@deepstrike/wasm 0.2.49 → 0.2.51

package/dist/runtime/runner.js

@@ -2,19 +2,20 @@ import { extractSessionMemories } from "../memory/extraction.js";
 import { resolvePermissionRequest } from "./execution-plane.js";
 import { governancePolicyToKernelEvent, governanceFilterSchema } from "../governance.js";
 import { getKernel } from "./kernel.js";
+import { CanonicalRunnerRuntime, canonicalKernelAction, canonicalKernelApply, canonicalKernelMaybeAction, canonicalStartAgent, canonicalStartWorkflow, sha256 as canonicalSha256, } from "./canonical-kernel-step.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { formatToolError } from "../tools/errors.js";
-import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, recoverWorkflowNodeOutcomes, recoverSubmittedWorkflowNodes, repairEventsForRecovery, } from "./session-repair.js";
-import { kernelAction, kernelApply, kernelMaybeAction, messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
-import { agentRunSpecToKernel, findSpawnProcessObservation, milestoneCheckPass, milestoneCheckResultToKernel, spawnObservationToManifest, subAgentResultToKernel, submitWorkflowNodesToKernel, submitWorkflowToKernel, workflowBudgetNote, workflowNodeOutcomeFromKernel, workflowNodeStatusFromTermination, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
+import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, } from "./session-repair.js";
+import { messageToKernelMessage, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
+import { agentRunSpecToKernel, MILESTONE_UNVERIFIED_REASON, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowBudgetNote, workflowNodeSpecToKernel, workflowNodeOutcomeFromKernel, workflowNodeStatusFromTermination, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
 import { resolveReducer } from "./reducers.js";
 import { loopInstruction, classifyInstruction, judgeGoal, dependencyOutputsNote, extractLoopContinue, extractClassifyBranch, extractJudgeWinner, } from "./workflow-control-flow.js";
 import { kernelObservationToSessionEvent } from "./kernel-event-log.js";
 import { assertNativeProfile } from "./os-profile.js";
-import { LargeResultSpool } from "./large-result-spool.js";
+import { PayloadStore } from "./payload-store.js";
 import { contextPolicyV1, normalizeContextPolicyV1, } from "./context-policy.js";
 export function schedulerPolicyToKernel(policy) {
     const allowed = new Set([
@@ -31,6 +32,42 @@ export function schedulerPolicyToKernel(policy) {
         token_cost_weight: policy.tokenCostWeight,
     };
 }
+function kernelReliabilityToKernel(policy) {
+    const allowed = new Set(["providerRecoveryAttempts", "outputRecoveryAttempts", "maxInputBytes"]);
+    const unknown = Object.keys(policy).filter(key => !allowed.has(key));
+    if (unknown.length > 0) {
+        throw new TypeError(`unknown kernel reliability field(s): ${unknown.join(", ")}`);
+    }
+    return {
+        ...(policy.providerRecoveryAttempts !== undefined
+            ? { provider_recovery_attempts: policy.providerRecoveryAttempts }
+            : {}),
+        ...(policy.outputRecoveryAttempts !== undefined
+            ? { output_recovery_attempts: policy.outputRecoveryAttempts }
+            : {}),
+        ...(policy.maxInputBytes !== undefined ? { max_input_bytes: policy.maxInputBytes } : {}),
+    };
+}
+function memoryPolicyToKernel(policy) {
+    const allowed = new Set([
+        "staleWarningDays",
+        "retrievalTopK",
+        "validationEnabled",
+        "maxContentBytes",
+        "maxNameLength",
+    ]);
+    const unknown = Object.keys(policy).filter(key => !allowed.has(key));
+    if (unknown.length > 0) {
+        throw new TypeError(`unknown memory policy field(s): ${unknown.join(", ")}`);
+    }
+    return {
+        ...(policy.staleWarningDays !== undefined ? { stale_warning_days: policy.staleWarningDays } : {}),
+        ...(policy.retrievalTopK !== undefined ? { retrieval_top_k: policy.retrievalTopK } : {}),
+        ...(policy.validationEnabled !== undefined ? { validation_enabled: policy.validationEnabled } : {}),
+        ...(policy.maxContentBytes !== undefined ? { max_content_bytes: policy.maxContentBytes } : {}),
+        ...(policy.maxNameLength !== undefined ? { max_name_length: policy.maxNameLength } : {}),
+    };
+}
 function pendingCallIds(action) {
     switch (action.kind) {
         case "call_provider": return [action.effectId];
@@ -61,6 +98,7 @@ export class RuntimeRunner {
     pendingObservations = [];
     activeKernel = null;
     currentSessionId = null;
+    fallbackPayloadStore = null;
     /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
     injectedSignals = [];
     /** Skill names whose content has already been pushed into the durable `knowledge` slot this
@@ -74,9 +112,7 @@ export class RuntimeRunner {
     nextArchiveStart = 0;
     pendingPageOutArchives = [];
     activePageOutArchive;
-    /** M5 v2.1: sub-workflow specs a top-level agent authored via `start_workflow`, awaiting auto-drive
-     *  at the next safe point (after the tool turn resolves, kernel back in Reason). */
-    pendingAuthoredWorkflows = [];
+    /** Provider continuation emitted after a canonical nested workflow completes. */
     workflowContinuation = null;
     constructor(opts) {
         this.opts = opts;
@@ -85,6 +121,44 @@ export class RuntimeRunner {
             throw new RangeError("workflowSchemaValidationAttempts must be an integer between 1 and 16");
         }
     }
+    resolveKernelJournal() {
+        const embedded = this.opts.sessionLog;
+        const journal = this.opts.kernelJournal ?? embedded.kernelJournal;
+        if (!journal) {
+            throw new Error("RuntimeOptions.kernelJournal is required when SessionLog has no canonical journal");
+        }
+        return journal;
+    }
+    async createCanonicalRuntime(runId = crypto.randomUUID(), sessionId = this.currentSessionId ?? "wasm-session") {
+        const { CanonicalKernel } = await getKernel();
+        return new CanonicalRunnerRuntime(new CanonicalKernel(), this.resolveKernelJournal(), `wasm-operation-${runId}`, {
+            maxContextTokens: this.opts.maxTokens,
+            maxTurns: this.opts.maxTurns,
+            maxTotalTokens: this.opts.maxTotalTokens,
+            maxWallMs: this.opts.timeoutMs,
+            memoryBindingId: `wasm-memory-${this.opts.agentId ?? "root"}`,
+            persistPayload: async (_callId, content, previewBytes) => {
+                const digest = canonicalSha256(content);
+                const payloadRef = `payload:${digest.replace(/^sha256:/, "").slice(0, 32)}`;
+                await this.payloadStore().persistPayload(sessionId, payloadRef, content);
+                return {
+                    payloadRef,
+                    digest,
+                    originalSize: String(new TextEncoder().encode(content).byteLength),
+                    preview: new TextDecoder().decode(new TextEncoder().encode(content).slice(0, previewBytes)),
+                };
+            },
+        });
+    }
+    async commitKernelApply(runtime, pending, event) {
+        return canonicalKernelApply(runtime, pending, event);
+    }
+    async commitKernelMaybeAction(runtime, pending, event) {
+        return canonicalKernelMaybeAction(runtime, pending, event);
+    }
+    async commitKernelAction(runtime, pending, event) {
+        return canonicalKernelAction(runtime, pending, event);
+    }
     get hostOptions() { return this.opts; }
     interrupt(reason = "user") {
         this.interrupted = true;
@@ -139,7 +213,7 @@ export class RuntimeRunner {
     async consumeInboundSignal(delivery, consume) {
         try {
             const observationStart = this.pendingObservations.length;
-            const result = consume(delivery);
+            const result = await consume(delivery);
             const dispositions = this.pendingObservations.slice(observationStart).filter(observation => observation.kind === "signal_delivery_disposed"
                 && observation.delivery_id === delivery.deliveryId
                 && observation.attempt === delivery.deliveryAttempt);
@@ -157,17 +231,32 @@ export class RuntimeRunner {
     }
     async *run(req) {
         const prior = req.inheritEvents ?? await this.opts.sessionLog.read(req.sessionId);
-        const midRun = isMidRun(prior);
+        const resumedStart = [...prior].reverse().find(entry => entry.event.kind === "run_started");
+        // Inherited parent events are transcript input for a fresh child operation, never recovery
+        // evidence for the child's own canonical journal.
+        let midRun = req.inheritEvents ? false : isMidRun(prior);
+        if (!midRun && resumedStart?.event.kind === "run_started" && !req.inheritEvents) {
+            const operationId = `wasm-operation-${resumedStart.event.run_id}`;
+            if (await this.resolveKernelJournal().head(operationId)) {
+                const authoritative = await this.createCanonicalRuntime(resumedStart.event.run_id, req.sessionId);
+                await authoritative.restore();
+                if (!authoritative.isTerminal())
+                    midRun = true;
+            }
+        }
         // Idempotent per session: an earlier run's `run_started` already carries these attachments
         // (same-session retry attempt), so replay reconstructs them — recording and seeding again
         // would double them in history. Deduping at the append keeps live and replay in agreement.
         const attachments = req.attachments?.length && !attachmentsAlreadySeeded(prior, req.attachments)
             ? req.attachments
             : undefined;
+        const runId = midRun && resumedStart?.event.kind === "run_started"
+            ? resumedStart.event.run_id
+            : crypto.randomUUID();
         if (!midRun) {
             await this.opts.sessionLog.append(req.sessionId, {
                 kind: "run_started",
-                run_id: crypto.randomUUID(),
+                run_id: runId,
                 goal: req.goal,
                 criteria: req.criteria ?? [],
                 agent_id: this.opts.agentId,
@@ -175,46 +264,42 @@ export class RuntimeRunner {
                 ...(attachments ? { attachments } : {}),
             });
         }
-        yield* this.execute(req.sessionId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments);
+        yield* this.execute(req.sessionId, runId, req.goal, req.criteria ?? [], req.extensions, prior.length > 0 ? prior : undefined, midRun, attachments);
     }
     async *wake(sessionId, extensions) {
         const events = await this.opts.sessionLog.read(sessionId);
-        if (events.some(e => e.event.kind === "run_terminal"))
-            return;
-        const startEntry = [...events].reverse().find(e => e.event.kind === "run_started");
+        const startIndex = events.reduce((latest, entry, index) => entry.event.kind === "run_started" ? index : latest, -1);
+        const startEntry = startIndex >= 0 ? events[startIndex] : undefined;
         if (!startEntry)
             throw new Error(`No run_started event for session: ${sessionId}`);
         const start = startEntry.event;
-        yield* this.execute(sessionId, start.goal, start.criteria, extensions, events, true, start.attachments);
+        const journalHead = await this.resolveKernelJournal().head(`wasm-operation-${start.run_id}`);
+        if (!journalHead) {
+            const projectedTail = events.slice(startIndex + 1);
+            if (projectedTail.some(e => e.event.kind === "run_terminal")) {
+                throw new Error("run_terminal projection has no canonical journal");
+            }
+            if (projectedTail.some(entry => entry.event.kind === "tool_requested" || entry.event.kind === "tool_completed")) {
+                throw new Error("restored canonical operation has no pending effect or terminal");
+            }
+        }
+        else {
+            const authoritative = await this.createCanonicalRuntime(start.run_id, sessionId);
+            await authoritative.restore();
+            if (authoritative.isTerminal())
+                return;
+        }
+        yield* this.execute(sessionId, start.run_id, start.goal, start.criteria, extensions, events, true, start.attachments);
     }
     async writeMemory(memory, sessionId) {
         if (!this.opts.dreamStore || !this.opts.agentId)
             return;
-        const kernel = await getKernel();
-        const runtime = new kernel.KernelRuntime({ maxTokens: this.opts.maxTokens, maxTurns: this.opts.maxTurns ?? 25 });
-        const observations = [];
-        const action = kernelMaybeAction(runtime, observations, { kind: "write_memory", memory });
-        if (!action) {
-            await this.appendMemorySyscallObservations(sessionId, observations);
-            return;
-        }
-        if (action.kind !== "persist_memory")
-            throw new Error(`write_memory returned unexpected kernel effect: ${action.kind}`);
-        let error;
         try {
-            await this.opts.dreamStore.upsert(this.opts.agentId, action.memory);
+            await this.opts.dreamStore.upsert(this.opts.agentId, memory);
         }
         catch (cause) {
-            error = formatToolError(cause);
+            throw new Error(formatToolError(cause));
         }
-        kernelApply(runtime, observations, {
-            kind: "memory_persist_result",
-            effect_id: action.effectId,
-            ...(error ? { error } : {}),
-        });
-        await this.appendMemorySyscallObservations(sessionId, observations);
-        if (error)
-            throw new Error(error);
     }
     async appendMemorySyscallObservations(sessionId, observations) {
         if (!sessionId)
@@ -231,10 +316,10 @@ export class RuntimeRunner {
      *  K1: `opts.key` gives the entry identity — a same-key push upserts (applied at the next
      *  compaction/renewal boundary) instead of appending a duplicate. `opts.pinned` exempts the
      *  entry from the knowledge-budget sweep. */
-    pushKnowledge(message, tokens, opts) {
+    async pushKnowledge(message, tokens, opts) {
         if (!this.activeKernel)
             return;
-        kernelApply(this.activeKernel, this.pendingObservations, {
+        await this.commitKernelApply(this.activeKernel, this.pendingObservations, {
             kind: "add_knowledge_message",
             content: message.content ?? "",
             tokens: tokens ?? Math.max(1, Math.ceil((message.content?.length ?? 0) / 4)),
@@ -242,19 +327,25 @@ export class RuntimeRunner {
             ...(opts?.pinned ? { pinned: true } : {}),
         });
     }
+    payloadStore() {
+        if (this.opts.payloadStore)
+            return this.opts.payloadStore;
+        this.fallbackPayloadStore ??= new PayloadStore();
+        return this.fallbackPayloadStore;
+    }
     /** K1: mark a keyed knowledge entry for removal at the next compaction/renewal boundary.
      *  Errs-open: an unknown key is a kernel-side no-op. */
-    removeKnowledge(key) {
+    async removeKnowledge(key) {
         if (!this.activeKernel)
             return;
-        kernelApply(this.activeKernel, this.pendingObservations, { kind: "remove_knowledge", key });
+        await this.commitKernelApply(this.activeKernel, this.pendingObservations, { kind: "remove_knowledge", key });
     }
     /** K3: host-driven skill deactivation — toolset re-widens at the next provider call, the
      *  skill's knowledge pin drops at the next boundary. Errs-open: not-active is a no-op. */
-    deactivateSkill(name) {
+    async deactivateSkill(name) {
         if (!this.activeKernel)
             return;
-        kernelApply(this.activeKernel, this.pendingObservations, { kind: "skill_deactivated", name });
+        await this.commitKernelApply(this.activeKernel, this.pendingObservations, { kind: "skill_deactivated", name });
         this.knowledgePushedSkills.delete(name);
     }
     async resolveKernelSuspend(requests, runtime, sessionId) {
@@ -334,63 +425,7 @@ export class RuntimeRunner {
         }
         return { approved, denied, events };
     }
-    /**
-     * O7: resolve a `read_result` meta-tool call to the full text of a previously-evicted tool
-     * output. Resolution order: (a) the result spool committed by `large_result_spool_result`,
-     * (b) a session-log scan for the original `tool_completed` event carrying that `call_id`.
-     * Slices the resolved text by `[offset, offset + maxBytes)` (plain string slice — "bytes-ish").
-     */
-    async resolveReadResult(sessionId, argsJson) {
-        let callId = "";
-        let offset = 0;
-        let maxBytes = 4000;
-        try {
-            const args = JSON.parse(argsJson || "{}");
-            callId = typeof args.call_id === "string" ? args.call_id : "";
-            if (typeof args.offset === "number" && Number.isFinite(args.offset))
-                offset = args.offset;
-            if (typeof args.max_bytes === "number" && Number.isFinite(args.max_bytes))
-                maxBytes = args.max_bytes;
-        }
-        catch {
-            // malformed arguments — callId stays empty, falls through to "not found" below
-        }
-        let full;
-        if (full === undefined && this.opts.resultSpool) {
-            try {
-                full = await this.opts.resultSpool.findByCallId(sessionId, callId);
-            }
-            catch {
-                full = undefined;
-            }
-        }
-        if (full === undefined) {
-            try {
-                const events = await this.opts.sessionLog.read(sessionId);
-                for (const { event } of events) {
-                    if (event.kind !== "tool_completed")
-                        continue;
-                    const match = event.results.find(r => r.call_id === callId);
-                    if (match)
-                        full = match.output;
-                }
-            }
-            catch {
-                full = undefined;
-            }
-        }
-        if (full === undefined) {
-            return { text: `no stored output for call_id "${callId}"`, isError: true };
-        }
-        const start = Math.max(0, offset);
-        const end = Math.min(full.length, start + Math.max(0, maxBytes));
-        const slice = full.slice(start, end);
-        return {
-            text: `[read_result ${callId}: chars ${start}–${end} of ${full.length}]\n${slice}`,
-            isError: false,
-        };
-    }
-    async *execute(sessionId, goal, criteria, extensions, priorEvents, resumeMidRun = false, attachments) {
+    async *execute(sessionId, runId, goal, criteria, extensions, priorEvents, resumeMidRun = false, attachments) {
         this.interrupted = false;
         this.cancellationReason = undefined;
         this.abortController = new AbortController();
@@ -398,164 +433,161 @@ export class RuntimeRunner {
         this.pendingPageOutArchives = [];
         this.activePageOutArchive = undefined;
         this.currentSessionId = sessionId;
-        const kernel = await getKernel();
         const ext = { ...this.opts.extensions, ...(extensions ?? {}) };
         const providerState = this.opts.provider.createRunState?.();
         let nextCompressedArchiveStart = nextArchivedSeqStart(priorEvents);
         const providerPolicy = this.opts.provider.runtimePolicy?.() ?? {};
         const effectiveMaxTurns = this.opts.maxTurns ?? providerPolicy.maxTurns ?? 25;
         const effectiveTimeoutMs = this.opts.timeoutMs ?? providerPolicy.timeoutMs;
-        const runtime = new kernel.KernelRuntime({
-            maxTokens: this.opts.maxTokens,
-            maxTurns: effectiveMaxTurns,
-            // M4/G5: per-node token cap → child run's cumulative token budget (wasm LoopPolicy.maxTotalTokens is f64).
-            ...(this.opts.maxTotalTokens !== undefined ? { maxTotalTokens: this.opts.maxTotalTokens } : {}),
-            timeoutMs: effectiveTimeoutMs,
-        });
+        const runtime = await this.createCanonicalRuntime(runId, sessionId);
+        if (resumeMidRun)
+            await runtime.restore();
         this.activeKernel = runtime;
-        if (this.opts.tokenizer) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "set_tokenizer",
-                name: this.opts.tokenizer,
-            });
-        }
-        if (this.opts.enablePlanTool !== undefined) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "set_plan_tool_enabled",
-                enabled: this.opts.enablePlanTool,
-            });
-        }
-        kernelApply(runtime, this.pendingObservations, {
-            kind: "set_tools",
-            tools: this.opts.executionPlane.schemas().map(toolSchemaToKernel),
-        });
-        if (this.opts.systemPrompt) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "add_system_message",
-                content: this.opts.systemPrompt,
-                tokens: Math.max(1, Math.ceil(this.opts.systemPrompt.length / 4)),
-            });
-        }
-        if (this.opts.initialMemory) {
-            for (const mem of this.opts.initialMemory) {
-                kernelApply(runtime, this.pendingObservations, {
-                    kind: "add_knowledge_message",
-                    content: mem,
-                    tokens: Math.max(1, Math.ceil(mem.length / 4)),
+        if (!resumeMidRun) {
+            if (this.opts.tokenizer) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "set_tokenizer",
+                    name: this.opts.tokenizer,
                 });
             }
-        }
-        if (this.opts.skillContentMap && this.opts.skillContentMap.size > 0) {
-            const metas = [...this.opts.skillContentMap.keys()].map(name => ({
-                name,
-                description: "",
-                estimatedTokens: 0,
-            }));
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "set_available_skills",
-                skills: metas.map(skillMetadataToKernel),
-            });
-        }
-        // P1-B/D: configure stable-core tool ids (always exposed under skill gating).
-        if (this.opts.stableCoreToolIds?.length) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "set_stable_core_tools",
-                tool_ids: this.opts.stableCoreToolIds,
-            });
-        }
-        if (this.opts.dreamStore && this.opts.agentId) {
-            kernelApply(runtime, this.pendingObservations, { kind: "set_memory_enabled", enabled: true });
-        }
-        if (this.opts.knowledgeSource) {
-            kernelApply(runtime, this.pendingObservations, { kind: "set_knowledge_enabled", enabled: true });
-        }
-        if (this.opts.milestoneContract) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "load_milestone_contract",
-                contract: {
-                    phases: this.opts.milestoneContract.phases.map(p => ({
-                        id: p.id,
-                        criteria: p.criteria ?? [],
-                        unlocks: p.unlocks ?? [],
-                        verifier: p.verifier ?? null,
-                        required_evidence: p.requiredEvidence ?? [],
-                    })),
-                },
-            });
-        }
-        const maxBytes = runtime.recoveryContentBytes();
-        if (priorEvents && priorEvents.length > 0) {
-            const repaired = repairEventsForRecovery(priorEvents, maxBytes);
-            seedProviderReplayFromEvents(this.opts.provider, repaired);
-            const replayed = await replayMessages(repaired, maxBytes, this.opts.compressionStore);
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "preload_history",
-                messages: replayed.map(messageToKernelMessage),
+            if (this.opts.enablePlanTool !== undefined) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "set_plan_tool_enabled",
+                    enabled: this.opts.enablePlanTool,
+                });
+            }
+            await this.commitKernelApply(runtime, this.pendingObservations, {
+                kind: "set_tools",
+                tools: this.opts.executionPlane.schemas().map(toolSchemaToKernel),
             });
-            // P1-B B3: rebuild active-skill gating after a wake (active_skills is not snapshotted).
-            // `knowledge` isn't snapshotted either (same graceful-reset philosophy) — best-effort re-push
-            // the skill's content from its replayed tool_result so the durable copy survives a wake too.
-            const toolResultByCallId = new Map();
-            for (const m of replayed) {
-                for (const part of m.contentParts ?? []) {
-                    if (part.type === "tool_result" && part.callId && part.output !== undefined) {
-                        toolResultByCallId.set(part.callId, part.output);
-                    }
+            if (this.opts.systemPrompt) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "add_system_message",
+                    content: this.opts.systemPrompt,
+                    tokens: Math.max(1, Math.ceil(this.opts.systemPrompt.length / 4)),
+                });
+            }
+            if (this.opts.initialMemory) {
+                for (const mem of this.opts.initialMemory) {
+                    await this.commitKernelApply(runtime, this.pendingObservations, {
+                        kind: "add_knowledge_message",
+                        content: mem,
+                        tokens: Math.max(1, Math.ceil(mem.length / 4)),
+                    });
                 }
             }
-            for (const m of replayed) {
-                for (const tc of m.toolCalls ?? []) {
-                    if (tc.name !== "skill")
-                        continue;
-                    try {
-                        const name = JSON.parse(tc.arguments || "{}").name;
-                        if (!name)
+            if (this.opts.skillContentMap && this.opts.skillContentMap.size > 0) {
+                const metas = [...this.opts.skillContentMap.keys()].map(name => ({
+                    name,
+                    description: "",
+                    estimatedTokens: 0,
+                }));
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "set_available_skills",
+                    skills: metas.map(skillMetadataToKernel),
+                });
+            }
+            // P1-B/D: configure stable-core tool ids (always exposed under skill gating).
+            if (this.opts.stableCoreToolIds?.length) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "set_stable_core_tools",
+                    tool_ids: this.opts.stableCoreToolIds,
+                });
+            }
+            if (this.opts.dreamStore && this.opts.agentId) {
+                await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_memory_enabled", enabled: true });
+            }
+            if (this.opts.knowledgeSource) {
+                await this.commitKernelApply(runtime, this.pendingObservations, { kind: "set_knowledge_enabled", enabled: true });
+            }
+            if (this.opts.milestoneContract) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "load_milestone_contract",
+                    contract: {
+                        phases: this.opts.milestoneContract.phases.map(p => ({
+                            id: p.id,
+                            criteria: p.criteria ?? [],
+                            unlocks: p.unlocks ?? [],
+                            verifier: p.verifier ?? null,
+                            required_evidence: p.requiredEvidence ?? [],
+                        })),
+                    },
+                });
+            }
+            const maxBytes = runtime.recoveryContentBytes();
+            if (priorEvents && priorEvents.length > 0) {
+                const replayed = await replayMessages(priorEvents, maxBytes, this.opts.compressionStore);
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "preload_history",
+                    messages: replayed.map(messageToKernelMessage),
+                });
+                // Re-pin replayed skill content into knowledge for the fresh operation. Activation itself is
+                // owned by canonical provider-result reduction; the host must not assert it separately.
+                const toolResultByCallId = new Map();
+                for (const m of replayed) {
+                    for (const part of m.contentParts ?? []) {
+                        if (part.type === "tool_result" && part.callId && part.output !== undefined) {
+                            toolResultByCallId.set(part.callId, part.output);
+                        }
+                    }
+                }
+                for (const m of replayed) {
+                    for (const tc of m.toolCalls ?? []) {
+                        if (tc.name !== "skill")
                             continue;
-                        kernelApply(runtime, this.pendingObservations, {
-                            kind: "skill_activated",
-                            name,
-                            ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
-                        });
-                        const output = toolResultByCallId.get(tc.id);
-                        if (output && !this.knowledgePushedSkills.has(name)) {
-                            this.knowledgePushedSkills.add(name);
-                            // K1: keyed — the kernel-side upsert is the authoritative dedup across wake replays.
-                            this.pushKnowledge({ role: "system", content: output }, undefined, { key: `skill:${name}` });
+                        try {
+                            const name = JSON.parse(tc.arguments || "{}").name;
+                            if (!name)
+                                continue;
+                            const output = toolResultByCallId.get(tc.id);
+                            if (output && !this.knowledgePushedSkills.has(name)) {
+                                this.knowledgePushedSkills.add(name);
+                                // K1: keyed — the kernel-side upsert is the authoritative dedup across wake replays.
+                                this.pushKnowledge({ role: "system", content: output }, undefined, { key: `skill:${name}` });
+                            }
                         }
+                        catch { /* skip */ }
                     }
-                    catch { /* skip */ }
                 }
             }
+            // Multimodal upload: seed attachments before the canonical root start (parity with Node/Python).
+            if (!resumeMidRun && attachments?.length) {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
+                    kind: "add_history_message",
+                    message: attachmentsToKernelMessage(attachments),
+                });
+            }
         }
-        // Multimodal upload: seed attachments before start_run (parity with Node/Python).
-        if (!resumeMidRun && attachments?.length) {
-            kernelApply(runtime, this.pendingObservations, {
-                kind: "add_history_message",
-                message: attachmentsToKernelMessage(attachments),
-            });
+        if (priorEvents && priorEvents.length > 0) {
+            seedProviderReplayFromEvents(this.opts.provider, priorEvents);
         }
         const sessionStart = Date.now();
-        const startPayload = {
-            kind: "start_run",
-            task: { goal, criteria },
-        };
-        // P0-A: lower an explicit `runSpec` and/or the `allowedToolIds` profile to the kernel's
-        // `capability_filter` (reuses the existing run_spec wire — no new ABI). Unset on both ⇒ no
-        // gating (铁律: no config = old behavior).
+        const startTask = { goal, criteria };
+        let startRunSpec;
+        // P0-A: lower an explicit `runSpec`, the `allowedToolIds` ceiling, and/or the `baselineToolIds`
+        // pre-activation surface to the kernel run spec (reuses the existing run_spec wire — no new
+        // ABI). Unset on all ⇒ no gating (铁律: no config = old behavior).
         const allowedToolIds = this.opts.allowedToolIds;
         const hasProfile = allowedToolIds !== undefined && allowedToolIds.length > 0;
-        if (this.opts.runSpec || hasProfile) {
+        // NOT the `length > 0` idiom above: `baselineToolIds: []` is the legitimate minimal surface
+        // (meta + stable-core only), so mere presence triggers the lowering.
+        const baselineToolIds = this.opts.baselineToolIds;
+        const hasBaseline = baselineToolIds !== undefined;
+        if (this.opts.runSpec || hasProfile || hasBaseline) {
             const baseSpec = this.opts.runSpec ?? {
                 identity: { agentId: this.opts.agentId ?? "root", sessionId, isSubAgent: false },
                 role: "custom",
                 goal,
             };
-            const spec = hasProfile
+            let spec = hasProfile
                 ? { ...baseSpec, capabilityFilter: { ...baseSpec.capabilityFilter, allowedIds: allowedToolIds } }
                 : baseSpec;
-            startPayload.run_spec = agentRunSpecToKernel(spec);
+            if (hasBaseline)
+                spec = { ...spec, exposureBaseline: baselineToolIds };
+            startRunSpec = agentRunSpecToKernel(spec);
         }
-        this.applyKernelPolicies(runtime);
+        if (!resumeMidRun)
+            await this.applyKernelPolicies(runtime);
         // I4: pre-fetch memory before the first LLM turn (mirrors Node). Strict dynamic context
         // control: single-use retrieval content, not a stable skill — lands in `history` like an
         // ordinary `memory` tool result, so it decays with the compression pyramid instead of
@@ -565,8 +597,8 @@ export class RuntimeRunner {
             await this.prefetchMemoryIntoHistory(runtime, "initial");
         }
         let action = resumeMidRun
-            ? kernelAction(runtime, this.pendingObservations, { kind: "resume" })
-            : kernelAction(runtime, this.pendingObservations, startPayload);
+            ? runtime.resumeAction() ?? (() => { throw new Error("restored canonical operation has no pending effect or terminal"); })()
+            : await canonicalStartAgent(runtime, this.pendingObservations, startTask, startRunSpec);
         // P0-C: the skill loaded and in effect going into the current turn → per-turn `activeSkill` metric.
         let activeSkill;
         // I0b: kernel-throw safety net — see Node runner for full rationale.
@@ -574,7 +606,7 @@ export class RuntimeRunner {
             while (!runtime.isTerminal()) {
                 nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
                 if (this.interrupted) {
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "cancel_operation",
                         reason: this.cancellationReason ?? "user",
                         pending_call_ids: pendingCallIds(action),
@@ -584,7 +616,7 @@ export class RuntimeRunner {
                 if (this.opts.signalSource || this.injectedSignals.length > 0) {
                     const delivery = await this.nextInboundSignal();
                     if (delivery) {
-                        const sigAction = await this.consumeInboundSignal(delivery, claimed => kernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
+                        const sigAction = await this.consumeInboundSignal(delivery, claimed => this.commitKernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
                         if (sigAction)
                             action = sigAction;
                         // Critical attention/preemption is distinct from operation cancellation.
@@ -593,12 +625,6 @@ export class RuntimeRunner {
                 if (runtime.isTerminal())
                     break;
                 if (action.kind === "call_provider") {
-                    // M5 v2.1: top-level auto-pivot at the safe point (kernel in Reason, not suspended). Loop-top
-                    // placement catches every path to `call_provider` (incl. post-approval-resume), so a queued
-                    // authored spec is never stranded. Drains the queue; fires once per authored batch.
-                    if (this.pendingAuthoredWorkflows.length > 0) {
-                        action = await this.driveAuthoredWorkflows(runtime, action);
-                    }
                     const providerEffectId = action.effectId;
                     const finalToolCalls = [];
                     let finalText = "";
@@ -669,7 +695,7 @@ export class RuntimeRunner {
                             // compacted context, or `done` to terminate with an honest `ContextOverflow`. The
                             // classify + compact + retry + give-up policy lives in the kernel (one place), not
                             // duplicated across the four SDK runners.
-                            action = kernelAction(runtime, this.pendingObservations, {
+                            action = await this.commitKernelAction(runtime, this.pendingObservations, {
                                 kind: "provider_error",
                                 effect_id: providerEffectId,
                                 message: formatToolError(err),
@@ -687,7 +713,7 @@ export class RuntimeRunner {
                     }
                     // #2-B-ii: stream aborted (preempt/interrupt) via the break path — end the turn now.
                     if (abortSignal?.aborted) {
-                        action = kernelAction(runtime, this.pendingObservations, {
+                        action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "cancel_operation",
                             reason: this.cancellationReason ?? "user",
                             pending_call_ids: [providerEffectId],
@@ -706,10 +732,9 @@ export class RuntimeRunner {
                         message: messageToKernelMessage(assistantMessage),
                         ...(turnInputTokens > 0 ? { observed_input_tokens: turnInputTokens } : {}),
                         ...(turnOutputTokens > 0 ? { observed_output_tokens: turnOutputTokens } : {}),
-                        now_ms: Date.now(),
                         ...(turnStopReason ? { stop_reason: turnStopReason } : {}),
                     };
-                    action = kernelAction(runtime, this.pendingObservations, providerEvent);
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
                     const providerReplay = peekProviderReplay(this.opts.provider, finalText, finalToolCalls);
                     await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
                         turn: runtime.turn(),
@@ -749,7 +774,7 @@ export class RuntimeRunner {
                     const resolved = await this.resolveKernelSuspend(action.requests, runtime, sessionId);
                     for (const evt of resolved.events)
                         yield evt;
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "approval_result",
                         effect_id: action.effectId,
                         approved_calls: resolved.approved,
@@ -766,7 +791,7 @@ export class RuntimeRunner {
                     catch (cause) {
                         error = formatToolError(cause);
                     }
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "memory_persist_result",
                         effect_id: action.effectId,
                         ...(error ? { error } : {}),
@@ -786,7 +811,7 @@ export class RuntimeRunner {
                         error = formatToolError(cause);
                     }
                     const obsStart = this.pendingObservations.length;
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "memory_query_result",
                         effect_id: action.effectId,
                         hits,
@@ -802,23 +827,6 @@ export class RuntimeRunner {
                         }
                     }
                 }
-                else if (action.kind === "spool_large_result") {
-                    const spool = this.opts.resultSpool ?? new LargeResultSpool();
-                    let spoolRef;
-                    let error;
-                    try {
-                        spoolRef = await spool.persistOutput(sessionId, action.callId, action.output);
-                    }
-                    catch (cause) {
-                        error = formatToolError(cause);
-                    }
-                    action = kernelAction(runtime, this.pendingObservations, {
-                        kind: "large_result_spool_result",
-                        effect_id: action.effectId,
-                        ...(spoolRef ? { spool_ref: spoolRef } : {}),
-                        ...(error ? { error } : {}),
-                    });
-                }
                 else if (action.kind === "archive_page_out") {
                     const archiveMeta = this.activePageOutArchive
                         ?? this.pendingPageOutArchives.shift()
@@ -830,6 +838,10 @@ export class RuntimeRunner {
                         if (this.opts.compressionStore) {
                             archiveRef = await this.opts.compressionStore.write(sessionId, archiveMeta.archiveStart, action.archived);
                         }
+                        if (action.payload) {
+                            archiveRef ??= `payload:${action.payload.digest.replace(/^sha256:/, "").slice(0, 32)}`;
+                            await this.payloadStore().persistPayload(sessionId, archiveRef, action.payload.content);
+                        }
                     }
                     catch (cause) {
                         error = formatToolError(cause);
@@ -839,7 +851,7 @@ export class RuntimeRunner {
                     const archiveTier = action.tier;
                     if (!error)
                         this.activePageOutArchive = undefined;
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "page_out_archive_result",
                         effect_id: action.effectId,
                         ...(archiveRef ? { archive_ref: archiveRef } : {}),
@@ -849,6 +861,25 @@ export class RuntimeRunner {
                         void this.archiveSemanticPageOut(archived, archiveAction);
                     }
                 }
+                else if (action.kind === "load_payload") {
+                    const content = await this.payloadStore().loadPayload(sessionId, action.payloadRef);
+                    action = content === undefined
+                        ? await this.commitKernelAction(runtime, this.pendingObservations, {
+                            kind: "payload_load_failed",
+                            effect_id: action.effectId,
+                            error: `payload not found for opaque locator ${action.payloadRef}`,
+                        })
+                        : await this.commitKernelAction(runtime, this.pendingObservations, {
+                            kind: "payload_loaded",
+                            effect_id: action.effectId,
+                            handle_id: action.handleId,
+                            payload: {
+                                content,
+                                digest: canonicalSha256(content),
+                                original_size: String(new TextEncoder().encode(content).byteLength),
+                            },
+                        });
+                }
                 else if (action.kind === "execute_tool") {
                     const toolEffectId = action.effectId;
                     const allCalls = action.calls;
@@ -863,55 +894,25 @@ export class RuntimeRunner {
                         onPermissionRequest: this.opts.onPermissionRequest,
                     };
                     const toolResults = [];
-                    // R3-1: intercept `submit_workflow_nodes` — it can't apply to this runner's kernel (when this
-                    // runner is a workflow node, the workflow lives in the parent). Surface the nodes as an event;
-                    // the orchestrator collects them and `runWorkflow` sends them to the parent kernel.
-                    // M5 v1: `start_workflow` (author a sub-workflow) flattens to the same append path.
+                    // Syscall tools are consumed by core from the provider result and must never escape as host
+                    // tool effects. Keep an explicit invariant check below so a projection drift fails closed.
                     const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes" || c.name === "start_workflow");
-                    // O7: `read_result` re-fetches a tool output the kernel evicted from context. Content is
-                    // host-resolved: (a) this turn's in-memory pending spool map, (b) the on-disk result spool,
-                    // (c) a session-log scan for the original `tool_completed` event.
-                    const readResultCalls = allCalls.filter(c => c.name === "read_result");
                     const planCalls = allCalls.filter(c => c.name === "update_plan");
-                    const normalCalls = allCalls.filter(c => c.name !== "submit_workflow_nodes" && c.name !== "start_workflow" && c.name !== "read_result"
+                    const normalCalls = allCalls.filter(c => c.name !== "submit_workflow_nodes" && c.name !== "start_workflow"
                         && c.name !== "update_plan");
                     // `update_plan` is a kernel meta-tool (exposed via `enablePlanTool`), not a registered
                     // plane tool — resolve it here as an `update_task` apply, mirroring the node/python runners.
                     for (const call of planCalls) {
                         const update = parseUpdatePlanArgs(call.arguments);
-                        kernelApply(runtime, this.pendingObservations, {
+                        await this.commitKernelApply(runtime, this.pendingObservations, {
                             kind: "update_task",
                             update: taskUpdateToKernel(update),
                         });
                         toolResults.push({ callId: call.id, output: "success", isError: false });
                         yield { type: "tool_result", callId: call.id, content: "success", isError: false };
                     }
-                    for (const call of readResultCalls) {
-                        const out = await this.resolveReadResult(sessionId, call.arguments);
-                        toolResults.push({ callId: call.id, output: out.text, isError: out.isError });
-                        yield { type: "tool_result", callId: call.id, content: out.text, isError: out.isError };
-                    }
                     for (const call of submitCalls) {
-                        // M5 v2.1: a TOP-LEVEL agent authoring a whole sub-workflow via `start_workflow` — record the
-                        // spec and AUTO-PIVOT once this tool turn resolves. A workflow-NODE's `start_workflow` (and
-                        // every `submit_workflow_nodes`) instead FLATTENS for the parent `runWorkflow` to append.
-                        if (call.name === "start_workflow" && !this.opts.isWorkflowNode) {
-                            const spec = parseStartWorkflowSpec(call.arguments);
-                            if (spec) {
-                                this.pendingAuthoredWorkflows.push(spec);
-                                const out = "workflow submitted for governance adjudication";
-                                toolResults.push({ callId: call.id, output: out, isError: false });
-                                yield { type: "tool_result", callId: call.id, content: out, isError: false };
-                                continue;
-                            }
-                        }
-                        const nodes = call.name === "start_workflow"
-                            ? parseStartWorkflowArgs(call.arguments)
-                            : parseSubmitWorkflowNodesArgs(call.arguments);
-                        yield { type: "workflow_nodes_submitted", nodes };
-                        const out = "workflow nodes submitted for parent governance adjudication";
-                        toolResults.push({ callId: call.id, output: out, isError: false });
-                        yield { type: "tool_result", callId: call.id, content: out, isError: false };
+                        throw new Error(`canonical kernel published model syscall ${call.name} as a host tool effect`);
                     }
                     // O5 (PreToolUse-hook analog): stateful host veto over each kernel-approved call.
                     // A blocked call never executes; its reason reaches the model as a denied result.
@@ -1030,9 +1031,10 @@ export class RuntimeRunner {
                             token_count: r.tokenCount,
                         })),
                     });
-                    // P1-B B3: a successfully-resolved `skill` call activates that skill for the next turn.
+                    // Canonical provider-result reduction activates a successfully resolved `skill` call. The
+                    // host only pins its METHOD content — how to do something — for later turns.
                     //
-                    // Strict dynamic context control: a skill is METHOD content — how to do something — reused
+                    // Strict dynamic context control: the skill text
                     // for the rest of the run, unlike a one-off memory/knowledge lookup (fact content, relevant
                     // for the moment it's used). So its text ALSO goes into the durable `knowledge` slot here
                     // (in addition to the ordinary tool_result already headed for `history`, where it will decay
@@ -1047,11 +1049,6 @@ export class RuntimeRunner {
                             const name = JSON.parse(call.arguments || "{}").name;
                             if (!name)
                                 continue;
-                            kernelApply(runtime, this.pendingObservations, {
-                                kind: "skill_activated",
-                                name,
-                                ...(this.opts.skillLeaseTurns !== undefined ? { lease_turns: this.opts.skillLeaseTurns } : {}),
-                            });
                             // With a lease configured, skip the Set optimization: an expired-then-reloaded skill
                             // must re-pin — only the kernel knows the lease state; its upsert dedupes anyway.
                             if (this.opts.skillLeaseTurns !== undefined || !this.knowledgePushedSkills.has(name)) {
@@ -1063,7 +1060,7 @@ export class RuntimeRunner {
                         catch { /* skip */ }
                     }
                     const entropyObsStart = this.pendingObservations.length;
-                    action = kernelAction(runtime, this.pendingObservations, {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "tool_results",
                         effect_id: toolEffectId,
                         results: toolResults.map(toolResultToKernel),
@@ -1094,9 +1091,11 @@ export class RuntimeRunner {
                     }
                 }
                 else if (action.kind === "evaluate_milestone") {
+                    const milestoneEffectId = action.effectId;
+                    const milestonePhaseId = action.phaseId;
                     const milestonePolicy = this.opts.milestonePolicy ?? "require_verifier";
                     if (milestonePolicy === "auto_pass") {
-                        action = kernelAction(runtime, this.pendingObservations, {
+                        action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "milestone_result",
                             effect_id: action.effectId,
                             result: milestoneCheckResultToKernel(milestoneCheckPass(action.phaseId)),
@@ -1109,7 +1108,7 @@ export class RuntimeRunner {
                             criteria: action.criteria ?? [],
                             requiredEvidence: action.requiredEvidence ?? [],
                         });
-                        action = kernelAction(runtime, this.pendingObservations, {
+                        action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "milestone_result",
                             effect_id: action.effectId,
                             result: milestoneCheckResultToKernel(check),
@@ -1117,6 +1116,17 @@ export class RuntimeRunner {
                         nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
                     }
                     else {
+                        // R-B27: resolve the effect before ending the run. Nothing here can attest the phase, but
+                        // the kernel is holding this milestone in its pending-effect table and only a matching
+                        // result removes it — a bare `return` leaves a dangling effect that a logical-checkpoint
+                        // recovery cannot resolve. Feed back the conservative "unverified" resolution: the wire
+                        // has no error field yet, so it rides as `passed: false`, which keeps the phase where it
+                        // is (fail-closed, no unlocks mounted). The run still ends as `milestone_pending`.
+                        await this.commitKernelAction(runtime, this.pendingObservations, {
+                            kind: "milestone_result",
+                            effect_id: milestoneEffectId,
+                            result: milestoneCheckResultToKernel(milestoneCheckFail(milestonePhaseId, MILESTONE_UNVERIFIED_REASON)),
+                        });
                         nextCompressedArchiveStart = await this.appendObservations(sessionId, runtime, nextCompressedArchiveStart);
                         const turnsUsed = Math.max(1, runtime.turn());
                         await this.opts.sessionLog.append(sessionId, buildRunTerminalEvent({
@@ -1130,9 +1140,31 @@ export class RuntimeRunner {
                         return;
                     }
                 }
+                else if (action.kind === "spawn_workflow") {
+                    await this.driveWorkflow(action, [], sessionId, runtime, new Map());
+                    action = runtime.resumeAction()
+                        ?? (() => { throw new Error("canonical workflow completed without a terminal or continuation"); })();
+                }
+                else if (action.kind === "unsupported_effect") {
+                    action = await this.commitKernelAction(runtime, this.pendingObservations, {
+                        kind: "unsupported_effect",
+                        effect_id: action.effectId,
+                        effect_kind: action.effectKind,
+                    });
+                }
                 else if (action.kind === "done") {
                     break;
                 }
+                else {
+                    // R-B28: fail-closed backstop. Without it an effect that reaches this position but has no
+                    // branch here (`spawn_workflow` / `preempt_sub_agents` are only driven inside the workflow
+                    // driver, and any effect kind a newer kernel adds) leaves `action` unreplaced and no event
+                    // in flight — `while (!runtime.isTerminal())` re-enters immediately and the run pins a core
+                    // at 100% forever while the kernel waits for a result that will never come. Terminating
+                    // through the loop's existing throw path makes the protocol mismatch visible instead
+                    // (run_terminal `error` + an `error` event) and cannot busy-wait.
+                    throw new Error(`unhandled kernel effect ${action.kind} in the main run loop`);
+                }
             }
         }
         catch (err) {
@@ -1207,54 +1239,6 @@ export class RuntimeRunner {
         this.activeKernel = null;
         this.currentSessionId = null;
     }
-    async spawnSubAgent(spec) {
-        if (!this.activeKernel || !this.currentSessionId) {
-            throw new Error("spawnSubAgent requires an active parent run");
-        }
-        const parentSessionId = this.currentSessionId;
-        const runtime = this.activeKernel;
-        const observations = kernelApply(runtime, this.pendingObservations, {
-            kind: "spawn_sub_agent",
-            spec: agentRunSpecToKernel(spec),
-            parent_session_id: parentSessionId,
-        });
-        this.nextArchiveStart = await this.appendObservations(parentSessionId, runtime, this.nextArchiveStart);
-        const spawned = findSpawnProcessObservation(observations);
-        if (!spawned) {
-            const rejected = controlRequestRejection(observations, "spawn_sub_agent");
-            if (rejected) {
-                return {
-                    agentId: rejected.subject ?? spec.identity.agentId,
-                    result: {
-                        termination: "error",
-                        finalMessage: {
-                            role: "assistant",
-                            content: `spawn_sub_agent denied: ${rejected.reason}`,
-                            toolCalls: [],
-                        },
-                        turnsUsed: 0,
-                        totalTokensUsed: 0,
-                    },
-                };
-            }
-            throw new Error("spawn_sub_agent did not emit agent_process_changed");
-        }
-        const manifest = spawnObservationToManifest(spawned, spec, parentSessionId);
-        const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
-        const result = await orchestrator.run({
-            parentOpts: this.opts,
-            parentSessionId,
-            spec,
-            manifest,
-            sessionLog: this.opts.sessionLog,
-            toolAccess: spec.toolAccess,
-        });
-        kernelApply(runtime, this.pendingObservations, {
-            kind: "sub_agent_completed",
-            result: subAgentResultToKernel(result),
-        });
-        return result;
-    }
     /**
      * G3: run one workflow node, enforcing its `output_schema` (if any) by instructing the agent,
      * validating its output (the supported JSON-Schema subset), and re-running once with the errors
@@ -1281,7 +1265,8 @@ export class RuntimeRunner {
             spec: { ...baseSpec, goal: withBudget(goal) },
             manifest,
             sessionLog: this.opts.sessionLog,
-            // M5 v2.1: this child IS a workflow node — its `start_workflow` flattens to this kernel.
+            // This child is a workflow node, so capability resolution applies workflow-node quarantine
+            // semantics instead of treating it as an independently spawned agent.
             isWorkflowNode: true,
             // W-N1: trusted workflow nodes run on the parent's execution plane (they carry no grant list
             // by design — filtering on the missing list ran every DAG node TOOL-LESS); quarantined nodes
@@ -1386,11 +1371,11 @@ export class RuntimeRunner {
      */
     /**
      * Lower the declarative governance / attention / scheduler-budget / resource-quota / memory policies
-     * into a freshly-created kernel. Shared by `execute()` (full run) and `bootstrapWorkflowKernel()`
+     * into a freshly-created kernel. Shared by `execute()` (full run) and `initializeWorkflowKernel()`
      * (standalone workflow) so a DAG's node spawns are gated and quota'd exactly as a mid-run spawn.
-     * Must run BEFORE `start_run`. No config ⇒ native-profile defaults.
+     * Must run before the canonical root start. No config ⇒ native-profile defaults.
      */
-    applyKernelPolicies(runtime) {
+    async applyKernelPolicies(runtime) {
         const osProfile = assertNativeProfile(this.opts.osProfile ?? "native");
         const signalPolicy = this.opts.signalPolicy ?? osProfile.signalPolicy;
         const governancePolicy = this.opts.governancePolicy ?? osProfile.governancePolicy;
@@ -1420,21 +1405,7 @@ export class RuntimeRunner {
             config.scheduler_policy = schedulerPolicyToKernel(this.opts.schedulerPolicy);
         }
         if (this.opts.kernelReliability) {
-            const r = this.opts.kernelReliability;
-            config.reliability = {
-                ...(r.eventReplayCapacity !== undefined ? { event_replay_capacity: r.eventReplayCapacity } : {}),
-                ...(r.completedEffectReplayCapacity !== undefined ? { completed_effect_replay_capacity: r.completedEffectReplayCapacity } : {}),
-                ...(r.providerRecoveryAttempts !== undefined ? { provider_recovery_attempts: r.providerRecoveryAttempts } : {}),
-                ...(r.outputRecoveryAttempts !== undefined ? { output_recovery_attempts: r.outputRecoveryAttempts } : {}),
-                ...(r.hostEffectRetryAttempts !== undefined ? { host_effect_retry_attempts: r.hostEffectRetryAttempts } : {}),
-                ...(r.spoolThresholdBytes !== undefined ? { spool_threshold_bytes: r.spoolThresholdBytes } : {}),
-                ...(r.spoolPreviewBytes !== undefined ? { spool_preview_bytes: r.spoolPreviewBytes } : {}),
-                ...(r.snapshotInputLimit !== undefined ? { snapshot_input_limit: r.snapshotInputLimit } : {}),
-                ...(r.maxInputBytes !== undefined ? { max_input_bytes: r.maxInputBytes } : {}),
-                ...(r.snapshotJournalBytesLimit !== undefined
-                    ? { snapshot_journal_bytes_limit: r.snapshotJournalBytesLimit }
-                    : {}),
-            };
+            config.reliability = kernelReliabilityToKernel(this.opts.kernelReliability);
         }
         if (this.opts.resourceQuota) {
             const q = this.opts.resourceQuota;
@@ -1458,6 +1429,11 @@ export class RuntimeRunner {
         if (this.opts.criteriaGate !== undefined) {
             config.criteria_gate = this.opts.criteriaGate;
         }
+        // P1: fail-closed dispatch selector (absent ⇒ kernel default "exposed"). "registered" is the
+        // escape hatch back to permissive dispatch; the kernel rejects any other value.
+        if (this.opts.toolDispatchGate !== undefined) {
+            config.tool_dispatch_gate = this.opts.toolDispatchGate;
+        }
         // K2: knowledge budget ratio (absent ⇒ kernel default 0.25; 0 disables).
         if (this.opts.knowledgeBudgetRatio !== undefined) {
             config.knowledge_budget_ratio = this.opts.knowledgeBudgetRatio;
@@ -1473,54 +1449,30 @@ export class RuntimeRunner {
                 ...(ew.notifyModel !== undefined ? { notify_model: ew.notifyModel } : {}),
             };
         }
-        kernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
+        await this.commitKernelApply(runtime, this.pendingObservations, { kind: "configure_run", config });
         if (this.opts.memoryPolicy) {
-            const m = this.opts.memoryPolicy;
-            kernelApply(runtime, this.pendingObservations, {
+            await this.commitKernelApply(runtime, this.pendingObservations, {
                 kind: "set_memory_policy",
-                ...(m.memoryPath !== undefined ? { memory_path: m.memoryPath } : {}),
-                ...(m.staleWarningDays !== undefined ? { stale_warning_days: m.staleWarningDays } : {}),
-                ...(m.retrievalTopK !== undefined ? { retrieval_top_k: m.retrievalTopK } : {}),
-                ...(m.validationEnabled !== undefined ? { validation_enabled: m.validationEnabled } : {}),
-                ...(m.maxContentBytes !== undefined ? { max_content_bytes: m.maxContentBytes } : {}),
-                ...(m.maxNameLength !== undefined ? { max_name_length: m.maxNameLength } : {}),
+                ...memoryPolicyToKernel(this.opts.memoryPolicy),
             });
         }
     }
     /**
-     * Bootstrap a standalone kernel for a host-driven workflow with no active parent run — the path a
-     * stateless handler (browser/edge worker) takes when it calls `runWorkflow(spec)` directly. Mirrors
-     * `execute()`'s pre-run setup (policies via `applyKernelPolicies`, then `start_run`) and records a
-     * best-effort `run_started` so the run is resumable. `runWorkflow` tears the kernel down afterward.
+     * Bootstrap a standalone kernel for a host-driven workflow with no active parent run. The caller
+     * durably records `run_started` with the same `runId` before this method can create journal state.
+     * `StartOperation { Workflow }` is the sole root transition; `runWorkflow` tears the kernel down.
      */
-    async bootstrapWorkflowKernel(sessionId, spec) {
+    async initializeWorkflowKernel(sessionId, runId) {
         this.interrupted = false;
         this.cancellationReason = undefined;
+        this.abortController = new AbortController();
         this.pendingObservations = [];
         this.pendingPageOutArchives = [];
         this.activePageOutArchive = undefined;
         this.currentSessionId = sessionId;
-        const kernel = await getKernel();
-        const runtime = new kernel.KernelRuntime({
-            maxTokens: this.opts.maxTokens,
-            maxTurns: this.opts.maxTurns ?? 25,
-            ...(this.opts.maxTotalTokens !== undefined ? { maxTotalTokens: this.opts.maxTotalTokens } : {}),
-            timeoutMs: this.opts.timeoutMs,
-        });
+        const runtime = await this.createCanonicalRuntime(runId, sessionId);
         this.activeKernel = runtime;
-        const goal = `workflow:${spec.nodes.length} nodes`;
-        void Promise.resolve(this.opts.sessionLog.append(sessionId, {
-            kind: "run_started",
-            run_id: crypto.randomUUID(),
-            goal,
-            criteria: [],
-            ...(this.opts.agentId ? { agent_id: this.opts.agentId } : {}),
-        })).catch(() => { });
-        this.applyKernelPolicies(runtime);
-        kernelAction(runtime, this.pendingObservations, {
-            kind: "start_run",
-            task: { goal: `workflow session ${sessionId}`, criteria: [] },
-        });
+        await this.applyKernelPolicies(runtime);
         return runtime;
     }
     async runWorkflow(spec, opts) {
@@ -1529,94 +1481,51 @@ export class RuntimeRunner {
         // Mid-run callers keep the original in-place behavior with no teardown.
         const bootstrapped = !this.activeKernel || !this.currentSessionId;
         if (bootstrapped) {
-            await this.bootstrapWorkflowKernel(opts?.sessionId ?? `wf-${crypto.randomUUID()}`, spec);
+            const sessionId = opts?.sessionId ?? `wf-${crypto.randomUUID()}`;
+            const runId = crypto.randomUUID();
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "run_started",
+                run_id: runId,
+                goal: `workflow:${spec.nodes.length} nodes`,
+                criteria: [],
+                ...(this.opts.agentId ? { agent_id: this.opts.agentId } : {}),
+            });
+            await this.initializeWorkflowKernel(sessionId, runId);
         }
         const parentSessionId = this.currentSessionId;
         const runtime = this.activeKernel;
         try {
             const observationStart = this.pendingObservations.length;
-            const initialAction = kernelMaybeAction(runtime, this.pendingObservations, {
-                kind: "load_workflow",
-                spec: workflowSpecToKernel(spec),
-                parent_session_id: parentSessionId,
-                // Exact typed terminal outcomes plus control-flow signals recovered from the journal.
-                ...(opts?.resumedOutcomes?.length
-                    ? {
-                        resumed_outcomes: opts.resumedOutcomes.map(r => ({
-                            agent_id: r.agentId,
-                            status: r.status,
-                            termination: r.termination,
-                            ...(r.output ? { output: messageToKernelMessage(r.output) } : {}),
-                            ...(r.classifyBranch !== undefined ? { classify_branch: r.classifyBranch } : {}),
-                            ...(r.tournamentWinner !== undefined ? { tournament_winner: r.tournamentWinner } : {}),
-                            ...(r.loopContinue !== undefined ? { loop_continue: r.loopContinue } : {}),
-                        })),
-                    }
-                    : {}),
-                // R3-1: re-apply recorded runtime submissions so dynamically-appended nodes are reconstructed.
-                ...(opts?.resumedSubmissions && opts.resumedSubmissions.length ? { resumed_submissions: opts.resumedSubmissions } : {}),
-                ...(opts?.resumedSubmissionBases && opts.resumedSubmissionBases.length ? { resumed_submission_bases: opts.resumedSubmissionBases } : {}),
-            });
+            const initialAction = await canonicalStartWorkflow(runtime, this.pendingObservations, workflowSpecToKernel(spec));
             const observations = this.pendingObservations.slice(observationStart);
-            return await this.driveWorkflow(initialAction, observations, parentSessionId, runtime, recoveredOutputs(opts?.resumedOutcomes));
+            const outcome = await this.driveWorkflow(initialAction, observations, parentSessionId, runtime, new Map());
+            if (bootstrapped) {
+                let terminal = runtime.resumeAction();
+                if (!terminal)
+                    throw new Error("completed canonical workflow has no terminal action");
+                if (terminal.kind !== "done" && this.interrupted) {
+                    terminal = await this.commitKernelAction(runtime, this.pendingObservations, {
+                        kind: "cancel_operation",
+                        effect_id: terminal.effectId,
+                        reason: this.cancellationReason ?? "user",
+                    });
+                }
+                if (terminal.kind !== "done") {
+                    throw new Error("canonical workflow did not produce a terminal kernel action");
+                }
+                await this.appendObservations(parentSessionId, runtime, 0);
+            }
+            return outcome;
         }
         finally {
             if (bootstrapped) {
                 this.activeKernel = null;
                 this.currentSessionId = null;
+                this.abortController = null;
                 this.pendingObservations = [];
             }
         }
     }
-    /**
-     * M5/G1: bootstrap an **agent-authored** workflow ("the model writes its own harness"). Routes the
-     * spec through the agent-reachable `Syscall::LoadWorkflow` (`submit_workflow`): with no workflow
-     * active the kernel bootstraps the DAG, else it flattens onto the running one (bootstrap-or-flatten —
-     * one kernel, one quota). The same shared driver runs the resulting batches.
-     */
-    async bootstrapWorkflow(spec, opts) {
-        if (!this.activeKernel || !this.currentSessionId) {
-            throw new Error("bootstrapWorkflow requires an active parent run");
-        }
-        const parentSessionId = this.currentSessionId;
-        const runtime = this.activeKernel;
-        const observationStart = this.pendingObservations.length;
-        const initialAction = kernelMaybeAction(runtime, this.pendingObservations, submitWorkflowToKernel(spec, parentSessionId, opts?.submitterAgentId));
-        const observations = this.pendingObservations.slice(observationStart);
-        // W-3: persist the agent-authored batch (bootstrap base 0 / flatten base N — the kernel now
-        // announces BOTH) so an interrupted authored workflow reconstructs on resume; the host never
-        // had this spec, unlike the `runWorkflow` path.
-        const submitted = observations.find(o => o.kind === "workflow_nodes_submitted");
-        if (submitted) {
-            await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
-                turn: runtime.turn(),
-                nodes: workflowSpecToKernel(spec).nodes ?? [],
-                baseIndex: submitted.base,
-                submitterAgentId: opts?.submitterAgentId,
-            }));
-        }
-        return this.driveWorkflow(initialAction, observations, parentSessionId, runtime);
-    }
-    /**
-     * M5 v2.1: drive the sub-workflow(s) a top-level agent authored via `start_workflow`, at the safe
-     * point (tool turn resolved → kernel in Reason). Each runs in THIS kernel (the kernel resumes the
-     * reason loop on `workflow_completed`), then the outcome is injected as a user message and a fresh
-     * `call_provider` is synthesized from the updated context (the workflow drive consumed its own
-     * kernel actions — same re-render pattern as the reactive-compact retry path).
-     */
-    async driveAuthoredWorkflows(runtime, action) {
-        const specs = this.pendingAuthoredWorkflows;
-        this.pendingAuthoredWorkflows = [];
-        this.workflowContinuation = null;
-        for (const spec of specs) {
-            await this.bootstrapWorkflow(spec);
-        }
-        const continuation = this.workflowContinuation;
-        if (!continuation) {
-            throw new Error("authored workflow completed without a provider continuation");
-        }
-        return continuation;
-    }
     /**
      * #2-B-ii: while a workflow batch is in flight, poll the signal source; a Critical `InterruptNow`
      * routes through the kernel (root in `SubAgentAwait` → preempt → `AgentPreempted` + tears the
@@ -1637,14 +1546,14 @@ export class RuntimeRunner {
                 continue;
             }
             const observationStart = this.pendingObservations.length;
-            const signalAction = await this.consumeInboundSignal(delivery, claimed => kernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
+            const signalAction = await this.consumeInboundSignal(delivery, claimed => this.commitKernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
             if (signalAction) {
                 if (signalAction.kind !== "preempt_sub_agents") {
                     throw new Error(`workflow signal returned unexpected effect: ${signalAction.kind}`);
                 }
                 for (const id of signalAction.agentIds)
                     controllers.get(id)?.abort();
-                const continuation = kernelMaybeAction(runtime, this.pendingObservations, {
+                const continuation = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
                     kind: "preempt_result", effect_id: signalAction.effectId,
                 });
                 if (continuation && continuation.kind !== "call_provider" && continuation.kind !== "done") {
@@ -1663,17 +1572,16 @@ export class RuntimeRunner {
         return null;
     }
     /**
-     * Shared workflow driver for `runWorkflow` (host `load_workflow`) and `bootstrapWorkflow` (agent
-     * `submit_workflow`): run each kernel-emitted batch in parallel, feed completions back (appending any
-     * agent-submitted nodes first), and loop until the kernel reports the workflow complete.
+     * Shared canonical workflow driver: run each kernel-emitted batch in parallel, feed completions
+     * back, and loop until the kernel reports the workflow complete.
      */
     async driveWorkflow(initialAction, initial, parentSessionId, runtime, seedOutputs) {
         const observations = initial;
         const orchestrator = this.opts.subAgentOrchestrator ?? defaultSubAgentOrchestrator;
         const findDone = (obs) => obs.find(o => o.kind === "workflow_completed");
-        const acceptSpawn = (spawn) => {
+        const acceptSpawn = async (spawn) => {
             const observationStart = this.pendingObservations.length;
-            const continuation = kernelMaybeAction(runtime, this.pendingObservations, {
+            const continuation = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
                 kind: "workflow_spawn_result",
                 effect_id: spawn.effectId,
                 started_agent_ids: spawn.nodes.map(node => String(node.agent_id ?? "")),
@@ -1701,7 +1609,7 @@ export class RuntimeRunner {
         }
         let nodes = initialAction.nodes;
         let budget = initialAction.budget;
-        acceptSpawn(initialAction);
+        await acceptSpawn(initialAction);
         // G2: each completed node's output, keyed by agent id — a reduce node reads its deps' outputs.
         // W-1: on resume it is pre-seeded from the persisted node outputs, so post-resume dependents
         // still see their (pre-crash) dependencies' outputs.
@@ -1709,6 +1617,13 @@ export class RuntimeRunner {
         for (;;) {
             if (nodes.length === 0)
                 return { nodeOutcomes: [], outputs: Object.fromEntries(outputs) };
+            for (const node of nodes) {
+                const dependencyOutputs = node.dependency_outputs ?? {};
+                for (const [agentId, output] of Object.entries(dependencyOutputs)) {
+                    if (!outputs.has(agentId))
+                        outputs.set(agentId, output);
+                }
+            }
             const roundBudget = budget;
             // #2-B-ii: per-node abort controllers + a concurrent preemption monitor (see node runner).
             const controllers = new Map(nodes.map(n => [n.agent_id, new AbortController()]));
@@ -1732,55 +1647,8 @@ export class RuntimeRunner {
                 const stableId = result.agentId.replace(/-i\d+$/, "");
                 if (stableId !== result.agentId)
                     outputs.set(stableId, outText);
-                // R3-1: if this node's agent submitted more nodes, append them to the parent DAG BEFORE
-                // reporting the node's completion — the workflow is still active, so even a last-node
-                // submission keeps the DAG alive.
-                if (result.submittedNodes?.length) {
-                    // G1: stamp the submitting node's agent id so the kernel coerces a quarantined submitter's
-                    // nodes to quarantined (no topological privilege escalation).
-                    const submitEvent = submitWorkflowNodesToKernel(result.submittedNodes, result.agentId);
-                    const observationStart = this.pendingObservations.length;
-                    const submitAction = kernelMaybeAction(runtime, this.pendingObservations, submitEvent);
-                    const subObs = this.pendingObservations.slice(observationStart);
-                    const nodesRejected = subObs.find(observation => observation.kind === "nodes_rejected");
-                    const rejected = controlRequestRejection(subObs, "submit_workflow_nodes")
-                        ?? (nodesRejected
-                            ? { operation: "submit_workflow_nodes", reason: String(nodesRejected.reason ?? "request denied") }
-                            : undefined);
-                    if (rejected) {
-                        const denial = `workflow node submission denied: ${rejected.reason}`;
-                        result.result = {
-                            ...result.result,
-                            termination: "error",
-                            finalMessage: { role: "assistant", content: denial, toolCalls: [] },
-                        };
-                        outputs.set(result.agentId, denial);
-                        if (stableId !== result.agentId)
-                            outputs.set(stableId, denial);
-                    }
-                    if (submitAction?.kind === "spawn_workflow") {
-                        nextNodes.push(...submitAction.nodes);
-                        budget = submitAction.budget ?? budget;
-                        acceptSpawn(submitAction);
-                    }
-                    else if (submitAction) {
-                        throw new Error(`workflow node submission returned unexpected effect: ${submitAction.kind}`);
-                    }
-                    // R3-1: persist the submission (kernel-shape nodes) + its kernel-reported base index
-                    // so resume can re-apply the batch at the exact original graph position. W-N3: also the
-                    // submitter, so resume drops batches whose submitter re-runs (it will re-submit).
-                    const submitted = subObs.find(o => o.kind === "workflow_nodes_submitted");
-                    if (submitted) {
-                        await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
-                            turn: runtime.turn(),
-                            nodes: submitEvent.nodes ?? [],
-                            baseIndex: submitted.base,
-                            submitterAgentId: result.agentId,
-                        }));
-                    }
-                }
                 const observationStart = this.pendingObservations.length;
-                const completionAction = kernelMaybeAction(runtime, this.pendingObservations, {
+                const completionAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
                     kind: "sub_agent_completed",
                     result: subAgentResultToKernel(result),
                 });
@@ -1788,14 +1656,31 @@ export class RuntimeRunner {
                 if (completionAction?.kind === "spawn_workflow") {
                     nextNodes.push(...completionAction.nodes);
                     budget = completionAction.budget ?? budget;
-                    obs = [...obs, ...acceptSpawn(completionAction)];
+                    obs = [...obs, ...await acceptSpawn(completionAction)];
                 }
                 else if (completionAction?.kind === "call_provider") {
                     this.workflowContinuation = completionAction;
                 }
+                else if (completionAction?.kind === "done") {
+                    // The correlated child completion may terminalize the workflow in the same canonical
+                    // step. Its workflow_completed observation below remains the typed outcome source.
+                }
                 else if (completionAction) {
                     throw new Error(`workflow completion returned unexpected effect: ${completionAction.kind}`);
                 }
+                // Child-authored DAG additions are admitted only as part of the canonical child-completion
+                // resolution. Persist the projection only after core reports the admitted base index.
+                if (result.submittedNodes?.length) {
+                    const submitted = obs.find(o => o.kind === "workflow_nodes_submitted");
+                    if (submitted) {
+                        await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
+                            turn: runtime.turn(),
+                            nodes: result.submittedNodes.map(workflowNodeSpecToKernel),
+                            baseIndex: submitted.base,
+                            submitterAgentId: result.agentId,
+                        }));
+                    }
+                }
                 const d = findDone(obs);
                 if (d)
                     done = d;
@@ -1822,38 +1707,6 @@ export class RuntimeRunner {
             nodes = nextNodes;
         }
     }
-    /**
-     * Resume a workflow from the parent session's completed nodes.
-     * Reads the session log, extracts completed workflow node records (with their W-1 control
-     * signals + outputs), and calls runWorkflow so the kernel skips those nodes, replays control
-     * flow (classify prune / loop stop), and the driver re-seeds its outputs map.
-     */
-    async resumeWorkflow(spec, opts) {
-        // Standalone resume: a stateless handler passes the prior `sessionId`; mid-run callers omit it.
-        const sessionId = opts?.sessionId ?? this.currentSessionId;
-        if (!sessionId) {
-            throw new Error("resumeWorkflow requires an active parent run or an explicit sessionId");
-        }
-        const events = await this.opts.sessionLog.read(sessionId);
-        const resumedOutcomes = recoverWorkflowNodeOutcomes(events);
-        const completedIds = new Set(resumedOutcomes.map(r => r.agentId));
-        const recovered = recoverSubmittedWorkflowNodes(events);
-        // W-N3: DROP batches whose submitter did NOT complete — that node re-runs on resume and will
-        // re-submit its batch; replaying the logged copy too would duplicate its nodes in the DAG.
-        // Exact bases keep later graph indices stable while dropped slots remain inert placeholders.
-        let { submissions, bases } = recovered;
-        if (submissions.length > 0) {
-            const keep = recovered.submitters.map(s => s === undefined || completedIds.has(s));
-            submissions = submissions.filter((_, i) => keep[i]);
-            bases = bases.filter((_, i) => keep[i]);
-        }
-        return this.runWorkflow(spec, {
-            resumedOutcomes,
-            resumedSubmissions: submissions,
-            resumedSubmissionBases: bases,
-            sessionId,
-        });
-    }
     async appendObservations(sessionId, runtime, nextArchiveStart) {
         const turn = runtime.turn();
         const preservedRefs = runtime.preservedRefs();
@@ -1909,7 +1762,7 @@ export class RuntimeRunner {
                 }
             }
             if (lines.length > 0) {
-                kernelApply(runtime, this.pendingObservations, {
+                await this.commitKernelApply(runtime, this.pendingObservations, {
                     kind: "add_history_message",
                     message: { role: "user", content: lines.join("\n") },
                 });
@@ -2093,72 +1946,6 @@ function parseUpdatePlanArgs(argsStr) {
             : parsed.blocked_on,
     };
 }
-/** R3-1: parse `submit_workflow_nodes` tool args (`{ nodes: WorkflowNodeSpec[] }`). Node shapes are
- *  trusted structurally; the kernel validates them on append. Malformed payload → no nodes. */
-function parseSubmitWorkflowNodesArgs(argsStr) {
-    let parsed = {};
-    try {
-        parsed = JSON.parse(argsStr);
-    }
-    catch {
-        // Ignore parse error → no nodes submitted.
-    }
-    return Array.isArray(parsed.nodes) ? parsed.nodes : [];
-}
-/** M5 v1: parse `start_workflow` tool args (`{ spec: { nodes: WorkflowNodeSpec[] } }`) into the
- *  spec's node batch — flattened onto the running workflow via the same append path. */
-function parseStartWorkflowArgs(argsStr) {
-    let parsed = {};
-    try {
-        parsed = JSON.parse(argsStr);
-    }
-    catch {
-        // Ignore parse error → no nodes.
-    }
-    const spec = parsed.spec;
-    return Array.isArray(spec?.nodes) ? spec.nodes : [];
-}
-/** M5 v2.1: parse the full `WorkflowSpec` from a top-level `start_workflow` call for the auto-pivot
- *  drive. Returns `undefined` on a malformed / empty payload (caller falls back to the flatten path). */
-function parseStartWorkflowSpec(argsStr) {
-    try {
-        const parsed = JSON.parse(argsStr);
-        if (Array.isArray(parsed.spec?.nodes) && parsed.spec.nodes.length > 0) {
-            return { nodes: parsed.spec.nodes };
-        }
-    }
-    catch {
-        // Ignore parse error → undefined (fall back to flatten).
-    }
-    return undefined;
-}
-/** M5 v2.1: render an authored-workflow outcome into a user-message note injected back into the
- *  agent's context, so its next turn continues with the sub-workflow's results in view. */
-function recoveredOutputs(outcomes) {
-    const outputs = new Map();
-    for (const outcome of outcomes ?? []) {
-        if (!outcome.output)
-            continue;
-        outputs.set(outcome.agentId, outcome.output.content);
-        outputs.set(outcome.agentId.replace(/-i\d+$/, ""), outcome.output.content);
-    }
-    return outputs;
-}
-function authoredWorkflowOutcomeNote(outcome) {
-    const counts = new Map();
-    for (const node of outcome.nodeOutcomes)
-        counts.set(node.status, (counts.get(node.status) ?? 0) + 1);
-    const lines = [
-        `[authored workflow result] ${outcome.nodeOutcomes.length} terminal node(s): ` +
-            [...counts.entries()].map(([status, count]) => `${count} ${status}`).join(", ") + ".",
-    ];
-    for (const node of outcome.nodeOutcomes) {
-        const out = outcome.outputs[node.nodeId] ?? node.output?.content;
-        if (out)
-            lines.push(`- ${node.nodeId} (${node.status}): ${out.length > 500 ? out.slice(0, 500) + "…" : out}`);
-    }
-    return lines.join("\n");
-}
 /** Lower a claimed signal delivery to the kernel's `deliver_signal` input event. Shared by the main
  *  loop's per-turn poll and #2-B-ii's workflow-batch preemption monitor (so the two never drift). */
 function signalToKernelEvent(delivery) {