@sema-agent/core 5.56.0 → 5.58.0

package/dist/core/runner/prepare-task.d.ts

@@ -329,13 +329,13 @@ export interface Prepared {
             chars: number;
             hash: string;
         }>;
-        /** Manifest v2 (campaign S1, additive): the compiled-IR section view (slot/carrier/cadence/
+        /** Manifest v2 (stage S1, additive): the compiled-IR section view (slot/carrier/cadence/
          *  cacheClass per section). `contentHash` is the
-         *  digest-tiering face ([1050]②/[1057]): present ONLY on operator-declared sections (the typed
+         *  digest-tiering face: present ONLY on operator-declared sections (the typed
          *  `stableBlocks` lane, owner "deployment") as an UNSALTED full sha256 of the section text —
          *  the center-publish ↔ manifest end-to-end reconciliation anchor. Core-native sections (env
          *  facts, memory tail, user role text) stay salted-only: a plain hash of a short guessable
-         *  block is a dictionary-preimage surface for trace readers (codex [E]). */
+         *  block is a dictionary-preimage surface for trace readers ([E]). */
         sections?: Array<{
             id: string;
             slot: string;
@@ -346,7 +346,7 @@ export interface Prepared {
             hash: string;
             contentHash?: string;
         }>;
-        /** Campaign S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
+        /** S2 (additive): the mounted tools plane — contract identity, durable-replay aliases,
          *  presentation-invariant shape digest and full wire digest per tool (initial mount face). */
         tools?: ToolManifestRow[];
         /** design/148 S3 (additive, §10.2): the nine-element cache identity — digests only, no prompt
@@ -363,7 +363,7 @@ export interface Prepared {
          *  seat chose it. Absent when nothing is deferred (there is no disclosure to describe). */
         toolDisclosure?: ToolDisclosureManifest;
     };
-    /** [1068] ruling a — this run's provider-declared prompt sections (epoch declaration axis),
+    /** This run's provider-declared prompt sections (epoch declaration axis),
      *  threaded to every compaction-boundary epoch selection so boundary re-pins hash the same
      *  artifact identity as the prepare-time pin. Empty on declaration-free runs. */
     epochDeclaredSections: import("../../prompt-assembly/epoch.js").EpochDeclaredSections;
@@ -690,7 +690,7 @@ export interface Prepared {
      *  RB-197: seeded entries are excluded — their content lives in the system-prompt lane, which
      *  compaction never touches, so re-attaching them into the summary would be a duplicate. */
     recentlyReadFiles?: () => string[];
-    /** RB-197②(独立复审 + codex 命中,已修) — canonicalizes a raw (often relative, model-typed) path the
+    /** RB-197②(独立复审 + 命中,已修) — canonicalizes a raw (often relative, model-typed) path the
      *  SAME way the hands toolkit does (`resolveKey` against the same containment root `readTaskFile`
      *  uses), so `maybeCompact`'s kept-tail/instruction-source exclusions compare paths in the SAME
      *  coordinate `recentlyReadFiles()` already uses — without this a plain string match silently never
@@ -698,7 +698,7 @@ export interface Prepared {
      *  readTaskFile); absent there is no containment root to resolve against, and every path source is
      *  already in the same raw coordinate anyway. */
     normalizeAttachmentPath?: (raw: string) => Promise<string>;
-    /** RB-197②(codex 交叉复审命中,已修) — recognizes the hands Read tool's own dedup-stub markers
+    /** RB-197②(交叉复审命中,已修) — recognizes the hands Read tool's own dedup-stub markers
      *  ({@link isReadDedupStubResult}), so `maybeCompact`'s kept-tail scan can tell a SUBSTANTIVE Read
      *  result from a stub hit whose original full transmission may already be summarized away. Present
      *  only with hands (same gate as readTaskFile). */
@@ -707,7 +707,7 @@ export interface Prepared {
      *  `MaybeCompactOptions.onApplied` by every compaction lane. Drops the non-seeded read-state entries
      *  (the summary just replaced the Read results the dedup stubs point at) and re-registers the files
      *  that were re-attached WHOLE. Present only with hands (same gate as readTaskFile).
-     *  RB-197②(codex 命中,已修): `preserveReadState` carries the kept-tail-visible files that were
+     *  RB-197②(命中,已修): `preserveReadState` carries the kept-tail-visible files that were
      *  deliberately skipped for re-attachment — their existing entry must survive the clear too (same
      *  reasoning as a seeded entry: the model's view of the file did not change). */
     onCompactionApplied?: (attachedComplete: ReadonlyArray<{
@@ -731,7 +731,7 @@ export interface Prepared {
     planModeRef: {
         active: boolean;
     };
-    /** [915] A1 (design/66 anchor revision) — the date-flip detector seam: `legDate` = the date frozen
+    /** A1 (design/66 anchor revision) — the date-flip detector seam: `legDate` = the date frozen
      *  into this leg's system prefix; `today()` = the boundary-time LOCAL date (user-zone-bound closure).
      *  The run loop feeds both to the `date_change` attachment producer; the prefix itself never
      *  re-renders mid-leg (cache preservation, CC parity). Present only when the prompt carries a date. */
@@ -953,7 +953,7 @@ export interface PrepareResume {
     /** Digest of that question's batch — the id alone can repeat, so the pairing is what keeps a LATER
      *  question from inheriting the claim that an operator approved it. */
     redeemedContentAskQuestionsHash?: string;
-    /** codex 1360 r6 — true iff this resume will EXECUTE an approved pending tool (`tool_approval`
+    /** true iff this resume will EXECUTE an approved pending tool (`tool_approval`
      *  checkpoint × an `allow` winner). The divergent-restore fail-closed guard keys on THIS, not on the
      *  batch being non-empty: a deny winner executes nothing, so a workspace-root divergence must not
      *  wedge the refusal (it proceeds under the path-state rebase and records the deny). */
@@ -1089,14 +1089,14 @@ export interface InheritedGate {
         /**
          * The environment this screening face was installed against — the source of the `HookEnvCapabilities`
          * handed to it, compared BY REFERENCE, `undefined` when the installation had no env face. Part of the
-         * installation's identity for the same reason the frozen approver is (codex review, HIGH): a face that
+         * installation's identity for the same reason the frozen approver is (HIGH): a face that
          * resolves paths through `ctx.env` answers a different question in a different environment, so an
          * ancestor running against the deployment's tree and a descendant running in an isolated worktree are
          * two screenings, not one. A deployment with a per-task `executionEnvFactory` therefore has its face
          * consulted once per environment on the chain rather than once overall — which is the point: the
          * ancestor's environment is the only place the ancestor's verdict can be reproduced.
          *
-         * ⚠️ RECORDED BOUNDARY (delegation provenance, codex review): the approver half of the key compares
+         * ⚠️ RECORDED BOUNDARY (delegation provenance): the approver half of the key compares
          * through {@link askApproverIdentity}, which by its own contract answers "the same decision-maker",
          * collapsing a `withDelegationProvenance` wrapper onto the approver it forwards to. Two installations
          * whose approvers differ ONLY in the provenance they attach therefore count as one. Raw reference
@@ -1270,7 +1270,7 @@ export interface RunInternals {
      */
     reminderMark?: string;
     /**
-     * RB-204 P1 (codex review) — set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
+     * RB-204 P1 — set UNCONDITIONALLY by every core spawn path (`createSubagentTool`'s
      * `childInternals` — shared by all four spawn legs sync/steer/background/fork, its persisted
      * `internalsSnapshot` for revive, and the workflow orchestrator's `spawnAttribution`), regardless
      * of whether a NAMEABLE `parentTaskId`/`parentToolCallId` exists. A directly-started workflow (no
@@ -1310,7 +1310,7 @@ export interface RunInternals {
      * Why internal (not a public `TaskSpec.goalMode`): the guidance promises "declaring done STOPS iteration and
      * surfaces" — a promise only `runGoal`'s loop makes real. A public field would let a caller inject that
      * prompt with no loop behind it (§6.3 honesty violation). `runGoal` injects the `declare_done` tool itself;
-     * this flag only governs the PROMPT (codex r2 — injection-ownership split).
+     * this flag only governs the PROMPT (injection-ownership split).
      */
     goalMode?: boolean;
     /**
@@ -1353,7 +1353,7 @@ export interface RunInternals {
      */
     agentName?: string;
     /**
-     * design/147 S3 (codex R3 label-vs-identity): the EXPLICIT `Agent({name})` spawn identity — set
+     * design/147 S3 (label-vs-identity): the EXPLICIT `Agent({name})` spawn identity — set
      * ONLY when the spawn carried a `name` parameter, unlike {@link agentName} (a DISPLAY label:
      * description or agent-type, present on nearly every spawn). Teammate semantics (hierarchy clamp,
      * teammate addendum, uplink attribution) key on THIS field; keying on the display label made
@@ -1393,7 +1393,7 @@ export interface RunInternals {
      * {@link delegationTaskType} above. TRUSTED run-scoped channel (never a TaskSpec field).
      */
     cycleSeq?: number;
-    /** δ 批 [1498]⑦/A-3 — the ROOT host session of the whole delegation tree (fixed point: the
+    /** The ROOT host session of the whole delegation tree (fixed point: the
      *  spawner passes its own `ctx.rootSessionId ?? ctx.sessionId`, so depth 1 gets the host session
      *  and every deeper level inherits it verbatim). `parentSessionId` is the IMMEDIATE spawner —
      *  after a restart those intermediate sessions are dead ends, and a recovery face enumerating
@@ -1421,7 +1421,7 @@ export interface RunInternals {
      * delegation tool resolves this axis TO that principal.
      */
     registryScope?: string;
-    /** design/148 S1 (codex F2a) — the spawning run's ADOPTED center artifact, threaded down the
+    /** design/148 S1 — the spawning run's ADOPTED center artifact, threaded down the
      *  trusted internals chain so every child in the tree composes the SAME closure (a child must
      *  never spontaneously adopt the live candidate while its parent runs an older pin — that is the
      *  exact mixed-version state the epoch exists to prevent). Resolved by-digest through the
@@ -1482,7 +1482,7 @@ export interface RunInternals {
         priority?: import("../task-notification.js").SystemInjectionPriority;
     }) => void;
     /**
-     * design/147 S3a (codex F2) — the PARENT run's subagent-retain ledger, threaded to a CHILD so its
+     * design/147 S3a — the PARENT run's subagent-retain ledger, threaded to a CHILD so its
      * SendMessage can continue a RETAINED SIBLING (the sibling's retain entry lives on the parent's
      * ledger — without this, sibling resolution succeeds but delivery always reads not-retained).
      * TRUSTED chain; read-only use (the sibling leg resumes through the same fenced resume face).
@@ -1522,7 +1522,7 @@ export interface RunInternals {
      */
     parentCwd?: string;
     /**
-     * [c209-D] codex R3 — the EXPLICIT Agent.cwd request, distinct from the best-effort `parentCwd`
+     * [c209-D] — the EXPLICIT Agent.cwd request, distinct from the best-effort `parentCwd`
      * inheritance hint above: inheritance may be silently ignored by a factory (or absent without one),
      * but an explicit cwd the model asked for MUST either take effect or fail loud. prepareTask enforces
      * the contract: no `executionEnvFactory` ⇒ throw `config.cwd_unsupported`; after env creation the
@@ -1558,7 +1558,7 @@ export interface RunInternals {
      */
     onActivity?: (activity: ToolActivity) => void;
     /**
-     * RB-393① (黑板 [2107]②) — a TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
+     * RB-393① — a TRUSTED run-scoped WORKSPACE-observation sink, filled ONLY by a core caller
      * (the workflow's `ctx.agent` / `ctx.agentStream`, to record an isolated agent's worktree directory on the
      * persisted run record). NEVER a {@link TaskSpec} field — same posture as {@link onActivity}.
      *
@@ -1566,7 +1566,7 @@ export interface RunInternals {
      * {@link RunnerDeps.executionEnvFactory} and lands only on the per-task env's `cwd`; no runner-outward face
      * (TaskEvent union / TaskStream / TaskResult) carries it back. An orchestrator therefore could not record
      * WHERE its isolated agent worked — the recovery path after an interrupted run had to enumerate the
-     * worktrees directory and guess, which is exactly the contradiction [2113] recorded against the
+     * worktrees directory and guess, which is exactly the contradiction recorded against the
      * "isolate-only, userland decides verify/merge" intent.
      *
      * Called at most ONCE per prepared run with the task's FINAL working root (see {@link ResolvedWorkspace}),

package/dist/core/runner/prepare-task.js

@@ -22,7 +22,7 @@ import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { askApproverIdentity, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOf, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
 const PERSISTED_RULE_TOOL = "Bash";
-import { findAdmittingRule, suggestRulesForCommand } from "../permission-rule-model.js";
+import { findAdmittingRule, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
 import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
 import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
@@ -35,6 +35,7 @@ import { createWriteProtectionCheck } from "../write-protect.js";
 import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
+import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
 import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
@@ -436,7 +437,9 @@ function orgRevisionEvidenceOf(resolution, onDefect) {
     return {};
 }
 function persistedRuleHitOf(admitting) {
-    return admitting === undefined ? undefined : { rule: admitting.rule, dots: admitting.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) };
+    return admitting === undefined
+        ? undefined
+        : { rules: admitting.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
 }
 function cwdConflictsRestoreError(requestedCwd) {
     const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
@@ -472,6 +475,20 @@ async function adoptReminderMark(session, sessionId, seedMark, spawnMark, onErro
     }
     return { reminderMark, reminderDisclosureCounts: {} };
 }
+async function derivedRouteFallsBack(args) {
+    try {
+        if (sameRouteIdentity(args.derived, args.primary))
+            return false;
+        const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
+        if (verdict === undefined || verdict.ok)
+            return false;
+        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict }));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -489,7 +506,13 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     const sessionId = acquired.sessionId;
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
-    warnCompactionWindowHazard(deps.tracer, spec, model, compModel, hostTaskId);
+    let effectiveCompModel = compModel;
+    if (spec.compactionModel === undefined &&
+        compModel !== undefined &&
+        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice }))) {
+        effectiveCompModel = undefined;
+    }
+    warnCompactionWindowHazard(deps.tracer, spec, model, effectiveCompModel, hostTaskId);
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     internals?.peerSelfRef?.addAxis("s", sessionId);
     internals?.peerSelfRef?.addAxis("t", hostTaskId);
@@ -1073,6 +1096,9 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             catch {
                 classifierModel = model;
             }
+            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice })) {
+                classifierModel = model;
+            }
             const classifierSystemPrompt = buildAutoModePrompt(am);
             const classifierRuntime = brainToRuntime(deps.brain);
             autoModeDecider = createAutoModeDecider({
@@ -1083,7 +1109,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     const ctx = await session.buildContext();
                     const known = ctx.messages.filter((m) => m.role === "user" || m.role === "assistant" || m.role === "toolResult");
                     const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                    const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, { signal });
+                    const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
+                    const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
+                        signal,
+                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
+                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
+                    });
                     return response.content
                         .filter((c) => c.type === "text")
                         .map((c) => c.text)
@@ -1412,7 +1443,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     owner: hostTaskId,
                     scope: taskScope,
                     ...(sessionId !== undefined ? { sessionId } : {}),
-                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}),
+                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}),
                     ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
                     ...(internals?.parentNotify !== undefined
                         ? { uplink: internals.parentNotify, ...(internals.parentPeerRef !== undefined ? { uplinkRecipient: internals.parentPeerRef } : {}) }
@@ -2990,7 +3021,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }));
                         return { unreadable: true };
                     }
-                    return persistedRuleHitOf(findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root }));
+                    const admitting = findAdmittingRule(listed.rules, { tool: req.toolName, command, cwd: root });
+                    if (admitting !== undefined)
+                        return persistedRuleHitOf(admitting);
+                    const coverage = segmentCoverageOf(command, { persisted: listed.rules }, { tool: req.toolName, cwd: root });
+                    return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
                 },
             };
         })();
@@ -3020,7 +3055,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             };
         })();
-        const ruleSuggestionsOf = (toolName, args, ask) => {
+        const ruleOffersOf = (toolName, args, ask) => {
             if (permissionRuleLane === undefined || toolName !== PERSISTED_RULE_TOOL)
                 return {};
             if ((spec.principal === undefined || spec.principal === "") && deps.localOwnerRules !== true)
@@ -3042,8 +3077,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             const command = args?.command;
             if (typeof command !== "string")
                 return {};
-            const suggestions = suggestRulesForCommand(command);
-            return suggestions.length > 0 ? { ruleSuggestions: suggestions } : {};
+            const offers = suggestRulesForCommand(command, ask?.segmentCoverage !== undefined ? { coverage: ask.segmentCoverage } : undefined);
+            return offers.length > 0 ? { ruleOffers: offers } : {};
         };
         const frozenClassifierExcluded = (d) => d.decisionReason === "hook" || d.matchedAskRule !== undefined;
         const recheckApprovedEdit = async (pol, onAskOf, creq, edit, csignal, ancestorDecider) => {
@@ -3092,7 +3127,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     toolName: creq.toolName,
                     toolCallId: creq.toolCallId,
                     args: editArgs,
-                    ...ruleSuggestionsOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
+                    ...ruleOffersOf(creq.toolName, editArgs, { ...(re ?? {}), ancestorResolved: true }),
                     message: re.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(creq.toolName),
@@ -3178,7 +3213,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(first.action === "ask" ? first : {}), ancestorResolved: true }),
                             message: first.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3266,7 +3301,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             toolName: creq.toolName,
                             toolCallId: creq.toolCallId,
                             args: presentedArgs,
-                            ...ruleSuggestionsOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
+                            ...ruleOffersOf(creq.toolName, presentedArgs, { ...(decision.action === "ask" ? decision : {}), ancestorResolved: true }),
                             message: decision.message ?? `approval required for "${creq.toolName}" (inherited parent policy)`,
                             ...askSourceIdentity(),
                             ...riskAxesOf(creq.toolName),
@@ -3558,7 +3593,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         const preview = approvalPreviewOf(req.toolName, req.args);
                         return preview !== undefined ? { preview } : {};
                     })(),
-                    ...ruleSuggestionsOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
+                    ...ruleOffersOf(req.toolName, req.args, decision.action === "ask" ? decision : undefined),
                     message: decision.message ?? `approval required for "${req.toolName}"`,
                     ...askSourceIdentity(),
                     ...riskAxesOf(req.toolName),
@@ -4035,7 +4070,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -4196,11 +4231,12 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                     const preview = approvalPreviewOf(req.toolName, parkedArgs);
                                     return preview !== undefined ? { preview } : {};
                                 })(),
-                                ...ruleSuggestionsOf(req.toolName, parkedArgs, {
+                                ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
                                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
                                     ...(askDecisionReason !== undefined ? { decisionReason: askDecisionReason } : {}),
                                     ...(inheritedUnavailableAsks.has(req.toolCallId) ? { inheritedUnresolved: true } : {}),
+                                    ...(segmentCoverage !== undefined ? { segmentCoverage } : {}),
                                 }),
                                 boundInputHash: boundInputHashOf(parkedArgs),
                                 batchToolCallIds,
@@ -4326,11 +4362,11 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                         admits: permissionRuleLane.admits,
                                         onResolved: (info) => emitTrace(deps.tracer, () => ({
                                             kind: "permission.persisted_rule_allowed",
-                                            version: 1,
+                                            version: 2,
                                             taskId: spec.taskId ?? sessionId,
                                             toolName: info.toolName,
                                             toolCallId: info.toolCallId,
-                                            rule: info.rule,
+                                            rules: [...info.rules],
                                             ts: Date.now(),
                                         })),
                                     },
@@ -4733,7 +4769,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, reminderMark, reminderDisclosureCounts, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;

package/dist/core/runner/prepare-workspace-restore.d.ts

@@ -3,7 +3,7 @@ import type { ExecutionEnv } from "../../internal/harness.js";
 import type { RemoteEnvFailureNote, RunnerDeps, TaskSpec } from "../types.js";
 import type { PrepareResume, RunInternals } from "./prepare-task.js";
 /**
- * codex 1360 r2-r4 — rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
+ * rebase one checkpointed absolute path from the OLD workspace root onto the RESTORED
  * one (divergent `resumeVM`). POSIX-ONLY by contract: every remote lane's `mountPath` is a container
  * path (e2b/k8s/ssh/adb/local-docker are all Linux targets), so a backslash ANYWHERE in the inputs marks
  * the value outside this function's domain and it returns `p` UNCHANGED — an un-rebased path is honestly
@@ -71,7 +71,7 @@ export interface PrepareWorkspaceRestoreInput {
     internals: Pick<RunInternals, "onWorkspaceResolved" | "isolation"> | undefined;
     /** borrowed-readonly — the durable-resume seats this phase reads: the checkpointed
      *  `workspaceHandle` (restore target) and `executesApprovedAction` (the divergence fail-closed
-     *  key — codex 1360 r6). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
+     *  key). Absent for a fresh/non-durable run: the phase is then root-passthrough. */
     resume: Pick<PrepareResume, "workspaceHandle" | "executesApprovedAction"> | undefined;
     /** owned (value) — the pre-restore task root (isolation-aware initial derivation, computed in the
      *  driver). Dead after this call by design (R-5): later phases read the returned

package/dist/core/runner/runtask.d.ts

@@ -145,17 +145,17 @@ export declare class Runner {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
-    /** service [403](a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
+    /** (a) — roots whose rewind-files snapshot hit `too_large`, with the refusal time.
      *  A 20G workspace otherwise pays a full bounded tree-walk (stat tens of thousands of files) EVERY
      *  task just to re-discover the same refusal; once too_large, skip further snapshots for that root
      *  (announced once via onError). E19 semantics unchanged — rewind for that root was already
-     *  impossible. codex 131 审 C: TTL'd (30min), not permanent — a long-lived Runner over a tree the
+     *  impossible. TTL'd (30min), not permanent — a long-lived Runner over a tree the
      *  user later SHRINKS re-probes instead of being locked out until restart.
      *  RB-430-b: `skipAnnounced` makes the SKIP itself observable — one announcement per cooldown window,
      *  so an operator can tell "this turn produced no snapshot" from "snapshots are working", without the
      *  per-turn log spam the latch exists to prevent. Cleared with the entry when the window elapses. */
     private snapshotTooLargeRoots;
-    /** 飞轮 [492]② — task notifications born BETWEEN turns (run torn down / harness already idle), parked
+    /** task notifications born BETWEEN turns (run torn down / harness already idle), parked
      *  per session and drained into the session's next run at its first boundary. Runner-lived (outlives any
      *  single run, like the registry handles that produce into it); bounded + drop-disclosing, see
      *  {@link PendingSessionNotifications}. Not checkpointed — the producing handles are process-local. */
@@ -189,7 +189,7 @@ export declare class Runner {
         builtinAgents?: boolean;
         models?: Record<string, Model>;
     };
-    /** design/125 (codex 实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
+    /** design/125 (实现审 B1) — the deployment-level gating baseline, exposed READ-ONLY so thin
      *  assemblers over the Runner (`runSpec`) can COMPOSE with it. The task-level engine semantic is a
      *  WHOLE-SLOT override (`spec.toolPolicy ?? deps.toolPolicy`, same for hooks — prepare-task), so any
      *  assembler that sets `spec.toolPolicy`/`spec.hooks` without folding these in silently shadows the
@@ -219,13 +219,16 @@ export declare class Runner {
      * - `tiers` omitted ⇒ the current tier bindings are kept (and re-applied over the new models);
      *   explicitly passed (including `undefined`) ⇒ replaced.
      * - Success is announced via `config.models_swapped` (models/tiers counts — key material only,
-     *   never the catalog itself).
+     *   never the catalog itself). A swap may additionally emit the advisory
+     *   `route.base_url_changed_key_unchanged` notice (deliberately conservative — see its entry in
+     *   the notice directory) for same-name entries whose URL moved while the Model-visible
+     *   credential fingerprint did not.
      */
     swapModels(next: {
         models: Record<string, Model>;
         tiers?: Record<string, ModelRef>;
     }): void;
-    /** [1463]① — one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
+    /** one-shot brain-routed utility query (see {@link runSideQuery} for the full contract):
      *  preserves system/multi-turn messages/tool DEFINITIONS, routes through the deployment's brain with
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
@@ -249,7 +252,7 @@ export declare class Runner {
     /**
      * design/101 §E19 — capture a working-tree snapshot of the just-finished turn, keyed by the leaf
      * `SessionTreeEntry.id`. Best-effort + never throws (errors route to `onError(phase:"rewind")`). Runs against
-     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT, service [263]) — the
+     * ANY ExecutionEnv (local or remote) when a `fileSnapshotStore` is wired (GATE-SPLIT) — the
      * snapshot is portable (env FileSystem ops). A deployment wanting VM-snapshot instead wires a VM-backed store.
      */
     private snapshotTurn;
@@ -273,7 +276,7 @@ export declare class Runner {
      * v1 serves only the `human`/`policy_ask` gate (F4). A `task_done` checkpoint (1C Path A) is not
      * resumable here — the caller orchestrates that one and reads its handle directly.
      *
-     * **🔒 Authorization boundary (design/80 D-2 / [122] invariant #1) — token-as-auth, scope is store-level
+     * **🔒 Authorization boundary (design/80 D-2 invariant #1) — token-as-auth, scope is store-level
      * isolation, NOT caller authorization.** `resume` is TOKEN-AS-AUTH: whoever presents a valid, still-`pending`
      * checkpoint token resolves it. The scope passed to the store CAS is the checkpoint's OWN `cp.scope` (read
      * off the row), so the store's scope-WHERE is store-level multi-tenant DATA isolation (one tenant's reaper /
@@ -315,13 +318,13 @@ export declare class Runner {
      * trigger to execute the pending action — a lost CAS rejects, never returns a re-running stream).
      *
      * **Eager (like {@link runTaskStream}):** once this resolves, the resumed run is already executing — the
-     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` (service [325]) tears down the
+     * pending action runs exactly once and the run-loop tail's `teardownOwnedEnv` tears down the
      * rebuilt remote env even if you never iterate the stream. So abandoning the returned stream is safe (no leak,
      * no hang); it only means you
      * don't observe the resumed segment's events.
      */
     resumeStream(token: CheckpointToken, outcome: ResumeOutcome, taskConfig: ResumeTaskConfig, 
-    /** service [371]①: the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
+    /** the TRUSTED run-internals seam, symmetric with {@link runTaskStream} — a resume leg
      *  otherwise has no `onForwardEvent`席位, so a subagent's task_progress ticks (child-isolated stream,
      *  only exit = the forward sink) were unreachable on resume. Deployment-owned, never a TaskSpec field.
      *  Parent effective-policy inheritance CONTRACT: a checkpoint whose `state.inheritedGate.
@@ -394,7 +397,7 @@ export declare class Runner {
     private recordCompactionReuse;
     private finish;
     /**
-     * design/48 remote seam + service [325]: tear down a per-task env minted by `executionEnvFactory` (e.g. a
+     * design/48 remote seam +: tear down a per-task env minted by `executionEnvFactory` (e.g. a
      * remote container, or a `withWorktreeIsolation` worktree) — this task owned its lifetime. Best-effort, like
      * `mcp.dispose`: a `destroy()` failure must not break the run. Only `ownedEnv` (factory-produced) is destroyed;
      * a caller-owned static `deps.executionEnv` outlives the task and is left untouched. The service control plane's
@@ -402,7 +405,7 @@ export declare class Runner {
      *
      * Runs from the run-loop tail AFTER every env-reader (finish()'s compaction `attachWorkingFiles` +
      * `snapshotTurn`'s rewind-files capture), so the working tree is still readable when they run. This ORDER is the
-     * fix for service [325]: the old in-`finish()` destroy ran BEFORE `snapshotTurn`, so a factory-minted
+     * fix for a teardown-order defect: the old in-`finish` destroy ran BEFORE `snapshotTurn`, so a factory-minted
      * remote/worktree lane snapshotted an already-destroyed env (plain host/static lanes were false-green).
      *
      * design/49 v1.5 / design/76 §2.5: a SUSPENDED (`suspendRef.token`) or `needs_review` (`reviewRef.token`) pause

package/dist/core/runner/runtask.js

@@ -20,6 +20,7 @@ import { emitTaskOutcome } from "../task-outcome.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { primaryActivityArg } from "../arg-summary.js";
 import { resolveReasoning } from "../../brain/reasoning.js";
+import { adjudicateDerivedRoute, authCarrierFingerprint, fallbackToPrimaryNotice, normalizeBaseUrl, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { readDegradation } from "../../brain/degrading.js";
 import { runWithBrainTelemetry, runWithReasoningWireFacts, runWithStatusSink } from "../../brain/status-sink.js";
 import { expandTiers, resolveModel, resolveTaskModel } from "../roles.js";
@@ -1511,6 +1512,22 @@ export class Runner {
                 ...(h.timeoutMs !== undefined ? { timeoutMs: h.timeoutMs } : {}),
             }
             : undefined;
+        const MIRRORED_HOOK_KEYS = [
+            "preToolUse",
+            "preToolUseObservational",
+            "postToolUse",
+            "userPromptSubmit",
+            "stop",
+            "postToolUseFailure",
+            "postToolBatch",
+            "preCompact",
+            "postCompact",
+            "stopFailure",
+            "permissionDenied",
+            "timeoutMs",
+        ];
+        const _mirrorIsComplete = true;
+        void _mirrorIsComplete;
         return {
             ...(deps.toolPolicy !== undefined
                 ? {
@@ -1552,6 +1569,17 @@ export class Runner {
         }
         const tiers = Object.hasOwn(next, "tiers") ? next.tiers : this.deps.tiers;
         const expanded = tiers && Object.keys(tiers).length > 0 ? expandTiers({ ...next.models }, tiers) : { ...next.models };
+        const movedEntries = [];
+        for (const [name, nextModel] of Object.entries(expanded ?? {})) {
+            const prior = this.deps.models?.[name];
+            if (!prior)
+                continue;
+            const from = normalizeBaseUrl(prior.baseUrl);
+            const to = normalizeBaseUrl(nextModel.baseUrl);
+            if (from !== to && authCarrierFingerprint(prior.headers) === authCarrierFingerprint(nextModel.headers)) {
+                movedEntries.push({ modelId: name, from, to });
+            }
+        }
         this.deps = { ...this.deps, models: expanded, ...(tiers !== undefined ? { tiers } : {}) };
         if (tiers === undefined)
             delete this.deps.tiers;
@@ -1560,6 +1588,18 @@ export class Runner {
             message: `model catalog swapped: ${Object.keys(next.models).length} model(s), ${tiers ? Object.keys(tiers).length : 0} tier binding(s); in-flight tasks finish on their resolved models, new tasks resolve against the new catalog`,
             detail: { models: Object.keys(next.models).length, tiers: tiers ? Object.keys(tiers).length : 0 },
         });
+        if (movedEntries.length > 0) {
+            const RENDER_CAP = 8;
+            const rendered = movedEntries.slice(0, RENDER_CAP);
+            deliverEngineNotice(this.deps.onNotice, {
+                code: "route.base_url_changed_key_unchanged",
+                message: `model catalog swap moved ${movedEntries.length} entry/entries to a new baseUrl while the Model-visible credential half stayed unchanged: ` +
+                    rendered.map((e) => `"${e.modelId}" ${e.from || "(config root)"} → ${e.to || "(config root)"}`).join("; ") +
+                    (movedEntries.length > rendered.length ? `; +${movedEntries.length - rendered.length} more` : "") +
+                    " — if the provider changed (not just its domain), update the credential reference in the same step",
+                detail: { entries: rendered, total: movedEntries.length },
+            });
+        }
     }
     sideQuery(spec) {
         return runWithReasoningWireFacts(() => { }, () => runSideQuery(spec, { brain: this.deps.brain, models: this.deps.models, roles: this.deps.roles }));
@@ -3890,6 +3930,14 @@ export class Runner {
             }
             catch {
             }
+            if (!sameRouteIdentity(model, prepared.model)) {
+                const verdict = await adjudicateDerivedRoute({ brain: this.deps.brain, model, getApiKeyAndHeaders: spec.getApiKeyAndHeaders });
+                if (verdict !== undefined && !verdict.ok) {
+                    deliverEngineNotice(this.deps.onNotice, fallbackToPrimaryNotice({ seat: "prompt-suggestions", from: model.id, to: prepared.model.id, verdict }));
+                    model = prepared.model;
+                    thinking = prepared.thinking;
+                }
+            }
             const pricing = this.deps.pricing?.[model.id] ?? modelCostToPricing(model.cost);
             const ctx = await prepared.session.buildContext();
             const transcript = ctx.messages.slice(-SUGGESTIONS_TRANSCRIPT_MESSAGES);

package/dist/core/runner/session-rule-policy.d.ts

@@ -15,7 +15,7 @@ import type { SessionPermissionRules } from "../session-policy-store.js";
  *  skill face is a separate capability decision with its own review). */
 export declare const PATH_WRITE_TOOLS: ReadonlySet<string>;
 /** The FULL path-confinable write-tool set: {@link PATH_WRITE_TOOLS} plus `NotebookEdit`, whose write
- *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} ([886]①b —
+ *  target is `notebook_path` and is extracted by the shared tool-aware {@link writeTargetPath} (
  *  notebook_path outranks a decoy `file_path` for that tool).
  *
  *  REF-B3 — the ONE spelling of "tools this codebase can confine by path". Consumers:

package/dist/core/runner/teardown-bounded.d.ts

@@ -1,5 +1,5 @@
 /**
- * RB-470 (blackboard [2310], the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
+ * RB-470 (the D4 never-settle class) — bounded await for BEST-EFFORT teardown /
  * cleanup legs on a run's settle path.
  *
  * The defect class: `resume()`/`runTask` settle only when the run body returns, and the body's tail