@namzu/cli 26.3.0 → 28.0.0

package/dist/tui/agent.js

@@ -1,5 +1,4 @@
 import { createCurrentCredentialReader } from '../integrations/providers/current-credential.js';
-import { CliPathBuilder } from '../integrations/sessions/paths.js';
 import { createWebSearchTool, resolveWebSearch, webSearchLabel, } from '../integrations/web/search.js';
 /**
  * TUI agent session — provider-direct, tool-enabled.
@@ -14,26 +13,28 @@ import { createWebSearchTool, resolveWebSearch, webSearchLabel, } from '../integ
  * Unlike the earlier `chatStream()`-only adapter, this drives the full
  * tool-execution loop: the model can call tools, their results are fed
  * back, and the loop iterates until the turn settles. We translate the
- * SDK's `RunEvent` stream into the TUI's smaller `AgentEvent` vocabulary
+ * SDK's `SessionEvent` stream into the TUI's smaller `AgentEvent` vocabulary
  * (text deltas + tool start/end + done/error).
  *
- * The TUI owns conversation history and passes the full `Message[]` on
- * every turn (stateless session). Empty / partial states (no
+ * The TUI holds the conversation it renders and passes the full `Message[]`
+ * on every turn; the session's log, which the kernel appends to while the
+ * turn runs, is what a later resume folds back. Empty / partial states (no
  * credentials, no preferences, no matching detected provider) return an
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DiskCheckpointStore, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, ToolRegistry, WebFetchTool, asRunId, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildResidentHistoryTools, buildResidentToolEvidenceTools, buildSessionGoalTools, compactNow, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContext, createResidentStepContributions, createReviewHandler, createToolPresenter, generateProjectId, generateRunId, generateSessionId, generateTenantId, generateTopicId, getBuiltinTools, isReviewExempt, query, resumeRun, seedObservationLedger, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, BackgroundJobRegistry, DiskSessionCheckpointStore, DiskSessionLog, DiskTaskStore, EVENT_NAME_ATTRIBUTE, GuardedFetchProvider, InMemorySessionLog, MarkdownMemoryStore, PromptContributionRegistry, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SessionPaths, ToolRegistry, WebFetchTool, abandonTurn, batchNeedsReview, buildAskUserQuestionTool, buildMemoryTools, buildResidentHistoryTools, buildResidentToolEvidenceTools, buildSessionGoalTools, compactNow, compactSession, createComputerUseTool, createFileReadTracker, createMemoryPromoter, createMemoryRecallStep, createResidentStepContext, createResidentStepContributions, createReviewHandler, createToolPresenter, ensureProject, generateSessionId, generateTenantId, generateTopicId, generateTurnId, getBuiltinTools, isReviewExempt, isTurnInProgressError, query, resumeSession, seedObservationLedger, webGuidanceContribution, withProviderFallback, } from '@namzu/sdk';
 import { SubprocessComputerUseHost } from '@namzu/computer-use';
 import { realpath, stat } from 'node:fs/promises';
-import { join, parse, resolve } from 'node:path';
+import { parse, resolve } from 'node:path';
 import { FileCheckpointStore } from '../checkpoints/store.js';
 import { CHECKPOINTED_TOOLS, withCheckpoints } from '../checkpoints/wrap.js';
-import { readStoredRunGuards, resolveRunGuards } from '../config/run-limits.js';
 import { configuredPassthroughTools, resolveToolResultScreens, unmatchedPassthroughTools, } from '../config/tool-result-screens.js';
+import { readStoredTurnGuards, resolveTurnGuards } from '../config/turn-guards.js';
 import { probeCapabilities } from '../context/capabilities.js';
+import { createSessionDirectories } from '../context/directories.js';
 import { NAMZU_DELEGATION_DOCTRINE, NAMZU_ORCHESTRATE_DOCTRINE, NAMZU_PLAN_MODE_DOCTRINE, NAMZU_WORKING_DOCTRINE, } from '../context/doctrine.js';
-import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
+import { composeEnvironmentPrompt, detectWsl, readEnvironmentFacts, } from '../context/environment.js';
 import { ProjectInstructionTracker } from '../context/project-tracker.js';
 import { resolveSandbox, sandboxResolvedSeverity, } from '../context/sandbox.js';
 import { composeTurnSnapshot, readTurnSnapshot } from '../context/turn-snapshot.js';
@@ -44,23 +45,29 @@ import { canSelectModel } from '../integrations/providers/access.js';
 import { createGeminiAccessTokenResolver } from '../integrations/providers/gemini-credentials.js';
 import { CredentialRefreshRejectedError, CredentialWithdrawnError, PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureFreshStoredCodexCredential, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readCodexCredentialFile, readPreferences, readSubscriptionCredential, resolveChainCapabilities, sameOAuthCredential, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
 import { modelReasoningView } from '../integrations/providers/model-reasoning.js';
-import { retainManualCompaction } from '../integrations/sessions/compaction-evidence.js';
+import { activeZenCatalogue, isOfferableModel } from '../integrations/providers/zen-catalogue.js';
+import { sessionLogCheckpointView } from '../integrations/sessions/checkpoint-view.js';
 import { createContextInventoryStep } from '../integrations/sessions/context-inventory.js';
 import { CONVERSATION_EVIDENCE_GUIDANCE, buildConversationReadTool, buildConversationSearchTool, releaseConversationEvidence, } from '../integrations/sessions/conversation-search.js';
 import { createConversationEvidenceRecall } from '../integrations/sessions/evidence-recall.js';
+import { ensureSessionStarted } from '../integrations/sessions/store.js';
 import { createTaskContextStep } from '../integrations/sessions/task-context.js';
+import { resolveNamzuHome } from '../integrations/state/home.js';
 import { ensurePrivateStateDirectory } from '../integrations/state/private-directory.js';
+import { cliProjectRoot } from '../integrations/state/project.js';
+import { CLI_CHECKPOINT_RETENTION } from '../integrations/state/retention.js';
+import { listSavedBatches } from '../integrations/subagents/batches.js';
 import { discoverAgentDefinitions } from '../integrations/subagents/definitions.js';
-import { createDelegationHistoryStep } from '../integrations/subagents/history.js';
 import { prepareDelegatedEffort } from '../integrations/subagents/model-effort.js';
-import { SubagentPathBuilder, resolveSubagentParent } from '../integrations/subagents/parent.js';
+import { resolveSubagentParent } from '../integrations/subagents/parent.js';
 import { replaySavedChildrenFor } from '../integrations/subagents/replay.js';
-import { listSavedOrchestrationRuns, } from '../integrations/subagents/runs.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
+import { createSavedAgentHistory, createSavedAgentsStep, } from '../integrations/subagents/saved-agents.js';
 import { cliLogger } from '../logging.js';
 import { formatMemoryDiagnostics } from '../memory/presentation.js';
 import { composeMemoryPrompt, readMemory } from '../memory/store.js';
-import { projectRunConversation } from './conversation-history.js';
+import { composeStoredMemoryPrompt, describeCuratedNotesImport, describeMemoryMigration, importCuratedNotes, migrateMemoryOnce, saveTypedNote, } from '../memory/typed.js';
+import { projectTurnConversation } from './conversation-history.js';
 import { buildSwitchModelTool } from './model-switch-tool.js';
 import { resolveModelSwitch } from './model-switch.js';
 /**
@@ -438,10 +445,10 @@ function builtinTools(backgroundJobs) {
         return [tool.name === 'bash' ? foregroundOnlyBash(tool) : tool];
     });
 }
-function buildToolRegistry(cwd, projectStateRoot = join(cwd, '.namzu'), backgroundJobs = true, checkpoints, projectId, screens) {
-    // Configured here rather than on the run, so every registry this CLI
-    // builds for a run carries the operator's choice — including the sub-agent
-    // registries below, which a run-level option would reach only if each
+function buildToolRegistry(paths, backgroundJobs, checkpoints, screens) {
+    // Configured here rather than on the turn, so every registry this CLI
+    // builds for a turn carries the operator's choice — including the sub-agent
+    // registries below, which a turn-level option would reach only if each
     // child's config were threaded as well. An absent key stays absent, so the
     // kernel's default applies exactly as it does for any other host.
     const screensConfig = resolveToolResultScreens(screens);
@@ -459,21 +466,20 @@ function buildToolRegistry(cwd, projectStateRoot = join(cwd, '.namzu'), backgrou
             registry.register(withCheckpoints(tool, checkpoints));
         }
     }
-    // SDK memory: the agent gets search_memory / read_memory / save_memory over
-    // a structured store in this Project's generated-state directory. CLI
-    // surfaces inject the central application-home hierarchy; embedded callers
-    // that omit it retain the historical `<cwd>/.namzu` layout.
-    // Separate from the user-curated MEMORY.md that is injected into the prompt.
-    const memoryRoot = ensurePrivateStateDirectory(projectStateRoot, 'memory');
-    const directory = projectId ? ensurePrivateStateDirectory(memoryRoot, projectId) : memoryRoot;
-    const memoryStore = new DiskMemoryStore({ baseDir: projectStateRoot, directory });
+    // Stored memory: the agent gets search_memory / read_memory / save_memory
+    // over typed Markdown files, one per memory, in this project's `memory/`
+    // under the application home (`projects/<slug>/memory`), so every
+    // workspace keeps its own. Separate from the operator-curated files, which
+    // are prompt text.
+    const directory = ensurePrivateStateDirectory(paths.projectDir(), 'memory');
+    const memoryStore = new MarkdownMemoryStore({ directory });
     // Search through the store's async boundary. Its concrete index is lazy:
     // handing `getIndex()` to the synchronous overload before the first store
     // read makes a new process report every persisted memory as absent.
     registry.register(buildMemoryTools(memoryStore));
     // query() mounts search_tools only if a deferred roster actually exists,
     // after runtime tools are registered. Ordinary CLI task tools are active.
-    return { registry, memoryStore };
+    return { registry, memoryStore, memoryDirectory: directory };
 }
 /** Refresh plugin skill metadata before each provider operation. */
 async function currentPluginSkills(registry) {
@@ -483,7 +489,6 @@ async function currentPluginSkills(registry) {
     return registry.list();
 }
 export async function createAgentSession(prefs, detected, options = {}) {
-    const scope = options.scope ?? mintScope();
     const fileObservations = new Map();
     /**
      * This process's observation ledger for one conversation, seeded from that
@@ -552,21 +557,34 @@ export async function createAgentSession(prefs, detected, options = {}) {
         cwd === parse(cwd).root) {
         return emptySession(`Working-directory sandboxing refuses filesystem root ${cwd}; choose a project directory so confinement has a boundary, or explicitly select an ephemeral workspace.`, 'invocation');
     }
-    const hierarchyRoot = resolve(options.stateRoot ?? join(cwd, '.namzu'));
-    const pathBuilder = new CliPathBuilder(hierarchyRoot);
-    const projectStateRoot = hierarchyRoot;
+    // Generated state never defaults into the working directory. It used to:
+    // `<cwd>/.namzu` for any caller without a state root, which put runtime
+    // trees inside checkouts (and, run from the home directory, made the
+    // project root and the application home the same directory). It lives in
+    // the checkout's project under the application home: `projects/<slug>/`.
+    let paths;
+    let projectId;
     try {
-        ensurePrivateStateDirectory(hierarchyRoot, 'sessions');
+        if (options.conversationSessions) {
+            paths = options.conversationSessions.paths;
+            projectId = options.conversationSessions.projectId;
+        }
+        else {
+            const home = resolve(options.stateRoot ?? resolveNamzuHome());
+            ensurePrivateStateDirectory(home, 'projects');
+            const project = await ensureProject({ home, cwd: cliProjectRoot(cwd) });
+            paths = new SessionPaths({ home, slug: project.slug });
+            projectId = project.projectId;
+        }
         // Refuse an aliased or otherwise unsafe generated-state root before any
-        // provider, sandbox or plugin runtime is constructed. Project-authored
-        // `.namzu` content may coexist here, but generated memory must never be
-        // redirected outside the trusted working directory through an ancestor
-        // symlink.
-        ensurePrivateStateDirectory(projectStateRoot, 'memory');
+        // provider, sandbox or plugin runtime is constructed.
+        ensurePrivateStateDirectory(resolve(paths.projectDir(), '..'), paths.slug);
+        ensurePrivateStateDirectory(paths.projectDir(), 'memory');
     }
     catch (error) {
         return emptySession(`Project state is unavailable: ${describeError(error)}`, 'environment');
     }
+    const scope = options.scope ?? mintScope(projectId, options.sessionId);
     // The head serves; the tail is fallen over to, in order, when it cannot.
     const primary = primaryProvider(prefs);
     const entry = PROVIDER_REGISTRY[primary.id];
@@ -583,9 +601,9 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // line any more: `probeAgentSession` reports the same gap as a
         // `credentialGap` and the App routes into the picker, where a credential
         // can actually be entered. What still arrives here is a headless caller —
-        // `run`, `run-stream`, `drain` — which has no picker and for which both
+        // `exec`, `exec --json`, `drain` — which has no picker and for which both
         // pieces of advice below are real: an environment variable, or
-        // `--provider`. Keeping the refusal is what makes those runs fail rather
+        // `--provider`. Keeping the refusal is what makes those turns fail rather
         // than quietly start on something else.
         return emptySession(`No credential found for ${entry.label}${entry.id === 'zen' ? ' with the selected model. Choose muse-spark-1.3-contributor-free for public access' : ''}. Set one of: ${entry.envVars.join(', ')} — or pass --provider with one that is configured.`);
     }
@@ -826,7 +844,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
     const providerForSession = (sessionId) => primary.id === 'zen' || primary.id === 'zen-go'
         ? constructProvider(primary.id, det, model, { sessionId })
         : provider;
-    // Session-owned discovery with one drain cursor per run. A child shares the
+    // Session-owned discovery with one drain cursor per turn. A child shares the
     // discovered scopes without being able to consume the parent's update, and
     // an edit takes effect in this session rather than only after reconnecting.
     const projectInstructions = new ProjectInstructionTracker(cwd);
@@ -860,7 +878,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
         });
         throw err;
     }
-    // AFTER resolveSandbox returns — the honest report of what THIS run got,
+    // AFTER resolveSandbox returns — the honest report of what THIS turn got,
     // never what was attempted. `unconfined` decides the severity: per the
     // design, this is "the single highest-value line in the whole design,
     // today computed and thrown away" — an operator reading default `info`
@@ -870,6 +888,33 @@ export async function createAgentSession(prefs, detected, options = {}) {
         [EVENT_NAME_ATTRIBUTE]: BOOT_EVENT_NAMES.SANDBOX_RESOLVED,
         'namzu.sandbox.unconfined': sandbox.unconfined,
     });
+    // The two boundaries a turn can be asked to cross, as questions rather
+    // than refusals. A path outside the working directory is reviewed on a
+    // host turn (the kernel looks only when there is no sandbox, since a
+    // sandboxed path is not mounted to be reached). A sandboxed command's
+    // escape is reviewed unless the operator turned escapes off; it is
+    // confirmed only by a person, or by `allowUnattendedEscape`.
+    const sandboxEscape = options.sandbox?.allowEscape === false ? 'refuse' : 'review';
+    const escalation = { outsideRootAccess: 'review', sandboxEscape };
+    const unattendedSandboxEscape = options.sandbox?.allowUnattendedEscape === true ? 'allow' : 'refuse';
+    // Read once: whether this is WSL does not change inside a session.
+    const wsl = detectWsl();
+    // Whether the last send had somebody to answer a prompt. A child's
+    // environment is composed outside any send, so it reads this.
+    let lastSendInteractive = false;
+    const boundaryFor = (interactive) => ({
+        ...(sandbox.provider && sandbox.environment
+            ? { sandbox: { environment: sandbox.environment, enforced: sandbox.enforced } }
+            : {}),
+        escape: sandboxEscape === 'refuse'
+            ? 'refused'
+            : interactive
+                ? 'ask'
+                : unattendedSandboxEscape === 'allow'
+                    ? 'unattended'
+                    : 'refused',
+        interactive,
+    });
     // Always built: the executor hands it to the tools only where it is
     // safe — on the host, or inside a sandbox that can start a detached
     // process — so a session under a sandbox that cannot simply has none.
@@ -889,27 +934,41 @@ export async function createAgentSession(prefs, detected, options = {}) {
         if (absolute !== resolve(cwd) && !directories.includes(absolute))
             directories.push(absolute);
     }
-    const sessionDirectories = {
-        list: () => [...directories],
-        add: async (path) => {
-            const absolute = resolve(cwd, path);
-            if (absolute === resolve(cwd))
-                return {
-                    added: false,
-                    path: absolute,
-                    reason: 'That is the working directory.',
-                };
-            if (directories.includes(absolute))
-                return { added: false, path: absolute, reason: 'Already added.' };
-            const entry = await stat(absolute).catch(() => null);
-            if (!entry?.isDirectory())
-                return { added: false, path: absolute, reason: 'Not a directory.' };
-            directories.push(absolute);
-            return { added: true, path: absolute };
-        },
+    const sessionDirectories = createSessionDirectories(cwd, directories);
+    // `/restore` snapshots live with the conversation they belong to
+    // (`<session-id>/file-history/`), not in a tree of their own. Read per
+    // turn: `scope.sessionId` moves when the operator switches conversation.
+    const checkpoints = new FileCheckpointStore(() => paths.fileHistory({ sessionId: scope.sessionId }), cwd);
+    const { registry, memoryStore, memoryDirectory } = buildToolRegistry(paths, backgroundJobs, checkpoints, options.toolResultScreens);
+    // Once per store, idempotently: a launch that finds nothing to move moves
+    // nothing, and one interrupted halfway is finished by the next. A failure
+    // is a notice, never a refusal to start — the curated files and the store
+    // both still work without it.
+    const memoryMigrationNotices = await migrateMemoryOnce({
+        store: memoryStore,
+        directory: memoryDirectory,
+        cwd,
+    })
+        .then((report) => describeMemoryMigration(report, memoryDirectory))
+        .catch((error) => [
+        `Stored memory migration did not run: ${error instanceof Error ? error.message : String(error)}`,
+    ]);
+    /**
+     * The stored-memory index for this turn's prompt, or null. A store that
+     * refuses to read (a malformed memory file) costs the turn its index and
+     * the operator a notice, not the turn.
+     */
+    const storedMemoryPrompt = async () => {
+        try {
+            return { prompt: composeStoredMemoryPrompt(await memoryStore.readIndex()) };
+        }
+        catch (error) {
+            return {
+                prompt: null,
+                notice: `Stored memory index not loaded: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
     };
-    const checkpoints = new FileCheckpointStore(join(ensurePrivateStateDirectory(projectStateRoot, 'checkpoints'), scope.sessionId), cwd);
-    const { registry, memoryStore } = buildToolRegistry(cwd, projectStateRoot, backgroundJobs, checkpoints, options.stateRoot ? scope.projectId : undefined, options.toolResultScreens);
     // Package presence is not tool reachability. The CLI used to probe and
     // report @namzu/computer-use without ever constructing its host or mounting
     // SDK's computer_use definition, so even an installed, healthy package was
@@ -958,12 +1017,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // Per-send denial further keeps the schemas out of ordinary human turns.
     const goalAuthorities = new Map();
     // A child is created after the parent query has started, from inside its
-    // Agent tool. Keying the review channel by the executing run keeps two
+    // Agent tool. Keying the review channel by the executing turn keeps two
     // concurrent sends from borrowing each other's prompt or approval latch.
     const delegatedResumeHandlers = new Map();
     const goalToolNames = new Set(SESSION_GOAL_TOOL_NAMES);
     if (options.sessionGoals) {
-        registry.register(buildSessionGoalTools(options.sessionGoals, (runId) => goalAuthorities.get(runId)));
+        registry.register(buildSessionGoalTools(options.sessionGoals, (turnId) => goalAuthorities.get(turnId)));
     }
     // External tool servers, before the roster is counted, so `toolNames` and
     // the `/tools` list a user reads include what they configured. Connecting
@@ -1036,13 +1095,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const history = options.residentHistory;
         const historyOwner = { ...scope };
         registry.register(buildResidentHistoryTools((context) => {
-            const owner = delegationScopes.get(context.runId);
+            const owner = delegationScopes.get(context.turnId);
             if (!owner ||
                 owner.sessionId !== historyOwner.sessionId ||
                 owner.projectId !== historyOwner.projectId ||
                 owner.tenantId !== historyOwner.tenantId ||
                 owner.tenantId !== history.scope.tenantId)
-                throw new Error('The requesting run does not own this resident history.');
+                throw new Error('The requesting turn does not own this resident history.');
             return history;
         }));
     }
@@ -1050,14 +1109,14 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const evidence = options.residentToolEvidence;
         const evidenceOwner = { ...scope };
         registry.register(buildResidentToolEvidenceTools((context) => {
-            const owner = delegationScopes.get(context.runId);
+            const owner = delegationScopes.get(context.turnId);
             if (!owner ||
                 owner.sessionId !== evidenceOwner.sessionId ||
                 owner.projectId !== evidenceOwner.projectId ||
                 owner.tenantId !== evidenceOwner.tenantId ||
                 owner.projectId !== evidence.scope.projectId ||
                 owner.tenantId !== evidence.scope.tenantId)
-                throw new Error('The requesting run does not own this resident tool evidence.');
+                throw new Error('The requesting turn does not own this resident tool evidence.');
             return evidence;
         }));
     }
@@ -1065,11 +1124,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const sessions = options.conversationSessions;
         for (const build of [buildConversationSearchTool, buildConversationReadTool])
             registry.register(build((context) => {
-                const owner = delegationScopes.get(context.runId);
+                const owner = delegationScopes.get(context.turnId);
                 if (!owner ||
                     owner.projectId !== sessions.projectId ||
                     owner.tenantId !== sessions.tenantId)
-                    throw new Error('The requesting run does not own this conversation.');
+                    throw new Error('The requesting turn does not own this conversation.');
                 return { sessions, sessionId: owner.sessionId };
             }));
     }
@@ -1080,18 +1139,31 @@ export async function createAgentSession(prefs, detected, options = {}) {
             return [];
         let step = evidenceRecallSteps.get(sessionId);
         if (!step) {
-            step = createConversationEvidenceRecall(sessions, sessionId, (runId) => {
-                const owner = delegationScopes.get(asRunId(runId));
+            step = createConversationEvidenceRecall(sessions, sessionId, (turnId) => {
+                const owner = turnId === undefined ? undefined : delegationScopes.get(turnId);
                 if (!owner ||
                     owner.sessionId !== sessionId ||
                     owner.tenantId !== sessions.tenantId ||
                     owner.projectId !== sessions.projectId)
-                    throw new Error('The requesting run no longer owns this conversation.');
+                    throw new Error('The requesting turn no longer owns this conversation.');
             }, options.compaction?.resolveEvidenceQueries !== false);
             evidenceRecallSteps.set(sessionId, step);
         }
         return [step];
     };
+    // The saved children of a conversation, read back from the session index and
+    // the child logs: the delegation history a turn is told about.
+    const conversationIndex = options.conversationSessions?.index;
+    const savedAgentsSteps = (sessionId) => conversationIndex
+        ? [
+            createSavedAgentsStep(createSavedAgentHistory({
+                index: conversationIndex,
+                paths,
+                session: { sessionId },
+                log: cliLogger(),
+            })),
+        ]
+        : [];
     let subagentRuntime;
     // Stays empty when the runtime below throws, which is the honest answer: the
     // catch is non-fatal and the session then genuinely has no delegate to
@@ -1110,38 +1182,56 @@ export async function createAgentSession(prefs, detected, options = {}) {
             });
         }
         const sub = await createSubagentRuntime({
-            historyRoot: projectStateRoot,
             cwd,
             model,
             tokenBudget: options.limits?.tokenBudget,
             maxIterations: options.limits?.maxIterations,
-            resolveLimits: (runId) => delegationLimits.get(runId),
+            resolveLimits: (turnId) => delegationLimits.get(turnId),
             timeoutMs: options.limits?.timeoutMs,
             definitions: discovered.definitions,
-            pathBuilder: new SubagentPathBuilder(projectStateRoot, scope.projectId),
-            resolveParent: async (runId) => {
-                const parent = delegationScopes.get(runId);
+            // Children log under the parent's `<session-id>/subagents/`; an
+            // ephemeral session keeps them in memory with its own log.
+            ...(options.ephemeral ? {} : { paths }),
+            ...(conversationIndex
+                ? {
+                    savedAgents: (sessionId) => createSavedAgentHistory({
+                        index: conversationIndex,
+                        paths,
+                        session: { sessionId },
+                        log: cliLogger(),
+                    }),
+                }
+                : {}),
+            resolveParent: async (turnId) => {
+                const parent = delegationScopes.get(turnId);
                 if (!parent)
-                    throw new Error(`Run ${runId} no longer owns delegation authority`);
-                return resolveSubagentParent(parent, cwd, options.stateRoot ? hierarchyRoot : undefined);
+                    throw new Error(`Turn ${turnId} no longer owns delegation authority`);
+                return resolveSubagentParent(parent, cwd);
             },
             sandboxWorkspace,
-            resolveResumeHandler: (runId) => delegatedResumeHandlers.get(runId),
-            resolveWaitForInbound: (runId) => delegatedInputWaiters.get(runId),
+            resolveResumeHandler: (turnId) => delegatedResumeHandlers.get(turnId),
+            resolveWaitForInbound: (turnId) => delegatedInputWaiters.get(turnId),
             ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
             ...(options.sandbox?.teardownTimeoutMs !== undefined
                 ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
                 : {}),
+            // A child is reviewed through its parent's channel, so the same two
+            // questions reach the same person — or the same refusal.
+            ...escalation,
             // A sub-agent works in the same repository and writes the same code,
             // so it is bound by the same instructions. Without this the parent
             // honours the project's rules and every task it delegates quietly
             // does not — the worse half of the feature, because the delegating
             // turn reports success either way.
-            projectInstructionContext: () => projectInstructions.createRunContext(),
+            projectInstructionContext: () => projectInstructions.createTurnContext(),
             // Same argument as the instructions, one step further: a sub-agent that
             // does not know what day it is dates a changelog entry from a training
             // cut-off, and the parent reports the delegation as successful.
-            readEnvironment: async () => composeEnvironmentPrompt(await readEnvironmentFacts(cwd)),
+            readEnvironment: async () => composeEnvironmentPrompt({
+                ...(await readEnvironmentFacts(cwd)),
+                boundary: boundaryFor(lastSendInteractive),
+                ...(wsl ? { wsl } : {}),
+            }),
             // Each child has its own provider instance, never the parent's fallback cursor.
             resolveModel: async (request, signal) => {
                 const resolution = await resolveModelSwitch(request, {
@@ -1185,6 +1275,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         const models = await runPickerProviderOperation(signal, (childSignal) => source.listModels?.(childSignal) ?? Promise.resolve([]));
                         return models
                             .filter((m) => canSelectModel(item.entry, item.apiKey, m.id) &&
+                            isOfferableModel(item.entry.id, m.id) &&
                             terms.every((term) => `${item.entry.id} ${m.id} ${m.name}`.toLowerCase().includes(term)))
                             .map((m) => ({ provider: item.entry.id, ...m }));
                     }
@@ -1234,11 +1325,11 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 // deferred and there is nothing for a search to load.
                 //
                 // The store this also builds is dropped, deliberately: a sub-agent
-                // promoting its own run memory would write a record per
-                // delegation, and a parent that delegated six times would leave
-                // seven accounts of one piece of work for the next run to read.
-                // The parent's settle is the one that speaks for the whole task.
-                const childTools = buildToolRegistry(cwd, projectStateRoot, backgroundJobs, undefined, options.stateRoot ? scope.projectId : undefined, options.toolResultScreens).registry;
+                // promoting its own memory would write a record per delegation,
+                // and a parent that delegated six times would leave seven accounts
+                // of one piece of work for the next turn to read. The parent's
+                // settle is the one that speaks for the whole task.
+                const childTools = buildToolRegistry(paths, backgroundJobs, undefined, options.toolResultScreens).registry;
                 // Search owns its provider connection per call, so it is safe to share
                 // with a child. Preserve the parent's configured backend/off choice.
                 const search = registry.get('web_search');
@@ -1264,8 +1355,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // somebody is there to read it, the same condition `ask_user_question`
         // mounts under further down. A child's roster is the registry
         // `buildTools` builds above, which carries none of these: that is what
-        // keeps narration the run's own voice rather than a child's. And a
-        // headless host — `run`, `run-stream`, `drain`, the resident step —
+        // keeps narration the turn's own voice rather than a child's. And a
+        // headless host — `exec`, `exec --json`, `drain`, the resident step —
         // has no rail for a line to appear above, so a tool whose entire
         // result is "the operator saw this" would be answering with something
         // that did not happen.
@@ -1306,7 +1397,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
     const modelSwitchHandlers = new Map();
     if (options.allowModelSwitch) {
         registry.register(buildSwitchModelTool(async (request, context) => {
-            const handler = modelSwitchHandlers.get(context.runId);
+            const handler = modelSwitchHandlers.get(context.turnId);
             if (!handler || context.abortSignal?.aborted) {
                 return {
                     kind: 'rejected',
@@ -1345,14 +1436,15 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     return { action: 'continue' };
             }
         };
-        // The park request carries the run id of the call that asked; the
-        // handler above routes by the question, not by the run, and no durable
+        // The park request carries the turn of the call that asked; the
+        // handler above routes by the question, not by the turn, and no durable
         // park recorder is supplied.
         registry.register(buildAskUserQuestionTool({ resumeHandler: parkQuestion }));
     }
     // Task store → query registers task_create / task_update / task_list and
-    // emits task_created/task_updated, so the agent can track a plan for the
-    // current request. Tasks are run-scoped. The kernel's default availability
+    // emits task_created/task_updated, so the agent can track a plan. Tasks
+    // belong to the session (`<session-id>/tasks/`) and record the turn that
+    // created them, so a plan outlives the turn. The kernel's default availability
     // for them is `deferred`; this session overrides that to `active` at the
     // query call, because the doctrine tells the model to plan with them and a
     // tool it must search for first is a tool it skips.
@@ -1366,11 +1458,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // It is also why `toolNames` below reads the registry rather than a list
     // captured on this line. The count at connect time is unchanged; what
     // changes is that asking again later gets a later answer.
-    ensurePrivateStateDirectory(projectStateRoot, 'tenants');
-    const taskStoreForRun = (runId, tenantId) => new DiskTaskStore({
-        baseDir: projectStateRoot,
-        defaultRunId: runId,
-        tenantId,
+    const taskStoreFor = (sessionScope) => new DiskTaskStore({
+        paths,
+        session: { sessionId: sessionScope.sessionId },
+        tenantId: sessionScope.tenantId,
     });
     let selectedTaskStore;
     let taskSelectionGeneration = 0;
@@ -1392,10 +1483,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
         // and other asynchronous setup are still being prepared.
         resetTaskStore();
         const generation = taskSelectionGeneration;
-        return (runId, runScope) => {
-            const store = taskStoreForRun(runId, runScope.tenantId);
-            if (generation === taskSelectionGeneration && matchesCurrentScope(runScope)) {
-                selectedTaskStore = { scope: { ...runScope }, store };
+        return (sessionScope) => {
+            const store = taskStoreFor(sessionScope);
+            if (generation === taskSelectionGeneration && matchesCurrentScope(sessionScope)) {
+                selectedTaskStore = { scope: { ...sessionScope }, store };
             }
             return store;
         };
@@ -1403,7 +1494,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // Persists across turns: once the user picks "approve all", later tool
     // batches in this session run without prompting.
     const approval = { all: false };
-    // Share the project store with tools and recall. Each run selects either
+    // Share the project store with tools and recall. Each turn selects either
     // this extracted-claim promoter or explicit consolidation, never both.
     // Candidates without useful claims write nothing.
     const promoteMemory = createMemoryPromoter({ store: memoryStore });
@@ -1421,21 +1512,19 @@ export async function createAgentSession(prefs, detected, options = {}) {
         return emptySession(describeError(error));
     }
     // The session's own lifecycle, for hooks that set up or tear down
-    // something per session rather than per run. The run id is minted for
-    // these two calls: they belong to no turn. `session_start` waits for
-    // the first turn rather than firing here, because the conversation id
-    // the scope holds at construction is provisional — it is replaced when
-    // the conversation is first made durable — and a hook given the
-    // provisional id could never match it to a run.
+    // something per session rather than per turn. These two calls belong to no
+    // turn, so they carry no turn id — nothing is minted to fill the field.
+    // `session_start` waits for the first turn rather than firing here, because
+    // the conversation id the scope holds at construction is provisional — it
+    // is replaced when the conversation is first made durable — and a hook
+    // given the provisional id could never match it to a turn.
     const sessionPlugins = pluginRuntime;
-    const sessionHookRunId = generateRunId();
     let sessionStarted = false;
     const announceSessionStart = async () => {
         if (!sessionPlugins || sessionStarted)
             return;
         sessionStarted = true;
         await sessionPlugins.manager.executeHooks('session_start', {
-            runId: sessionHookRunId,
             sessionId: scope.sessionId,
         });
     };
@@ -1484,7 +1573,6 @@ export async function createAgentSession(prefs, detected, options = {}) {
             sessionPlugins
                 ? sessionPlugins.manager
                     .executeHooks('session_end', {
-                    runId: sessionHookRunId,
                     sessionId: scope.sessionId,
                 })
                     .catch(() => [])
@@ -1549,14 +1637,15 @@ export async function createAgentSession(prefs, detected, options = {}) {
         effortNotice = `Reasoning effort levels could not be established for this session: ${describeError(error)}`;
     }
     /**
-     * The kernel's resume with this session's half of the run attached: the
+     * The kernel's resume with this session's half of the turn attached: the
      * provider, the tools, the working directory, the doctrine — the part a
      * checkpoint cannot carry. `resumeDurable` and `resumePaused` differ only
-     * in where the run and its store come from.
+     * in where the log and its lease come from.
      */
-    const kernelResume = ({ entry, checkpointStore, claimFence, signal, checkpointId, listener, }) => operations.promise(signal, async (ownedSignal) => {
+    const kernelResume = ({ entry, sessionLog, checkpointStore, lease, signal, checkpointId, listener, }) => operations.promise(signal, async (ownedSignal) => {
         const selectTaskStore = beginTaskStoreReadout();
-        const resumedLimits = (await readStoredRunGuards(join(pathBuilder.runDir(entry.projectId, entry.sessionId, entry.runId), 'run.json'), entry)) ?? resolveRunGuards(options.limits);
+        // The turn's own limits, as its `turn_started` recorded them.
+        const resumedLimits = (await readStoredTurnGuards(sessionLog, entry.turnId)) ?? resolveTurnGuards(options.limits);
         // The same prelude a turn runs, and for the same reasons: a lapsed
         // OAuth token has to be renewed before the provider is used, and the
         // fallback chain has to be built AFTER that so its members do not
@@ -1568,10 +1657,17 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const curatedMemory = readMemory(undefined, cwd);
         for (const notice of formatMemoryDiagnostics(curatedMemory))
             cliLogger().warn(notice);
-        const memoryPrompt = composeMemoryPrompt(curatedMemory);
+        const storedMemory = await storedMemoryPrompt();
+        if (storedMemory.notice)
+            cliLogger().warn(storedMemory.notice);
+        const memoryPrompt = [composeMemoryPrompt(curatedMemory), storedMemory.prompt]
+            .filter((part) => Boolean(part))
+            .join('\n\n') || null;
         const environmentPrompt = composeEnvironmentPrompt({
             ...(await readEnvironmentFacts(cwd)),
             additionalDirectories: [...directories],
+            boundary: boundaryFor(false),
+            ...(wsl ? { wsl } : {}),
         });
         const systemPrompt = [
             NAMZU_IDENTITY,
@@ -1583,29 +1679,27 @@ export async function createAgentSession(prefs, detected, options = {}) {
         ]
             .filter((s) => Boolean(s))
             .join('\n\n') || undefined;
-        const resumeHandler = makeResumeHandler(approval, undefined, options.permissionMode, (name, input) => isPromptExempt(registry, name, input));
-        if (delegatedResumeHandlers.has(entry.runId)) {
-            throw new Error(`Run ${entry.runId} already owns a delegated review channel.`);
+        const resumeHandler = makeResumeHandler(approval, undefined, options.permissionMode, (name, input) => isPromptExempt(registry, name, input), { unattendedSandboxEscape });
+        if (delegatedResumeHandlers.has(entry.turnId)) {
+            throw new Error(`Turn ${entry.turnId} already owns a delegated review channel.`);
         }
-        delegatedResumeHandlers.set(entry.runId, resumeHandler);
-        delegationScopes.set(entry.runId, { ...entry, topicId: scope.topicId });
-        delegationLimits.set(entry.runId, resumedLimits);
-        const runTaskStore = selectTaskStore(entry.runId, {
-            ...entry,
-            topicId: scope.topicId,
-        });
+        const turnScope = { ...entry, topicId: scope.topicId };
+        delegatedResumeHandlers.set(entry.turnId, resumeHandler);
+        delegationScopes.set(entry.turnId, turnScope);
+        delegationLimits.set(entry.turnId, resumedLimits);
+        const turnTaskStore = selectTaskStore(turnScope);
         try {
-            return await resumeRun({
+            return await resumeSession({
                 provider: providerForSession(entry.sessionId),
                 fallbackProviders: fallbackPlan.build(currentToken, entry.sessionId),
                 tools: registry,
                 pluginManager: pluginRuntime?.manager,
                 skillRegistry: pluginRuntime?.skills,
                 skills: pluginSkills,
-                taskStore: runTaskStore,
+                taskStore: turnTaskStore,
                 ...(webCapability ? { web: webCapability } : {}),
-                // The same availability the original run registered under.
-                // A resumed run re-registers the task tools; leaving them at
+                // The same availability the original turn registered under.
+                // A resumed turn re-registers the task tools; leaving them at
                 // the kernel's `deferred` default would hand the model a plan
                 // it started with active tools and can no longer update.
                 runtimeToolOverrides: {
@@ -1614,9 +1708,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     task_list: 'active',
                 },
                 ...(subagentRuntime
-                    ? {
-                        taskScheduler: await subagentRuntime.gatewayForRun(entry.runId),
-                    }
+                    ? { taskScheduler: await subagentRuntime.gatewayForTurn(entry.turnId) }
                     : {}),
                 authorizationGate: gateFor(options.rules),
                 compactionConfig: compactionConfigFor(options.compaction),
@@ -1624,8 +1716,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     ? (options.compaction?.retainedToolPreviewChars ?? 4_000)
                     : undefined,
                 prepareStep: [
-                    createTaskContextStep(runTaskStore, entry.tenantId),
-                    createDelegationHistoryStep(projectStateRoot, entry.sessionId),
+                    createTaskContextStep(turnTaskStore, entry.tenantId),
+                    ...savedAgentsSteps(entry.sessionId),
                     ...(options.memory?.recall === false
                         ? []
                         : [
@@ -1640,98 +1732,98 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 ...(options.compaction?.consolidate
                     ? { consolidateInto: memoryStore }
                     : { promoteMemory }),
-                projectInstructionContext: projectInstructions.createRunContext(),
-                pathBuilder,
+                projectInstructionContext: projectInstructions.createTurnContext(),
+                paths,
                 ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
                 ...(options.sandbox?.teardownTimeoutMs !== undefined
                     ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
                     : {}),
-                // NOT `emergencySave`, unlike a turn. The manager is a singleton
-                // whose `attach` detaches whoever held it before, so a caller
-                // resuming several runs in one process would leave only the last
-                // one covered — and would look covered. A turn owns its process
-                // end to end; a drainer does not.
-                runConfig: {
+                turnConfig: {
                     model,
                     ...(nativeWebSearch ? { webSearch: nativeWebSearch } : {}),
                     ...(sandbox.provider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                     ...resumedLimits,
                     maxResponseTokens: 8192,
                     permissionMode: 'auto',
+                    pruneKeepLast: CLI_CHECKPOINT_RETENTION,
                 },
                 agentId: 'namzu',
                 agentName: 'namzu',
                 ...(systemPrompt ? { systemPrompt } : {}),
                 workingDirectory: cwd,
                 ...(directories.length > 0 ? { additionalDirectories: [...directories] } : {}),
-                ...(options.limits ? { limits: options.limits } : {}),
+                ...escalation,
                 // No `onPermission`: there is nobody at a drainer's terminal, so a
-                // prompt would block the pass forever on a run nobody is watching.
+                // prompt would block the pass forever on a turn nobody is watching.
                 // The gate's deny rules still apply.
-                // One presenter for the whole stream, built from the registry this
-                // scope already holds. It was the absence of the registry HERE that
-                // forced presentation to be name matching: `toAgentEvent` was pure
-                // over a `RunEvent` and could not ask a tool anything.
                 resumeHandler,
                 signal: ownedSignal,
-                // Attribution comes from the ENTRY, not from this session: the run
+                // Attribution comes from the ENTRY, not from this session: the turn
                 // belongs to whoever started it, and stamping the drainer's ids onto
                 // it would file another tenant's work under this one.
                 tenantId: entry.tenantId,
                 projectId: entry.projectId,
                 sessionId: entry.sessionId,
-                // …except the topic, which no checkpoint records — see
-                // `RunStateScope`. This one is the drainer's, and honestly so:
-                // supplied here rather than pretended to have been recovered.
+                // …except the topic, which the drainer supplies honestly rather
+                // than pretending to have recovered it.
                 topicId: scope.topicId,
-                scope: { ...entry, topicId: scope.topicId },
-                checkpointStore,
-                ...(claimFence !== undefined ? { claimFence } : {}),
+                scope: turnScope,
+                sessionLog,
+                checkpointStore: checkpointStore ??
+                    new DiskSessionCheckpointStore({
+                        paths,
+                        log: sessionLogCheckpointView(sessionLog),
+                        // A drained child's log sits under its parent's `subagents/`;
+                        // its checkpoints are in its own directory there, not at the top.
+                        ...(sessionLog instanceof DiskSessionLog && sessionLog.locator
+                            ? { session: sessionLog.locator }
+                            : {}),
+                    }),
+                ...(lease ? { lease } : {}),
                 ...(checkpointId !== undefined ? { checkpointId } : {}),
-                ...(listener ? { listener } : {}),
+                ...(listener || options.onSessionEvent
+                    ? {
+                        listener: (event) => {
+                            options.onSessionEvent?.(event);
+                            listener?.(event);
+                        },
+                    }
+                    : {}),
             });
         }
         finally {
-            if (delegatedResumeHandlers.get(entry.runId) === resumeHandler) {
-                delegatedResumeHandlers.delete(entry.runId);
-                delegationScopes.delete(entry.runId);
-                delegationLimits.delete(entry.runId);
-                await subagentRuntime?.releaseRun(entry.runId);
+            if (delegatedResumeHandlers.get(entry.turnId) === resumeHandler) {
+                delegatedResumeHandlers.delete(entry.turnId);
+                delegationScopes.delete(entry.turnId);
+                delegationLimits.delete(entry.turnId);
+                await subagentRuntime?.releaseTurn(entry.turnId);
             }
         }
     });
     /**
-     * `resumeRun` drains the loop and returns a settled run; the events go to a
-     * listener. A small queue turns that into the stream `send` gives, so a
-     * headless caller renders a resumed run exactly as it rendered the turn.
+     * `resumeSession` drains the loop and returns a settled turn; the events go
+     * to a listener. A small queue turns that into the stream `send` gives, so a
+     * headless caller renders a resumed turn exactly as it rendered the first
+     * segment.
      */
-    const resumePausedStream = ({ runId, checkpointId, signal, }) => {
+    const resumePausedStream = ({ turnId, checkpointId, signal, }) => {
         const queue = [];
         let wake;
         let settled = false;
         let failure;
         const presenter = createToolPresenter(registry);
-        // The store the turn's run manager wrote to, built the same way it
-        // built it (see the kernel's `RunPersistence`): the session directory's
-        // `runs/`, attributed to this tenant and project.
-        const store = new DiskCheckpointStore({
-            baseDir: join(pathBuilder.sessionDir(scope.projectId, scope.sessionId), 'runs'),
-        }, {
-            tenantId: scope.tenantId,
-            projectId: scope.projectId,
-            sessionId: scope.sessionId,
-        });
-        const entry = {
-            tenantId: scope.tenantId,
-            projectId: scope.projectId,
-            sessionId: scope.sessionId,
-            runId: runId,
-        };
+        // The log the turn appends to, and its checkpoints beside it.
+        const sessionLog = DiskSessionLog.at(paths, { sessionId: scope.sessionId });
         const outcome = kernelResume({
-            entry,
-            checkpointStore: store,
+            entry: {
+                tenantId: scope.tenantId,
+                projectId: scope.projectId,
+                sessionId: scope.sessionId,
+                turnId: turnId,
+            },
+            sessionLog,
             ...(signal ? { signal } : {}),
-            checkpointId: checkpointId,
+            ...(checkpointId !== undefined ? { checkpointId: checkpointId } : {}),
             listener: (event) => {
                 queue.push(event);
                 wake?.();
@@ -1740,8 +1832,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
             .then((result) => {
             if (!result.resumed) {
                 failure = new Error(result.reason === 'no-checkpoint'
-                    ? `no checkpoint ${checkpointId} is recorded for run ${runId}`
-                    : `run ${runId} is parked on a decision only a person can answer`);
+                    ? `no checkpoint ${checkpointId ?? ''} is recorded for turn ${turnId}`.replace('  ', ' ')
+                    : `turn ${turnId} is parked on a decision only a person can answer`);
             }
         })
             .catch((err) => {
@@ -1790,23 +1882,30 @@ export async function createAgentSession(prefs, detected, options = {}) {
             const sessionId = scope.sessionId;
             const sessions = options.conversationSessions;
             await prepareProviderCredential(signal);
-            return compactNow({
-                messages,
+            const common = {
                 config: compactionConfigFor(options.compaction),
                 provider: providerForSession(sessionId),
                 model,
                 signal,
-                ...(sessions
-                    ? {
-                        onShed: async (removed) => {
-                            if (sessions.projectId !== scope.projectId ||
-                                sessions.tenantId !== scope.tenantId)
-                                throw new Error('Manual compaction is outside the current conversation scope.');
-                            await retainManualCompaction(sessions, sessionId, removed, signal);
-                        },
-                    }
-                    : {}),
-            });
+            };
+            // A durable conversation compacts its own log: the kernel folds the
+            // context from it and appends a `compaction{ trigger: 'manual' }`
+            // record outside any turn, so the originals stay in the log and a
+            // resume folds the summary. A session with no log compacts the
+            // history it was handed.
+            if (sessions && !options.ephemeral) {
+                if (sessions.projectId !== scope.projectId || sessions.tenantId !== scope.tenantId)
+                    throw new Error('Manual compaction is outside the current conversation scope.');
+                return await compactSession({
+                    ...common,
+                    sessionId,
+                    locator: {
+                        log: DiskSessionLog.at(paths, { sessionId }),
+                        index: sessions.index,
+                    },
+                });
+            }
+            return compactNow({ ...common, messages });
         }),
         // Reads the same registry object the deferred registration mutates, at
         // call time — the pair of `promptExemptTools` below, and for the same
@@ -1838,16 +1937,22 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 listener(job);
         }) ?? (() => { }),
         ...(subagentRuntime ? { subagents: subagentRuntime.activity } : {}),
-        savedChildren: () => replaySavedChildrenFor({
-            sessionsRoot: join(projectStateRoot, 'sessions'),
-            sessionId: scope.sessionId,
-            log: cliLogger(),
-        }),
-        listOrchestrationRuns: () => listSavedOrchestrationRuns({
-            sessionsRoot: join(projectStateRoot, 'sessions'),
-            sessionId: scope.sessionId,
-            log: cliLogger(),
-        }),
+        ...(conversationIndex
+            ? {
+                savedChildren: () => replaySavedChildrenFor({
+                    index: conversationIndex,
+                    paths,
+                    session: { sessionId: scope.sessionId },
+                    log: cliLogger(),
+                }),
+                listSavedBatches: () => listSavedBatches({
+                    index: conversationIndex,
+                    paths,
+                    session: { sessionId: scope.sessionId },
+                    log: cliLogger(),
+                }),
+            }
+            : {}),
         get instructionFiles() {
             return projectInstructions.instructionFiles;
         },
@@ -1870,7 +1975,18 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 : []),
             ...unresolvedNotice.map((line) => `Provider chain: capabilities could not be established for ${line}.`),
             ...fallbackPlan.notices,
+            ...memoryMigrationNotices,
         ],
+        rememberNote: (text, type) => saveTypedNote(memoryStore, text, type),
+        importCuratedNotes: async () => describeCuratedNotesImport(await importCuratedNotes({ store: memoryStore, directory: memoryDirectory, cwd }), memoryDirectory),
+        storedMemoryIndex: async () => ({
+            directory: memoryDirectory,
+            index: await memoryStore.readIndex({ maxLines: Number.POSITIVE_INFINITY }),
+            derived: await memoryStore.readIndex({
+                maxLines: Number.POSITIVE_INFINITY,
+                derived: true,
+            }),
+        }),
         webSearchSummary: webSearchLabel(options.web, nativeSearchAvailable),
         close: () => operations.close(),
         errorHint: null,
@@ -1883,22 +1999,41 @@ export async function createAgentSession(prefs, detected, options = {}) {
         promptExemptTools: () => promptExemptToolNames(registry).filter((name) => !goalToolNames.has(name)),
         send: (messages, opts) => operations.stream(opts?.signal, (signal) => (async function* () {
             const selectTaskStore = beginTaskStoreReadout();
-            const runId = opts?.runId ?? generateRunId();
-            const turnLimits = resolveRunGuards(options.limits, opts?.limits);
-            const turnOpts = { ...opts, runId, signal };
+            const turnLimits = resolveTurnGuards(options.limits, opts?.limits);
+            const turnOpts = { ...opts, signal };
             let runTools = registry;
-            const resumeHandler = makeResumeHandler(approval, opts?.onPermission, opts?.permissionMode ?? options.permissionMode, (name, input) => isPromptExempt(runTools, name, input));
-            if (delegatedResumeHandlers.has(runId)) {
-                throw new Error(`Run ${runId} already owns a delegated review channel.`);
-            }
-            delegatedResumeHandlers.set(runId, resumeHandler);
-            if (opts?.onModelSwitch)
-                modelSwitchHandlers.set(runId, opts.onModelSwitch);
-            if (opts?.waitForInbound)
-                delegatedInputWaiters.set(runId, opts.waitForInbound);
+            lastSendInteractive = opts?.onPermission !== undefined;
+            const resumeHandler = makeResumeHandler(approval, opts?.onPermission, opts?.permissionMode ?? options.permissionMode, (name, input) => isPromptExempt(runTools, name, input), { unattendedSandboxEscape });
             const turnScope = { ...scope };
-            delegationScopes.set(runId, turnScope);
-            delegationLimits.set(runId, turnLimits);
+            // The turn's id is reserved here, before the kernel begins it, because
+            // everything that authorizes the turn is keyed by it: the review
+            // channel its children borrow, the delegation gateway, the goal-round
+            // authority. A caller may reserve it itself (a resident step names
+            // its turn to its verifier first).
+            const turnId = opts?.turnId ?? generateTurnId();
+            const claimed = new Set();
+            let capturedAuthority;
+            const claimTurn = (turnId) => {
+                if (claimed.has(turnId))
+                    return;
+                if (delegatedResumeHandlers.has(turnId)) {
+                    throw new Error(`Turn ${turnId} already owns a delegated review channel.`);
+                }
+                claimed.add(turnId);
+                delegatedResumeHandlers.set(turnId, resumeHandler);
+                if (opts?.onModelSwitch)
+                    modelSwitchHandlers.set(turnId, opts.onModelSwitch);
+                if (opts?.waitForInbound)
+                    delegatedInputWaiters.set(turnId, opts.waitForInbound);
+                delegationScopes.set(turnId, turnScope);
+                delegationLimits.set(turnId, turnLimits);
+                if (capturedAuthority) {
+                    if (goalAuthorities.has(turnId)) {
+                        throw new Error(`Turn ${turnId} already owns goal-round authority.`);
+                    }
+                    goalAuthorities.set(turnId, capturedAuthority);
+                }
+            };
             try {
                 // Renew a lapsed OAuth token before the turn runs (no-op for valid
                 // tokens and non-subscription credentials).
@@ -1927,7 +2062,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 for (const notice of formatMemoryDiagnostics(curatedMemory)) {
                     yield { kind: 'context', text: notice, shed: false };
                 }
-                const memoryPrompt = composeMemoryPrompt(curatedMemory);
+                const storedMemory = await storedMemoryPrompt();
+                if (storedMemory.notice) {
+                    yield { kind: 'context', text: storedMemory.notice, shed: false };
+                }
+                const memoryPrompt = [composeMemoryPrompt(curatedMemory), storedMemory.prompt]
+                    .filter((part) => Boolean(part))
+                    .join('\n\n') || null;
                 currentOnQuestion = opts?.onQuestion;
                 const [environmentFacts, turnSnapshot] = await Promise.all([
                     readEnvironmentFacts(cwd),
@@ -1936,10 +2077,16 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 const environmentPrompt = composeEnvironmentPrompt({
                     ...environmentFacts,
                     additionalDirectories: [...directories],
+                    boundary: boundaryFor(opts?.onPermission !== undefined),
+                    ...(wsl ? { wsl } : {}),
                 });
                 // The repository as it stood when THIS turn began, through the
-                // SDK's `turn` placement — the ephemeral trailing message that is
-                // never cached and never enters history. FIRST iteration only:
+                // SDK's `context` placement — request-only context after the
+                // history that never enters it. An observation, not an
+                // instruction: under `turn` it rode a system message the
+                // hoisting driver moves ahead of the conversation, so every
+                // new send's changed snapshot re-read the whole history
+                // uncached. FIRST iteration only:
                 // later iterations work from state the model itself changed, and
                 // `git status` is the honest source for that. A registry per
                 // turn, closed over this turn's snapshot, rather than one
@@ -1949,7 +2096,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 const promptContributions = new PromptContributionRegistry();
                 promptContributions.register({
                     id: 'namzu.turn-snapshot',
-                    placement: 'turn',
+                    placement: 'context',
                     render: ({ iteration }) => (iteration === 1 ? turnSnapshotPrompt : null),
                 });
                 // The citation rules that come with the web tools, only when the
@@ -1972,12 +2119,12 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     const bundle = opts?.residentLearningDisclosure === 'on-demand'
                         ? createResidentStepContext({
                             ...contextOptions,
-                            authorizeLearningRead: (context) => context.runId === runId &&
-                                delegationScopes.get(context.runId) === turnScope,
+                            authorizeLearningRead: (context) => claimed.has(context.turnId) &&
+                                delegationScopes.get(context.turnId) === turnScope,
                         })
                         : { contributions: createResidentStepContributions(contextOptions), tools: [] };
                     if (bundle.tools.length) {
-                        // Per-send membership: neither another send nor delegated runs inherit this tool.
+                        // Per-send membership: neither another send nor delegated sessions inherit this tool.
                         runTools = runTools.fork();
                         for (const tool of bundle.tools)
                             runTools.register(tool);
@@ -2015,10 +2162,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     .join('\n\n') || undefined;
                 await announceSessionStart();
                 checkpoints.beginTurn(lastUserText(messages));
-                let capturedAuthority;
                 if (opts?.goalRound) {
-                    if (!opts.runId)
-                        throw new Error('A goal round requires a caller-reserved runId.');
                     if (!options.sessionGoals)
                         throw new Error('This session has no durable goal store.');
                     if (opts.goalRound.sessionId !== scope.sessionId ||
@@ -2035,13 +2179,32 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         current.maxGoalRounds !== opts.goalRound.maxGoalRounds) {
                         throw new Error('Goal-round authority is stale or does not match the durable goal.');
                     }
-                    if (goalAuthorities.has(opts.runId)) {
-                        throw new Error(`Run ${opts.runId} already owns goal-round authority.`);
-                    }
                     capturedAuthority = Object.freeze({ ...opts.goalRound });
-                    goalAuthorities.set(opts.runId, capturedAuthority);
                 }
-                const runTaskStore = selectTaskStore(runId, turnScope);
+                claimTurn(turnId);
+                const turnTaskStore = selectTaskStore(turnScope);
+                // An ephemeral session keeps its whole turn in memory: a fresh
+                // log per send, opened with the `session_started` a turn follows.
+                // A durable one appends to `<session-id>.jsonl`, created first
+                // when this session is the one bringing it into existence.
+                let ephemeralLog;
+                if (options.ephemeral) {
+                    ephemeralLog = new InMemorySessionLog({ sessionId: turnScope.sessionId });
+                    await ensureSessionStarted(ephemeralLog, {
+                        ...turnScope,
+                        cwd,
+                        agent: { id: 'namzu', name: 'namzu' },
+                        ...(options.origin ? { origin: options.origin } : {}),
+                    });
+                }
+                else {
+                    await ensureSessionStarted(DiskSessionLog.at(paths, { sessionId: turnScope.sessionId }), {
+                        ...turnScope,
+                        cwd,
+                        agent: { id: 'namzu', name: 'namzu' },
+                        ...(options.origin ? { origin: options.origin } : {}),
+                    });
+                }
                 try {
                     yield* runTurn({
                         provider: providerForSession(turnScope.sessionId),
@@ -2071,9 +2234,13 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         skillRegistry: pluginRuntime?.skills,
                         skills: pluginSkills,
                         scope: turnScope,
-                        pathBuilder,
+                        turnId,
+                        paths,
+                        ...(ephemeralLog ? { sessionLog: ephemeralLog } : {}),
+                        claimTurn,
                         workingDirectory: cwd,
                         ...(directories.length > 0 ? { additionalDirectories: [...directories] } : {}),
+                        escalation,
                         limits: turnLimits,
                         sandboxWorkspace,
                         rules: options.rules,
@@ -2082,8 +2249,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
                         maxAnswerReviews: options.maxAnswerReviews,
                         promoteMemory: options.compaction?.consolidate ? undefined : promoteMemory,
                         prepareStep: [
-                            createTaskContextStep(runTaskStore, turnScope.tenantId),
-                            createDelegationHistoryStep(projectStateRoot, turnScope.sessionId),
+                            createTaskContextStep(turnTaskStore, turnScope.tenantId),
+                            ...savedAgentsSteps(turnScope.sessionId),
                             ...(options.memory?.recall === false
                                 ? []
                                 : [
@@ -2097,26 +2264,25 @@ export async function createAgentSession(prefs, detected, options = {}) {
                             ...evidenceRecallFor(turnScope.sessionId),
                             ...(options.residentEvidenceRecall ? [options.residentEvidenceRecall] : []),
                         ],
-                        taskStore: runTaskStore,
+                        taskStore: turnTaskStore,
                         systemPrompt,
                         messages,
-                        projectInstructionContext: projectInstructions.createRunContext(),
+                        projectInstructionContext: projectInstructions.createTurnContext(),
                         opts: turnOpts,
                         resumeHandler,
-                        taskGateway: await subagentRuntime?.gatewayForRun(runId),
-                        completionInbox: await subagentRuntime?.completionInboxForRun(runId),
+                        taskGateway: await subagentRuntime?.gatewayForTurn(turnId),
+                        completionInbox: await subagentRuntime?.completionInboxForTurn(turnId),
                         promptContributions,
                         ...(webCapability ? { web: webCapability } : {}),
                         ...(nativeWebSearch ? { webSearch: nativeWebSearch } : {}),
-                        // Tasks join this run's registry inside query, after the fork.
+                        // Tasks join this turn's registry inside query, after the fork.
                         // Keep the existing eager path unless deferral was requested.
                         runtimeToolOverrides: {
                             task_create: options.toolLoading === 'deferred' ? 'deferred' : 'active',
                             task_update: options.toolLoading === 'deferred' ? 'deferred' : 'active',
                             task_list: options.toolLoading === 'deferred' ? 'deferred' : 'active',
                         },
-                        emergencySave: options.emergencySave ?? true,
-                        onRunEvent: options.onRunEvent,
+                        onSessionEvent: options.onSessionEvent,
                         ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
                         ...(options.sandbox?.teardownTimeoutMs !== undefined
                             ? {
@@ -2126,31 +2292,36 @@ export async function createAgentSession(prefs, detected, options = {}) {
                     });
                 }
                 finally {
-                    if (opts?.runId &&
-                        capturedAuthority &&
-                        goalAuthorities.get(opts.runId) === capturedAuthority) {
-                        goalAuthorities.delete(opts.runId);
+                    for (const turnId of claimed) {
+                        if (capturedAuthority && goalAuthorities.get(turnId) === capturedAuthority) {
+                            goalAuthorities.delete(turnId);
+                        }
                     }
                 }
             }
             finally {
-                if (delegatedResumeHandlers.get(runId) === resumeHandler) {
-                    delegatedResumeHandlers.delete(runId);
-                    modelSwitchHandlers.delete(runId);
-                    delegatedInputWaiters.delete(runId);
-                    delegationScopes.delete(runId);
-                    delegationLimits.delete(runId);
-                    await subagentRuntime?.releaseRun(runId);
+                for (const turnId of claimed) {
+                    if (delegatedResumeHandlers.get(turnId) !== resumeHandler)
+                        continue;
+                    delegatedResumeHandlers.delete(turnId);
+                    modelSwitchHandlers.delete(turnId);
+                    delegatedInputWaiters.delete(turnId);
+                    delegationScopes.delete(turnId);
+                    delegationLimits.delete(turnId);
+                    await subagentRuntime?.releaseTurn(turnId);
                 }
             }
         })()),
-        resumeDurable: ({ entry, checkpointStore, claimFence, signal }) => kernelResume({
-            entry,
-            checkpointStore,
-            ...(claimFence !== undefined ? { claimFence } : {}),
-            ...(signal ? { signal } : {}),
-        }),
+        resumeDurable: (params) => kernelResume(params),
         resumePaused: (params) => resumePausedStream(params),
+        abandonTurn: (turnId, reason) => operations.promise(undefined, async () => {
+            if (options.ephemeral)
+                throw new Error('An ephemeral session keeps no turn to abandon.');
+            await abandonTurn(scope.sessionId, turnId, reason, {
+                log: DiskSessionLog.at(paths, { sessionId: scope.sessionId }),
+                ...(options.conversationSessions ? { index: options.conversationSessions.index } : {}),
+            });
+        }),
     };
 }
 function planFallbacks(members, detected) {
@@ -2292,6 +2463,9 @@ export function constructProvider(id, det, model, context = {}) {
                     }),
                 baseURL: det?.baseUrl,
                 model,
+                // Read at every lookup, so the launch's background catalogue refresh
+                // reaches this provider whenever it lands, including after now.
+                catalogue: activeZenCatalogue,
                 ...(context.sessionId ? { sessionId: context.sessionId } : {}),
             });
             return provider;
@@ -2379,7 +2553,7 @@ export async function describeProviderModels(id, det, signal) {
         signal?.throwIfAborted();
         // constructProvider calls ProviderRegistry.create, which throws
         // "Unsupported provider type" until the vendor package has registered
-        // itself. The run path registers lazily via ensureRegistered; the
+        // itself. The turn path registers lazily via ensureRegistered; the
         // listing path must do the same or every provider returns nothing.
         await ensureRegistered(id);
         signal?.throwIfAborted();
@@ -2389,7 +2563,11 @@ export async function describeProviderModels(id, det, signal) {
         const models = await runPickerProviderOperation(signal, (operationSignal) => provider.listModels?.(operationSignal) ?? Promise.resolve([]));
         return {
             kind: 'ok',
-            models: models.map((m) => ({
+            // A Zen id served with no known wire is listed by the driver for hosts
+            // that can name a protocol. This one cannot, so it is not offered.
+            models: models
+                .filter((m) => isOfferableModel(id, m.id))
+                .map((m) => ({
                 id: m.id,
                 name: m.name || m.id,
                 ...(m.inputModalities !== undefined ? { inputModalities: [...m.inputModalities] } : {}),
@@ -2499,15 +2677,20 @@ function lastUserText(messages) {
     return '';
 }
 /**
- * A scope for a session no host supplied one for: four minted ids. Minted
- * rather than spelled, because a spelled id is a place a typo hides and
- * these types accept either spelling until they are nominal.
+ * A scope for a session no host supplied one for.
+ *
+ * The project is the one the working directory's checkout stands for
+ * (`projects/<slug>/project.json`), not minted: a minted one gave every
+ * session a project of its own, so generated memory and task state were
+ * partitioned per launch and a second session in the same directory could
+ * not see what the first had saved. The session, topic and tenant stay
+ * minted — nothing here has a store to find existing ones in.
  */
-function mintScope() {
+function mintScope(projectId, sessionId) {
     return {
-        sessionId: generateSessionId(),
+        sessionId: sessionId ?? generateSessionId(),
         topicId: generateTopicId(),
-        projectId: generateProjectId(),
+        projectId,
         tenantId: generateTenantId(),
     };
 }
@@ -2544,7 +2727,7 @@ function gateFor(rules) {
 // unbounded context growth on long ones.
 //
 // `contextWindowTokens` is deliberately omitted: the SDK resolves the window
-// from `runConfig.model`, which is the value the user actually chose. Pinning
+// from `turnConfig.model`, which is the value the user actually chose. Pinning
 // a number here would fix one window across every model the CLI can talk to.
 const COMPACTION_CONFIG = {
     strategy: 'salience',
@@ -2588,11 +2771,11 @@ function compactionConfigFor(compaction) {
             : {}),
     };
 }
-async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTracker, provider, compactionConfig, consolidateInto, backgroundJobs, backgroundJobOwner, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, pathBuilder, workingDirectory, limits, additionalDirectories, sandboxWorkspace, rules, structuredOutput, reviewAnswer, maxAnswerReviews, promoteMemory, prepareStep, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, completionInbox, promptContributions, runtimeToolOverrides, webSearch, web, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
+async function* runTurn({ retainedToolPreviewChars, fileReadTracker, provider, compactionConfig, consolidateInto, backgroundJobs, backgroundJobOwner, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, turnId, paths, sessionLog, claimTurn, workingDirectory, limits, additionalDirectories, escalation, sandboxWorkspace, rules, structuredOutput, reviewAnswer, maxAnswerReviews, promoteMemory, prepareStep, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, completionInbox, promptContributions, runtimeToolOverrides, webSearch, web, sandboxProvider, sandboxTeardownTimeoutMs, onSessionEvent, }) {
     const signal = opts?.signal;
     // One presenter for the whole stream, built from the registry this scope
     // already holds. Its absence HERE is what forced presentation to be name
-    // matching in the first place: `toAgentEvent` is pure over a `RunEvent`
+    // matching in the first place: `toAgentEvent` is pure over a `SessionEvent`
     // and could not ask a tool anything, so the host guessed from the name.
     const presenter = createToolPresenter(tools);
     try {
@@ -2601,18 +2784,22 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
             ...(fileReadTracker ? { fileReadTracker } : {}),
             ...(structuredOutput ? { structuredOutput } : {}),
             provider,
-            pathBuilder,
-            ...(opts?.runId ? { runId: opts.runId } : {}),
+            paths,
+            ...(sessionLog ? { sessionLog } : {}),
+            // Reserved by the session, so a new turn begins under this id.
+            turnId,
+            ...(opts?.origin ? { origin: opts.origin } : {}),
+            ...(opts?.abandonInterrupted ? { abandonInterrupted: true } : {}),
             // Omitted rather than empty when there is no tail. `query` treats the
-            // two the same, but an absent option reads as "this run has no chain"
-            // where `[]` reads as "this run has a chain with nothing in it".
+            // two the same, but an absent option reads as "this turn has no chain"
+            // where `[]` reads as "this turn has a chain with nothing in it".
             ...(fallbackProviders.length > 0 ? { fallbackProviders } : {}),
             tools,
             ...(pluginManager ? { pluginManager } : {}),
             ...(skillRegistry ? { skillRegistry } : {}),
             ...(skills ? { skills } : {}),
             // Withheld at both provider and executor boundaries on every ordinary
-            // turn. An admitted send owns the exact run-scoped authority above.
+            // turn. An admitted send owns the exact turn-scoped authority above.
             ...(!opts?.goalRound ? { deniedTools: SESSION_GOAL_TOOL_NAMES } : {}),
             taskStore,
             ...(taskGateway ? { taskScheduler: taskGateway } : {}),
@@ -2626,20 +2813,19 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
             compactionConfig,
             ...(consolidateInto ? { consolidateInto } : {}),
             ...(backgroundJobs ? { backgroundJobs, backgroundJobOwner } : {}),
-            // Interactive chat may own process exit. An enclosing resident host
-            // instead drains the run and writes its finish/runner receipts first.
-            emergencySave,
-            runConfig: {
+            turnConfig: {
                 model,
                 ...(sandboxProvider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                 ...(opts?.effort !== undefined ? { effort: opts.effort } : {}),
                 ...(webSearch ? { webSearch } : {}),
-                ...resolveRunGuards(limits),
+                ...resolveTurnGuards(limits),
                 maxResponseTokens: 8192,
                 permissionMode: 'auto',
+                // The kernel keeps every checkpoint unless told otherwise.
+                pruneKeepLast: CLI_CHECKPOINT_RETENTION,
             },
             // The operator's gate, if they set one. Omitted rather than passed
-            // as undefined so a run with no gate is byte-identical to the one
+            // as undefined so a turn with no gate is byte-identical to the one
             // that shipped before gates existed.
             ...(reviewAnswer ? { reviewAnswer } : {}),
             ...(maxAnswerReviews !== undefined ? { maxAnswerReviews } : {}),
@@ -2656,6 +2842,7 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
             ...(completionInbox ? { completionInbox } : {}),
             workingDirectory,
             ...(additionalDirectories?.length ? { additionalDirectories } : {}),
+            ...(escalation ?? {}),
             // The exemption reads `tools` at decision time, so it sees the task
             // tools `query()` registers deferred below and any tool server that
             // connected after this session was built.
@@ -2673,28 +2860,35 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
                 const next = await events.next();
                 if (next.done) {
                     settled = true;
-                    // A Run contains its fresh static/dynamic system floor as well as the
-                    // conversation. Only the latter crosses this host seam. Compaction
-                    // summaries survive because they ARE conversation state; arbitrary
-                    // system prompts are rebuilt fresh on every send and stay private to it.
-                    opts?.onConversationMessages?.(projectRunConversation(next.value.messages));
+                    // A Turn contains its fresh static/dynamic system floor as well as
+                    // the conversation. Only the latter crosses this host seam.
+                    // Compaction summaries survive because they ARE conversation state;
+                    // arbitrary system prompts are rebuilt fresh on every send and stay
+                    // private to it.
+                    opts?.onConversationMessages?.(projectTurnConversation(next.value.messages));
                     return;
                 }
                 const event = next.value;
+                // Every event inside a turn names it. Should the kernel have begun the
+                // turn under an id other than the reserved one, that id gets the same
+                // authority before any of its tools can run.
+                if ('turnId' in event && typeof event.turnId === 'string' && event.turnId !== turnId) {
+                    claimTurn(event.turnId);
+                }
                 // Before the abort check and before `toAgentEvent`: a session
                 // cancelled mid-turn still produced the events up to that point, and
                 // they are the interesting ones. Every event, not just the ones the
                 // TUI renders — an export that only saw what the screen showed would
                 // be a recording of the interface rather than of the session.
-                onRunEvent?.(event);
+                onSessionEvent?.(event);
                 if (signal?.aborted) {
                     if (!abortReported) {
                         abortReported = true;
                         yield { kind: 'error', message: 'aborted' };
                     }
                     // Let cancellation settle in the kernel. Calling return() here
-                    // discarded its Run and forced App to save only visible prose,
-                    // losing tool receipts and reasoning before the next user turn.
+                    // discarded its Turn before the recorder closed it, losing tool
+                    // receipts and reasoning before the next user turn.
                     continue;
                 }
                 const mapped = toAgentEvent(event, presenter);
@@ -2704,7 +2898,7 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
             }
         }
         finally {
-            // Manual iteration is what exposes the generator's Run return value.
+            // Manual iteration is what exposes the generator's Turn return value.
             // Preserve `for await`'s other guarantee too: a consumer that stops
             // early must close the live query instead of abandoning its transport.
             if (!settled)
@@ -2712,6 +2906,23 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
         }
     }
     catch (err) {
+        if (isTurnInProgressError(err)) {
+            // Nothing was begun: the conversation already has an active turn. Said
+            // by name, with the turn and its state, because the ways out differ —
+            // a paused turn is resumed or abandoned, a running one is waited for.
+            yield {
+                kind: 'error',
+                message: `This conversation already has a ${err.state} turn (${err.activeTurnId}). ${err.state === 'running'
+                    ? 'Wait for it to finish.'
+                    : 'Resume it with /resume, or close it with /abandon.'}`,
+                turnInProgress: {
+                    sessionId: String(err.sessionId),
+                    activeTurnId: String(err.activeTurnId),
+                    state: err.state,
+                },
+            };
+            return;
+        }
         yield {
             kind: 'error',
             message: err instanceof Error ? err.message : String(err),
@@ -2725,12 +2936,16 @@ async function* runTurn({ emergencySave, retainedToolPreviewChars, fileReadTrack
  * (`createReviewHandler`); what this application adds is the person to ask
  * and the session's "approve all" box, which the screen also reads.
  */
-export function makeResumeHandler(approval, onPermission, mode = onPermission ? 'prompt' : 'auto', exempt = () => false) {
+export function makeResumeHandler(approval, onPermission, mode = onPermission ? 'prompt' : 'auto', exempt = () => false, escapePolicy = {}) {
     return createReviewHandler({
         mode,
         prompt: onPermission,
         exempt,
         remembered: approval,
+        // Refused unless the operator wrote `sandbox.allowUnattendedEscape`: a
+        // session with nobody to ask has nobody to consent to leaving the
+        // sandbox, and `auto` is not consent to a command it never showed.
+        unattendedSandboxEscape: escapePolicy.unattendedSandboxEscape ?? 'refuse',
     });
 }
 /**
@@ -2750,15 +2965,15 @@ export function promptExemptToolNames(registry) {
 /** A batch needs explicit approval when any call mutates state. */
 export const batchNeedsPrompt = batchNeedsReview;
 /**
- * Translate one SDK `RunEvent` into the TUI's `AgentEvent` vocabulary, or
+ * Translate one SDK `SessionEvent` into the TUI's `AgentEvent` vocabulary, or
  * `null` for events the chat surface doesn't render (iteration markers,
- * token usage, checkpoints, plan/task lifecycle, …). Pure — unit-tested.
+ * checkpoints, plan lifecycle, …). Pure — unit-tested.
  */
 export function toAgentEvent(event, presenter) {
     switch (event.type) {
         case 'hosted_tool': {
             const common = {
-                runId: event.runId,
+                turnId: event.turnId,
                 toolUseId: event.tool.id,
                 toolName: 'web_search',
             };
@@ -2783,7 +2998,7 @@ export function toAgentEvent(event, presenter) {
                 text: event.text,
                 ...(event.textPart ? { textPart: event.textPart } : {}),
                 ...(event.messageId ? { messageId: event.messageId } : {}),
-                ...(event.runId ? { runId: event.runId } : {}),
+                ...(event.turnId ? { turnId: event.turnId } : {}),
             };
         case 'reasoning_started':
             // A redacted block has no text to show; the empty delta still says
@@ -2796,7 +3011,7 @@ export function toAgentEvent(event, presenter) {
         case 'tool_executing':
             return {
                 kind: 'tool-start',
-                runId: event.runId,
+                turnId: event.turnId,
                 ...(event.toolName === 'wait_for_task' &&
                     typeof event.input?.task_id === 'string'
                     ? { taskId: event.input.task_id }
@@ -2818,7 +3033,7 @@ export function toAgentEvent(event, presenter) {
         case 'tool_progress':
             return {
                 kind: 'tool-progress',
-                runId: event.runId,
+                turnId: event.turnId,
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
                 message: event.message,
@@ -2840,7 +3055,7 @@ export function toAgentEvent(event, presenter) {
             return {
                 kind: 'tool-end',
                 output: event.result,
-                runId: event.runId,
+                turnId: event.turnId,
                 toolUseId: event.toolUseId,
                 toolName: event.toolName,
                 isError: event.isError,
@@ -2862,6 +3077,8 @@ export function toAgentEvent(event, presenter) {
             // cannot ground, and a `0` here would ground a wrong one.
             return {
                 kind: 'usage',
+                sessionId: event.sessionId,
+                ...(event.turnId ? { turnId: event.turnId } : {}),
                 totalTokens: event.usage.totalTokens,
                 ...(event.budget ? { budget: event.budget } : {}),
                 cost: event.cost,
@@ -2920,7 +3137,7 @@ export function toAgentEvent(event, presenter) {
                 subject: event.subject,
                 status: event.status,
             };
-        case 'run_paused':
+        case 'turn_paused':
             // A pause is not an error and not an invisible end. The checkpoint and
             // classification are the recovery surface; dropping this event made a
             // shell report success and let the interactive queue run on a premise
@@ -2928,26 +3145,28 @@ export function toAgentEvent(event, presenter) {
             return {
                 kind: 'paused',
                 ...(event.budget ? { budget: event.budget } : {}),
-                runId: String(event.runId),
+                turnId: String(event.turnId),
                 checkpointId: event.checkpointId,
                 reason: event.reason,
                 ...(event.failure ? { failure: event.failure } : {}),
                 ...(event.providerError ? { providerError: event.providerError } : {}),
                 ...(event.explanation ? { explanation: event.explanation } : {}),
             };
-        case 'run_completed':
-            // Carried through rather than dropped: `run_failed` fires only from
+        case 'turn_completed':
+            // Carried through rather than dropped: `turn_failed` fires only from
             // the throw path, so this event is also how a budget stop, a
             // timeout, a cancellation and a blocked output guardrail arrive. A
-            // consumer that reads this as success reports one for a run whose
+            // consumer that reads this as success reports one for a turn whose
             // answer was refused.
             return {
                 kind: 'done',
+                sessionId: event.sessionId,
+                turnId: event.turnId,
                 text: event.result,
                 ...(event.budget ? { budget: event.budget } : {}),
                 ...(event.stopReason ? { stopReason: event.stopReason } : {}),
             };
-        case 'run_failed':
+        case 'turn_failed':
             // Keep the compatibility string and the structure. Prefixing the
             // message with only the coarse `provider_error` code discarded the
             // stable explanation, retry delay and first-hand provider detail while
@@ -3057,7 +3276,7 @@ function describeCompactionFailure(event) {
  * the logs use.
  */
 const FALLBACK_REASONS = {
-    rate_limit: 'it rate limited this run and the retries did not clear it',
+    rate_limit: 'it rate limited this turn and the retries did not clear it',
     overloaded: 'it was overloaded and the retries did not clear it',
     server_error: 'it kept failing and the retries did not clear it',
     timeout: 'it did not answer in time',
@@ -3067,7 +3286,7 @@ const FALLBACK_REASONS = {
     unknown: 'it failed in a way namzu could not classify',
 };
 /**
- * The one line an operator reads when their run changes hands.
+ * The one line an operator reads when their turn changes hands.
  *
  * Both members are named with their chain position, because naming only the
  * replacement leaves an operator with four declared members unable to tell
@@ -3322,7 +3541,7 @@ function emptySession(errorHint, errorKind = 'environment') {
         },
         // Throws rather than reporting `no-checkpoint`. A resume that reported
         // "there is nothing to continue" when the truth is "this session has no
-        // provider" would let a drainer mark every run in a queue as a dead end
+        // provider" would let a drainer mark every turn in a queue as a dead end
         // and move on — an unavailable capability degrading a check into a
         // wrong answer, on the one path where the answer is destructive.
         resumeDurable: async () => {