@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/runner/prepare-safety-scan.js

@@ -1,17 +1,40 @@
 import { callerToolNameProblem } from "../caller-tool-name.js";
-import { engineCardTypes, handBandEffects } from "../tool-registry.js";
-import { callerCardIdOf, offendingResultCard, rosterMemberBoundProblem, schemaKeyBoundProblem, survivorsByName } from "../tool-roster.js";
+import { describeToolCatalog } from "../tool-registry.js";
+import { callerCardIdOf, rosterMemberBoundProblem, schemaKeyBoundProblem, survivorsByName } from "../tool-roster.js";
 import { toolFaceProblem } from "./tool-face-overlay.js";
-import { OFFLOAD_TOOL_NAME } from "../tool-result-store.js";
-import { PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
 const REPEAT_RISK = { read: 0, idempotent: 1, write: 2 };
 const leastRepeatSafe = (a, b) => (REPEAT_RISK[a] >= REPEAT_RISK[b] ? a : b);
+function engineCandidatesOf(spec, deps) {
+    const hands = Boolean(deps.executionEnvFactory || deps.executionEnv);
+    const readOnlyHands = spec.handsReadOnly === true;
+    const out = [];
+    for (const e of describeToolCatalog()) {
+        if (!e.mountedBy.some((t) => t !== "scenario" && (t !== "hands" || hands)))
+            continue;
+        if (e.mountedBy.includes("hands") && e.face.ruleFace?.grammar === "command" && (e.face.effect === "read") !== readOnlyHands)
+            continue;
+        const effect = e.face.effect ?? "write";
+        for (const name of [e.name, ...(e.face.aliases ?? [])])
+            out.push([name, effect]);
+    }
+    return out;
+}
+function wakeEffectsOf(table, claimed, candidates) {
+    const wakeEffects = new Map(table);
+    const claims = new Set(claimed);
+    for (const [name, effect] of candidates) {
+        const prior = wakeEffects.get(name) ?? (claims.has(name) ? "write" : undefined);
+        wakeEffects.set(name, prior === undefined ? effect : leastRepeatSafe(prior, effect));
+    }
+    return wakeEffects;
+}
 const tierOf = (t) => t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
 export function prepareSafetyScan(input) {
     const { spec, deps } = input;
     const toolEffects = new Map();
     const survivors = survivorsByName(spec.tools ?? []);
     const claimedAliases = new Set();
+    const aliasClaims = [];
     const egressTools = new Set();
     const irreversibleTools = new Set();
     const irreversibilityTier = new Map();
@@ -52,18 +75,12 @@ export function prepareSafetyScan(input) {
                 ...(t.ruleFace !== undefined ? { ruleFace: t.ruleFace } : {}),
                 ...(t.renderHints !== undefined ? { renderHints: t.renderHints } : {}),
             };
-            const faceProblem = toolFaceProblem(declared, t.parameters, { toolName: t.name });
+            const faceProblem = toolFaceProblem(declared, t.parameters, { toolName: t.name, cardId: callerCardIdOf(t) });
             if (faceProblem !== undefined) {
                 const e = new Error(`Tool "${t.name}" declares a face its schema cannot carry: ${faceProblem}.`);
                 e.code = "config.tool_face_invalid";
                 throw e;
             }
-            const foreignCard = offendingResultCard(t.renderHints, callerCardIdOf(t), engineCardTypes());
-            if (foreignCard !== undefined) {
-                const e = new Error(`Tool "${t.name}" declares a result card outside its own namespace: ${JSON.stringify(foreignCard)} (a caller card is "${callerCardIdOf(t)}/<card>"; engine cards and other contracts' namespaces are reserved).`);
-                e.code = "config.tool_face_invalid";
-                throw e;
-            }
         }
         for (const [what, n] of [["name", t.name], ...(t.aliases ?? []).map((a) => ["alias", a])]) {
             const problem = callerToolNameProblem(n);
@@ -96,16 +113,21 @@ export function prepareSafetyScan(input) {
             markedBy(t.name, "deployment");
         }
     }
+    const candidates = engineCandidatesOf(spec, deps);
+    const engineNames = new Set(candidates.map(([n]) => n));
     for (const t of survivors.values()) {
         const tier = tierOf(t);
         for (const alias of t.aliases ?? []) {
             if (alias === t.name || survivors.has(alias))
                 continue;
+            aliasClaims.push([alias, t.effect ?? "write"]);
             if (claimedAliases.has(alias))
                 continue;
             claimedAliases.add(alias);
             if (t.effect)
                 toolEffects.set(alias, t.effect);
+            if (engineNames.has(alias))
+                continue;
             if (tier !== undefined) {
                 irreversibilityTier.set(alias, tier);
                 if (tier === "always" || tier === "maybe") {
@@ -121,24 +143,9 @@ export function prepareSafetyScan(input) {
             }
         }
     }
-    toolEffects.set(OFFLOAD_TOOL_NAME, "read");
-    const claimerEffects = new Map([...claimedAliases, ...survivors.keys()].map((a) => [a, toolEffects.get(a) ?? "write"]));
-    const recordHandEffect = (name, effect) => {
-        const claimed = claimerEffects.get(name);
-        toolEffects.set(name, claimed === undefined ? effect : leastRepeatSafe(claimed, effect));
-    };
-    if (deps.executionEnvFactory || deps.executionEnv) {
-        for (const [name, effect] of handBandEffects())
-            recordHandEffect(name, effect);
-        if (spec.handsReadOnly === true)
-            recordHandEffect("Bash", "read");
-    }
-    if (spec.enablePlanMode === true) {
-        toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");
-        toolEffects.set(ENTER_PLAN_MODE_TOOL_NAME, "read");
-    }
     return {
         toolEffects,
+        wakeEffects: wakeEffectsOf(toolEffects, [...claimedAliases, ...survivors.keys()], [...aliasClaims, ...candidates]),
         egressTools,
         irreversibleTools,
         irreversibilityTier,

package/dist/core/runner/prepare-suspend-saga.d.ts

@@ -177,8 +177,8 @@ export interface PrepareSuspendSagaInput {
         readonly definition?: string;
         readonly lists: string;
     } | undefined;
-    /** borrowed-readonly — the external-content-target fold (the row's monotonic bit). */
-    externalContentTargetActive: boolean;
+    /** borrowed-readonly — the external-content-target fold (the row's monotonic bit). */ externalContentTargetActive: boolean;
+    /** borrowed-readonly — the leg's cross-boundary lane: the row's mark, and the record written before the row as the row's leaf. */ crossBoundary: import("./cross-boundary-lane.js").CrossBoundaryLane;
     /** borrowed-mutable — the run-scoped remote-lifecycle failure log (`Prepared.remoteEnvFailures`). Writer here: the
      *  compensation's note binding (`push`). */
     remoteEnvFailures: Prepared["remoteEnvFailures"];

package/dist/core/runner/prepare-suspend-saga.js

@@ -82,7 +82,7 @@ function stampPlacementRootSessionId(placementRootResolved) {
     return placementValueOrAbsent(placementRootResolved);
 }
 export function prepareSuspendSaga(input) {
-    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot, handsHome, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors, inheritedPathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, ownToolLists, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
+    const { gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot, handsHome, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors, inheritedPathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, ownToolLists, externalContentTargetActive, crossBoundary, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter } = input;
     if (!gateMachineryActive)
         return { saga: undefined };
     const inFlightSpendMicroUsd = () => {
@@ -182,6 +182,7 @@ export function prepareSuspendSaga(input) {
         toolCeiling: toolCeiling !== undefined ? toolCeiling.map((l) => ({ ...(l.allow !== undefined ? { allow: persistedToolNameList(l.allow, "allowed") } : {}), deny: persistedToolNameList(l.deny, "denied") })) : undefined,
         toolListsJudged,
         ownToolLists: ownToolLists !== undefined ? { toolName: ownToolLists.toolName, ...(ownToolLists.definition !== undefined ? { definition: ownToolLists.definition } : {}), lists: ownToolLists.lists } : undefined,
+        crossBoundaryRecorded: crossBoundary.recorded() ? true : undefined,
     });
     const compensatePausedVM = (remoteEnv, snapshotId) => compensateUnparkedPause(remoteEnv, snapshotId, {
         boundMs: PARK_COMPENSATION_TIMEOUT_MS,
@@ -199,6 +200,7 @@ export function prepareSuspendSaga(input) {
             return { tag: "absent" };
         if (memoryEngineSession)
             await memoryEngineSession.harvest("checkpoint");
+        const recordUnwritten = await crossBoundary.owe(cp.leafId).then((entryId) => void (entryId !== undefined && (cp = { ...cp, leafId: entryId })), (err) => ({ err }));
         if (cutSignal?.aborted) {
             if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
                 const back = await compensatePausedVM(remoteEnv, remoteHandle.snapshotId);
@@ -262,6 +264,8 @@ export function prepareSuspendSaga(input) {
             const own = judgeAsStored(stamped, fidelity);
             if (own.kind !== "ok")
                 throw new Error(`the checkpoint row was not written: ${own.kind === "damaged" ? own.why : "it lists words this engine lacks"}`);
+            if (recordUnwritten !== undefined)
+                throw new Error(`the checkpoint row was not written: the session's cross-boundary record it points at could not be written first (${thrownText(recordUnwritten.err)})`);
             putAttempted = true;
             await checkpointStore.put(token, stamped);
             announceCommittedScreeningPark();
@@ -270,7 +274,7 @@ export function prepareSuspendSaga(input) {
         catch (putErr) {
             deps.onError?.(putErr, { phase: "config", sessionId });
             if (!putAttempted)
-                return compensateNotWritten("the approval checkpoint was not written (the row failed its own requirement judge before the write; the deployment's error face carries why)");
+                return compensateNotWritten(recordUnwritten !== undefined ? `the session's cross-boundary record could not be written before its approval could be parked (${thrownText(recordUnwritten.err)}) — on a governed tree a row is not put without its record` : "the approval checkpoint was not written (a check before the write refused it — the row's own requirement judge; the deployment's error face carries why)");
             const confirmed = await confirmPutOutcome(putErr);
             if (confirmed === "committed") {
                 try {

package/dist/core/runner/prepare-task.js

@@ -43,6 +43,7 @@ import { prepareTurnWiring } from "./prepare-turn-wiring.js";
 export { runGuardChain } from "./prepare-context-lane.js";
 import { preparePromptAssembly } from "./prepare-prompt-assembly.js";
 import { limitConfigError, prepareConfigDoors } from "./prepare-config-doors.js";
+import { joinedCrossBoundaryTree, prepareCrossBoundaryLane } from "./cross-boundary-lane.js";
 import { prepareSafetyScan } from "./prepare-safety-scan.js";
 import { prepareAcquireReconcile } from "./prepare-acquire-reconcile.js";
 import { settleBranchWriteBack } from "./branch-writeback.js";
@@ -305,7 +306,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     const { toolFaceLists, promptProfile, promptHost, promptBinding, lockedPreflight, resolvedInteractionPosture, microCompactKnob, resolvedRole, model, thinking, compModel, fableMitigations, memoryDelegationEvidence, memoryProvenance, memoryCapturePolicy, usageWindows, brainCallGuardrailRef, brainCallGuardrailMs } = doors;
     announceToolModelGate(deps.onNotice, model.id, doors.modelGate);
     const modelGateManifest = toolModelGateManifest(doors.modelGate);
-    const { toolEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, toolMarkSources } = prepareSafetyScan({ spec, deps });
+    const { toolEffects, wakeEffects, egressTools, irreversibleTools, irreversibilityTier, axisExplicitNegatives, reversibilityProbes, toolMarkSources } = prepareSafetyScan({ spec, deps });
     let shellGatedTools = new Set();
     refuseRequireExistingWithoutSession(spec);
     refuseRegistryScopeMismatch(spec, internals);
@@ -318,7 +319,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         throw e;
     }
     const fileHistoryRequest = resolveFileHistoryRequest(spec, deps);
-    const { acquired, session, conflictRef, wakeRecovered, branch } = await prepareAcquireReconcile({ sessions, spec, resume, toolEffects, report: (e, id) => deps.onError?.(e, { phase: "config", sessionId: id }), ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
+    const { acquired, session, conflictRef, wakeRecovered, branch } = await prepareAcquireReconcile({ sessions, spec, resume, wakeEffects, report: (e, id) => deps.onError?.(e, { phase: "config", sessionId: id }), ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
     const sessionId = acquired.sessionId;
     await holdSessionLock?.(sessionId);
     const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
@@ -377,6 +378,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     if (!handsEnabled)
         refuseUserAttachmentPathsWithoutWorkspace(userAttachmentsSeat);
     const externalContentTargetActive = executionEnv.externalContentTarget === true || resume?.seed.externalContentTarget === true;
+    const crossBoundaryTree = joinedCrossBoundaryTree(internals?.crossBoundaryTree, (m) => deps.onError?.(new Error(m), { phase: "config", sessionId }));
     const abortController = new AbortController();
     if (spec.signal?.aborted)
         abortController.abort();
@@ -457,7 +459,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         let handsLessResolvedWriteFace;
         const mcpPool = installedPreflight.mcp?.length ? { pool: internals?.mcpPool ?? new McpConnectionPool(), owned: internals?.mcpPool === undefined } : undefined;
         const mountedMcpNow = mcpPool !== undefined ? () => mountedMcpOf({ declared: installedPreflight.mcp, roster: roster.tools, aggregateNames: new Set(mcp.tools.filter((t) => t.mcpRemoteName === undefined).map((t) => t.name)), pool: mcpPool.pool }) : undefined;
-        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, askSeat: doors.askSeat, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { chainTop, onLeg: onLeg.chained }, checkpointSeat, checkpointScope, toolFaceSnapshot, mountsCallerTool, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, modBus: legMods.bus, ownModChain, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
+        const { liveInheritedGate, seedInheritedGate, inheritedAncestorRules, inheritedShellGate, inheritedParentConstraints, permissionMode, commitModeSeats, endModeCeiling, inheritedAdmittedOrgScopes, priorOwnOrgVerdict, orgGovernedProvenance, effectiveShellGate, ownSessionRulesRef, ancestorSessionRulesRef, ancestorRulesNow, memoryAdmittedOrgScopesRef, ownOrgVerdictRef, runClampSource, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, frozenOnAsk, hookEnvSource, frozenOnQuestion, parentSpecSeat, provenanceForChildrenRef, delegationSettlementRef, inheritedGateForChildren, carrierReadFace, carrierWriteFace, fullShellReachable, gateStopRef, stopForDenialLimit, enrichSpecToolCtx } = prepareInheritedGate({ spec, deps, askSeat: doors.askSeat, crossBoundaryTree, internals, resume, sessions, sessionId, runId, hostTaskId, taskRootFinal, executionEnv, ownedEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { chainTop, onLeg: onLeg.chained }, checkpointSeat, checkpointScope, toolFaceSnapshot, mountsCallerTool, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), promptProfile, resolvedInteractionPosture, permissionModeSeat, handsEnabled, reportUsage, harnessRef, skillGrants, requestAllowedTools: allowedToolTables.request, forwardEvent, subagentRetain, worktreeIsolation, requestReview, requestStopAfterTurn, enterPlanMode, reminderMark, reminderDisclosureCounts, fileHistoryEnabled, historyScope, historyRoot, historyFs, abortRun: () => { abortController.abort(); void harness.abort(); }, runtimeCaps: () => runtimeCaps, modBus: legMods.bus, ownModChain, hookEnvFace: () => hookEnvFace, autoModeDecider: () => autoModeDeciderRef.current, autoModeDenialTracking: () => autoModeDenialTrackingRef.current, autoModeArming: () => autoModeArmingRef.current, agentForkDenial: () => agentForkDenial, observersActive: () => observersActive, resolvedReadFace: () => resolvedReadFace, resolvedWriteFace: () => resolvedWriteFace, readDenyAdditionsNormalized: () => readDenyAdditionsNormalized, handsLessResolvedFace: () => handsLessResolvedFace, handsLessResolvedWriteFace: () => handsLessResolvedWriteFace, centerAdoption: () => centerAdoptionRef.current, memoryEngineSession: () => memoryEngineSession });
         bindPermissionModeSeat(permissionMode);
         const personRowNotices = { onUnread: ruleStoreUnreadableNotice(deps.onNotice, { sessionId, runId }), onRowsDropped: ruleRowsDroppedNotice(deps.onNotice, { sessionId, runId }) };
         const readerOf = (signals) => personPathRowsOfTask({ deps, notices: personRowNotices, principal: spec.principal, ids: { sessionId, runId, taskId: hostTaskId }, root: taskRootFinal, rootCanonical: taskRootCanonical, leads: headLeads, chainTop, occurrences: toolOccurrences, signals });
@@ -475,8 +477,9 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const legExemptRoots = Object.freeze(dataRootSpellings(deps.memoryEngineDir));
         const legWriteGuard = { exemptRoots: legExemptRoots, rows: toolPolicyWriteGuardRows([installedToolPolicy, ...(inheritedParentConstraints ?? []).map((c) => c.policy)]) };
         const sideCallBookRef = {};
-        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => personRows.tablesReady().then(() => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: pathTables?.ruleRows() ?? effectivePathDenyRules })), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, delegated: delegation.isDelegatedChild, sideCallBookRef });
+        const { roster, blockedRef, runtimeCaps, runtimeCapsFaulted, complianceDenies, complianceDegraded, agentForkDenial, observersActive, autoModeArmReason, autoModeDeciderRef, autoModeDenialTrackingRef, autoModeArmingRef, armAutoMode, selfOrchestrationActive, workflowToolsActive, workflowSizeGuideline } = await prepareCapsAndWorkflow({ spec, deps, askSeat: doors.askSeat, internals, crossBoundaryTree, session, sessionId, runId, hostTaskId, taskScope, taskRootFinal, model, thinking, lockedPreflight, checkpointSeat, toolEffects, safetyAxes: { irreversibilityTier, irreversibleTools, reversibilityProbes, egressTools, toolMarkSources }, toolFaceSnapshot, promptProfile, resolvedInteractionPosture, harnessRef, parentSpecSeat, runClampSource, forwardEvent, inheritedGateForChildren, enrichSpecToolCtx, maybeOffload, requestReview, enterPlanMode, permissionMode, readDenyEntries: () => personRows.tablesReady().then(() => ({ entries: readDenyMatcher?.entries ?? [], ruleRows: pathTables?.ruleRows() ?? effectivePathDenyRules })), peerLaneActive, peerSendMessageBuiltIn, runnerSelf, memoryEngineSession: () => memoryEngineSession, centerAdoption: () => centerAdoptionRef.current, delegated: delegation.isDelegatedChild, sideCallBookRef });
         const tools = roster.tools;
+        const crossBoundary = await prepareCrossBoundaryLane({ token: crossBoundaryTree, posture: doors.crossBoundaryPosture, externalContentTargetActive, env: executionEnv, session, resumeLeg: resume !== undefined, sessionId, runId, hostTaskId, deps });
         const pausedRef = {};
         const undeliveredContinuationRef = { current: { parkedSteers: [], orphanTasks: [] } };
         const remoteEnvFailures = [];
@@ -786,7 +789,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             }
         }
         const { basePolicyForResumeEdit, denyNarrowingPolicy, skillGrantLane, allowEntryLanes, policyLayers, effectivePolicy, inheritedUnavailableAsks, inheritedAskGrants, askSourceIdentity, riskAxesOf, ruleOffersOf, grantBindingOf, permissionRuleLane, ruleLaneFacts, permissionRuleOrgLane, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, foldAskClasses, ancestorSandboxAdmissions, ancestorArbitrations, inheritedToolChecks } = await preparePolicyChain({ spec, deps, internals, sessionId, runId, hostTaskId, taskRootFinal, additionalRootsCanonical, executionEnv, lockedPreflight: installedPreflight, pathRuleAnchors: { leg: legAnchors, chainTop }, headLeads, tools, harnessTools, selector: toolFaceSnapshot.selector, toolEffects, egressTools, irreversibilityTier, axisExplicitNegatives, shellGatedTools, toolMarkSources, envHandToolNames, handsCwdRef, readDenyMatcher, personRows, questionToolMounted, runtimeCaps, inheritedAncestorRules, ancestorSessionRulesRef, inheritedParentConstraints, seedInheritedGate, skillGrants, skillSpecs, allowedToolTables, frozenOnAsk, hookEnvSource, notifyOwnHookCrash, modBus: legMods.bus, ownModChain, autoModeDecider: () => autoModeDeciderRef.current, readFace: () => resolvedReadFace, permissionMode, scratchpadDir: spec.envFacts?.scratchpadDir, toolRosterDeltas: rosterSeat, stopForDenialLimit, delegation, abortController, now, ownSessionRulesRef });
-        const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus: legMods.bus, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope, memoryPollution: () => memoryEngineSession?.pollution });
+        const { onAsk, preToolContexts, blockedToolCalls, batchHaltRef, blockedTracked, incompleteSuspendAdapter, durableSuspendInfraReady, resourceSuspendEligible, usageGovernance, durableApproval, wiringManifest, writeProtection, parkLaneArmed, gateMachineryActive, hookIdentity, hookEnvFace, sessionBoxBound } = prepareWiringManifest({ spec, deps, askSeat: doors.askSeat, crossBoundaryStationEngaged: crossBoundary.stationEngaged, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus: legMods.bus, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, shellReadStationArmed: handsReadFace.shellReadStationArmed, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, harness, pausedRef, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive: handsReadFace.readDenyBuiltinTiersActive, lspManagerWired, lspDiagnosticsLive: lspDiagnostics !== undefined, fileHistoryFact, sessionBox, checkpointScope, memoryPollution: () => memoryEngineSession?.pollution });
         const writeProtectionCheck = writeProtection.mount?.check;
         writeTargetJudgeRef.current = writeProtection.judgeWriteTarget;
         if (fileHistoryBoundary !== undefined) {
@@ -796,20 +799,20 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
             });
         }
         const listPathRows = () => skillSpecs.flatMap((s) => compileSkillGrant(s, "model").rows).flatMap((r) => (r.behavior === "deny" && r.compiled.kind === "path" ? [r.compiled.rule] : []));
-        const stampCallTarget = attachmentRootCanonical === undefined ? undefined : legCallTargetStamp({ env: executionEnv, root: attachmentRootCanonical, cwd: () => handsCwdRef?.current, judgesPaths: () => effectivePolicy?.pathRules !== undefined || basePolicyForResumeEdit?.pathRules !== undefined || permissionRuleLane !== undefined || skillSpecs.some((s) => compileSkillGrant(s, "model").rows.some((r) => r.compiled.kind === "path")) || allowedToolTables.request.holdsPathRows() || allowedToolTables.deployment.holdsPathRows(), leads: () => headLeads.resolve([...toolPolicyPathRules([effectivePolicy, basePolicyForResumeEdit, ...(inheritedParentConstraints ?? []).map((c) => c.policy)], legAnchors), ...bindPathRules(listPathRows().map((rule) => ({ parsed: rule, ruleText: rule.rule })), legAnchors)]) });
+        const stampCallTarget = attachmentRootCanonical === undefined ? undefined : legCallTargetStamp({ env: executionEnv, root: attachmentRootCanonical, cwd: () => handsCwdRef?.current, judgesPaths: () => parkLaneArmed || effectivePolicy?.pathRules !== undefined || basePolicyForResumeEdit?.pathRules !== undefined || permissionRuleLane !== undefined || skillSpecs.some((s) => compileSkillGrant(s, "model").rows.some((r) => r.compiled.kind === "path")) || allowedToolTables.request.holdsPathRows() || allowedToolTables.deployment.holdsPathRows(), leads: () => headLeads.resolve([...toolPolicyPathRules([effectivePolicy, basePolicyForResumeEdit, ...(inheritedParentConstraints ?? []).map((c) => c.policy)], legAnchors), ...bindPathRules(listPathRows().map((rule) => ({ parsed: rule, ruleText: rule.rule })), legAnchors)]) });
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, advertisedWritableDirs, exemptRoots: legExemptRoots, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, modBus: legMods.bus, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const inheritedAnchorRecords = chainAnchorRecords(chainTop, inheritedParentConstraints ?? []);
-        const { saga } = prepareSuspendSaga({ gateMachineryActive, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot: attachmentRootCanonical, handsHome: attachmentRootCanonical !== undefined ? legAnchors.home : undefined, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors: chainTop !== legAnchors ? inheritedAnchorRecords.pathRuleAnchors : undefined, inheritedPathRuleInstallations: inheritedAnchorRecords.pathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, ownToolLists, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
+        const { saga } = prepareSuspendSaga({ gateMachineryActive, crossBoundary, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, reminderMark, handsCwdRef, handsRoot: attachmentRootCanonical, handsHome: attachmentRootCanonical !== undefined ? legAnchors.home : undefined, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors: chainTop !== legAnchors ? inheritedAnchorRecords.pathRuleAnchors : undefined, inheritedPathRuleInstallations: inheritedAnchorRecords.pathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, ownToolLists, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, checkpointScope, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
         const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, advertisedWritableDirs, exemptRoots: legExemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
-        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, modBus: legMods.bus, inheritedToolChecks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, readDenyInForce: (toolCallId) => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...(pathTables?.forCall(toolCallId).ruleRows ?? handsReadFaceInput.denyRuleRows).filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement });
+        const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, crossBoundaryCheck: crossBoundary.seat({ tools, roster: rosterSeat }), toolEffects, deps, toolCallGateArmedRef, effectivePolicy, modBus: legMods.bus, inheritedToolChecks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, readDenyInForce: (toolCallId) => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...(pathTables?.forCall(toolCallId).ruleRows ?? handsReadFaceInput.denyRuleRows).filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
         const { microCompact, charsPerToken } = prepareContextLane({ model, deps, sessionId, runId, hostTaskId, offloadStore, toolRosterDeltas: rosterSeat, microCompactKnob, harness, batchHaltRef, gitStatusRef, postureFrameRef, requestLossyRef, trimPressureRef, contextOverlay: legContextOverlay, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}) });
         const preparedHolder = {};
-        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest: promptManifest.identity.artifact, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
+        const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, compactionRestore, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest: promptManifest.identity.artifact, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, modelFileReader: modelFileReaderSeat.current, reminderMark, reminderDisclosureCounts, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), consolidationWriteJudge, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, promptIdentity, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, readTaskFile, recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, modBus: legMods.bus, sideCallBookRef, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, crossBoundary, registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), consolidationWriteJudge, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, promptIdentity, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, ...(compactionRestore !== undefined ? { compactionRestore } : {}), recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, modBus: legMods.bus, sideCallBookRef, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}) });
         refuseLateRosterChanges(callerRoster.roster);
         rollback.commit();
         commitModeSeats(abortController.signal);

package/dist/core/runner/prepare-turn-wiring.d.ts

@@ -12,10 +12,11 @@ import { type ConsolidationWriteJudgeLeg } from "./memory-consolidation-write-ju
 import type { RunnerDeps, TaskSpec } from "../types.js";
 import type { CwdRef } from "../../tools/fs/fs-shared.js";
 import { type ContainmentFace } from "../../tools/fs/index.js";
-import type { PlacedReadDenyMatcher } from "../../tools/fs/read-deny-home.js";
 import type { ReadRootsSeat } from "./person-path-rows.js";
 import { type ReadFileState } from "../../tools/fs/safety.js";
 import type { Prepared } from "./contracts.js";
+import type { ModelFileReader } from "../../tools/fs/fs-read.js";
+import type { ReminderDisclosureCounts } from "../reminder-disclosure.js";
 export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the deployment seats: `cacheBreakDetection` (the detector knob), `onError` (the attachment-skip
      *  degraded line), `promptSource` (the center candidate's state and current artifact), `permissionRuleStore` and
@@ -73,8 +74,12 @@ export interface PrepareTurnWiringInput {
     /** borrowed-readonly — the read face's root set beside the attachment root, read per use: the write roots, the read
      *  roots with the run's grants, the person's read directories as the run read them last (no call: `ready` first). */
     readRoots: (() => readonly string[]) & Pick<ReadRootsSeat, "ready">;
-    /** borrowed-readonly — the run's read deny table (its latest; these readers are no call), or undefined (the reader's withheld arm). */
-    readDenyMatcher: PlacedReadDenyMatcher | undefined;
+    /** borrowed-readonly — the leg's one file reader (the hands band's), or undefined without hands: the restore reads through it. */
+    modelFileReader: ModelFileReader | undefined;
+    /** borrowed-readonly — the run's reminder mark (the restore frames' marked blocks). */
+    reminderMark: string | undefined;
+    /** borrowed-mutable — the run's disclosure counters; the restore frames' scans bump them when a frame is delivered. */
+    reminderDisclosureCounts: ReminderDisclosureCounts | undefined;
     /** borrowed-readonly — the resolved read face, or undefined (the fence's ninth argument). */
     resolvedReadFace: ContainmentFace | undefined;
     /** borrowed-readonly — the tracked-cwd seat, read per call by the kept-tail normalizer (never written here). */
@@ -148,8 +153,8 @@ export interface PrepareTurnWiringResult {
     } | undefined;
     /** owned — the fixed prompt-overhead term in the compaction trigger's coordinate (`Prepared.promptOverheadTokens`). */
     promptOverheadTokens: number;
-    /** owned — the fenced working-file reader, or undefined without hands (`Prepared.readTaskFile`). */
-    readTaskFile: Prepared["readTaskFile"];
+    /** owned — the post-compaction restore, or undefined without hands (`Prepared.compactionRestore`). */
+    compactionRestore: Prepared["compactionRestore"];
     /** owned — the kept-tail path normalizer, or undefined without hands. */
     normalizeAttachmentPath: Prepared["normalizeAttachmentPath"];
     /** owned — the Read tool's dedup-stub predicate, or undefined without hands. */

package/dist/core/runner/prepare-turn-wiring.js

@@ -8,14 +8,13 @@ import { createSyntheticReadJudge } from "../synthetic-read-verdict.js";
 import { createConsolidationWriteJudge } from "./memory-consolidation-write-judge.js";
 import { toolCallFaceOf } from "../tool-roster.js";
 import { ORG_ADJUDICATION_TIMEOUT_MS } from "../permission-rule-org.js";
-import { decodeTextBytes } from "../../tools/fs/encoding.js";
-import { applyContextShrinkToReadFileState, isReadDedupStubResult } from "../../tools/fs/index.js";
+import { applyContextShrinkToReadFileState, isReadDedupStubResult, readFileStateAfterSummary } from "../../tools/fs/index.js";
 import { resolveKey } from "../../tools/fs/safety.js";
 import { PROMPT_HASH_SALT } from "./prompt-hash-salt.js";
 import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
-import { thrownText } from "../thrown-value.js";
+import { readCompactionRestore } from "../user-attachment.js";
 export function prepareTurnWiring(input) {
-    const { deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, readDenyMatcher, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
+    const { deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest, promptProfile, fableMitigations, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, modelFileReader, reminderMark, reminderDisclosureCounts, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants, callerPolicy, inheritedPolicies, persistedRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder } = input;
     const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
     const cacheFingerprint = cacheBreakDetector
         ? { systemPrompt: systemPromptSeat.current, tools: toolsToFingerprintInputs(harnessTools) }
@@ -41,49 +40,6 @@ export function prepareTurnWiring(input) {
     promptManifest.lowering = turnSnapshot.lowering;
     const promptOverheadTokens = Math.ceil((systemPromptSeat.current.length +
         harnessTools.reduce((a, t) => a + t.name.length + (t.description?.length ?? 0) + JSON.stringify(t.parameters ?? {}).length, 0)) / charsPerToken);
-    const announceAttachmentSkip = (path, reason) => {
-        deps.onError?.(new Error(`working-file attachment skipped — ${path}: ${reason}`), {
-            phase: "degraded",
-            sessionId,
-            classification: "attachment-read",
-        });
-    };
-    const readTaskFile = handsEnabled
-        ? async (path) => {
-            try {
-                let key = path;
-                if (attachmentRootCanonical !== undefined) {
-                    await readRoots.ready(abortController.signal);
-                    if (abortController.signal.aborted)
-                        return null;
-                    const rk = await resolveKey(executionEnv, attachmentRootCanonical, path, abortController.signal, undefined, readRoots(), undefined, readDenyMatcher, resolvedReadFace);
-                    if (!rk.ok) {
-                        announceAttachmentSkip(path, rk.violation.message);
-                        if (rk.violation.code === "read_path_denied" && rk.violation.pattern !== undefined) {
-                            return { withheld: { pattern: rk.violation.pattern } };
-                        }
-                        return null;
-                    }
-                    key = rk.key;
-                }
-                const r = await executionEnv.readBinaryFile(key, abortController.signal);
-                if (!r.ok) {
-                    announceAttachmentSkip(path, r.error.message);
-                    return null;
-                }
-                const d = decodeTextBytes(r.value);
-                if (d.malformed) {
-                    announceAttachmentSkip(path, "malformed text encoding (truncated UTF-16 body)");
-                    return null;
-                }
-                return d.text;
-            }
-            catch (err) {
-                announceAttachmentSkip(path, thrownText(err));
-                return null;
-            }
-        }
-        : undefined;
     const normalizeAttachmentPath = handsEnabled
         ? async (path) => {
             if (attachmentRootCanonical === undefined)
@@ -108,7 +64,7 @@ export function prepareTurnWiring(input) {
             .map(([path]) => path)
         : undefined;
     const onCompactionApplied = handsEnabled && readFileStateForCheckpoint
-        ? (attachedComplete, preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", attachedComplete, ...(preserveReadState !== undefined ? { preserveKeys: preserveReadState } : {}) })
+        ? (preserveReadState) => applyContextShrinkToReadFileState(readFileStateForCheckpoint, { kind: "summarized", preserveKeys: preserveReadState })
         : undefined;
     const syntheticLayers = {
         skillGrants,
@@ -120,6 +76,15 @@ export function prepareTurnWiring(input) {
         ...(stampCallTarget !== undefined ? { stampCallTarget } : {}),
     };
     const syntheticReadVerdict = createSyntheticReadJudge({ ...syntheticLayers, signal: abortController.signal });
+    const announceRestoreSkip = (path, reason) => {
+        deps.onError?.(new Error(`compaction restore did not deliver ${path}: ${reason}`), { phase: "degraded", sessionId, classification: "attachment-read" });
+    };
+    const compactionRestore = handsEnabled && modelFileReader !== undefined
+        ? {
+            restore: (ask) => readCompactionRestore({ reader: modelFileReader, judge: syntheticReadVerdict, cwd: () => handsCwdRef?.current, mark: reminderMark, counts: reminderDisclosureCounts, signal: abortController.signal, report: announceRestoreSkip }, { candidates: ask.candidates, maxFiles: ask.maxFiles, perFileChars: ask.perFileChars, totalChars: ask.totalChars, charsPerToken: ask.charsPerToken, dedupAgainst: readFileStateAfterSummary(readFileStateForCheckpoint ?? new Map(), ask.preserveKeys) }),
+            undelivered: announceRestoreSkip,
+        }
+        : undefined;
     const consolidationWriteJudge = createConsolidationWriteJudge({ ruleStoreProvider: deps.permissionRuleStore, principal: spec.principal, localOwnerDeclared: deps.localOwnerRules === true, ...(callerPolicy !== undefined ? { callerPolicy } : {}) }, { rows: personRowsBeyondRun, lanes: ruleLaneFacts, layers: { skillGrants, ...(denyNarrowingPolicy !== undefined ? { denyNarrowingPolicy } : {}), inheritedPolicies, ...(stampCallTarget !== undefined ? { stampCallTarget } : {}) }, facts: () => {
             const p = preparedHolder.current;
             return { face: toolCallFaceOf(p?.toolRoster, "Write"), cwd: p?.cwdRef?.current, root: p?.handsRoot, advertisedWritableDirs: p?.advertisedWritableDirs, exemptRoots: p?.exemptRoots };
@@ -218,5 +183,5 @@ export function prepareTurnWiring(input) {
     const effectiveReadFaceObserved = carrierReadFace();
     const effectiveWriteFaceObserved = carrierWriteFace();
     const effectiveReadDenyObserved = readDenyAdditionsNormalized.length > 0 ? readDenyAdditionsNormalized.map((e) => ({ ...e })) : undefined;
-    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, readTaskFile, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
+    return { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, compactionRestore, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved };
 }

package/dist/core/runner/prepare-wiring-manifest.d.ts

@@ -82,9 +82,9 @@ export interface PrepareWiringManifestInput {
     irreversibleTools: ReadonlySet<string>;
     /** borrowed-readonly — see `irreversibleTools`. */
     egressTools: ReadonlySet<string>;
-    /** borrowed-readonly — the hands phase mounted the shell READ STATION (a real shell was mounted): the gate
-     *  machinery must run for it, under every doctrine — the read-only face's containment IS that station. */
+    /** borrowed-readonly — the hands phase mounted the shell READ STATION (a real shell was mounted): the gate machinery must run for it, under every doctrine. */
     shellReadStationArmed: boolean;
+    /** borrowed-readonly — the leg's cross-boundary station is engaged (a declared posture, a target leg, a governed tree): the gate machinery runs for it. */ crossBoundaryStationEngaged: boolean;
     /** borrowed-readonly — the effect collection; read only here (the ungated scans). */
     toolEffects: ReadonlyMap<string, ToolEffect>;
     /** borrowed-readonly — the per-task owned env when a factory minted one (durable infra, the hook-env predicate). */

package/dist/core/runner/prepare-wiring-manifest.js

@@ -117,7 +117,7 @@ function announceDurableGateUnavailable(args) {
     });
 }
 export function prepareWiringManifest(input) {
-    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, lspDiagnosticsLive, fileHistoryFact, memoryPollution } = input;
+    const { spec, deps, internals, resume, sessionId, runId, hostTaskId, taskScope, modBus, checkpointScope, policyLayers, effectivePolicy, handsEnabled, taskRootFinal, legWriteGuard, mcp, irreversibleTools, egressTools, toolEffects, ownedEnv, executionEnv, offloadStore, onceLedger, usageWindows, envLifetimeSuspendAt, runtimeCaps, resolvedInteractionPosture, durableQuestionFace, liveQuestionFace, checkpointStore, sessions, modelGateManifest, autoModeArmReason, permissionMode, lockedPreflight, peerLaneRefs, frameSettlement, sessionBox, harness, pausedRef, askSeat, liveInheritedGate, delegation, toolRoster, readDenyBuiltinTiersActive, lspManagerWired, shellReadStationArmed, crossBoundaryStationEngaged, lspDiagnosticsLive, fileHistoryFact, memoryPollution } = input;
     const onAsk = askSeat.value;
     const handWriteTools = toolRoster.entries.filter((e) => e.mountedBy === "hands" && (e.effect === "write" || e.effect === "idempotent")).map((e) => e.name);
     const hasEffectAwareGate = policyLayers.length > 0 || chainJudges(modBus);
@@ -249,7 +249,7 @@ export function prepareWiringManifest(input) {
         modBus.hasHandlers("classic.PreToolUse") ||
         egressTools.size > 0 ||
         irreversibleTools.size > 0 ||
-        shellReadStationArmed ||
+        shellReadStationArmed || crossBoundaryStationEngaged ||
         resourceSuspendEligible ||
         platformSuspendArmed ||
         spec.enablePlanMode === true;

package/dist/core/runner/prepare-workspace-restore.js

@@ -1,4 +1,4 @@
-import { isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
+import { frozenHandleCopy, isRemoteExecutionEnv, missingRestoreSurface } from "../remote-env.js";
 import { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
 import { rebaseWorkspacePathAcross } from "./workspace-path.js";
 export { remoteEnvFailureNote, restoreWorkspaceWithRetry } from "./remote-env-retry.js";
@@ -49,7 +49,7 @@ export async function prepareWorkspaceRestore(input) {
             refuseIdentityMismatch(ownedEnv.workspaceHandle());
             const { outcome: restored, attempts: restoreAttempts } = await restoreWorkspaceWithRetry(ownedEnv, handle.snapshotId, {
                 abortSignal: restoreSignal,
-                priorHandle: handle,
+                priorHandle: frozenHandleCopy(handle),
             });
             if (!restored.ok) {
                 failResume(`resumeVM failed after ${restoreAttempts} attempt(s) (${restored.error.code}): ${restored.error.message}`, restored.error, remoteEnvFailureNote("resumeVM", restored.error, restoreAttempts));

package/dist/core/runner/resume-admission.js

@@ -3,6 +3,14 @@ import { assertResumeConfigRecord, checkpointStoreSeat, refuseResumeDoors } from
 import { asResumeConfigRefusal } from "../mode-policy.js";
 import { describeSuppliedValue } from "./decide-continuation.js";
 import { detachSkillLists } from "../skill-grant.js";
+import { isGateKind, PAUSE_REGISTRY } from "../pause-registry.js";
+const DECIDE_ENTRY_BY_RESUME_GATE = {
+    policy_ask: "a `policy_ask` outcome (decision allow/deny bound to the pending tool call)",
+    dry_run_review: "a `dry_run_review` outcome (decision approve/reject)",
+    plan_review: "a `plan_review` outcome (decision approve/edit/reject)",
+    resource_limit: 'a `resource_limit` outcome (decision "continue")',
+    task_done: undefined,
+};
 export async function resumeAdmission(input) {
     const { token, outcome, taskConfig, runner, sessions, parentConstraintRegistry } = input;
     let internals = input.internals;
@@ -46,15 +54,7 @@ export async function resumeAdmission(input) {
     if (outcomeGate === "wake") {
         suppliedMessage = outcome.message;
         const gk = cp.gate.kind;
-        const decideEntry = gk === "human" || gk === "irreversible_ask"
-            ? 'a `policy_ask` outcome (decision allow/deny bound to the pending tool call)'
-            : gk === "needs_review"
-                ? 'a `dry_run_review` outcome (decision approve/reject)'
-                : gk === "plan_review"
-                    ? 'a `plan_review` outcome (decision approve/edit/reject)'
-                    : gk === "resource_limit"
-                        ? 'a `resource_limit` outcome (decision "continue")'
-                        : undefined;
+        const decideEntry = isGateKind(gk) ? DECIDE_ENTRY_BY_RESUME_GATE[PAUSE_REGISTRY[gk].resume] : undefined;
         if (gk !== "task_done") {
             throw new CheckpointError("wake.gate_pending", `cannot wake: this checkpoint awaits a pending gate decision (gate "${gk}") — wake is not a decision ` +
                 `channel; resume it with ${decideEntry ?? "its own gate outcome"} instead`);

package/dist/core/runner/resume-apply.js

@@ -13,7 +13,7 @@ import { orgVerdictBeforeClaim } from "./permission-rule-lanes.js";
 import { chainCannotJudge } from "./call-hook-stations.js";
 import { thrownText } from "../thrown-value.js";
 import { wireOf } from "../tool-name-readings.js";
-import { parkedSkillApprovalRefusal } from "../skill-grant.js";
+import { judgeApprovalObject } from "../approval-object.js";
 import { SKILL_CONTENT_MAX_CHARS, SKILL_TOOL_NAME, normalizeSkills } from "./synthetic-tools.js";
 import { skillLoadReading } from "./skill-base-dir.js";
 export async function resumeApply(input) {
@@ -76,9 +76,9 @@ export async function resumeApply(input) {
     };
     if (plainPolicyOutcome?.decision === "allow" && cp.pendingAction.kind === "tool_approval") {
         const servedSkills = normalizeSkills(config.skills).filter((s) => skillLoadReading(s, SKILL_CONTENT_MAX_CHARS).loads);
-        const skillRefusal = parkedSkillApprovalRefusal(cp.pendingAction, plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, servedSkills, SKILL_TOOL_NAME);
-        if (skillRefusal !== undefined)
-            throw new CheckpointError("checkpoint.invalid_outcome", skillRefusal, { field: "boundGrantDigest" });
+        const claimed = judgeApprovalObject(cp.pendingAction, { args: plainPolicyOutcome.updatedInput ?? cp.pendingAction.args, skills: servedSkills, skillToolName: SKILL_TOOL_NAME }, "claim");
+        if (claimed !== "match")
+            throw new CheckpointError("checkpoint.invalid_outcome", claimed.message, { field: "boundGrantDigest" });
     }
     if (plainPolicyOutcome !== undefined &&
         plainPolicyOutcome.decision === "allow" &&

package/dist/core/runner/resume-policy-outcome.d.ts

@@ -1,8 +1,8 @@
 /**
  * The resume ladder's APPROVAL-LANE capture and binding rung (E4), verbatim from
  * `Runner.resumeStream`: on a human / irreversible_ask row every deployment-supplied field of the
- * `policy_ask` decide is read exactly once into a plain twin (answer canonicalized, updatedInput cloned to the
- * JSON domain, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
+ * `policy_ask` decide is read exactly once into a plain twin (answer and updatedInput by the one capture, in their
+ * JSON form, the decision word, the refused keys, the host's decision facts and attribution, the deny note),
  * then the decision-action binding (boundCallId, boundInputHash by version), the env_failed replay guard and
  * the content-ask answer binding. Synchronous; every refusal throws pre-CAS.
  */