@sema-agent/core 7.56.0 → 7.57.0

package/dist/core/runner/prepare-task.js

@@ -74,7 +74,7 @@ export { compensateUnparkedPause } from "./prepare-suspend-saga.js";
 import { checkpointScopeOf, placementValueOrAbsent } from "./checkpoint-scope.js";
 export { DEFAULT_IRREVERSIBLE_SCOPE, checkpointScopeOf, placementValueOrAbsent } from "./checkpoint-scope.js";
 export { mcpManifestEntries } from "./prepare-wiring-manifest.js";
-import { derivedRouteFallsBack } from "./derived-route-fallback.js";
+import { compactionSummaryFallback, compactionSummaryIsDerived } from "./derived-route-fallback.js";
 import { prepareAdvisor } from "./prepare-advisor.js";
 import { prepareProtocolTools } from "./prepare-protocol-tools.js";
 import { prepareQuestionFace } from "./prepare-question-face.js";
@@ -91,8 +91,8 @@ import { announcePeerLaneMount, judgeSessionBoxDrain } from "../../agents/peer-s
 import { createFrameSettlement } from "../frame-settlement.js";
 import { createSchedulerTools } from "../../tools/scheduler-tools.js";
 import { selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
-import { compileToolSelector, valveLeaves } from "../../agents/tool-filter.js";
-import { boundOwnToolLists, boundToolListsJudgment, judgeRunToolLists } from "./sub-agent-deny-lists.js";
+import { valveLeaves } from "../../agents/tool-filter.js";
+import { boundOwnToolLists, boundToolListsJudgment, judgeRunToolLists, ownListsWhereOf, readToolSelector } from "./sub-agent-deny-lists.js";
 import { remainingBudgetMicroUsd, resolveCheckpointStore } from "../checkpoint-store.js";
 import { checkpointSeatOf } from "../checkpoint-seat.js";
 import { handsWriteHalfMounts } from "../../tools/fs/index.js";
@@ -288,7 +288,7 @@ function refuseRegistryScopeMismatch(spec, internals) {
 function validateInputFaultNotice(onError, sessionId) {
     return ({ toolName, toolCallId, error }) => onError?.(new Error(`tool input pre-validation (validateInput) threw for ${toolName} (call ${toolCallId}) — read as no verdict; the call proceeded to the gate: ${thrownText(error)}`), { phase: "hook", sessionId });
 }
-export async function prepareTask(request, deps, sessions, resume, internals, runnerSelf, runIdSink, holdSessionLock) {
+export async function prepareTask(request, deps, sessions, resume, internals, runnerSelf, runIdSink, holdSessionLock, legWrites) {
     const runId = uuidv7();
     if (runIdSink !== undefined)
         runIdSink.runId = runId;
@@ -317,17 +317,6 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     refuseRequireExistingWithoutSession(spec);
     refuseRegistryScopeMismatch(spec, internals);
     const ownToolLists = boundOwnToolLists(internals?.ownToolLists ?? resume?.seed.ownToolLists, toolFaceLists);
-    const extraBodyRefusal = judgeExtraBody(model.extraBody, model.id).refused;
-    if (extraBodyRefusal !== undefined)
-        throw Object.assign(new Error(extraBodyRefusal.sentence), { code: extraBodyRefusal.code, ...(extraBodyRefusal.field !== undefined ? { detail: { field: extraBodyRefusal.field } } : {}) });
-    for (const cap of MODEL_CAPABILITIES)
-        capabilityOf(model, cap);
-    const fileHistoryRequest = resolveFileHistoryRequest(spec, deps);
-    const { acquired, session, conflictRef, wakeRecovered, branch } = await prepareAcquireReconcile({ sessions, spec, resume, wakeEffects, report: (e, id) => deps.onError?.(e, { phase: "config", sessionId: id }), ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
-    const sessionId = acquired.sessionId;
-    await holdSessionLock?.(sessionId);
-    const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
-    const hostTaskId = spec.taskId ?? sessionId;
     const delegation = effectiveDelegationFacts(internals, resume?.seed.isDelegatedChild);
     const toolLegs = [
         ...(delegation.isDelegatedChild ? ["delegated"] : []),
@@ -339,18 +328,25 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
     const toolCeiling = internals?.toolCeiling ?? resume?.seed.toolCeiling;
     const toolListsJudged = boundToolListsJudgment(internals?.toolListsJudged ?? resume?.seed.toolListsJudged, toolFaceLists);
     const toolFaceSnapshot = Object.freeze({
-        selector: compileToolSelector([...(toolCeiling ?? []), Object.freeze({ ...(toolFaceLists.allow !== undefined ? { allow: toolFaceLists.allow } : {}), deny: toolFaceLists.exclude ?? [] })], toolLegs),
+        selector: readToolSelector({ layers: [...(toolCeiling ?? []), { ...(toolFaceLists.allow !== undefined ? { allow: toolFaceLists.allow } : {}), deny: toolFaceLists.exclude ?? [] }], where: ownListsWhereOf(ownToolLists), legs: toolLegs }),
         defer: toolFaceLists.defer,
         alwaysLoad: toolFaceLists.alwaysLoad,
         restoreGated: toolFaceLists.restoreGated,
     });
+    const toolCeilingRead = toolCeiling === undefined ? undefined : toolFaceSnapshot.selector.layers.slice(0, -1);
+    const extraBodyRefusal = judgeExtraBody(model.extraBody, model.id).refused;
+    if (extraBodyRefusal !== undefined)
+        throw Object.assign(new Error(extraBodyRefusal.sentence), { code: extraBodyRefusal.code, ...(extraBodyRefusal.field !== undefined ? { detail: { field: extraBodyRefusal.field } } : {}) });
+    for (const cap of MODEL_CAPABILITIES)
+        capabilityOf(model, cap);
+    const fileHistoryRequest = resolveFileHistoryRequest(spec, deps);
+    const { acquired, session, conflictRef, wakeRecovered, branch } = await prepareAcquireReconcile({ sessions, spec, resume, wakeEffects, report: (e, id) => deps.onError?.(e, { phase: "config", sessionId: id }), ...(legWrites !== undefined ? { legWrites } : {}), ...(internals?.sessionPlacement !== undefined ? { placement: internals.sessionPlacement } : {}), ...(() => { const g = durableParkGapFor(deps, spec); return g !== undefined ? { durableParkGap: g } : {}; })() });
+    const sessionId = acquired.sessionId;
+    await holdSessionLock?.(sessionId);
+    const onceLedger = await loadAnnounceOnceLedger(session, resume?.seed.announcedListings, deps.onError);
+    const hostTaskId = spec.taskId ?? sessionId;
     const placementRootResolved = (internals = restorePlacementRoot(internals, resume?.seed.placementRootSessionId))?.placementRoot ?? internals?.rootSessionId ?? sessionId;
-    let effectiveCompModel = compModel;
-    if (spec.compactionModel === undefined &&
-        compModel !== undefined &&
-        (await derivedRouteFallsBack({ seat: "compaction-summary", derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId })).action === "fall_back") {
-        effectiveCompModel = undefined;
-    }
+    const effectiveCompModel = compactionSummaryIsDerived(spec.compactionModel !== undefined, compModel) ? await compactionSummaryFallback({ derived: compModel, primary: model, brain: deps.brain, getApiKeyAndHeaders: spec.getApiKeyAndHeaders, onNotice: deps.onNotice, sessionId, runId }) : compModel;
     warnCompactionWindowHazard(deps.tracer, spec, model, effectiveCompModel, hostTaskId, runnerSelf?.contextOverlayOf?.(resolvedRole.modelRef));
     const taskScope = internals?.registryScope ?? spec.principal ?? "default";
     const checkpointScope = checkpointScopeOf(spec, internals?.checkpointScope || resume?.seed.legScope);
@@ -625,7 +621,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const modelFileReaderSeat = {};
         const handsReadFaceInput = { permissionMode, denyRuleRows: effectivePathDenyRules, headLeads, writeTargetJudge: () => writeTargetJudgeRef.current, personRows, handsEnabled, executionEnv, taskRootFinal, taskRootCanonical, rebaseRestoredPath, resume, session, sessionId, hostTaskId, taskScope, fullShellReachable, effectiveShellGate, toolFaceSnapshot, model, spec, deps, internals, memoryWriteGate, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), firstPartyOffload, roster, egressTools, irreversibilityTier, irreversibleTools, reversibilityProbes, reminderMark, reminderDisclosureCounts, modelFileReaderSeat, ...(trackFileEdit !== undefined ? { trackFileEdit } : {}), onFileEdited: noteFileEdited, harnessRef, toolProgressRef, toolOccurrences };
         const handsReadFace = handsEnabled ? await prepareHandsMount(handsReadFaceInput) : resolveHandsLessReadFace(handsReadFaceInput);
-        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, shellReadCheck, shellReadAdmission, additionalRootsCanonical, attachmentRootCanonical, readDenyMatcher, readRoots, pathTables, envHandToolNames, sealReadStateSeat } = handsReadFace;
+        const { readFileStateForCheckpoint, seedContextFiles, handsCwdRef, workspaceStateSettle, wsSnapshot, rebaseWsPath, backgroundTaskToolsActive, shellReadCheck, shellReadAdmission, shellReadLandings, additionalRootsCanonical, attachmentRootCanonical, readDenyMatcher, readRoots, pathTables, envHandToolNames, sealReadStateSeat } = handsReadFace;
         resolvedReadFace = handsReadFace.resolvedReadFace;
         resolvedWriteFace = handsReadFace.resolvedWriteFace;
         readDenyAdditionsNormalized = handsReadFace.readDenyAdditionsNormalized;
@@ -681,7 +677,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const { memoryBlock: memoryBlockWithProject, instructionSources, projectMemoryFact, projectInstructionContent, skillSpecs, skillSeatOf, skillsListing, sharedMemoryPairMounted, memoryEnginePairMounted } = projectContext;
         const { featureFlags, sugar, mcpInstructionsBlock, envFacts, tzValid, userTz, dateAnchor, gitStatusRef } = await preparePromptInputs({ modBus: legMods.bus, spec, deps, contextOverlay: legContextOverlay(), failClosedReason: selfOrchestrationFailClosedReason(spec, deps), lockedPreflight, selfOrchestrationActive, executionEnv, reminderMark, resolvedReadFace, resolvedWriteFace: resolvedWriteFace?.inForce(), toolFaceSnapshot, internals, thinking, ownedEnv, delegation, resolvedRole, taskRole: promptHost.role, mcp, roster, model, externalContentTargetActive, resume, handsEnabled, taskRootFinal, additionalRootsCanonical, additionalReadRootsCanonical: (await readRoots.ready().then(readRoots)).filter((r) => !additionalRootsCanonical.includes(r)), sessionId, session, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}) });
         const advisor = await prepareAdvisor({ spec, advisorTool: doors.advisorTool, deps, model, roster, selector: toolFaceSnapshot.selector, session, onceLedger, rootLeg: !delegation.isDelegatedChild, sessionId, runId, sideCallBookRef, lastSentRequest: () => lastBrainContextRef.current, brainCallGuardrailMs });
-        judgeRunToolLists({ spec, tools: roster.tools, declaredPeers: { mcp: lockedPreflight.mcp, a2a: a2a.statuses }, own: { allow: toolFaceLists.allow, exclude: toolFaceLists.exclude }, layers: toolFaceSnapshot.selector.layers, legs: toolLegs, judgedUpstream: toolListsJudged !== undefined, toldUpstream: internals?.ownToolLists !== undefined && ownToolLists !== undefined && toolCeiling !== undefined, ownBy: ownToolLists, onceLedger, sessionId });
+        judgeRunToolLists({ spec, tools: roster.tools, declaredPeers: { mcp: lockedPreflight.mcp, a2a: a2a.statuses }, own: { allow: toolFaceLists.allow, exclude: toolFaceLists.exclude }, selector: toolFaceSnapshot.selector, legs: toolLegs, judgedUpstream: toolListsJudged !== undefined, toldUpstream: internals?.ownToolLists !== undefined && ownToolLists !== undefined && toolCeiling !== undefined, ownBy: ownToolLists, onceLedger, sessionId });
         const { deferred, memoryBlock, toolSearch: toolSearchPolicy } = prepareDeferClassify({ spec, deps, roster, toolFaceSnapshot, handsEnabled, fullShellReachable, promptTraits, model, mcp, a2a, sharedMemoryPairMounted, memoryEnginePairMounted, memoryBlock: memoryBlockWithProject, memoryRecallSegment, onceLedger, sessionId });
         prepareMemoryEngineSession({ memoryEngineSession, internals, memoryDelegationEvidence, externalContentTargetActive, lockedPreflight, ...(mountedMcpNow !== undefined ? { mountedMcp: mountedMcpNow } : {}), sessionId, runId, deps, provenanceForChildrenRef, delegationSettlementRef, spec, envHandToolNames, roster, contentOriginWrapRef });
         const { systemPromptSeat, renderWithDate, systemBlocks, promptManifest, promptIdentity, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef } = await preparePromptAssembly({ session, deps, internals, resume, sugar: sugar.overlays, host: { ...(sugar.hostRole !== undefined ? { role: sugar.hostRole } : {}), ...(promptHost.form !== undefined ? { form: promptHost.form } : {}) }, binding: promptBinding, modBus: legMods.bus, signal: abortController.signal, featureFlags, mcpInstructionsBlock, memoryBlock, envFacts, promptTraits, tools, model, sessionId, onceLedger });
@@ -808,9 +804,9 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const stampCallTarget = attachmentRootCanonical === undefined ? undefined : legCallTargetStamp({ env: executionEnv, root: attachmentRootCanonical, cwd: () => handsCwdRef?.current, judgesPaths: () => parkLaneArmed || effectivePolicy?.pathRules !== undefined || basePolicyForResumeEdit?.pathRules !== undefined || permissionRuleLane !== undefined || skillSpecs.some((s) => compileSkillGrant(s, "model").rows.some((r) => r.compiled.kind === "path")) || allowedToolTables.request.holdsPathRows() || allowedToolTables.deployment.holdsPathRows(), leads: () => headLeads.resolve([...toolPolicyPathRules([effectivePolicy, basePolicyForResumeEdit, ...(inheritedParentConstraints ?? []).map((c) => c.policy)], legAnchors), ...bindPathRules(listPathRows().map((rule) => ({ parsed: rule, ruleText: rule.rule })), legAnchors)]) });
         const { askLane } = prepareAskLane({ gateMachineryActive, abortController, effectivePolicy, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, advertisedWritableDirs, exemptRoots: legExemptRoots, tools, inheritedUnavailableAsks, inheritedAskGrants, onAsk, humanReviewRef, now, ruleOffersOf, grantBindingOf, askSourceIdentity, riskAxesOf, autoModeDenialTracking: autoModeDenialTrackingRef, spec, deps, sessionId, runId, modBus: legMods.bus, notifyOwnHookCrash, grantReadRoot: handsReadFace.grantReadRoot });
         const inheritedAnchorRecords = chainAnchorRecords(chainTop, inheritedParentConstraints ?? []);
-        const { saga } = prepareSuspendSaga({ gateMachineryActive, crossBoundary, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, skillScopesCheckpointSection: () => legMods.skillScopes.frozen(), reminderMark, handsCwdRef, handsRoot: attachmentRootCanonical, handsHome: attachmentRootCanonical !== undefined ? legAnchors.home : undefined, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors: chainTop !== legAnchors ? inheritedAnchorRecords.pathRuleAnchors : undefined, inheritedPathRuleInstallations: inheritedAnchorRecords.pathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling, toolListsJudged, ownToolLists, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
+        const { saga } = prepareSuspendSaga({ gateMachineryActive, crossBoundary, abortController, harness, checkpointStore, deps, sessionId, hostTaskId, taskScope, liveSpendRef, resume, nestedStats, internals, activeTools, outputRef, readFileStateForCheckpoint, faceCheckpointSection, writeFaceCheckpointSection, skillGrantCheckpointSection, skillScopesCheckpointSection: () => legMods.skillScopes.frozen(), reminderMark, handsCwdRef, handsRoot: attachmentRootCanonical, handsHome: attachmentRootCanonical !== undefined ? legAnchors.home : undefined, worktreeSessionRef, undeliveredContinuationRef, inheritedParentConstraints, seedInheritedGate, ancestorRulesNow, inheritedShellGate, permissionMode, inheritedAdmittedOrgScopes, inheritedPathRuleAnchors: chainTop !== legAnchors ? inheritedAnchorRecords.pathRuleAnchors : undefined, inheritedPathRuleInstallations: inheritedAnchorRecords.pathRuleInstallations, ownOrgVerdictRef, orgGovernedProvenance, announcedListingsRef, gitStatusRef, hookIdentity, placementRootResolved, checkpointScope, toolCeiling: toolCeilingRead, toolListsJudged, ownToolLists, externalContentTargetActive, remoteEnvFailures, memoryEngineSession, suspendLoopRef, ownedEnv, incompleteSuspendAdapter });
         const { suspendForResource, suspendForPlatformLimit, suspendForReview } = prepareBoundaryParks({ saga, spec, checkpointStore, checkpointScope, abortController, harness, session, sessions, sessionId, deps, priorLedger, maxSlices, maxSuspends, resourceTotal, priorSuspendCount, suspendChainBase, humanReviewRef, liveSpendRef, now, pausedRef, remoteEnvFailures, resourceSuspendEligible, durableSuspendInfraReady, incompleteSuspendAdapter });
-        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, advertisedWritableDirs, exemptRoots: legExemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
+        const { parkAsk } = prepareParkAsk({ askLane, saga, spec, deps, sessionId, checkpointStore, checkpointScope, toolRosterDeltas: rosterSeat, parkLaneArmed, contentAskRoutable, liveQuestionFace, mountedQuestionTool, contentAskBindings, lateStrandedAnswers, discloseStrandedAnswers, onAsk, runtimeCaps, inheritedUnavailableAsks, basePolicyForResumeEdit, budgetSnapshot, handsCwdRef, handsRoot: attachmentRootCanonical, stampCallTarget, shellReadLandings, advertisedWritableDirs, exemptRoots: legExemptRoots, offloadStore, ownedEnv, incompleteSuspendAdapter, session, sessions, suspendChainBase, maxSuspends, remoteEnvFailures, shellGatedTools, irreversibilityTier, toolMarkSources, effectiveShellGate, durableApproval, priorLedger, liveSpendRef, resourceTotal, ruleOffersOf, grantBindingOf, now, humanReviewRef, abortController, harness, pausedRef });
         const seatInputsFor = skillGateWiring({ tools, skillToolName: SKILL_TOOL_NAME, seatOf: skillSeatOf, mode: () => permissionMode.current, lane: skillGrantLane, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.skill_allowed", version: 1, taskId: hostTaskId, ...info, entries: [...info.entries], ts: Date.now() })), allowEntries: { deploymentAllows: { ...allowEntryLanes.deployment, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "deployment", ...info, entries: [...info.entries], ts: Date.now() })) }, requestAllows: { ...allowEntryLanes.request, onAllowed: (info) => emitTrace(deps.tracer, () => ({ kind: "permission.allowed_tools_allowed", version: 1, taskId: hostTaskId, source: "request", ...info, entries: [...info.entries], ts: Date.now() })) } } });
         const { approvedCallScreen } = prepareGateStations({ askLane, parkAsk, tools, toolRosterDeltas: rosterSeat, crossBoundaryCheck: crossBoundary.seat({ tools, roster: rosterSeat }), deps, toolCallGateArmedRef, effectivePolicy, modBus: legMods.bus, inheritedToolChecks, egressTools, irreversibleTools, spec, complianceDenies, harness, blockedToolCalls, inheritedAskGrants, inheritedUnavailableAsks, foldAskClasses, ancestorSandboxAdmissions, preToolContexts, toolOccurrences, batchHaltRef, blockedTracked, hookIdentity, reminderMark, hostTaskId, sessionId, handsCwdRef, stampCallTarget, readDenyInForce: (toolCallId) => ({ tiers: handsReadFace.readDenyBuiltinTiersActive, rows: [...readDenyAdditionsNormalized.map((e) => e.pattern), ...(pathTables?.forCall(toolCallId).ruleRows ?? handsReadFaceInput.denyRuleRows).filter((r) => r.faces.includes("read")).map((r) => r.rule)] }), hookEnvFace, writeProtectionCheck, shellReadCheck, readFace: () => resolvedReadFace, irreversibilityTier, reversibilityProbes, abortController, shellGatedTools, autoModeDecider: autoModeDeciderRef, autoModeDenialTracking: autoModeDenialTrackingRef, askRoute: { ...wiringManifest.ask, effective: askSeatEffective(wiringManifest) }, permissionMode, toolMarkSources, ...(deps.a2a?.isolatePeers === true ? { a2aIsolatePeers: true } : {}), ancestorArbitrations, runId, stopForDenialLimit, permissionRuleLane, seatInputsFor, permissionRuleOrgLane, questionToolMounted, sandboxAdmissionArmed, sandboxBoundaryCapable, emitSandboxAdmitted, delegation, frameSettlement });
         const postureFrameRef = { report: (err) => deps.onError?.(err, { phase: "degraded", sessionId }) };
@@ -818,7 +814,7 @@ export async function prepareTask(request, deps, sessions, resume, internals, ru
         const preparedHolder = {};
         const { cacheBreakDetector, cacheFingerprint, promptOverheadTokens, compactionRestore, normalizeAttachmentPath, isDedupStubResult, recentlyReadFiles, onCompactionApplied, detectExternalChanges, syntheticReadVerdict, consolidationWriteJudge, listBackgroundTasks, centerCompactionCandidate, effectiveReadFaceObserved, effectiveWriteFaceObserved, effectiveReadDenyObserved } = prepareTurnWiring({ deps, systemPromptSeat, harnessTools, fpRef, model, promptIdentityDigest: promptManifest.identity.artifact, systemBlocks, thinking, spec, sessionId, turnSnapshotRef, promptManifest, charsPerToken, handsEnabled, executionEnv, attachmentRootCanonical, readRoots, modelFileReader: modelFileReaderSeat.current, reminderMark, reminderDisclosureCounts, resolvedReadFace, handsCwdRef, readFileStateForCheckpoint, denyNarrowingPolicy, skillGrants: skillGrantLane, callerPolicy: installedToolPolicy, inheritedPolicies: (inheritedParentConstraints ?? []).map((c) => c.policy), persistedRuleLane: permissionRuleLane, ruleLaneFacts, personRowsBeyondRun, orgRuleLane: permissionRuleOrgLane, stampCallTarget, abortController, hostTaskId, taskScope, buildAssembleInputs, identityFor, adoptsCandidates, centerAdoptionRef, harnessRef, carrierReadFace, carrierWriteFace, readDenyAdditionsNormalized, preparedHolder });
         await onceLedger.settle(session, announcedListingsRef);
-        const buildPrepared = () => ({ harness, session, sessionId, runId, crossBoundary, ...(doors.hostFloor !== undefined ? { hostFloor: doors.hostFloor } : {}), registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), consolidationWriteJudge, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, promptIdentity, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, lastSentRequest: () => lastBrainContextRef.current, ...(advisor.instruction !== undefined ? { advisorInstruction: advisor.instruction } : {}), ...(compactionRestore !== undefined ? { compactionRestore } : {}), recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(mcpUnavailable ? { mcpUnavailable } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, modBus: legMods.bus, sideCallBookRef, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}), ...(toolCallStationRef.current !== undefined ? { toolCallStation: toolCallStationRef.current } : {}) });
+        const buildPrepared = () => ({ harness, session, sessionId, runId, crossBoundary, ...(doors.hostFloor !== undefined ? { hostFloor: doors.hostFloor } : {}), registryAccess: { owner: hostTaskId, scope: taskScope }, reminderMark, reminderDisclosureCounts, fullShellReachable, approvalPosture: { get mode() { return permissionMode.current; }, askEffective: askSeatEffective(wiringManifest) }, ...(outputStyleFrame !== undefined ? { outputStyleFrame } : {}), permissionMode, editedFilesSnapshot, taskRootPath: taskRootFinal, model, thinking, compModel: effectiveCompModel, mcp, ...(mcpRedial !== undefined ? { mcpRedial } : {}), ...(a2a.tools.length > 0 ? { a2a } : {}), blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, toolOccurrences, batchHaltRef, nestedStats, ...(rewindNotes.length > 0 ? { rewindNotes } : {}), ...(fileHistoryBoundary !== undefined ? { fileHistoryBoundary } : {}), ...(effectiveReadFaceObserved !== undefined ? { effectiveReadFace: effectiveReadFaceObserved, effectiveWriteFace: effectiveWriteFaceObserved } : {}), ...(effectiveReadDenyObserved !== undefined ? { effectiveReadDenyPatterns: effectiveReadDenyObserved } : {}), effectiveMemoryScopes: memoryEffectiveScopes, cwdRef: handsCwdRef, ...(attachmentRootCanonical !== undefined ? { handsRoot: attachmentRootCanonical } : {}), ...(stampCallTarget !== undefined ? { stampCallTarget } : {}), toolProgressRef, ...(advertisedWritableDirs !== undefined ? { advertisedWritableDirs } : {}), exemptRoots: legExemptRoots, ...(worktreeSessionRef !== undefined ? { worktreeSessionRef } : {}), ...(workspaceStateSettle !== undefined ? { workspaceStateSettle } : {}), ...(sealReadStateSeat !== undefined ? { sealReadStateSeat } : {}), denyNarrowingPolicy, skillGrants: skillGrantLane, skillSpecs, ...(permissionRuleLane !== undefined ? { persistedRuleLane: permissionRuleLane } : {}), ...(basePolicyForResumeEdit !== undefined ? { basePolicyForResumeEdit } : {}), consolidationWriteJudge, ...(permissionRuleOrgLane !== undefined ? { permissionRuleOrg: permissionRuleOrgLane } : {}), releaseSignal, endModeCeiling, settleContentAskBindings, cacheBreakDetector, cacheFingerprint, wiringManifest, promptManifest, promptIdentity, activeTools, ...(deferred.size > 0 ? { deferredToolNames: deferred } : {}), toolMaterializeStatic, deferDirectCall, ...(staticFaceForRef.current !== undefined ? { staticFaceFor: staticFaceForRef.current } : {}), ownedEnv, pausedRef, undeliveredContinuationRef, suspendProgressRef, remoteEnvFailures, reviewRequestRef, suspendLoopRef, suspendForResource, ...(suspendForPlatformLimit !== undefined ? { suspendForPlatformLimit } : {}), ...(envLifetimeSuspendAt !== undefined ? { envLifetimeSuspendAt } : {}), ...(usageGovernance !== undefined ? { usageGovernance } : {}), callIssuedAtRef, workCutRef, brainCallGuardrailRef, gateStopRef, stopForDenialLimit, suspendForReview, ...(readFileStateForCheckpoint !== undefined ? { readFileState: readFileStateForCheckpoint } : {}), resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolRoster, toolRosterDeltas: rosterSeat, structuredProjector, toolEffects, wakeRecovered, promptOverheadTokens, lastBrainContext, lastSentRequest: () => lastBrainContextRef.current, ...(advisor.instruction !== undefined ? { advisorInstruction: advisor.instruction } : {}), ...(compactionRestore !== undefined ? { compactionRestore } : {}), recentlyReadFiles, normalizeAttachmentPath, isDedupStubResult, ...(onCompactionApplied ? { onCompactionApplied } : {}), compactionReuseRef, trimPressureRef, microCompact, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit && withheldDiagnosticsOf ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit, runIdent: lspRunIdent, withheldOf: withheldDiagnosticsOf } } : {}), stopRequestedRef, announcedSnapshotRecovered: onceLedger.recovered, ...(dateChange ? { dateChange } : {}), ...(instructionSources ? { instructionSources } : {}), ...(projectInstructionContent !== undefined ? { projectInstructionContent } : {}), ...(workflowSizeGuideline ? { workflowSizeGuideline } : {}), ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(mcpUnavailable ? { mcpUnavailable } : {}), ...(agentListing ? { agentListing } : {}), ...(skillsListing ? { skillsListing } : {}), announcedListingsRef, frameReceipts: { pending: [], listingSnapshotOwed: false }, frameSettlement, ...(userAttachmentsSeat !== undefined ? { userAttachments: userAttachmentsSeat } : {}), attachmentDelivery: createAttachmentDelivery(), ...(modelFileReaderSeat.current !== undefined ? { modelFileReader: modelFileReaderSeat.current } : {}), syntheticReadVerdict, ...(peerLaneRefs.boundaryRound !== undefined ? { peerBoundaryRound: peerLaneRefs.boundaryRound } : {}), gitStatusRef, postureFrameRef, listBackgroundTasks, hookIdentity, modBus: legMods.bus, sideCallBookRef, ...(sessionBoxBound !== undefined ? { sessionBox: sessionBoxBound } : {}), ...(turnSnapshotRef.current !== undefined ? { turnSnapshot: turnSnapshotRef.current } : {}), ...(centerCompactionCandidate !== undefined ? { centerCompactionCandidate } : {}), ...(shellReadCheck !== undefined ? { shellReadCheck } : {}), ...(shellReadLandings !== undefined ? { shellReadLandings } : {}), ...(toolDisclosureSeat !== undefined ? { toolDisclosure: toolDisclosureSeat } : {}), ...(approvedCallScreen !== undefined ? { approvedCallScreen } : {}), ...(toolCallStationRef.current !== undefined ? { toolCallStation: toolCallStationRef.current } : {}) });
         refuseLateRosterChanges(callerRoster.roster);
         rollback.commit();
         commitModeSeats(abortController.signal);

package/dist/core/runner/prepare-tool-disclosure-mount.d.ts

@@ -114,6 +114,19 @@ export interface PrepareToolDisclosureMountResult {
     /** owned — the deferral census seat, minted ONLY when something is deferred; absent ⇒ no `tool_disclosure` frame at all. */
     toolDisclosureSeat?: ToolDisclosureSeat;
 }
+/**
+ * The ToolSearch activation set a branch's landed compactions restate: the union of every engine compaction entry's
+ * snapshot (activation is monotonic in-session and every snapshot restates the then-current set, so the union is the
+ * latest complete restatement plus whatever older names a snapshotless window preserved); hook-authored entries are
+ * skipped like every sibling carrier reader (their details are not engine shape). Unfiltered — a leg intersects it
+ * with its own deferred registry. The one reading for a leg's seed and for a pass with no leg (the out-of-run
+ * compaction restates it, so a wake whose floor sits at the newest compaction still sees it).
+ */
+export declare function compactionActivationSnapshot(branch: ReadonlyArray<{
+    readonly type: string;
+    readonly fromHook?: boolean;
+    readonly details?: unknown;
+}>): string[];
 /** Test seam (mirrors `__resetToolModelGateAnnouncements`): never called by production code.
  *  Re-arms BOTH arms (a WeakMap has no clear — it is re-minted). */
 export declare function __resetMaterializeEnvAnnouncements(): void;

package/dist/core/runner/prepare-tool-disclosure-mount.js

@@ -16,6 +16,16 @@ function materializeEnvLedger(onNotice) {
     }
     return lines;
 }
+export function compactionActivationSnapshot(branch) {
+    const names = new Set();
+    for (const entry of branch) {
+        if (entry.type !== "compaction" || entry.fromHook === true)
+            continue;
+        for (const n of readCompactionActiveTools(entry.details))
+            names.add(n);
+    }
+    return [...names];
+}
 export function __resetMaterializeEnvAnnouncements() {
     announcedMaterializeEnvBySink = new WeakMap();
     announcedMaterializeEnvConsole.clear();
@@ -144,13 +154,9 @@ export async function prepareToolDisclosureMount(input) {
             if (deferred.has(n))
                 activeTools.add(n);
         }
-        for (const entry of await session.getBranch()) {
-            if (entry.type !== "compaction" || entry.fromHook === true)
-                continue;
-            for (const n of readCompactionActiveTools(entry.details)) {
-                if (deferred.has(n))
-                    activeTools.add(n);
-            }
+        for (const n of compactionActivationSnapshot(await session.getBranch())) {
+            if (deferred.has(n))
+                activeTools.add(n);
         }
         if (resume) {
             for (const n of resume.seed.activeTools)

package/dist/core/runner/rewind-files.d.ts

@@ -2,14 +2,11 @@ import type { RewindFilesRequest, RewindFilesResult } from "../file-history-stor
 import type { SessionStore } from "../session.js";
 import type { RunnerDeps } from "../types.js";
 import type { SessionReadFileStates } from "./session-read-file-states.js";
+import { type SessionLockSeats } from "./session-verb-doors.js";
 /** What the Runner lends the rewind: its current deps, its session store, its read-state seats, and its lock. */
-export interface RewindFilesSeats {
+export interface RewindFilesSeats extends SessionLockSeats {
     deps: RunnerDeps;
     sessions: SessionStore;
     readStates: SessionReadFileStates;
-    /** Whether a leg of this Runner holds or awaits `sessionId`'s lock. */
-    sessionBusy(sessionId: string): boolean;
-    /** Take `sessionId`'s lock; called synchronously after `sessionBusy` answered false, so nothing slips in between. */
-    takeSessionLock(sessionId: string): Promise<() => void>;
 }
 export declare function rewindSessionFiles(seats: RewindFilesSeats, request: RewindFilesRequest): Promise<RewindFilesResult>;

package/dist/core/runner/rewind-files.js

@@ -1,12 +1,10 @@
-import { types } from "node:util";
-import { isPlainRecord } from "../mods/kernel/receive.js";
 import { hasDestroy } from "../remote-env.js";
-import { readMember } from "../thrown-value.js";
 import { resolveDeploymentFileHistory, storeUnconfiguredRefusal } from "./file-history-request.js";
 import { prepareExecutionEnv } from "./prepare-execution-env.js";
 import { noBoundaryRefusal, settleFileHistoryRestore } from "./file-history-restore.js";
 import { adoptForkedFileHistory, resolveFileHistoryCoordinates } from "./prepare-file-history.js";
 import { createRollbackStack } from "./rollback-stack.js";
+import { acquireExistingSession, claimIdleSession, readPlainRequest, shownValue } from "./session-verb-doors.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 const REQUEST_KEYS = new Set(["sessionId", "to", "dryRun", "signal"]);
 export async function rewindSessionFiles(seats, request) {
@@ -15,12 +13,9 @@ export async function rewindSessionFiles(seats, request) {
     const { wiredSeat, fileHistoryStore, captureStore } = resolveDeploymentFileHistory(deps);
     if (fileHistoryStore === undefined)
         throw storeUnconfiguredRefusal(wiredSeat, req.to);
-    if (seats.sessionBusy(req.sessionId))
-        throw sessionBusyRefusal(req.sessionId, req.to);
-    const lock = seats.takeSessionLock(req.sessionId);
-    const release = await lock;
+    const release = await claimIdleSession(seats, req.sessionId, () => sessionBusyRefusal(req.sessionId, req.to));
     try {
-        const session = await acquireExistingSession(seats.sessions, req.sessionId);
+        const session = await acquireExistingSession(seats.sessions, req.sessionId, "Runner.rewindFiles", "nothing was rewound");
         const report = (err) => {
             try {
                 deps.onError?.(err, { phase: "config", sessionId: req.sessionId });
@@ -72,56 +67,19 @@ function screenRewindFilesRequest(request) {
         e.code = "rewind.invalid_spec";
         throw e;
     };
-    if (typeof request !== "object" || request === null)
-        return bad(`the request must be a plain object, got ${request === null ? "null" : typeof request}`);
-    if (types.isProxy(request) || !isPlainRecord(request))
-        return bad("the request must be a plain data object (not a Proxy, and with no prototype that could supply a member)");
-    let descriptors;
-    try {
-        descriptors = Object.getOwnPropertyDescriptors(request);
-    }
-    catch {
-        return bad("the request could not be read");
-    }
-    const keys = Reflect.ownKeys(descriptors);
-    const unknown = keys.filter((k) => typeof k !== "string" || !REQUEST_KEYS.has(k));
-    if (unknown.length > 0)
-        return bad(`unknown key ${unknown.map((k) => JSON.stringify(String(k))).join(", ")}`);
-    const read = {};
-    for (const k of keys) {
-        const d = descriptors[k];
-        if (!("value" in d))
-            return bad(`member ${JSON.stringify(k)} is an accessor, not a value`);
-        read[k] = d.value;
-    }
-    const { sessionId, to, dryRun, signal } = read;
+    const { sessionId, to, dryRun, signal } = readPlainRequest(request, REQUEST_KEYS, bad);
     if (typeof sessionId !== "string" || sessionId === "")
-        return bad(`sessionId must be a non-empty string, got ${shown(sessionId)}`);
+        return bad(`sessionId must be a non-empty string, got ${shownValue(sessionId)}`);
     if (typeof to !== "string" || to === "")
-        return bad(`to must be a non-empty entry id, got ${shown(to)}`);
+        return bad(`to must be a non-empty entry id, got ${shownValue(to)}`);
     if (dryRun !== undefined && typeof dryRun !== "boolean")
-        return bad(`dryRun must be a boolean when given, got ${shown(dryRun)}`);
+        return bad(`dryRun must be a boolean when given, got ${shownValue(dryRun)}`);
     if (signal !== undefined && !(signal instanceof AbortSignal))
-        return bad(`signal must be an AbortSignal when given, got ${shown(signal)}`);
+        return bad(`signal must be an AbortSignal when given, got ${shownValue(signal)}`);
     return { sessionId, to, dryRun: dryRun === true, signal };
 }
-function shown(v) {
-    return typeof v === "string" ? JSON.stringify(v.slice(0, 40)) : v === null || typeof v === "boolean" || typeof v === "number" ? String(v) : `a ${typeof v}`;
-}
-async function acquireExistingSession(sessions, sessionId) {
-    try {
-        return await sessions.acquire(sessionId, { requireExisting: true });
-    }
-    catch (err) {
-        if (readMember(err, "code") !== "not_found")
-            throw err;
-        const e = new Error(`Runner.rewindFiles: session "${sessionId}" does not exist — nothing was rewound`);
-        e.code = "resume.session_not_found";
-        throw e;
-    }
-}
 function sessionBusyRefusal(sessionId, target) {
-    const e = new Error(`Runner.rewindFiles: a task is running or queued on session "${sessionId}" in this Runner — rewinding its files to entry "${target}" now would move them under that task, so nothing was rewound; retry once it has ended`);
+    const e = new Error(`Runner.rewindFiles: a task is running or queued on session "${sessionId}" in this Runner, or a write one of its tasks issued has not settled — rewinding its files to entry "${target}" now would move them under that work, so nothing was rewound; retry once it has ended and its writes have settled`);
     e.code = "rewind.session_busy";
     return e;
 }

package/dist/core/runner/run-leg.js

@@ -69,7 +69,6 @@ export async function runLeg(input) {
             const walltimeExhaustedResume = effectiveTimeoutMs !== undefined && effectiveTimeoutMs <= 0;
             const approvalWords = approvalWordsOf(resume.outcome);
             const approvalFrames = owedApprovalWords(approvalWords, uuidv7());
-            let approvalCommitted = false;
             prepared.undeliveredContinuationRef.current.parkedSteers.push(...approvalFrames);
             const resumeWindowRetryAfterMs = !walltimeExhaustedResume && prepared.usageGovernance !== undefined ? await prepared.usageGovernance.check(Date.now()) : undefined;
             if (resumeWindowRetryAfterMs !== undefined) {
@@ -244,10 +243,10 @@ export async function runLeg(input) {
                             (steer.trusted ? formatHookFeedback(projected, prepared.reminderMark) : delimitUntrusted("supervisor steering message", projected));
                     if (steer.trusted)
                         engineSegments.push({ start, end: continuation.length });
-                    appliedEvents.push({
+                    appliedEvents.push(() => ({
                         ...buildAppliedHumanInputEvent({ carrier: source, source, sessionSeq: nextHumanInputSeq(prepared.harness), inputId: steer.inputId, actor: steer.actor, principal: spec.principal }),
                         ...ident(),
-                    });
+                    }));
                 }
                 if (approvalWords !== undefined)
                     continuation = withApprovalWords(continuation, engineSegments, approvalWords);
@@ -259,8 +258,6 @@ export async function runLeg(input) {
                     prepared.batchHaltRef.current = { rejectedToolCallId: pending.toolCallId };
                 prepared.undeliveredContinuationRef.current = { parkedSteers: [...resumeFrames.map(({ entry }) => entry).filter((e) => !withheldSteerIds.has(e.inputId)), ...approvalFrames], orphanTasks };
                 if (!prepared.abortController.signal.aborted) {
-                    if (resume !== undefined)
-                        resume.decisionDelivered = true;
                     registerAdvisorReceipt(prepared, continuation);
                     if (gitResumeDelivered !== undefined) {
                         const delivered = gitResumeDelivered;
@@ -284,24 +281,15 @@ export async function runLeg(input) {
                         prepared.frameReceipts.pending.push({ source: "posture", text: continuation, commit: () => undefined });
                     if (unavailableResume !== undefined)
                         prepared.frameReceipts.pending.push({ source: "mcp_unavailable", text: continuation, commit: () => void (settleMcpUnavailable(prepared, unavailableResume.entries), queue.push({ type: "steering_injected", source: "mcp_unavailable", preview: redactThenCut(unavailableResume.body, 220), ...ident() }), (rs.attach.attachmentsInjected += 1)) });
-                    if (approvalFrames.length > 0) {
-                        prepared.frameReceipts.pending.push({
-                            source: "approval_feedback",
-                            text: continuation,
-                            commit: () => {
-                                approvalCommitted = true;
-                                const seat = prepared.undeliveredContinuationRef.current;
-                                seat.parkedSteers = seat.parkedSteers.filter((f) => !approvalFrames.includes(f));
-                            },
-                        });
-                    }
                     final = await withBrainSinks(() => prepared.harness.prompt(continuation, {
                         engineSegments,
                         settleUnansweredToolCalls: rejectionHalt !== undefined ? { halt: rejectionHalt } : {},
-                        onDelivered: () => {
-                            prepared.undeliveredContinuationRef.current = { parkedSteers: approvalCommitted ? [] : [...approvalFrames], orphanTasks: [] };
-                            for (const e of appliedEvents)
-                                queue.push(e);
+                        onCommitted: () => {
+                            if (resume !== undefined)
+                                resume.decisionDelivered = true;
+                            prepared.undeliveredContinuationRef.current = { parkedSteers: [], orphanTasks: [] };
+                            for (const applied of appliedEvents)
+                                queue.push(applied());
                         },
                     }));
                     await flushGitMirror();
@@ -830,7 +818,8 @@ async function resolvePendingCall(runner, prepared, resume, emit, emitCommitted,
     for (;;) {
         const { targetReading: _belts, ...unread } = beltReq();
         const targetReading = (await prepared.stampCallTarget?.(unread, prepared.abortController.signal))?.targetReading;
-        const atExecution = judgeApprovalObject(pendingAction, { tool: mounted().entry, args: executedArgs, skills: prepared.skillSpecs, skillToolName: SKILL_TOOL_NAME, ...(humanRewrite !== undefined ? { decided: resolvedArgs } : {}), targetReading }, "execution");
+        const reads = prepared.shellReadLandings?.(pendingAction.toolCallId);
+        const atExecution = judgeApprovalObject(pendingAction, { tool: mounted().entry, args: executedArgs, skills: prepared.skillSpecs, skillToolName: SKILL_TOOL_NAME, ...(humanRewrite !== undefined ? { decided: resolvedArgs } : {}), targetReading, reads }, "execution");
         if (atExecution !== "match")
             return atExecution.disposition === "reopen" ? reopen(atExecution) : vetoApproval(atExecution);
         tool = mounted().tool;

package/dist/core/runner/run-notification-lane.d.ts

@@ -19,6 +19,8 @@ export interface RunNotificationLaneInput<R> {
     taskIdRef: TaskIdRef | undefined;
     /** borrowed-readonly — the stream layer's session-lock verb, handed to prepare; absent when the spec named its session. */
     holdSessionLock: ((sessionId: string) => Promise<void>) | undefined;
+    /** borrowed-mutable (the Runner's) — this leg's view of the session write ledger, handed to prepare; the stream layer closes it at the leg's end. */
+    legWrites: import("./session-write-ledger.js").LegWrites;
     /** borrowed-readonly — the Runner's deployment deps, read LIVE (`onError` in the park closure — after the run, on a swapped
      *  catalog it is still the CURRENT sink; `models` and prepare's `deps` at the natural-snapshot pin); the one home of why it
      *  is a seat and not a captured object is {@link RunnerDepsSeat}. */

package/dist/core/runner/run-notification-lane.js

@@ -8,7 +8,7 @@ export function runNotificationLane(input) {
     return obligations.run(() => runNotificationLaneAs(input, obligations));
 }
 async function runNotificationLaneAs(input, obligations) {
-    const { spec, queue, resume, internals, taskIdRef, holdSessionLock, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
+    const { spec, queue, resume, internals, taskIdRef, holdSessionLock, legWrites, runner, self, sessions, sessionReadStates, sessionModeSeats, pendingSessionNotifications, prepareTask, next } = input;
     const prepareResume = resume
         ? {
             leafId: resume.cp.leafId,
@@ -128,7 +128,7 @@ async function runNotificationLaneAs(input, obligations) {
             }
             return injectTaskNotification(notification, opts);
         },
-    }, self, taskIdRef, holdSessionLock);
+    }, self, taskIdRef, holdSessionLock, legWrites);
     pendingSessionNotifications.bindSessionBox(prepared.sessionId, prepared.sessionBox);
     const notificationLane = {
         get harness() { return notificationHarness; }, set harness(h) { notificationHarness = h; },

package/dist/core/runner/run-recovery-lanes.js

@@ -2,7 +2,7 @@ import { compactionKindOf } from "../task-notification.js";
 import { planRejectionClears } from "../context-edit.js";
 import { rosterToolName } from "../tool-roster.js";
 import { landStaleResultClears } from "./prepare-context-lane.js";
-import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
+import { compactionFailureReason, compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { rebaseCadenceWindows } from "./turn-attachments.js";
@@ -11,7 +11,7 @@ import { compactionEnabled } from "../context-settings.js";
 import { compactionRestateOptions } from "./compaction-restate.js";
 import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
-import { asThrownError, thrownText } from "../thrown-value.js";
+import { asThrownError } from "../thrown-value.js";
 export function runRecoveryLanes(input) {
     const { spec, prepared, queue, rs, ident, compactionBrain, compactionBreaker, windowSafetyOptions, callerStop, runner } = input;
     const runForcedCompactionPass = async (lane, turnSignal) => {
@@ -102,8 +102,7 @@ export function runRecoveryLanes(input) {
             }
             compactionBreaker.failures += 1;
             runner.deps.onError?.(asThrownError(err), { phase: "compaction", sessionId: prepared.sessionId });
-            const msg = thrownText(err);
-            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: msg.length > 512 ? `${msg.slice(0, 512)}…` : msg, ...passReport.end, ...ident() });
+            queue.push({ type: "compaction_outcome", outcome: "failed", trigger: "forced", reason: compactionFailureReason(err), ...passReport.end, ...ident() });
             return false;
         }
     };

package/dist/core/runner/run-settle-and-teardown.js

@@ -5,7 +5,7 @@ import { adjudicateDerivedRoute, fallbackToPrimaryNotice, sameRouteIdentity } fr
 import { isDegenerateCutMessage } from "../../brain/terminal-cause.js";
 import { hasBackgroundShell, sweepRunBoundaryBackgroundShells } from "../background-shell.js";
 import { resolveCheckpointStore } from "../checkpoint-store.js";
-import { reopenReasonOf, reopenedUnstartedSentence, resumeStartupCauseOf } from "../resume-startup-cause.js";
+import { compensateUnstarted, reopenReasonOf, resumeStartupCauseOf, unstartedRowSentence } from "../resume-startup-cause.js";
 import { classicEventBase, observeClassic } from "../mods/stations.js";
 import { modelCostToPricing } from "../pricing.js";
 import { hasDestroy, isIsolated } from "../remote-env.js";
@@ -139,17 +139,11 @@ export async function runSettleAndTeardown(input) {
             resume.pendingActionStarted !== true &&
             result.terminal.kind !== "completed" &&
             result.terminal.kind !== "paused" &&
-            !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true) &&
-            resume.onEnvRestoreFailed !== undefined) {
+            !(resumeDecisionWasNegative(resume) && resume.decisionDelivered === true)) {
             const reopenReason = reopenReasonOf(resumeStartupCauseOf(result.terminal.kind === "failed" ? result.terminal.code : undefined));
-            try {
-                await resume.onEnvRestoreFailed(reopenReason);
-                rowReturned = true;
-                amendTerminal(result, "resume.reopened_unstarted", (m) => `${m ?? "the resume leg did not complete"} — ${reopenedUnstartedSentence(reopenReason)}`);
-            }
-            catch {
-                amendTerminal(result, "resume.reopen_failed_unstarted", (m) => `${m ?? "the resume leg did not complete"} — the approved action never started, and reopening the checkpoint FAILED: its state is unprovable from here. Re-read it before deciding; do NOT issue a fresh approval on the assumption the old one is dead`);
-            }
+            const row = await compensateUnstarted(resume.reopenUnstarted, reopenReason);
+            rowReturned = row.kind === "reopened";
+            amendTerminal(result, rowReturned ? "resume.reopened_unstarted" : "resume.reopen_failed_unstarted", (m) => `${m ?? "the resume leg did not complete"} — ${unstartedRowSentence(row)}`);
         }
         settleOwedUserInput(owedUserInput, rowReturned, { taskId: spec.taskId ?? prepared.sessionId, sessionId: prepared.sessionId, runId: prepared.runId, parent: parentLegIds(internals) }, runner.deps.onNotice);
         prepared.sealReadStateSeat?.(ownCommittedTailRef.current);

package/dist/core/runner/run-terminal-adoption.js

@@ -1,4 +1,4 @@
-import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
+import { compactionFailureReason, compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact } from "../auto-compaction.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
 import { appendInterruptionMarker, reconcileInterruptedSession } from "../session-reconcile.js";
 import { emitTrace } from "../trace.js";
@@ -11,7 +11,7 @@ import { compactionRestateOptions } from "./compaction-restate.js";
 import { MAX_CONSECUTIVE_COMPACTION_FAILURES } from "./compaction-knobs.js";
 import { emitSettled, reconciledEnd } from "./tool-end-body.js";
 import { isApprovalWordsFrame } from "./approval-feedback.js";
-import { asThrownError, thrownText } from "../thrown-value.js";
+import { asThrownError } from "../thrown-value.js";
 export async function runTerminalAdoption(input) {
     const { spec, queue, prepared, rs, stats, ident, emitCommitted, startedToolCallIds, toolLabels, timeout, compactionBrain, compactionBreaker, windowSafetyOptions, undrainedUserAtEnd, userInputLostAtEnd, final, abortedLive, userInterruptedLive, callerStop, runner, sessions, next } = input;
     let { threw } = input;
@@ -185,8 +185,7 @@ async function finish(spec, prepared, opts, runner, sessions) {
                 opts?.onCompactionOutcome?.("mooted", "cancelled", opts.passReport.end);
             }
             else {
-                const failMsg = thrownText(err);
-                const failReason = failMsg.length > 512 ? `${failMsg.slice(0, 512)}…` : failMsg;
+                const failReason = compactionFailureReason(err);
                 emitTrace(opts?.telemetry?.tracer ?? spec.tracer ?? runner.deps.tracer, () => ({
                     kind: "compaction.failed",
                     version: 1,

package/dist/core/runner/run-turn-boundary.js

@@ -1,7 +1,7 @@
 import { compactionKindOf } from "../task-notification.js";
 import { mintSystemReminder } from "../reminder-mint.js";
 import { eventDefaultOn } from "../../prompt-assembly/event-registry.js";
-import { compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
+import { compactionFailureReason, compactionPassReport, DEFAULT_COMPACTION_INSTRUCTIONS, isCompactionManualCancel, manualCompactOutcomeOf, maybeCompact, mintCompactedEvent, nextTrimForceBackoff, recordCompactionAndCheckRapidRefill } from "../auto-compaction.js";
 import { emitTrace } from "../trace.js";
 import { redactThenCut } from "../../agents/subagent-steps.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, TOTAL_TOKENS_REMINDER_DEFAULT_MODE, attachmentEnvelopeTags, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, isIntactSource, rebaseCadenceWindows, renderAgentListingFrame, renderMcpDroppedTools, renderMcpInstructionsDelta, selectMcpDroppedBatch, renderSkillsListingFrame, renderToolsDelta } from "./turn-attachments.js";
@@ -18,7 +18,6 @@ import { COMPACTION_FREED_EPSILON, COMPACTION_REGROWTH_FACTOR, MAX_CONSECUTIVE_C
 import { compactionHookOptions, recordCompactionReuse, seamCCompactionOptions } from "./compaction-seams.js";
 import { contextUsageSections } from "../../prompt-assembly/section-usage.js";
 import { asThrownError } from "../thrown-value.js";
-import { egressThrownText } from "../untrusted-egress.js";
 const BATCH_CONTEXT_MIN_KEEP_BYTES = 160;
 const BATCH_TRUNCATION_MARKER = "\n…[truncated]";
 export function createTurnBoundary(input) {
@@ -614,7 +613,7 @@ export function createTurnBoundary(input) {
                     ts: Date.now(),
                 }));
             }
-            manualOutcome = comp.compacted ? "compacted" : comp.blocked ? "blocked" : comp.disabled ? "disabled" : "noop";
+            manualOutcome = manualCompactOutcomeOf(comp);
             if (forceManual && !comp.compacted && !comp.blocked) {
                 if (comp.disabled) {
                     emitTrace(rs.telemetry.tracer, () => ({ kind: "compaction.disabled", version: 1, taskId: rs.telemetry.taskId, ts: Date.now() }));
@@ -671,8 +670,7 @@ export function createTurnBoundary(input) {
             else if (!prepared.abortController.signal.aborted) {
                 compactionBreaker.failures += 1;
                 runnerHooks.onError?.(err, { phase: "compaction", sessionId: prepared.sessionId });
-                const msg = egressThrownText("same-principal", err);
-                const failReason = msg.length > 512 ? `${msg.slice(0, 512)}…` : msg;
+                const failReason = compactionFailureReason(err);
                 emitTrace(rs.telemetry.tracer, () => ({
                     kind: "compaction.failed",
                     version: 1,

package/dist/core/runner/runtask.d.ts

@@ -8,6 +8,7 @@ import type { AgentDefinition, ModelRef, ModelRoles, RunnerDeps, TaskEvent, Task
 import { type ContextSettings, type ContextWindowOverlay } from "../context-settings.js";
 import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
 export type { ResumeTaskConfig } from "./contracts.js";
+import type { CompactSessionRequest, CompactSessionResult } from "../auto-compaction.js";
 import type { RewindFilesRequest, RewindFilesResult } from "../file-history-store.js";
 /**
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
@@ -18,6 +19,10 @@ export declare class Runner implements RunnerSelfSeat {
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */
     private sessionLocks;
+    /** The lock's tail: the session writes this Runner's legs issued that have not settled — a session's next holder starts after them. */
+    private readonly sessionWrites;
+    /** The session-lock seats every out-of-run verb (`rewindFiles`, `compactSession`) is lent — ONE reading of "busy": a leg holds or awaits the lock, or a write issued to the session has not settled. */
+    private readonly verbLockSeats;
     /** Per-session read-file-state seats (CC parity: readFileState is session-scoped;
      *  sema's map stays per-task, so the session scope lives here). A bounded CACHE, never an
      *  authority: a durable resume's checkpoint seed wins on its leg, and a miss (cross-process,
@@ -134,8 +139,10 @@ export declare class Runner implements RunnerSelfSeat {
      *  the same model resolution as tasks, returns real usage/model. No session, no tool execution, no
      *  policy gate, no accounting — caller-trusted. */
     sideQuery(spec: SideQuerySpec): Promise<SideQueryResult>;
-    /** The out-of-run code-only rewind, no model call and no session entry — the contract is {@link rewindSessionFiles}'s (refused while a leg of this Runner holds or awaits the session's lock). */
+    /** The out-of-run code-only rewind, no model call and no session entry — the contract is {@link rewindSessionFiles}'s (refused while a leg of this Runner holds or awaits the session's lock, or a write issued to it has not settled). */
     rewindFiles(request: RewindFilesRequest): Promise<RewindFilesResult>;
+    /** The out-of-run manual compaction, no run and no user turn — the contract is {@link compactIdleSession}'s (the one pass every lane runs; refused while a leg of this Runner holds or awaits the session's lock, or a write issued to it has not settled). */
+    compactSession(request: CompactSessionRequest): Promise<CompactSessionResult>;
     /** Run a task and stream live events; await `.result()` for the final TaskResult. `resume` (internal)
      *  drives a durable resume through the same loop instead of a fresh objective prompt.
      *  `internals` (internal) is a TRUSTED run-scoped channel for live per-task state the