an explicit spec, else
+            // synthesizes a minimal top-level spec carrying just the exposure config (reuses the existing
+            // run_spec wire — no new ABI). Unset on all ⇒ no run_spec ⇒ no gating (铁律: no config = old
+            // behavior).
             const allowedToolIds = this.opts.allowedToolIds;
             const hasProfile = allowedToolIds !== undefined && allowedToolIds.length > 0;
-            if (this.opts.runSpec || hasProfile) {
+            // NOT the `length > 0` idiom above: `baselineToolIds: []` is the legitimate minimal surface
+            // (meta + stable-core only), so mere presence triggers the lowering.
+            const baselineToolIds = this.opts.baselineToolIds;
+            const hasBaseline = baselineToolIds !== undefined;
+            const hasMilestoneContract = this.opts.milestoneContract !== undefined;
+            if (this.opts.runSpec || hasProfile || hasBaseline || hasMilestoneContract) {
                 const baseSpec = this.opts.runSpec ?? {
                     identity: { agentId: this.opts.agentId ?? "root", sessionId, isSubAgent: false },
                     role: "custom",
                     goal,
                 };
-                const spec = hasProfile
+                let spec = hasProfile
                     ? { ...baseSpec, capabilityFilter: { ...baseSpec.capabilityFilter, allowedIds: allowedToolIds } }
                     : baseSpec;
-                startPayload.run_spec = agentRunSpecToKernel(spec);
+                if (hasBaseline)
+                    spec = { ...spec, exposureBaseline: baselineToolIds };
+                if (hasMilestoneContract && !spec.verificationContractId) {
+                    spec = { ...spec, verificationContractId: "node-default" };
+                }
+                startRunSpec = agentRunSpecToKernel(spec);
             }
-            // Reserve capacity before start_run. The kernel enforces only this vehicle's grant and reports
+            // Reserve capacity before the canonical root start. The kernel enforces only this vehicle's grant and reports
             // exact terminal usage against the same opaque reservation identity. A nested vehicle joins for
             // lineage/settlement only: it reserves no budget axes (group admission governs peer vehicles),
             // so the parent's held reservation cannot squeeze the child's grant to zero.
-            if (this.opts.runGroup) {
+            if (!resumeMidRun && this.opts.runGroup) {
                 const g = this.opts.runGroup;
                 groupBudgetScope = await GroupBudgetScope.open(g, { sessionId, role: this.opts.agentId, kind: "vehicle" }, this.opts.nestedGroupVehicle ? { limits: {}, requested: {} } : this.groupBudgetRequest());
                 this.activeGroupBudgetScope = groupBudgetScope;
             }
-            try {
-                await this.applyKernelPolicies(runtime, groupBudgetScope);
-            }
-            catch (err) {
-                // Admission failure (e.g. the kernel rejecting a zero-capacity grant): release the
-                // reservation so it cannot linger in the group ledger, then surface the error.
-                await groupBudgetScope?.release();
-                this.activeGroupBudgetScope = undefined;
-                throw err;
+            if (!resumeMidRun) {
+                try {
+                    await this.applyKernelPolicies(runtime, groupBudgetScope);
+                }
+                catch (err) {
+                    // Admission failure (e.g. the kernel rejecting a zero-capacity grant): release the
+                    // reservation so it cannot linger in the group ledger, then surface the error.
+                    await groupBudgetScope?.release();
+                    this.activeGroupBudgetScope = undefined;
+                    throw err;
+                }
             }
+            this.currentGoal = goal;
+            if (!resumeMidRun)
+                await this.prefetchMemoryIntoInitialContext(runtime);
             // Multimodal upload: seed the user's attachments (images/audio) as a history
-            // message before start_run pushes the "[TASK STATE]" anchor. init_task does not
+            // message before root start pushes the "[TASK STATE]" anchor. init_task does not
             // clear history, so order becomes [attachment user msg, "Proceed…"] — both land
             // in the first render. On resume the message is already in the replayed history.
             if (!resumeMidRun && attachments?.length) {
@@ -1625,24 +1500,14 @@ export class RuntimeRunner {
                     message: attachmentsToKernelMessage(attachments),
                 });
             }
-            this.currentGoal = goal;
+            const resumedAction = resumeMidRun ? runtime.resumeAction() : null;
             let action = resumeMidRun
-                ? await this.commitKernelAction(runtime, this.pendingObservations, { kind: "resume" })
-                : await this.commitKernelAction(runtime, this.pendingObservations, startPayload);
-            // I4/T5: pre-fetch memory before the first LLM turn so the model sees it on turn 1 instead
-            // of discovering it via the `memory` tool on turn 3+. It routes through the kernel's
-            // query_memory lifecycle and therefore runs AFTER start_run — a memory query is a kernel
-            // preload whose result resumes the reasoning path, so issuing it pre-run would leave the
-            // kernel Running and start_run would fault. The resumed action from the last query
-            // supersedes start_run's (same pull contract; it renders the injected hits). Hits land in
-            // `history` as ordinary turns — single-use retrieval content that decays with the
-            // compression pyramid, never pinned into `knowledge`. Skipped on resumes (already in
-            // prior context) and when dreamStore/agentId is absent.
-            if (!resumeMidRun) {
-                const resumed = await this.prefetchMemoryIntoHistory(runtime, "initial");
-                if (resumed)
-                    action = resumed;
-            }
+                ? resumedAction ?? (() => { throw new Error("restored canonical operation has no pending effect or terminal"); })()
+                : await this.startKernelAgent(runtime, this.pendingObservations, startTask, startRunSpec);
+            // I4/T5: pre-fetch memory before root start so the model sees it on turn 1 instead of
+            // discovering it via the `memory` tool later. Accepted hits enter `initial_context.messages`
+            // and are therefore frozen into the canonical start record. Skipped on restore (the checkpoint
+            // or journal already owns them) and when dreamStore/agentId is absent.
             // P0-C: the skill loaded and in effect going into the current turn (updated when the model's
             // `skill` tool call resolves). Drives the per-turn `activeSkill` metric → dwell measurement.
             let activeSkill;
@@ -1679,15 +1544,6 @@ export class RuntimeRunner {
                     if (runtime.isTerminal())
                         break;
                     if (action.kind === "call_provider") {
-                        // M5 v2.1: top-level auto-pivot at the safe point. If the agent authored sub-workflow(s) via
-                        // `start_workflow`, drive each in THIS kernel now (the kernel is in Reason / `call_provider`,
-                        // NOT suspended — driving mid-suspend would clobber the single-slot suspend state), inject the
-                        // outcome into context, and re-render. Loop-top placement (vs only after `tool_results`) catches
-                        // EVERY path to `call_provider` — including resuming after an approval gate — so a queued spec
-                        // is never stranded. Drains the queue; fires once per authored batch.
-                        if (this.pendingAuthoredWorkflows.length > 0) {
-                            action = await this.driveAuthoredWorkflows(runtime, action);
-                        }
                         const providerEffectId = action.effectId;
                         const finalToolCalls = [];
                         let finalText = "";
@@ -1790,10 +1646,28 @@ export class RuntimeRunner {
                             });
                             break;
                         }
+                        const canonicalToolCalls = this.opts.skillLeaseTurns === undefined
+                            ? finalToolCalls
+                            : finalToolCalls.map(call => {
+                                if (call.name !== "skill")
+                                    return call;
+                                try {
+                                    return {
+                                        ...call,
+                                        arguments: JSON.stringify({
+                                            ...JSON.parse(call.arguments || "{}"),
+                                            lease_turns: this.opts.skillLeaseTurns,
+                                        }),
+                                    };
+                                }
+                                catch {
+                                    return call;
+                                }
+                            });
                         const assistantMessage = {
                             role: "assistant",
                             content: finalText,
-                            toolCalls: finalToolCalls,
+                            toolCalls: canonicalToolCalls,
                             tokenCount: turnOutputTokens || turnTokens || undefined,
                         };
                         const providerEvent = {
@@ -1802,9 +1676,36 @@ export class RuntimeRunner {
                             message: messageToKernelMessage(assistantMessage),
                             ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
                             ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
-                            now_ms: Date.now(),
                             ...(turnStopReason ? { stop_reason: turnStopReason } : {}),
                         };
+                        if (this.opts.skillDir) {
+                            const skillCalls = finalToolCalls.filter(call => call.name === "skill");
+                            if (skillCalls.length > 0) {
+                                const { readSkillFile } = await import("../skills/loader.js");
+                                for (const call of skillCalls) {
+                                    try {
+                                        const name = String(JSON.parse(call.arguments || "{}").name ?? "");
+                                        if (!name)
+                                            continue;
+                                        if (this.opts.skillFilter && !this.opts.skillFilter.includes(name))
+                                            continue;
+                                        const content = await readSkillFile(this.opts.skillDir, name);
+                                        if (!content)
+                                            continue;
+                                        await this.commitKernelApply(runtime, this.pendingObservations, {
+                                            kind: "add_knowledge_message",
+                                            key: `skill:${name}`,
+                                            content,
+                                            tokens: Math.max(1, Math.ceil(content.length / 4)),
+                                            pinned: true,
+                                        });
+                                    }
+                                    catch {
+                                        // A missing or malformed skill stays a model-visible syscall rejection.
+                                    }
+                                }
+                            }
+                        }
                         action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
                         const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
                         await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
@@ -1856,10 +1757,32 @@ export class RuntimeRunner {
                     else if (action.kind === "persist_memory") {
                         let error;
                         const agentId = this.opts.agentId;
+                        const canonicalMemory = action.memory;
+                        const record = {
+                            record_id: `memory:${crypto.randomUUID()}`,
+                            scope: this.opts.memoryScope ?? { tenant_id: "default", namespace: agentId ?? "default" },
+                            name: String(canonicalMemory.name ?? ""),
+                            kind: String(canonicalMemory.kind ?? "reference"),
+                            content: String(canonicalMemory.content ?? ""),
+                            description: String(canonicalMemory.description ?? ""),
+                            provenance: {
+                                author: "model",
+                                trust: "untrusted",
+                                evidence_refs: Array.isArray(canonicalMemory.evidence_refs)
+                                    ? canonicalMemory.evidence_refs.map(String)
+                                    : [],
+                            },
+                            created_at: Number(canonicalMemory.accepted_at_ms ?? Date.now()),
+                            updated_at: Number(canonicalMemory.accepted_at_ms ?? Date.now()),
+                            recall_count: 0,
+                            confidence: 1,
+                            links: [],
+                            pinned: false,
+                        };
                         try {
                             if (!agentId)
                                 throw new Error("memory persistence requires RuntimeOptions.agentId");
-                            await this.persistMemoryToStore(action.memory, agentId);
+                            await this.persistMemoryToStore(record, agentId);
                         }
                         catch (cause) {
                             error = formatToolError(cause);
@@ -1867,11 +1790,22 @@ export class RuntimeRunner {
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "memory_persist_result",
                             effect_id: action.effectId,
+                            record_ref: record.record_id,
                             ...(error ? { error } : {}),
                         });
                     }
                     else if (action.kind === "query_memory") {
-                        const query = action.query;
+                        const query = {
+                            scope: this.opts.memoryScope ?? {
+                                tenant_id: "default",
+                                namespace: this.opts.agentId ?? "default",
+                            },
+                            query: String(action.query.text ?? ""),
+                            top_k: action.requestedK,
+                            kinds: Array.isArray(action.query.kinds)
+                                ? action.query.kinds.map(String)
+                                : [],
+                        };
                         let hits = [];
                         let error;
                         const agentId = this.opts.agentId;
@@ -1892,23 +1826,6 @@ export class RuntimeRunner {
                         if (!error)
                             await this.logMemoryRetrievalResult(sessionId, hits);
                     }
-                    else if (action.kind === "spool_large_result") {
-                        const spool = this.opts.resultSpool ?? new LargeResultSpool();
-                        let spoolRef;
-                        let error;
-                        try {
-                            spoolRef = await spool.persistOutput(sessionId, action.callId, action.output);
-                        }
-                        catch (cause) {
-                            error = formatToolError(cause);
-                        }
-                        action = await this.commitKernelAction(runtime, this.pendingObservations, {
-                            kind: "large_result_spool_result",
-                            effect_id: action.effectId,
-                            ...(spoolRef ? { spool_ref: spoolRef } : {}),
-                            ...(error ? { error } : {}),
-                        });
-                    }
                     else if (action.kind === "archive_page_out") {
                         const archiveMeta = this.activePageOutArchive
                             ?? this.pendingPageOutArchives.shift()
@@ -1920,8 +1837,15 @@ export class RuntimeRunner {
                         let archiveRef;
                         let error;
                         try {
-                            if (this.opts.compressionStore) {
-                                const ref = await this.opts.compressionStore.write(sessionId, archiveMeta.archiveStart, action.archived);
+                            if (action.payload && action.handleId) {
+                                archiveRef = this.opts.compressionStore
+                                    ? await this.opts.compressionStore.write(sessionId, archiveMeta.archiveStart, action.archived ?? [])
+                                    : undefined;
+                                archiveRef ??= `payload:${String(action.payload.digest).replace(/^sha256:/, "").slice(0, 32)}`;
+                                await this.payloadStore().persistPayload(sessionId, archiveRef, action.payload.content);
+                            }
+                            else if (this.opts.compressionStore) {
+                                const ref = await this.opts.compressionStore.write(sessionId, archiveMeta.archiveStart, action.archived ?? []);
                                 if (ref)
                                     archiveRef = ref;
                             }
@@ -1929,7 +1853,7 @@ export class RuntimeRunner {
                         catch (cause) {
                             error = formatToolError(cause);
                         }
-                        const archived = action.archived;
+                        const archived = action.archived ?? [];
                         const archiveAction = compressionAction(action.action) ?? "auto_compact";
                         const archiveTier = action.tier;
                         const compressedSeq = archiveMeta.compressedSeq;
@@ -1938,6 +1862,7 @@ export class RuntimeRunner {
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "page_out_archive_result",
                             effect_id: action.effectId,
+                            ...(archiveRef ? { payload_ref: archiveRef } : {}),
                             ...(archiveRef ? { archive_ref: archiveRef } : {}),
                             ...(error ? { error } : {}),
                         });
@@ -1951,6 +1876,39 @@ export class RuntimeRunner {
                             }
                         }
                     }
+                    else if (action.kind === "load_payload") {
+                        let content;
+                        let error;
+                        try {
+                            content = await this.payloadStore().loadPayload(sessionId, action.payloadRef);
+                            if (content === undefined) {
+                                throw new Error(`payload not found for opaque locator ${action.payloadRef}`);
+                            }
+                        }
+                        catch (cause) {
+                            error = formatToolError(cause);
+                        }
+                        if (error || content === undefined) {
+                            action = await this.commitKernelAction(runtime, this.pendingObservations, {
+                                kind: "payload_load_failed",
+                                effect_id: action.effectId,
+                                error,
+                            });
+                        }
+                        else {
+                            const digestBytes = await crypto.subtle.digest("SHA-256", Buffer.from(content));
+                            action = await this.commitKernelAction(runtime, this.pendingObservations, {
+                                kind: "payload_loaded",
+                                effect_id: action.effectId,
+                                handle_id: action.handleId,
+                                payload: {
+                                    content,
+                                    digest: `sha256:${Buffer.from(digestBytes).toString("hex")}`,
+                                    original_size: String(Buffer.byteLength(content, "utf8")),
+                                },
+                            });
+                        }
+                    }
                     else if (action.kind === "execute_tool") {
                         const toolEffectId = action.effectId;
                         const allCalls = action.calls;
@@ -1964,18 +1922,13 @@ export class RuntimeRunner {
                             knowledgeSource: this.opts.knowledgeSource,
                             onToolSuspend: this.opts.onToolSuspend,
                             onPermissionRequest: this.opts.onPermissionRequest,
-                            resultSpool: this.opts.resultSpool ?? new LargeResultSpool(),
                         };
                         const toolResults = [];
-                        const normalCalls = allCalls.filter(c => c.name !== "update_plan" && c.name !== "submit_workflow_nodes" && c.name !== "start_workflow"
-                            && c.name !== "read_result");
+                        const normalCalls = allCalls.filter(c => c.name !== "update_plan" && c.name !== "submit_workflow_nodes" && c.name !== "start_workflow");
                         const planCalls = allCalls.filter(c => c.name === "update_plan");
-                        // M5 v1: `start_workflow` (author a sub-workflow) flattens to the same append path as
-                        // `submit_workflow_nodes` — a `WorkflowSpec` is a node batch. (v2 adds top-level bootstrap.)
+                        // Syscall tools are consumed by core from the provider result. If one reaches this host
+                        // effect projection, the canonical boundary has drifted and must fail closed.
                         const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes" || c.name === "start_workflow");
-                        // O7: `read_result` re-fetches a tool output the kernel evicted from context. Content is
-                        // host-resolved from the effect-committed spool, then from the durable session log.
-                        const readResultCalls = allCalls.filter(c => c.name === "read_result");
                         for (const call of planCalls) {
                             const update = parseUpdatePlanArgs(call.arguments);
                             await this.commitKernelApply(runtime, this.pendingObservations, {
@@ -1986,39 +1939,8 @@ export class RuntimeRunner {
                             toolResults.push(result);
                             yield { type: "tool_result", callId: call.id, content: "success", isError: false };
                         }
-                        for (const call of readResultCalls) {
-                            const out = await this.resolveReadResult(sessionId, call.arguments);
-                            toolResults.push({ callId: call.id, output: out.text, isError: out.isError });
-                            yield { type: "tool_result", callId: call.id, content: out.text, isError: out.isError };
-                        }
-                        // R3-1: `submit_workflow_nodes` cannot be applied to this runner's kernel — when this runner
-                        // is a workflow node, the workflow lives in the *parent* kernel. Surface the requested nodes
-                        // as a stream event; the orchestrator collects them onto the node's result and `runWorkflow`
-                        // sends `submit_workflow_nodes` to the parent kernel. (When not a workflow node, the event is
-                        // simply unconsumed — a no-op.)
                         for (const call of submitCalls) {
-                            // M5 v2.1: a TOP-LEVEL agent authoring a whole sub-workflow via `start_workflow` — record the
-                            // full spec and AUTO-PIVOT once this tool turn resolves (the loop drives it in this kernel and
-                            // injects the outcome). A workflow-NODE's `start_workflow` (and every `submit_workflow_nodes`)
-                            // instead FLATTENS: the batch is surfaced for the parent `runWorkflow` to append.
-                            if (call.name === "start_workflow" && !this.opts.isWorkflowNode) {
-                                const spec = parseStartWorkflowSpec(call.arguments);
-                                if (spec) {
-                                    this.pendingAuthoredWorkflows.push(spec);
-                                    const out = "workflow submitted for governance adjudication";
-                                    toolResults.push({ callId: call.id, output: out, isError: false });
-                                    yield { type: "tool_result", callId: call.id, content: out, isError: false };
-                                    continue;
-                                }
-                            }
-                            // `start_workflow` wraps the batch as `{ spec: { nodes } }`; `submit_workflow_nodes` is `{ nodes }`.
-                            const nodes = call.name === "start_workflow"
-                                ? parseStartWorkflowArgs(call.arguments)
-                                : parseSubmitWorkflowNodesArgs(call.arguments);
-                            yield { type: "workflow_nodes_submitted", nodes };
-                            const result = { callId: call.id, output: "workflow nodes submitted for parent governance adjudication", isError: false };
-                            toolResults.push(result);
-                            yield { type: "tool_result", callId: call.id, content: result.output, isError: false };
+                            throw new Error(`canonical kernel published model syscall ${call.name} as a host tool effect`);
                         }
                         // O5 (PreToolUse-hook analog): give the host a STATEFUL veto over each kernel-approved
                         // call. A blocked call never executes; its reason reaches the model as a committed
@@ -2149,11 +2071,11 @@ export class RuntimeRunner {
                                 token_count: r.tokenCount,
                             })),
                         });
-                        // P1-B B3: a `skill` call that resolved successfully activates that skill in the kernel, so
-                        // the next `call_provider` narrows the toolset to its declared tools. Fed before `tool_results`
-                        // (which computes the next action). Errs-open: a failed/missing skill load doesn't activate.
+                        // The canonical provider resolution already activates a successfully resolved `skill` call.
+                        // The host's remaining responsibility is to pin the resolved METHOD content — how to do
+                        // something — for reuse throughout the run, unlike a one-off memory/knowledge lookup.
                         //
-                        // Strict dynamic context control: a skill is METHOD content — how to do something — reused
+                        // Strict dynamic context control: the skill text
                         // for the rest of the run, unlike a one-off memory/knowledge lookup (fact content, relevant
                         // for the moment it's used). So its text ALSO goes into the durable `knowledge` slot here
                         // (in addition to the ordinary tool_result already headed for `history`, where it will decay
@@ -2169,11 +2091,6 @@ export class RuntimeRunner {
                                 const name = JSON.parse(call.arguments || "{}").name;
                                 if (!name)
                                     continue;
-                                await this.commitKernelApply(runtime, this.pendingObservations, {
-                                    kind: "skill_activated",
-                                    name,
-                                    ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
-                                });
                                 // K1: keyed `skill:<name>` — the kernel-side upsert dedupes across runner instances
                                 // (wake re-push of an already-pinned skill upserts instead of duplicating). With a
                                 // lease configured, the Set optimization is skipped: an expired-then-reloaded skill
@@ -2183,7 +2100,7 @@ export class RuntimeRunner {
                                     await this.pushKnowledge({ role: "system", content: res.output, toolCalls: [] }, undefined, { key: `skill:${name}` });
                                 }
                             }
-                            catch { /* malformed skill args — skip activation */ }
+                            catch { /* malformed skill args — skip the knowledge pin */ }
                         }
                         const entropyObsStart = this.pendingObservations.length;
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
@@ -2210,6 +2127,7 @@ export class RuntimeRunner {
                     }
                     else if (action.kind === "evaluate_milestone") {
                         const milestoneEffectId = action.effectId;
+                        const milestonePhaseId = action.phaseId;
                         const milestonePolicy = this.opts.milestonePolicy ?? "require_verifier";
                         if (milestonePolicy === "auto_pass") {
                             action = await this.commitKernelAction(runtime, this.pendingObservations, {
@@ -2233,6 +2151,17 @@ export class RuntimeRunner {
                             this.nextArchiveStart = await this.appendObservations(sessionId, runtime, this.nextArchiveStart, taskScope);
                         }
                         else {
+                            // R-B27: resolve the effect before ending the run. Nothing here can attest the phase, but
+                            // the kernel is holding this milestone in its pending-effect table and only a matching
+                            // result removes it — a bare `return` leaves a dangling effect that a logical-checkpoint
+                            // recovery cannot resolve. Feed back the conservative "unverified" resolution: the wire
+                            // has no error field yet, so it rides as `passed: false`, which keeps the phase where it
+                            // is (fail-closed, no unlocks mounted). The run still ends as `milestone_pending`.
+                            await this.commitKernelAction(runtime, this.pendingObservations, {
+                                kind: "milestone_result",
+                                effect_id: milestoneEffectId,
+                                result: milestoneCheckResultToKernel(milestoneCheckFail(milestonePhaseId, MILESTONE_UNVERIFIED_REASON)),
+                            });
                             this.nextArchiveStart = await this.appendObservations(sessionId, runtime, this.nextArchiveStart, taskScope);
                             const turnsUsed = Math.max(1, runtime.turn());
                             await this.opts.sessionLog.append(sessionId, buildRunTerminalEvent({
@@ -2248,9 +2177,31 @@ export class RuntimeRunner {
                             return;
                         }
                     }
+                    else if (action.kind === "spawn_workflow") {
+                        await this.driveWorkflow(action, [], sessionId, runtime, new Map());
+                        action = runtime.resumeAction()
+                            ?? (() => { throw new Error("canonical workflow completed without a terminal or continuation"); })();
+                    }
+                    else if (action.kind === "unsupported_effect") {
+                        action = await this.commitKernelAction(runtime, this.pendingObservations, {
+                            kind: "unsupported_effect",
+                            effect_id: action.effectId,
+                            effect_kind: action.effectKind,
+                        });
+                    }
                     else if (action.kind === "done") {
                         break;
                     }
+                    else {
+                        // R-B28: fail-closed backstop. Without it an effect that reaches this position but has no
+                        // branch here (`spawn_workflow` / `preempt_sub_agents` are only driven inside the workflow
+                        // driver, and any effect kind a newer kernel adds) leaves `action` unreplaced and no event
+                        // in flight — `while (!runtime.isTerminal())` re-enters immediately and the run pins a core
+                        // at 100% forever while the kernel waits for a result that will never come. Terminating
+                        // through the loop's existing throw path makes the protocol mismatch visible instead
+                        // (run_terminal `error` + an `error` event) and cannot busy-wait.
+                        throw new Error(`unhandled kernel effect ${action.kind} in the main run loop`);
+                    }
                 }
             }
             catch (err) {
@@ -2298,7 +2249,12 @@ export class RuntimeRunner {
                 totalTokens,
             }));
             if (groupBudgetScope && !groupBudgetScope.isClosed) {
-                throw new Error("kernel terminated without a correlated budget_usage_reported observation");
+                await this.settleGroupBudget(groupBudgetScope, {
+                    tokens: totalTokens,
+                    subagents: runtime.localSubagentsSpawned(),
+                    ...(this.opts.runSpec?.loopRound ? { rounds: 1 } : {}),
+                });
+                this.activeGroupBudgetScope = undefined;
             }
             if (this.opts.dreamStore && this.opts.agentId) {
                 const newMsgs = runtime.drainNewMessages().map(m => ({
@@ -2374,9 +2330,8 @@ export class RuntimeRunner {
                 runSpec: this.opts.runSpec,
                 phase,
             });
-            // T5: route each query through the kernel's query_memory lifecycle instead of calling
-            // the store directly — the kernel injects each routed hit into history itself and the
-            // recall lifecycle (recordRecall / promotion) fires exactly like an in-run query.
+            // Renewal prefetch is a host policy, not an agent syscall. Store selection stays host-side;
+            // each accepted hit enters the live run through a canonical seed-knowledge command.
             //
             // One prefetch = one dedupe horizon: a record hit by several short queries recalls and
             // injects once. A renewal prefetch starts a fresh horizon — renewal dropped the earlier
@@ -2386,16 +2341,57 @@ export class RuntimeRunner {
             for (const q of queries ?? []) {
                 if (!q.query.trim())
                     continue;
-                const { action } = await this.queryMemoryThroughKernel(runtime, q, this.opts.agentId, this.durableSessionId(this.currentSessionId), seenRecordIds, this.pendingObservations);
+                const { action } = await this.prefetchMemoryIntoKnowledge(runtime, q, this.opts.agentId, this.durableSessionId(this.currentSessionId), seenRecordIds, this.pendingObservations);
                 resumed = action ?? resumed;
             }
-            // Each memory_query_result resumes the reasoning path and re-emits the pending loop
-            // action; the caller must continue from the LAST one (it renders the injected hits).
+            // Every seed command leaves the pending provider action authoritative; use the last view.
             return resumed;
         }
         catch { /* errs-open — a faulty pre-fetch never breaks the run */ }
         return undefined;
     }
+    async prefetchMemoryIntoInitialContext(runtime) {
+        if (!this.opts.dreamStore || !this.opts.agentId || !this.opts.memoryScope)
+            return;
+        const preQuery = this.opts.preQueryMemory
+            ?? ((ctx) => [{
+                    scope: this.opts.memoryScope,
+                    query: ctx.goal,
+                    top_k: 5,
+                    kinds: [],
+                }]);
+        try {
+            const queries = await preQuery({
+                goal: this.currentGoal,
+                runSpec: this.opts.runSpec,
+                phase: "initial",
+            });
+            const seen = new Set();
+            const accepted = [];
+            for (const query of queries ?? []) {
+                if (!query.query.trim())
+                    continue;
+                const hits = await this.retrieveMemoryFromStore(query, query.top_k, this.opts.agentId);
+                for (const hit of hits) {
+                    if (seen.has(hit.record.record_id))
+                        continue;
+                    seen.add(hit.record.record_id);
+                    accepted.push(hit);
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "add_history_message",
+                        message: {
+                            role: "user",
+                            content: `[MEMORY record_id=${hit.record.record_id} kind=${hit.record.kind}] ${hit.record.content}`,
+                        },
+                    });
+                }
+            }
+            await this.applyHostMemoryRecallLifecycle(accepted, this.opts.agentId);
+        }
+        catch {
+            // Prefetch is advisory; store/config failure never blocks the operation.
+        }
+    }
     async appendObservations(sessionId, runtime, nextArchiveStart, _taskScope) {
         const turn = runtime.turn();
         const preservedRefs = runtime.preservedRefs();
@@ -2821,75 +2817,6 @@ function parseUpdatePlanArgs(argsStr) {
             : parsed.blocked_on,
     };
 }
-/** R3-1: parse the `submit_workflow_nodes` tool arguments (`{ nodes: WorkflowNodeSpec[] }`). Node
- *  shapes are trusted structurally here; the kernel validates them (dep range, quarantine, quota) on
- *  append. A malformed payload yields no nodes rather than throwing. */
-function parseSubmitWorkflowNodesArgs(argsStr) {
-    let parsed = {};
-    try {
-        parsed = JSON.parse(argsStr);
-    }
-    catch {
-        // Ignore parse error → no nodes submitted.
-    }
-    return Array.isArray(parsed.nodes) ? parsed.nodes : [];
-}
-/** M5 v1: parse the `start_workflow` tool arguments (`{ spec: { nodes: WorkflowNodeSpec[] } }`) into
- *  the spec's node batch — flattened onto the running workflow via the same append path. A malformed
- *  payload yields no nodes rather than throwing. */
-function parseStartWorkflowArgs(argsStr) {
-    let parsed = {};
-    try {
-        parsed = JSON.parse(argsStr);
-    }
-    catch {
-        // Ignore parse error → no nodes.
-    }
-    const spec = parsed.spec;
-    return Array.isArray(spec?.nodes) ? spec.nodes : [];
-}
-/** M5 v2.1: parse the full `WorkflowSpec` from a top-level `start_workflow` call, for auto-pivot drive
- *  (vs `parseStartWorkflowArgs`, which returns only the node batch for the flatten path). Returns
- *  `undefined` on a malformed / empty payload so the caller falls back to the flatten path. */
-function parseStartWorkflowSpec(argsStr) {
-    try {
-        const parsed = JSON.parse(argsStr);
-        if (Array.isArray(parsed.spec?.nodes) && parsed.spec.nodes.length > 0) {
-            return { nodes: parsed.spec.nodes };
-        }
-    }
-    catch {
-        // Ignore parse error → undefined (fall back to flatten).
-    }
-    return undefined;
-}
-/** M5 v2.1: render an authored-workflow outcome into a user-message note injected back into the
- *  agent's context, so the agent's next turn continues with the sub-workflow's results in view. */
-function recoveredOutputs(outcomes) {
-    const outputs = new Map();
-    for (const outcome of outcomes ?? []) {
-        if (!outcome.output)
-            continue;
-        outputs.set(outcome.agentId, outcome.output.content);
-        outputs.set(outcome.agentId.replace(/-i\d+$/, ""), outcome.output.content);
-    }
-    return outputs;
-}
-function authoredWorkflowOutcomeNote(outcome) {
-    const counts = new Map();
-    for (const node of outcome.nodeOutcomes)
-        counts.set(node.status, (counts.get(node.status) ?? 0) + 1);
-    const lines = [
-        `[authored workflow result] ${outcome.nodeOutcomes.length} terminal node(s): ` +
-            [...counts.entries()].map(([status, count]) => `${count} ${status}`).join(", ") + ".",
-    ];
-    for (const node of outcome.nodeOutcomes) {
-        const out = outcome.outputs[node.nodeId] ?? node.output?.content;
-        if (out)
-            lines.push(`- ${node.nodeId} (${node.status}): ${out.length > 500 ? out.slice(0, 500) + "…" : out}`);
-    }
-    return lines.join("\n");
-}
 /** Lower a host `RuntimeSignal` to the kernel's snake_case `signal` input event. Shared by the main
  *  loop's per-turn poll and #2-B-ii's workflow-batch preemption monitor (so the two never drift). */
 function signalToKernelEvent(delivery) {