@deepstrike/wasm 0.2.74 → 0.2.76

package/dist/runtime/runner.js

@@ -1,16 +1,20 @@
 import { prepareProviderRequest } from "../providers/prepared-request.js";
 import { createNativeContextPreparationAdapter } from "./context.js";
+import { sha256Hex } from "./sha256.js";
 import { extractSessionMemories } from "../memory/extraction.js";
 import { resolvePermissionRequest } from "./execution-plane.js";
-import { governancePolicyToKernelEvent, governanceFilterSchema } from "../governance.js";
+import { governancePolicyToKernelEvent } from "../governance.js";
+import { parseToolCallArguments } from "./tool-arguments.js";
+import { stripSkillFrontmatter } from "./execution-plane.js";
 import { getKernel } from "./kernel.js";
-import { CanonicalRunnerRuntime, canonicalKernelAction, canonicalKernelApply, canonicalKernelMaybeAction, canonicalStartAgent, canonicalStartWorkflow, sha256 as canonicalSha256, } from "./canonical-kernel-step.js";
+import { checkMemoryWrite, deriveMemoryRecall } from "../memory/authority.js";
+import { CanonicalRunnerRuntime, canonicalKernelAction, canonicalKernelApply, isInvalidInputError, canonicalKernelMaybeAction, canonicalStartAgent, canonicalStartWorkflow, sha256 as canonicalSha256, } from "./canonical-kernel-step.js";
 import { peekProviderReplay, seedProviderReplayFromEvents } from "./provider-replay.js";
 import { sanitizeReplayText } from "./replay-sanitize.js";
 import { decodeDurableContent, decodeDurableToolResult, durableBlocksToToolOutput, toolOutputBlocksToDurable } from "./durable-content.js";
 import { formatToolError } from "../tools/errors.js";
 import { buildLlmCompletedEvent, buildRunTerminalEvent, buildWorkflowNodeCompletedEvent, buildWorkflowNodesSubmittedEvent, } from "./session-repair.js";
-import { messageToKernelMessage, archivePresentationFromObservations, skillMetadataToKernel, taskUpdateToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
+import { messageToKernelMessage, archivePresentationFromObservations, skillMetadataToKernel, toolResultToKernel, toolSchemaToKernel, } from "./kernel-step.js";
 import { agentRunSpecToKernel, MILESTONE_UNVERIFIED_REASON, milestoneCheckFail, milestoneCheckPass, milestoneCheckResultToKernel, subAgentResultToKernel, workflowBudgetNote, workflowNodeSpecToKernel, workflowNodeOutcomeFromKernel, workflowNodeStatusFromTermination, workflowNodeToManifest, workflowNodeToSpec, workflowSpecToKernel, } from "./types/agent.js";
 import { defaultSubAgentOrchestrator } from "./sub-agent-orchestrator.js";
 import { extractJsonValue, schemaInstruction, schemaRetryInstruction, validateAgainstSchema, } from "./output-schema.js";
@@ -65,6 +69,7 @@ function memoryPolicyToKernel(policy) {
         "validationEnabled",
         "maxContentBytes",
         "maxNameLength",
+        "promotionRecallThreshold",
     ]);
     const unknown = Object.keys(policy).filter(key => !allowed.has(key));
     if (unknown.length > 0) {
@@ -76,16 +81,19 @@ function memoryPolicyToKernel(policy) {
         ...(policy.validationEnabled !== undefined ? { validation_enabled: policy.validationEnabled } : {}),
         ...(policy.maxContentBytes !== undefined ? { max_content_bytes: policy.maxContentBytes } : {}),
         ...(policy.maxNameLength !== undefined ? { max_name_length: policy.maxNameLength } : {}),
+        ...(policy.promotionRecallThreshold !== undefined
+            ? { promotion_recall_threshold: policy.promotionRecallThreshold }
+            : {}),
     };
 }
+/** Logical tool calls the cancellation abandons. The kernel's `pending_call_ids` is the call-id
+ *  namespace only: provider/host effect ids and sub-agent ids are not calls and are settled by the
+ *  cancel transition itself. */
 function pendingCallIds(action) {
     switch (action.kind) {
-        case "call_provider": return [action.effectId];
         case "execute_tool": return action.calls.map(call => call.id);
         case "request_approval": return action.requests.map(request => request.callId);
-        case "spawn_workflow": return action.nodes.map(node => String(node.agent_id ?? "")).filter(Boolean);
-        case "preempt_sub_agents": return action.agentIds;
-        default: return "effectId" in action ? [action.effectId] : [];
+        default: return [];
     }
 }
 function controlRequestRejection(observations, operation) {
@@ -111,6 +119,9 @@ export class RuntimeRunner {
     fallbackPayloadStore = null;
     /** O2 (system-reminder channel): host-pushed notes awaiting the next turn-boundary drain. */
     injectedSignals = [];
+    /** Host control commands queued by the public control methods; the main loop applies them
+     *  between effects so a command that publishes an effect never races an in-flight one. */
+    pendingControl = [];
     /** Skill names whose content has already been pushed into the durable `knowledge` slot this
      *  run — guards against re-pushing a duplicate entry if the model calls `skill(name)` again for
      *  an already-active skill (loading is idempotent; the knowledge push should be too). */
@@ -206,7 +217,10 @@ export class RuntimeRunner {
      *  the kernel disposition ladder: `"normal"` queues (default), `"high"` soft-interrupts, `"critical"`
      *  preempts. */
     injectNote(text, urgency = "normal") {
-        this.injectedSignals.push({ source: "custom", signalType: "event", urgency, payload: { goal: text } });
+        this.injectedSignals.push({
+            signal: { source: "custom", signalType: "event", urgency, payload: { goal: text } },
+            note: text,
+        });
     }
     /** The most recent kernel session-entropy sample (one per completed turn), or `null` before the
      *  first boundary. A pull companion to the streamed `entropy_sample` events. */
@@ -222,7 +236,8 @@ export class RuntimeRunner {
                 signalId: crypto.randomUUID(),
                 deliveryId: `injected-${crypto.randomUUID()}`,
                 deliveryAttempt: 1,
-                signal: injected,
+                signal: injected.signal,
+                note: injected.note,
                 ack: async () => true,
                 nack: async () => true,
             };
@@ -327,25 +342,87 @@ export class RuntimeRunner {
         }
         yield* this.execute(sessionId, start.run_id, start.goal, start.criteria, extensions, events, true, start.attachments);
     }
+    /**
+     * §22.13 · a host-authored memory write. The kernel decides whether it may happen: a live
+     * operation answers through `admit_memory_write` (the model's validation rule and rolling write
+     * quota); with no live operation the same kernel rule answers statelessly. Resolves `true` when
+     * the record was persisted.
+     */
     async writeMemory(memory, sessionId) {
         if (!this.opts.memoryStore || !this.opts.agentId)
-            return;
+            return false;
+        const turn = this.activeKernel?.turn() ?? 0;
+        const error = await this.admitMemoryWrite(memory);
+        if (error) {
+            if (sessionId) {
+                await this.opts.sessionLog.append(sessionId, {
+                    kind: "memory_validation_failed", turn, record_id: memory.record_id, error,
+                });
+            }
+            return false;
+        }
         try {
             await this.opts.memoryStore.put(this.opts.agentId, memory);
         }
         catch (cause) {
             throw new Error(formatToolError(cause));
         }
+        if (sessionId) {
+            await this.opts.sessionLog.append(sessionId, {
+                kind: "memory_written", turn, record_id: memory.record_id, scope: memory.scope,
+                memory_kind: memory.kind, name: memory.name,
+                size_bytes: new TextEncoder().encode(memory.content).byteLength,
+            });
+        }
+        return true;
+    }
+    async admitMemoryWrite(memory) {
+        const runtime = this.activeKernel;
+        if (runtime && runtime.hasStarted() && !runtime.isTerminal()) {
+            // The caller logs the verdict, so the fact is consumed here rather than queued for the
+            // per-turn drain (which would log it a second time).
+            const observations = await canonicalKernelApply(runtime, [], {
+                kind: "admit_memory_write",
+                record_id: memory.record_id,
+                name: memory.name,
+                content_bytes: new TextEncoder().encode(memory.content).byteLength,
+            });
+            let refusal;
+            for (const observation of observations) {
+                if (observation.kind === "memory_validation_failed" && observation.record_id === memory.record_id) {
+                    refusal = String(observation.error ?? "memory write refused");
+                }
+                else {
+                    this.pendingObservations.push(observation);
+                }
+            }
+            return refusal;
+        }
+        return checkMemoryWrite(this.kernelMemoryPolicyWire(), memory.name, memory.content);
+    }
+    /** The run's memory policy as the kernel's canonical wire carries it. */
+    kernelMemoryPolicyWire() {
+        if (!this.opts.memoryPolicy)
+            return undefined;
+        const { promotion_recall_threshold: threshold, ...rest } = memoryPolicyToKernel(this.opts.memoryPolicy);
+        return {
+            ...rest,
+            ...(threshold !== undefined ? { promotion_recall_threshold: String(threshold) } : {}),
+        };
     }
-    async appendMemorySyscallObservations(sessionId, observations) {
-        if (!sessionId)
+    /**
+     * M3/M4 · a host-initiated recall (prefetch). The store reports the counts it holds; the kernel
+     * derives the next counts and the promotion edge, and the host only mirrors them — the same
+     * derivation a model `query_memory` resolution journals as `memory_recalled`.
+     */
+    async recordHostMemoryRecall(hits) {
+        if (!this.opts.agentId)
             return;
-        for (const observation of observations) {
-            if (!["memory_written", "memory_queried", "memory_validation_failed"].includes(observation.kind))
-                continue;
-            const event = kernelObservationToSessionEvent(observation, 0);
-            if (event)
-                await this.opts.sessionLog.append(sessionId, event);
+        const { recalls, promotions } = await deriveMemoryRecall(this.kernelMemoryPolicyWire(), Date.now(), hits);
+        if (recalls.length > 0)
+            await this.opts.memoryStore?.recordRecall?.(this.opts.agentId, recalls);
+        for (const promotion of promotions) {
+            this.opts.onPromotionSuggested?.({ recordId: promotion.record_id, recallCount: promotion.recall_count });
         }
     }
     /** Push content into Slot 2 (system_knowledge) via add_knowledge_message.
@@ -378,6 +455,41 @@ export class RuntimeRunner {
     }
     /** K3: host-driven skill deactivation — toolset re-widens at the next provider call, the
      *  skill's knowledge pin drops at the next boundary. Errs-open: not-active is a no-op. */
+    /** §13.2 live policy patch (signal / governance / resource quota / recovery), guarded by the
+     *  policy revision. Mirrors Node: the runtime tracks the committed revision; after a restore
+     *  `expectedRevision` must be given. Rejects when the kernel refuses the patch. */
+    applyPolicyPatch(patch, opts = {}) {
+        return this.enqueueControl({
+            kind: "apply_policy_patch",
+            patch,
+            ...(opts.expectedRevision !== undefined ? { expected_revision: opts.expectedRevision } : {}),
+        });
+    }
+    /** Move the operation's absolute deadline (epoch ms), or clear it with `null`. */
+    updateDeadline(deadlineMs) {
+        return this.enqueueControl({ kind: "update_deadline", deadline_ms: deadlineMs });
+    }
+    /** Ask the kernel to compact context now; any archive it owes runs as a normal page-out effect. */
+    forceCompact() {
+        return this.enqueueControl({ kind: "force_compact" });
+    }
+    /** Host-driven skill activation, admitted by the kernel against the operation's skill catalog. */
+    activateSkill(name, opts = {}) {
+        return this.enqueueControl({
+            kind: "skill_activation",
+            name,
+            ...(opts.leaseTurns !== undefined ? { lease_turns: opts.leaseTurns } : {}),
+        });
+    }
+    enqueueControl(event) {
+        if (!this.activeKernel)
+            return Promise.reject(new Error(`${String(event.kind)} requires an active run`));
+        return new Promise((resolve, reject) => this.pendingControl.push({ event, resolve, reject }));
+    }
+    rejectPendingControl(reason) {
+        for (const pending of this.pendingControl.splice(0))
+            pending.reject(new Error(reason));
+    }
     async deactivateSkill(name) {
         if (!this.activeKernel)
             return;
@@ -627,6 +739,11 @@ export class RuntimeRunner {
                 ? { ...baseSpec, capabilityFilter: { ...baseSpec.capabilityFilter, allowedIds: allowedToolIds } }
                 : baseSpec;
             spec = { ...spec, exposureBaseline: baselineToolIds };
+            // The loaded milestone contract only gates a run whose spec names it; without this binding
+            // the kernel never publishes `evaluate_milestone` and the whole phase gate is inert.
+            if (this.opts.milestoneContract && !spec.verificationContractId) {
+                spec = { ...spec, verificationContractId: "node-default" };
+            }
             startRunSpec = agentRunSpecToKernel(spec);
         }
         if (!resumeMidRun)
@@ -656,6 +773,22 @@ export class RuntimeRunner {
                     });
                     break;
                 }
+                if (this.pendingControl.length > 0) {
+                    for (const pending of this.pendingControl.splice(0)) {
+                        try {
+                            await this.commitKernelMaybeAction(runtime, this.pendingObservations, pending.event);
+                            pending.resolve();
+                        }
+                        catch (error) {
+                            pending.reject(error);
+                        }
+                    }
+                    // A command can publish an effect ahead of the one in hand (a forced compaction's page-out);
+                    // the kernel's projection decides what runs next.
+                    action = runtime.resumeAction() ?? action;
+                    if (runtime.isTerminal())
+                        break;
+                }
                 if (this.opts.signalSource || this.injectedSignals.length > 0) {
                     const delivery = await this.nextInboundSignal();
                     if (delivery) {
@@ -683,22 +816,10 @@ export class RuntimeRunner {
                     const attemptStartedAtMs = Date.now();
                     const finalToolCalls = [];
                     let finalText = "";
-                    // I5: governance schema-level pre-filter — see Node runner for full rationale.
-                    let context = action.context;
-                    let tools = action.tools;
-                    if (this.opts.governancePolicy && this.opts.governancePolicy.surfaceDeniedInSystem !== false) {
-                        const { allowed, denied } = governanceFilterSchema(tools, this.opts.governancePolicy);
-                        if (denied.length > 0) {
-                            tools = allowed;
-                            const note = `[governance] the following tools are denied for this run and will fail if called: ${denied.join(", ")}.`;
-                            context = {
-                                ...context,
-                                systemKnowledge: context.systemKnowledge
-                                    ? `${context.systemKnowledge}\n\n${note}`
-                                    : note,
-                            };
-                        }
-                    }
+                    // I5: the kernel itself withholds statically denied tools (`hide_denied_tools`) and renders
+                    // the denial note — the host sends exactly the context and surface the kernel committed.
+                    const context = action.context;
+                    const tools = action.tools;
                     let turnTokens = 0;
                     let turnInputTokens = 0;
                     let turnOutputTokens = 0;
@@ -802,7 +923,7 @@ export class RuntimeRunner {
                                 finalText += evt.delta;
                             else if (evt.type === "tool_call") {
                                 const tc = evt;
-                                finalToolCalls.push({ id: tc.id, name: tc.name, arguments: JSON.stringify(tc.arguments) });
+                                finalToolCalls.push({ id: tc.id, name: tc.name, arguments: tc.rawArguments ?? JSON.stringify(tc.arguments) });
                             }
                         }
                     }
@@ -879,7 +1000,6 @@ export class RuntimeRunner {
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "cancel_operation",
                             reason: this.cancellationReason ?? "user",
-                            pending_call_ids: [providerEffectId],
                         });
                         break;
                     }
@@ -932,7 +1052,29 @@ export class RuntimeRunner {
                         ...(attemptUsage !== undefined ? { usage: attemptUsage } : {}),
                         wireEvidence,
                     });
+                    // Skill content is STAGED before the provider resolution commits, so the kernel's next render
+                    // can include it. The kernel adjudicates the `skill` syscall in that commit and withdraws the
+                    // staged `skill:<name>` entry when it refuses the activation — the host never decides.
+                    if (this.opts.skillContentMap?.size) {
+                        for (const call of finalToolCalls) {
+                            if (call.name !== "skill")
+                                continue;
+                            const parsed = parseToolCallArguments(call.arguments);
+                            const name = parsed.ok ? String(parsed.args.name ?? "") : "";
+                            const raw = name ? this.opts.skillContentMap.get(name) : undefined;
+                            if (raw == null)
+                                continue;
+                            const content = stripSkillFrontmatter(raw);
+                            await this.pushKnowledge({ role: "system", content }, undefined, { key: `skill:${name}`, pinned: true });
+                        }
+                    }
+                    const providerObservationStart = this.pendingObservations.length;
                     action = await this.commitKernelAction(runtime, this.pendingObservations, providerEvent);
+                    for (const observation of this.pendingObservations.slice(providerObservationStart)) {
+                        if (observation.kind === "skill_admitted" && typeof observation.name === "string") {
+                            this.knowledgePushedSkills.add(observation.name);
+                        }
+                    }
                     await this.opts.sessionLog.append(sessionId, buildLlmCompletedEvent({
                         turn: runtime.turn(),
                         content: finalText,
@@ -980,11 +1122,34 @@ export class RuntimeRunner {
                     });
                 }
                 else if (action.kind === "persist_memory") {
+                    // The kernel hands over the validated canonical write, which carries no store identity:
+                    // build the full record here, and let the receipt name exactly what the store now holds.
+                    const canonicalMemory = action.memory;
+                    const acceptedAt = Number(canonicalMemory.accepted_at_ms ?? Date.now());
+                    const record = {
+                        record_id: `memory:${crypto.randomUUID()}`,
+                        scope: this.opts.memoryScope ?? { tenant_id: "default", namespace: this.opts.agentId ?? "default" },
+                        name: String(canonicalMemory.name ?? ""),
+                        kind: String(canonicalMemory.kind ?? "reference"),
+                        content: String(canonicalMemory.content ?? ""),
+                        description: String(canonicalMemory.description ?? ""),
+                        provenance: {
+                            author: "model",
+                            trust: "untrusted",
+                            evidence_refs: Array.isArray(canonicalMemory.evidence_refs) ? canonicalMemory.evidence_refs.map(String) : [],
+                        },
+                        created_at: acceptedAt,
+                        updated_at: acceptedAt,
+                        recall_count: 0,
+                        confidence: 1,
+                        links: [],
+                        pinned: false,
+                    };
                     let error;
                     try {
                         if (!this.opts.memoryStore || !this.opts.agentId)
                             throw new Error("WASM memory persistence requires memoryStore and agentId");
-                        await this.opts.memoryStore.put(this.opts.agentId, action.memory);
+                        await this.opts.memoryStore.put(this.opts.agentId, record);
                     }
                     catch (cause) {
                         error = formatToolError(cause);
@@ -992,7 +1157,10 @@ export class RuntimeRunner {
                     action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "memory_persist_result",
                         effect_id: action.effectId,
-                        ...(error ? { error } : {}),
+                        ...(error ? { error } : {
+                            record_ref: record.record_id,
+                            digest: `sha256:${sha256Hex(record.content)}`,
+                        }),
                     });
                 }
                 else if (action.kind === "query_memory") {
@@ -1092,23 +1260,12 @@ export class RuntimeRunner {
                         onPermissionRequest: this.opts.onPermissionRequest,
                     };
                     const toolResults = [];
-                    // Syscall tools are consumed by core from the provider result and must never escape as host
-                    // tool effects. Keep an explicit invariant check below so a projection drift fails closed.
-                    const submitCalls = allCalls.filter(c => c.name === "submit_workflow_nodes" || c.name === "start_workflow");
-                    const planCalls = allCalls.filter(c => c.name === "update_plan");
+                    // Syscall tools (`update_plan` included) are consumed by core from the provider result: the
+                    // kernel decodes and applies them itself. One reaching this host effect projection is
+                    // boundary drift and fails closed — the host never re-applies a model plan as `update_task`.
+                    const submitCalls = allCalls.filter(c => c.name === "update_plan" || c.name === "submit_workflow_nodes" || c.name === "start_workflow");
                     const normalCalls = allCalls.filter(c => c.name !== "submit_workflow_nodes" && c.name !== "start_workflow"
                         && c.name !== "update_plan");
-                    // `update_plan` is a kernel meta-tool (exposed via `enablePlanTool`), not a registered
-                    // plane tool — resolve it here as an `update_task` apply, mirroring the node/python runners.
-                    for (const call of planCalls) {
-                        const update = parseUpdatePlanArgs(call.arguments);
-                        await this.commitKernelApply(runtime, this.pendingObservations, {
-                            kind: "update_task",
-                            update: taskUpdateToKernel(update),
-                        });
-                        toolResults.push({ callId: call.id, output: "success", isError: false });
-                        yield { type: "tool_result", callId: call.id, content: "success", isError: false };
-                    }
                     for (const call of submitCalls) {
                         throw new Error(`canonical kernel published model syscall ${call.name} as a host tool effect`);
                     }
@@ -1213,8 +1370,12 @@ export class RuntimeRunner {
                             }
                             if (!decision)
                                 continue;
-                            if (typeof decision.replaceOutput === "string")
+                            if (typeof decision.replaceOutput === "string") {
                                 r.output = decision.replaceOutput;
+                                // The replacement is what every consumer sees: drop the raw structured blocks so the
+                                // durable session record cannot resurface content the host just redacted.
+                                delete r.contentParts;
+                            }
                             if (decision.note)
                                 this.injectNote(decision.note);
                         }
@@ -1231,34 +1392,8 @@ export class RuntimeRunner {
                             content: { blocks: toolOutputBlocksToDurable(r.contentParts?.length ? r.contentParts : [{ type: "text", text: r.output }]) },
                         })),
                     });
-                    // Canonical provider-result reduction activates a successfully resolved `skill` call. The
-                    // host only pins its METHOD content — how to do something — for later turns.
-                    //
-                    // Strict dynamic context control: the skill text
-                    // for the rest of the run, unlike a one-off memory/knowledge lookup (fact content, relevant
-                    // for the moment it's used). So its text ALSO goes into the durable `knowledge` slot here
-                    // (in addition to the ordinary tool_result already headed for `history`, where it will decay
-                    // with the compression pyramid like any other tool output). First activation only.
-                    for (const call of allCalls) {
-                        if (call.name !== "skill")
-                            continue;
-                        const res = toolResults.find(r => r.callId === call.id);
-                        if (!res || res.isError)
-                            continue;
-                        try {
-                            const name = JSON.parse(call.arguments || "{}").name;
-                            if (!name)
-                                continue;
-                            // With a lease configured, skip the Set optimization: an expired-then-reloaded skill
-                            // must re-pin — only the kernel knows the lease state; its put dedupes anyway.
-                            if (this.opts.skillLeaseTurns !== undefined || !this.knowledgePushedSkills.has(name)) {
-                                this.knowledgePushedSkills.add(name);
-                                // K1: keyed `skill:<name>` — the kernel-side put dedupes across runner instances.
-                                this.pushKnowledge({ role: "system", content: res.output }, undefined, { key: `skill:${name}` });
-                            }
-                        }
-                        catch { /* skip */ }
-                    }
+                    // `skill` is a kernel syscall: it never reaches this host tool effect. The kernel admits or
+                    // refuses it at the provider resolution (and withdraws any content staged for a refusal).
                     const entropyObsStart = this.pendingObservations.length;
                     action = await this.commitKernelAction(runtime, this.pendingObservations, {
                         kind: "tool_results",
@@ -1292,6 +1427,8 @@ export class RuntimeRunner {
                 else if (action.kind === "evaluate_milestone") {
                     const milestoneEffectId = action.effectId;
                     const milestonePhaseId = action.phaseId;
+                    // Host-owned phase data: the kernel names the phase, the host contract says what it demands.
+                    const milestonePhase = this.opts.milestoneContract?.phases.find(phase => phase.id === milestonePhaseId);
                     const milestonePolicy = this.opts.milestonePolicy ?? "require_verifier";
                     if (milestonePolicy === "auto_pass") {
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
@@ -1304,8 +1441,8 @@ export class RuntimeRunner {
                     else if (this.opts.onMilestoneEvaluate) {
                         const check = await this.opts.onMilestoneEvaluate({
                             phaseId: action.phaseId,
-                            criteria: action.criteria ?? [],
-                            requiredEvidence: action.requiredEvidence ?? [],
+                            criteria: milestonePhase?.criteria ?? action.criteria ?? [],
+                            requiredEvidence: milestonePhase?.requiredEvidence ?? action.requiredEvidence ?? [],
                         });
                         action = await this.commitKernelAction(runtime, this.pendingObservations, {
                             kind: "milestone_result",
@@ -1334,6 +1471,7 @@ export class RuntimeRunner {
                             totalTokens: 0,
                         }));
                         yield { type: "done", iterations: turnsUsed, totalTokens: 0, status: "milestone_pending" };
+                        this.rejectPendingControl("the run ended before the control command was applied");
                         this.activeKernel = null;
                         this.currentSessionId = null;
                         return;
@@ -1370,11 +1508,7 @@ export class RuntimeRunner {
             // I0b: kernel rejection (or any other thrown error inside the loop) is observable here —
             // emit run_terminal so downstream code sees a clean end rather than mid-loop EOF.
             const errMsg = formatToolError(err);
-            const code = err.code;
-            const isInvalidArg = code === "InvalidArg" ||
-                errMsg.toLowerCase().includes("invalidarg") ||
-                errMsg.toLowerCase().includes("invalid argument");
-            const reason = isInvalidArg ? "invalid_arg" : "error";
+            const reason = isInvalidInputError(err) ? "invalid_arg" : "error";
             yield { type: "error", message: errMsg };
             try {
                 await this.opts.sessionLog.append(sessionId, buildRunTerminalEvent({
@@ -1385,6 +1519,7 @@ export class RuntimeRunner {
             }
             catch { /* session log failure must not mask the original error */ }
             yield { type: "done", iterations: runtime.turn() || 0, totalTokens: 0, status: reason };
+            this.rejectPendingControl("the run ended before the control command was applied");
             this.activeKernel = null;
             this.currentSessionId = null;
             return;
@@ -1434,6 +1569,7 @@ export class RuntimeRunner {
             // ③ loop-agent: surface the kernel-adjudicated after-round decision to the driver.
             ...(result?.paceDecision ? { paceDecision: result.paceDecision } : {}),
         };
+        this.rejectPendingControl("the run ended before the control command was applied");
         this.activeKernel = null;
         this.currentSessionId = null;
     }
@@ -1707,6 +1843,7 @@ export class RuntimeRunner {
         }
         finally {
             if (bootstrapped) {
+                this.rejectPendingControl("the run ended before the control command was applied");
                 this.activeKernel = null;
                 this.currentSessionId = null;
                 this.abortController = null;
@@ -1720,7 +1857,7 @@ export class RuntimeRunner {
      * `WorkflowRun` down), and we abort the matching children's in-flight LLM calls. Returns the
      * torn-down outcome on preemption, else `null`. No-op without a signal source.
      */
-    async monitorWorkflowPreemption(runtime, controllers, batchState) {
+    async monitorWorkflowPreemption(runtime, controllers, batchState, exclusive) {
         const source = this.opts.signalSource;
         if (!source && this.injectedSignals.length === 0)
             return null;
@@ -1733,29 +1870,36 @@ export class RuntimeRunner {
                 await new Promise(resolve => setTimeout(resolve, 5));
                 continue;
             }
-            const observationStart = this.pendingObservations.length;
-            const signalAction = await this.consumeInboundSignal(delivery, claimed => this.commitKernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
-            if (signalAction) {
-                if (signalAction.kind !== "preempt_sub_agents") {
-                    throw new Error(`workflow signal returned unexpected effect: ${signalAction.kind}`);
+            const preemptedBySignal = await exclusive(async () => {
+                const observationStart = this.pendingObservations.length;
+                const signalAction = await this.consumeInboundSignal(delivery, claimed => this.commitKernelMaybeAction(runtime, this.pendingObservations, signalToKernelEvent(claimed)));
+                if (signalAction) {
+                    if (signalAction.kind !== "preempt_sub_agents") {
+                        throw new Error(`workflow signal returned unexpected effect: ${signalAction.kind}`);
+                    }
+                    for (const id of signalAction.agentIds)
+                        controllers.get(id)?.abort();
+                    const continuation = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
+                        kind: "preempt_result", effect_id: signalAction.effectId,
+                        already_finished_agent_ids: signalAction.agentIds.filter(id => batchState.finished.has(id)),
+                    });
+                    if (continuation && continuation.kind !== "call_provider" && continuation.kind !== "done") {
+                        throw new Error(`workflow preemption returned unexpected effect: ${continuation.kind}`);
+                    }
                 }
-                for (const id of signalAction.agentIds)
-                    controllers.get(id)?.abort();
-                const continuation = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
-                    kind: "preempt_result", effect_id: signalAction.effectId,
-                });
-                if (continuation && continuation.kind !== "call_provider" && continuation.kind !== "done") {
-                    throw new Error(`workflow preemption returned unexpected effect: ${continuation.kind}`);
+                const obs = this.pendingObservations.slice(observationStart);
+                const preempted = obs.find(o => o.kind === "agent_preempted");
+                if (preempted) {
+                    batchState.stopping = true;
+                    for (const id of preempted.agent_ids ?? [])
+                        controllers.get(id)?.abort();
+                    const wc = obs.find(o => o.kind === "workflow_completed");
+                    return (wc?.node_outcomes ?? []).map(workflowNodeOutcomeFromKernel);
                 }
-            }
-            const obs = this.pendingObservations.slice(observationStart);
-            const preempted = obs.find(o => o.kind === "agent_preempted");
-            if (preempted) {
-                for (const id of preempted.agent_ids ?? [])
-                    controllers.get(id)?.abort();
-                const wc = obs.find(o => o.kind === "workflow_completed");
-                return (wc?.node_outcomes ?? []).map(workflowNodeOutcomeFromKernel);
-            }
+                return null;
+            });
+            if (preemptedBySignal)
+                return preemptedBySignal;
         }
         return null;
     }
@@ -1802,98 +1946,144 @@ export class RuntimeRunner {
         // W-1: on resume it is pre-seeded from the persisted node outputs, so post-resume dependents
         // still see their (pre-crash) dependencies' outputs.
         const outputs = new Map(seedOutputs ?? []);
-        for (;;) {
-            if (nodes.length === 0)
-                return { nodeOutcomes: [], outputs: Object.fromEntries(outputs) };
-            for (const node of nodes) {
-                const dependencyOutputs = node.dependency_outputs ?? {};
-                for (const [agentId, output] of Object.entries(dependencyOutputs)) {
-                    if (!outputs.has(agentId))
-                        outputs.set(agentId, output);
-                }
+        if (nodes.length === 0)
+            return { nodeOutcomes: [], outputs: Object.fromEntries(outputs) };
+        // Nodes run as soon as the kernel spawns them and each completion is fed back the moment it
+        // lands — no round barrier, so a fast node's dependents never wait on a slow sibling. A child
+        // that fails is an ordinary completion; a driver that throws aborts every sibling and propagates.
+        // #2-B-ii: per-node abort controllers + a concurrent preemption monitor (see node runner). The
+        // monitor and the completion feeds share one kernel queue; after a teardown nothing is fed.
+        const controllers = new Map();
+        const batchState = { settled: false, stopping: false, finished: new Set() };
+        let kernelQueue = Promise.resolve();
+        const exclusive = (work) => {
+            const run = kernelQueue.then(work, work);
+            kernelQueue = run.catch(() => undefined);
+            return run;
+        };
+        const monitor = this.monitorWorkflowPreemption(runtime, controllers, batchState, exclusive);
+        const inFlight = new Map();
+        const launch = (node) => {
+            const dependencyOutputs = node.dependency_outputs ?? {};
+            for (const [agentId, output] of Object.entries(dependencyOutputs)) {
+                if (!outputs.has(agentId))
+                    outputs.set(agentId, output);
             }
-            const roundBudget = budget;
-            // #2-B-ii: per-node abort controllers + a concurrent preemption monitor (see node runner).
-            const controllers = new Map(nodes.map(n => [n.agent_id, new AbortController()]));
-            const batchState = { settled: false };
-            const monitor = this.monitorWorkflowPreemption(runtime, controllers, batchState);
-            const results = await Promise.all(nodes.map(node => this.runWorkflowNode(node, parentSessionId, orchestrator, roundBudget, outputs, controllers.get(node.agent_id)?.signal)));
+            const controller = new AbortController();
+            controllers.set(node.agent_id, controller);
+            const running = this.runWorkflowNode(node, parentSessionId, orchestrator, budget, outputs, controller.signal)
+                .then(result => ({ kind: "node", node, result }))
+                .finally(() => batchState.finished.add(node.agent_id));
+            // A node can fail while the driver is busy feeding another completion; the race observes
+            // it on the next pass, so it must not count as unhandled in between.
+            running.catch(() => undefined);
+            inFlight.set(node.agent_id, running);
+        };
+        const stopAll = async () => {
             batchState.settled = true;
-            const preempted = await monitor;
-            if (preempted)
-                return { nodeOutcomes: preempted, outputs: Object.fromEntries(outputs) };
-            // Accumulate next-batch nodes across feeds (per-node unblock can spawn dependents per feed).
-            const nextNodes = [];
-            done = undefined;
-            for (const result of results) {
-                // G2: record this node's output so a downstream reduce node can consume it.
-                const outContent = result.result.finalMessage?.content;
-                const outText = typeof outContent === "string" ? outContent : outContent != null ? JSON.stringify(outContent) : "";
-                outputs.set(result.agentId, outText);
-                // A loop iteration completes under `wf-node{N}-i{k}` but its dependents consume the STABLE
-                // node id `wf-node{N}` — alias it so the LAST iteration's output is what dependents see.
-                const stableId = result.agentId.replace(/-i\d+$/, "");
-                if (stableId !== result.agentId)
-                    outputs.set(stableId, outText);
-                const observationStart = this.pendingObservations.length;
-                const completionAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
-                    kind: "sub_agent_completed",
-                    result: subAgentResultToKernel(result),
-                });
-                let obs = this.pendingObservations.slice(observationStart);
-                if (completionAction?.kind === "spawn_workflow") {
-                    nextNodes.push(...completionAction.nodes);
-                    budget = completionAction.budget ?? budget;
-                    obs = [...obs, ...await acceptSpawn(completionAction)];
-                }
-                else if (completionAction?.kind === "call_provider") {
-                    this.workflowContinuation = completionAction;
-                }
-                else if (completionAction?.kind === "done") {
-                    // The correlated child completion may terminalize the workflow in the same canonical
-                    // step. Its workflow_completed observation below remains the typed outcome source.
-                }
-                else if (completionAction) {
-                    throw new Error(`workflow completion returned unexpected effect: ${completionAction.kind}`);
+            for (const controller of controllers.values())
+                controller.abort();
+            await Promise.allSettled(inFlight.values());
+            await monitor;
+        };
+        let watching = monitor.then(outcome => ({ kind: "monitor", outcome }));
+        for (const node of nodes)
+            launch(node);
+        try {
+            while (inFlight.size > 0) {
+                const landed = await Promise.race([...inFlight.values(), ...(watching ? [watching] : [])]);
+                if (landed.kind === "monitor") {
+                    watching = undefined;
+                    if (landed.outcome === null)
+                        continue;
+                    await stopAll();
+                    return { nodeOutcomes: landed.outcome, outputs: Object.fromEntries(outputs) };
                 }
-                // Child-authored DAG additions are admitted only as part of the canonical child-completion
-                // resolution. Persist the projection only after core reports the admitted base index.
-                if (result.submittedNodes?.length) {
-                    const submitted = obs.find(o => o.kind === "workflow_nodes_submitted");
-                    if (submitted) {
-                        await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
-                            turn: runtime.turn(),
-                            nodes: result.submittedNodes.map(workflowNodeSpecToKernel),
-                            baseIndex: submitted.base,
-                            submitterAgentId: result.agentId,
-                        }));
+                inFlight.delete(landed.node.agent_id);
+                const settled = await exclusive(async () => {
+                    if (batchState.stopping)
+                        return { spawned: [], done: undefined };
+                    const { node, result } = landed;
+                    // G2: record this node's output so a downstream reduce node can consume it.
+                    const outContent = result.result.finalMessage?.content;
+                    const outText = typeof outContent === "string" ? outContent : outContent != null ? JSON.stringify(outContent) : "";
+                    outputs.set(result.agentId, outText);
+                    // A loop iteration completes under `wf-node{N}-i{k}` but its dependents consume the STABLE
+                    // node id `wf-node{N}` — alias it so the LAST iteration's output is what dependents see.
+                    const stableId = result.agentId.replace(/-i\d+$/, "");
+                    if (stableId !== result.agentId)
+                        outputs.set(stableId, outText);
+                    const observationStart = this.pendingObservations.length;
+                    const completionAction = await this.commitKernelMaybeAction(runtime, this.pendingObservations, {
+                        kind: "sub_agent_completed",
+                        result: subAgentResultToKernel(result),
+                        ...(node.attempt_id ? { attempt_id: node.attempt_id } : {}),
+                    });
+                    let obs = this.pendingObservations.slice(observationStart);
+                    const spawned = [];
+                    if (completionAction?.kind === "spawn_workflow") {
+                        spawned.push(...completionAction.nodes);
+                        budget = completionAction.budget ?? budget;
+                        obs = [...obs, ...await acceptSpawn(completionAction)];
+                    }
+                    else if (completionAction?.kind === "call_provider") {
+                        this.workflowContinuation = completionAction;
+                    }
+                    else if (completionAction?.kind === "done") {
+                        // The correlated child completion may terminalize the workflow in the same canonical
+                        // step. Its workflow_completed observation below remains the typed outcome source.
+                    }
+                    else if (completionAction) {
+                        throw new Error(`workflow completion returned unexpected effect: ${completionAction.kind}`);
                     }
+                    // Child-authored DAG additions are admitted only as part of the canonical child-completion
+                    // resolution. Persist the projection only after core reports the admitted base index.
+                    if (result.submittedNodes?.length) {
+                        const submitted = obs.find(o => o.kind === "workflow_nodes_submitted");
+                        if (submitted) {
+                            await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodesSubmittedEvent({
+                                turn: runtime.turn(),
+                                nodes: result.submittedNodes.map(workflowNodeSpecToKernel),
+                                baseIndex: submitted.base,
+                                submitterAgentId: result.agentId,
+                            }));
+                        }
+                    }
+                    // Persist node completion for resume recovery. W-1: the result-borne control signals ride
+                    // along (a resumed classifier re-prunes; a recorded loop stop is honored) plus the output
+                    // text (post-resume dependents/reduce still see this node's output).
+                    await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodeCompletedEvent({
+                        turn: runtime.turn(),
+                        agentId: result.agentId,
+                        status: workflowNodeStatusFromTermination(result.result.termination),
+                        termination: result.result.termination,
+                        classifyBranch: result.result.classifyBranch,
+                        tournamentWinner: result.result.tournamentWinner,
+                        loopContinue: result.result.loopContinue,
+                        ...(result.result.finalMessage ? { output: result.result.finalMessage } : {}),
+                    }));
+                    return { spawned, done: findDone(obs) };
+                });
+                if (settled.done && settled.spawned.length === 0 && inFlight.size === 0) {
+                    await stopAll();
+                    return {
+                        nodeOutcomes: (settled.done.node_outcomes ?? []).map(workflowNodeOutcomeFromKernel),
+                        outputs: Object.fromEntries(outputs),
+                    };
                 }
-                const d = findDone(obs);
-                if (d)
-                    done = d;
-                // Persist node completion for resume recovery. W-1: the result-borne control signals ride
-                // along (a resumed classifier re-prunes; a recorded loop stop is honored) plus the output
-                // text (post-resume dependents/reduce still see this node's output).
-                await this.opts.sessionLog.append(parentSessionId, buildWorkflowNodeCompletedEvent({
-                    turn: runtime.turn(),
-                    agentId: result.agentId,
-                    status: workflowNodeStatusFromTermination(result.result.termination),
-                    termination: result.result.termination,
-                    classifyBranch: result.result.classifyBranch,
-                    tournamentWinner: result.result.tournamentWinner,
-                    loopContinue: result.result.loopContinue,
-                    ...(result.result.finalMessage ? { output: result.result.finalMessage } : {}),
-                }));
+                for (const node of settled.spawned)
+                    launch(node);
             }
-            if (done && nextNodes.length === 0) {
-                return {
-                    nodeOutcomes: (done.node_outcomes ?? []).map(workflowNodeOutcomeFromKernel),
-                    outputs: Object.fromEntries(outputs),
-                };
-            }
-            nodes = nextNodes;
         }
+        catch (error) {
+            await stopAll();
+            throw error;
+        }
+        await stopAll();
+        const preempted = await monitor;
+        if (preempted)
+            return { nodeOutcomes: preempted, outputs: Object.fromEntries(outputs) };
+        return { nodeOutcomes: [], outputs: Object.fromEntries(outputs) };
     }
     async appendObservations(sessionId, runtime, nextArchiveStart) {
         const turn = runtime.turn();
@@ -1945,11 +2135,17 @@ export class RuntimeRunner {
         try {
             const queries = await preQuery({ goal: this.currentGoal, phase });
             const lines = [];
+            const seen = new Set();
+            const recalled = [];
             for (const q of queries ?? []) {
                 if (!q.query.trim())
                     continue;
                 const hits = await this.opts.memoryStore.search(this.opts.agentId, q);
                 for (const hit of hits) {
+                    if (seen.has(hit.record.record_id))
+                        continue;
+                    seen.add(hit.record.record_id);
+                    recalled.push(hit);
                     lines.push(`[memory record_id=${hit.record.record_id} trust=${hit.record.provenance.trust} score=${hit.score.toFixed(3)}] ${hit.record.content}`);
                 }
             }
@@ -1959,6 +2155,7 @@ export class RuntimeRunner {
                     message: { role: "user", content: lines.join("\n") },
                 });
             }
+            await this.recordHostMemoryRecall(recalled);
         }
         catch { /* errs-open */ }
     }
@@ -2132,47 +2329,27 @@ async function withTimeout(promise, timeoutMs) {
             clearTimeout(timer);
     }
 }
-/** Parse `update_plan` meta-tool args into a task update (snake_case aliases accepted, mirroring
- *  the node/python runners). Malformed payload → an empty update (a no-op `update_task`). */
-function parseUpdatePlanArgs(argsStr) {
-    let parsed = {};
-    try {
-        parsed = JSON.parse(argsStr);
-    }
-    catch {
-        // Ignore parse error → empty update.
-    }
-    return {
-        plan: parsed.plan,
-        currentStep: parsed.currentStep !== undefined ? Number(parsed.currentStep) : parsed.current_step !== undefined ? Number(parsed.current_step) : undefined,
-        progress: parsed.progress,
-        scratchpad: parsed.scratchpad,
-        blockedOn: parsed.blockedOn !== undefined
-            ? parsed.blockedOn
-            : parsed.blocked_on,
-    };
-}
-/** Lower a claimed signal delivery to the kernel's `deliver_signal` input event. Shared by the main
- *  loop's per-turn poll and #2-B-ii's workflow-batch preemption monitor (so the two never drift). */
-function signalToKernelEvent(delivery) {
+/** Lower a claimed signal delivery straight into the kernel's `LogicalSignal` vocabulary. Shared by
+ *  the main loop's per-turn poll and #2-B-ii's workflow-batch preemption monitor (so the two never
+ *  drift). `signalType` / `coalesceKey` / `coalescedCount` are signal-source concepts the canonical
+ *  wire deliberately does not carry (§5n); the absolute `deadlineMs` becomes the duration the kernel
+ *  anchors to its own accepted time. */
+export function signalToKernelEvent(delivery, nowMs = Date.now()) {
     const sig = delivery.signal;
     return {
         kind: "deliver_signal",
         delivery_id: delivery.deliveryId,
         attempt: delivery.deliveryAttempt,
         signal: {
-            id: delivery.signalId,
+            signal_id: delivery.signalId,
             source: sig.source ?? "custom",
-            signal_type: sig.signalType ?? "event",
+            target: sig.recipient ? { kind: "task", task_id: sig.recipient } : { kind: "operation" },
             urgency: sig.urgency ?? "normal",
-            summary: String(sig.payload?.goal ?? "signal"),
-            payload: sig.payload ?? {},
+            payload: delivery.note ?? sig.payload ?? {},
             ...(sig.dedupeKey ? { dedupe_key: sig.dedupeKey } : {}),
-            ...(sig.recipient ? { recipient: sig.recipient } : {}),
-            ...(sig.deadlineMs !== undefined ? { deadline_ms: sig.deadlineMs } : {}),
-            ...(sig.coalesceKey ? { coalesce_key: sig.coalesceKey } : {}),
-            coalesced_count: Math.max(1, sig.coalescedCount ?? 1),
-            timestamp_ms: Date.now(),
+            ...(sig.deadlineMs !== undefined
+                ? { escalate_after_ms: String(Math.max(0, Math.floor(sig.deadlineMs - nowMs))) }
+                : {}),
         },
     };
 }