@sema-agent/core 7.4.0 → 7.5.1

package/dist/core/runner/prepare-task.js

@@ -1,75 +1,78 @@
 import { createHash, randomBytes } from "node:crypto";
 import { realpathSync } from "node:fs";
 import { resolve as resolveFsPath } from "node:path";
-import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, isSyntheticApiErrorMessage, readCompactionActiveTools, summaryOutputBudgetTokens } from "../../internal/harness.js";
+import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, estimateContextTokens, summaryOutputBudgetTokens } from "../../internal/harness.js";
 const PROMPT_HASH_SALT = randomBytes(16);
 import { sanitizeCompactionSettings } from "../auto-compaction.js";
 import { projectStaleToolResults, resolveStaleToolResultOffload } from "./compaction-call-options.js";
-import { createAutoModeDecider, createAutoModeDenialTracker } from "../auto-mode.js";
-import { attachRebuiltDenialTrackers, createDenialLimitStop, headlessDenyAtFold, headlessDenyAtRecheck, judgeInheritedClassifier, settleDenialLimitFallback } from "./denial-limit-arms.js";
-import { autoModeArmingRecipeOf } from "../auto-mode-arming.js";
-import { buildAutoModePrompt, renderAutoModeAction, renderAutoModeWindow } from "../auto-mode-prompt.js";
-import { resolveTaskModel } from "../roles.js";
+import { gateAskCarry, inheritedAskCarry, headlessDenyAtFold, headlessDenyAtRecheck, judgeInheritedClassifier, settleDenialLimitFallback } from "./denial-limit-arms.js";
 import { primaryActivityArg } from "../arg-summary.js";
-import { materializeMcpTools } from "../mcp.js";
-import { materializeA2aTools } from "../a2a.js";
-import { Type } from "typebox";
 import { Value } from "typebox/value";
 import { uuidv7 } from "../../engine/session/uuid.js";
 import { brainToRuntime } from "../runtime.js";
 import { hasSessionFork } from "../session.js";
-import { createSubagentWorktreeHelper, forkGovernanceDenial, resolveDelegationEntryCaps } from "../../agents/subagent.js";
-import { createAgentTranscriptTool, AGENT_TRANSCRIPT_TOOL_NAME } from "../../agents/agent-transcript-tool.js";
-import { createSendMessageTool, SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
-import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
-import { askApproverIdentity, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOfLayer, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
-const PERSISTED_RULE_TOOL = "Bash";
-const DIRECTORY_RULE_TOOL = "Read";
-import { directoryRuleAdmits, eligiblePersisted, findAdmittingRule, lexicalNormalAbsolutePathOf, segmentCoverageOf, suggestRulesForCommand } from "../permission-rule-model.js";
-import { normalizePersistedRule } from "../permission-rule-store.js";
-import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
-import { CHANGED_FILES_MTIME_EPS_MS, fenceMcpServerInstructions, renderAgentListingDelta } from "./turn-attachments.js";
+import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
+import { askApproverIdentity, isLiveApproverSeat, carriesBidiControls, checkToolPolicyProjection, combinePolicies, constraintChainDigest, constraintChainEntryOfLayer, isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, describeThrown, refuseOutOfContractDecision, resolveAsk, toolPolicyNameSets, tryCloneArgs } from "../tool-policy.js";
+import { suggestRulesForCommand } from "../permission-rule-model.js";
+import { PERSISTED_RULE_TOOL, inheritedAskRuleEvidence, createPermissionRuleLanes } from "./prepare-permission-rules.js";
+import { createActiveSkillScopePolicy } from "./active-skill-scope.js";
+import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
 import { inlineUntrusted } from "../untrusted-text.js";
+import { loadAnnounceOnceLedger, serializeAnnouncedListings } from "./prepare-announce-once.js";
 import { isValidReminderMark, mintReminderMark, reminderMarkDeclaration } from "../reminder-mint.js";
 import { policyAskClassOf } from "../ask-class.js";
 import { emitTrace } from "../trace.js";
 import { createSessionRulePolicy, PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { cloneObserverInput, createHookEnvCapabilities, createPreToolUseConstraintPolicy, formatHookFeedback, mintHookInvocationIdentity, persistedRuleMandateOf, resolveHookTimeoutMs, runHookSeat, hookSeatExpiredError, runToolGate } from "../hooks.js";
+import { askCarryRowMembers, cloneObserverInput, formatHookFeedback, persistedRuleMandateOf, resolveHookTimeoutMs, runHookSeat, hookSeatExpiredError, runToolGate } from "../hooks.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
-import { orgRuleVerdictFor } from "../permission-rule-org.js";
 import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
 import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
-import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } from "../../brain/route-adjudicator.js";
 import { STALL_CONNECT_MS, STALL_FIRST_TOKEN_MS, STALL_IDLE_MS, withBrainCallGuardrail } from "../../brain/timeout.js";
-import { defineTool, isDefineToolProduct } from "../tools.js";
 import { RETIRED_TOOL_NAMES } from "../tool-name-aliases.js";
 import { protocolOf } from "../protocol-table.js";
 import { isNamespacedCoveringRuleName, namespacedRuleNameCovers } from "../permission-rules.js";
-import { pathToUri } from "../lsp-protocol.js";
-import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, createOffloadPersist, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, createReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
-import { OUTPUT_TOOL_NAME, REPORT_FINDINGS_TOOL_NAME, SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, createOutputTool, createReportBlockedTool, createReportFindingsTool, createSkillTool, normalizeSkills } from "./synthetic-tools.js";
+import { createOffloadPersist, InMemoryToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, } from "../tool-result-store.js";
+import { OUTPUT_TOOL_NAME, createOutputTool } from "./synthetic-tools.js";
 import { compileOutputSchema } from "./strict-output-schema.js";
-import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, createPlaceholderTool, createToolSearchTool, staticSchemaRenderable, } from "./tool-disclosure.js";
-import { createSharedMemoryTools } from "../shared-memory/tools.js";
-import { SHARED_MEMORY_TOOL_NAMES } from "../shared-memory/types.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
 import { classifyToolContentOrigin, contentOriginPollutes, delegationCallIsExternal } from "../memory-engine/content-origin.js";
 import { narrowContentSafety, readCardAttestation } from "../memory-engine/delegation-provenance.js";
 import { recordSyncUnattestable, sessionSettlements } from "../memory-engine/delegation-settlement.js";
-import { composeMemoryBlock } from "../memory.js";
-import { COMPLIANCE_CAPABILITIES, WEB_FETCH_TOOL_NAME, complianceCallDenial, resolveComplianceDenies } from "../compliance.js";
+import { complianceCallDenial } from "../compliance.js";
 import { foldAdmissionFreeze } from "../memory-admission.js";
 import { prepareMemory } from "./prepare-memory.js";
+import { prepareDeferClassify } from "./prepare-defer-classify.js";
+import { prepareListings } from "./prepare-listings.js";
+import { preparePromptInputs } from "./prepare-prompt-inputs.js";
+import { hasConversationContent, prepareProjectContext } from "./prepare-project-context.js";
 import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js";
 import { NAMESPACED_NAME_SHAPES, prepareSafetyScan } from "./prepare-safety-scan.js";
 import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
 import { prepareHandsMount, resolveHandsLessReadFace } from "./prepare-hands-readface.js";
-import { createEditedFilesLedger } from "./edited-files-ledger.js";
 import { prepareWorkspaceRestore, remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./prepare-workspace-restore.js";
-import { defaultPromptProvider, buildEnvironmentContext, formatLocalDate, isValidTimeZone, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
-import { applyGitFrameGuard, probeGitStatusLane } from "./git-status-frame.js";
+import { prepareOffloadWrappers } from "./prepare-offload-wrappers.js";
+import { prepareFileHistory } from "./prepare-file-history.js";
+import { prepareExecutionEnv } from "./prepare-execution-env.js";
+import { prepareRunRefs } from "./prepare-run-refs.js";
+import { prepareInheritedGate } from "./prepare-inherited-gate.js";
+import { prepareCapsAndWorkflow } from "./prepare-caps-and-workflow.js";
+import { prepareDelegationSurface } from "./prepare-delegation-surface.js";
+import { prepareToolDisclosureMount } from "./prepare-tool-disclosure-mount.js";
+import { prepareWiringManifest } from "./prepare-wiring-manifest.js";
+import { checkpointScopeOf } from "./checkpoint-scope.js";
+export { DEFAULT_IRREVERSIBLE_SCOPE, checkpointScopeOf } from "./checkpoint-scope.js";
+export { mcpManifestEntries } from "./prepare-wiring-manifest.js";
+import { derivedRouteFallsBack } from "./derived-route-fallback.js";
+import { prepareProtocolTools } from "./prepare-protocol-tools.js";
+import { CONTENT_ASK_BINDING_CAP, prepareQuestionFace } from "./prepare-question-face.js";
+import { prepareLsp } from "./prepare-lsp.js";
+import { createRollbackStack } from "./rollback-stack.js";
+export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
+export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
+import { defaultPromptProvider, buildEnvironmentContext } from "../../prompts/default.js";
+import { applyGitFrameGuard } from "./git-status-frame.js";
 import { assemblePrompt } from "../../prompt-assembly/assemble.js";
-import { auditToolCollisions, getToolContract, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
+import { auditToolCollisions, projectToolManifest } from "../../prompt-assembly/tool-catalog.js";
 import { resolveEpochAgainstBundled } from "../../prompt-assembly/epoch.js";
 import { artifactDeclarations } from "../../prompt-assembly/artifact.js";
 import { buildTurnPromptSnapshot } from "../../prompt-assembly/turn-snapshot.js";
@@ -78,56 +81,22 @@ import { clearStaleToolResults, createClearedProjectionLedger, dropEmptyFailureA
 import { capAggregateToolResults } from "../tool-result-budget.js";
 import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
 import { dropOrphanToolResults, guardBudget, insertTrimNotice, trimToBudget } from "../context-guard.js";
-import { StubExecutionEnv } from "../stub-env.js";
-import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable, missingRestoreSurface, RemoteExecutionError } from "../remote-env.js";
+import { isIsolated, isRemoteExecutionEnv, isSuspendable, RemoteExecutionError } from "../remote-env.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
-import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
-import { createMonitorTool } from "../../tools/monitor.js";
-import { createWorktreeTools } from "../../tools/worktree.js";
-import { announcePeerLaneMount, bindPeerLaneDrain, listAgentsMountable, mountListAgents, peerLaneSendMessageSeats } from "../../agents/peer-session-drain.js";
-import { CROSS_SESSION_CLASSIFIER_RULE } from "../../agents/cross-session-envelope.js";
-import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
-import { applyCompactionToReadFileState, isReadDedupStubResult, FULL_SHELL_CONTRACT_ID, HAND_TOOL_EFFECTS } from "../../tools/fs/index.js";
+import { defaultTaskRegistry } from "../task-registry.js";
+import { announcePeerLaneMount } from "../../agents/peer-session-drain.js";
+import { applyCompactionToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
 import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { ASK_USER_QUESTION_TOOL_NAME, createAskUserQuestionTool, classifyQuestionOutcome, isLiveQuestionFace, validateAskQuestions, } from "../ask-question.js";
+import { ASK_USER_QUESTION_TOOL_NAME, classifyQuestionOutcome, validateAskQuestions, } from "../ask-question.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
-import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
-import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
-import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
-import { resolveWorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
-import { createLspTool, gitCheckIgnoreFilter, resolveLspPath } from "../lsp.js";
+import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
+import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
 import { fileArgPath, resolveKey } from "../../tools/fs/safety.js";
 import { BINDING_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, RESOURCE_CHECKPOINT_VERSION, TOKEN_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, remainingBudgetMicroUsd, resolveCheckpointStore, resolveDeclaredFidelity, samePlainValue, } from "../checkpoint-store.js";
 import { boundInputHashOf } from "../canonical-json.js";
-import { countElicitOptIns, deriveWiringManifest, resolveAskSeamForm, resolveDeclaredDurability, resolveElicitSeam, resolveQuestionSeam, resolveSubagentTranscriptTier } from "../wiring-manifest.js";
 import { durableParkGapFor } from "../park-selfcheck.js";
-import { GLOBAL_USAGE_KEY, usageRetryAfterMs, windowsGovernCost } from "../usage-window-store.js";
 import { deliverEngineNotice } from "../types.js";
-import { resolveTrackKey } from "../file-history-store.js";
-let announcedMaterializeEnvBySink = new WeakMap();
-const announcedMaterializeEnvConsole = new Set();
-function materializeEnvLedger(onNotice) {
-    if (typeof onNotice !== "function")
-        return announcedMaterializeEnvConsole;
-    let lines = announcedMaterializeEnvBySink.get(onNotice);
-    if (lines === undefined) {
-        lines = new Set();
-        announcedMaterializeEnvBySink.set(onNotice, lines);
-    }
-    return lines;
-}
-export function __resetMaterializeEnvAnnouncements() {
-    announcedMaterializeEnvBySink = new WeakMap();
-    announcedMaterializeEnvConsole.clear();
-}
-function emitMaterializeEnvNotice(onNotice, message, detail) {
-    const ledger = materializeEnvLedger(onNotice);
-    if (ledger.has(message))
-        return;
-    ledger.add(message);
-    deliverEngineNotice(onNotice, { code: "config.materialize_env_discarded", message, detail });
-}
 function warnCompactionWindowHazard(tracer, spec, model, compModel, hostTaskId) {
     if (compModel === undefined)
         return;
@@ -247,65 +216,9 @@ function announceDeclaredMcpContentClasses(args) {
 }
 export { __resetReadFaceClampAnnouncement } from "./prepare-hands-readface.js";
 const DEFAULT_MAX_SUSPENDS = 5;
-const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
 const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 export const ENV_LIFETIME_SUSPEND_MARGIN_MS = 60_000;
 export const USAGE_WINDOW_REAP_MARGIN_MS = 60 * 60 * 1000;
-function buildUsageGovernance(windows, deps, principal, sessionId) {
-    if (windows === undefined || windows.length === 0)
-        return undefined;
-    const store = deps.usageWindowStore;
-    if (store === undefined) {
-        deps.onError?.(new Error("RunnerDeps.usageWindows is set but INACTIVE: no `usageWindowStore` is wired, so cross-task usage cannot be counted and no window can be enforced. Wire InMemoryUsageWindowStore (process-local) or FileUsageWindowStore (restart-surviving)."), { phase: "config", sessionId });
-        return undefined;
-    }
-    const key = principal || GLOBAL_USAGE_KEY;
-    const governsCost = windowsGovernCost(windows);
-    let chargedTokens = 0;
-    let chargedCostMicroUsd = 0;
-    let announcedCostGap = false;
-    let recordedUnpricedGap = false;
-    return {
-        key,
-        governsCost,
-        async check(now) {
-            const readings = await store.read(key, windows, now);
-            if (!announcedCostGap && readings.some((r) => r.costUnknown === true)) {
-                announcedCostGap = true;
-                deps.onError?.(new Error(`the usage window for ledger key ${JSON.stringify(key)} holds spend that nothing could price, so its maxCostUsd ceiling is being evaluated against a LOWER BOUND until that charge ages out of the window. Price every model this deployment can reach (including degrade targets and the compaction model).`), { phase: "config", sessionId });
-            }
-            return usageRetryAfterMs(readings, windows);
-        },
-        async commit(cumulativeTokens, cumulativeCostMicroUsd, now) {
-            if (!governsCost) {
-                const delta = cumulativeTokens - chargedTokens;
-                if (delta <= 0)
-                    return;
-                await store.charge(key, delta, now, windows);
-                chargedTokens = cumulativeTokens;
-                return;
-            }
-            if (cumulativeCostMicroUsd === undefined) {
-                const tokenDelta = cumulativeTokens - chargedTokens;
-                if (tokenDelta > 0 || !recordedUnpricedGap) {
-                    await store.charge(key, Math.max(0, tokenDelta), now, windows, null);
-                    chargedTokens = Math.max(chargedTokens, cumulativeTokens);
-                    recordedUnpricedGap = true;
-                }
-                const e = new Error("a deployment usage window declares maxCostUsd, but this run's spend has NO cost figure (RB-368 unpriced: a model served without a RunnerDeps.pricing entry or a Model.cost declaration). Refused rather than charged a fabricated 0 — the money ceiling would have silently stopped applying. Price every model this run can reach, or drop maxCostUsd from the window.");
-                e.code = "config.usage_window_unpriced";
-                throw e;
-            }
-            const tokenDelta = cumulativeTokens - chargedTokens;
-            const costDelta = cumulativeCostMicroUsd - chargedCostMicroUsd;
-            if (tokenDelta <= 0 && costDelta <= 0)
-                return;
-            await store.charge(key, Math.max(0, tokenDelta), now, windows, Math.max(0, costDelta));
-            chargedTokens = cumulativeTokens;
-            chargedCostMicroUsd = cumulativeCostMicroUsd;
-        },
-    };
-}
 export function resolveEnvLifetimeExpiry(env, observedAt) {
     const lifetimeMs = env.lifetimeMs;
     if (lifetimeMs === undefined)
@@ -322,22 +235,14 @@ export function resolveEnvLifetimeExpiry(env, observedAt) {
         return { unanchored: true };
     return { expiresAt: anchor + lifetimeMs };
 }
-function isLiveApproverSeat(onAsk) {
-    return typeof onAsk === "function";
-}
 const DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 function sanitizedTtlMs(ttlMs) {
     if (ttlMs === undefined)
         return undefined;
     return Number.isFinite(ttlMs) && ttlMs > 0 ? ttlMs : DEFAULT_RESOURCE_TTL_MS;
 }
-const ungatedWarnedShapes = new WeakMap();
 const advisedPolicyNames = new WeakMap();
 const ADVISED_KEYS_CAP = 64;
-export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
-export function checkpointScopeOf(spec) {
-    return spec.durableApproval?.scope || spec.principal || DEFAULT_IRREVERSIBLE_SCOPE;
-}
 class ParkRefusal extends Error {
     constructor(message, options) {
         super(message, options);
@@ -346,7 +251,7 @@ class ParkRefusal extends Error {
 }
 export { resolveCheckpointStore } from "../checkpoint-store.js";
 export { isFableFamilyModelId, resolveAttachmentsConfig, resolveModelPromptTraits, resolveTaskLimits } from "./prepare-config-doors.js";
-export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./prepare-workspace-restore.js";
+export { rebaseWorkspacePath, rebaseWorkspacePathAcross } from "./workspace-path.js";
 function buildMicroCompactState(deps, model, sessionId, runId, offloadStore, knob) {
     const triggerWindow = resolveTriggerWindow(model);
     if (triggerWindow.clamped) {
@@ -457,226 +362,6 @@ export async function runGuardChain(args) {
     const t = applyGuardTrim(working, anchoredWorking);
     return { working, trimmed: t.trimmed, trimDroppedMessages: t.dropped };
 }
-function restoredAbsPathsOf(restored, root) {
-    const out = [];
-    for (const key of [...restored.filesChanged, ...restored.failed.map((f) => f.path)]) {
-        const abs = resolveTrackKey(root, key);
-        if (abs.ok)
-            out.push(abs.abs);
-    }
-    return out;
-}
-function resolveWiredFileHistoryStore(candidate) {
-    if (candidate === undefined)
-        return undefined;
-    const verbs = ["trackEdit", "annulTrack", "snapshot", "restore", "canRestore", "reap", "adoptScope"];
-    const verbOf = (v) => {
-        try {
-            return candidate[v];
-        }
-        catch {
-            return undefined;
-        }
-    };
-    const probeable = (typeof candidate === "object" && candidate !== null) || typeof candidate === "function";
-    const missing = probeable ? verbs.filter((v) => typeof verbOf(v) !== "function") : [...verbs];
-    if (missing.length > 0) {
-        const shape = candidate === null ? "null" : probeable ? "a value that is not a FileHistoryStore" : `a ${typeof candidate}`;
-        const e = new Error(`RunnerDeps.fileHistoryStore was wired with ${shape} — missing contract verbs: ${missing.join(", ")}. Refusing prepare rather than half-wiring the rewind seat (a present-but-unusable store makes every Edit/Write/NotebookEdit fail its first-touch backup while restore requests report "no store wired"). Omit the key to run without file history.`);
-        e.code = "config.invalid_file_history_store";
-        throw e;
-    }
-    return candidate;
-}
-const LEGACY_PROBE_TIMEOUT_MS = 2_000;
-const LEGACY_PROBE_TIMED_OUT = Symbol("legacy-rewind-probe-timeout");
-async function legacyRewindEpochTail(deps, sessionId, entryId, form) {
-    const probe = deps.legacyRewindBoundaryProbe;
-    let verdict;
-    if (probe !== undefined) {
-        try {
-            let timer;
-            const timeout = new Promise((resolve) => {
-                timer = setTimeout(() => resolve(LEGACY_PROBE_TIMED_OUT), LEGACY_PROBE_TIMEOUT_MS);
-            });
-            try {
-                verdict = await Promise.race([Promise.resolve(probe({ sessionId, entryId })), timeout]);
-            }
-            finally {
-                clearTimeout(timer);
-            }
-            if (verdict === LEGACY_PROBE_TIMED_OUT) {
-                verdict = undefined;
-                try {
-                    deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe did not answer within ${LEGACY_PROBE_TIMEOUT_MS}ms while explaining a rewind refusal — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-                }
-                catch {
-                }
-            }
-        }
-        catch (err) {
-            verdict = undefined;
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe threw while explaining a rewind refusal (${err.message}) — the refusal stands and names both possibilities`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-        }
-        if (verdict !== undefined && typeof verdict !== "boolean") {
-            try {
-                deps.onError?.(new Error(`RunnerDeps.legacyRewindBoundaryProbe answered ${JSON.stringify(String(verdict))} for entry "${entryId}" — only true/false/undefined are meaningful, so the refusal names both possibilities instead of trusting it`), { phase: "rewind", sessionId });
-            }
-            catch {
-            }
-            verdict = undefined;
-        }
-    }
-    if (verdict === true) {
-        return `This deployment's legacy-epoch probe reports that entry "${entryId}" DOES carry a boundary from the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore — the two epochs are not interchangeable (a whole-tree manifest carries no tracked-set provenance, so replaying it here would converge files this session never edited). Restore it with the whole-tree-era tooling this deployment kept, or re-run the turns under the current engine.`;
-    }
-    if (verdict === false) {
-        return `This deployment's legacy-epoch probe reports no whole-tree-era boundary for entry "${entryId}" either, so the boundary simply does not exist: its turns ran without a RunnerDeps.fileHistoryStore wired, or it was reaped.`;
-    }
-    return form === "keyed"
-        ? `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that ran with a RunnerDeps.fileHistoryStore wired; a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`
-        : `Either the boundary does not exist (its turns ran without a RunnerDeps.fileHistoryStore, or it was reaped), or it was produced in the retired whole-tree snapshot era, which this engine's per-edited-file seat does not restore.`;
-}
-const FILE_HISTORY_BOUNDARY_TIMEOUT_MS = 30_000;
-const FILE_HISTORY_CARRY_MEMO = new WeakMap();
-async function adoptForkedFileHistory(store, session, sessionId, onError) {
-    const memo = FILE_HISTORY_CARRY_MEMO.get(store) ?? { settled: new Set(), disclosed: new Set(), inFlight: new Map() };
-    FILE_HISTORY_CARRY_MEMO.set(store, memo);
-    const discloseOnce = (err) => {
-        if (memo.disclosed.has(sessionId))
-            return;
-        memo.disclosed.add(sessionId);
-        onError?.(err, { phase: "rewind", sessionId });
-    };
-    try {
-        if (memo.settled.has(sessionId))
-            return;
-        const forkedFrom = (await session.getMetadata()).forkedFrom;
-        if (forkedFrom === undefined || forkedFrom === sessionId)
-            return;
-        const shared = memo.inFlight.get(sessionId);
-        if (shared !== undefined)
-            return await shared;
-        if (memo.settled.has(sessionId))
-            return;
-        const attempt = store.adoptScope(forkedFrom, sessionId).then((carried) => {
-            if (carried.ok || carried.error.code === "conflict") {
-                memo.settled.add(sessionId);
-                return;
-            }
-            discloseOnce(new Error(`file-history fork carry from session "${forkedFrom}" failed (${carried.error.code}): ${carried.error.message} — this forked session starts with an EMPTY rewind history, so boundaries recorded before the fork are not restorable from it (the run itself proceeds; the carry is retried on this session's next turn while its scope is still empty)`));
-        }, (err) => discloseOnce(err));
-        memo.inFlight.set(sessionId, attempt);
-        try {
-            await attempt;
-        }
-        finally {
-            memo.inFlight.delete(sessionId);
-        }
-    }
-    catch (err) {
-        try {
-            discloseOnce(err);
-        }
-        catch {
-        }
-    }
-}
-function createFileHistoryBoundarySeat(opts) {
-    let inFlight;
-    let begun = false;
-    return {
-        begin(entryId) {
-            if (begun)
-                return;
-            begun = true;
-            const ac = new AbortController();
-            let timer;
-            const timeout = new Promise((resolve) => {
-                timer = setTimeout(() => {
-                    ac.abort();
-                    resolve({ ok: false });
-                }, FILE_HISTORY_BOUNDARY_TIMEOUT_MS);
-            });
-            let work;
-            try {
-                work = opts.store.snapshot(opts.sessionId, entryId, opts.env, opts.root, ac.signal);
-            }
-            catch (err) {
-                work = Promise.resolve({ ok: false, error: { code: "snapshot_failed", message: `history store threw synchronously: ${err.message}` } });
-            }
-            work.catch(() => { });
-            inFlight = Promise.race([
-                work.then((r) => (r.ok ? undefined : `boundary capture failed (${r.error.code}): ${r.error.message}`)),
-                timeout.then(() => `boundary capture timed out after ${FILE_HISTORY_BOUNDARY_TIMEOUT_MS / 1000}s (fenced — the attempt can never publish)`),
-            ])
-                .then((failure) => {
-                if (failure !== undefined) {
-                    try {
-                        opts.onError?.(new Error(`file-history ${failure} — this turn has no boundary and cannot be rewound to (the turn itself proceeds)`), { phase: "rewind", sessionId: opts.sessionId });
-                    }
-                    catch {
-                    }
-                }
-            })
-                .catch((err) => {
-                try {
-                    opts.onError?.(err, { phase: "rewind", sessionId: opts.sessionId });
-                }
-                catch {
-                }
-            })
-                .finally(() => clearTimeout(timer));
-        },
-        async settle() {
-            if (inFlight !== undefined)
-                await inFlight;
-        },
-    };
-}
-async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
-    if (!enabled)
-        return { historyRoot: taskRoot, historyScope: sessionId, historyFs: "" };
-    const canonRoot = await env.canonicalPath(taskRoot);
-    const historyRoot = canonRoot.ok ? canonRoot.value : taskRoot;
-    const historyFs = fileHistoryFilesystemIdentity(env);
-    return { historyRoot, historyScope: resolveFileHistoryScope(lineage, historyRoot, historyFs, sessionId), historyFs };
-}
-export function resolveFileHistoryScope(lineage, historyRoot, historyFs, sessionId) {
-    if (lineage === undefined || lineage.scope === "" || lineage.root !== historyRoot || lineage.fs !== historyFs)
-        return sessionId;
-    return lineage.scope;
-}
-const envFilesystemTokens = new WeakMap();
-let envFilesystemSeq = 0;
-export function fileHistoryFilesystemIdentity(env) {
-    if (isRemoteExecutionEnv(env)) {
-        try {
-            const h = env.workspaceHandle();
-            return JSON.stringify(["remote", h.provider, h.sandboxId, h.deviceId !== undefined && h.deviceId !== "" ? h.deviceId : null]);
-        }
-        catch {
-        }
-    }
-    else if (env.hostLocalPaths === true || (env.hostLocalPaths === undefined && env instanceof NodeExecutionEnv)) {
-        return "host";
-    }
-    let token = envFilesystemTokens.get(env);
-    if (token === undefined) {
-        token = `instance:${++envFilesystemSeq}`;
-        envFilesystemTokens.set(env, token);
-    }
-    return token;
-}
-function childScopeRewindRefusal(rootScope, target) {
-    const e = new Error(`rewind-files: this run is a delegated child recording its edits into the ROOT session "${rootScope}"'s file history, so restoring files to entry "${target}" is the root session's action (rewindFilesTo / resumeAt+restoreFiles on that session), not the child's — the files were NOT rewound`);
-    e.code = "rewind.child_scope_unsupported";
-    return e;
-}
 export function gatedCallIdOf(p) {
     if (p.suspendRef.token !== undefined)
         return p.suspendRef.gatedCallId;
@@ -701,9 +386,6 @@ function publishCommittedSuspend(refs, token, gate, scope, remoteHandle, checkpo
         ref.restoreMode = remoteHandle.restoreMode === "park_only" ? "park_only" : "snapshot";
     ref.scope = scope;
 }
-function hasConversationContent(branch) {
-    return branch.some((e) => e.type === "message" || e.type === "custom_message" || e.type === "compaction");
-}
 export function effectiveDelegationFacts(internals, seedIsDelegatedChild) {
     const isDelegatedChild = internals?.isDelegatedChild !== undefined ? internals.isDelegatedChild === true : seedIsDelegatedChild === true;
     return { isDelegatedChild, isNonForkChild: isDelegatedChild && internals?.insideFork !== true };
@@ -890,19 +572,6 @@ function createDenyObserverNotifier(hooks, hookTimeoutMs, signal, report) {
         }
     };
 }
-function mcpRevocationWiring(deps, runId) {
-    if (deps.mcpRevocations === undefined)
-        return undefined;
-    const ledger = deps.mcpRevocations;
-    return {
-        isRevoked: (name) => ledger.isRevoked(name),
-        onProbeFailure: (e) => deliverEngineNotice(deps.onNotice, {
-            code: "mcp.revocation_probe_failed",
-            message: `the mcpRevocations.isRevoked probe threw — MCP dispatch fails OPEN (no server treated as revoked) until the probe recovers: ${e instanceof Error ? e.message : String(e)}`,
-            detail: { message: e instanceof Error ? e.message : String(e), runId },
-        }),
-    };
-}
 async function forgetQuietly(sessions, sessionId) {
     try {
         if (sessions.forget)
@@ -937,12 +606,21 @@ function screenGateSettlement(result, settling) {
         else
             resolution = reportedResolution;
     }
+    const reportedAutoDenied = result.autoDenied;
+    let autoDenied;
+    if (reportedAutoDenied === true) {
+        if (!settling)
+            defects.push("a tool-gate settlement reported autoDenied on an executing call — only a BLOCKED call can carry the marker; the frame carries none");
+        else
+            autoDenied = true;
+    }
     const record = {
         ...(settledBy !== undefined ? { settledBy } : {}),
         ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
         ...(resolution !== undefined ? { resolution } : {}),
+        ...(autoDenied !== undefined ? { autoDenied } : {}),
     };
-    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined ? { record } : {}), defects };
+    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined || autoDenied !== undefined ? { record } : {}), defects };
 }
 function maybeHumanRejectionHalt(input) {
     if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
@@ -995,37 +673,6 @@ function resolveApprovalPreview(tools, toolName, args) {
         return { withheld: "unavailable" };
     }
 }
-function inheritedAskRuleEvidence(deps) {
-    const org = deps.permissionRuleOrg === undefined ? "not_wired" : "not_adjudicated";
-    const personal = deps.permissionRuleStore === undefined ? "not_wired" : "not_adjudicated";
-    return Object.freeze({ orgRevisionAbsent: org, orgRuleAbsent: org, personalRuleDotsAbsent: personal });
-}
-function orgRevisionEvidenceOf(resolution, onDefect) {
-    const reported = resolution.revision;
-    if (reported === undefined)
-        return {};
-    if (typeof reported === "number" && Number.isFinite(reported))
-        return { revision: reported };
-    onDefect(`the org rule overlay reported revision ${JSON.stringify(reported)} — a snapshot revision is a finite number; ` +
-        `the adjudication stands, but the ask carries no revision evidence for this call`);
-    return {};
-}
-function persistedRuleHitOf(admitting) {
-    return admitting === undefined
-        ? undefined
-        : { rules: admitting.map((r) => ({ rule: r.rule, dots: r.adds.map((a) => ({ actor: a.dot.actor, counter: a.dot.counter })) })) };
-}
-function directoryRuleLaneAnswer(table, args, ctx) {
-    const filePath = args?.file_path;
-    if (typeof filePath !== "string" || filePath === "")
-        return undefined;
-    const spelled = filePath.startsWith("/") ? filePath : `${(ctx.liveCwd ?? ctx.root ?? "").replace(/\/+$/, "")}/${filePath}`;
-    const target = lexicalNormalAbsolutePathOf(spelled);
-    if (target === undefined)
-        return undefined;
-    const hit = table.find((r) => eligiblePersisted(r, { tool: DIRECTORY_RULE_TOOL, cwd: ctx.root, sessionId: ctx.sessionId }) && directoryRuleAdmits(r, target));
-    return hit !== undefined ? persistedRuleHitOf([hit]) : undefined;
-}
 function makeRuleOffersOf(cfg) {
     return (toolName, args, ask) => {
         if (!cfg.laneArmed || toolName !== PERSISTED_RULE_TOOL)
@@ -1071,38 +718,6 @@ function makeRuleOffersOf(cfg) {
             : { ruleOffersAbsence: "lane_cannot_speak" };
     };
 }
-function makeOrgAdjudicationLane(overlay, questionToolMounted, onRevisionDefect) {
-    if (overlay === undefined)
-        return undefined;
-    return {
-        adjudicate: async (req) => {
-            if (req.toolName === ASK_USER_QUESTION_TOOL_NAME && questionToolMounted)
-                return { status: "available" };
-            let resolution;
-            try {
-                resolution = await overlay.resolve();
-            }
-            catch (err) {
-                return { status: "unavailable", disclosures: [`the org rule overlay threw: ${err instanceof Error ? err.message : String(err)}`] };
-            }
-            if (resolution.status === "unavailable")
-                return { status: "unavailable", disclosures: resolution.disclosures };
-            const revisionCell = orgRevisionEvidenceOf(resolution, onRevisionDefect);
-            const command = req.args?.command;
-            if (req.toolName !== PERSISTED_RULE_TOOL || typeof command !== "string")
-                return { status: "available", ...revisionCell };
-            const verdict = orgRuleVerdictFor(resolution.rules, { tool: req.toolName, command });
-            return verdict === undefined ? { status: "available", ...revisionCell } : { status: "available", verdict, ...revisionCell };
-        },
-    };
-}
-function cwdConflictsRestoreError(requestedCwd) {
-    const e = new Error(`RunInternals.requestedCwd ("${requestedCwd}") cannot be combined with a checkpoint workspace restore — ` +
-        `the restored workspace's own mount path is authoritative for the task root, so a requested cwd on this leg ` +
-        `would be ignored (or worse, probed against an unrestored environment). Drop requestedCwd on resume legs.`);
-    e.code = "config.cwd_conflicts_restore";
-    return e;
-}
 async function adoptReminderMark(session, sessionId, seedMark, spawnMark, onError) {
     const sessionReminderMark = await (async () => {
         try {
@@ -1130,28 +745,6 @@ async function adoptReminderMark(session, sessionId, seedMark, spawnMark, onErro
     }
     return { reminderMark, reminderDisclosureCounts: {} };
 }
-async function derivedRouteFallsBack(args) {
-    try {
-        if (sameRouteIdentity(args.derived, args.primary))
-            return false;
-        const verdict = await adjudicateDerivedRoute({ brain: args.brain, model: args.derived, getApiKeyAndHeaders: args.getApiKeyAndHeaders });
-        if (verdict === undefined || verdict.ok)
-            return false;
-        deliverEngineNotice(args.onNotice, fallbackToPrimaryNotice({ seat: args.seat, from: args.derived.id, to: args.primary.id, verdict, ...(args.sessionId !== undefined ? { sessionId: args.sessionId } : {}), ...(args.runId !== undefined ? { runId: args.runId } : {}) }));
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function mintPlacementRootSessionId(placementRootResolved) {
-    if (placementRootResolved === "") {
-        const e = new Error("placement root resolved EMPTY (internals.placementRoot / internals.rootSessionId carries an empty string) — an empty fixed point cannot key a placement lookup; fix the spawning lane instead of defaulting around it.");
-        e.code = "config.placement_root_invalid";
-        throw e;
-    }
-    return placementRootResolved;
-}
 function restorePlacementRoot(internals, seedPlacementRoot) {
     if (internals?.placementRoot !== undefined)
         return internals;
@@ -1166,52 +759,6 @@ export function placementValueOrAbsent(value) {
 function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
-function explicitlyDeferredMemoryTrio(mounted, roster, deferNames) {
-    return mounted ? MEMORY_ENGINE_TOOL_NAMES.filter((n) => roster.some((t) => t.name === n) && (deferNames ?? []).includes(n)) : [];
-}
-function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
-    return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
-}
-function assembleParentCaptureState(o, i, ctl, ancestors) {
-    const build = (optedOut, indeterminate) => ({
-        optedOut: optedOut === true,
-        indeterminate: indeterminate === true,
-        ...(ctl !== undefined ? { controlDir: ctl } : {}),
-        ancestors,
-    });
-    return o instanceof Promise || i instanceof Promise ? Promise.all([o, i]).then(([ov, iv]) => build(ov, iv)) : build(o, i);
-}
-async function spliceSessionOverlayRows(overlay, sessionId, persisted, tracer, hostTaskId) {
-    if (overlay === undefined)
-        return persisted;
-    try {
-        const served = structuredClone(await overlay.read(sessionId));
-        const sessionRows = served.filter((r) => {
-            const scope = r?.scope;
-            return scope?.kind === "session" && scope.sessionId === sessionId && !("reject" in normalizePersistedRule(r));
-        });
-        if (sessionRows.length < served.length) {
-            emitTrace(tracer, () => ({
-                kind: "permission.rule_store_unreadable",
-                version: 1,
-                taskId: hostTaskId,
-                message: `session-rule overlay served ${served.length - sessionRows.length} row(s) that are not canonical session rows of this session — dropped, not adjudicated`,
-                ts: Date.now(),
-            }));
-        }
-        return sessionRows.length > 0 ? [...sessionRows, ...persisted] : persisted;
-    }
-    catch (err) {
-        emitTrace(tracer, () => ({
-            kind: "permission.rule_store_unreadable",
-            version: 1,
-            taskId: hostTaskId,
-            message: `session-rule overlay: ${err instanceof Error ? err.message : String(err)}`,
-            ts: Date.now(),
-        }));
-        return persisted;
-    }
-}
 function refuseRequireExistingWithoutSession(spec) {
     if (spec.requireExistingSession && !spec.sessionId) {
         const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
@@ -1219,31 +766,6 @@ function refuseRequireExistingWithoutSession(spec) {
         throw e;
     }
 }
-function screenAutoModeCap(caps, onError, sessionId) {
-    if (caps === undefined)
-        return { caps, faulted: false };
-    if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
-        onError?.(new Error(`runtimeCapsResolver returned a non-record value (${JSON.stringify(caps)}) — read as a resolver fault: every per-principal capability is DENIED for this run (auto mode is not armed; asks flow the original chain). Return a RuntimeCaps object or undefined.`), { phase: "config", sessionId });
-        return { caps: { allowWorkflows: false, allowFork: false, autoMode: false }, faulted: true };
-    }
-    const record = caps;
-    if (record.autoMode === undefined || typeof record.autoMode === "boolean")
-        return { caps: record, faulted: false };
-    onError?.(new Error(`runtimeCapsResolver returned a non-boolean autoMode (${JSON.stringify(record.autoMode)}) — read as a resolver fault: auto mode is DENIED for this run (the classifier is not armed; asks flow the original chain). Return true, false, or omit the key.`), { phase: "config", sessionId });
-    return { caps: { ...record, autoMode: false }, faulted: true };
-}
-function mintPersistedArming(am, laneRule, classifierSystemPrompt, onError, sessionId) {
-    const arming = autoModeArmingRecipeOf(laneRule ? { ...am, crossSessionMessagesRule: true } : am, {
-        promptDigest: `apv1:${createHash("sha256").update(classifierSystemPrompt).digest("hex")}`,
-    });
-    if (arming === undefined) {
-        onError?.(new Error("RunnerDeps.autoMode.persistArming is set but the auto-mode face did not canonicalize into an arming recipe " +
-            "(a rule list carrying a non-string, or a non-finite/out-of-range timeoutMs / failureThreshold / window bound) — " +
-            "NO arming recipe is recorded on this run's parked constraint chain, and a cross-process redemption keeps the " +
-            "conservative behavior (the ancestor classifier answers unavailable and the inherited ask flows to a human)"), { phase: "config", sessionId });
-    }
-    return arming;
-}
 function autoModeLatchHealthy(d) {
     try {
         return d.breakerOpen() !== true && typeof d.consecutiveFailures === "function" && d.consecutiveFailures() === 0;
@@ -1252,15 +774,6 @@ function autoModeLatchHealthy(d) {
         return false;
     }
 }
-function autoModeArmReasonOf(intent, facePresent, capsAutoMode, capsFaulted) {
-    if (!intent)
-        return "no_intent";
-    if (!facePresent)
-        return "no_face";
-    if (capsAutoMode === false)
-        return capsFaulted ? "resolver_fault" : "denied";
-    return "armed";
-}
 function validateInputFaultNotice(onError, sessionId) {
     return ({ toolName, toolCallId, error }) => onError?.(new Error(`tool input pre-validation (validateInput) threw for ${toolName} (call ${toolCallId}) — read as no verdict; the call proceeded to the gate: ${error instanceof Error ? error.message : String(error)}`), { phase: "hook", sessionId });
 }
@@ -1272,50 +785,6 @@ function refuseInvalidAutoModeSeat(spec) {
     }
     return spec.autoModeRequested === true;
 }
-function announceDurableGateUnavailable(args) {
-    if (!args.forceDurableGate || args.storeWired)
-        return;
-    const cause = args.taskStoreNull ? "task_store_null" : "no_deployment_store";
-    const inheritedContentMandate = (args.parentConstraints ?? []).some((pc) => pc.contentMandate === true);
-    const liveQuestionFace = args.liveQuestionFace && !inheritedContentMandate;
-    deliverEngineNotice(args.onNotice, {
-        code: "config.durable_gate_unavailable",
-        message: `Durable approval gate mandated but unavailable: the runtime entitlement forceDurableGate is in force for this ` +
-            `principal, but ${cause === "task_store_null" ? "this task disabled the checkpoint store (checkpointStore: null)" : "this deployment wired no checkpoint store"}, ` +
-            `so no interactive ask of this task can be parked for a durable answer. Asks resolve on the live chain instead ` +
-            `(${args.liveApprover ? "a live approver answers permission asks in-stream" : "permission asks are denied fail-closed — no live approver is wired"}; ` +
-            `${liveQuestionFace ? "a live question face answers AskUserQuestion in-stream" : args.liveQuestionFace ? "AskUserQuestion is withheld from the live face by an inherited durable mandate and refused" : "AskUserQuestion has no live face and is refused"}) ` +
-            `and NO durable approval record is written. ${cause === "task_store_null" ? "Run this task with its store, or withdraw the entitlement for principals whose runs are machine-started." : "Wire a checkpoint store on this deployment, or withdraw the entitlement for principals served here."}`,
-        detail: {
-            sessionId: args.sessionId,
-            runId: args.runId,
-            ...(args.principal ? { principal: args.principal } : {}),
-            cause,
-            liveApprover: args.liveApprover,
-            liveQuestionFace,
-        },
-    });
-}
-function buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) {
-    if (delegationForRevive === undefined)
-        return undefined;
-    return async (req) => {
-        const out = await delegationForRevive.execute({
-            description: req.row.description ?? "revived teammate",
-            prompt: req.prompt,
-            run_in_background: true,
-            ...(req.row.agentType !== undefined ? { subagent_type: req.row.agentType } : {}),
-            ...(req.row.name !== undefined ? { name: req.row.name } : {}),
-            ...(req.row.model !== undefined ? { model: req.row.model } : {}),
-        }, enrichSpecToolCtx({ toolCallId: `rv-${randomBytes(8).toString("hex")}`, reviveClaim: { row: req.row, rev: req.rev, ...(req.peerSeed !== undefined ? { peerSeed: req.peerSeed } : {}) } }));
-        const o = (typeof out === "string" ? { content: out } : out);
-        return {
-            content: typeof o.content === "string" ? o.content : JSON.stringify(o.content),
-            ...(o.isError === true ? { isError: true } : {}),
-            ...(o.details !== undefined ? { details: o.details } : {}),
-        };
-    };
-}
 export async function prepareTask(spec, deps, sessions, resume, internals, runnerSelf, runIdSink) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
@@ -1332,6 +801,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
     refuseRequireExistingWithoutSession(spec);
     const { acquired, session, conflictRef, wakeRecovered, resumeAtBeforeParentId } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
+    const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
     const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
     const placementRootResolved = (internals = restorePlacementRoot(internals, resume?.seed.placementRootSessionId))?.placementRoot ?? internals?.rootSessionId ?? sessionId;
@@ -1366,112 +836,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         e.code = "config.extra_body_output_cap";
         throw e;
     }
-    const nestedStats = { tokens: 0, turns: 0, tasks: 0, costMicroUsd: 0, anyUnpriced: false };
-    if (resume) {
-        nestedStats.tokens = resume.seed.nestedStats.tokens;
-        nestedStats.turns = resume.seed.nestedStats.turns;
-        nestedStats.tasks = resume.seed.nestedStats.tasks;
-        nestedStats.costMicroUsd = resume.seed.nestedStats.costMicroUsd;
-        nestedStats.anyUnpriced = resume.seed.nestedStats.anyUnpriced ?? true;
-    }
-    const reportUsage = (u) => {
-        nestedStats.tokens += u.tokens;
-        nestedStats.turns += u.turns;
-        nestedStats.tasks += u.tasks;
-        nestedStats.costMicroUsd += u.costMicroUsd ?? 0;
-        if (u.costMicroUsd === undefined)
-            nestedStats.anyUnpriced = true;
-    };
-    const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
-    const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
-    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0;
-    const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
-    const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
-        ? new ScopedToolResultStore(rawOffloadStore, offloadScope)
-        : rawOffloadStore;
-    const offloadReachableToolsRef = {};
-    const maybeOffload = (tool, perTool) => {
-        if (!offloadStore || perTool?.offload === false)
-            return tool;
-        return withToolResultOffload(tool, offloadStore, perTool?.offloadThresholdChars ?? offloadThreshold, sessionId, () => offloadReachableToolsRef.current?.());
-    };
-    const firstPartyOffload = (tool) => {
-        const policy = firstPartyOffloadPolicy(tool.name);
-        if (policy.offload === false)
-            return maybeOffload(tool, policy);
-        return maybeOffload(tool, explicitGlobalThreshold === undefined ? policy : undefined);
-    };
-    const remoteToolOffload = (tool) => {
-        if (explicitGlobalThreshold !== undefined)
-            return maybeOffload(tool);
-        return maybeOffload(tool, { offloadThresholdChars: tool.mcpMaxResultSizeChars ?? 50_000 });
-    };
+    const { nestedStats, reportUsage, offloadStore, offloadReachableToolsRef, maybeOffload, firstPartyOffload, remoteToolOffload } = prepareOffloadWrappers({ spec, deps, resume, offloadScope, sessionId });
     if (offloadStore && (spec.tools ?? []).some((t) => t.name === OFFLOAD_TOOL_NAME)) {
         const e = new Error(`Tool name "${OFFLOAD_TOOL_NAME}" is reserved when large-result offload is enabled.`);
         e.code = "config.reserved_tool_name";
         await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (reserved-name leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
         throw e;
     }
-    let ownedEnv;
-    let ownedEnvObservedAt;
-    let mcp;
-    let a2a;
-    if (internals?.requestedCwd !== undefined && deps.executionEnvFactory === undefined) {
-        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-unsupported leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
-        const e = new Error(`Agent cwd "${internals.requestedCwd}" cannot take effect: this deployment has no executionEnvFactory (a static execution environment cannot be re-rooted per agent). Drop the cwd parameter or deploy a factory.`);
-        e.code = "config.cwd_unsupported";
-        throw e;
-    }
-    if (internals?.requestedCwd !== undefined && resume?.workspaceHandle !== undefined) {
-        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-conflicts-restore leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
-        throw cwdConflictsRestoreError(internals.requestedCwd);
-    }
-    try {
-        ownedEnv = deps.executionEnvFactory
-            ? await deps.executionEnvFactory({
-                sessionId, placementRootSessionId: mintPlacementRootSessionId(placementRootResolved),
-                taskId: spec.taskId,
-                ...(internals?.isolation ? { isolation: internals.isolation } : {}),
-                ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
-            })
-            : undefined;
-        if (ownedEnv !== undefined)
-            ownedEnvObservedAt = Date.now();
-    }
-    catch (factoryErr) {
-        await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (env-factory-throw leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
-        throw factoryErr;
-    }
-    const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    const rollback = createRollbackStack((e) => deps.onError?.(e, { phase: "config", sessionId }));
+    const { executionEnv, ownedEnvSeat, ownedEnvObservedAt, handsEnabled, taskRootInitial } = await prepareExecutionEnv({ deps, spec, internals, resume, placementRootResolved, sessionId, forgetOnThrow, rollback });
     const externalContentTargetActive = executionEnv.externalContentTarget === true || resume?.seed.externalContentTarget === true;
-    if (internals?.requestedCwd !== undefined) {
-        const canon = async (p) => {
-            const r = await executionEnv.canonicalPath(p);
-            return r.ok ? r.value : p;
-        };
-        const want = await canon(internals.requestedCwd);
-        const rejectCwd = async (message, code) => {
-            await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (cwd-reject leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
-            await settleTeardownLeg(() => (ownedEnv && hasDestroy(ownedEnv) ? ownedEnv.destroy() : undefined), "ownedEnv.destroy (cwd-reject leg)", (err) => deps.onError?.(err, { phase: "config", sessionId }));
-            const e = new Error(message);
-            e.code = code;
-            throw e;
-        };
-        if (deps.rootPath !== undefined) {
-            const root = await canon(deps.rootPath);
-            const sep = root.includes("\\") && !root.includes("/") ? "\\" : "/";
-            const rootPrefix = root.endsWith(sep) ? root : root + sep;
-            if (want !== root && !want.startsWith(rootPrefix)) {
-                await rejectCwd(`Agent cwd "${internals.requestedCwd}" is outside this deployment's declared root "${deps.rootPath}" — the cwd must be located within the deployment root.`, "config.cwd_outside_root");
-            }
-        }
-        const got = await canon(executionEnv.cwd);
-        if (want !== got) {
-            await rejectCwd(`Agent cwd "${internals.requestedCwd}" was not honored by the execution environment (it rooted at "${executionEnv.cwd}") — failing loud instead of running the agent in the wrong tree.`, "config.cwd_not_honored");
-        }
-    }
-    const handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined;
-    const taskRootInitial = internals?.isolation === "worktree" || internals?.requestedCwd !== undefined || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
     const abortController = new AbortController();
     if (spec.signal?.aborted)
         abortController.abort();
@@ -1487,15 +861,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 e.code = "isolation.unavailable";
                 throw e;
             };
-            if (ownedEnv === undefined) {
+            if (ownedEnvSeat.current === undefined) {
                 failIsolation("no executionEnvFactory is configured (a static/shared execution env cannot mint a per-agent worktree)");
             }
-            else if (ownedEnv === deps.executionEnv) {
-                ownedEnv = undefined;
+            else if (ownedEnvSeat.current === deps.executionEnv) {
+                ownedEnvSeat.current = undefined;
                 failIsolation("the executionEnvFactory returned the shared static env instead of a worktree-rooted env");
             }
-            else if (isRemoteExecutionEnv(ownedEnv)) {
-                if (ownedEnv.capabilities.isolation !== true) {
+            else if (isRemoteExecutionEnv(ownedEnvSeat.current)) {
+                if (ownedEnvSeat.current.capabilities.isolation !== true) {
                     failIsolation("the executionEnvFactory returned a remote env without capabilities.isolation — a non-isolated remote target is a shared remote checkout, not a per-agent worktree");
                 }
             }
@@ -1509,7 +883,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     }
                 };
                 if (deps.rootPath !== undefined || internals.parentCwd !== undefined) {
-                    const envCwd = canonical(ownedEnv.cwd, "the factory env's cwd");
+                    const envCwd = canonical(ownedEnvSeat.current.cwd, "the factory env's cwd");
                     if (deps.rootPath !== undefined && envCwd === canonical(deps.rootPath, "the shared base root")) {
                         failIsolation("the executionEnvFactory rooted the env at the shared base root instead of a worktree");
                     }
@@ -1519,625 +893,15 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             }
         }
+        const ownedEnv = ownedEnvSeat.current;
         const { taskRootFinal, rebaseRestoredPath } = await prepareWorkspaceRestore({ ownedEnv, deps, spec, internals, resume, taskRootInitial, abortController, sessionId });
-        const rewindNotes = [];
-        const onTrackFailure = deps.onTrackFailure === undefined ? "refuse" : deps.onTrackFailure;
-        if (onTrackFailure !== "refuse" && onTrackFailure !== "proceed-unprotected") {
-            const e = new Error(`RunnerDeps.onTrackFailure must be "refuse" or "proceed-unprotected"; got ${JSON.stringify(deps.onTrackFailure)} — refusing prepare rather than silently defaulting a first-touch-failure policy.`);
-            e.code = "config.invalid_on_track_failure";
-            throw e;
-        }
-        const fileHistoryStore = resolveWiredFileHistoryStore(deps.fileHistoryStore);
-        const legacyRewindFiles = spec.rewindFiles;
-        if (legacyRewindFiles === true) {
-            if (spec.resumeAt !== undefined) {
-                const e = new Error(`rewind-files: TaskSpec.rewindFiles is retired (design/381 — rewind now converges the per-edited-file history, not a whole-tree snapshot). This request pairs it with resumeAt, i.e. the RESTORE sense: set restoreFiles: true instead. (The capture sense needs no request anymore — first-touch tracking is always on when a RunnerDeps.fileHistoryStore is wired.)`);
-                e.code = "rewind.rewind_files_retired";
-                throw e;
-            }
-            try {
-                deps.onError?.(new Error(`TaskSpec.rewindFiles (capture sense) is retired and was ignored: per-edited-file first-touch tracking is always on when RunnerDeps.fileHistoryStore is wired, so a per-turn capture request has nothing left to ask for. Drop the field; the restore sense moved to TaskSpec.restoreFiles.`), { phase: "config", sessionId });
-            }
-            catch {
-            }
-        }
-        if (spec.restoreFiles === true && spec.resumeAt === undefined) {
-            const e = new Error(`rewind-files: restoreFiles: true needs a resumeAt anchor — restoring files means converging them to a specific prior entry's boundary, and this spec names none. Use resumeAt + restoreFiles to move conversation and files together, or rewindFilesTo alone for a code-only restore.`);
-            e.code = "rewind.invalid_spec";
-            throw e;
-        }
-        if (spec.resumeAt !== undefined && spec.rewindFilesTo !== undefined) {
-            const e = new Error(`rewind-files: resumeAt ("${spec.resumeAt}") and rewindFilesTo ("${spec.rewindFilesTo}") were both set — resumeAt already anchors the file restore when restoreFiles is true, so a separate rewindFilesTo target is a conflicting request. Drop one of the two.`);
-            e.code = "rewind.conflicting_targets";
-            throw e;
-        }
-        let rewindTarget = spec.resumeAt !== undefined ? (spec.restoreFiles === true ? spec.resumeAt : undefined) : spec.rewindFilesTo;
-        const rewindBefore = rewindTarget !== undefined && spec.resumeAt !== undefined && spec.resumeAtMode === "before";
-        if (spec.resumeAt !== undefined && spec.restoreFiles !== true) {
-            rewindNotes.push({
-                code: "conversation_only",
-                message: `the conversation was branched at entry "${spec.resumeAt}" but the working tree was NOT rewound — this task set resumeAt without restoreFiles, so files remain at their current state`,
-            });
-        }
-        const fileHistoryEnabled = fileHistoryStore !== undefined && handsEnabled;
-        const { historyRoot, historyScope, historyFs } = await resolveFileHistoryCoordinates(fileHistoryEnabled, executionEnv, taskRootFinal, internals?.fileHistoryLineage, sessionId);
-        if (fileHistoryStore !== undefined && internals?.fileHistoryLineage === undefined)
-            await adoptForkedFileHistory(fileHistoryStore, session, sessionId, deps.onError);
-        if (rewindTarget !== undefined && historyScope !== sessionId)
-            throw childScopeRewindRefusal(historyScope, rewindTarget);
-        if (fileHistoryStore === undefined) {
-            if (rewindTarget !== undefined) {
-                const e = new Error(`rewind-files: restoring files to entry "${rewindTarget}" requires a history backend, but this deployment wired no RunnerDeps.fileHistoryStore — no file history was ever recorded, so the files were NOT rewound`);
-                e.code = "rewind.store_unconfigured";
-                throw e;
-            }
-        }
-        else if (!handsEnabled) {
-            if (rewindTarget !== undefined) {
-                rewindNotes.push({
-                    code: "files_env_unsupported",
-                    message: "the file side of rewind was inert: this deployment mounts no filesystem-capable ExecutionEnv, so no file history was recorded or restored",
-                });
-            }
-        }
-        const legacyEpochTail = (entryId, form = "at-or-above") => legacyRewindEpochTail(deps, sessionId, entryId, form);
-        let restoredFilePaths = [];
-        if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
-            const historyStore = fileHistoryStore;
-            if (rewindBefore) {
-                let anchor;
-                if (await historyStore.canRestore(sessionId, rewindTarget)) {
-                    anchor = rewindTarget;
-                }
-                else {
-                    const walked = new Set();
-                    let cursor = resumeAtBeforeParentId;
-                    while (cursor !== null && !walked.has(cursor)) {
-                        walked.add(cursor);
-                        if (await historyStore.canRestore(sessionId, cursor)) {
-                            anchor = cursor;
-                            break;
-                        }
-                        cursor = (await session.getEntry(cursor))?.parentId ?? null;
-                    }
-                }
-                if (anchor === undefined) {
-                    const e = new Error(`rewind-files: no file-history boundary exists at or above the "before" branch point on session "${sessionId}" — cannot restore files consistent with the rewound context. ${await legacyEpochTail(rewindTarget)}`);
-                    e.code = "rewind_snapshot.unresolvable";
-                    throw e;
-                }
-                rewindTarget = anchor;
-            }
-            const restoreRoot = historyRoot;
-            const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
-            const restored = await historyStore.restore(sessionId, rewindTarget, executionEnv, restoreRoot, restoreSignal);
-            const ledgerLine = (r) => `applied ${r.filesChanged.length}, identical ${r.identicalSkipped.length}, refused ${r.refused.length}${r.refused.length > 0 ? ` (${r.refused.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}, failed ${r.failed.length}${r.failed.length > 0 ? ` (${r.failed.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}`;
-            if (restored.outcome === "failed") {
-                if (restored.error?.code === "not_found") {
-                    const e = new Error(rewindBefore
-                        ? `rewind-files: the resolved "before" history anchor "${rewindTarget}" disappeared before restore — files were NOT rewound`
-                        : `rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${await legacyEpochTail(rewindTarget, "keyed")}`);
-                    e.code = "rewind_snapshot.unresolvable";
-                    throw e;
-                }
-                const e = new Error(`rewind-files restore failed (${restored.error?.code ?? "restore_failed"}): ${restored.error?.message ?? "unknown"} — ledger: ${ledgerLine(restored)}`);
-                e.code = "rewind.restore_failed";
-                throw e;
-            }
-            if (restored.outcome === "partial") {
-                if (spec.acceptPartialRestore === true) {
-                    rewindNotes.push({
-                        code: "restore_partial",
-                        message: `file restore to entry "${rewindTarget}" was PARTIAL and was tolerated by acceptPartialRestore — ledger: ${ledgerLine(restored)}. Re-running the same restore converges (per-file idempotent).`,
-                    });
-                }
-                else {
-                    const e = new Error(`rewind-files: restore to entry "${rewindTarget}" was PARTIAL — ledger: ${ledgerLine(restored)}. The task is refused rather than run on a mixed-state tree (set acceptPartialRestore: true to tolerate and disclose instead); re-running the same restore converges (per-file idempotent).`);
-                    e.code = "rewind.restore_failed";
-                    throw e;
-                }
-            }
-            restoredFilePaths = restoredAbsPathsOf(restored, restoreRoot);
-        }
-        const trackFileEdit = fileHistoryEnabled
-            ? async (req) => {
-                const r = await fileHistoryStore.trackEdit(historyScope, req.key, executionEnv, historyRoot, req.signal);
-                if (r.ok) {
-                    if (!r.minted)
-                        return { ok: true };
-                    return {
-                        ok: true,
-                        annul: async (proof) => {
-                            const a = await fileHistoryStore.annulTrack(historyScope, req.key, historyRoot, proof === "verify" ? { env: executionEnv, ...(req.signal !== undefined ? { signal: req.signal } : {}) } : undefined);
-                            if (a.ok)
-                                return;
-                            try {
-                                deps.onError?.(new Error(`file-history could not retract the first-touch record for "${req.key}" after its edit failed to land (${a.error.code}: ${a.error.message}) — the path stays tracked, so a rewind to a boundary below it may converge bytes this engine never wrote`), { phase: "rewind", sessionId });
-                            }
-                            catch {
-                            }
-                        },
-                    };
-                }
-                if (onTrackFailure === "proceed-unprotected") {
-                    try {
-                        deps.onError?.(new Error(`file-history first-touch backup for "${req.key}" failed (${r.error.code}: ${r.error.message}) — proceeding UNPROTECTED per RunnerDeps.onTrackFailure: the pristine promise for this path is void, and only in this process's memory (no durable trace exists, so after a process restart the next edit can still mint already-modified bytes as pristine v1)`), { phase: "rewind", sessionId });
-                    }
-                    catch {
-                    }
-                    return { ok: true };
-                }
-                return {
-                    ok: false,
-                    refusal: `Error (${req.tool}): the edit was refused because its first-touch file-history backup could not be persisted (${r.error.code}: ${r.error.message}). Proceeding would leave "${req.path}" with no durable pristine record — after the history store recovers, a retried edit would mint already-modified bytes as the pristine baseline. Retry when the file-history store is healthy.`,
-                };
-            }
-            : undefined;
-        const { note: noteFileEdited, snapshot: editedFilesSnapshot } = createEditedFilesLedger();
-        const fileHistoryBoundary = fileHistoryEnabled && historyScope === sessionId
-            ? createFileHistoryBoundarySeat({ store: fileHistoryStore, sessionId, env: executionEnv, root: historyRoot, onError: deps.onError })
-            : undefined;
-        const harnessRef = {};
-        const skillScope = new ActiveSkillScope();
-        const forwardSink = internals?.onForwardEvent;
-        const forwardEvent = forwardSink
-            ? (e) => {
-                if (e.type === "task_progress")
-                    forwardSink(e);
-                else if (spec.forwardSubagentEvents === true &&
-                    (e.type === "text_delta" || e.type === "text_end" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_end")) {
-                    forwardSink(e);
-                }
-            }
-            : undefined;
-        const reviewRequestRef = {};
-        const requestReview = (opts) => {
-            if (reviewRequestRef.pending === undefined) {
-                reviewRequestRef.pending = opts?.reason !== undefined ? { reason: opts.reason } : {};
-            }
-        };
-        const requestStopAfterTurn = () => {
-            harnessRef.current?.requestStopAfterTurn();
-        };
-        const planModeRef = { active: false };
-        const enterPlanMode = () => {
-            planModeRef.active = true;
-        };
-        const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
-        const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootFinal) : undefined;
-        const liveInheritedGate = internals?.inheritedGate;
-        const seedInheritedGate = resume?.seed.inheritedGate;
-        const inheritedAncestorRules = (() => {
-            const seedRules = seedInheritedGate?.ancestorRules;
-            const liveRules = liveInheritedGate?.ancestorRules;
-            if (seedRules === undefined || seedRules.length === 0)
-                return liveRules ?? seedRules;
-            if (liveRules === undefined || liveRules.length === 0)
-                return seedRules;
-            const merged = seedRules.map((s) => {
-                const live = liveRules.find((l) => l.sessionId === s.sessionId && l.principal === s.principal);
-                return live !== undefined && live.rev >= s.rev ? live : s;
-            });
-            const extras = liveRules.filter((l) => !seedRules.some((s) => s.sessionId === l.sessionId && s.principal === l.principal));
-            return [...merged, ...extras];
-        })();
-        const shellGateRank = { off: 0, classify: 1, always: 2 };
-        const liveShellGate = liveInheritedGate?.shellGate;
-        const seedShellGate = seedInheritedGate?.shellGate;
-        const inheritedShellGate = liveShellGate === undefined
-            ? seedShellGate
-            : seedShellGate === undefined
-                ? liveShellGate
-                : shellGateRank[liveShellGate] >= shellGateRank[seedShellGate]
-                    ? liveShellGate
-                    : seedShellGate;
-        const inheritedParentConstraints = attachRebuiltDenialTrackers(liveInheritedGate?.parentConstraints, deps.autoMode?.denialLimit);
-        const autoModeIntent = autoModeSeat || liveInheritedGate?.autoModeRequested === true || seedInheritedGate?.autoModeRequested === true;
-        const liveAdmittedOrg = liveInheritedGate?.admittedOrgScopes;
-        const seedAdmittedOrg = seedInheritedGate?.admittedOrgScopes;
-        const inheritedAdmittedOrgScopes = liveAdmittedOrg === undefined ? seedAdmittedOrg : seedAdmittedOrg === undefined ? liveAdmittedOrg : liveAdmittedOrg.filter((s) => seedAdmittedOrg.includes(s));
-        const inheritedOrgGoverned = liveInheritedGate?.orgAdmissionGoverned === true || seedInheritedGate?.orgAdmissionGoverned === true;
-        const checkpointOwnOrgVerdict = resume?.seed.inheritedGate?.ownAdmittedOrgScopes !== undefined
-            ? { scopes: resume.seed.inheritedGate.ownAdmittedOrgScopes, writeScope: resume.seed.inheritedGate.ownAdmittedOrgWriteScope ?? null }
-            : undefined;
-        const refOwnOrgVerdict = internals?.ownOrgAdmissionRef?.current;
-        const priorOwnOrgVerdict = checkpointOwnOrgVerdict === undefined
-            ? refOwnOrgVerdict
-            : refOwnOrgVerdict === undefined
-                ? checkpointOwnOrgVerdict
-                : {
-                    scopes: checkpointOwnOrgVerdict.scopes.filter((sc) => refOwnOrgVerdict.scopes.includes(sc)),
-                    writeScope: checkpointOwnOrgVerdict.writeScope !== null && checkpointOwnOrgVerdict.writeScope === refOwnOrgVerdict.writeScope
-                        ? checkpointOwnOrgVerdict.writeScope
-                        : null,
-                };
-        const orgGovernedProvenance = deps.memoryScopeAdmission !== undefined ||
-            (deps.deploymentMemoryScopes !== undefined && deps.deploymentMemoryScopes.length > 0) ||
-            deps.compliancePostureResolver !== undefined ||
-            inheritedOrgGoverned ||
-            priorOwnOrgVerdict !== undefined;
-        const specShellGate = spec.shellGate ?? "off";
-        const effectiveShellGate = inheritedShellGate !== undefined && shellGateRank[inheritedShellGate] > shellGateRank[specShellGate] ? inheritedShellGate : specShellGate;
-        const ownSessionRulesRef = {};
-        const memoryAdmittedOrgScopesRef = { current: [] };
-        const ownOrgVerdictRef = { current: undefined };
-        const orgAdmissionCheckpointState = () => inheritedAdmittedOrgScopes !== undefined || ownOrgVerdictRef.current !== undefined || orgGovernedProvenance;
-        const faceCheckpointSection = () => {
-            if (resolvedReadFace === undefined && resume !== undefined) {
-                const seed = resume.seed.readFace;
-                return seed !== undefined ? { face: seed.face, ...(seed.denyEntries !== undefined ? { denyEntries: seed.denyEntries.map((e) => ({ ...e })) } : {}) } : undefined;
-            }
-            const face = resolvedReadFace ?? handsLessResolvedFace;
-            if (face === undefined)
-                return undefined;
-            if (face === "open" || readDenyAdditionsNormalized.length > 0) {
-                return { face, ...(readDenyAdditionsNormalized.length > 0 ? { denyEntries: readDenyAdditionsNormalized.map((e) => ({ ...e })) } : {}) };
-            }
-            return undefined;
-        };
-        const faceCheckpointState = () => faceCheckpointSection() !== undefined;
-        const f012CheckpointState = () => (inheritedParentConstraints?.length ?? 0) > 0 ||
-            seedInheritedGate?.constraintChain !== undefined ||
-            internals?.delegationProvenance !== undefined;
-        const frozenOnAsk = spec.onAsk ?? deps.onAsk;
-        const hookEnvSource = (ownedEnv ?? deps.executionEnv) != null ? executionEnv : undefined;
-        const notifyOwnHookCrash = (err) => {
-            try {
-                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
-            }
-            catch {
-            }
-        };
-        const frozenOnQuestion = spec.onQuestion ?? deps.onQuestion;
-        const provenanceForChildrenRef = {};
-        const delegationProvenanceForChildren = () => provenanceForChildrenRef.current;
-        const delegationSettlementRef = {};
-        const delegationSettlementForChildren = () => delegationSettlementRef.current;
-        const inheritedGateForChildren = () => {
-            const ancestorRules = [
-                ...(inheritedAncestorRules ?? []),
-                ...(ownSessionRulesRef.current !== undefined ? [ownSessionRulesRef.current] : []),
-            ];
-            const ownCallerPolicy = lockedPreflight.toolPolicy;
-            const durableMandate = runtimeCaps?.forceDurableGate === true ||
-                (spec.durableApproval !== undefined && !isLiveApproverSeat(frozenOnAsk));
-            const contentMandate = runtimeCaps?.forceDurableGate === true ||
-                (spec.durableApproval !== undefined && !isLiveQuestionFace(frozenOnQuestion));
-            const ownPreToolUse = preToolUseObservational ? undefined : hooks?.preToolUse;
-            const hookConstraint = ownPreToolUse !== undefined &&
-                !(inheritedParentConstraints ?? []).some((pc) => pc.preToolUse === ownPreToolUse &&
-                    askApproverIdentity(pc.onAsk) === askApproverIdentity(frozenOnAsk) &&
-                    (pc.durableMandate === true) === durableMandate &&
-                    (pc.contentMandate === true) === contentMandate &&
-                    pc.hookEnv === hookEnvSource &&
-                    pc.autoMode?.decider === autoModeDecider)
-                ? [
-                    {
-                        policy: createPreToolUseConstraintPolicy(ownPreToolUse, hookEnvFace, notifyOwnHookCrash, hookTimeoutMs),
-                        preToolUse: ownPreToolUse,
-                        ...(hookEnvSource !== undefined ? { hookEnv: hookEnvSource } : {}),
-                        ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
-                        ...(durableMandate ? { durableMandate: true } : {}),
-                        ...(contentMandate ? { contentMandate: true } : {}),
-                        ...(autoModeDecider !== undefined
-                            ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
-                            : {}),
-                    },
-                ]
-                : [];
-            const parentConstraints = [
-                ...(inheritedParentConstraints ?? []),
-                ...hookConstraint,
-                ...(ownCallerPolicy !== undefined
-                    ? [
-                        {
-                            policy: ownCallerPolicy,
-                            ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
-                            ...(durableMandate ? { durableMandate: true } : {}),
-                            ...(contentMandate ? { contentMandate: true } : {}),
-                            ...(autoModeDecider !== undefined
-                                ? { autoMode: { decider: autoModeDecider, ...(autoModeDenialTracking !== undefined ? { denialTracking: autoModeDenialTracking } : {}), ...(autoModeArming !== undefined ? { arming: autoModeArming } : {}) } }
-                                : {}),
-                        },
-                    ]
-                    : []),
-            ];
-            return {
-                ...(ancestorRules.length > 0 ? { ancestorRules } : {}),
-                ...(effectiveShellGate !== "off" ? { shellGate: effectiveShellGate } : {}),
-                ...(autoModeIntent ? { autoModeRequested: true } : {}),
-                ...(parentConstraints.length > 0 ? { parentConstraints } : {}),
-                admittedOrgScopes: memoryAdmittedOrgScopesRef.current,
-                ...(orgGovernedProvenance ? { orgAdmissionGoverned: true } : {}),
-            };
-        };
-        let agentForkDenial;
-        let observersActive = false;
+        const { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, historyScope, historyRoot, historyFs } = await prepareFileHistory({ deps, spec, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, resumeAtBeforeParentId, abortController });
+        const { noteFileEdited, editedFilesSnapshot, harnessRef, skillScope, forwardEvent, reviewRequestRef, requestReview, stopRequestedRef, requestStopAfterTurn, planModeRef, enterPlanMode, subagentRetain, worktreeIsolation } = prepareRunRefs({ spec, internals, executionEnv, taskRootFinal });
         let resolvedReadFace;
         let readDenyAdditionsNormalized = [];
         let handsLessResolvedFace;
-        const carrierReadFace = () => resolvedReadFace ?? handsLessResolvedFace;
-        const fullShellReachable = handsEnabled &&
-            !(executionEnv instanceof StubExecutionEnv) &&
-            spec.handsReadOnly !== true &&
-            !(toolFaceSnapshot.exclude?.includes("Bash") ?? false);
-        let autoModeDecider;
-        let autoModeDenialTracking;
-        const { gateStopRef, stopForDenialLimit } = createDenialLimitStop({ sessionId, runId, onNotice: deps.onNotice, abort: () => { abortController.abort(); void harness.abort(); } });
-        let autoModeArming;
-        const delegationEntryCapsResolved = resolveDelegationEntryCaps(deps.delegationEntryCaps);
-        const enrichSpecToolCtx = (ctx) => ({
-            ...ctx,
-            delegationEntryCaps: delegationEntryCapsResolved,
-            reportUsage,
-            model: harnessRef.current?.getModel(),
-            thinkingLevel: harnessRef.current?.getThinkingLevel(),
-            principal: spec.principal,
-            ...(frozenOnAsk !== undefined ? { onAsk: frozenOnAsk } : {}),
-            ...(frozenOnQuestion !== undefined ? { onQuestion: frozenOnQuestion } : {}),
-            ...(spec.handsReadOnly === true ? { handsReadOnly: true } : {}),
-            ...(carrierReadFace() === "roots" ? { readFace: "roots" } : {}),
-            ...(readDenyAdditionsNormalized.length > 0 ? { readDenyPatterns: Object.freeze(readDenyAdditionsNormalized.map((e) => ({ ...e }))) } : {}),
-            ...(spec.interactiveTools === false ? { interactiveTools: false } : {}),
-            oneShot: spec.oneShot,
-            clientContext: spec.clientContext,
-            excludeTools: toolFaceSnapshot.exclude,
-            deferTools: toolFaceSnapshot.defer,
-            alwaysLoadTools: toolFaceSnapshot.alwaysLoad,
-            ...(toolFaceSnapshot.restoreGated !== undefined ? { restoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-            promptProfile,
-            ...(spec.additionalDirectories !== undefined ? { additionalDirectories: Object.freeze([...spec.additionalDirectories]) } : {}),
-            ...(spec.additionalReadDirectories !== undefined ? { additionalReadDirectories: Object.freeze([...spec.additionalReadDirectories]) } : {}),
-            ...(spec.envFacts !== undefined ? { envFacts: { ...spec.envFacts } } : {}),
-            ...(spec.memoryPersistenceCapable !== undefined ? { memoryPersistenceCapable: spec.memoryPersistenceCapable } : {}),
-            get memoryCaptureOptedOut() {
-                return memoryEngineSession?.captureOptOut?.optedOut() ?? false;
-            },
-            get memoryCaptureIndeterminate() {
-                return memoryEngineSession?.captureOptOut?.indeterminate() ?? false;
-            },
-            get memoryCaptureControlDir() {
-                return memoryEngineSession?.engine.controlPlaneDir;
-            },
-            get memoryCaptureAncestors() {
-                const ctl = memoryEngineSession?.engine.controlPlaneDir;
-                return [...(internals?.memoryCaptureAncestors ?? []), { sessionId, ...(ctl !== undefined ? { controlDir: ctl } : {}) }];
-            },
-            getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
-            parentCwd: taskRootFinal,
-            ...(fileHistoryEnabled ? { fileHistoryLineage: { scope: historyScope, root: historyRoot, fs: historyFs } } : {}),
-            reminderMark,
-            reminderDisclosureCounts,
-            ...(centerAdoption !== undefined ? { centerArtifactDigest: centerAdoption.artifact.artifactDigest } : {}),
-            ...(centerAdoption?.sourceRevision !== undefined ? { centerSourceRevision: centerAdoption.sourceRevision } : {}),
-            activeSkillScope: () => skillScope.active(),
-            inheritedGateForChildren,
-            delegationProvenanceForChildren,
-            delegationSettlement: delegationSettlementForChildren,
-            ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
-            ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
-            ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
-            taskId: hostTaskId,
-            ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
-            ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
-            ...(internals?.rootSessionId !== undefined ? { rootSessionId: internals.rootSessionId } : {}), ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
-            ...(internals?.explicitAgentName !== undefined ? { spawnedAgentName: internals.explicitAgentName } : {}),
-            ...(internals?.peerSelfRef !== undefined ? { peerSelfRef: internals.peerSelfRef } : {}),
-            ...(internals?.peerInboundChainRef !== undefined ? { peerInboundChainRef: internals.peerInboundChainRef } : {}),
-            ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}),
-            ...(sessions.fork !== undefined
-                ? {
-                    hostSessionFork: async () => {
-                        const forked = (await sessions.fork(sessionId, spec.principal ?? null)) ?? null;
-                        if (forked === null)
-                            return null;
-                        return {
-                            sessionId: forked,
-                            release: async () => {
-                                await sessions.release?.(forked);
-                            },
-                        };
-                    },
-                }
-                : {}),
-            sessionId,
-            ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
-            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
-            ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
-            ...(internals?.onTaskNotification ? { onTaskNotification: internals.onTaskNotification } : {}),
-            ...(forwardEvent ? { forwardEvent } : {}),
-            ...(internals?.onSubagentSpawn ? { onSubagentSpawn: internals.onSubagentSpawn } : {}),
-            ...(subagentRetain ? { subagentRetain } : {}),
-            ...(worktreeIsolation ? { worktreeIsolation } : {}),
-            ...(internals?.insideFork === true ? { insideFork: true } : {}),
-            ...(agentForkDenial !== undefined ? { forkAccess: { denied: agentForkDenial } } : {}),
-            ...(observersActive ? { observersAllowed: true } : {}),
-            requestReview,
-            requestStopAfterTurn,
-            ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
-        });
-        const tools = (spec.tools ?? []).map((t) => {
-            if (isDefineToolProduct(t)) {
-                return maybeOffload(t, t);
-            }
-            return maybeOffload(defineTool({
-                ...t,
-                execute: (args, ctx) => t.execute(args, enrichSpecToolCtx(ctx)),
-            }), t);
-        });
-        const blockedRef = {};
-        if (spec.enableBlockedReport !== false) {
-            tools.push(createReportBlockedTool(blockedRef));
-        }
-        if (!(spec.tools ?? []).some((t) => t.name === REPORT_FINDINGS_TOOL_NAME || t.aliases?.includes(REPORT_FINDINGS_TOOL_NAME))) {
-            tools.push(createReportFindingsTool());
-        }
-        if (spec.enablePlanMode === true && spec.interactiveTools !== false) {
-            const planReviewFace = resolveCheckpointStore(spec, deps) !== undefined;
-            if (spec.interactiveTools === true || planReviewFace) {
-                tools.push(defineTool(createPresentPlanTool(requestReview)));
-                if (planReviewFace) {
-                    tools.push(defineTool(createEnterPlanModeTool(enterPlanMode)));
-                }
-            }
-        }
-        let runtimeCaps;
-        let runtimeCapsFaulted = false;
-        if (deps.runtimeCapsResolver) {
-            try {
-                runtimeCaps = (await deps.runtimeCapsResolver(spec.principal)) ?? undefined;
-            }
-            catch (err) {
-                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-                runtimeCaps = { allowWorkflows: false, allowFork: false, autoMode: false };
-                runtimeCapsFaulted = true;
-            }
-            const screened = screenAutoModeCap(runtimeCaps, deps.onError, sessionId);
-            runtimeCaps = screened.caps;
-            runtimeCapsFaulted ||= screened.faulted;
-        }
-        let complianceDenies = new Set();
-        let complianceDegraded = false;
-        if (deps.compliancePostureResolver) {
-            try {
-                const posture = (await deps.compliancePostureResolver(spec.principal)) ?? undefined;
-                if (posture !== undefined)
-                    complianceDenies = resolveComplianceDenies(posture);
-            }
-            catch (err) {
-                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-                complianceDenies = new Set(COMPLIANCE_CAPABILITIES);
-                complianceDegraded = true;
-            }
-            const complianceRefuse = (capability, requested) => {
-                const e = new Error(`${requested} is denied for this principal by the compliance posture (capability "${capability}"` +
-                    `${complianceDegraded ? "; the posture resolver is currently failing, so every managed capability is denied fail-closed" : ""}) — ` +
-                    `the task is refused rather than silently narrowed.`);
-                e.code = complianceDegraded ? "config.compliance_required" : "config.compliance_denied";
-                throw e;
-            };
-            if (complianceDenies.has("mcp_servers") && lockedPreflight.mcp?.length) {
-                complianceRefuse("mcp_servers", "TaskSpec.mcp (MCP server materialization)");
-            }
-            if (complianceDenies.has("workflows") && spec.selfOrchestration === true) {
-                complianceRefuse("workflows", "TaskSpec.selfOrchestration (workflow self-orchestration)");
-            }
-            if (complianceDenies.has("web_fetch")) {
-                const webTool = (spec.tools ?? []).find((t) => t.name === WEB_FETCH_TOOL_NAME || (t.aliases ?? []).includes(WEB_FETCH_TOOL_NAME));
-                if (webTool !== undefined) {
-                    complianceRefuse("web_fetch", `TaskSpec.tools["${webTool.name}"] (the WebFetch tool face)`);
-                }
-            }
-        }
-        agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
-        observersActive = runtimeCaps?.allowObservers === true;
-        const autoModeArmReason = autoModeArmReasonOf(autoModeIntent, deps.autoMode !== undefined, runtimeCaps?.autoMode, runtimeCapsFaulted);
-        if (autoModeIntent && deps.autoMode !== undefined && runtimeCaps?.autoMode !== false) {
-            const am = deps.autoMode;
-            let classifierModel;
-            try {
-                classifierModel = resolveTaskModel({ modelRole: "classifier" }, deps).model;
-            }
-            catch {
-                classifierModel = model;
-            }
-            if (await derivedRouteFallsBack({ seat: "auto-mode-classifier", derived: classifierModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })) {
-                classifierModel = model;
-            }
-            const classifierLaneRule = peerLaneActive && peerSendMessageBuiltIn;
-            const classifierSystemPrompt = buildAutoModePrompt(classifierLaneRule ? { ...am, crossSessionMessagesRule: CROSS_SESSION_CLASSIFIER_RULE } : am);
-            const classifierRuntime = brainToRuntime(deps.brain);
-            autoModeDenialTracking = createAutoModeDenialTracker(am.denialLimit);
-            autoModeDecider = createAutoModeDecider({
-                ...(am.timeoutMs !== undefined ? { timeoutMs: am.timeoutMs } : {}),
-                ...(am.failureThreshold !== undefined ? { failureThreshold: am.failureThreshold } : {}),
-                ...(am.onBreakerOpen !== undefined ? { onBreakerOpen: am.onBreakerOpen } : {}),
-                classify: async (input, signal) => {
-                    const ctx = await session.buildContext();
-                    const known = ctx.messages.filter((m) => !isSyntheticApiErrorMessage(m) &&
-                        (m.role === "user" || m.role === "assistant" || m.role === "toolResult"));
-                    const userPrompt = renderAutoModeWindow(known, am.window) + renderAutoModeAction(input);
-                    const classifierAuth = await spec.getApiKeyAndHeaders?.(classifierModel);
-                    const response = await classifierRuntime.completeSimple(classifierModel, { systemPrompt: classifierSystemPrompt, messages: [{ role: "user", content: userPrompt, timestamp: Date.now() }] }, {
-                        signal,
-                        ...(classifierAuth?.apiKey !== undefined ? { apiKey: classifierAuth.apiKey } : {}),
-                        ...(classifierAuth?.headers !== undefined ? { headers: classifierAuth.headers } : {}),
-                    });
-                    return response.content
-                        .filter((c) => c.type === "text")
-                        .map((c) => c.text)
-                        .join("");
-                },
-            });
-            if (am.persistArming === true)
-                autoModeArming = mintPersistedArming(am, classifierLaneRule, classifierSystemPrompt, deps.onError, sessionId);
-        }
-        const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
-        const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
-        if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {
-            deps.onError?.(new Error(`self-orchestration DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowWorkflows=false ` +
-                `(per-principal entitlement governance, not a misconfiguration — the run_workflow tool is not mounted)`), { phase: "config", sessionId });
-        }
-        let workflowToolsActive = false;
-        let workflowSizeGuideline;
-        if (selfOrchestrationActive && runnerSelf && deps.workflowScriptRunner && deps.workflowGovernanceBaseline) {
-            workflowToolsActive = true;
-            const currentSizeGuideline = () => resolveWorkflowSizeGuideline(deps.workflowLimits?.sizeGuideline).size;
-            workflowSizeGuideline = { legGuideline: currentSizeGuideline(), current: currentSizeGuideline };
-            toolEffects.set(RUN_WORKFLOW_TOOL_NAME, "write");
-            tools.push(await createRunWorkflowTool({
-                runner: runnerSelf,
-                scriptRunner: deps.workflowScriptRunner,
-                governanceBaseline: deps.workflowGovernanceBaseline,
-                parentExcludeTools: toolFaceSnapshot.exclude,
-                parentDeferTools: toolFaceSnapshot.defer,
-                parentAlwaysLoadTools: toolFaceSnapshot.alwaysLoad,
-                ...(toolFaceSnapshot.restoreGated !== undefined ? { parentRestoreGatedTools: toolFaceSnapshot.restoreGated } : {}),
-                parentPromptProfile: promptProfile,
-                models: deps.models,
-                agents: deps.agents,
-                builtinAgents: deps.builtinAgents,
-                store: deps.workflowRunStore,
-                journalStore: deps.workflowJournalStore,
-                ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
-                scriptStore: deps.workflowScriptStore,
-                builtinWorkflows: deps.builtinWorkflows,
-                onAgentSpawn: deps.onWorkflowAgentSpawn,
-                scope: taskScope,
-                notifier: deps.workflowCompletionNotifier,
-                originatingSessionId: sessionId,
-                rootSessionId: internals?.rootSessionId ?? sessionId, ...(internals?.placementRoot !== undefined ? { placementRoot: internals.placementRoot } : {}),
-                taskRegistry: defaultTaskRegistry,
-                taskNotification: internals?.onTaskNotification,
-                taskOwner: hostTaskId,
-                limits: deps.workflowLimits,
-                sourceTaskId: hostTaskId,
-                parentModel: () => harnessRef.current?.getModel(),
-                ...(spec.getApiKeyAndHeaders !== undefined ? { parentGetApiKeyAndHeaders: spec.getApiKeyAndHeaders } : {}),
-                ...(frozenOnAsk !== undefined ? { parentOnAsk: frozenOnAsk } : {}),
-                principal: spec.principal,
-                oneShot: spec.oneShot,
-                ...(resolvedInteractionPosture !== undefined ? { parentInteractionPosture: resolvedInteractionPosture } : {}),
-                parentMemoryCaptureState: () => {
-                    const ctl = memoryEngineSession?.engine.controlPlaneDir;
-                    const co = memoryEngineSession?.captureOptOut;
-                    return assembleParentCaptureState(co?.optedOut() ?? false, co?.indeterminate() ?? false, ctl, [...(internals?.memoryCaptureAncestors ?? []), { sessionId, ...(ctl !== undefined ? { controlDir: ctl } : {}) }]);
-                },
-                autoModeReview: () => (autoModeDecider !== undefined ? { decider: autoModeDecider } : undefined),
-                workflowDepth: internals?.workflowDepth,
-                parentCwd: taskRootFinal,
-                parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
-                parentReadFace: () => carrierReadFace(),
-                parentReadDenyPatterns: () => (readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized : undefined),
-                ...(spec.handsReadOnly === true ? { parentHandsReadOnly: true } : {}), ...(spec.interactiveTools === false ? { parentInteractiveTools: false } : {}),
-                onNotice: deps.onNotice,
-                parentCheckpointStoreDisabled: spec.checkpointStore === null,
-                parentCenterArtifactDigest: () => centerAdoption?.artifact.artifactDigest,
-                parentCenterSourceRevision: () => centerAdoption?.sourceRevision,
-                ...(forwardEvent ? { forwardEvent } : {}),
-                inheritedGateForChildren,
-            }));
-        }
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoption, memoryEngineSession: () => memoryEngineSession });
+        const { tools, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoption, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
         const suspendRef = {};
         const reviewRef = {};
         const remoteEnvFailures = [];
@@ -2170,191 +934,36 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             resourceSpentMicroUsd: priorLedger?.spentMicroUsd ?? 0,
             suspendCount: priorSuspendCount,
         };
-        let worktreeSessionRef;
         let suspendForResource;
         let suspendForPlatformLimit;
         let suspendForReview;
-        const outputRef = {};
-        if (resume?.seed.outputRef) {
-            outputRef.value = resume.seed.outputRef.value;
-            outputRef.set = resume.seed.outputRef.set;
-        }
-        if (spec.outputSchema) {
-            if ((spec.tools ?? []).some((t) => t.name === OUTPUT_TOOL_NAME)) {
-                const e = new Error(`Tool name "${OUTPUT_TOOL_NAME}" is reserved when TaskSpec.outputSchema is set.`);
-                e.code = "config.reserved_tool_name";
-                throw e;
-            }
-            const compiled = compileOutputSchema(spec.outputSchema);
-            if ("error" in compiled) {
-                const e = new Error(`TaskSpec.outputSchema is not a valid JSON Schema: ${compiled.error}`);
-                e.code = "config.invalid_output_schema";
-                throw e;
-            }
-            if (!compiled.strict) {
-                try {
-                    deps.onError?.(new Error(`structured-output: strict schema derivation fell back to non-strict (${compiled.fallbackReason}) — the schema is served to the model as-is`), { phase: "config", sessionId });
-                }
-                catch {
-                }
-            }
-            tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
-        }
-        mcp = lockedPreflight.mcp?.length
-            ? await materializeMcpTools(lockedPreflight.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer, { reminderMark, counts: reminderDisclosureCounts }, mcpRevocationWiring(deps, runId))
-            : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, droppedTools: [], statuses: [], refresh: async () => [], dispose: async () => { } };
-        for (const w of mcp.warnings)
-            deps.onError?.(w, { phase: "mcp", sessionId });
-        for (const d of mcp.droppedTools) {
-            deps.onError?.(new Error(`MCP tool dropped at intake — ${d.tool} (server "${d.server}"): ${d.reason}`), { phase: "mcp", sessionId });
-        }
-        {
-            const callerNames = new Set((spec.tools ?? []).flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-            const clash = mcp.tools.find((t) => [t.name, ...(t.aliases ?? [])].some((name) => callerNames.has(name)));
-            if (clash) {
-                await mcp.dispose();
-                const e = new Error(`Tool name "${clash.name}" is reserved by an injected MCP tool — a caller tool of the same name would silently shadow it.`);
-                e.code = "config.reserved_tool_name";
-                throw e;
-            }
-        }
-        tools.push(...mcp.tools.map((t) => remoteToolOffload(t)));
-        const rebuildHarnessToolsRef = {};
-        const contentOriginWrapRef = {};
-        const toolCallGateArmedRef = { armed: false };
-        if (lockedPreflight.mcp?.length) {
-            tools.push({
-                name: "RefreshMcpTools",
-                label: "RefreshMcpTools",
-                description: "Refresh the tool list of connected MCP servers. Never dials or re-dials connections — it only re-reads the tool list over the existing connection. The refreshed tools are available immediately; you can call them on your next step. Use when a server's expected tool is missing, or the tool list looks stale after a connection recovered. Omit `server` to refresh every connected server.",
-                parameters: Type.Object({
-                    server: Type.Optional(Type.String({ description: "Name of a single MCP server to refresh; omit to refresh all connected servers." })),
-                }),
-                execute: async (_toolCallId, params) => {
-                    const serverArg = params?.server;
-                    const results = await mcp.refresh(typeof serverArg === "string" && serverArg.length > 0 ? serverArg : undefined);
-                    const lines = [];
-                    let changed = false;
-                    let anyActiveFailure = false;
-                    for (const r of results) {
-                        if (r.status !== "refreshed" || r.tools === undefined) {
-                            lines.push(`${r.server}: ${r.status}${r.error !== undefined ? ` (${r.error})` : ""}`);
-                            if (r.status === "failed")
-                                anyActiveFailure = true;
-                            continue;
-                        }
-                        const excludedSet = new Set(toolFaceSnapshot.exclude ?? []);
-                        const pushable = r.tools.filter((t) => !excludedSet.has(t.name));
-                        const excludedNow = r.tools.filter((t) => excludedSet.has(t.name)).map((t) => t.name);
-                        const domainSnapshot = (m) => new Map([...m].filter(([name]) => name.startsWith(r.prefix)));
-                        const restoreDomain = (m, snap) => {
-                            for (const name of [...m.keys()])
-                                if (name.startsWith(r.prefix))
-                                    m.delete(name);
-                            for (const [name, v] of snap)
-                                m.set(name, v);
-                        };
-                        const priorDomainEffects = domainSnapshot(toolEffects);
-                        const priorDomainNegatives = domainSnapshot(axisExplicitNegatives);
-                        for (const name of priorDomainEffects.keys())
-                            toolEffects.delete(name);
-                        for (const name of priorDomainNegatives.keys())
-                            axisExplicitNegatives.delete(name);
-                        try {
-                            foldProtocolAxes((r.axes ?? []).filter((a) => !excludedSet.has(a.name)), "MCP");
-                        }
-                        catch (foldErr) {
-                            restoreDomain(toolEffects, priorDomainEffects);
-                            restoreDomain(axisExplicitNegatives, priorDomainNegatives);
-                            lines.push(`${r.server}: failed (${foldErr instanceof Error ? foldErr.message : String(foldErr)})`);
-                            anyActiveFailure = true;
-                            continue;
-                        }
-                        let domainAnchor = -1;
-                        for (let i = tools.length - 1; i >= 0; i--) {
-                            const t = tools[i];
-                            if (t.name.startsWith(r.prefix)) {
-                                domainAnchor = i;
-                                tools.splice(i, 1);
-                            }
-                        }
-                        const refreshedMounts = pushable.map((t) => remoteToolOffload(t));
-                        if (domainAnchor >= 0)
-                            tools.splice(domainAnchor, 0, ...refreshedMounts);
-                        else
-                            tools.push(...refreshedMounts);
-                        changed = true;
-                        const detail = [];
-                        const shownAdded = r.added.filter((n) => !excludedSet.has(n));
-                        if (shownAdded.length > 0)
-                            detail.push(`added: ${shownAdded.join(", ")}`);
-                        if (r.removed.length > 0)
-                            detail.push(`removed: ${r.removed.join(", ")}`);
-                        if (excludedNow.length > 0)
-                            detail.push(`excluded by deployment config (not mounted): ${excludedNow.join(", ")}`);
-                        if ((r.dropped?.length ?? 0) > 0)
-                            detail.push(`dropped: ${r.dropped.map((d) => `${d.tool} (${d.reason.length > 90 ? `${d.reason.slice(0, 90)}…` : d.reason})`).join("; ")}`);
-                        lines.push(`${r.server}: refreshed — ${pushable.length} tool${pushable.length === 1 ? "" : "s"}${detail.length > 0 ? ` (${detail.join("; ")})` : ""}`);
-                    }
-                    if (changed)
-                        await rebuildHarnessToolsRef.current?.();
-                    if (changed && !toolCallGateArmedRef.armed && (irreversibleTools.size > 0 || egressTools.size > 0)) {
-                        lines.push("WARNING: refreshed tools declare irreversible/egress safety hints, but this task started with no approval gate registered (no policy/hooks and no gated tools at start) — these hints cannot arm a gate mid-task (RB-46); the refreshed tools run ungated on this deployment shape.");
-                    }
-                    const text = lines.length === 0 ? "No connected MCP servers to refresh." : lines.join("\n");
-                    return {
-                        content: [{ type: "text", text }],
-                        details: { results },
-                        terminate: false,
-                        ...(anyActiveFailure && !changed ? { isError: true } : {}),
-                    };
-                },
-            });
-            toolEffects.set("RefreshMcpTools", "read");
-        }
-        const foldProtocolAxes = (axes, protocolLabel) => {
-            for (const axis of axes) {
-                if (axis.irreversibility === "always") {
-                    irreversibilityTier.set(axis.name, "always");
-                    irreversibleTools.add(axis.name);
-                }
-                if (axis.irreversibility === "never") {
-                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), irreversible: false });
-                }
-                if (axis.egress === false) {
-                    axisExplicitNegatives.set(axis.name, { ...axisExplicitNegatives.get(axis.name), egress: false });
-                }
-                if (axis.egress) {
-                    if (axis.effect !== undefined && axis.effect !== "write") {
-                        const e = new Error(`${protocolLabel} tool "${axis.name}" resolves to egress:true with effect:"${axis.effect}" — an egress tool (external write) must have effect:"write". Clear egress (toolAxes egress:false) if it is a pure read, or set effect:"write".`);
-                        e.code = "config.egress_requires_write_effect";
-                        throw e;
-                    }
-                    egressTools.add(axis.name);
-                }
-                if (!toolEffects.has(axis.name))
-                    toolEffects.set(axis.name, axis.effect ?? "write");
-            }
-        };
-        foldProtocolAxes(mcp.toolAxes, "MCP");
-        a2a = spec.a2a?.length
-            ? await materializeA2aTools(spec.a2a, spec.principal, abortController.signal)
-            : { tools: [], toolAxes: [], warnings: [], statuses: [], refresh: async () => [], dispose: async () => { } };
-        for (const w of a2a.warnings)
-            deps.onError?.(w, { phase: "a2a", sessionId });
-        {
-            const callerNames = new Set((spec.tools ?? []).flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-            const clash = a2a.tools.find((t) => callerNames.has(t.name));
-            if (clash) {
-                await a2a.dispose();
-                await mcp.dispose();
-                const e = new Error(`Tool name "${clash.name}" is reserved by an injected A2A tool — a caller tool of the same name would silently shadow it.`);
+        const outputRef = {};
+        if (resume?.seed.outputRef) {
+            outputRef.value = resume.seed.outputRef.value;
+            outputRef.set = resume.seed.outputRef.set;
+        }
+        if (spec.outputSchema) {
+            if ((spec.tools ?? []).some((t) => t.name === OUTPUT_TOOL_NAME)) {
+                const e = new Error(`Tool name "${OUTPUT_TOOL_NAME}" is reserved when TaskSpec.outputSchema is set.`);
                 e.code = "config.reserved_tool_name";
                 throw e;
             }
+            const compiled = compileOutputSchema(spec.outputSchema);
+            if ("error" in compiled) {
+                const e = new Error(`TaskSpec.outputSchema is not a valid JSON Schema: ${compiled.error}`);
+                e.code = "config.invalid_output_schema";
+                throw e;
+            }
+            if (!compiled.strict) {
+                try {
+                    onceLedger.onError(new Error(`structured-output: strict schema derivation fell back to non-strict (${compiled.fallbackReason}) — the schema is served to the model as-is`), { phase: "config", sessionId });
+                }
+                catch {
+                }
+            }
+            tools.push(createOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
         }
-        tools.push(...a2a.tools.map((t) => remoteToolOffload(t)));
-        foldProtocolAxes(a2a.toolAxes, "A2A");
+        const { mcp, a2a, rebuildHarnessToolsRef, contentOriginWrapRef, toolCallGateArmedRef } = await prepareProtocolTools({ lockedPreflight, spec, deps, reminderMark, reminderDisclosureCounts, runId, sessionId, onceLedger, tools, remoteToolOffload, toolFaceSnapshot, toolEffects, axisExplicitNegatives, irreversibilityTier, irreversibleTools, egressTools, abortController, rollback });
         const callIssuedAtRef = {};
         const memoryWriteGateRef = {};
         const handsReadFaceInput = { handsEnabled, executionEnv, taskRootFinal, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGateRef, firstPartyOffload, tools, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, ...(restoredFilePaths.length > 0 ? { restoredFilePaths } : {}) };
@@ -2365,191 +974,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         handsLessResolvedFace = handsReadFace.handsLessResolvedFace;
         shellGatedBash = handsReadFace.shellGatedBash;
         shellGatedMonitor = handsReadFace.shellGatedMonitor;
-        const delegationSurfaceActive = backgroundTaskToolsActive || workflowToolsActive;
-        if (delegationSurfaceActive || internals?.parentNotify !== undefined || peerLaneActive) {
-            if (delegationSurfaceActive) {
-                toolEffects.set("TaskOutput", "read");
-                toolEffects.set("TaskStop", "write");
-                tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore, notificationWired: internals?.onTaskNotification !== undefined, oneShot: spec.oneShot, toolResultStore: offloadStore })), firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore, agentStore: deps.backgroundAgentStore })));
-            }
-            if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
-                toolEffects.set(SEND_MESSAGE_TOOL_NAME, "write");
-                axisExplicitNegatives.set(SEND_MESSAGE_TOOL_NAME, { ...axisExplicitNegatives.get(SEND_MESSAGE_TOOL_NAME), egress: false });
-                const delegationForRevive = (spec.tools ?? []).find((t) => t.agentListing !== undefined);
-                const reviveSpawn = deps.backgroundAgentStore !== undefined && deps.mailboxStore !== undefined ? buildTier3ReviveSpawn(delegationForRevive, enrichSpecToolCtx) : undefined;
-                tools.push(firstPartyOffload(createSendMessageTool({
-                    runner: runnerSelf,
-                    registry: defaultTaskRegistry,
-                    ...(subagentRetain ? { retain: subagentRetain } : {}),
-                    owner: hostTaskId,
-                    scope: taskScope,
-                    ...(sessionId !== undefined ? { sessionId } : {}),
-                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}), ...(spec.oneShot !== undefined ? { oneShot: spec.oneShot } : {}), retrievalToolMounted: delegationSurfaceActive,
-                    ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
-                    ...(internals?.parentNotify !== undefined
-                        ? { uplink: internals.parentNotify, ...(internals.parentPeerRef !== undefined ? { uplinkRecipient: internals.parentPeerRef } : {}) }
-                        : {}),
-                    ...(internals?.explicitAgentName !== undefined ? { senderName: internals.explicitAgentName } : {}),
-                    ...(internals?.parentRetainLedger !== undefined ? { siblingRetain: internals.parentRetainLedger } : {}),
-                    ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
-                    ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),
-                    enrichCtx: enrichSpecToolCtx,
-                    ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}),
-                    ...(deps.peerAdmission !== undefined ? { admission: deps.peerAdmission } : {}),
-                    ...(deps.onNotice !== undefined ? { onNotice: deps.onNotice } : {}),
-                    ...(internals?.peerSelfRef !== undefined ? { peerSelf: internals.peerSelfRef } : {}),
-                    ...(internals?.peerInboundChainRef !== undefined ? { peerInbound: internals.peerInboundChainRef } : {}),
-                    ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
-                    ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
-                    ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
-                    ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
-                    ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) }) : {}),
-                    onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
-                    onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
-                        code: "delegation.transcript_integrity",
-                        message: `delegation transcript integrity: agent ${handle}'s durable row binds a transcript session the session store attests is gone — the declared transcript durability is being contradicted (check the session store wiring/retention)`,
-                        detail: { handle, ...(scope !== undefined ? { scope } : {}) },
-                    }),
-                })));
-                if (delegationSurfaceActive && !(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
-                    tools.push(firstPartyOffload(createAgentTranscriptTool({
-                        runner: runnerSelf,
-                        registry: defaultTaskRegistry,
-                        agentStore: deps.backgroundAgentStore,
-                        owner: hostTaskId,
-                        scope: taskScope,
-                        ...(sessionId !== undefined ? { sessionId } : {}),
-                        enrichCtx: enrichSpecToolCtx,
-                        onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
-                            code: "delegation.transcript_integrity",
-                            message: `delegation transcript integrity: agent ${handle}'s durable row binds a transcript session the session store attests is gone — the declared transcript durability is being contradicted (check the session store wiring/retention)`,
-                            detail: { handle, ...(scope !== undefined ? { scope } : {}) },
-                        }),
-                    })));
-                }
-            }
-        }
-        const listAgents = peerLaneActive && peerSendMessageBuiltIn && listAgentsMountable({ exclude: toolFaceSnapshot.exclude, specTools: spec.tools ?? [] }) ? mountListAgents({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, hostTaskId, ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}), ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}), registry: defaultTaskRegistry, ...(deps.rosterStore !== undefined ? { roster: deps.rosterStore } : {}), specTools: spec.tools ?? [], toolEffects }) : undefined;
-        if (listAgents !== undefined)
-            tools.push(firstPartyOffload(listAgents));
-        if (backgroundTaskToolsActive) {
-            toolEffects.set("Monitor", "write");
-            envHandToolNames.add("Monitor");
-            tools.push(firstPartyOffload(createMonitorTool(executionEnv, {
-                registry: defaultTaskRegistry,
-                owner: hostTaskId,
-                scope: taskScope,
-                ...(sessionId !== undefined ? { sessionId } : {}),
-                ...(internals?.onTaskNotification !== undefined ? { onTaskNotification: internals.onTaskNotification } : {}),
-                ...(handsCwdRef !== undefined ? { cwdRef: handsCwdRef } : {}),
-                ...(offloadStore !== undefined ? { toolResultStore: offloadStore } : {}),
-                ...(spec.retainBackgroundProcesses === true ? { retainBackgroundProcesses: true } : {}),
-            })));
-        }
-        if (handsCwdRef !== undefined) {
-            toolEffects.set("EnterWorktree", "write");
-            toolEffects.set("ExitWorktree", "write");
-            worktreeSessionRef = {
-                ...(resume?.seed.activeWorktree
-                    ? {
-                        current: {
-                            ...resume.seed.activeWorktree,
-                            worktreeDir: rebaseRestoredPath(resume.seed.activeWorktree.worktreeDir),
-                            originalCwd: rebaseRestoredPath(resume.seed.activeWorktree.originalCwd),
-                        },
-                    }
-                    : wsSnapshot?.activeWorktree !== undefined
-                        ? {
-                            current: {
-                                ...wsSnapshot.activeWorktree,
-                                worktreeDir: rebaseWsPath(wsSnapshot.activeWorktree.worktreeDir),
-                                originalCwd: rebaseWsPath(wsSnapshot.activeWorktree.originalCwd),
-                            },
-                        }
-                        : {}),
-            };
-            if (workspaceStateSettle !== undefined)
-                workspaceStateSettle.restoredWorktreeDir = worktreeSessionRef.current?.worktreeDir;
-            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootFinal, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => (envHandToolNames.add(t.name), firstPartyOffload(t))));
-        }
-        if (offloadStore)
-            tools.push(createReadToolResultTool(offloadStore));
-        const onQuestion = frozenOnQuestion;
-        const liveQuestionFace = isLiveQuestionFace(onQuestion) ? onQuestion : undefined;
-        const contentAskBindings = new Map();
-        const CONTENT_ASK_BINDING_CAP = 32;
-        const checkpointStore = resolveCheckpointStore(spec, deps);
-        const questionParkStoreWired = checkpointStore !== undefined;
-        const questionDurableMandateBinding = runtimeCaps?.forceDurableGate === true && questionParkStoreWired;
-        const contentAskRoutable = (toolCallId) => liveQuestionFace !== undefined &&
-            mountedQuestionTool !== undefined &&
-            tools.includes(mountedQuestionTool) &&
-            !questionDurableMandateBinding &&
-            !inheritedUnavailableAsks.has(toolCallId);
-        const lateStrandedAnswers = [];
-        const discloseStrandedAnswers = (records, why) => {
-            if (records.length === 0)
-                return;
-            try {
-                deps.onError?.(new Error(`AskUserQuestion: ${records.length} question(s) were answered by a person but the call never ` +
-                    `executed to collect the answer (${records.map((r) => `${r.toolCallId} [delivery ${r.deliveryId}]`).join(", ")}) — ${why}. The answer(s) were NOT ` +
-                    `delivered to the model and are gone with this leg; re-ask if the decision is still needed.`), { phase: "degraded", sessionId, classification: "unconsumed-human-answer" });
-            }
-            catch {
-            }
-        };
-        const settleContentAskBindings = () => {
-            const stranded = [];
-            for (const [callId, bound] of contentAskBindings) {
-                if (bound.kind === "answered")
-                    stranded.push({ deliveryId: bound.deliveryId, toolCallId: callId });
-            }
-            contentAskBindings.clear();
-            discloseStrandedAnswers(stranded, "the leg ended first (abort, batch teardown, or a loop failure)");
-            const byDelivery = new Map();
-            for (const r of [...stranded, ...lateStrandedAnswers])
-                byDelivery.set(r.deliveryId, r);
-            return [...byDelivery.values()];
-        };
-        const durableQuestionFace = questionParkStoreWired && (spec.durableApproval !== undefined || runtimeCaps?.forceDurableGate === true);
-        const mountedQuestionFace = liveQuestionFace !== undefined
-            ? async (req, signal) => {
-                const bound = contentAskBindings.get(req.toolCallId);
-                if (bound !== undefined) {
-                    if (bound.questionsHash === boundInputHashOf(req.questions)) {
-                        contentAskBindings.delete(req.toolCallId);
-                        if (bound.kind === "answered")
-                            return bound.answer;
-                        throw bound.error;
-                    }
-                    contentAskBindings.delete(req.toolCallId);
-                }
-                return liveQuestionFace(req, signal);
-            }
-            : onQuestion;
-        const questionToolMounted = spec.interactiveTools === true || (spec.interactiveTools !== false && (onQuestion !== undefined || durableQuestionFace));
-        let mountedQuestionTool;
-        if (questionToolMounted)
-            tools.push((mountedQuestionTool =
-                createAskUserQuestionTool(mountedQuestionFace, { principal: spec.principal, sourceTaskId: sessionId }, {
-                    ...(resume?.redeemedContentAskCallId !== undefined
-                        ? {
-                            redeemedApprovalCallId: resume.redeemedContentAskCallId,
-                            ...(resume.redeemedContentAskQuestionsHash !== undefined ? { redeemedApprovalQuestionsHash: resume.redeemedContentAskQuestionsHash } : {}),
-                        }
-                        : {}),
-                    ...(resolvedInteractionPosture !== undefined ? { posture: resolvedInteractionPosture } : {}),
-                    ...(spec.interactiveQuestionFallback === true ? { interactiveFallback: true } : {}),
-                    onSyntheticContinuation: ({ questionId, reason }) => {
-                        deps.onError?.(new Error(`AskUserQuestion ${questionId}: no human answer was obtainable (` +
-                            (reason === "seam_absent"
-                                ? "no onQuestion seam is wired"
-                                : reason === "declined_unavailable"
-                                    ? "the wired question channel reported nobody was reachable"
-                                    : "the wired question channel failed") +
-                            `) — the model was instructed to self-answer and the run CONTINUES (warning, not a failure).`), { phase: "degraded", sessionId, classification: "no-human-autoanswered" });
-                    },
-                })));
+        const { worktreeSessionRef } = prepareDelegationSurface({ spec, deps, internals, resume, sessionId, hostTaskId, taskScope, taskRootFinal, executionEnv, runnerSelf, backgroundTaskToolsActive, workflowToolsActive, peerLaneActive, peerSendMessageBuiltIn, peerLaneRefs, tools, toolEffects, axisExplicitNegatives, envHandToolNames, toolFaceSnapshot, firstPartyOffload, offloadStore, subagentRetain, enrichSpecToolCtx, handsCwdRef, wsSnapshot, rebaseWsPath, rebaseRestoredPath, workspaceStateSettle });
+        const { checkpointStore, liveQuestionFace, contentAskBindings, contentAskRoutable, lateStrandedAnswers, discloseStrandedAnswers, settleContentAskBindings, durableQuestionFace, questionToolMounted, mountedQuestionTool } = prepareQuestionFace({ frozenOnQuestion, spec, deps, runtimeCaps, resolvedInteractionPosture, resume, sessionId, tools, inheritedUnavailableAsks: () => inheritedUnavailableAsks });
         if (spec.handsReadOnly !== true) {
             const sessionScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
             tools.push(...createSchedulerTools(executionEnv, {
@@ -2567,27 +993,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
                 `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
         }
-        const lspManager = spec.lspManager ?? deps.lspManager;
-        if (lspManager) {
-            const lspRoot = taskRootFinal;
-            tools.push(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }));
-            envHandToolNames.add("LSP");
-        }
-        const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
-            ? lspManager.diagnostics
-            : undefined;
-        const lspRunIdent = sessionId;
-        const nudgeLspOnEdit = lspDiagnostics
-            ? (rawPath) => {
-                const baseDir = handsCwdRef?.current ?? taskRootFinal;
-                const filePath = resolveLspPath(rawPath, baseDir);
-                lspDiagnostics.fileEdited(lspRunIdent, pathToUri(filePath));
-                void lspManager
-                    .sessionFor(filePath, undefined, executionEnv)
-                    .then((session) => session?.notifyFileChanged?.(filePath))
-                    .catch(() => undefined);
-            }
-            : undefined;
+        const { lspDiagnostics, nudgeLspOnEdit, lspRunIdent } = prepareLsp({ spec, deps, executionEnv, taskRootFinal, handsEnabled, sessionId, handsCwdRef, tools, envHandToolNames });
         const memoryPairNameDomain = new Set();
         for (const t of tools) {
             memoryPairNameDomain.add(t.name);
@@ -2679,7 +1085,6 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     live.incomplete = true;
             }
         }
-        let memoryBlock = memoryBlockFromEngine;
         if (memorySeedFiles?.length && seedContextFiles) {
             try {
                 await seedContextFiles(memorySeedFiles);
@@ -2688,366 +1093,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
             }
         }
-        let instructionSources;
-        let projectInstructionContent;
-        if (deps.loadProjectMemory) {
-            let projectMemoryPhase = spec.sessionId ? "resume" : "fresh";
-            if (spec.sessionId) {
-                try {
-                    const branch = await session.getBranch();
-                    const hasConversation = hasConversationContent(branch);
-                    if (!hasConversation)
-                        projectMemoryPhase = "fresh";
-                    else {
-                        for (let i = branch.length - 1; i >= 0; i--) {
-                            const e = branch[i];
-                            if (e.type === "compaction") {
-                                projectMemoryPhase = "post-compact";
-                                break;
-                            }
-                            if (e.type === "message" && e.message.role === "user")
-                                break;
-                        }
-                    }
-                }
-                catch {
-                }
-            }
-            let loaded = null;
-            try {
-                loaded = await Promise.resolve(deps.loadProjectMemory({
-                    cwd: taskRootFinal,
-                    handsEnabled,
-                    isSubagent: delegation.isNonForkChild,
-                    ...(internals?.agentName ? { agentName: internals.agentName } : {}),
-                    sessionId,
-                    phase: projectMemoryPhase,
-                }));
-            }
-            catch (err) {
-                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-            }
-            const projectMem = loaded !== null && typeof loaded === "object" ? loaded.content : loaded;
-            const seededFiles = loaded !== null && typeof loaded === "object" ? loaded.seededFiles : undefined;
-            const declaredSources = loaded !== null && typeof loaded === "object" ? loaded.instructionSources : undefined;
-            if (declaredSources !== undefined && declaredSources.length > 0)
-                instructionSources = declaredSources;
-            if (seededFiles?.length && seedContextFiles) {
-                try {
-                    await seedContextFiles(seededFiles);
-                }
-                catch (err) {
-                    deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
-                }
-            }
-            if (projectMem != null && projectMem.trim()) {
-                projectInstructionContent = projectMem;
-                const projectBlock = `${PROJECT_CONTEXT_FRAMING}\n\n${composeMemoryBlock(projectMem, "project")}`;
-                memoryBlock = memoryBlock ? `${memoryBlock}\n\n${projectBlock}` : projectBlock;
-            }
-        }
-        const declaredSkillRank = new Map();
-        for (const s of spec.skills ?? [])
-            if (!declaredSkillRank.has(s.name))
-                declaredSkillRank.set(s.name, declaredSkillRank.size);
-        const skillSpecs = normalizeSkills(spec.skills ?? []).filter((s) => {
-            if (s.content.length <= SKILL_CONTENT_MAX_CHARS)
-                return true;
-            deps.onError?.(new Error(`Skill "${s.name}" content is ${s.content.length} chars, over the ${SKILL_CONTENT_MAX_CHARS}-char load limit — skill not loaded (skills are never truncated; shrink the body or move material to attachments/files).`), { phase: "config", sessionId });
-            return false;
-        });
-        const inheritedFrames = internals?.inheritedManifestScope ?? [];
-        for (const frame of inheritedFrames) {
-            skillScope.push(frame);
-        }
-        const hasSkillManifest = skillSpecs.some((s) => s.manifest !== undefined) || inheritedFrames.length > 0;
-        if (skillSpecs.length > 0) {
-            if (tools.some((t) => t.name === SKILL_TOOL_NAME)) {
-                const e = new Error(`Tool name "${SKILL_TOOL_NAME}" is reserved when spec.skills is present.`);
-                e.code = "config.reserved_tool_name";
-                throw e;
-            }
-            tools.push(createSkillTool(skillSpecs, skillScope));
-        }
-        const sharedMemoryProvider = deps.sharedMemoryStores;
-        let sharedMemoryPairMounted = false;
-        if (sharedMemoryProvider !== undefined) {
-            const excluded = new Set(toolFaceSnapshot.exclude ?? []);
-            const mountedNameDomain = new Set();
-            for (const t of tools) {
-                mountedNameDomain.add(t.name);
-                for (const alias of t.aliases ?? [])
-                    mountedNameDomain.add(alias);
-            }
-            const excludedName = SHARED_MEMORY_TOOL_NAMES.find((n) => excluded.has(n));
-            const occupiedName = SHARED_MEMORY_TOOL_NAMES.find((n) => mountedNameDomain.has(n));
-            if (excludedName !== undefined || occupiedName !== undefined) {
-                deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: ` +
-                    (excludedName !== undefined
-                        ? `excludeTools removes "${excludedName}"`
-                        : `this task already declares a tool named "${occupiedName}" (the built-in yields to it)`) +
-                    " — the pair mounts together or not at all."), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
-            }
-            else {
-                tools.push(...createSharedMemoryTools({
-                    provider: sharedMemoryProvider,
-                    context: { sessionId, taskId: hostTaskId, ...(spec.principal !== undefined ? { principal: spec.principal } : {}) },
-                }).map((s) => defineTool(s)));
-                sharedMemoryPairMounted = true;
-            }
-        }
-        let memoryEnginePairMounted = false;
-        if (memoryTools !== undefined && memoryTools.length > 0) {
-            tools.push(...memoryTools.map((s) => defineTool(s)));
-            memoryEnginePairMounted = true;
-        }
-        else if (memoryEngineSession !== undefined && !memorySearchToolsPlanned) {
-            deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: ` +
-                (memoryPairExcludedName !== undefined
-                    ? `excludeTools removes "${memoryPairExcludedName}"`
-                    : `this task already declares a tool named "${memoryPairOccupiedName}" (the built-in yields to it)`) +
-                " — these tools mount together or not at all."), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
-        }
-        const skillsListing = skillSpecs.length > 0
-            ? {
-                entries: skillSpecs.map((s) => ({
-                    name: s.name,
-                    description: s.description,
-                    ...(s.files !== undefined ? { files: s.files.map((f) => ({ path: f.path })) } : {}),
-                    ...(declaredSkillRank.get(s.name) !== undefined ? { declaredRank: declaredSkillRank.get(s.name) } : {}),
-                })),
-                seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
-            }
-            :
-                (resume?.seed.announcedListings?.skills?.length ?? 0) > 0 || spec.sessionId !== undefined
-                    ?
-                        { entries: [], seedAnnounced: true }
-                    : undefined;
-        const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
-        const promptPolicyEnabled = Boolean(lockedPreflight.toolPolicy);
-        const promptHooks = spec.hooks ?? deps.hooks;
-        const promptHooksEnabled = Boolean(promptHooks?.preToolUse || promptHooks?.postToolUse);
-        const failClosedReason = selfOrchestrationFailClosedReason(spec, deps);
-        if (failClosedReason) {
-            deps.onError?.(new Error(failClosedReason), { phase: "config", sessionId });
-        }
-        const featureFlags = {
-            policyEnabled: promptPolicyEnabled,
-            hooksEnabled: promptHooksEnabled,
-            isolationEnabled: isIsolated(executionEnv),
-            reminderMark,
-            readFaceOpen: resolvedReadFace === "open",
-            orchestrationEnabled: selfOrchestrationActive,
-            orchestrationDeferred: selfOrchestrationActive && (toolFaceSnapshot.defer?.includes("Workflow") ?? false),
-            promptProfile,
-            fableMitigations,
-            goalEnabled: internals?.goalMode === true,
-            awarenessEnabled: thinking !== undefined && ULTRA_REASONING_TIERS.has(thinking),
-            worktreeIsolated: internals?.isolation === "worktree" && ownedEnv !== undefined,
-            withinTaskCompactionEnabled: (spec.compaction?.enabled ?? true) && (spec.compaction?.withinTask ?? true),
-            isSubagent: delegation.isNonForkChild,
-        };
-        const userSystemPrompt = spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals?.defaultSystemPrompt;
-        const userAppendSystemPrompt = spec.appendSystemPrompt;
-        const mcpInstructionsBlock = mcp.serverInstructions.length
-            ? `# MCP Server Instructions\n${mcp.serverInstructions.map((s) => fenceMcpServerInstructions(s.server, s.text)).join("\n\n")}`
-            : undefined;
-        const userTz = spec.clientContext?.timeZone;
-        const tzValid = userTz !== undefined && isValidTimeZone(userTz);
-        const envFacts = { date: formatLocalDate(new Date(), tzValid ? userTz : undefined), modelId: model.id };
-        if (tzValid)
-            envFacts.timeZone = userTz;
-        if (spec.clientContext?.userEmail)
-            envFacts.userEmail = spec.clientContext.userEmail;
-        const declaredCutoff = deps.modelKnowledgeCutoffs?.[model.id];
-        if (declaredCutoff)
-            envFacts.knowledgeCutoff = declaredCutoff;
-        if (spec.envFacts?.profile)
-            envFacts.sandboxProfile = spec.envFacts.profile;
-        if (spec.envFacts?.capabilities && spec.envFacts.capabilities.length > 0)
-            envFacts.sandboxCapabilities = [...spec.envFacts.capabilities];
-        if (spec.envFacts?.pkgSource)
-            envFacts.sandboxPkgSource = spec.envFacts.pkgSource;
-        if (spec.envFacts?.egress === "none" || spec.envFacts?.egress === "allowlist" || spec.envFacts?.egress === "full")
-            envFacts.sandboxEgress = spec.envFacts.egress;
-        if (spec.envFacts?.scratchpadDir)
-            envFacts.scratchpadDir = spec.envFacts.scratchpadDir;
-        if (externalContentTargetActive)
-            envFacts.externalContentTarget = true;
-        if (resume !== undefined && spec.envFacts?.resumeFacts) {
-            const rf = spec.envFacts.resumeFacts;
-            const copy = {};
-            if (rf.processes === "preserved" || rf.processes === "lost")
-                copy.processes = rf.processes;
-            if (rf.scratch === "preserved" || rf.scratch === "lost")
-                copy.scratch = rf.scratch;
-            if (typeof rf.note === "string" && rf.note.length > 0)
-                copy.note = rf.note;
-            if (Object.keys(copy).length > 0)
-                envFacts.resumeFacts = copy;
-        }
-        if (handsEnabled) {
-            envFacts.cwd = taskRootFinal;
-            if (additionalRootsCanonical.length > 0) {
-                envFacts.additionalDirectories = [...additionalRootsCanonical];
-            }
-            if (resolvedReadFace !== undefined)
-                envFacts.readFace = resolvedReadFace;
-            if (additionalReadRootsCanonical.length > 0) {
-                envFacts.additionalReadDirectories = [...additionalReadRootsCanonical];
-            }
-            try {
-                const probe = await executionEnv.exec('uname -s; uname -r; (git rev-parse --is-inside-work-tree 2>/dev/null || echo false); (git symbolic-ref --short -q HEAD 2>/dev/null || echo "HEAD (detached)"); (git rev-parse --show-toplevel 2>/dev/null || echo); (test -n "$(git status --porcelain 2>/dev/null | head -1)" && echo dirty || echo clean); (s=$(ps -p $$ -o comm= 2>/dev/null); s=${s##*/}; echo "${s#-}"); (test "$(git rev-parse --git-dir 2>/dev/null)" != "$(git rev-parse --git-common-dir 2>/dev/null)" && echo linked || echo main); (pwd -P 2>/dev/null || pwd)', { cwd: envFacts.cwd, timeout: 10 });
-                if (probe.ok && probe.value.exitCode === 0) {
-                    const lines = probe.value.stdout.split("\n");
-                    if (lines.length >= 6) {
-                        const [osName, osVer, git, branch, worktreeRoot, dirty] = lines;
-                        if (osName?.trim())
-                            envFacts.platform = osName.trim();
-                        if (osVer?.trim())
-                            envFacts.osVersion = osVer.trim();
-                        envFacts.isGitRepo = (git ?? "").trim() === "true";
-                        if (envFacts.isGitRepo) {
-                            const b = (branch ?? "").trim();
-                            if (b)
-                                envFacts.gitBranch = b;
-                            const root = (worktreeRoot ?? "").trim();
-                            if (root)
-                                envFacts.gitWorktreeRoot = root;
-                            const d = (dirty ?? "").trim();
-                            if (d === "dirty" || d === "clean")
-                                envFacts.gitDirty = d === "dirty";
-                        }
-                        const sh = (lines[6] ?? "").trim();
-                        if (sh)
-                            envFacts.shell = sh;
-                        if (envFacts.isGitRepo && (lines[7] ?? "").trim() === "linked")
-                            envFacts.isLinkedWorktree = true;
-                        const probedPwd = (lines[8] ?? "").trim();
-                        if (probedPwd && envFacts.cwd && probedPwd !== envFacts.cwd) {
-                            const canonOf = async (p) => {
-                                try {
-                                    const c = await executionEnv.canonicalPath(p);
-                                    return c.ok ? c.value : p;
-                                }
-                                catch {
-                                    return p;
-                                }
-                            };
-                            const canonicalProbed = await canonOf(probedPwd);
-                            if (canonicalProbed !== (await canonOf(envFacts.cwd))) {
-                                try {
-                                    deps.onError?.(new Error(`execution-env cwd misalignment: task root is "${envFacts.cwd}" but the env's shell reports pwd "${canonicalProbed}" — per-exec cwd injection may be ignored on this lane (execs/artifacts can land outside the workspace root)`), { phase: "config", sessionId });
-                                }
-                                catch {
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-            catch {
-            }
-        }
-        const gitStatusRef = await probeGitStatusLane({
-            executionEnv,
-            envFacts,
-            handsEnabled,
-            taskRoot: taskRootFinal,
-            onDegrade: (reason) => deps.onError?.(new Error(`env git snapshot degraded — ${reason}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" }),
-        });
-        if (toolFaceSnapshot.exclude !== undefined && toolFaceSnapshot.exclude.length > 0) {
-            const excluded = new Set(toolFaceSnapshot.exclude);
-            for (let i = tools.length - 1; i >= 0; i--)
-                if (excluded.has(tools[i].name))
-                    tools.splice(i, 1);
-        }
-        if (handsEnabled) {
-            const fullShellOnRoster = tools.some((t) => t.name === "Bash" && getToolContract(t, "core").contractId === FULL_SHELL_CONTRACT_ID);
-            if (fullShellOnRoster !== fullShellReachable) {
-                const e = new Error(`internal invariant: fullShellReachable=${String(fullShellReachable)} but the post-exclusion roster ` +
-                    `${fullShellOnRoster ? "carries" : "does not carry"} the full shell (${FULL_SHELL_CONTRACT_ID}). ` +
-                    `A new roster-affecting mechanism was added without updating the predicate.`);
-                e.code = "internal.full_shell_reachable_mismatch";
-                throw e;
-            }
-        }
-        if (promptProfile === "classic") {
-            for (let i = 0; i < tools.length; i++) {
-                const t = tools[i];
-                if (t.descriptionClassic !== undefined)
-                    tools[i] = { ...t, description: t.descriptionClassic };
-            }
-        }
-        const userToolNames = (spec.tools ?? []).map((t) => t.name);
-        const protocolToolNames = [...mcp.tools.map((t) => t.name), ...a2a.tools.map((t) => t.name)];
-        const mcpAlwaysLoadNames = mcp.tools
-            .filter((t) => t.mcpAlwaysLoad === true && !(toolFaceSnapshot.defer ?? []).includes(t.name))
-            .map((t) => t.name);
-        const classifyDeferredOverFace = (face, builtinDeferNames) => {
-            const deferredSet = classifyDeferred({
-                specs: spec.tools ?? [],
-                protocolToolNames,
-                fullTools: face.filter((t) => userToolNames.includes(t.name) || protocolToolNames.includes(t.name)),
-                deferMode: deps.deferMode,
-                model,
-                deferNames: [...(toolFaceSnapshot.defer ?? []), ...builtinDeferNames].filter((n) => face.some((t) => t.name === n)),
-                alwaysLoadNames: [
-                    ASK_USER_QUESTION_TOOL_NAME,
-                    ...(toolFaceSnapshot.alwaysLoad ?? []),
-                    ...mcpAlwaysLoadNames,
-                ],
-            });
-            for (const n of [...deferredSet]) {
-                if (!face.some((t) => t.name === n))
-                    deferredSet.delete(n);
-            }
-            return deferredSet;
-        };
-        const sharedMemoryPair = sharedMemoryPairMounted ? SHARED_MEMORY_TOOL_NAMES.filter((n) => tools.some((t) => t.name === n)) : [];
-        const memoryEnginePair = explicitlyDeferredMemoryTrio(memoryEnginePairMounted, tools, toolFaceSnapshot.defer);
-        const builtinDeferPairNames = [...sharedMemoryPair, ...memoryEnginePair];
-        let deferred;
-        if (builtinDeferPairNames.length > 0) {
-            const withoutPairs = tools.filter((t) => !builtinDeferPairNames.some((n) => n === t.name));
-            const d1 = classifyDeferredOverFace(tools, builtinDeferPairNames);
-            const d0 = classifyDeferredOverFace(withoutPairs, []);
-            const soleCause = d0.size === 0 && d1.size > 0;
-            const supportNameTaken = tools.some((t) => t.name === TOOL_SEARCH_NAME || (t.aliases ?? []).includes(TOOL_SEARCH_NAME));
-            if (soleCause && supportNameTaken) {
-                const retractNames = memoryGroupRetractionSet(builtinDeferPairNames, memoryEnginePair.length > 0);
-                for (let i = tools.length - 1; i >= 0; i--) {
-                    if (retractNames.has(tools[i].name))
-                        tools.splice(i, 1);
-                }
-                if (sharedMemoryPair.length > 0) {
-                    sharedMemoryPairMounted = false;
-                    deps.onError?.(new Error(`Shared memory tools ${SHARED_MEMORY_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — the pair mounts together or not at all.`), { phase: "config", sessionId, classification: "shared-memory-not-mounted" });
-                }
-                if (memoryEnginePair.length > 0) {
-                    memoryEnginePairMounted = false;
-                    if (memoryBlock !== undefined && memoryRecallSegment !== undefined) {
-                        const segment = memoryRecallSegment;
-                        if (memoryBlock === segment)
-                            memoryBlock = undefined;
-                        else if (memoryBlock.includes(`\n\n${segment}`))
-                            memoryBlock = memoryBlock.replace(`\n\n${segment}`, "");
-                        else if (memoryBlock.startsWith(`${segment}\n\n`))
-                            memoryBlock = memoryBlock.slice(segment.length + 2);
-                    }
-                    deps.onError?.(new Error(`Memory tools ${MEMORY_ENGINE_TOOL_NAMES.join("/")} were NOT mounted: mounting them would inject ` +
-                        `the "${TOOL_SEARCH_NAME}" tool, whose name this task already declares — these tools mount together or not at all.`), { phase: "config", sessionId, classification: "memory-tools-not-mounted" });
-                }
-                deferred = d0;
-            }
-            else {
-                deferred = d1;
-            }
-        }
-        else {
-            deferred = classifyDeferredOverFace(tools, []);
-        }
+        const projectContext = await prepareProjectContext({ deps, spec, internals, session, sessionId, hostTaskId, taskRootFinal, handsEnabled, delegation, seedContextFiles, memoryBlockFromEngine, skillScope, tools, toolFaceSnapshot, onceLedger, memoryTools, memoryEngineSession, memorySearchToolsPlanned, memoryPairExcludedName, memoryPairOccupiedName, resume });
+        const { memoryBlock: memoryBlockWithProject, instructionSources, projectInstructionContent, hasSkillManifest, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
+        const { provider, featureFlags, userSystemPrompt, userAppendSystemPrompt, mcpInstructionsBlock, envFacts, tzValid, userTz, gitStatusRef } = await preparePromptInputs({ spec, deps, failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, toolFaceSnapshot, promptProfile, fableMitigations, internals, thinking, ownedEnv, delegation, resolvedRole, mcp, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical, sessionId });
+        const { deferred, memoryBlock } = prepareDeferClassify({ spec, deps, tools, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
         const delegationProvenanceChannel = internals?.delegationProvenance;
         if (memoryEngineSession !== undefined || delegationProvenanceChannel !== undefined) {
             const pollution = memoryEngineSession?.pollution;
@@ -3328,10 +1377,10 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         const promptBlocks = assembled.legacyBlocks;
         const collisionAudit = auditToolCollisions(tools);
         for (const y of collisionAudit.yields) {
-            deps.onError?.(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });
+            onceLedger.onError(new Error(`tool mount: caller tool "${y.name}" shadows another tool with the same canonical name (deliberate last-write-wins yield — the later mount serves)`), { phase: "config", sessionId });
         }
         for (const c of collisionAudit.aliasCollisions) {
-            deps.onError?.(new Error(`tool mount: alias "${c.alias}" is claimed by both "${c.owners[0]}" and "${c.owners[1]}" (design/141 warn face — name resolution serves the later mount)`), { phase: "config", sessionId });
+            onceLedger.onError(new Error(`tool mount: alias "${c.alias}" is claimed by both "${c.owners[0]}" and "${c.owners[1]}" (design/141 warn face — name resolution serves the later mount)`), { phase: "config", sessionId });
         }
         const saltedHash = (text) => createHash("sha256").update(PROMPT_HASH_SALT).update(text).digest("hex").slice(0, 12);
         const promptManifest = {
@@ -3365,282 +1414,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 });
             }
         }
-        const activeTools = new Set();
-        const fpRef = {};
-        const turnSnapshotRef = {};
-        let harnessTools = tools;
-        const failedMcpServers = mcp.statuses
-            .filter((s) => s.status === "failed")
-            .map((s) => ({ name: inlineUntrusted(s.name, 160), ...(s.error !== undefined ? { error: inlineUntrusted(s.error, 240) } : {}) }));
-        let toolsDeltaRef;
-        let toolMaterializeStatic = false;
-        let deferDirectCall = false;
-        const staticFaceForRef = {};
-        if (deferred.size > 0 || failedMcpServers.length > 0) {
-            toolsDeltaRef = { pending: [], pendingRemoved: [], pendingReadded: [], pendingFailed: failedMcpServers };
-        }
-        const listingRideRef = {};
-        {
-            const raw = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
-            if (raw !== undefined && raw !== "swap" && raw !== "static" && deferred.size === 0) {
-                const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(raw)} is not "swap" or "static" — inert on this task (no deferred tools), but a deferring task WITHOUT an explicit spec strategy will refuse to prepare under it (an explicit legal spec outranks and discards it, loudly). Fix or unset the flag.`;
-                emitMaterializeEnvNotice(deps.onNotice, line, { raw });
-            }
-        }
-        if (deferred.size > 0) {
-            if (deferred.has(TOOL_SEARCH_NAME) || tools.some((t) => t.name === TOOL_SEARCH_NAME)) {
-                const e = new Error(`Tool name "${TOOL_SEARCH_NAME}" is reserved when deferred tools are present.`);
-                e.code = "config.reserved_tool_name";
-                throw e;
-            }
-            const registry = buildDeferredRegistry(deferred, tools);
-            const rawEnvStrategy = process.env.SEMA_TOOL_MATERIALIZE_STRATEGY;
-            const envStrategyInvalid = rawEnvStrategy !== undefined && rawEnvStrategy !== "swap" && rawEnvStrategy !== "static";
-            if (envStrategyInvalid && spec.toolMaterializeStrategy === undefined) {
-                const e = new Error(`SEMA_TOOL_MATERIALIZE_STRATEGY must be "swap" or "static" (got ${JSON.stringify(rawEnvStrategy)}).`);
-                e.code = "config.tool_materialize_invalid";
-                throw e;
-            }
-            if (envStrategyInvalid) {
-                const line = `SEMA_TOOL_MATERIALIZE_STRATEGY=${JSON.stringify(rawEnvStrategy)} was ignored — not "swap" or "static", and the task spec pins toolMaterializeStrategy=${JSON.stringify(spec.toolMaterializeStrategy)} which outranks it. Fix or unset the env flag.`;
-                emitMaterializeEnvNotice(deps.onNotice, line, { raw: rawEnvStrategy, specStrategy: spec.toolMaterializeStrategy });
-            }
-            const envStrategy = envStrategyInvalid ? undefined : rawEnvStrategy;
-            const requestedStrategy = spec.toolMaterializeStrategy ?? envStrategy ?? "swap";
-            const laneDegrade = requestedStrategy === "static" && spec.deferSelfResolve === false;
-            const materializeStatic = requestedStrategy === "static" && !laneDegrade;
-            toolMaterializeStatic = materializeStatic;
-            deferDirectCall = spec.deferSelfResolve !== false;
-            promptManifest.toolDisclosure = {
-                deferredTools: deferred.size,
-                strategy: materializeStatic ? "static" : "swap",
-                source: laneDegrade ? "degraded_no_direct_lane" : spec.toolMaterializeStrategy !== undefined ? "spec" : envStrategy !== undefined ? "env" : "default",
-            };
-            const everExempt = new Set();
-            const staticFaceFor = (name) => {
-                if (!materializeStatic)
-                    return false;
-                if (everExempt.has(name))
-                    return false;
-                if (staticSchemaRenderable(tools.find((t) => t.name === name)?.parameters))
-                    return true;
-                everExempt.add(name);
-                return false;
-            };
-            staticFaceForRef.current = staticFaceFor;
-            let activationChain = Promise.resolve();
-            const serializeActivation = (section) => {
-                const p = activationChain.then(section);
-                activationChain = p.then(() => undefined, () => undefined);
-                return p;
-            };
-            const directCallFor = (name) => {
-                if (spec.deferSelfResolve === false)
-                    return undefined;
-                const executionMode = tools.find((t) => t.name === name)?.executionMode;
-                return {
-                    resolveReal: () => {
-                        const real = tools.find((t) => t.name === name);
-                        if (real === undefined)
-                            return undefined;
-                        return {
-                            parameters: real.parameters,
-                            invoke: (toolCallId, params, signal, onUpdate) => real.execute(toolCallId, params, signal, onUpdate),
-                        };
-                    },
-                    ...(executionMode !== undefined ? { executionMode } : {}),
-                    staticFace: () => staticFaceFor(name),
-                    activate: async () => serializeActivation(async () => {
-                        if (activeTools.has(name))
-                            return undefined;
-                        activeTools.add(name);
-                        try {
-                            await rematerialize(activeTools);
-                        }
-                        catch (e) {
-                            activeTools.delete(name);
-                            throw e;
-                        }
-                        return listingRideRef.current?.([name]);
-                    }),
-                };
-            };
-            const placeholders = new Map([...registry.values()].map((i) => [i.name, createPlaceholderTool(i, directCallFor(i.name))]));
-            const { messages } = await session.buildContext();
-            for (const n of extractDiscoveredToolNames(messages, registry)) {
-                if (deferred.has(n))
-                    activeTools.add(n);
-            }
-            for (const entry of await session.getBranch()) {
-                if (entry.type !== "compaction" || entry.fromHook === true)
-                    continue;
-                for (const n of readCompactionActiveTools(entry.details)) {
-                    if (deferred.has(n))
-                        activeTools.add(n);
-                }
-            }
-            if (resume) {
-                for (const n of resume.seed.activeTools)
-                    if (deferred.has(n))
-                        activeTools.add(n);
-            }
-            const callableToolNames = () => {
-                const s = new Set(tools.map((t) => t.name));
-                for (const n of deferred)
-                    if (!activeTools.has(n))
-                        s.delete(n);
-                s.add(TOOL_SEARCH_NAME);
-                return s;
-            };
-            offloadReachableToolsRef.current = callableToolNames;
-            let toolSearch;
-            const buildToolList = (active) => {
-                const list = tools.map((t) => (deferred.has(t.name) && (staticFaceFor(t.name) || !active.has(t.name)) ? placeholders.get(t.name) : t));
-                list.push(toolSearch);
-                return list;
-            };
-            const announcedTools = new Set(activeTools);
-            const withdrawnTools = new Set();
-            const deltaRef = toolsDeltaRef;
-            const rematerialize = async (active) => {
-                contentOriginWrapRef.current?.();
-                const list = buildToolList(active);
-                await harnessRef.current.setTools(list, list.map((t) => t.name));
-                if (fpRef.current)
-                    fpRef.current.tools = toolsToFingerprintInputs(list);
-                turnSnapshotRef.current?.refreshTools(toolsToFingerprintInputs(list));
-                const live = new Set(list.map((t) => t.name));
-                for (const n of [...announcedTools]) {
-                    if (!live.has(n)) {
-                        announcedTools.delete(n);
-                        withdrawnTools.add(n);
-                        deltaRef.pendingRemoved.push(n);
-                    }
-                }
-                for (const n of active) {
-                    if (!live.has(n))
-                        continue;
-                    if (!announcedTools.has(n)) {
-                        announcedTools.add(n);
-                        if (withdrawnTools.delete(n))
-                            deltaRef.pendingReadded.push(n);
-                        else
-                            deltaRef.pending.push(n);
-                    }
-                }
-            };
-            rebuildHarnessToolsRef.current = () => rematerialize(activeTools);
-            toolSearch = createToolSearchTool({
-                registry,
-                active: activeTools,
-                rematerialize,
-                listingRide: (newly) => listingRideRef.current?.(newly),
-                mountedNames: callableToolNames,
-                directCallEnabled: spec.deferSelfResolve !== false,
-                isMounted: (name) => tools.some((t) => t.name === name),
-                ...(materializeStatic
-                    ? { staticSchemaFor: (name) => (staticFaceFor(name) ? tools.find((t) => t.name === name)?.parameters : undefined) }
-                    : {}),
-                serializeActivation,
-            });
-            harnessTools = buildToolList(activeTools);
-        }
-        else {
-            rebuildHarnessToolsRef.current = async () => {
-                contentOriginWrapRef.current?.();
-                const list = [...tools];
-                await harnessRef.current.setTools(list, list.map((t) => t.name));
-                if (fpRef.current)
-                    fpRef.current.tools = toolsToFingerprintInputs(list);
-                turnSnapshotRef.current?.refreshTools(toolsToFingerprintInputs(list));
-            };
-        }
-        if (spec.agents !== undefined && spec.agents.length > 0) {
-            const known = new Set(tools.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
-            for (const def of spec.agents) {
-                const unknownAllow = (def.allowTools ?? []).filter((n) => n !== "*" && !known.has(n));
-                if (unknownAllow.length > 0) {
-                    try {
-                        deps.onError?.(new Error(`TaskSpec.agents: agent "${def.name}" allows tool(s) ${unknownAllow.join(", ")} not present in this task's assembled roster — likely a typo (the entry would be item-filtered at spawn; the agent stays usable). Advisory only: the delegation pool can differ from this roster, so a tool mounted only on the delegation tool or produced by per-spawn extraTools makes this spurious.`), { phase: "config", sessionId });
-                    }
-                    catch {
-                    }
-                }
-                for (const n of def.denyTools ?? []) {
-                    if (n === "*")
-                        continue;
-                    if (!known.has(n)) {
-                        const e = new Error(`TaskSpec.agents: agent "${def.name}" declares tool "${n}" in its denied tools, but no such tool exists in this deployment — fix the agent's tools list or mount the tool.`);
-                        e.code = "config.agent.unknown_tool";
-                        throw e;
-                    }
-                }
-            }
-        }
-        const rosterBearingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
-        const rosterFaceDeferred = rosterBearingSpec !== undefined &&
-            !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false) &&
-            (toolFaceSnapshot.defer?.includes(rosterBearingSpec.name) ?? false) &&
-            !activeTools.has(rosterBearingSpec.name);
-        const agentListingSpec = rosterBearingSpec !== undefined &&
-            !rosterFaceDeferred &&
-            !(toolFaceSnapshot.exclude?.includes(rosterBearingSpec.name) ?? false)
-            ? rosterBearingSpec
-            : undefined;
-        const agentListing = agentListingSpec
-            ? {
-                entries: agentListingSpec.agentListing,
-                toolName: agentListingSpec.name,
-                seedAnnounced: resume !== undefined || spec.sessionId !== undefined,
-                ...(agentListingSpec.agentModels !== undefined ? { models: agentListingSpec.agentModels } : {}),
-            }
-            :
-                !rosterFaceDeferred && ((resume?.seed.announcedListings?.agents?.length ?? 0) > 0 || spec.sessionId !== undefined)
-                    ?
-                        {
-                            entries: [],
-                            toolName: (spec.tools ?? []).find((t) => t.agentListing !== undefined)?.name ?? "Agent",
-                            seedAnnounced: true,
-                        }
-                    : undefined;
-        if (spec.attachments?.agentListing === false && agentListing !== undefined && agentListing.entries.length > 0) {
-            deps.onError?.(new Error(`attachments.agentListing is explicitly false but the "${agentListing.toolName}" delegation tool mounts a ${agentListing.entries.length}-type roster — the model will never see the agent-type listing its tool description points to.`), { phase: "config", sessionId });
-        }
-        if (spec.attachments?.skillsListing === false && skillsListing !== undefined && skillsListing.entries.length > 0) {
-            deps.onError?.(new Error(`attachments.skillsListing is explicitly false but ${skillsListing.entries.length} skill(s) are mounted — the model will never see the skills listing the ${SKILL_TOOL_NAME} tool description points to.`), { phase: "config", sessionId });
-        }
-        const announcedListingsRef = {};
-        if (rosterFaceDeferred) {
-            if (resume?.seed.announcedListings?.agents !== undefined)
-                announcedListingsRef.agents = [...resume.seed.announcedListings.agents];
-            if (resume?.seed.announcedListings?.models !== undefined)
-                announcedListingsRef.models = [...resume.seed.announcedListings.models];
-            if (announcedListingsRef.agents === undefined && announcedListingsRef.models === undefined) {
-                try {
-                    const entrySnap = await session.getAnnouncedListing();
-                    if (entrySnap?.agents !== undefined)
-                        announcedListingsRef.agents = [...entrySnap.agents];
-                    if (entrySnap?.models !== undefined)
-                        announcedListingsRef.models = [...entrySnap.models];
-                }
-                catch {
-                }
-            }
-        }
-        if (rosterFaceDeferred && rosterBearingSpec !== undefined) {
-            const rideEntries = rosterBearingSpec.agentListing;
-            const rideModels = rosterBearingSpec.agentModels;
-            listingRideRef.current = (newly) => {
-                if (!newly.includes(rosterBearingSpec.name))
-                    return undefined;
-                if ((announcedListingsRef.agents?.length ?? 0) > 0)
-                    return undefined;
-                return renderAgentListingDelta({ announcedAgentTypes: undefined }, rideEntries, rosterBearingSpec.name, rideModels);
-            };
-        }
-        const dateChange = renderWithDate
-            ? { legDate: envFacts.date, today: () => formatLocalDate(new Date(), tzValid ? userTz : undefined) }
-            : undefined;
+        const { activeTools, fpRef, turnSnapshotRef, harnessTools, toolsDeltaRef, toolMaterializeStatic, deferDirectCall, staticFaceForRef, listingRideRef } = await prepareToolDisclosureMount({ spec, deps, session, resume, deferred, tools, onceLedger, mcp, promptManifest, offloadReachableToolsRef, contentOriginWrapRef, rebuildHarnessToolsRef, harnessRef });
+        const { agentListing, announcedListingsRef, dateChange } = prepareListings({ spec, tools, onceLedger, sessionId, toolFaceSnapshot, activeTools, resume, skillsListing, listingRideRef, renderWithDate, envFacts, tzValid, userTz });
         const lastBrainContextRef = {};
         const requestLossyRef = { current: false };
         const staleOffloadWrittenRefs = new Set();
@@ -3660,7 +1435,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         };
         const staleOffloadCfg = resolveStaleToolResultOffload(spec.compaction?.staleToolResultOffload);
         if (staleOffloadCfg !== undefined && offloadStore === undefined) {
-            deps.onError?.(new Error("compaction.staleToolResultOffload is set but the tool-result offload store is disabled (toolResultThresholdChars ≤ 0/∞) — the knob is inert this run; re-enable offloading or drop the knob"), { phase: "config", sessionId });
+            onceLedger.onError(new Error("compaction.staleToolResultOffload is set but the tool-result offload store is disabled (toolResultThresholdChars ≤ 0/∞) — the knob is inert this run; re-enable offloading or drop the knob"), { phase: "config", sessionId });
         }
         const staleOffload = staleOffloadCfg !== undefined && offloadStore !== undefined ? { cfg: staleOffloadCfg, store: offloadStore } : undefined;
         const guardedBrain = brainCallGuardrailMs === undefined
@@ -3961,61 +1736,19 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 return {};
             return { riskAxes: { ...(irreversible !== undefined ? { irreversible } : {}), ...(egress !== undefined ? { egress } : {}) } };
         };
-        const inheritedAskEvidence = inheritedAskRuleEvidence(deps);
-        const permissionRuleLane = (() => {
-            const provider = deps.permissionRuleStore;
-            const localOwnerDeclared = deps.localOwnerRules === true;
-            if (localOwnerDeclared) {
-                if (provider === undefined) {
-                    throw new Error("RunnerDeps.localOwnerRules is declared but no permissionRuleStore provider is wired — there is no bucket for the local owner to hold rules in; refusing rather than running as if the declaration were absent");
-                }
-                if (provider.forLocalOwner === undefined) {
-                    throw new Error("RunnerDeps.localOwnerRules is declared but the wired permissionRuleStore provider implements no forLocalOwner() face — a provider without a local-owner bucket cannot honor the declaration; refusing rather than silently resolving zero rules");
-                }
-            }
-            if (provider === undefined)
-                return undefined;
-            const root = taskRootFinal;
-            return {
-                admits: async (req) => {
-                    const anonymous = spec.principal === undefined || spec.principal === "";
-                    if (anonymous && !localOwnerDeclared)
-                        return undefined;
-                    if (req.toolName !== PERSISTED_RULE_TOOL && req.toolName !== DIRECTORY_RULE_TOOL)
-                        return undefined;
-                    let listed;
-                    try {
-                        listed = anonymous
-                            ?
-                                await provider.forLocalOwner().list()
-                            : await provider.forPrincipal(spec.principal).list();
-                    }
-                    catch (err) {
-                        emitTrace(deps.tracer, () => ({
-                            kind: "permission.rule_store_unreadable",
-                            version: 1,
-                            taskId: hostTaskId,
-                            message: err instanceof Error ? err.message : String(err),
-                            ts: Date.now(),
-                        }));
-                        return { unreadable: true };
-                    }
-                    const table = await spliceSessionOverlayRows(deps.sessionPermissionRules, sessionId, listed.rules, deps.tracer, hostTaskId);
-                    if (req.toolName === DIRECTORY_RULE_TOOL) {
-                        return directoryRuleLaneAnswer(table, req.args, { root, sessionId, liveCwd: handsCwdRef?.current });
-                    }
-                    const command = req.args?.command;
-                    if (typeof command !== "string")
-                        return undefined;
-                    const admitting = findAdmittingRule(table, { tool: req.toolName, command, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
-                    if (admitting !== undefined)
-                        return persistedRuleHitOf(admitting);
-                    const coverage = segmentCoverageOf(command, { persisted: table }, { tool: req.toolName, cwd: root, sessionId, ...(handsCwdRef?.current !== undefined ? { execCwd: handsCwdRef.current } : {}) });
-                    return coverage !== undefined ? { segmentCoverage: coverage } : undefined;
-                },
-            };
-        })();
-        const permissionRuleOrgLane = makeOrgAdjudicationLane(deps.permissionRuleOrg, questionToolMounted, (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }));
+        const inheritedAskEvidence = inheritedAskRuleEvidence(deps.permissionRuleStore);
+        const { personal: permissionRuleLane, org: permissionRuleOrgLane } = createPermissionRuleLanes({
+            provider: deps.permissionRuleStore,
+            localOwnerDeclared: deps.localOwnerRules === true,
+            principal: spec.principal,
+            sessionId,
+            root: taskRootFinal,
+            liveCwd: () => handsCwdRef?.current,
+            questionToolMounted,
+            questionToolName: ASK_USER_QUESTION_TOOL_NAME,
+            onRevisionDefect: (message) => deps.onError?.(new Error(message), { phase: "config", sessionId }),
+            onDisclosure: (message) => emitTrace(deps.tracer, () => ({ kind: "permission.rule_store_unreadable", version: 1, taskId: hostTaskId, message, ts: Date.now() })),
+        });
         const ruleOffersOf = makeRuleOffersOf({
             laneArmed: permissionRuleLane !== undefined,
             principal: spec.principal,
@@ -4058,7 +1791,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     return { action: "allow", updatedInput: editArgs };
                 if (judged.kind === "deny")
                     return judged.result;
-                const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere } = judged;
+                const { ask: editAsk, fallback: editFallback, mintedHere: editMintedHere, origin: editOrigin } = judged;
                 re = editAsk;
                 const rr = await resolveAsk({
                     toolName: creq.toolName,
@@ -4070,7 +1803,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(creq.toolName),
                     ...(re.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(re.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: re.persistedRuleShadowed } : {}),
-                    ...(editFallback !== undefined ? { denialLimitFallback: editFallback } : {}),
+                    ...inheritedAskCarry(editOrigin, editFallback, isLiveApproverSeat(onAskOf), ancestorTracker),
                     ruleEvidence: inheritedAskEvidence,
                 }, onAskOf, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                 settleDenialLimitFallback({ fallback: editFallback, mintedHere: editMintedHere, tracker: ancestorTracker, resolved: rr, headless: headlessDenyAtRecheck, stop: stopForDenialLimit, toolName: creq.toolName, toolCallId: creq.toolCallId });
@@ -4131,7 +1864,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return { action: "allow" };
                         if (judged.kind === "deny")
                             return judged.result;
-                        const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                        const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
                         if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                             recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                             return { action: "allow" };
@@ -4148,7 +1881,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                            ...(fallback !== undefined ? { denialLimitFallback: fallback } : {}),
+                            ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                             ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                         const askWaitMs = Math.max(0, now() - askT0);
@@ -4211,7 +1944,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
                         if (judged.kind === "deny")
                             return judged.result;
-                        const { ask: inheritedAsk, fallback, mintedHere } = judged;
+                        const { ask: inheritedAsk, fallback, mintedHere, origin: inheritedOrigin } = judged;
                         if (fallback === undefined && sandboxAdmissionArmed && policyAskClassOf(pc.policy) === "sandbox_local" && !sandboxBoundaryCapable(creq.toolName)) {
                             recordAncestorSandboxAdmission(creq.toolCallId, creq.toolName);
                             return decision.updatedInput !== undefined ? { action: "allow", updatedInput: decision.updatedInput } : { action: "allow" };
@@ -4227,7 +1960,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                             ...riskAxesOf(creq.toolName),
                             ...(inheritedAsk.action === "ask" && inheritedAsk.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                             ...(inheritedAsk.action === "ask" && inheritedAsk.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: inheritedAsk.persistedRuleShadowed } : {}),
-                            ...(fallback !== undefined ? { denialLimitFallback: fallback } : {}),
+                            ...inheritedAskCarry(inheritedOrigin, fallback, isLiveApproverSeat(pc.onAsk), pc.autoMode?.denialTracking),
                             ruleEvidence: inheritedAskEvidence,
                         }, pc.onAsk, csignal ?? abortController.signal, lateAskSettlementObserver({ toolName: creq.toolName, toolCallId: creq.toolCallId, sessionId, runId, ...(spec.taskId !== undefined ? { taskId: spec.taskId } : {}), onNotice: deps.onNotice, onError: deps.onError }));
                         const askWaitMs = Math.max(0, now() - askT0);
@@ -4337,131 +2070,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 },
             }
             : foldedPolicy;
-        const onAsk = spec.onAsk ?? deps.onAsk;
-        const handWriteTools = handsEnabled && spec.handsReadOnly !== true
-            ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
-                const eff = HAND_TOOL_EFFECTS[name];
-                return eff === "write" || eff === "idempotent";
-            })
-            : [];
-        const hasEffectAwareGate = Boolean(policyLayers.length > 0 || (hooks?.preToolUse !== undefined && !preToolUseObservational));
-        const destructiveMcpUngated = mcp.tools.some((t) => !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read");
-        const firstPartyWriteUngated = (spec.tools ?? [])
-            .map((t) => t.name)
-            .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
-        if (!hasEffectAwareGate && (handWriteTools.length > 0 || destructiveMcpUngated || firstPartyWriteUngated.length > 0)) {
-            const what = [
-                handWriteTools.length > 0 ? `hand tools [${handWriteTools.join(", ")}]` : undefined,
-                destructiveMcpUngated ? "MCP write tools" : undefined,
-                firstPartyWriteUngated.length > 0 ? `write tools [${firstPartyWriteUngated.join(", ")}]` : undefined,
-            ]
-                .filter(Boolean)
-                .join(" + ");
-            if (!ungatedWarnedShapes.get(deps)?.has(what)) {
-                let shapes = ungatedWarnedShapes.get(deps);
-                if (!shapes) {
-                    shapes = new Set();
-                    ungatedWarnedShapes.set(deps, shapes);
-                }
-                shapes.add(what);
-                deps.onError?.(new Error(`write-capable ${what} are present but UNGATED — wire an effect-aware tool policy (or a PreToolUse hook). ` +
-                    `bash/MCP irreversible actions are otherwise unadjudicated; the deployment sandbox/egress boundary is the only protection (design/77 §4, design/53 §2.H). ` +
-                    `(This warning fires once per deployment per tool-set shape.)`), { phase: "config", sessionId });
-            }
-        }
-        const preToolContexts = new Map();
-        const blockedToolCalls = new Set();
-        const approvalSettlement = new Map();
-        const humanBareRejections = new Set();
-        const batchHaltRef = {};
-        const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
-        const restoreSurfaceGap = ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) && ownedEnv.capabilities.suspendable ? missingRestoreSurface(ownedEnv) : [];
-        const incompleteSuspendAdapter = restoreSurfaceGap.length > 0 ? restoreSurfaceGap : undefined;
-        const durableSuspendInfraReady = resolveCheckpointStore(spec, deps) !== undefined &&
-            !(offloadStore !== undefined && isVolatileOffloadStore(offloadStore)) &&
-            (ownedEnv === undefined || isRemoteExecutionEnv(ownedEnv)) &&
-            incompleteSuspendAdapter === undefined;
-        const resourceSuspendEligible = spec.resourceSuspend !== undefined && durableSuspendInfraReady;
-        if (spec.resourceSuspend !== undefined && !resourceSuspendEligible) {
-            const why = resolveCheckpointStore(spec, deps) === undefined
-                ? "no CheckpointStore is wired"
-                : offloadStore !== undefined && isVolatileOffloadStore(offloadStore)
-                    ? "tool-result offload uses the in-memory store (a resume needs durable results)"
-                    : incompleteSuspendAdapter !== undefined
-                        ? `the per-task execution env declares capabilities.suspendable but its adapter does not implement ${incompleteSuspendAdapter.join(" or ")} (a snapshot nothing can restore is worse than no snapshot)`
-                        : "the per-task execution env is not a RemoteExecutionEnv (it would be destroyed on suspend)";
-            deps.onError?.(new Error(`resourceSuspend is set but INACTIVE: ${why}; resource limits will hard-fail, not suspend`), {
-                phase: "config",
-                sessionId,
-            });
-        }
-        const usageGovernance = buildUsageGovernance(usageWindows, deps, spec.principal, sessionId);
-        const platformSuspendArmed = durableSuspendInfraReady && (envLifetimeSuspendAt !== undefined || usageGovernance !== undefined);
-        const durableApproval = spec.durableApproval ??
-            (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
-        const wiringQuestionSeam = resolveQuestionSeam(spec, deps);
-        const wiringQuestionStripped = internals?.questionFaceStripped === true;
-        const wiringAskSeam = resolveAskSeamForm(spec, deps);
-        const wiringManifest = deriveWiringManifest({
-            half: "effective",
-            leg: resume !== undefined ? "resume" : internals?.isDelegatedChild === true ? "child" : "root",
-            askForm: wiringAskSeam.form,
-            ...(wiringAskSeam.provenance !== undefined ? { askProvenance: wiringAskSeam.provenance } : {}),
-            questionWired: wiringQuestionSeam.wired,
-            ...(wiringQuestionSeam.provenance !== undefined ? { questionProvenance: wiringQuestionSeam.provenance } : {}),
-            ...(wiringQuestionStripped ? { questionStrippedByEngine: true } : {}),
-            ...(resolvedInteractionPosture !== undefined ? { interactionPosture: resolvedInteractionPosture } : {}),
-            ...(spec.interactiveTools === true && !wiringQuestionSeam.wired && !durableQuestionFace && !wiringQuestionStripped
-                ? { interactiveToolsWithoutDeliveryFace: true }
-                : {}),
-            elicitSeamWired: resolveElicitSeam(deps),
-            elicitServersOptedIn: countElicitOptIns(spec),
-            parkCapable: checkpointStore !== undefined,
-            parkDurableApprovalOptIn: spec.durableApproval !== undefined,
-            parkForceDurableGate: runtimeCaps?.forceDurableGate === true,
-            parkSafetyVocabularyArmed: irreversibleTools.size > 0 || egressTools.size > 0,
-            ...(checkpointStore !== undefined ? { checkpointDurability: resolveDeclaredDurability(checkpointStore, "checkpointStore") } : {}),
-            sessionDurability: resolveDeclaredDurability(sessions, "sessionStore"),
-            backgroundAgentStoreWired: deps.backgroundAgentStore !== undefined,
-            subagentTranscriptTier: resolveSubagentTranscriptTier(deps.backgroundAgentStore !== undefined, sessions),
-            permissionRuleStoreWired: deps.permissionRuleStore !== undefined,
-            permissionRuleSyncWired: deps.permissionRuleSyncWired === true,
-            permissionRuleOrgGoverned: deps.permissionRuleOrg !== undefined,
-            hostChildEventSinkWired: deps.onBackgroundChildEvent !== undefined,
-            lockedConfigWired: deps.lockedConfig !== undefined,
-            complianceWired: deps.compliancePostureResolver !== undefined,
-            memoryAdmissionWired: deps.memoryScopeAdmission !== undefined,
-            retentionPolicyWired: deps.retentionPolicy !== undefined,
-            ...(modelGateManifest !== undefined ? { modelGate: modelGateManifest } : {}),
-            autoMode: { armed: autoModeArmReason === "armed", reason: autoModeArmReason },
-        });
-        peerLaneRefs.askEffective = wiringManifest.ask.effective;
-        if (peerLaneActive && internals?.onTaskNotification !== undefined) {
-            bindPeerLaneDrain(harness, {
-                deps,
-                sessionId,
-                runId,
-                scope: taskScope,
-                inject: internals.onTaskNotification,
-                ownTokens: () => internals?.peerSelfRef?.current.ownTokens ?? [],
-                refs: peerLaneRefs,
-                selfName: () => internals?.explicitAgentName,
-                parked: () => suspendRef.token !== undefined || reviewRef.token !== undefined,
-            });
-        }
-        const parkLaneArmed = wiringManifest.parkLane.effective === true;
-        announceDurableGateUnavailable({ onNotice: deps.onNotice, forceDurableGate: runtimeCaps?.forceDurableGate === true, storeWired: checkpointStore !== undefined, taskStoreNull: spec.checkpointStore === null, liveApprover: isLiveApproverSeat(frozenOnAsk), liveQuestionFace: liveQuestionFace !== undefined, parentConstraints: liveInheritedGate?.parentConstraints, sessionId, runId, principal: spec.principal });
-        const hookIdentity = mintHookInvocationIdentity({
-            sessionId,
-            taskId: hostTaskId,
-            legKind: wiringManifest.leg.kind,
-            isDelegatedChild: delegation.isDelegatedChild,
-            ...(internals?.insideFork === true ? { insideFork: true } : {}),
-            ...(internals?.agentName !== undefined ? { agentName: internals.agentName } : {}),
-            ...(internals?.parentToolCallId !== undefined ? { parentToolCallId: internals.parentToolCallId } : {}),
-        });
-        const hookContextConsumerWired = hooks?.preToolUse !== undefined || hooks?.postToolUse !== undefined || hooks?.postToolUseFailure !== undefined;
-        const hookEnvFace = hookContextConsumerWired && (ownedEnv ?? deps.executionEnv) != null ? createHookEnvCapabilities(executionEnv) : undefined;
+        const { onAsk, preToolContexts, blockedToolCalls, approvalSettlement, humanBareRejections, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, platformSuspendArmed, durableApproval, wiringManifest, parkLaneArmed, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, suspendRef, reviewRef, frozenOnAsk, liveInheritedGate, delegation });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
@@ -4509,7 +2118,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                     ...riskAxesOf(req.toolName),
                     ...(decision.action === "ask" && decision.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
                     ...(decision.action === "ask" && decision.persistedRuleShadowed !== undefined ? { persistedRuleShadowed: decision.persistedRuleShadowed } : {}),
-                    ...(decision.action === "ask" && decision.denialLimitFallback !== undefined ? { denialLimitFallback: decision.denialLimitFallback } : {}),
+                    ...(decision.action === "ask" ? gateAskCarry(decision, isLiveApproverSeat(onAsk), autoModeDenialTracking) : {}),
                     ...(decision.action === "ask" && decision.probeReason !== undefined ? { probeReason: decision.probeReason } : {}),
                     ...(decision.action === "ask" && decision.probeCause !== undefined ? { probeCause: decision.probeCause } : {}),
                     ...(decision.action === "ask" && decision.ruleEvidence !== undefined ? { ruleEvidence: decision.ruleEvidence } : {}),
@@ -4616,13 +2225,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         }
                         : undefined;
                 })(),
-                announcedListings: announcedListingsRef.agents !== undefined || announcedListingsRef.skills !== undefined || announcedListingsRef.models !== undefined
-                    ? {
-                        ...(announcedListingsRef.agents !== undefined ? { agents: [...announcedListingsRef.agents] } : {}),
-                        ...(announcedListingsRef.skills !== undefined ? { skills: [...announcedListingsRef.skills] } : {}),
-                        ...(announcedListingsRef.models !== undefined ? { models: [...announcedListingsRef.models] } : {}),
-                    }
-                    : undefined,
+                announcedListings: serializeAnnouncedListings(announcedListingsRef),
                 gitAnnouncement: gitStatusRef.announced !== undefined ? { ...gitStatusRef.announced } : undefined,
                 delegationProvenance: internals?.delegationProvenance !== undefined ? { ...internals.delegationProvenance.ref.current } : undefined,
                 isDelegatedChild: hookIdentity.isDelegatedChild ? true : undefined,
@@ -4999,7 +2602,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 }
             };
             const suspendAsk = parkLaneArmed && checkpointStore !== undefined
-                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, callSignal) => {
+                ? async (req, postHookArgs, safety, liveFaceUnavailable, realApproval, shadowedRule, askDecisionReason, probeReason, probeCause, segmentCoverage, matchedAskRule, probeMandated, carry) => {
                     const syncFirstEligible = req.toolName === ASK_USER_QUESTION_TOOL_NAME ? contentAskRoutable(req.toolCallId) : isLiveApproverSeat(onAsk);
                     if (syncFirstEligible &&
                         runtimeCaps?.forceDurableGate !== true &&
@@ -5007,7 +2610,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                         !inheritedUnavailableAsks.has(req.toolCallId)) {
                         return undefined;
                     }
-                    const cutSignal = composedCallSignal(callSignal);
+                    const cutSignal = composedCallSignal(carry?.signal);
                     let token;
                     let gate;
                     let cp;
@@ -5179,6 +2782,8 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                                         ...(bidi ? { hasBidiControls: true } : {}),
                                     };
                                 })(),
+                                ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
+                                ...askCarryRowMembers(carry),
                                 ...ruleOffersOf(req.toolName, parkedArgs, {
                                     ...(realApproval !== undefined ? { requiresRealApproval: true } : {}),
                                     ...(shadowedRule !== undefined ? { persistedRuleShadowed: shadowedRule } : {}),
@@ -5255,7 +2860,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 if (eff !== undefined && !toolEffects.has(t.name))
                     toolEffects.set(t.name, eff);
             }
-            const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths);
+            const writeProtectionCheck = createWriteProtectionCheck(deps.writeProtectedPaths, deps.memoryEngineDir !== undefined ? { dataRoot: deps.memoryEngineDir } : undefined);
             const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
             toolCallGateArmedRef.armed =
                 effectivePolicy !== undefined ||
@@ -5759,25 +3364,16 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         overheadState.promptChars = systemPrompt.length;
         const effectiveReadFaceObserved = carrierReadFace();
         const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
+        await onceLedger.settle(session, announcedListingsRef);
         const preparedHolder = {};
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp: mcp, ...(a2a !== undefined && a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;
         return prepared;
     }
     catch (prepareErr) {
-        if (a2a) {
-            const a2aHandle = a2a;
-            await settleTeardownLeg(() => a2aHandle.dispose(), "a2a.dispose (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
-        }
-        if (mcp) {
-            const mcpHandle = mcp;
-            await settleTeardownLeg(() => mcpHandle.dispose(), "mcp.dispose (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
-        }
-        if (ownedEnv && hasDestroy(ownedEnv)) {
-            const env = ownedEnv;
-            await settleTeardownLeg(() => env.destroy(), "ownedEnv.destroy (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
-        }
+        await rollback.unwindAll();
         await settleTeardownLeg(() => forgetOnThrow(), "forgetOnThrow (prepare-throw leg)", (e) => deps.onError?.(e, { phase: "config", sessionId }));
         throw prepareErr;
     }