@sema-agent/core 7.5.2 → 7.6.1

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -1,15 +1,11 @@
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
-import { createSendMessageTool } from "../../agents/send-message-tool.js";
 import { type PeerLaneRefs } from "../../agents/peer-session-drain.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { type WorktreeSessionRef } from "../../tools/worktree.js";
 import type { CwdRef } from "../../tools/fs/index.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import type { RunnerDeps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
-import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
-/** The runner the SendMessage / AgentTranscript mounts accept — spelled as the factory's own option type so this phase
- *  names no runner module of its own (the narrow `RunnerSelfSeat` contract is a design decision still open). */
-type DelegationMountRunner = Parameters<typeof createSendMessageTool>[0]["runner"];
+import type { PrepareResume, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 export interface PrepareDelegationSurfaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `tools` (the shadow checks and the revival spawner's delegation-tool
      *  lookup), `oneShot` (the read/kill faces' completion promises), `retainBackgroundProcesses` (the Monitor receipt),
@@ -36,7 +32,7 @@ export interface PrepareDelegationSurfaceInput {
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the trusted Runner self-reference the SendMessage / AgentTranscript mounts execute through; undefined
      *  when prepareTask runs standalone (then neither mounts). */
-    runnerSelf: DelegationMountRunner | undefined;
+    runnerSelf: RunnerSelfSeat | undefined;
     /** borrowed-readonly — the background/workflow door's first half: the hands mount decided a real shell with write hands. */
     backgroundTaskToolsActive: boolean;
     /** borrowed-readonly — the door's second half: the Workflow tool is on the roster. */
@@ -101,4 +97,3 @@ export interface PrepareDelegationSurfaceResult {
 }
 /** The M6 phase body — prepareTask's delegation-surface stretch, verbatim (see the module header). */
 export declare function prepareDelegationSurface(input: PrepareDelegationSurfaceInput): PrepareDelegationSurfaceResult;
-export {};

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -27,7 +27,7 @@ import type { AskClass } from "../ask-class.js";
 import type { AutoModeDecider, AutoModeDenialTracker } from "../auto-mode.js";
 import { type ComplianceCapability } from "../compliance.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity, type Hooks } from "../hooks.js";
-import { type ToolPolicy } from "../tool-policy.js";
+import type { ToolPolicy } from "../tool-policy.js";
 import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import type { AskLane, IrreversibilityTier, ParkAsk, Prepared, ReversibilityProbes } from "./contracts.js";
@@ -74,9 +74,6 @@ export interface PrepareGateStationsInput {
     blockedToolCalls: Set<string>;
     /** borrowed-mutable — the duplicate-frame ask-grant record. Writer here: the head-of-evaluation and lifecycle-end `delete`. */
     inheritedAskGrants: Map<string, unknown>;
-    /** borrowed-mutable — the bare-human-rejection sideband. Writer here: the head-of-evaluation `delete` and the lifecycle
-     *  sweep whose `delete` IS the read the boundary judgment consumes. */
-    humanBareRejections: Set<string>;
     /** borrowed-mutable — the inherited-unavailable marker set. Writer here: the lifecycle-end `delete`; `has` is handed to
      *  the gate as the read-only `isMarkedUnresolvable`. */
     inheritedUnavailableAsks: Set<string>;
@@ -94,9 +91,9 @@ export interface PrepareGateStationsInput {
     /** borrowed-mutable — PreToolUse `additionalContext` per call id. Writers here: the `tool_call` station's stash (`set`, only
      *  for calls that will execute) and the `tool_result` station's one-shot drain (`delete`). */
     preToolContexts: Map<string, string[]>;
-    /** borrowed-mutable — the settlement sideband (`Prepared.approvalSettlement`). Writer here: the ONE screened `set` per
-     *  gate outcome; the frame mint reads and deletes. */
-    approvalSettlement: Prepared["approvalSettlement"];
+    /** borrowed-mutable — the gate-outcome sideband (`Prepared.gateOutcomes`). Writer here: the single screened write per
+     *  gated call (the two short-circuits and the gate's terminal exits); the frame mint reads and deletes. */
+    gateOutcomes: Prepared["gateOutcomes"];
     /** borrowed-mutable — the turn halt fact (`Prepared.batchHaltRef`). Writer here: the bare-rejection boundary (`current`). */
     batchHaltRef: Prepared["batchHaltRef"];
     /** borrowed-readonly — whether blocked/suspended ids are tracked at all (the post-tool callbacks exist). */

package/dist/core/runner/prepare-gate-stations.js

@@ -2,54 +2,29 @@ import { SEND_MESSAGE_TOOL_NAME } from "../../agents/send-message-tool.js";
 import { complianceCallDenial } from "../compliance.js";
 import { cloneObserverInput, formatHookFeedback, hookSeatExpiredError, runHookSeat, runToolGate } from "../hooks.js";
 import { PRESENT_PLAN_TOOL_NAME } from "../present-plan-tool.js";
-import { isApprovalSettledBy, isAskDenyResolution, screenApproverAttribution } from "../tool-policy.js";
+import { screenGateOutcome } from "../gate-outcome.js";
+import { directDeny } from "./gate-exit.js";
 import { emitTrace } from "../trace.js";
 import { createWriteProtectionCheck } from "../write-protect.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-function screenGateSettlement(result, settling) {
-    const defects = [];
-    const reportedBy = result.settledBy;
-    let settledBy;
-    if (reportedBy !== undefined) {
-        if (!isApprovalSettledBy(reportedBy) || (!settling && reportedBy !== "human")) {
-            defects.push(`a tool-gate settlement reported settledBy "${String(reportedBy)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                `it is one of "human" / "timeout" / "aborted", and only "human" can be the source of a call that runs; the frame carries no source`);
-        }
-        else
-            settledBy = reportedBy;
-    }
-    const attribution = screenApproverAttribution(result.approver);
-    if (attribution.defect !== undefined) {
-        defects.push(`a tool-gate settlement reported an attribution this engine refuses: ${attribution.defect}; the frame carries no approver`);
-    }
-    const reportedResolution = result.resolution;
-    let resolution;
-    if (reportedResolution !== undefined) {
-        if (!isAskDenyResolution(reportedResolution) || !settling) {
-            defects.push(`a tool-gate settlement reported a deny resolution "${String(reportedResolution)}" on ${settling ? "a blocked" : "an executing"} call — ` +
-                `it is one of the closed ask-deny vocabulary and only a BLOCKED call can carry one; the frame carries no resolution`);
-        }
-        else
-            resolution = reportedResolution;
-    }
-    const reportedAutoDenied = result.autoDenied;
-    let autoDenied;
-    if (reportedAutoDenied === true) {
-        if (!settling)
-            defects.push("a tool-gate settlement reported autoDenied on an executing call — only a BLOCKED call can carry the marker; the frame carries none");
-        else
-            autoDenied = true;
+function screenGateResult(result) {
+    if (result.suspend !== undefined)
+        return { defects: [] };
+    const gate = result.gate;
+    if (gate === undefined)
+        return { defects: ["a tool-gate result carried no outcome record on a terminal exit — every terminal exit mints one; the frame carries none"] };
+    const defects = screenGateOutcome(gate);
+    const blocked = result.block === true;
+    if ((gate.disposition.kind === "denied") !== blocked) {
+        defects.push(`a tool-gate result's outcome reads "${gate.disposition.kind}" on ${blocked ? "a blocked" : "an executing"} call — the two faces of one verdict disagree; the frame carries no outcome`);
     }
-    const record = {
-        ...(settledBy !== undefined ? { settledBy } : {}),
-        ...(attribution.approver !== undefined ? { approver: attribution.approver } : {}),
-        ...(resolution !== undefined ? { resolution } : {}),
-        ...(autoDenied !== undefined ? { autoDenied } : {}),
-    };
-    return { ...(settledBy !== undefined || attribution.approver !== undefined || resolution !== undefined || autoDenied !== undefined ? { record } : {}), defects };
+    return defects.length > 0 ? { defects } : { gate, defects };
 }
 function maybeHumanRejectionHalt(input) {
-    if (!input.bare || input.settledBy !== "human" || input.isDelegatedChild)
+    const d = input.gate?.disposition;
+    const s = input.gate?.settlement;
+    const bare = d?.kind === "denied" && d.deniedBy === "ask_resolution" && s?.kind === "human_refused" && s.note === undefined;
+    if (!bare || input.isDelegatedChild)
         return undefined;
     return {
         reason: `This tool call was NOT executed: the user rejected the "${input.toolName}" tool call in the same ` +
@@ -64,7 +39,7 @@ function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, humanBareRejections, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, approvalSettlement, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
+    const { askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash } = input;
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
@@ -87,14 +62,15 @@ export function prepareGateStations(input) {
             harness.on("tool_call", async (e) => {
                 blockedToolCalls.delete(e.toolCallId);
                 inheritedAskGrants.delete(e.toolCallId);
-                humanBareRejections.delete(e.toolCallId);
                 {
                     const complianceDeny = complianceCallDenial(complianceDenies, e.toolName);
                     if (complianceDeny !== undefined) {
                         if (blockedTracked)
                             blockedToolCalls.add(e.toolCallId);
+                        const gate = directDeny("compliance");
+                        gateOutcomes.set(e.toolCallId, gate);
                         if (notifyPermissionDenied) {
-                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, source: "safety", identity: hookIdentity });
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: complianceDeny, gate, identity: hookIdentity });
                         }
                         return { block: true, reason: formatHookFeedback(complianceDeny, reminderMark), preToolContext: [] };
                     }
@@ -104,8 +80,10 @@ export function prepareGateStations(input) {
                         blockedToolCalls.add(e.toolCallId);
                     const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
                         `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
+                    const gate = directDeny("plan_mode");
+                    gateOutcomes.set(e.toolCallId, gate);
                     if (notifyPermissionDenied) {
-                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode", identity: hookIdentity });
+                        await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, gate, identity: hookIdentity });
                     }
                     return {
                         block: true,
@@ -114,7 +92,6 @@ export function prepareGateStations(input) {
                     };
                 }
                 let result;
-                let humanBareRejection = false;
                 try {
                     result = await runToolGate({
                         onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
@@ -190,7 +167,6 @@ export function prepareGateStations(input) {
                     inheritedUnavailableAsks.delete(e.toolCallId);
                     inheritedAskGrants.delete(e.toolCallId);
                     foldAskClasses.delete(e.toolCallId);
-                    humanBareRejection = humanBareRejections.delete(e.toolCallId);
                 }
                 const ancestorAdmitted = ancestorSandboxAdmissions.get(e.toolCallId);
                 ancestorSandboxAdmissions.delete(e.toolCallId);
@@ -204,15 +180,14 @@ export function prepareGateStations(input) {
                 if (blockedTracked && (result.block || result.suspend)) {
                     blockedToolCalls.add(e.toolCallId);
                 }
-                const settlement = screenGateSettlement(result, result.block === true);
-                for (const defect of settlement.defects)
+                const screened = screenGateResult(result);
+                for (const defect of screened.defects)
                     deps.onError?.(new Error(defect), { phase: "config", sessionId });
-                if (settlement.record !== undefined)
-                    approvalSettlement.set(e.toolCallId, settlement.record);
+                if (screened.gate !== undefined)
+                    gateOutcomes.set(e.toolCallId, screened.gate);
                 if (result.block) {
                     const haltRemaining = maybeHumanRejectionHalt({
-                        bare: humanBareRejection,
-                        settledBy: result.settledBy,
+                        gate: screened.gate,
                         isDelegatedChild: delegation.isDelegatedChild === true,
                         toolName: e.toolName,
                         toolCallId: e.toolCallId,

package/dist/core/runner/prepare-inherited-gate.js

@@ -221,7 +221,7 @@ export function prepareInheritedGate(input) {
             delegationSettlement: delegationSettlementForChildren,
             ...(autoModeDecider ? { autoModeReview: { decider: autoModeDecider } } : {}),
             ...(spec.durableApproval !== undefined ? { durableApprovalForChildren: { ...spec.durableApproval } } : {}),
-            ...(spec.checkpointStore === null ? { checkpointStoreDisabledForChildren: true } : {}),
+            ...(spec.checkpointStore === "disabled" ? { checkpointStoreDisabledForChildren: true } : {}),
             taskId: hostTaskId,
             ...(internals?.parentTaskId !== undefined ? { parentTaskId: internals.parentTaskId } : {}),
             ...(internals?.parentSessionId !== undefined ? { parentSessionId: internals.parentSessionId } : {}),

package/dist/core/runner/prepare-memory.d.ts

@@ -2,15 +2,29 @@ import type { BeforeWriteHook, EffectiveMemoryScopes, RunnerDeps, TaskSpec, Tool
 import { type CaptureEntitlementInput, type MemoryCapturePosture } from "./memory-capture-optout.js";
 import type { Prepared } from "./contracts.js";
 export interface PrepareMemoryInput {
+    /** borrowed-readonly — the REBOUND spec. Read: `memory` (the scope declaration this phase
+     *  normalizes) and `principal` (the org-admission subject). Never mutated. */
     spec: TaskSpec;
+    /** borrowed-readonly — the deployment seams this phase reads: the two operator lanes (`onError`,
+     *  `onNotice`), the memory planes (`memoryBackend`, `memoryStore`, `memoryEngineDir`, `rootPath`,
+     *  `deploymentMemoryScopes`, `memoryScopeAdmission`), `memoryCaptureRecordStore`,
+     *  `memoryConsolidation`, `runtimeCapsResolver` and `onMemoryHarvestReport`. Receivers preserved
+     *  (`deps.onError?.(…)`). */
     deps: RunnerDeps;
+    /** borrowed-readonly — the acquired session's id: the engine session's key, the operator lines'
+     *  context, and the capture record's subject. */
     sessionId: string;
+    /** borrowed-readonly — the resolved task root: the containment boundary every derived memory dir
+     *  is checked against, and the repo-root fallback when `deps.rootPath` is unset. */
     taskRootPath: string;
+    /** borrowed-mutable — the caller's write-gate cell, and THIS phase is its writer: it installs the
+     *  memory write gate into `.current` (the module header's one out-param effect). Identity is the
+     *  contract — the caller's hands/read-face seat reads this exact cell. */
     memoryWriteGateRef: {
         current?: BeforeWriteHook;
     };
     /**
-     * #181-F5 — whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
+     * borrowed-readonly — #181-F5: whether a tool NAMED `Write` (the tool the CC `# Memory` instruction names) is on the
      * ASSEMBLED roster this run, not excluded, AND can actually REACH the host-side memory root:
      * prepare-task's `tools.some(t => t.name === "Write") && !exclude.includes("Write")` plus the
      * remote-env conjunct (a hand-band Write on a remote ExecutionEnv writes the sandbox filesystem,
@@ -22,12 +36,12 @@ export interface PrepareMemoryInput {
      * its roster (or cannot reach the store); the RB-276 index seed follows the same gate.
      */
     writeToolsMounted: boolean;
-    /** design/319 (A ticket) — the run's reminder provenance mark: the memory engine's announcement
+    /** borrowed-readonly — design/319 (A ticket): the run's reminder provenance mark: the memory engine's announcement
      *  block is an engine-authored `<system-reminder>`, so its open tag must carry the same mark the
      *  system-prompt declaration names. Threaded into every `engine.inject` call this phase builds. */
     reminderMark: string;
     /**
-     * The session-wide persistence verdict: `TaskSpec.memoryPersistenceCapable` (the deployment's own
+     * borrowed-readonly — the session-wide persistence verdict: `TaskSpec.memoryPersistenceCapable` (the deployment's own
      * statement — the only honest channel for a custom memory writer persisting through its closure,
      * which no inference can see) when set, else the KNOWN-store-path inference: a mounted,
      * non-excluded file-write tool (Write/Edit/NotebookEdit) or a write-capable shell. A generic
@@ -37,7 +51,7 @@ export interface PrepareMemoryInput {
      */
     rosterCanPersist: boolean;
     /**
-     * The raw `TaskSpec.memoryPersistenceCapable` DECLARATION, kept separate from the composed
+     * borrowed-readonly — the raw `TaskSpec.memoryPersistenceCapable` DECLARATION, kept separate from the composed
      * {@link rosterCanPersist} verdict because the two drive different arms:
      * - `true` (declared) RETRACTS the engine's own read-only notice — the deployment vouches for a
      *   persistence channel the engine cannot see (a custom writer persisting through its closure),
@@ -52,14 +66,14 @@ export interface PrepareMemoryInput {
      */
     memoryPersistenceDeclared?: boolean;
     /**
-     * design/336 §13-3 — the memory-provenance master switch, screened at the config doors
+     * borrowed-readonly — design/336 §13-3: the memory-provenance master switch, screened at the config doors
      * (`config.memory_provenance`, exact spellings, absent folded to `"carry"`). Every engine this
      * phase constructs runs under it, and the pollution notices/tool wording state the mode-true
      * behavior off it. See {@link RunnerDeps.memoryProvenance}.
      */
     memoryProvenance: "off" | "carry";
     /**
-     * design/178 ②-1 — whether the `memory_search`/`memory_get` pair PASSED its early mount conjuncts
+     * borrowed-readonly — design/178 ②-1: whether the `memory_search`/`memory_get` pair PASSED its early mount conjuncts
      * (exclusion + name occupancy, decided in prepare-task BEFORE this phase). True ⇒ this phase builds
      * the pair's ToolSpecs ({@link PrepareMemoryResult.memoryTools}) and the injection's instruction
      * teaches the retrieval discipline; false ⇒ neither happens, so the teaching and the roster agree
@@ -68,29 +82,22 @@ export interface PrepareMemoryInput {
      */
     memorySearchToolsPlanned: boolean;
     /**
-     * Org-memory admission context (ruled 2026-08-05), assembled by prepare-task:
-     * - `orgMemoryDenied`/`complianceDegraded`: the compliance capability `org_memory_mount` verdict
-     *   for this principal (the veto covers the request-origin plane);
-     * - `parentAdmittedOrgScopes`: the delegation chain's FROZEN admitted org set — `undefined` for a
-     *   top-level task; for a delegated child the caller passes the fail-closed empty set when the
-     *   chain carries no verdict (an older-shape chain must not read as "unconstrained").
-     */
-    /**
-     * design/383 §3.1 — the SCREENED capture posture (prepare-config-doors; absent deps seat folded
-     * to `"open"`) plus whether the deployment DECLARED one at all (the once-per-process "switch in
-     * use, no policy configured" operator line fires only on the undeclared arm).
+     * borrowed-readonly — design/383 §3.1: the SCREENED capture posture (prepare-config-doors; an
+     * absent deps seat folded to `"open"`).
      */
     memoryCapturePolicy?: MemoryCapturePosture;
+    /** borrowed-readonly — whether the deployment DECLARED a posture at all: the once-per-process
+     *  "switch in use, no policy configured" operator line fires only on the undeclared arm. */
     memoryCapturePolicyDeclared?: boolean;
     /**
-     * design/383 §3.1 — the per-principal entitlement as resolved by prepare-task's ONE caps resolve
+     * borrowed-readonly — design/383 §3.1: the per-principal entitlement as resolved by prepare-task's ONE caps resolve
      * (`value` = `runtimeCaps.allowMemoryOptOut` when boolean; `faulted` = the resolve threw or the
      * member was non-boolean — per the member's F2 fault-transit contract a fault must never arrive
      * as a coined explicit value). Consumed by the adjudicator on every ingress of this prepare.
      */
     captureEntitlement?: CaptureEntitlementInput;
     /**
-     * design/383 §2.1b — the carrier-absence verdict, judged by prepare-task from the DECLARED
+     * borrowed-readonly — design/383 §2.1b: the carrier-absence verdict, judged by prepare-task from the DECLARED
      * deployment shape: a remote-execution deployment whose control plane does not follow the run
      * (the per-run sandbox / stateless-replica form) with no
      * {@link RunnerDeps.memoryCaptureRecordStore} supplied. TRUE + a `capture:"off"` declaration ⇒
@@ -99,7 +106,7 @@ export interface PrepareMemoryInput {
      */
     captureCarrierUnsupported?: boolean;
     /**
-     * design/383 §2.5 — the IMMEDIATE spawner's session id (trusted internals seat, filled by the
+     * borrowed-readonly — design/383 §2.5: the IMMEDIATE spawner's session id (trusted internals seat, filled by the
      * delegation lanes; absent on top-level runs). The record-query leg of the delegation floor: a
      * child's harvest legs also read the PARENT's opt-out record off the shared write-plane control
      * store, so a parent whose opt-out landed AFTER this child spawned (the mid-run flip) still gets
@@ -112,7 +119,7 @@ export interface PrepareMemoryInput {
      */
     parentSessionId?: string;
     /**
-     * design/383 §2.5 — the delegation FLOOR bit off the trusted internals chain
+     * borrowed-readonly — design/383 §2.5: the delegation FLOOR bit off the trusted internals chain
      * (`internals.memoryCaptureFloor === true`): the spawning session was opted out at spawn time.
      * A floored leg runs opted-out WITHOUT re-adjudication (the parent's granted opt-out tightens
      * the tree; re-asking could only loosen) and mints its own one-way record (reason names the
@@ -120,7 +127,7 @@ export interface PrepareMemoryInput {
      */
     captureFloor?: boolean;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the floor seat's THIRD state off the same trusted
+     * borrowed-readonly — design/383 §2.5 (rescan post-6.0.0-RC): the floor seat's THIRD state off the same trusted
      * chain: the spawning session's capture state was INDETERMINATE at spawn time (its record store
      * faulted at the getter read). This leg resolves it against the live record query (see
      * `armCaptureOptOut`): ancestor record found ⇒ floor; still faulting ⇒ this session runs
@@ -129,7 +136,7 @@ export interface PrepareMemoryInput {
      */
     captureFloorIndeterminate?: boolean;
     /**
-     * design/383 §2.5 (rescan post-6.0.0-RC) — the HOST-SIDE FORK lane: the session this one was
+     * borrowed-readonly — design/383 §2.5 (rescan post-6.0.0-RC): the HOST-SIDE FORK lane: the session this one was
      * forked FROM (`SessionMetadata.forkedFrom`, read by prepare-task off the acquired session). A
      * fork byte-copies the source's committed transcript, so the source's standing opt-out governs
      * the copy: record found at prepare ⇒ the floor arm (mint, reason naming the fork, no
@@ -138,22 +145,33 @@ export interface PrepareMemoryInput {
      * record-query walk, so a source that flips WHILE the fork runs suppresses it live.
      */
     captureForkOrigin?: string;
-    /** design/383 §2.5 (rescan, codex adversarial round) — the fork-lineage read itself FAULTED
+    /** borrowed-readonly — design/383 §2.5 (rescan, codex adversarial round): the fork-lineage read itself FAULTED
      *  (session metadata unreadable): whether this session forks an opted-out source is unknowable,
      *  so the capture arm runs INDETERMINATE (suppress fail-closed, disclose, mint nothing) — a
      *  metadata outage must not read as "no lineage" (读错不许伪装 clean). */
     captureLineageFault?: boolean;
-    /** design/383 §2.5 (codex review adopted) — the SPAWNING session's write-plane control dir
+    /** borrowed-readonly — design/383 §2.5 (codex review adopted): the SPAWNING session's write-plane control dir
      *  (trusted internals chain), so the record-query leg reaches a parent on a DIFFERENT memory
      *  plane (project-writing parent, personal-writing child). Absent ⇒ same-plane query only. */
     parentCaptureQueryDir?: string;
-    /** design/383 §2.5 (codex round 3) — the full ancestor chain's capture coordinates off the
+    /** borrowed-readonly — design/383 §2.5 (codex round 3): the full ancestor chain's capture coordinates off the
      *  trusted internals seat; the harvest closure walks every row (deduped with the parent seat),
      *  so a mid-run flip anywhere up the tree suppresses this in-flight descendant. */
     captureAncestors?: ReadonlyArray<{
         sessionId: string;
         controlDir?: string;
     }>;
+    /**
+     * borrowed-readonly — the org-memory admission context (ruled 2026-08-05), assembled by
+     * prepare-task:
+     * - `orgMemoryDenied`/`complianceDegraded`: the compliance capability `org_memory_mount` verdict
+     *   for this principal (the veto covers the request-origin plane);
+     * - `parentAdmittedOrgScopes`: the delegation chain's FROZEN admitted org set — `undefined` for a
+     *   top-level task; for a delegated child the caller passes the fail-closed empty set when the
+     *   chain carries no verdict (an older-shape chain must not read as "unconstrained");
+     * - `priorOwnVerdict`/`governedProvenance`: the session freeze and the monotonic governance bit.
+     * Read as a whole into the admission call; never mutated.
+     */
     admissionCtx: {
         orgMemoryDenied: boolean;
         complianceDegraded: boolean;

package/dist/core/runner/prepare-park-ask.d.ts

@@ -142,10 +142,8 @@ export interface PrepareParkAskInput {
     };
     /** borrowed-mutable — the built harness. Writer here: `abort()` (release the gate, then stop the loop). */
     harness: Pick<AgentHarness, "abort">;
-    /** borrowed-mutable — the durable-suspend holder (`Prepared.suspendRef`). Writer here: the commit-side publication. */
-    suspendRef: Prepared["suspendRef"];
-    /** borrowed-readonly — the review holder; handed to the commit-side discriminant, which never writes it for these kinds. */
-    reviewRef: Prepared["reviewRef"];
+    /** borrowed-mutable — the run's committed-pause holder (`Prepared.pausedRef`). Writer here: the commit-side publication. */
+    pausedRef: Prepared["pausedRef"];
 }
 export interface PrepareParkAskResult {
     /** owned — the two closures as ONE value, or undefined exactly when the ask lane (and so the saga) is absent. */

package/dist/core/runner/prepare-park-ask.js

@@ -4,6 +4,7 @@ import { ASK_USER_QUESTION_TOOL_NAME, classifyQuestionOutcome, validateAskQuesti
 import { hasBackgroundShell, sweepBackgroundShells } from "../background-shell.js";
 import { boundInputHashOf } from "../canonical-json.js";
 import { BINDING_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, encodeAtFidelity, F012_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, mintCheckpointId, mintCheckpointToken, ORG_ADMISSION_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, resolveDeclaredFidelity, samePlainValue, TOKEN_CHECKPOINT_VERSION, } from "../checkpoint-store.js";
+import { pauseOf } from "../pause-registry.js";
 import { askCarryRowMembers } from "../hooks.js";
 import { defaultTaskRegistry } from "../task-registry.js";
 import { isLiveApproverSeat, carriesBidiControls, describeThrown, refuseOutOfContractDecision, tryCloneArgs } from "../tool-policy.js";
@@ -20,7 +21,7 @@ class ParkRefusal extends Error {
     }
 }
 export function prepareParkAsk(input) {
-    const { askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, suspendRef, reviewRef } = input;
+    const { askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef } = input;
     if (askLane === undefined || saga === undefined)
         return { parkAsk: undefined };
     const { composedCallSignal, approvalPreviewOf } = askLane;
@@ -272,8 +273,7 @@ export function prepareParkAsk(input) {
                     scope,
                     sessionId,
                     leafId,
-                    gate,
-                    pendingAction: {
+                    ...pauseOf(gate, {
                         kind: "tool_approval",
                         toolCallId: req.toolCallId,
                         toolName: req.toolName,
@@ -301,7 +301,7 @@ export function prepareParkAsk(input) {
                         boundInputHash: boundInputHashOf(parkedArgs),
                         batchToolCallIds,
                         completedCallIds,
-                    },
+                    }),
                     state: checkpointState,
                     deadline: ttlMs !== undefined
                         ? mintedAt + ttlMs
@@ -348,7 +348,7 @@ export function prepareParkAsk(input) {
                 }
                 return { parkFailed: committed.reason };
             }
-            publishCommittedSuspend({ suspendRef, reviewRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
+            publishCommittedSuspend({ pausedRef }, token, gate, cp.scope, remoteHandle, cp.checkpointId, cp.pendingAction);
             try {
                 await sessions.pin?.(sessionId);
             }

package/dist/core/runner/prepare-task.d.ts

@@ -7,7 +7,7 @@ export { DEFAULT_IRREVERSIBLE_SCOPE, checkpointScopeOf, placementValueOrAbsent }
 export { mcpManifestEntries } from "./prepare-wiring-manifest.js";
 export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
 export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
-import type { Runner } from "./runtask.js";
+import type { RunnerSelfSeat } from "./contracts.js";
 import type { Prepared, PrepareResume, RunInternals } from "./contracts.js";
 export type { FileHistoryBoundarySeat, InheritedGate, Prepared, PreparedMicroCompact, PrepareResume, ResolvedWorkspace, RunInternals, UsageGovernance } from "./contracts.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
@@ -107,7 +107,7 @@ export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions:
 /** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
  *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */
-runnerSelf?: Runner, 
+runnerSelf?: RunnerSelfSeat, 
 /** #499 — carrier for the id minted below, so a prepare that THROWS still lets its caller name the
  *  run (prepare emits run-scoped notices of its own; each needs a terminal that names it). Same seat
  *  shape the Runner uses for the generated taskId/sessionId. */

package/dist/core/runner/prepare-task.js

@@ -364,8 +364,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
         let handsLessResolvedFace;
         const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, autoModeIntent, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, orgAdmissionCheckpointState, faceCheckpointSection, faceCheckpointState, f012CheckpointState, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, frozenOnQuestion, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, autoModeSeat, handsEnabled, reportUsage, harnessRef, skillScope, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, hooks: () => hooks, preToolUseObservational: () => preToolUseObservational, hookTimeoutMs: () => hookTimeoutMs, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDecider, autoModeDenialTracking: () => autoModeDenialTracking, autoModeArming: () => autoModeArming, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         const { tools, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDecider, autoModeDenialTracking, autoModeArming, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, frozenOnAsk, carrierReadFace, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, autoModeIntent, peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized });
-        const suspendRef = {};
-        const reviewRef = {};
+        const pausedRef = {};
         const remoteEnvFailures = [];
         const suspendLoopRef = { hit: false };
         const compactionReuseRef = { consecutive: 0 };
@@ -589,7 +588,7 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
                 stream: withBrainCallGuardrail((m, c, o) => deps.brain.stream(m, c, o), brainCallGuardrailMs, brainCallGuardrailRef),
             };
         const harness = new AgentHarness({
-            abortResultDetails: () => (gateStopRef.terminal !== undefined ? { code: gateStopRef.terminal.code } : parkContaminationMarker({ suspendRef, reviewRef })),
+            abortResultDetails: () => (gateStopRef.terminal !== undefined ? { code: gateStopRef.terminal.code } : parkContaminationMarker({ pausedRef })),
             onToolInputValidationFault: validateInputFaultNotice(deps.onError, sessionId),
             ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
                 ? { maxOutputTokens: spec.limits.maxOutputTokens }
@@ -653,23 +652,23 @@ export async function prepareTask(spec, deps, sessions, resume, internals, runne
             }
         }
         const { hooks, hookTimeoutMs, preToolUseObservational, ownGatePreToolUse, basePolicyForResumeEdit, denyNarrowingPolicy, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, permissionRuleLane, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, lockedPreflight, tools, harnessTools, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, ownToolNames, shellGatedBash, handsCwdRef, readDenyMatcher, questionToolMounted, runtimeCaps, inheritedAncestorRules, inheritedParentConstraints, seedInheritedGate, hasSkillManifest, skillScope, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, autoModeDecider, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, approvalSettlement, humanBareRejections, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, suspendRef, reviewRef, frozenOnAsk, liveInheritedGate, delegation });
+        const { onAsk, preToolContexts, blockedToolCalls, gateOutcomes, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace } = prepareWiringManifest({ spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, hooks, preToolUseObservational, policyLayers, effectivePolicy, handsEnabled, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, lockedPreflight, peerLaneRefs, peerLaneActive, harness, pausedRef, frozenOnAsk, liveInheritedGate, delegation });
         if (fileHistoryBoundary !== undefined) {
             harness.on("tool_call", async () => {
                 await fileHistoryBoundary.settle();
                 return undefined;
             });
         }
-        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, humanBareRejections, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
+        const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking, spec, deps, sessionId, runId, hooks, hookTimeoutMs, notifyOwnHookCrash });
         const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, reminderMark, handsCwdRef, worktreeSessionRef, inheritedParentConstraints, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, autoModeIntent, autoModeDecider, inheritedAdmittedOrgScopes, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
-        const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, suspendRef, reviewRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, suspendRef, reviewRef });
-        prepareGateStations({ askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, humanBareRejections, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, approvalSettlement, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
+        const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedBash, shellGatedMonitor, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, faceCheckpointState, f012CheckpointState, orgAdmissionCheckpointState, ruleOffersOf, now, humanReviewRef, abortController, harness, pausedRef });
+        prepareGateStations({ askLane, parkAsk, tools, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, hooks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, gateOutcomes, batchHaltRef, blockedTracked, hookIdentity, reminderMark, planModeRef, hostTaskId, sessionId, ownGatePreToolUse, hookTimeoutMs, handsCwdRef, hookEnvFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedBash, shellGatedMonitor, autoModeDecider, autoModeDenialTracking, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, notifyOwnHookCrash });
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, microCompactKnob, harness, batchHaltRef, gitStatusRef, requestLossyRef, trimPressureRef });
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, epochArtifactDigestForSnapshot, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, additionalRootsCanonical, additionalReadRootsCanonical, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, abortController, hostTaskId, taskScope, buildAssembleInputs, centerAdoptionRef, harnessRef, epochDeclaredSections, carrierReadFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, approvalSettlement, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, suspendRef, suspendProgressRef, reviewRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, reminderMark, reminderDisclosureCounts, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, gateOutcomes, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, epochDeclaredSections, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, brainCallGuardrailRef, gateStopRef, suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent } } : {}), planModeRef, stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, gitStatusRef, listBackgroundTasks, hookIdentity, hookTimeoutMs, ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}) });
         rollback.commit();
         const prepared = buildPrepared();
         preparedHolder.current = prepared;