@sema-agent/core 5.62.0 → 5.64.0

package/dist/core/memory-engine/origin-clearance.d.ts

@@ -40,6 +40,34 @@ export interface OriginClearanceRow {
     tombstonedAt?: number;
     events: OriginClearanceEvent[];
 }
+/**
+ * #468② — the ACCOUNT SHADOW a `memory.origin_clear_not_marked` refusal carries when the engine already
+ * held the answer: the entry's most recent COMPLETED clearance, as who asked for it and when it settled.
+ *
+ * It exists to discriminate the refusal's two very different causes without a second full read of the
+ * account: an entry that was NEVER marked (no shadow — nothing to clear, and nothing ever cleared) versus a
+ * RE-SEND of a clear that already succeeded (shadow present — the caller's own earlier call, or another
+ * host's, already did this). Absence is honest absence: the engine never opens an extra read to fill it, so
+ * a refusal raised on a path that did not need the ledger simply omits it.
+ *
+ * `requestId` is the OPENER's attribution (the `clearEntryOrigin` caller's own key — what a re-sending
+ * caller compares against), while `settledAt` is the row's terminal `done` event, which on a crash-resumed
+ * row is a LATER moment than the opening. The full row (reason, origin, custody, every event) stays one
+ * {@link OriginClearanceRow} lookup away — this shadow is a discriminator, never a replacement for it.
+ *
+ * AS-OF SEMANTICS (codex r3): the account is read ONCE per `clearEntryOrigin` call, by the probe that looks
+ * for a resumable pending row, and the committed entry is read after it. A clearance opened AND settled by
+ * ANOTHER caller inside that window is therefore not in the snapshot this shadow is derived from, so its
+ * absence means "no settled clearance as of this call's own read of the account", never "none exists" — and
+ * a fresh call answers with the newer account. The caller's OWN earlier clear (the re-send case this exists
+ * for) settled long before and is always in the snapshot. Deliberately not closed by a second read: the
+ * shadow is a convenience over the authoritative `listOriginClearances`, and buying strictness with an extra
+ * ledger read on a refusal path would cost every caller what only a concurrent third party could observe.
+ */
+export interface OriginClearanceShadow {
+    requestId: string;
+    settledAt: number;
+}
 /** Lock-free strict read of the whole account (host audit face; journal-aware, corrupt = throw). */
 export declare function readOriginClearances(controlDir: string): OriginClearanceRow[];
 /**

package/dist/core/remote-env.d.ts

@@ -58,6 +58,13 @@ export interface WorkspaceHandle {
      *  `snapshotId` as corruption (fail-closed) unless the resumed env is itself non-suspendable
      *  (tolerance for park handles minted by 1.257.1 before this field existed). */
     restoreMode?: "park_only";
+    /**
+     * design/380 O1④ — explicit identity of the physical/target device this workspace lives on
+     * (device lane; an SSH/ADB adapter MAY also stamp it). MINTER-STATED: consumers read this field,
+     * never parse an identity out of `sandboxId`. Plain string → rides CheckpointState.workspaceHandle
+     * (all-string whitelist) with zero schema movement.
+     */
+    deviceId?: string;
 }
 /**
  * A reference to a secret injected at {@link RemoteExecutionEnv.connect}/{@link RemoteExecutionEnv.postResumeInit}
@@ -213,6 +220,16 @@ export type RemoteExecutionErrorCode =
  * else a retry whitelist misses them.
  */
  | "transport_lost"
+/**
+ * design/380 O12 — the op was COMMITTED to the remote target and its outcome is UNKNOWABLE (the target
+ * went unreachable / restarted / was revoked after dispatch-commit; an execStream cut where the target
+ * protocol's own server has ruled the outcome unknowable). NEVER auto-retried and deliberately NOT in
+ * {@link RETRYABLE_REMOTE_ERROR_CODES}: the command may have already executed — a retry whitelist that
+ * contained it would re-drive committed side effects. Distinct from `transport_lost` (connection story
+ * known, idempotency-gated retry after reconnect). Message MUST carry the verify-first sentence ("may
+ * have already executed on the target; verify its effect before re-running").
+ */
+ | "outcome_unknown"
 /** Unclassified provider/transport failure. */
  | "unknown";
 /**
@@ -220,8 +237,10 @@ export type RemoteExecutionErrorCode =
  * can succeed (`auth_transient`: retry-exactly-once after the device is authorized; `connect_failed`: the
  * workspace could not be reached/provisioned this attempt; `timeout`: a liveness bound tripped;
  * `transport_lost`: re-establish the connection). Every OTHER code is permanent for this attempt
- * (`auth_failed`/`unsupported`), caller-driven (`aborted`), or unclassifiable (`unknown`) — retrying them
- * burns budget or, worse, re-drives a rejected credential.
+ * (`auth_failed`/`unsupported`), caller-driven (`aborted`), unclassifiable (`unknown`), or
+ * outcome-unknowable (`outcome_unknown` — design/380 O12: the op may have ALREADY executed, so a retry
+ * re-drives committed side effects) — retrying them burns budget or, worse, re-drives a rejected
+ * credential or a committed op.
  *
  * ONE list, two consumers, so a caller's retry decision and its DISCLOSURE can never disagree: the engine
  * retries only IDEMPOTENT ops on these codes (see {@link withRetry}'s red line — a snapshot-taking
@@ -405,6 +424,19 @@ export interface RemoteExecutionEnv extends ExecutionEnv {
 export interface ExecutionEnvFactoryContext {
     /** Resolved session id for the task — the stable identity of its per-task workspace. */
     sessionId: string;
+    /**
+     * design/380 O1① — the run TREE's placement root (fixed point), minted by prepare AFTER session
+     * resolution as `internals.placementRoot ?? internals.rootSessionId ?? sessionId` — a top-level
+     * run's own resolved sessionId, every descendant's inherited root, verbatim (delegation and
+     * workflow spawn chains re-thread an explicit `placementRoot` — C12; the ONE boundary it does not
+     * yet cross is a bare DURABLE RESUME, which falls back to the checkpointed session until
+     * design/380 O1③'s checkpoint carriage lands — residual pinned). A target-bound
+     * factory (device lane) keys its placement lookup on THIS, never on `sessionId` (a child's fresh
+     * session id must not read as a new placement). Always present and non-empty — an empty value is
+     * an assembly error the engine refuses loudly at the mint (`config.placement_root_invalid`) and a
+     * factory MUST refuse loudly too (loud-bad-value posture), never default around.
+     */
+    placementRootSessionId: string;
     /** Caller-supplied task id, when set on the `TaskSpec`. */
     taskId?: string;
     /**

package/dist/core/runner/prepare-config-doors.d.ts

@@ -158,7 +158,7 @@ export interface PrepareConfigDoorsResult {
      *  for the door + placement reasoning). The per-run state builder consumes exactly these values —
      *  the deps bag is never re-read after this door. */
     microCompactKnob: {
-        machine: ContextEditMachine;
+        machine: "off" | ContextEditMachine;
         clearOnRejection: boolean;
     };
     /** owned — the resolved role; its `systemPrompt` seat is still read at prompt-input time. */
@@ -216,7 +216,7 @@ export interface PrepareConfigDoorsResult {
  *  it must refuse exactly like a malformed field, never fold to the defaults. The RESOLVED values
  *  returned here are immutable and are the state builder's ONLY source — nothing re-reads the bag. */
 export declare function resolveMicroCompactKnob(bag: RunnerDeps["microCompact"]): {
-    machine: ContextEditMachine;
+    machine: "off" | ContextEditMachine;
     clearOnRejection: boolean;
 };
 export declare function prepareConfigDoors(input: PrepareConfigDoorsInput): PrepareConfigDoorsResult;

package/dist/core/runner/prepare-config-doors.js

@@ -123,8 +123,8 @@ function microCompactConfigError(field, value, legal) {
     }
     const seat = field === undefined ? "microCompact" : `microCompact.${field}`;
     const e = new Error(`${seat} ${shown} is not ${legal} — an unevaluable declaration is refused loudly, ` +
-        `never folded to the default: a silently-ignored opt-in would run the pre-374 machine while the ` +
-        `deployment believes it opted in.`);
+        `never folded to the default: a silently-ignored declaration would run the DEFAULT machine ` +
+        `while the deployment believes its opt-in or opt-out took effect.`);
     e.code = "config.microcompact_invalid";
     return e;
 }
@@ -133,14 +133,17 @@ export function resolveMicroCompactKnob(bag) {
         throw microCompactConfigError(undefined, bag, "an object carrying optional machine/clearOnRejection keys");
     }
     const declaredMachine = bag?.machine;
-    if (declaredMachine !== undefined && declaredMachine !== "legacy" && declaredMachine !== "cc") {
-        throw microCompactConfigError("machine", declaredMachine, `"legacy" | "cc"`);
+    if (declaredMachine !== undefined && declaredMachine !== "off" && declaredMachine !== "legacy" && declaredMachine !== "cc") {
+        throw microCompactConfigError("machine", declaredMachine, `"off" | "legacy" | "cc"`);
     }
-    const declaredClearOnRejection = bag?.clearOnRejection;
-    if (declaredClearOnRejection !== undefined && typeof declaredClearOnRejection !== "boolean") {
-        throw microCompactConfigError("clearOnRejection", declaredClearOnRejection, "a boolean");
+    return { machine: declaredMachine ?? "cc", clearOnRejection: resolveClearOnRejection(bag) };
+}
+function resolveClearOnRejection(bag) {
+    const declared = bag?.clearOnRejection;
+    if (declared !== undefined && typeof declared !== "boolean") {
+        throw microCompactConfigError("clearOnRejection", declared, "a boolean");
     }
-    return { machine: declaredMachine ?? "legacy", clearOnRejection: declaredClearOnRejection === true };
+    return declared ?? true;
 }
 export function prepareConfigDoors(input) {
     const { deps, sessions, resume, internals } = input;

package/dist/core/runner/prepare-task.d.ts

@@ -145,6 +145,51 @@ export declare function checkpointScopeOf(spec: {
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
 export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+/** See {@link runGuardChain}. */
+export interface GuardChainArgs {
+    /** The post-frontier view the chain starts from. */
+    edited: AgentMessage[];
+    /** The pre-cap counterpart view (arm A's clearSource — RB-212 durable composition seat). */
+    replayed: AgentMessage[];
+    index: OccurrenceIndex;
+    microCompact: PreparedMicroCompact;
+    guardAt: number;
+    charsPerToken: number;
+    offloadStore: import("../tool-result-store.js").ToolResultStore | undefined;
+    sessionId: string;
+    taskId: string;
+    deps: RunnerDeps;
+    trimPressureRef: {
+        droppedMessages: boolean;
+    };
+    recheck: boolean | undefined;
+    signal: AbortSignal | undefined;
+    /** The r7 per-request observation buffer — the chain DROPS it on its early returns (a discarded
+     *  provisional projection must not narrate itself). */
+    pendingProjectionObservations: Array<() => void>;
+}
+export type GuardChainOutcome = {
+    earlyReturn: {
+        messages: AgentMessage[];
+        adoptSessionRebuild?: boolean;
+    };
+} | {
+    working: AgentMessage[];
+    trimmed: AgentMessage[];
+    trimDroppedMessages: boolean;
+};
+/**
+ * design/374 slice 3 — the GUARD CHAIN over one request build (D-7 case-ii transfer table),
+ * module-level per the design/238 body-span bank. design/123 D3: the chain reads the anchored
+ * coordinate re-estimated on the EDITED array (pre-anchor clears don't lower it — deliberately;
+ * trimToBudget doc). The opt-out machine = the pre-374 backstop order byte-identical
+ * (trim as the ordinary second line); otherwise arm A (blocking machine run, only when the
+ * frontier pass is off) → arm B (in-turn forced compaction behind the adopt seam) → arm C (trim,
+ * the disaster-only last resort and this chain's sole `context.trim` emitter). Returns either the
+ * post-chain view for the pipeline tail, or an EARLY hook result the context handler must return
+ * verbatim (arm-B adoption / the r8 dead-turn stand-down).
+ */
+export declare function runGuardChain(args: GuardChainArgs): Promise<GuardChainOutcome>;
 export interface Prepared {
     harness: AgentHarness;
     /** The CONCRETE built-in session (engine-internal: prepare constructs/acquires `StoredSession` itself,
@@ -886,21 +931,38 @@ export interface Prepared {
     trimPressureRef: {
         droppedMessages: boolean;
     };
-    /** design/374 slices 1b/2 — the microCompact machine state this run: the selected clearing
+    /** design/374 slices 1b/2/3 — the microCompact machine state this run: the selected clearing
      *  machine, the cleared-projection ledger (request-view application, durable decisions — see
      *  `context-edit.ts`'s ledger note; per-run in-memory, so durable resume / `resumeAt` rebuilds
      *  start EMPTY by construction), the last request's projection seat (what the provider actually
      *  saw — the MC-R rejection arm computes its candidates and savings on THIS view, never on the
-     *  raw session rebuild), and the MC-R knob. Default machine "legacy" + MC-R off ⇒ the ledger
-     *  never gains an entry and every replay is a same-reference no-op (default bytes unchanged). */
+     *  raw session rebuild), the MC-R knob, and the slice-3 arm-B seat. The explicit opt-out
+     *  (`machine: "legacy"` + MC-R off) ⇒ the ledger never gains an entry and every replay is a
+     *  same-reference no-op (opt-out bytes unchanged). */
     microCompact: PreparedMicroCompact;
 }
 /** See {@link Prepared.microCompact}. */
 export interface PreparedMicroCompact {
-    machine: ContextEditMachine;
+    /** The frontier-machine selection — `"off"` = no proactive frontier clearing (the unified
+     *  machine instead gets its one blocking-point shot, slice-3 arm A). */
+    machine: "off" | ContextEditMachine;
     /** MC-R (design/374 §3.2): one-shot clear-and-retry on a provider input-too-long rejection.
-     *  Default false (X2: lands with the machinery, flips with slice 3). */
+     *  Default true since the slice-3 flip. */
     clearOnRejection: boolean;
+    /** design/374 slice 3 (arm B) — the in-turn forced-compaction seat: runtask wires a closure
+     *  that runs the SAME forced-compaction pass the prompt-too-long recovery uses (gates included)
+     *  and answers whether a compaction landed in the session. The context hook calls it when the
+     *  pre-send estimate breaks the guard budget and then returns `adoptSessionRebuild` so the
+     *  harness adopts the reduced transcript. `signal` is the TURN-scoped abort of the request
+     *  build (r3): a turn interrupt must be able to cut the summary call short instead of waiting
+     *  it out. `anchoredEstimate` is the chain's own trigger coordinate — the seat consults the
+     *  §25.2 anti-thrash floor against it (an ineffective landing must not be repeated per request
+     *  build; the chain's arm C owns the bounded fallback). Unwired (pure-prepare callers) ⇒ arm B
+     *  declines and the chain falls to the trim last resort — same posture as a compaction-disabled
+     *  run. */
+    inTurnCompactionRef: {
+        current?: (signal?: AbortSignal, anchoredEstimate?: number) => Promise<boolean>;
+    };
     ledger: ClearedProjectionLedger;
     projectionRef: {
         current?: {
@@ -1436,6 +1498,26 @@ export interface RunInternals {
      *  after a restart those intermediate sessions are dead ends, and a recovery face enumerating
      *  "everything under this host session" needs the root anchor, not an alias walk. */
     rootSessionId?: string;
+    /**
+     * design/380 O1② — the run tree's PLACEMENT root: the fixed point a target-bound env factory keys
+     * its placement lookup on ({@link import("../remote-env.js").ExecutionEnvFactoryContext.placementRootSessionId}).
+     * A SEPARATE axis from {@link rootSessionId} deliberately: that field means "member of this host
+     * session's DELEGATION tree" and is consumed by the registry access/recovery faces — cascade rungs
+     * and verification legs are intentionally NOT members of that tree (independent cold re-runs in
+     * their own sessions), so widening `rootSessionId` to cover them would corrupt the recovery faces'
+     * reading. This member says only "place me where this session was placed". Producers: the
+     * orchestration entries (`runCascade` / `runWithVerification` family) after their first leg's
+     * sessionId receipt, and — C12 — the delegation/workflow spawn chains, which re-thread a parent's
+     * EXPLICIT value verbatim into child internals (ToolExecuteContext.placementRoot → childInternals;
+     * workflow deps → shared internals base), so every descendant of a placed leg keeps the fixed
+     * point; prepare's mint reads it first (`placementRoot ?? rootSessionId ?? sessionId`). Absent
+     * everywhere else — the delegation lanes' `rootSessionId` fixed point then becomes the placement
+     * root through the middle segment, unchanged. NOT yet durable (C12 residual, pinned): a bare
+     * durable resume cannot recover it until design/380 O1③'s checkpoint carriage lands — the
+     * resumed leg falls back to its own session; a resume caller needing continuity re-supplies the
+     * member itself. TRUSTED run-scoped channel (never a {@link TaskSpec} field).
+     */
+    placementRoot?: string;
     /**
      * RB-429 — the REGISTRY SCOPE this run's own background row lives in: the domain its registry-facing
      * tools (TaskOutput / TaskStop / SendMessage / AgentTranscript / Monitor, and the announce listing)

package/dist/core/runner/prepare-task.js

@@ -345,6 +345,7 @@ function buildMicroCompactState(deps, model, sessionId, offloadStore, knob) {
         clearOnRejection: knob.clearOnRejection,
         ledger: createClearedProjectionLedger(),
         projectionRef: {},
+        inTurnCompactionRef: {},
         ...(offloadStore ? { offloadPersist: createOffloadPersist(offloadStore, sessionId, deps.onNotice) } : {}),
     };
 }
@@ -363,10 +364,75 @@ function recordFrontierClears(args) {
         taskId: args.taskId,
         clearedCount: args.pass.clears.length,
         tokensSavedEstimate: args.pass.tokensSavedEstimate,
-        trigger: "frontier",
+        trigger: args.trigger,
         ts: Date.now(),
     }));
 }
+function flushProjectionObservations(pending) {
+    for (const fire of pending.splice(0)) {
+        try {
+            fire();
+        }
+        catch {
+        }
+    }
+}
+export async function runGuardChain(args) {
+    const { edited, microCompact, guardAt, charsPerToken, deps, taskId } = args;
+    const applyGuardTrim = (view, anchoredTotal) => {
+        let trimmed = trimToBudget(view, guardAt, anchoredTotal, charsPerToken);
+        const dropped = trimmed.length < view.length;
+        if (dropped) {
+            args.trimPressureRef.droppedMessages = true;
+            const droppedCount = view.length - trimmed.length;
+            trimmed = insertTrimNotice(trimmed);
+            emitTrace(deps.tracer, () => ({
+                kind: "context.trim",
+                version: 1,
+                taskId,
+                dropped: droppedCount,
+                ts: Date.now(),
+            }));
+        }
+        return { trimmed, dropped };
+    };
+    let working = edited;
+    let anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
+    if (microCompact.machine === "legacy") {
+        const t = applyGuardTrim(working, anchoredWorking);
+        return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
+    }
+    if (microCompact.machine === "off" && anchoredWorking > guardAt) {
+        let blockingPass;
+        const blockingEdited = clearStaleToolResults(working, {
+            budgetTokens: guardAt,
+            machine: "cc",
+            clearSource: args.replayed,
+            onCleared: (pass) => { blockingPass = pass; },
+            anchoredTotalTokens: anchoredWorking,
+            charsPerToken,
+            ...(args.offloadStore ? { offload: { persist: createOffloadPersist(args.offloadStore, args.sessionId, deps.onNotice) } } : {}),
+        });
+        if (blockingPass !== undefined) {
+            recordFrontierClears({ pass: blockingPass, index: args.index, edited: blockingEdited, ledger: microCompact.ledger, tracer: deps.tracer, taskId, trigger: "blocking" });
+            working = blockingEdited;
+            anchoredWorking = estimateContextTokens(working, charsPerToken).tokens;
+        }
+    }
+    if (anchoredWorking > guardAt && args.recheck !== true) {
+        const compacted = (await microCompact.inTurnCompactionRef.current?.(args.signal, anchoredWorking)) === true;
+        if (compacted) {
+            args.pendingProjectionObservations.length = 0;
+            return { earlyReturn: { messages: working, adoptSessionRebuild: true } };
+        }
+        if (args.signal?.aborted === true) {
+            args.pendingProjectionObservations.length = 0;
+            return { working, trimmed: working, trimDroppedMessages: false };
+        }
+    }
+    const t = applyGuardTrim(working, anchoredWorking);
+    return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
+}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -615,6 +681,15 @@ async function derivedRouteFallsBack(args) {
         return false;
     }
 }
+function mintPlacementRootSessionId(internals, sessionId) {
+    const placementRootSessionId = internals?.placementRoot ?? internals?.rootSessionId ?? sessionId;
+    if (placementRootSessionId === "") {
+        const e = new Error("placement root resolved EMPTY (internals.placementRoot / internals.rootSessionId carries an empty string) — an empty fixed point cannot key a placement lookup; fix the spawning lane instead of defaulting around it.");
+        e.code = "config.placement_root_invalid";
+        throw e;
+    }
+    return placementRootSessionId;
+}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf) {
     const doors = prepareConfigDoors({ spec, deps, sessions, resume, internals });
     spec = doors.spec;
@@ -723,7 +798,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     try {
         ownedEnv = deps.executionEnvFactory
             ? await deps.executionEnvFactory({
-                sessionId,
+                sessionId, placementRootSessionId: mintPlacementRootSessionId(internals, sessionId),
                 taskId: spec.taskId,
                 ...(internals?.isolation ? { isolation: internals.isolation } : {}),
                 ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
@@ -1107,7 +1182,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
-            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}),
+            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}), ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
             ...(internals?.explicitAgentName !== undefined ? { spawnedAgentName: internals.explicitAgentName } : {}),
             ...(internals?.peerSelfRef !== undefined ? { peerSelfRef: internals.peerSelfRef } : {}),
             ...(internals?.peerInboundChainRef !== undefined ? { peerInboundChainRef: internals.peerInboundChainRef } : {}),
@@ -1282,7 +1357,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 scope: taskScope,
                 notifier: deps.workflowCompletionNotifier,
                 originatingSessionId: sessionId,
-                rootSessionId: internals?.rootSessionId ?? sessionId,
+                rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
                 taskRegistry: defaultTaskRegistry,
                 taskNotification: internals?.onTaskNotification,
                 taskOwner: hostTaskId,
@@ -4621,101 +4696,108 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const guardAt = guardBudget(model);
         const microCompact = buildMicroCompactState(deps, model, sessionId, offloadStore, microCompactKnob);
         const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
-        harness.on("context", async ({ messages }) => {
+        harness.on("context", async ({ messages, recheck, signal }) => {
             batchHaltRef.current = undefined;
-            const healed = dropEmptyFailureAssistants(messages);
-            const replay = replayClearedProjection(healed, microCompact.ledger);
-            const replayed = replay.messages;
-            const capped = await capAggregateToolResults(replayed, {
-                store: offloadStore,
-                sessionId,
-                onCapped: (info) => emitTrace(deps.tracer, () => ({
-                    kind: "tool_result.capped",
-                    version: 1,
-                    taskId: spec.taskId ?? sessionId,
-                    ...(info.tool !== undefined ? { tool: info.tool } : {}),
-                    sizeChars: info.sizeChars,
-                    storeFallback: info.storeFallback,
-                    ts: Date.now(),
-                })),
-            });
-            const mediaCapped = capAggregateMediaBytes(capped, {
-                limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
-                onStripped: deps.onMediaStripped,
-            });
-            let ccPass;
-            const edited = clearStaleToolResults(mediaCapped, {
-                budgetTokens: editAt,
-                ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
-                ...(microCompact.machine === "cc"
-                    ? {
-                        machine: "cc",
-                        clearSource: replayed,
-                        onCleared: (pass) => { ccPass = pass; },
-                    }
-                    : {}),
-                anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
-                charsPerToken,
-                ...(offloadStore
-                    ? {
-                        offload: {
-                            persist: createOffloadPersist(offloadStore, sessionId, deps.onNotice),
-                        },
-                    }
-                    : {}),
-            });
-            if (ccPass !== undefined) {
-                recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: spec.taskId ?? sessionId });
-            }
-            let trimmed = trimToBudget(edited, guardAt, estimateContextTokens(edited, charsPerToken).tokens, charsPerToken);
-            const trimDroppedMessages = trimmed.length < edited.length;
-            if (trimDroppedMessages) {
-                trimPressureRef.droppedMessages = true;
-                const droppedCount = edited.length - trimmed.length;
-                trimmed = insertTrimNotice(trimmed);
-                emitTrace(deps.tracer, () => ({
-                    kind: "context.trim",
-                    version: 1,
-                    taskId: spec.taskId ?? sessionId,
-                    dropped: droppedCount,
-                    ts: Date.now(),
-                }));
-            }
-            trimmed = applyGitFrameGuard({
-                before: edited,
-                trimmed,
-                budgetTokens: guardAt,
-                ref: gitStatusRef,
-                charsPerToken,
-                onDegrade: (message) => {
+            const pendingProjectionObservations = [];
+            try {
+                const healed = dropEmptyFailureAssistants(messages);
+                const replay = replayClearedProjection(healed, microCompact.ledger);
+                const replayed = replay.messages;
+                const capped = await capAggregateToolResults(replayed, {
+                    store: offloadStore,
+                    sessionId,
+                    onCapped: (info) => pendingProjectionObservations.push(() => emitTrace(deps.tracer, () => ({
+                        kind: "tool_result.capped",
+                        version: 1,
+                        taskId: spec.taskId ?? sessionId,
+                        ...(info.tool !== undefined ? { tool: info.tool } : {}),
+                        sizeChars: info.sizeChars,
+                        storeFallback: info.storeFallback,
+                        ts: Date.now(),
+                    }))),
+                });
+                const mediaCapped = capAggregateMediaBytes(capped, {
+                    limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
+                    onStripped: (info) => {
+                        const onMediaStripped = deps.onMediaStripped;
+                        if (onMediaStripped !== undefined)
+                            pendingProjectionObservations.push(() => onMediaStripped(info));
+                    },
+                });
+                let ccPass;
+                const edited = microCompact.machine === "off" ? mediaCapped : clearStaleToolResults(mediaCapped, {
+                    budgetTokens: editAt,
+                    machine: microCompact.machine,
+                    ...(microCompact.machine === "cc" || microCompact.clearOnRejection ? { recognizeCcMarkers: true } : {}),
+                    ...(microCompact.machine === "cc"
+                        ? {
+                            clearSource: replayed,
+                            onCleared: (pass) => { ccPass = pass; },
+                        }
+                        : {}),
+                    anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
+                    charsPerToken,
+                    ...(offloadStore
+                        ? {
+                            offload: {
+                                persist: createOffloadPersist(offloadStore, sessionId, deps.onNotice),
+                            },
+                        }
+                        : {}),
+                });
+                if (ccPass !== undefined) {
+                    recordFrontierClears({ pass: ccPass, index: replay.index, edited, ledger: microCompact.ledger, tracer: deps.tracer, taskId: spec.taskId ?? sessionId, trigger: "frontier" });
+                }
+                const chain = await runGuardChain({
+                    edited, replayed, index: replay.index, microCompact, guardAt, charsPerToken, offloadStore,
+                    sessionId, taskId: spec.taskId ?? sessionId, deps, trimPressureRef, recheck, signal,
+                    pendingProjectionObservations,
+                });
+                if ("earlyReturn" in chain) {
+                    return chain.earlyReturn;
+                }
+                const { working, trimDroppedMessages } = chain;
+                let trimmed = chain.trimmed;
+                trimmed = applyGitFrameGuard({
+                    before: working,
+                    trimmed,
+                    budgetTokens: guardAt,
+                    ref: gitStatusRef,
+                    charsPerToken,
+                    onDegrade: (message) => {
+                        try {
+                            deps.onError?.(new Error(message), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
+                        }
+                        catch {
+                        }
+                    },
+                });
+                const swept = dropOrphanToolResults(trimmed);
+                if (swept.dropped.length > 0) {
                     try {
-                        deps.onError?.(new Error(message), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
+                        deps.onError?.(new Error(`context belt: dropped ${swept.dropped.length} orphan toolResult(s) whose tool-call assistant was not in the request view — ` +
+                            swept.dropped
+                                .map((d) => `toolCallId=${d.toolCallId} at index ${d.index} (prev=${d.prevRole}, next=${d.nextRole})`)
+                                .join("; ")), { phase: "hook", sessionId });
                     }
                     catch {
                     }
-                },
-            });
-            const swept = dropOrphanToolResults(trimmed);
-            if (swept.dropped.length > 0) {
-                try {
-                    deps.onError?.(new Error(`context belt: dropped ${swept.dropped.length} orphan toolResult(s) whose tool-call assistant was not in the request view — ` +
-                        swept.dropped
-                            .map((d) => `toolCallId=${d.toolCallId} at index ${d.index} (prev=${d.prevRole}, next=${d.nextRole})`)
-                            .join("; ")), { phase: "hook", sessionId });
-                }
-                catch {
                 }
+                requestLossyRef.current =
+                    replayed !== healed ||
+                        capped !== replayed ||
+                        mediaCapped !== capped ||
+                        edited !== mediaCapped ||
+                        working !== edited ||
+                        trimDroppedMessages ||
+                        swept.dropped.length > 0 ||
+                        gitStatusRef.overBudgetShrunk === true;
+                microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
+                return { messages: swept.messages };
+            }
+            finally {
+                flushProjectionObservations(pendingProjectionObservations);
             }
-            requestLossyRef.current =
-                replayed !== healed ||
-                    capped !== replayed ||
-                    mediaCapped !== capped ||
-                    edited !== mediaCapped ||
-                    trimDroppedMessages ||
-                    swept.dropped.length > 0 ||
-                    gitStatusRef.overBudgetShrunk === true;
-            microCompact.projectionRef.current = { messages: swept.messages, keyOf: replay.index.keyOf };
-            return { messages: swept.messages };
         });
         const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
         const cacheFingerprint = cacheBreakDetector

package/dist/core/runner/prepare-workspace-restore.js

@@ -49,6 +49,16 @@ export async function prepareWorkspaceRestore(input) {
             throw e;
         };
         const handle = resume.workspaceHandle;
+        const refuseIdentityMismatch = (resumedHandle) => {
+            if (resumedHandle.provider !== handle.provider) {
+                failResume(`resume workspace identity mismatch: the checkpoint records provider "${handle.provider}" but the resumed env reports "${resumedHandle.provider}" — refusing to continue a workspace on a different backend (wire the factory to rebuild the checkpointed lane and re-resume)`);
+            }
+            if (handle.deviceId !== undefined && resumedHandle.deviceId !== handle.deviceId) {
+                failResume(resumedHandle.deviceId === undefined
+                    ? `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports none — a device-bound workspace cannot be verified on a handle that does not state its device (absence is not a match)`
+                    : `resume workspace identity mismatch: the checkpoint records deviceId "${handle.deviceId}" but the resumed env reports "${resumedHandle.deviceId}" — refusing to continue on a different physical device`);
+            }
+        };
         if (ownedEnv === undefined || !isRemoteExecutionEnv(ownedEnv)) {
             failResume("resume needs a RemoteExecutionEnv from executionEnvFactory to restore the workspace snapshot");
         }
@@ -56,6 +66,7 @@ export async function prepareWorkspaceRestore(input) {
             if (handle.restoreMode !== "park_only" && ownedEnv.capabilities.suspendable) {
                 failResume("checkpoint workspaceHandle has no snapshotId and is not a park_only handle, but the resumed env is suspendable — refusing to resume on a possibly-unrestored workspace (corrupt checkpoint?)");
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             if (handle.mountPath && handle.mountPath !== taskRootPath) {
                 taskRootPath = handle.mountPath;
             }
@@ -68,6 +79,7 @@ export async function prepareWorkspaceRestore(input) {
             if (missingHere.length > 0) {
                 failResume(`the resumed execution env cannot restore a workspace snapshot: its adapter does not implement ${missingHere.join(" or ")}. The checkpoint holds snapshot "${handle.snapshotId}" — wire an adapter that implements the full RemoteExecutionEnv restore surface and re-resume.`);
             }
+            refuseIdentityMismatch(ownedEnv.workspaceHandle());
             const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
                 abortSignal: restoreSignal,
                 priorHandle: handle,
@@ -76,6 +88,7 @@ export async function prepareWorkspaceRestore(input) {
                 failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));
             }
             else {
+                refuseIdentityMismatch(restored.value);
                 const restoredEnv = ownedEnv;
                 const canonicalInEnv = async (p) => {
                     try {