@sema-agent/core 5.31.0 → 5.33.0

package/dist/core/runner/prepare-task.js

@@ -7,7 +7,7 @@ import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
 import { createAutoModeDecider } from "../auto-mode.js";
 import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { resolveTaskModel } from "../roles.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { materializeMcpTools } from "../mcp.js";
 import { materializeA2aTools } from "../a2a.js";
@@ -15,7 +15,7 @@ import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
-import { StoredSession, isSessionConflict, hasSessionFork } from "../session.js";
+import { hasSessionFork } from "../session.js";
 import { createSubagentWorktreeHelper, forkGovernanceDenial } from "../../agents/subagent.js";
 import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
 import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
@@ -31,13 +31,12 @@ import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy } from "./session-rule-policy.js";
 import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, persistedRuleMandateOf, runToolGate } from "../hooks.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
-import { reconcileInterruptedSession } from "../session-reconcile.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
-import { resolveBrainCallGuardrailMs, STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
+import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
-import { protocolOf, PROTOCOL_TABLE } from "../protocol-table.js";
+import { protocolOf } from "../protocol-table.js";
 import { pathToUri } from "../lsp-protocol.js";
 import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
 import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
@@ -50,11 +49,13 @@ import { MEMORY_RECALL_DISCIPLINE } from "../memory-engine/engine.js";
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { composeMemoryBlock } from "../memory.js";
-import { preflightLockedConfig } from "../locked-config.js";
 import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
-import { assertRetentionCapability } from "../retention.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
 import { prepareMemory } from "./prepare-memory.js";
+import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js";
+import { NAMESPACED_NAME_SHAPES, prepareSafetyScan } from "./prepare-safety-scan.js";
+import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
+import { prepareWorkspaceRestore, rebaseWorkspacePath, remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./prepare-workspace-restore.js";
 import { defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
 import { auditToolCollisions, getToolContract, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
@@ -67,18 +68,17 @@ import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
 import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy, isIsolated, isRemoteExecutionEnv, isRetryableRemoteErrorCode, isSuspendable, missingRestoreSurface, RETRYABLE_REMOTE_ERROR_CODES } from "../remote-env.js";
-import { withRetry } from "../with-retry.js";
+import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface } from "../remote-env.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
 import { createMonitorTool } from "../../tools/monitor.js";
 import { createWorktreeTools } from "../../tools/worktree.js";
-import { applyCompactionToReadFileState, assertReadFaceValue, bashReversibilityProbe, compileReadDeny, createHandsToolkit, isReadDedupStubResult, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
+import { applyCompactionToReadFileState, bashReversibilityProbe, compileReadDeny, createHandsToolkit, deploymentReadFaceClampNotice, isReadDedupStubResult, resolveReadDenyBuiltins, resolveReadFace, seedReadFileStateFromContext, seedReadFileStateFromTranscript, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
 import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
-import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
+import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
 import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
 import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
 import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
@@ -87,8 +87,8 @@ import { resolveKey } from "../../tools/fs/safety.js";
 import { wholeFileRecordsFromTranscript } from "./session-file-state-replay.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { countElicitOptIns, deriveAskEffective, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
-import { GLOBAL_USAGE_KEY, resolveUsageWindows, usageRetryAfterMs } from "../usage-window-store.js";
+import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam } from "../wiring-manifest.js";
+import { GLOBAL_USAGE_KEY, usageRetryAfterMs } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
 const announcedMaterializeEnv = new Set();
 export function __resetMaterializeEnvAnnouncements() {
@@ -97,74 +97,12 @@ export function __resetMaterializeEnvAnnouncements() {
 function emitMaterializeEnvNotice(onNotice, message, detail) {
     deliverEngineNotice(onNotice, { code: "config.materialize_env_discarded", message, detail });
 }
-const RECONCILE_MAX_RETRIES = 3;
-const DEFAULT_MAX_SUSPENDS = 5;
-const TASK_LIMIT_KEY_DICT = {
-    maxTokens: true,
-    maxCostUsd: true,
-    maxTurns: true,
-    maxWalltimeMs: true,
-    maxOutputTokens: true,
-    approachNotice: true,
-    budgetStreamCancel: true,
-    degrade: true,
-    brainCallGuardrailMs: true,
-};
-const TASK_LIMIT_KEYS = Object.keys(TASK_LIMIT_KEY_DICT);
-const NUMERIC_TASK_LIMIT_KEYS = ["maxTokens", "maxCostUsd", "maxTurns", "maxWalltimeMs", "maxOutputTokens"];
-const RETIRED_TASK_LIMIT_KEYS = {
-    timeoutSec: "maxWalltimeMs (milliseconds, not seconds)",
-    deadlineNudge: "approachNotice",
-    callCapByDeadline: "(retired — no replacement)",
-    gracefulFinalize: "(retired — the approach notice is the only end-of-budget prompt)",
-};
-function limitConfigError(code, message) {
-    const e = new Error(message);
-    e.code = code;
-    return e;
-}
-export function resolveTaskLimits(limits) {
-    if (limits === undefined)
-        return undefined;
-    if (typeof limits !== "object" || Array.isArray(limits)) {
-        throw limitConfigError("config.limit_invalid", `TaskSpec.limits must be an object (got ${Array.isArray(limits) ? "an array" : typeof limits})`);
-    }
-    const raw = limits;
-    const legal = TASK_LIMIT_KEYS;
-    for (const key of Object.keys(raw)) {
-        if (legal.includes(key))
-            continue;
-        const replacement = RETIRED_TASK_LIMIT_KEYS[key];
-        throw limitConfigError("config.limit_unknown_key", `TaskSpec.limits.${key} is not a limit this engine reads` +
-            (replacement !== undefined ? ` — it was replaced by \`${replacement}\`` : "") +
-            `. Legal keys: ${TASK_LIMIT_KEYS.join(", ")}. Refused rather than ignored: a limit that is silently dropped reads to the caller as an armed ceiling.`);
-    }
-    for (const key of NUMERIC_TASK_LIMIT_KEYS) {
-        const value = raw[key];
-        if (value === undefined)
-            continue;
-        if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable ceiling is not a ceiling, and folding it to a default would run the task under a limit nobody chose.`);
-        }
-    }
-    const notice = raw.approachNotice;
-    if (notice !== undefined && notice !== false) {
-        if (typeof notice !== "object" || notice === null || Array.isArray(notice)) {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice must be \`false\` or { at?: [first, second] } (got ${String(notice)})`);
-        }
-        const at = notice.at;
-        if (at !== undefined) {
-            const ok = Array.isArray(at) &&
-                at.length === 2 &&
-                at.every((n) => typeof n === "number" && Number.isFinite(n) && n > 0 && n <= 1) &&
-                at[0] <= at[1];
-            if (!ok) {
-                throw limitConfigError("config.limit_invalid", `TaskSpec.limits.approachNotice.at must be two fractions in (0, 1] with first <= second (got ${JSON.stringify(at)})`);
-            }
-        }
-    }
-    return limits;
+const readFaceClampAnnouncedSinks = new WeakSet();
+let readFaceClampConsoleAnnounced = false;
+export function __resetReadFaceClampAnnouncement() {
+    readFaceClampConsoleAnnounced = false;
 }
+const DEFAULT_MAX_SUSPENDS = 5;
 const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const ENV_LIFETIME_SUSPEND_MARGIN_MS = 60_000;
@@ -197,7 +135,6 @@ function sanitizedTtlMs(ttlMs) {
 const ungatedWarnedShapes = new WeakMap();
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;
-const NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
 export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
 export function checkpointScopeOf(spec) {
     return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
@@ -209,16 +146,8 @@ class ParkRefusal extends Error {
     }
 }
 export { resolveCheckpointStore } from "../checkpoint-store.js";
-export function isFableFamilyModelId(id) {
-    const tail = id.toLowerCase().split("/").pop() ?? "";
-    return /^claude-fable-\d/.test(tail) || /^claude-mythos-5(?!\d)/.test(tail);
-}
-export function resolveModelPromptTraits(model, spec, internals) {
-    return {
-        promptProfile: spec.promptProfile ?? internals?.promptProfile ?? "simple",
-        fableMitigations: isFableFamilyModelId(model.id),
-    };
-}
+export { isFableFamilyModelId, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
+export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
 function hasConversationContent(branch) {
     return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
 }
@@ -238,31 +167,6 @@ export function batchContextAt(messages, currentId) {
     const completedCallIds = batch.filter((id) => id !== currentId && resolved.has(id));
     return { batchToolCallIds: batch, completedCallIds };
 }
-function detectConflicts(storage, ref) {
-    const guard = (fn) => async (...args) => {
-        try {
-            return await fn(...args);
-        }
-        catch (err) {
-            if (isSessionConflict(err)) {
-                ref.hit = true;
-            }
-            throw err;
-        }
-    };
-    return new Proxy(storage, {
-        get(target, prop, receiver) {
-            const value = Reflect.get(target, prop, receiver);
-            if (typeof value !== "function") {
-                return value;
-            }
-            const bound = value.bind(target);
-            return prop === "appendEntry" || prop === "setLeafId"
-                ? guard(bound)
-                : bound;
-        },
-    });
-}
 function raceAbort(p, signal, onAbort) {
     if (signal.aborted)
         return Promise.resolve(onAbort());
@@ -288,353 +192,19 @@ async function forgetQuietly(sessions, sessionId) {
     catch {
     }
 }
-export function rebaseWorkspacePath(p, fromRaw, toRaw) {
-    if (p.includes("\\") || fromRaw.includes("\\") || toRaw.includes("\\"))
-        return p;
-    const stripTrail = (s) => (s.length > 1 && s.endsWith("/") ? stripTrail(s.slice(0, -1)) : s);
-    const from = stripTrail(fromRaw);
-    const to = stripTrail(toRaw);
-    if (p === from || stripTrail(p) === from)
-        return to;
-    const fromPrefix = from === "/" ? from : `${from}/`;
-    if (!p.startsWith(fromPrefix))
-        return p;
-    const suffix = p.slice(fromPrefix.length).replace(/^\/+/, "");
-    return to === "/" ? `${to}${suffix}` : `${to}/${suffix}`;
-}
-function remoteEnvFailureNote(op, error, attempts) {
-    return { op, code: error.code, retryable: isRetryableRemoteErrorCode(error.code), attempts, message: error.message };
-}
-const REMOTE_RESTORE_MAX_ATTEMPTS = 2;
-const REMOTE_RESTORE_BACKOFF_MS = 200;
-async function restoreWorkspaceWithRetry(env, snapshotId, options) {
-    let attempts = 0;
-    const outcome = await withRetry(async (attempt) => {
-        attempts = attempt;
-        return env.resumeVM(snapshotId, options);
-    }, { retryableCodes: RETRYABLE_REMOTE_ERROR_CODES, maxAttempts: REMOTE_RESTORE_MAX_ATTEMPTS, backoffMs: () => REMOTE_RESTORE_BACKOFF_MS }, { ...(options.abortSignal !== undefined ? { signal: options.abortSignal } : {}) });
-    return { outcome, attempts };
-}
-export function rebaseWorkspacePathAcross(p, froms, to) {
-    for (const from of froms) {
-        const out = rebaseWorkspacePath(p, from, to);
-        if (out !== p)
-            return out;
-    }
-    return p;
-}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
-    const toolFaceSnapshot = {
-        exclude: spec.excludeTools ? Object.freeze([...spec.excludeTools]) : undefined,
-        defer: spec.deferTools ? Object.freeze([...spec.deferTools]) : undefined,
-        alwaysLoad: spec.alwaysLoadTools ? Object.freeze([...spec.alwaysLoadTools]) : undefined,
-    };
-    const promptProfile = resolveModelPromptTraits({ id: "" }, spec, internals).promptProfile;
-    if (spec.resumeAt !== undefined) {
-        if (resume) {
-            const e = new Error("resumeAt cannot be combined with a durable resume");
-            e.code = "resume_at.conflicts_resume";
-            throw e;
-        }
-        if (!spec.sessionId) {
-            const e = new Error("resumeAt requires a sessionId (the session to branch)");
-            e.code = "resume_at.no_session";
-            throw e;
-        }
-    }
-    assertReadFaceValue(spec.readFace, "TaskSpec.readFace");
-    assertReadFaceValue(deps.readFace, "readFace (deployment seat)");
-    if (spec.resumeAtMode !== undefined) {
-        if (spec.resumeAt === undefined) {
-            const e = new Error(`resumeAtMode "${spec.resumeAtMode}" requires resumeAt (there is no branch target to position against)`);
-            e.code = "resume_at.mode_without_target";
-            throw e;
-        }
-        if (spec.resumeAtMode !== "at" && spec.resumeAtMode !== "before") {
-            const e = new Error(`resumeAtMode "${String(spec.resumeAtMode)}" is invalid — expected "at" (inclusive branch, the default) or "before" (exclusive branch)`);
-            e.code = "resume_at.invalid_mode";
-            throw e;
-        }
-    }
-    if (spec.toolMaterializeStrategy !== undefined && spec.toolMaterializeStrategy !== "swap" && spec.toolMaterializeStrategy !== "static") {
-        const e = new Error(`toolMaterializeStrategy must be "swap" or "static" (got ${JSON.stringify(spec.toolMaterializeStrategy)}).`);
-        e.code = "config.tool_materialize_invalid";
-        throw e;
-    }
-    if (spec.memoryPersistenceCapable !== undefined && typeof spec.memoryPersistenceCapable !== "boolean") {
-        const e = new Error(`memoryPersistenceCapable must be a boolean when present (got ${JSON.stringify(spec.memoryPersistenceCapable)}) — a non-boolean would silently read as capable.`);
-        e.code = "config.memory_persistence_invalid";
-        throw e;
-    }
-    if (spec.toolMaterializeStrategy === "static" && spec.deferSelfResolve === false) {
-        const e = new Error(`toolMaterializeStrategy "static" cannot be combined with deferSelfResolve: false — with the direct-call ` +
-            `lane disabled a placeholder is never swapped and never self-resolves, so no deferred tool could ever be ` +
-            `called. Use "swap", or leave deferSelfResolve on.`);
-        e.code = "config.tool_materialize_unreachable";
-        throw e;
-    }
-    if (resume === undefined && spec.objective.trim().length === 0) {
-        const e = new Error("TaskSpec.objective is empty — a task needs an instruction (an empty user message is rejected by strict model endpoints and would fail every later request of the session).");
-        e.code = "config.empty_objective";
-        throw e;
-    }
-    const lockedPreflight = preflightLockedConfig(spec, deps);
-    assertRetentionCapability({
-        policy: deps.retentionPolicy,
-        locked: lockedPreflight.lockedKeys.has("retentionPolicy"),
-        stores: [
-            { name: "sessionStore", store: sessions },
-            { name: "checkpointStore", store: resolveCheckpointStore(spec, deps) },
-            { name: "toolResultStore", store: deps.toolResultStore },
-        ],
-    });
-    const resolvedInteractionPosture = spec.interactionPosture ?? internals?.parentInteractionPosture ?? deps.interactionPosture;
-    {
-        const interactionPosture = resolvedInteractionPosture;
-        const discloseInteractionPostureRefusal = (err) => {
-            try {
-                deps.onError?.(err, { phase: "config", sessionId: spec.sessionId ?? "(pre-session)", classification: "interaction-posture-refused" });
-            }
-            catch {
-            }
-        };
-        if (interactionPosture !== undefined && interactionPosture !== "interactive" && interactionPosture !== "headless") {
-            const e = new Error(`interactionPosture ${JSON.stringify(interactionPosture)} is not a recognized posture ("interactive" | "headless") — ` +
-                `an unevaluable declaration is refused loudly, never folded to either posture.`);
-            e.code = "config.interaction_posture";
-            discloseInteractionPostureRefusal(e);
-            throw e;
-        }
-        if (interactionPosture === "interactive") {
-            const askDoor = resolveAskSeamForm(spec, deps);
-            const humanReachable = deriveAskEffective(askDoor.form, "unresolved") === "human_reachable";
-            const questionDoor = resolveQuestionSeam(spec, deps);
-            const strippedByEngine = internals?.questionFaceStripped === true;
-            if (spec.interactiveTools === false) {
-                const e = new Error(`interaction posture "interactive" declared together with interactiveTools: false — the hard-headless ` +
-                    `clamp removes the AskUserQuestion mount, so no content question can ever reach the human this posture ` +
-                    `promises. Drop one of the two declarations.`);
-                e.code = "config.interaction_posture";
-                discloseInteractionPostureRefusal(e);
-                throw e;
-            }
-            if (!humanReachable || !(questionDoor.wired || strippedByEngine)) {
-                const missing = [];
-                if (!humanReachable) {
-                    missing.push(askDoor.form === "absent"
-                        ? "no onAsk approver is wired (spec.onAsk ?? deps.onAsk is absent — asks would auto-deny or park)"
-                        : `the resolved onAsk seat is the blanket policy "${askDoor.form}" (${askDoor.provenance ?? "?"}) — a policy setting is not a reachable human`);
-                }
-                if (!questionDoor.wired && !strippedByEngine) {
-                    missing.push("no content-question channel (spec.onQuestion ?? deps.onQuestion is absent, and this leg is not an engine-stripped background lane)");
-                }
-                const e = new Error(`interaction posture "interactive" declared, but this assembly cannot reach a human: ${missing.join("; ")}. ` +
-                    `Wire the missing seam(s), or drop the posture declaration (absent = no check).`);
-                e.code = "config.interaction_posture";
-                discloseInteractionPostureRefusal(e);
-                throw e;
-            }
-        }
-    }
-    resolveTaskLimits(spec.limits);
-    if (spec.resourceSuspend !== undefined) {
-        const rsus = spec.resourceSuspend;
-        if (typeof rsus.scope !== "string" || rsus.scope === "") {
-            throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.scope must be a non-empty string (got ${String(rsus.scope)}) — it is the multi-tenant isolation key every resource checkpoint is filed under.`);
-        }
-        for (const key of ["totalBudgetUsd", "totalTokens", "maxSlices", "ttlMs"]) {
-            const value = rsus[key];
-            if (value === undefined)
-                continue;
-            if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-                throw limitConfigError("config.limit_invalid", `TaskSpec.resourceSuspend.${key} must be a finite, non-negative number (got ${String(value)}) — an unevaluable allocation is not an allocation, and a NaN here blinds even the validated per-slice window.`);
-            }
-        }
-    }
-    const usageWindows = resolveUsageWindows(deps.usageWindows);
-    const brainCallGuardrailRef = {};
-    const brainCallGuardrailMs = resolveBrainCallGuardrailMs(spec.limits?.brainCallGuardrailMs ?? deps.brainCallGuardrailMs);
-    if (spec.agents !== undefined && spec.agents.length > 0) {
-        const pool = spec.tools ?? [];
-        if (!pool.some((t) => typeof t.withAgents === "function")) {
-            const e = new Error(`TaskSpec.agents was provided but no delegation tool (createSubagentTool) is mounted in spec.tools — the per-task agents could never be offered. Mount the delegation tool, or drop spec.agents.`);
-            e.code = "config.agents.no_delegation_tool";
-            throw e;
-        }
-        const perTask = spec.agents;
-        spec = { ...spec, tools: pool.map((t) => (typeof t.withAgents === "function" ? t.withAgents(perTask) : t)) };
-    }
-    const resolvedRole = resolveTaskModel(spec, deps);
-    const model = resolvedRole.model;
-    const fableMitigations = resolveModelPromptTraits(model, spec, internals).fableMitigations;
-    const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
-    const compModel = spec.compactionModel
-        ? resolveModel(spec.compactionModel, deps.models)
-        : roleModelIfSet("summarize", spec, deps);
-    const toolEffects = new Map();
-    const ownToolNames = new Set((spec.tools ?? []).map((t) => t.name));
-    const claimedAliases = new Set();
-    const egressTools = new Set();
-    const irreversibleTools = new Set();
-    const irreversibilityTier = new Map();
-    const axisExplicitNegatives = new Map();
-    const reversibilityProbes = new Map();
+    const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
+    spec = doors.spec;
+    const { toolFaceSnapshot, promptProfile, lockedPreflight, resolvedInteractionPosture, resolvedRole, model, thinking, compModel, fableMitigations, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
+    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, ownToolNames } = prepareSafetyScan({ spec, deps });
     let shellGatedBash = false;
     let shellGatedMonitor = false;
-    for (const t of spec.tools ?? []) {
-        if (t.name.includes("__")) {
-            const e = new Error(`Tool name "${t.name}" is invalid: "__" is reserved for the engine's protocol tool namespaces (${NAMESPACED_NAME_SHAPES}) and must not appear in a caller tool name.`);
-            e.code = "config.tool_name_invalid";
-            throw e;
-        }
-        if (t.effect) {
-            toolEffects.set(t.name, t.effect);
-        }
-        const tier = t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
-        if (tier !== undefined) {
-            irreversibilityTier.set(t.name, tier);
-            if (tier === "always" || tier === "maybe")
-                irreversibleTools.add(t.name);
-        }
-        if (t.reversibilityProbe)
-            reversibilityProbes.set(t.name, t.reversibilityProbe);
-        if (t.egress) {
-            if (t.effect !== undefined && t.effect !== "write") {
-                const e = new Error(`Tool "${t.name}" declares egress:true with effect:"${t.effect}" — an egress tool (external write) must have effect:"write" (or omit effect; write is the default).`);
-                e.code = "config.egress_requires_write_effect";
-                throw e;
-            }
-            egressTools.add(t.name);
-        }
-        for (const alias of t.aliases ?? []) {
-            if (alias === t.name || ownToolNames.has(alias))
-                continue;
-            if (claimedAliases.has(alias))
-                continue;
-            claimedAliases.add(alias);
-            if (t.effect)
-                toolEffects.set(alias, t.effect);
-            if (tier !== undefined) {
-                irreversibilityTier.set(alias, tier);
-                if (tier === "always" || tier === "maybe")
-                    irreversibleTools.add(alias);
-            }
-            if (t.reversibilityProbe)
-                reversibilityProbes.set(alias, t.reversibilityProbe);
-            if (t.egress)
-                egressTools.add(alias);
-        }
-    }
-    toolEffects.set(OFFLOAD_TOOL_NAME, "read");
-    if (deps.executionEnvFactory || deps.executionEnv) {
-        for (const [name, effect] of Object.entries(HAND_TOOL_EFFECTS))
-            toolEffects.set(name, effect);
-        if (spec.handsReadOnly === true)
-            toolEffects.set("Bash", "read");
-    }
-    if (spec.enablePlanMode === true) {
-        toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");
-        toolEffects.set(ENTER_PLAN_MODE_TOOL_NAME, "read");
-    }
     if (spec.requireExistingSession && !spec.sessionId) {
         const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
         e.code = "resume.session_not_found";
         throw e;
     }
-    let acquired;
-    let session;
-    let conflictRef;
-    let wakeRecovered = [];
-    let resumeAtBeforeParentId = null;
-    for (let attempt = 0;; attempt++) {
-        try {
-            acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : undefined);
-        }
-        catch (err) {
-            if (spec.requireExistingSession && err?.code === "not_found") {
-                const e = new Error(`requireExistingSession: session "${spec.sessionId}" does not exist — refusing a silent fresh run (design/114 Phase3)`);
-                e.code = "resume.session_not_found";
-                throw e;
-            }
-            throw err;
-        }
-        conflictRef = { hit: false };
-        session = new StoredSession(detectConflicts(acquired.session.getStorage(), conflictRef));
-        if (!spec.sessionId) {
-            break;
-        }
-        try {
-            if (resume) {
-                await session.getStorage().setLeafId(resume.leafId);
-            }
-            else if (spec.resumeAt !== undefined) {
-                const entry = await session.getEntry(spec.resumeAt);
-                if (!entry) {
-                    const e = new Error(`resumeAt entry "${spec.resumeAt}" not found in session "${spec.sessionId}"`);
-                    e.code = "resume_at.not_found";
-                    throw e;
-                }
-                if (entry.type !== "message" && entry.type !== "custom_message") {
-                    const e = new Error(`resumeAt entry "${spec.resumeAt}" is a "${entry.type}" entry; resume-at requires a message boundary`);
-                    e.code = "resume_at.not_a_message";
-                    throw e;
-                }
-                if (entry.type === "message") {
-                    const msg = entry.message;
-                    if (msg?.role === "toolResult") {
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is a tool-result (mid-turn); resume-at requires a settled turn boundary (a user message or a finished assistant turn)`);
-                        e.code = "resume_at.not_a_message";
-                        throw e;
-                    }
-                    if (msg?.role === "assistant" && Array.isArray(msg.content) && msg.content.some((p) => p?.type === "toolCall")) {
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" ends a turn mid-tool-call; resume-at requires a settled turn boundary`);
-                        e.code = "resume_at.not_a_message";
-                        throw e;
-                    }
-                }
-                if (spec.resumeAtMode === "before") {
-                    const role = entry.type === "message" ? entry.message.role : undefined;
-                    if (role !== "user") {
-                        const kind = entry.type === "message" ? `role "${String(role)}" message` : `"${entry.type}" entry`;
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is a ${kind}; resumeAtMode "before" supports only USER-message targets (the exclusive-rewind shape: the removed message is a user message)`);
-                        e.code = "resume_at.before_target_not_user";
-                        throw e;
-                    }
-                    let ancestorId = entry.parentId;
-                    let sawConversationAbove = false;
-                    while (ancestorId !== null) {
-                        const ancestor = await session.getEntry(ancestorId);
-                        if (!ancestor)
-                            break;
-                        if (ancestor.type === "message" || ancestor.type === "custom_message") {
-                            sawConversationAbove = true;
-                            break;
-                        }
-                        ancestorId = ancestor.parentId;
-                    }
-                    if (!sawConversationAbove) {
-                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is the session's first message; resumeAtMode "before" cannot rewind past the session root — start a NEW session instead`);
-                        e.code = "resume_at.before_root_unsupported";
-                        throw e;
-                    }
-                    resumeAtBeforeParentId = entry.parentId;
-                }
-                await session.getStorage().setLeafId(spec.resumeAtMode === "before" ? entry.parentId : spec.resumeAt);
-            }
-            wakeRecovered = (await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch)).recovered;
-            break;
-        }
-        catch (err) {
-            if (isSessionConflict(err) && attempt < RECONCILE_MAX_RETRIES) {
-                if (sessions.forget) {
-                    await Promise.resolve(sessions.forget(spec.sessionId)).catch(() => undefined);
-                }
-                continue;
-            }
-            await Promise.resolve(sessions.forget ? sessions.forget(acquired.sessionId) : undefined).catch(() => undefined);
-            throw err;
-        }
-    }
+    const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects });
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     if (compModel !== undefined) {
@@ -776,7 +346,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
     }
     const handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined;
-    let taskRootPath = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
+    const taskRootInitial = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
     const abortController = new AbortController();
     if (spec.signal?.aborted)
         abortController.abort();
@@ -824,108 +394,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
         }
-        let restoredRootRebase;
-        const rebaseRestoredPath = (p) => restoredRootRebase === undefined ? p : rebaseWorkspacePathAcross(p, restoredRootRebase.from, restoredRootRebase.to);
-        if (resume?.workspaceHandle !== undefined) {
-            const failResume = (message, cause, note) => {
-                const e = new Error(message, cause ? { cause } : undefined);
-                e.code = "resume.env_failed";
-                if (note !== undefined)
-                    e.remoteEnvFailure = note;
-                throw e;
-            };
-            const handle = resume.workspaceHandle;
-            if (ownedEnv === undefined || !isRemoteExecutionEnv(ownedEnv)) {
-                failResume("resume needs a RemoteExecutionEnv from executionEnvFactory to restore the workspace snapshot");
-            }
-            else if (handle.snapshotId === undefined) {
-                if (handle.restoreMode !== "park_only" && ownedEnv.capabilities.suspendable) {
-                    failResume("checkpoint workspaceHandle has no snapshotId and is not a park_only handle, but the resumed env is suspendable — refusing to resume on a possibly-unrestored workspace (corrupt checkpoint?)");
-                }
-                if (handle.mountPath && handle.mountPath !== taskRootPath) {
-                    taskRootPath = handle.mountPath;
-                }
-            }
-            else {
-                const restoreSignal = spec.signal
-                    ? AbortSignal.any([abortController.signal, spec.signal])
-                    : abortController.signal;
-                const missingHere = missingRestoreSurface(ownedEnv);
-                if (missingHere.length > 0) {
-                    failResume(`the resumed execution env cannot restore a workspace snapshot: its adapter does not implement ${missingHere.join(" or ")}. The checkpoint holds snapshot "${handle.snapshotId}" — wire an adapter that implements the full RemoteExecutionEnv restore surface and re-resume.`);
-                }
-                const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
-                    abortSignal: restoreSignal,
-                    priorHandle: handle,
-                });
-                if (!restored.ok) {
-                    failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));
-                }
-                else {
-                    const restoredEnv = ownedEnv;
-                    const canonicalInEnv = async (p) => {
-                        try {
-                            const r = await restoredEnv.canonicalPath(p, restoreSignal);
-                            return r.ok ? r.value : undefined;
-                        }
-                        catch {
-                            return undefined;
-                        }
-                    };
-                    let checkpointedCanonical;
-                    let sameRootUnderAlias = false;
-                    if (restored.value.mountPath !== handle.mountPath) {
-                        checkpointedCanonical = await canonicalInEnv(handle.mountPath);
-                        const restoredCanonical = await canonicalInEnv(restored.value.mountPath);
-                        sameRootUnderAlias =
-                            checkpointedCanonical !== undefined && restoredCanonical !== undefined && checkpointedCanonical === restoredCanonical;
-                    }
-                    if (restored.value.mountPath !== handle.mountPath && !sameRootUnderAlias) {
-                        if (resume.executesApprovedAction === true) {
-                            failResume(`resumeVM workspace-root divergence with a pending approved action: checkpointed mountPath "${handle.mountPath}" but the restored handle reports "${restored.value.mountPath}" — the approved args are bound to the checkpointed root; refusing to execute them against a moved workspace (adapter should honor priorHandle)`);
-                        }
-                        try {
-                            deps.onError?.(new Error(`resumeVM workspace-root divergence: checkpointed mountPath "${handle.mountPath}" but the restored handle reports "${restored.value.mountPath}" — the resumed task follows the restored root`), { phase: "config", sessionId });
-                        }
-                        catch {
-                        }
-                    }
-                    if (restored.value.mountPath && restored.value.mountPath !== taskRootPath) {
-                        taskRootPath = restored.value.mountPath;
-                    }
-                    if (restored.value.mountPath && restored.value.mountPath !== handle.mountPath && !sameRootUnderAlias) {
-                        const from = checkpointedCanonical !== undefined && checkpointedCanonical !== handle.mountPath
-                            ? [handle.mountPath, checkpointedCanonical]
-                            : [handle.mountPath];
-                        restoredRootRebase = { from, to: restored.value.mountPath };
-                        try {
-                            deps.onError?.(new Error(from.length > 1
-                                ? `resumeVM workspace-root rebase accepts both spellings of the checkpointed root (${from.map((f) => `"${f}"`).join(" and ")}) when migrating persisted paths to "${restored.value.mountPath}"`
-                                : `resumeVM workspace-root rebase is spelling-exact: it matches the checkpointed root "${handle.mountPath}" only, so persisted paths recorded under an equivalent alias of it are NOT migrated to "${restored.value.mountPath}" and stay as written`), { phase: "config", sessionId });
-                        }
-                        catch {
-                        }
-                    }
-                }
-                const init = await ownedEnv.postResumeInit();
-                if (!init.ok) {
-                    failResume(`postResumeInit failed (${init.error.code}): ${init.error.message}`, init.error, remoteEnvFailureNote("postResumeInit", init.error, 1));
-                }
-            }
-        }
-        if (internals?.onWorkspaceResolved !== undefined) {
-            try {
-                const workspaceEnv = ownedEnv ?? deps.executionEnv;
-                internals.onWorkspaceResolved({
-                    cwd: taskRootPath,
-                    isolated: internals.isolation === "worktree",
-                    remote: workspaceEnv !== undefined &&
-                        (isRemoteExecutionEnv(workspaceEnv) || workspaceEnv.hostLocalPaths === false),
-                });
-            }
-            catch {
-            }
-        }
+        const { taskRootFinal, rebaseRestoredPath } = await prepareWorkspaceRestore({ ownedEnv, deps, spec, internals, resume, taskRootInitial, abortController, sessionId });
         const rewindNotes = [];
         const rewindCaptureRequested = spec.rewindFiles === true;
         if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
@@ -982,7 +451,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
                 rewindTarget = anchor;
             }
-            const restoreRoot = taskRootPath;
+            const restoreRoot = taskRootFinal;
             const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
             const restored = await deps.fileSnapshotStore.restore(sessionId, rewindTarget, executionEnv, restoreRoot, restoreSignal);
             if (!restored.ok) {
@@ -1027,7 +496,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             planModeRef.active = true;
         };
         const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
-        const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootPath) : undefined;
+        const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootFinal) : undefined;
         const liveInheritedGate = internals?.inheritedGate;
         const seedInheritedGate = resume?.seed.inheritedGate;
         const inheritedAncestorRules = (() => {
@@ -1085,12 +554,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const ownOrgVerdictRef = { current: undefined };
         const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
         const faceCheckpointSection = () => {
-            if (resolvedReadFace === undefined) {
-                const seed = resume?.seed.readFace;
+            if (resolvedReadFace === undefined && resume !== undefined) {
+                const seed = resume.seed.readFace;
                 return seed !== undefined ? { face: seed.face, ...(seed.denyEntries !== undefined ? { denyEntries: seed.denyEntries.map((e) => ({ ...e })) } : {}) } : undefined;
             }
-            if (resolvedReadFace === "open" || readDenyAdditionsNormalized.length > 0) {
-                return { face: resolvedReadFace, ...(readDenyAdditionsNormalized.length > 0 ? { denyEntries: readDenyAdditionsNormalized.map((e) => ({ ...e })) } : {}) };
+            const face = resolvedReadFace ?? handsLessResolvedFace;
+            if (face === undefined)
+                return undefined;
+            if (face === "open" || readDenyAdditionsNormalized.length > 0) {
+                return { face, ...(readDenyAdditionsNormalized.length > 0 ? { denyEntries: readDenyAdditionsNormalized.map((e) => ({ ...e })) } : {}) };
             }
             return undefined;
         };
@@ -1167,6 +639,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let observersActive = false;
         let resolvedReadFace;
         let readDenyAdditionsNormalized = [];
+        let handsLessResolvedFace;
+        const carrierReadFace = () => resolvedReadFace ?? handsLessResolvedFace;
         const fullShellReachable = handsEnabled &&
             !(executionEnv instanceof StubExecutionEnv) &&
             spec.handsReadOnly !== true &&
@@ -1181,7 +655,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
             ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
             ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
-            ...(resolvedReadFace === "roots" ? { readFace: "roots" } : {}),
+            ...(carrierReadFace() === "roots" ? { readFace: "roots" } : {}),
             ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
             ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
             oneShot: spec.oneShot,
@@ -1195,7 +669,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
             ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
             getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
-            parentCwd: taskRootPath,
+            parentCwd: taskRootFinal,
             ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
             ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
             activeSkillScope: () => skillScope.active(),
@@ -1386,9 +860,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
                 autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
                 workflowDepth: internals?.workflowDepth,
-                parentCwd: taskRootPath,
+                parentCwd: taskRootFinal,
                 parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
-                parentReadFace: () => resolvedReadFace,
+                parentReadFace: () => carrierReadFace(),
                 parentReadDenyPatterns: () => (readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined),
                 onNotice: deps.onNotice,
                 parentCheckpointStoreDisabled: spec.checkpointStore === null,
@@ -1608,7 +1082,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let attachmentRootCanonical;
         let readDenyMatcher;
         if (handsEnabled) {
-            const rootRaw = taskRootPath;
+            const rootRaw = taskRootFinal;
             const canon = await executionEnv.canonicalPath(rootRaw);
             const rootCanonical = canon.ok ? canon.value : rootRaw;
             attachmentRootCanonical = rootCanonical;
@@ -1681,17 +1155,32 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             const seedReadFaceSection = resume?.seed.readFace;
             const readDenyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seedReadFaceSection?.denyEntries ?? [])];
-            readDenyMatcher = compileReadDeny(readDenyAdditions, "readDenyPatterns");
-            {
-                const builtinCount = compileReadDeny([], "built-in").entries.length;
-                readDenyAdditionsNormalized = readDenyMatcher.entries.slice(builtinCount);
-            }
+            const readDenyBuiltinCfg = {
+                ...(deps.readDenyBuiltinTiers !== undefined ? { tiers: [...deps.readDenyBuiltinTiers] } : {}),
+                ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: [...deps.readDenyBuiltinExclude] } : {}),
+            };
+            readDenyMatcher = compileReadDeny(readDenyAdditions, "readDenyPatterns", readDenyBuiltinCfg);
+            readDenyAdditionsNormalized = compileReadDeny(readDenyAdditions, "readDenyPatterns", { tiers: [] }).entries;
             let liveReadFace = resolveReadFace({
                 specReadFace: spec.readFace,
                 depsReadFace: deps.readFace,
                 readOnlyMount: handsReadOnly,
                 orgGoverned: deps.permissionRuleOrg !== undefined,
                 fullShellReachable,
+                onDeploymentClamp: () => {
+                    const sink = deps.onNotice;
+                    if (typeof sink === "function") {
+                        if (readFaceClampAnnouncedSinks.has(sink))
+                            return;
+                        readFaceClampAnnouncedSinks.add(sink);
+                    }
+                    else {
+                        if (readFaceClampConsoleAnnounced)
+                            return;
+                        readFaceClampConsoleAnnounced = true;
+                    }
+                    deliverEngineNotice(sink, deploymentReadFaceClampNotice());
+                },
             });
             if (resume !== undefined && (seedReadFaceSection === undefined || seedReadFaceSection.face === "roots"))
                 liveReadFace = "roots";
@@ -1708,6 +1197,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
                 ...(additionalReadRootsCanonical.length > 0 ? { additionalReadRoots: additionalReadRootsCanonical } : {}),
                 ...(readDenyAdditions.length > 0 ? { readDenyPatterns: readDenyAdditions } : {}),
+                ...(readDenyBuiltinCfg.tiers !== undefined ? { readDenyBuiltinTiers: readDenyBuiltinCfg.tiers } : {}),
+                ...(readDenyBuiltinCfg.exclude !== undefined ? { readDenyBuiltinExclude: readDenyBuiltinCfg.exclude } : {}),
                 readFace: liveReadFace,
                 includeShell: handsIncludeShell,
                 readOnly: handsReadOnly,
@@ -1778,6 +1269,25 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
         }
+        else {
+            const liveFace = resolveReadFace({
+                specReadFace: spec.readFace,
+                depsReadFace: deps.readFace,
+                readOnlyMount: spec.handsReadOnly === true,
+                orgGoverned: deps.permissionRuleOrg !== undefined,
+                fullShellReachable,
+            });
+            const seed = resume?.seed.readFace;
+            handsLessResolvedFace = resume !== undefined && (seed === undefined || seed.face === "roots") ? "roots" : liveFace;
+            const denyAdditions = [...(deps.readDenyPatterns ?? []), ...(spec.readDenyPatterns ?? []), ...(seed?.denyEntries ?? [])];
+            resolveReadDenyBuiltins({
+                ...(deps.readDenyBuiltinTiers !== undefined ? { tiers: deps.readDenyBuiltinTiers } : {}),
+                ...(deps.readDenyBuiltinExclude !== undefined ? { exclude: deps.readDenyBuiltinExclude } : {}),
+            });
+            if (denyAdditions.length > 0) {
+                readDenyAdditionsNormalized = compileReadDeny(denyAdditions, "readDenyPatterns", { tiers: [] }).entries;
+            }
+        }
         if (backgroundTaskToolsActive || workflowToolsActive) {
             toolEffects.set("TaskOutput", "read");
             toolEffects.set("TaskStop", "write");
@@ -1879,7 +1389,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             };
             if (workspaceStateSettle !== undefined)
                 workspaceStateSettle.restoredWorktreeDir = worktreeSessionRef.current?.worktreeDir;
-            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootPath, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => firstPartyOffload(t)));
+            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => firstPartyOffload(t)));
         }
         if (offloadStore)
             tools.push(createReadToolResultTool(offloadStore));
@@ -1976,7 +1486,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         }
         const lspManager = spec.lspManager ?? deps.lspManager;
         if (lspManager) {
-            const lspRoot = taskRootPath;
+            const lspRoot = taskRootFinal;
             tools.push(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }));
         }
         const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
@@ -1985,7 +1495,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const lspRunIdent = sessionId;
         const nudgeLspOnEdit = lspDiagnostics
             ? (rawPath) => {
-                const baseDir = handsCwdRef?.current ?? taskRootPath;
+                const baseDir = handsCwdRef?.current ?? taskRootFinal;
                 const filePath = resolveLspPath(rawPath, baseDir);
                 lspDiagnostics.fileEdited(lspRunIdent, pathToUri(filePath));
                 void lspManager
@@ -2007,7 +1517,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             spec,
             deps,
             sessionId,
-            taskRootPath,
+            taskRootPath: taskRootFinal,
             memoryWriteGateRef,
             writeToolsMounted: tools.some((t) => t.name === "Write") &&
                 !(toolFaceSnapshot.exclude?.includes("Write") ?? false) &&
@@ -2096,7 +1606,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             let loaded = null;
             try {
                 loaded = await Promise.resolve(deps.loadProjectMemory({
-                    cwd: taskRootPath,
+                    cwd: taskRootFinal,
                     handsEnabled,
                     isSubagent: isDelegatedNonForkChild(internals),
                     ...(internals?.agentName ? { agentName: internals.agentName } : {}),
@@ -2263,7 +1773,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 envFacts.resumeFacts = copy;
         }
         if (handsEnabled) {
-            envFacts.cwd = taskRootPath;
+            envFacts.cwd = taskRootFinal;
             if (additionalRootsCanonical.length > 0) {
                 envFacts.additionalDirectories = [...additionalRootsCanonical];
             }
@@ -3088,7 +2598,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         if (deps.sessionPolicyStore && spec.sessionId) {
             const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
             if (rules) {
-                sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootPath, toolEffects });
+                sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootFinal, toolEffects });
                 ownSessionRulesRef.current = {
                     sessionId: spec.sessionId,
                     ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
@@ -3109,13 +2619,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 catch {
                 }
             }
-            ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootPath, toolEffects }));
+            ancestorRulePolicies.push(createSessionRulePolicy(ancestorRules, { env: executionEnv, rootPath: taskRootFinal, toolEffects }));
         }
         const skillScopePolicy = hasSkillManifest
             ? createActiveSkillScopePolicy({
                 scope: skillScope,
                 env: executionEnv,
-                rootPath: taskRootPath,
+                rootPath: taskRootFinal,
                 toolEffects,
             })
             : undefined;
@@ -3281,7 +2791,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             if (provider === undefined)
                 return undefined;
-            const root = taskRootPath;
+            const root = taskRootFinal;
             return {
                 admits: async (req) => {
                     const anonymous = spec.principal === undefined || spec.principal === "";
@@ -3901,6 +3411,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
+                    ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
+                    ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
                 }, onAsk, abortController.signal);
                 const waitMs = Math.max(0, now() - t0);
                 if (resolved.approverUnavailable !== true) {
@@ -4383,7 +3895,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4489,6 +4001,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             args: parkedArgs,
                             safety,
                             ...(shadowedRule !== undefined ? { shadowedRule } : {}),
+                            ...(probeReason !== undefined ? { probeReason } : {}),
+                            ...(probeCause !== undefined ? { probeCause } : {}),
                             shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
                             ...(effectiveShellGate !== "off" ? { shellGateDoctrine: effectiveShellGate } : {}),
                         });
@@ -5035,8 +4549,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
             : undefined;
         overheadState.promptChars = systemPrompt.length;
+        const effectiveReadFaceObserved = carrierReadFace();
+        const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettledBy, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, listBackgroundTasks, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;