@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/runner/prepare-defer-classify.js

@@ -1,4 +1,4 @@
-import { getToolContract } from "../../prompt-assembly/tool-catalog.js";
+import { getToolContract, mountDescriptionVariant } from "../../prompt-assembly/tool-catalog.js";
 import { FULL_SHELL_CONTRACT_ID } from "../../tools/fs/index.js";
 import { ASK_USER_QUESTION_TOOL_NAME } from "../ask-question.js";
 import { MEMORY_ENGINE_TOOL_NAMES } from "../memory-engine/tools.js";
@@ -17,7 +17,7 @@ function memoryGroupRetractionSet(builtinDeferPairNames, engineTrioInPlay) {
     return new Set([...builtinDeferPairNames, ...(engineTrioInPlay ? MEMORY_ENGINE_TOOL_NAMES : [])]);
 }
 export function prepareDeferClassify(input) {
-    const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptProfile, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
+    const { spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptTraits, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryRecallSegment, onceLedger, sessionId } = input;
     const tools = roster.tools;
     let memoryBlock = input.memoryBlock;
     const leaves = valveLeaves(spec, toolFaceSnapshot.selector);
@@ -32,12 +32,11 @@ export function prepareDeferClassify(input) {
             throw e;
         }
     }
-    if (promptProfile === "classic") {
-        for (let i = 0; i < tools.length; i++) {
-            const t = tools[i];
-            if (t.descriptionClassic !== undefined)
-                roster.replaceAt(i, { ...t, description: t.descriptionClassic });
-        }
+    for (let i = 0; i < tools.length; i++) {
+        const t = tools[i];
+        const face = mountDescriptionVariant(t, promptTraits);
+        if (face !== t)
+            roster.replaceAt(i, face);
     }
     const protocolToolNames = [...mcp.tools, ...a2a.tools].filter((t) => protocolOf(t.name) !== undefined).map((t) => t.name);
     const mcpAlwaysLoadNames = mcp.tools

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -32,9 +32,9 @@ export interface PrepareDelegationSurfaceInput {
      *  `handsReadOnly` is NOT read here (the hands mount decided the surface). Never mutated. */
     spec: Pick<TaskSpec, "tools" | "oneShot" | "retainBackgroundProcesses" | "excludeAllTools">;
     /** borrowed-readonly — the deployment seats the mounts read: `workflowRunStore` / `backgroundAgentStore` / `mailboxStore` (the
-     *  read/kill faces and the tier-3 revival seams), `rosterStore`, `peerLane`, `peerDirectory`, `onNotice`,
+     *  read/kill faces and the tier-3 revival seams), `rosterStore`, `peerLane`, `peerDirectory`, `peerChannel`, `onNotice`,
      *  `onBackgroundChildEvent`, `tracer`. */
-    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "principalInboxConsumer" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
+    deps: Pick<RunnerDeps, "workflowRunStore" | "backgroundAgentStore" | "mailboxStore" | "rosterStore" | "peerLane" | "peerDirectory" | "peerChannel" | "principalInboxConsumer" | "onNotice" | "onBackgroundChildEvent" | "tracer">;
     /** borrowed-readonly — the trusted spawn-side channel: `parentNotify` (the delegated-child door), the uplink / sibling /
      *  identity seats the SendMessage mount forwards, `onTaskNotification`, `onSubagentSpawn`. Never mutated. */
     internals: Pick<RunInternals, "parentNotify" | "parentPeerRef" | "uplinkSessionId" | "parentRetainLedger" | "explicitAgentName" | "parentTaskId" | "parentSessionId" | "peerSelfRef" | "peerInboundChainRef" | "onTaskNotification" | "onSubagentSpawn"> | undefined;

package/dist/core/runner/prepare-delegation-surface.js

@@ -56,7 +56,7 @@ export function prepareDelegationSurface(input) {
                 ...(deps.backgroundAgentStore !== undefined ? { agentStore: deps.backgroundAgentStore } : {}),
                 ...(deps.mailboxStore !== undefined ? { mailbox: deps.mailboxStore } : {}),
                 ...(reviveSpawn !== undefined ? { reviveSpawn } : {}),
-                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) }) : {}),
+                ...(peerLaneActive ? peerLaneSendMessageSeats({ peerDirectory: deps.peerDirectory, ...(deps.peerChannel !== undefined ? { peerChannel: deps.peerChannel } : {}), sessionId, scope: taskScope, ...(internals?.explicitAgentName !== undefined ? { name: internals.explicitAgentName } : {}), refs: peerLaneRefs, listingMounted: listAgentsMountable({ leaves, specTools: spec.tools ?? [] }) }) : {}),
                 onNotifyError: (f) => emitTrace(deps.tracer, () => ({ kind: "observer.notify_failed", version: 1, taskId: hostTaskId, site: f.site, message: f.error.message, ts: Date.now() })),
                 onTranscriptIntegrityGap: (handle, scope) => deliverEngineNotice(deps.onNotice, {
                     code: "delegation.transcript_integrity",

package/dist/core/runner/prepare-file-history.d.ts

@@ -14,15 +14,18 @@
  *
  * The request door (the bad-value doors and every refusal the request decides alone) lives in
  * `./file-history-request.ts` and runs BEFORE the session is acquired; this phase receives its resolution.
- * The module-level helpers below the phase (`restoredAbsPathsOf`,
- * the refusal's epoch-tail wording helper, `adoptForkedFileHistory` with its per-store carry memo,
+ * The module-level helpers below the phase (`adoptForkedFileHistory` with its per-store carry memo,
  * `createFileHistoryBoundarySeat`, `resolveFileHistoryCoordinates` / `resolveFileHistoryScope` /
  * `fileHistoryFilesystemIdentity`, `childScopeRewindRefusal`) moved with it unchanged; the two the test
- * suite reaches through the driver are re-exported from there.
+ * suite reaches through the driver are re-exported from there. The restore itself and the reading of its
+ * answer live in `./file-history-restore.ts`, shared with the out-of-run rewind (`./rewind-files.ts`), which
+ * also reaches down here for the coordinates and the fork carry — a rewind outside a run is the same history
+ * operation as the one this phase runs.
  */
 import type { ExecutionEnv } from "../../internal/harness.js";
 import type { StoredSession } from "../../engine/session/session.js";
 import type { RunnerDeps, TaskResult, TaskSpec, TrackFileEditHook } from "../types.js";
+import type { FileHistoryStore } from "../file-history-store.js";
 import type { FileHistoryBoundarySeat, RunInternals } from "./contracts.js";
 import type { FileHistoryRequest } from "./file-history-request.js";
 export interface PrepareFileHistoryInput {
@@ -36,8 +39,9 @@ export interface PrepareFileHistoryInput {
      *  acquired: every refusal the request and the deployment's seats decide on their own has already thrown. */
     request: FileHistoryRequest;
     /** borrowed-readonly — the trusted lineage a delegating parent handed this run (absent for a root run
-     *  and for a host's own fork), read for the recording-scope decision only. */
-    internals: Pick<RunInternals, "fileHistoryLineage"> | undefined;
+     *  and for a host's own fork), read for the recording-scope decision only; and the Runner's session
+     *  read-state seats, whose restore channel the restore writes the paths it moved into. */
+    internals: Pick<RunInternals, "fileHistoryLineage" | "sessionReadStates"> | undefined;
     /** borrowed-readonly — the run's resolved env (owned or static or the stub); every history verb runs
      *  against ITS filesystem ops. Never rebound or destroyed here. */
     executionEnv: ExecutionEnv;
@@ -60,9 +64,6 @@ export interface PrepareFileHistoryResult {
     /** borrowed-readonly — the turn-start boundary seat runtask drives; `undefined` when not live or when
      *  this run records into its ROOT session's scope (a child mints no boundaries). */
     fileHistoryBoundary: FileHistoryBoundarySeat | undefined;
-    /** borrowed-readonly — the absolute paths the restore MUTATED (empty when no restore ran), for the
-     *  read-face phase's read-state invalidation. */
-    restoredFilePaths: string[];
     /** borrowed-mutable — the non-fatal rewind disclosures (`TaskResult.rewindNotes`). Mutation owners after
      *  this call: none — every push happens inside this phase; the driver only reads it into `Prepared`. */
     rewindNotes: NonNullable<TaskResult["rewindNotes"]>;
@@ -79,6 +80,45 @@ export interface PrepareFileHistoryResult {
     historyFs: string;
 }
 export declare function prepareFileHistory(input: PrepareFileHistoryInput): Promise<PrepareFileHistoryResult>;
+/**
+ * Carry a forked session's file history from its parent scope (the seat §5 names).
+ * Never throws and never fails the turn: a store that cannot carry leaves the fork with an empty
+ * history, which is DEGRADED (a pre-fork boundary is not restorable from the new session) and not
+ * wrong (nothing is silently mis-restored — the restore seat answers "no boundary" honestly).
+ */
+export declare function adoptForkedFileHistory(store: FileHistoryStore, session: {
+    getMetadata(): Promise<{
+        forkedFrom?: string;
+    }>;
+}, sessionId: string, onError: RunnerDeps["onError"]): Promise<void>;
+/**
+ * The run's two file-history COORDINATES, resolved once where store/env/root meet (module-level per
+ * the body ratchet):
+ *  - `historyRoot` — ONE canonical root coordinate for every history verb: capture keys (rel-under-root
+ *    vs absolute, DV-6) must agree with the canonical containment keys the hands band mints — a
+ *    symlinked root spelling (macOS /var → /private/var) would otherwise record in-root files as
+ *    absolute and un-tether them from the root they live in.
+ *  - `historyScope` — WHICH scope this run's first-touch records land in. A top-level run owns its own
+ *    (its sessionId). A delegated child that was handed a {@link RunInternals.fileHistoryLineage} and
+ *    runs on the SAME canonical root records into the lineage's scope — the root session's — so the
+ *    edits a child makes on the user's behalf are part of the ONE history the user rewinds from
+ *    (before this, a child's first touch minted its baseline in a scope no rewind ever read, and the
+ *    parent's own later first touch of that file recorded the child-modified bytes as pristine). A
+ *    child on a DIFFERENT root keeps its own scope: keys are root-relative and carry no root, so a
+ *    record minted under a worktree re-joined against the root session's tree would converge a file
+ *    that run never edited — the structural out-of-scope guarantee the store contract opens with.
+ *    Same-tree equality is judged on TWO coordinates, both minted here: the CANONICAL root spelling
+ *    both sides minted their keys against, and the FILESYSTEM the env is a view of
+ *    ({@link fileHistoryFilesystemIdentity}) — a path string alone is not a tree (two per-task
+ *    sandboxes can both spell `/workspace` and hold unrelated files).
+ * With no live history store there is nothing to coordinate: own scope, uncanonicalized root, no
+ * filesystem identity (nothing reads any of them).
+ */
+export declare function resolveFileHistoryCoordinates(enabled: boolean, env: ExecutionEnv, taskRoot: string, lineage: RunInternals["fileHistoryLineage"], sessionId: string): Promise<{
+    historyRoot: string;
+    historyScope: string;
+    historyFs: string;
+}>;
 /** The ONE reading of {@link RunInternals.fileHistoryLineage} (see {@link resolveFileHistoryCoordinates}):
  *  the lineage's scope iff BOTH tree coordinates match; otherwise the run's own session. */
 export declare function resolveFileHistoryScope(lineage: RunInternals["fileHistoryLineage"], historyRoot: string, historyFs: string, sessionId: string): string;

package/dist/core/runner/prepare-file-history.js

@@ -1,6 +1,9 @@
 import { NodeExecutionEnv } from "../../engine/execution-env/node-execution-env.js";
 import { isRemoteExecutionEnv } from "../remote-env.js";
-import { resolveTrackKey } from "../file-history-store.js";
+import { FILE_HISTORY_ERROR_CODES, FileHistoryStoreError } from "../file-history-store.js";
+import { readMember, thrownText } from "../thrown-value.js";
+import { isGovernanceRetryClass } from "../governance-codes.js";
+import { fileHistoryRestoreLedgerLine, settleFileHistoryRestore } from "./file-history-restore.js";
 export async function prepareFileHistory(input) {
     const { deps, spec, request, internals, executionEnv, taskRootFinal, handsEnabled, sessionId, session, abortController } = input;
     const rewindNotes = [];
@@ -43,27 +46,10 @@ export async function prepareFileHistory(input) {
             });
         }
     }
-    let restoredFilePaths = [];
     if (rewindTarget !== undefined && fileHistoryStore !== undefined && handsEnabled) {
-        const historyStore = fileHistoryStore;
-        if (rewindBefore && !(await historyStore.canRestore(sessionId, rewindTarget)))
-            throw beforeWithoutBoundaryRefusal(rewindTarget, sessionId);
-        const restoreRoot = historyRoot;
         const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
-        const restored = await historyStore.restore(sessionId, rewindTarget, executionEnv, restoreRoot, restoreSignal);
-        const ledgerLine = (r) => `applied ${r.filesChanged.length}, identical ${r.identicalSkipped.length}, refused ${r.refused.length}${r.refused.length > 0 ? ` (${r.refused.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}, failed ${r.failed.length}${r.failed.length > 0 ? ` (${r.failed.map((f) => `${f.path}: ${f.reason}`).join("; ")})` : ""}`;
-        if (restored.outcome === "failed") {
-            if (restored.error?.code === "not_found") {
-                if (rewindBefore)
-                    throw beforeWithoutBoundaryRefusal(rewindTarget, sessionId);
-                const e = new Error(`rewind-files: no file-history boundary exists for entry "${rewindTarget}" on session "${sessionId}" — the working tree was NOT rewound. ${rewindRefusalTail()}`);
-                e.code = "rewind_snapshot.unresolvable";
-                throw e;
-            }
-            const e = new Error(`rewind-files restore failed (${restored.error?.code ?? "restore_failed"}): ${restored.error?.message ?? "unknown"} — ledger: ${ledgerLine(restored)}`);
-            e.code = "rewind.restore_failed";
-            throw e;
-        }
+        const restored = await settleFileHistoryRestore({ store: fileHistoryStore, sessionId, target: rewindTarget, before: rewindBefore, env: executionEnv, root: historyRoot, signal: restoreSignal, readStates: internals?.sessionReadStates });
+        const ledgerLine = fileHistoryRestoreLedgerLine;
         if (restored.outcome === "partial") {
             if (spec.acceptPartialRestore === true) {
                 rewindNotes.push({
@@ -77,22 +63,21 @@ export async function prepareFileHistory(input) {
                 throw e;
             }
         }
-        restoredFilePaths = restoredAbsPathsOf(restored, restoreRoot);
     }
     const trackFileEdit = fileHistoryEnabled
         ? async (req) => {
-            const r = await fileHistoryStore.trackEdit(historyScope, req.key, executionEnv, historyRoot, req.signal);
+            const r = await answerOf(() => fileHistoryStore.trackEdit(historyScope, req.key, executionEnv, historyRoot, req.signal), "track_failed");
             if (r.ok) {
                 if (!r.minted)
                     return { ok: true };
                 return {
                     ok: true,
                     annul: async (proof) => {
-                        const a = await fileHistoryStore.annulTrack(historyScope, req.key, historyRoot, proof === "verify" ? { env: executionEnv, ...(req.signal !== undefined ? { signal: req.signal } : {}) } : undefined);
+                        const a = await answerOf(() => fileHistoryStore.annulTrack(historyScope, req.key, historyRoot, proof === "verify" ? { env: executionEnv, ...(req.signal !== undefined ? { signal: req.signal } : {}) } : undefined), "track_failed");
                         if (a.ok)
                             return;
                         try {
-                            deps.onError?.(new Error(`file-history could not retract the first-touch record for "${req.key}" after its edit failed to land (${a.error.code}: ${a.error.message}) — the path stays tracked, so a rewind to a boundary below it may converge bytes this engine never wrote`), { phase: "rewind", sessionId });
+                            deps.onError?.(new FileHistoryStoreError(a.error, `file-history could not retract the first-touch record for "${req.key}" after its edit failed to land (${a.error.code}: ${a.error.message}) — the path stays tracked, so a rewind to a boundary below it may converge bytes this engine never wrote`, "thrown" in a ? a.thrown : undefined), { phase: "rewind", sessionId });
                         }
                         catch {
                         }
@@ -101,40 +86,21 @@ export async function prepareFileHistory(input) {
             }
             if (onTrackFailure === "proceed-unprotected") {
                 try {
-                    deps.onError?.(new Error(`file-history first-touch backup for "${req.key}" failed (${r.error.code}: ${r.error.message}) — proceeding UNPROTECTED per RunnerDeps.onTrackFailure: the pristine promise for this path is void, and only in this process's memory (no durable trace exists, so after a process restart the next edit can still mint already-modified bytes as pristine v1)`), { phase: "rewind", sessionId });
+                    deps.onError?.(new FileHistoryStoreError(r.error, `file-history first-touch backup for "${req.key}" failed (${r.error.code}: ${r.error.message}) — proceeding UNPROTECTED per RunnerDeps.onTrackFailure: the pristine promise for this path is void, and only in this process's memory (no durable trace exists, so after a process restart the next edit can still mint already-modified bytes as pristine v1)`, "thrown" in r ? r.thrown : undefined), { phase: "rewind", sessionId });
                 }
                 catch {
                 }
                 return { ok: true };
             }
-            return {
-                ok: false,
-                refusal: `Error (${req.tool}): the edit was refused because its first-touch file-history backup could not be persisted (${r.error.code}: ${r.error.message}). Proceeding would leave "${req.path}" with no durable pristine record — after the history store recovers, a retried edit would mint already-modified bytes as the pristine baseline. Retry when the file-history store is healthy.`,
-            };
+            const lead = r.error.permanence === "terminal" ? "The history store reports this failure as permanent: do not retry this edit until the store is fixed." : "Retry when the file-history store is healthy.";
+            return { ok: false, refusal: `Error (${req.tool}): the edit was refused because its first-touch file-history backup could not be persisted (${r.error.code}). ${lead} Proceeding would leave the file with no durable pristine record. ${r.error.message}` };
         }
         : undefined;
     const fileHistoryBoundary = fileHistoryEnabled && historyScope === sessionId
         ? createFileHistoryBoundarySeat({ store: fileHistoryStore, sessionId, env: executionEnv, root: historyRoot, onError: deps.onError })
         : undefined;
     const fileHistoryFact = fileHistoryEnabled ? "on" : "disabled";
-    return { trackFileEdit, fileHistoryBoundary, restoredFilePaths, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
-}
-function restoredAbsPathsOf(restored, root) {
-    const out = [];
-    for (const key of [...restored.filesChanged, ...restored.failed.map((f) => f.path)]) {
-        const abs = resolveTrackKey(root, key);
-        if (abs.ok)
-            out.push(abs.abs);
-    }
-    return out;
-}
-function rewindRefusalTail() {
-    return `Boundaries are keyed by a turn's INITIAL entry and exist only for turns that recorded history (a RunnerDeps.fileHistoryStore wired, capture on, and the run's file history not disabled); a boundary from the retired whole-tree snapshot era is not restorable by this seat, and reaped boundaries have none.`;
-}
-function beforeWithoutBoundaryRefusal(target, sessionId) {
-    const e = new Error(`rewind-files: entry "${target}" has no file-history boundary on session "${sessionId}" — a before-restore needs the target's own boundary and never crosses into an earlier turn, so the working tree was NOT rewound. ${rewindRefusalTail()}`);
-    e.code = "rewind_snapshot.unresolvable";
-    return e;
+    return { trackFileEdit, fileHistoryBoundary, rewindNotes, fileHistoryEnabled, fileHistoryFact, historyScope, historyRoot, historyFs };
 }
 const FILE_HISTORY_BOUNDARY_TIMEOUT_MS = 30_000;
 const FILE_HISTORY_LIVENESS_MEMO = new WeakMap();
@@ -147,7 +113,22 @@ function toldAlready(sink, arm) {
     return false;
 }
 const FILE_HISTORY_CARRY_MEMO = new WeakMap();
-async function adoptForkedFileHistory(store, session, sessionId, onError) {
+function answerOf(call, code) {
+    const unanswered = (message, thrown) => ({ ok: false, error: { code, message }, ...(thrown === undefined ? {} : { thrown }) });
+    return Promise.resolve().then(call).then((r) => {
+        const ok = readMember(r, "ok");
+        if (ok === true)
+            return { ok: true, minted: readMember(r, "minted") === true };
+        const error = readMember(r, "error"), stated = readMember(error, "code"), message = readMember(error, "message"), permanence = readMember(error, "permanence");
+        if (ok !== false || typeof stated !== "string")
+            return unanswered("the history store answered something that is not a result");
+        const text = typeof message === "string" ? message : "(the history store gave no message)", known = FILE_HISTORY_ERROR_CODES.find((c) => c === stated);
+        if (known === undefined)
+            return unanswered(`the history store answered a code outside the closed set (${JSON.stringify(stated)}): ${text}`);
+        return { ok: false, error: { code: known, message: text, ...(isGovernanceRetryClass(permanence) ? { permanence } : {}) } };
+    }, (value) => unanswered(`the history store threw: ${thrownText(value)}`, { value }));
+}
+export async function adoptForkedFileHistory(store, session, sessionId, onError) {
     const memo = FILE_HISTORY_CARRY_MEMO.get(store) ?? { settled: new Set(), disclosed: new Set(), inFlight: new Map() };
     FILE_HISTORY_CARRY_MEMO.set(store, memo);
     const discloseOnce = (err) => {
@@ -156,6 +137,7 @@ async function adoptForkedFileHistory(store, session, sessionId, onError) {
         memo.disclosed.add(sessionId);
         onError?.(err, { phase: "rewind", sessionId });
     };
+    const threw = (err) => new FileHistoryStoreError({ code: "adopt_failed" }, `file-history fork carry could not run: ${thrownText(err)} — the parent's history was not carried into this session (the run itself proceeds)`, { value: err });
     try {
         if (memo.settled.has(sessionId))
             return;
@@ -167,13 +149,13 @@ async function adoptForkedFileHistory(store, session, sessionId, onError) {
             return await shared;
         if (memo.settled.has(sessionId))
             return;
-        const attempt = store.adoptScope(forkedFrom, sessionId).then((carried) => {
+        const attempt = answerOf(() => store.adoptScope(forkedFrom, sessionId), "adopt_failed").then((carried) => {
             if (carried.ok || carried.error.code === "conflict") {
                 memo.settled.add(sessionId);
                 return;
             }
-            discloseOnce(new Error(`file-history fork carry from session "${forkedFrom}" failed (${carried.error.code}): ${carried.error.message} — this forked session starts with an EMPTY rewind history, so boundaries recorded before the fork are not restorable from it (the run itself proceeds; the carry is retried on this session's next turn while its scope is still empty)`));
-        }, (err) => discloseOnce(err));
+            discloseOnce(new FileHistoryStoreError(carried.error, `file-history fork carry from session "${forkedFrom}" failed (${carried.error.code}): ${carried.error.message} — the parent's history was not carried, so boundaries recorded before the fork are not restorable from this session (the run itself proceeds; the carry is retried on this session's next turn)`, "thrown" in carried ? carried.thrown : undefined));
+        });
         memo.inFlight.set(sessionId, attempt);
         try {
             await attempt;
@@ -184,7 +166,7 @@ async function adoptForkedFileHistory(store, session, sessionId, onError) {
     }
     catch (err) {
         try {
-            discloseOnce(err);
+            discloseOnce(threw(err));
         }
         catch {
         }
@@ -206,30 +188,16 @@ function createFileHistoryBoundarySeat(opts) {
                     resolve({ ok: false });
                 }, FILE_HISTORY_BOUNDARY_TIMEOUT_MS);
             });
-            let work;
-            try {
-                work = opts.store.snapshot(opts.sessionId, entryId, opts.env, opts.root, ac.signal);
-            }
-            catch (err) {
-                work = Promise.resolve({ ok: false, error: { code: "snapshot_failed", message: `history store threw synchronously: ${err.message}` } });
-            }
-            work.catch(() => { });
+            const work = answerOf(() => opts.store.snapshot(opts.sessionId, entryId, opts.env, opts.root, ac.signal), "snapshot_failed");
+            const disclose = (failure, what, thrown) => new FileHistoryStoreError(failure, `file-history ${what} — this turn has no boundary and cannot be rewound to (the turn itself proceeds)`, thrown);
             inFlight = Promise.race([
-                work.then((r) => (r.ok ? undefined : `boundary capture failed (${r.error.code}): ${r.error.message}`)),
-                timeout.then(() => `boundary capture timed out after ${FILE_HISTORY_BOUNDARY_TIMEOUT_MS / 1000}s (fenced — the attempt can never publish)`),
+                work.then((r) => (r.ok ? undefined : disclose(r.error, `boundary capture failed (${r.error.code}): ${r.error.message}`, "thrown" in r ? r.thrown : undefined))),
+                timeout.then(() => disclose({ code: "aborted" }, `boundary capture timed out after ${FILE_HISTORY_BOUNDARY_TIMEOUT_MS / 1000}s (fenced — the attempt can never publish)`)),
             ])
                 .then((failure) => {
-                if (failure !== undefined) {
-                    try {
-                        opts.onError?.(new Error(`file-history ${failure} — this turn has no boundary and cannot be rewound to (the turn itself proceeds)`), { phase: "rewind", sessionId: opts.sessionId });
-                    }
-                    catch {
-                    }
-                }
-            })
-                .catch((err) => {
                 try {
-                    opts.onError?.(err, { phase: "rewind", sessionId: opts.sessionId });
+                    if (failure !== undefined)
+                        opts.onError?.(failure, { phase: "rewind", sessionId: opts.sessionId });
                 }
                 catch {
                 }
@@ -242,7 +210,7 @@ function createFileHistoryBoundarySeat(opts) {
         },
     };
 }
-async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
+export async function resolveFileHistoryCoordinates(enabled, env, taskRoot, lineage, sessionId) {
     if (!enabled)
         return { historyRoot: taskRoot, historyScope: sessionId, historyFs: "" };
     const canonRoot = await env.canonicalPath(taskRoot);

package/dist/core/runner/prepare-gate-stations.d.ts

@@ -34,7 +34,7 @@ import type { InheritedToolCheck, LegModBus } from "../mods/stations.js";
 import { type HookEnvCapabilities, type HookInvocationIdentity } from "../hooks.js";
 import type { ToolPolicy } from "../tool-policy.js";
 import { type GateOutcome } from "../gate-outcome.js";
-import type { RunnerDeps, TaskSpec, ToolEffect } from "../types.js";
+import type { RunnerDeps, TaskSpec } from "../types.js";
 import { type WiringManifest } from "../wiring-manifest.js";
 import type { WriteProtectionCheck } from "../write-protect.js";
 import type { ShellReadCheck } from "../../tools/fs/shell-read-check.js";
@@ -82,9 +82,6 @@ export interface PrepareGateStationsInput {
     tools: readonly AgentTool[];
     /** borrowed-readonly — the leg's delta seat: its current roster is the face source for every gated call. */
     toolRosterDeltas: ToolRosterDeltaSeat;
-    /** borrowed-mutable — the effect collection. Writer here: the final-roster sync fills MISSING entries from each
-     *  first-party tool's declared effect (never overrides a scanned one); the plan-mode deny reads it per call. */
-    toolEffects: Map<string, ToolEffect>;
     /** borrowed-readonly — the deployment seats these stations read, as a Pick over the SAME `deps` object (receiver
      *  preserved for `deps.onError?.()`): the write-protection table and its data root, the tracer, the error face, and
      *  the notice sink (the gate's unresolvable-ask exit delivers `delegation.ask_unresolvable` through it). */
@@ -111,7 +108,7 @@ export interface PrepareGateStationsInput {
     complianceDenies: ReadonlySet<ComplianceCapability>;
     /** borrowed-mutable — the built harness. Writer here: `on("tool_call")` / `on("tool_result")` — the registrations this
      *  phase exists for, in this order, after the driver's boundary-lease handler. */
-    harness: Pick<AgentHarness, "on">;
+    harness: Pick<AgentHarness, "on" | "isBatchSafe">;
     /** borrowed-mutable — the blocked/suspended call ids (`Prepared.blockedToolCalls`). Writers here: the head-of-evaluation
      *  hygiene `delete`, the two short-circuits' and the gate outcome's `add`, the `tool_result` station's one-shot `delete`. */
     blockedToolCalls: Set<string>;

package/dist/core/runner/prepare-gate-stations.js

@@ -10,9 +10,11 @@ import { askUnresolvableNotice } from "../ask-unresolvable-notice.js";
 import { approvalRouteOf } from "../wiring-manifest.js";
 import { classifierUnavailableSeat } from "./classifier-ladder.js";
 import { PATH_CONFINABLE_WRITE_TOOLS } from "./session-rule-policy.js";
-import { callFaceSeat, rosterToolName, survivorsByName, toolCallFaceOf } from "../tool-roster.js";
+import { callFaceSeat, rosterToolName, toolCallFaceOf } from "../tool-roster.js";
 import { heldBy, heldValues, seatOf, wireOf } from "../tool-name-readings.js";
 import { createApprovedCallScreen, createToolResultStation } from "./call-hook-stations.js";
+import { extensionCallOf } from "../mods/extension-call.js";
+import { extensionCallOverlap } from "../mods/tool-call.js";
 const PEER_MESSAGE_NAMES = new Set([SEND_MESSAGE_TOOL_NAME]);
 function screenGateResult(result) {
     if (result.suspend !== undefined)
@@ -46,7 +48,7 @@ export function maybeHumanRejectionHalt(input) {
     };
 }
 export function prepareGateStations(input) {
-    const { askLane, parkAsk, tools, toolRosterDeltas, toolEffects, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, crossBoundaryCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
+    const { askLane, parkAsk, tools, toolRosterDeltas, deps, toolCallGateArmedRef, effectivePolicy, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, hookEnvFace, writeProtectionCheck, shellReadCheck, crossBoundaryCheck, readFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider, autoModeDenialTracking, askRoute, permissionMode, toolMarkSources, a2aIsolatePeers, ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement, seatInputsFor, modBus, inheritedToolChecks } = input;
     const releasesAnnounced = new Map();
     const onModeReleased = (info) => {
         const table = info.readUnestablished === true ? input.readDenyInForce(info.toolCallId) : undefined;
@@ -72,11 +74,6 @@ export function prepareGateStations(input) {
     if (askLane !== undefined && parkAsk !== undefined) {
         const { adjudicate, resolveAskBound, notifyPermissionDenied, notifyHookError } = askLane;
         const { resolveContentAsk, suspendAsk } = parkAsk;
-        for (const t of survivorsByName(tools).values()) {
-            const eff = t.effect;
-            if (eff !== undefined && !toolEffects.has(t.name))
-                toolEffects.set(t.name, eff);
-        }
         const writeProtectionArmed = writeProtectionCheck !== undefined && tools.some((t) => PATH_CONFINABLE_WRITE_TOOLS.has(t.name));
         toolCallGateArmedRef.armed =
             effectivePolicy !== undefined ||
@@ -128,7 +125,7 @@ export function prepareGateStations(input) {
                         toolFaceOf: (name) => toolCallFaceOf(toolRosterDeltas.current, name === e.toolName ? called.toolName : name),
                         adjudicate,
                         resolveAsk: (...args) => toolOccurrences.whileAwaitingUser(args[1].toolCallId, () => resolveAskBound(...args)),
-                        suspendAsk,
+                        ...(extensionCallOf(modBus, e.toolCallId) === undefined ? { suspendAsk } : {}),
                         resolveContentAsk: (...args) => toolOccurrences.whileAwaitingUser(args[0].toolCallId, () => resolveContentAsk(...args)),
                         egress: heldBy("gate.egress", egressTools, call),
                         peerMessage: heldBy("gate.peerMessage", PEER_MESSAGE_NAMES, call),
@@ -241,6 +238,13 @@ export function prepareGateStations(input) {
                     }
                     return { block: true, reason: result.reason, ...details };
                 }
+                const overlap = result.suspend === undefined && extensionCallOf(modBus, e.toolCallId) !== undefined ? extensionCallOverlap({ occurrences: toolOccurrences, toolCallId: e.toolCallId, toolName: e.toolName, args: result.finalInput ?? e.input, batchSafe: (n, a) => harness.isBatchSafe(n, a) }) : undefined;
+                if (overlap !== undefined) {
+                    toolOccurrences.refuse(e.toolCallId, "hook");
+                    if (blockedTracked)
+                        blockedToolCalls.add(e.toolCallId);
+                    return { block: true, reason: formatHookFeedback(overlap, reminderMark) };
+                }
                 if (result.suspend === undefined)
                     toolOccurrences.release(e.toolCallId);
                 return result.updatedInput !== undefined ? { updatedInput: result.updatedInput } : undefined;

package/dist/core/runner/prepare-hands-readface.d.ts

@@ -96,7 +96,8 @@ export interface PrepareHandsReadFaceInput {
     deps: Pick<RunnerDeps, "onError" | "onNotice" | "tracer" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "agentConfigDir" | "readFace" | "writeFace" | "permissionRuleStore" | "hands">;
     /** borrowed-readonly — the trusted spawn-side seats the band forwards: the finished-command
      *  notification lane, the mid-flight detach hub, and the Runner's per-session
-     *  read-state seats (absent on a standalone prepare ⇒ the transcript-replay rung covers alone). */
+     *  read-state seats and their restore channel (absent on a standalone prepare ⇒ the transcript-replay rung
+     *  covers alone, and no restore is owed a check — the channel is the Runner's). */
     internals: Pick<RunInternals, "onTaskNotification" | "detachHub" | "sessionReadStates"> | undefined;
     /** borrowed-mutable — the harness seat, read LIVE by the band's queued-human-input predicate (the shell's
      *  auto-backgrounding leg asks it mid-command). Late-bound: the band is built here, the harness later. */
@@ -110,13 +111,6 @@ export interface PrepareHandsReadFaceInput {
     };
     /** borrowed-mutable — the leg's occurrence table; writer here: the shell read station's refused-admission callback. */
     toolOccurrences: ToolOccurrenceTable;
-    /** borrowed-readonly — ABSOLUTE paths this prepare's restore wrote, deleted,
-     *  or failed to write. Every read-state seed above describes the PRE-restore tree, so these keys are
-     *  dropped from the map: the engine replaced those bytes itself, and a surviving entry makes the
-     *  next refusal blame "the user or a linter" for the engine's own write. Absent (the common case)
-     *  when no file restore ran. Fail-closed by construction — dropping a read record only ever
-     *  produces refusals. */
-    restoredFilePaths?: readonly string[];
     /** borrowed-readonly — the memory write gate the memory phase minted (it runs BEFORE this phase: the memory root
      *  must be known before the toolkit compiles), composed into the band's beforeWrite below; undefined for a
      *  memory-less run (every write passes the engine half). */

package/dist/core/runner/prepare-hands-readface.js

@@ -260,22 +260,23 @@ export async function prepareHandsMount(input) {
                 }
             }
         }
-        if (input.restoredFilePaths !== undefined) {
-            for (const abs of input.restoredFilePaths) {
-                const k = await judgeKey(abs);
-                if (k === undefined)
-                    continue;
-                const entry = readFileState.get(k);
-                if (entry === undefined || entry.seededFromContext === true)
-                    continue;
-                const cur = await executionEnv.readTextFile(abs);
-                if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
-                    continue;
-                readFileState.delete(k);
-            }
+        const restoredOwed = sessionSeats?.pendingRestored(sessionId) ?? [];
+        for (const abs of restoredOwed) {
+            const k = await judgeKey(abs);
+            if (k === undefined)
+                continue;
+            const entry = readFileState.get(k);
+            if (entry === undefined || entry.seededFromContext === true)
+                continue;
+            const cur = await executionEnv.readTextFile(abs);
+            if (cur.ok && entry.hash === sha256(normalizeFileText(cur.value)))
+                continue;
+            readFileState.delete(k);
         }
-        if (seatLeafId !== undefined)
+        if (seatLeafId !== undefined) {
             sessionSeats?.adopt(sessionId, readFileState, seatLeafId);
+            sessionSeats?.settleRestored(sessionId, restoredOwed);
+        }
         sealReadStateSeat =
             sessionSeats !== undefined && seatLeafId !== undefined
                 ? (ownCommittedTailEntryId) => {

package/dist/core/runner/prepare-inherited-gate.d.ts

@@ -43,7 +43,7 @@ import { type ChildClampSource } from "../child-clamp-seats.js";
 import type { LockedPreflight } from "../locked-config.js";
 import type { OwnOrgAdmissionVerdict } from "../memory-admission.js";
 import type { DelegationContentSafety } from "../memory-engine/delegation-provenance.js";
-import { type SessionPermissionRules } from "../session-policy-store.js";
+import type { SessionPermissionRules } from "../session-policy-store.js";
 import type { SessionStore } from "../session.js";
 import { type OnAsk, type ToolPolicy } from "../tool-policy.js";
 import type { PathRuleBases } from "../permission-rule-model.js";
@@ -62,6 +62,8 @@ export interface PrepareInheritedGateInput {
     checkpointSeat: import("../checkpoint-seat.js").CheckpointSeat | undefined;
     /** borrowed-readonly — this leg's checkpoint scope (the driver's one `checkpointScopeOf` derivation): the ctx's `checkpointScopeForChildren`, which every delegation lane copies into its children's internals. */
     checkpointScope: string;
+    /** borrowed-readonly — the deployment's host floor as the config doors compiled it (`RunnerDeps.hostFloor`): the ctx's `hostFloor`, absent when none is declared. */
+    hostFloor: import("../host-floor.js").HostFloor | undefined;
     /** borrowed-readonly — the deployment seats: `autoMode.denialLimit` (the rebuilt trackers' bounds), `memoryScopeAdmission` /
      *  `deploymentMemoryScopes` / `compliancePostureResolver` (the governed-provenance bit), `onError` (the screening-face crash
      *  lane), `onNotice` (the stop seat's notice), `executionEnv` (the hook-env identity predicate), `delegationEntryCaps` (resolved
@@ -109,8 +111,8 @@ export interface PrepareInheritedGateInput {
     mountsCallerTool: (tool: ToolSpec) => boolean;
     /** borrowed-readonly — the ctx's `mountedMcp` seat: the MCP surface the run mounts right now (call-time; the roster is minted after this phase). Present iff the run declared a server. */
     mountedMcp?: () => import("../mounted-mcp.js").MountedMcp;
-    /** borrowed-readonly — the resolved prompt profile (ctx seat). */
-    promptProfile: ToolExecuteContext["promptProfile"];
+    /** borrowed-readonly — the task-level lean switch (ctx seat; absent ⇒ no key). */
+    promptLean: ToolExecuteContext["promptLean"];
     /** borrowed-readonly — the resolved interaction posture (ctx seat; absent ⇒ no key). */
     resolvedInteractionPosture: ToolExecuteContext["interactionPosture"];
     /** borrowed-readonly — the task's own permission-mode key, screened and snapshotted before the first await (undefined =
@@ -160,7 +162,8 @@ export interface PrepareInheritedGateInput {
     /** borrowed-readonly — LATE-BOUND: the per-principal entitlements the caps phase resolves after this one; read only inside
      *  `inheritedGateForChildren` (the two mandate tests), at spawn time. */
     runtimeCaps: () => RuntimeCaps | undefined;
-    /** borrowed-readonly — the leg's mods bus: the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
+    /** borrowed-readonly — what the leg hands its descendants of its mods bus (`LegMods.handedDown`: without the skills' own
+     *  registrations): the chain assembly mints this leg's screening entry over its `classic.PreToolUse` chain. */
     modBus: LegModBus;
     /** borrowed-readonly — this leg's chain identity as its admission recorded it (`chainOfBus`) — the installation identity's chain term. */
     ownModChain: readonly ModChainLink[];
@@ -228,9 +231,10 @@ export interface PrepareInheritedGateResult {
     orgGovernedProvenance: boolean;
     /** owned — the operator's shell floor in force (the spec's, or the chain's); undefined = no floor. */
     effectiveShellGate: ShellGateDoctrine | undefined;
-    /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain. Writers (R-3): the policy-chain
-     *  station's session-policy read, once per leg, when a store is wired and the task carries its own sessionId. Read by
-     *  `inheritedGateForChildren` at spawn time. */
+    /** borrowed-mutable — THIS task's own session-rule snapshot for its children's chain: present iff the leg enforces its
+     *  own session-rule layer (a store is wired and the task carries its own sessionId), from prepare on. Writer (R-3): the
+     *  policy-chain station — the layer's seed (the empty rev-0 row when the session has none), then each row it comes to
+     *  enforce. Read by `inheritedGateForChildren` at spawn time. */
     ownSessionRulesRef: {
         current?: {
             sessionId: string;