@sema-agent/core 7.6.0 → 7.6.2

package/dist/core/runner/gate-exit.js

@@ -1,5 +1,7 @@
 import { screenGateOutcome, SETTLEMENT_IS_REFUSAL } from "../gate-outcome.js";
-import { engineSettlementOf } from "../tool-policy.js";
+import { decisionText, engineSettlementOf } from "../tool-policy.js";
+import { inlineUntrusted } from "../untrusted-text.js";
+import { formatHookFeedback } from "../reminder-mint.js";
 export function mintGateOutcome(facts) {
     const settlement = facts.settled !== undefined ? Object.freeze({ ...facts.settled.settlement, who: Object.freeze({ ...facts.settled.settlement.who }) }) : undefined;
     const outcome = Object.freeze({
@@ -53,3 +55,70 @@ export function createSettlementLedger(call) {
         },
     };
 }
+export function cloneObserverInput(input) {
+    try {
+        return structuredClone(input);
+    }
+    catch {
+        if (Array.isArray(input))
+            return [...input];
+        if (input !== null && typeof input === "object")
+            return { ...input };
+        return input;
+    }
+}
+export function traceHookCrash(input, err, notifier) {
+    notifier.notify(() => input.onHookError?.(err), "toolGate.onHookError");
+}
+const PARK_FAILURE_CAUSE_MAX = 600;
+function withParkFailureCause(reason, parkFailed) {
+    if (parkFailed === undefined)
+        return reason;
+    return (`${reason} — note: a durable approval park was attempted for this call FIRST and could not be minted ` +
+        `(${inlineUntrusted(parkFailed, PARK_FAILURE_CAUSE_MAX)}), so the refusal above is what the fallback had ` +
+        `left to say, not the reason the call stopped.`);
+}
+export async function engineFailClosedExit(pass, reason) {
+    const { input, toolName, toolCallId, notifyPermissionDenied } = pass;
+    const gate = directDeny("hook");
+    await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+    return { block: true, reason: formatHookFeedback(reason, input.reminderMark), gate, preToolContext: pass.preToolContext };
+}
+export function hookDenyExit(pass, r) {
+    const { input, toolName } = pass;
+    return {
+        block: true,
+        reason: formatHookFeedback(decisionText(r) ?? `tool "${toolName}" blocked by a PreToolUse hook`, input.reminderMark),
+        gate: directDeny("hook"),
+        preToolContext: pass.preToolContext,
+    };
+}
+export async function exitGate(pass) {
+    const { input, event, toolName, toolCallId, ledger, notifyPermissionDenied } = pass;
+    if (pass.decision.action === "deny") {
+        const denyReason = withParkFailureCause(decisionText(pass.decision) ?? `tool "${toolName}" denied by policy`, pass.parkFailed);
+        if (pass.decision.updatedInput !== undefined) {
+            pass.currentInput = pass.decision.updatedInput;
+        }
+        if (pass.deniedBy === undefined)
+            throw new Error(`the tool gate refused "${toolName}" without a refusing layer — every deny site attributes itself`);
+        const gate = mintGateOutcome({ deniedBy: pass.deniedBy, ...(ledger.settled !== undefined ? { settled: ledger.settled } : {}) });
+        await notifyPermissionDenied({ toolName, input: cloneObserverInput(pass.currentInput), toolCallId, reason: denyReason, gate, ...(input.identity !== undefined ? { identity: input.identity } : {}) });
+        return {
+            block: true,
+            reason: formatHookFeedback(denyReason, input.reminderMark),
+            gate,
+            preToolContext: pass.preToolContext,
+        };
+    }
+    if (pass.decision.action === "allow") {
+        const rw = pass.decision.updatedInput !== undefined ? pass.decision.updatedInput : pass.policyRewrite;
+        if (rw !== undefined)
+            pass.currentInput = rw;
+    }
+    return {
+        updatedInput: pass.currentInput === event.input ? undefined : pass.currentInput,
+        gate: mintGateOutcome(ledger.settled !== undefined ? { settled: ledger.settled } : {}),
+        preToolContext: pass.preToolContext,
+    };
+}

package/dist/core/runner/prepare-caps-and-workflow.d.ts

@@ -22,7 +22,6 @@ import type { AgentHarness, AgentTool, ThinkingLevel } from "../../internal/harn
 import type { Model } from "../../internal/llm.js";
 import { forkGovernanceDenial } from "../../agents/subagent.js";
 import type { PromptEpochArtifact } from "../../prompt-assembly/artifact.js";
-import { createRunWorkflowTool } from "../../orchestration/run-workflow-tool.js";
 import { type WorkflowSizeGuideline } from "../../orchestration/workflow-size-guideline.js";
 import { type AutoModeArmingRecipe } from "../auto-mode-arming.js";
 import { type AutoModeDecider, type AutoModeDenialTracker } from "../auto-mode.js";
@@ -33,11 +32,8 @@ import type { OnAsk } from "../tool-policy.js";
 import type { RunnerDeps, RuntimeCaps, TaskEvent, TaskSpec, ToolExecuteContext } from "../types.js";
 import type { AutoModeArmReason } from "../wiring-manifest.js";
 import type { ReadFace } from "../../tools/fs/index.js";
-import type { InheritedGate, Prepared, RunInternals, ToolFaceSnapshot } from "./contracts.js";
+import type { InheritedGate, Prepared, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 import { type BlockedRef } from "./synthetic-tools.js";
-/** The runner the Workflow mount accepts — spelled as the factory's own option type so this phase names no runner
- *  module of its own (the narrow `RunnerSelfSeat` contract is a design decision still open; see the layering registry). */
-type WorkflowMountRunner = Parameters<typeof createRunWorkflowTool>[0]["runner"];
 export interface PrepareCapsAndWorkflowInput {
     /** borrowed-readonly — the REBOUND spec, whole: the roster map reads `tools`; the mounts read `enableBlockedReport`,
      *  `enablePlanMode`, `interactiveTools`, `checkpointStore`; the caps/compliance stations read `principal`, `selfOrchestration`,
@@ -113,7 +109,7 @@ export interface PrepareCapsAndWorkflowInput {
     peerSendMessageBuiltIn: boolean;
     /** borrowed-readonly — the trusted Runner self-reference the Workflow mount executes children through; undefined when
      *  prepareTask runs standalone (then Workflow is simply not mounted). */
-    runnerSelf: WorkflowMountRunner | undefined;
+    runnerSelf: RunnerSelfSeat | undefined;
     /** borrowed-readonly — LATE-BOUND: the memory-engine session; the Workflow mount's capture-floor getter reads it at ITS call time. */
     memoryEngineSession: () => Prepared["memoryEngineSession"];
     /** borrowed-readonly — LATE-BOUND: the adopted center artifact; the Workflow mount's two center getters read it at THEIR call time. */
@@ -167,4 +163,3 @@ export interface PrepareCapsAndWorkflowResult {
 }
 /** The M4 phase body — prepareTask's caps-and-workflow stretch, verbatim (see the module header). */
 export declare function prepareCapsAndWorkflow(input: PrepareCapsAndWorkflowInput): Promise<PrepareCapsAndWorkflowResult>;
-export {};

package/dist/core/runner/prepare-delegation-surface.d.ts

@@ -1,15 +1,11 @@
 import type { AgentTool, ExecutionEnv, WorkspaceState } from "../../internal/harness.js";
-import { createSendMessageTool } from "../../agents/send-message-tool.js";
 import { type PeerLaneRefs } from "../../agents/peer-session-drain.js";
 import type { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { type WorktreeSessionRef } from "../../tools/worktree.js";
 import type { CwdRef } from "../../tools/fs/index.js";
 import { type ToolResultStore } from "../tool-result-store.js";
 import type { RunnerDeps, TaskSpec, ToolEffect, ToolExecuteContext } from "../types.js";
-import type { PrepareResume, RunInternals, ToolFaceSnapshot } from "./contracts.js";
-/** The runner the SendMessage / AgentTranscript mounts accept — spelled as the factory's own option type so this phase
- *  names no runner module of its own (the narrow `RunnerSelfSeat` contract is a design decision still open). */
-type DelegationMountRunner = Parameters<typeof createSendMessageTool>[0]["runner"];
+import type { PrepareResume, RunInternals, RunnerSelfSeat, ToolFaceSnapshot } from "./contracts.js";
 export interface PrepareDelegationSurfaceInput {
     /** borrowed-readonly — the REBOUND spec. Read: `tools` (the shadow checks and the revival spawner's delegation-tool
      *  lookup), `oneShot` (the read/kill faces' completion promises), `retainBackgroundProcesses` (the Monitor receipt),
@@ -36,7 +32,7 @@ export interface PrepareDelegationSurfaceInput {
     executionEnv: ExecutionEnv;
     /** borrowed-readonly — the trusted Runner self-reference the SendMessage / AgentTranscript mounts execute through; undefined
      *  when prepareTask runs standalone (then neither mounts). */
-    runnerSelf: DelegationMountRunner | undefined;
+    runnerSelf: RunnerSelfSeat | undefined;
     /** borrowed-readonly — the background/workflow door's first half: the hands mount decided a real shell with write hands. */
     backgroundTaskToolsActive: boolean;
     /** borrowed-readonly — the door's second half: the Workflow tool is on the roster. */
@@ -101,4 +97,3 @@ export interface PrepareDelegationSurfaceResult {
 }
 /** The M6 phase body — prepareTask's delegation-surface stretch, verbatim (see the module header). */
 export declare function prepareDelegationSurface(input: PrepareDelegationSurfaceInput): PrepareDelegationSurfaceResult;
-export {};

package/dist/core/runner/prepare-run-refs.d.ts

@@ -86,4 +86,16 @@ export interface PrepareRunRefsResult {
     worktreeIsolation: SubagentWorktreeIsolation | undefined;
 }
 /** The M3a phase body — prepareTask's run-refs stretch, verbatim (see the module header). */
+/**
+ * A run that opted into `forwardSubagentEvents` may have BACKGROUND children whose frames are forwarded to the
+ * deployment's sink from the child's own run. Those forwards are scheduled on later microtasks than the parent's
+ * turn, so "the parent stream ended" and "the child's already-emitted frames reached the sink" are two different
+ * moments — the gap is one microtask ladder deep and moves whenever the gate's station structure changes (design/393
+ * / #594: the three-layer gate added three async frames to a child's gated call, and a consumer that read the parent
+ * to `done` then inspected the sink lost the child's `tool_end`). The rule is not a tick count: **before the parent
+ * says `done`, every frame a child had already handed to the forward channel is delivered.** One macrotask turn is
+ * the smallest boundary that strictly orders after all pending microtasks; it is taken only on the opted-in run,
+ * only once, right before `done`.
+ */
+export declare function drainForwardedFramesBeforeDone(spec: Pick<TaskSpec, "forwardSubagentEvents">): Promise<void>;
 export declare function prepareRunRefs(input: PrepareRunRefsInput): PrepareRunRefsResult;

package/dist/core/runner/prepare-run-refs.js

@@ -2,6 +2,11 @@ import { createSubagentWorktreeHelper } from "../../agents/subagent.js";
 import { SubagentRetainLedger } from "../../agents/retain-ledger.js";
 import { ActiveSkillScope } from "./active-skill-scope.js";
 import { createEditedFilesLedger } from "./edited-files-ledger.js";
+export async function drainForwardedFramesBeforeDone(spec) {
+    if (spec.forwardSubagentEvents !== true)
+        return;
+    await new Promise((resolve) => setImmediate(resolve));
+}
 export function prepareRunRefs(input) {
     const { spec, internals, executionEnv, taskRootFinal } = input;
     const { note: noteFileEdited, snapshot: editedFilesSnapshot } = createEditedFilesLedger();

package/dist/core/runner/prepare-task.d.ts

@@ -7,7 +7,7 @@ export { DEFAULT_IRREVERSIBLE_SCOPE, checkpointScopeOf, placementValueOrAbsent }
 export { mcpManifestEntries } from "./prepare-wiring-manifest.js";
 export { __resetMaterializeEnvAnnouncements } from "./prepare-tool-disclosure-mount.js";
 export { fileHistoryFilesystemIdentity, resolveFileHistoryScope } from "./prepare-file-history.js";
-import type { Runner } from "./runtask.js";
+import type { RunnerSelfSeat } from "./contracts.js";
 import type { Prepared, PrepareResume, RunInternals } from "./contracts.js";
 export type { FileHistoryBoundarySeat, InheritedGate, Prepared, PreparedMicroCompact, PrepareResume, ResolvedWorkspace, RunInternals, UsageGovernance } from "./contracts.js";
 import type { ExecutionEnv } from "../../internal/harness.js";
@@ -107,7 +107,7 @@ export declare function prepareTask(spec: TaskSpec, deps: RunnerDeps, sessions:
 /** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
  *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
  *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */
-runnerSelf?: Runner, 
+runnerSelf?: RunnerSelfSeat, 
 /** #499 — carrier for the id minted below, so a prepare that THROWS still lets its caller name the
  *  run (prepare emits run-scoped notices of its own; each needs a terminal that names it). Same seat
  *  shape the Runner uses for the generated taskId/sessionId. */

package/dist/core/runner/runtask.d.ts

@@ -1,6 +1,5 @@
 import { type Model } from "../../internal/llm.js";
-import { type Checkpoint, type CheckpointToken, type PendingSteerEntry, type ReopenReason, type ResumeOutcome } from "../checkpoint-store.js";
-import type { RunInternals } from "./prepare-task.js";
+import { type CheckpointToken, type ResumeOutcome } from "../checkpoint-store.js";
 import { type TaskOutcome } from "../task-outcome.js";
 import { type SideQuerySpec, type SideQueryResult } from "../side-query.js";
 import type { SessionStore } from "../session.js";
@@ -8,74 +7,8 @@ import { type RecoveredOrphan } from "../session-reconcile.js";
 import type { GateOutcome } from "../gate-outcome.js";
 import { type McpDelivered } from "../mcp-failure.js";
 import type { AgentDefinition, ModelRef, RunnerDeps, TaskEvent, TaskResult, TaskSpec, TaskStream } from "../types.js";
-/**
- * Config re-supplied to {@link Runner.resume} (design/45). A suspended task's tools / model / policy /
- * hooks cannot be reconstructed from a checkpoint token (the session stores neither tool implementations
- * nor the hand band), so the caller's trusted control plane re-supplies the same {@link TaskSpec} it ran
- * with — minus the conversation bits: `sessionId` comes from the checkpoint and `objective` is replaced by
- * an internally-generated continuation, so both are omitted.
- */
-export type ResumeTaskConfig = Omit<TaskSpec, "objective" | "sessionId">;
-/** design/45 resume plan threaded from {@link Runner.resume} into the shared run loop. */
-interface ResumeRun {
-    cp: Checkpoint;
-    /**
-     * RB-152 (2026-07-25, 按面收口): did the APPROVED ACTION actually begin executing?
-     *
-     * The reopen compensation used to key on an error-code whitelist (`resume.env_failed` /
-     * `resume.session_not_found` / `resume.tool_unavailable`). That is a proxy for the thing that actually
-     * matters, and every time a NEW way to exit without running the action appeared, the whitelist did not
-     * know about it: a caller's abort landing anywhere between the CAS and `tool.execute` — across
-     * `SessionStore.acquire` (pluggable, cross-network on a durable backend), the MCP reconnect, the env
-     * rebuild, `resumeVM`, tool materialization — produced a `failed` result with NO errorCode, no reopen,
-     * and a human approval consumed for work that never happened. Two rounds of fixes (RB-77, RB-109) each
-     * moved that window rather than closing it, because both extended the whitelist.
-     *
-     * This binds the compensation to the FACT instead: set the instant before `tool.execute` for the gated
-     * call (the same `onExecuteStart` signal the orphan-reconcile split already trusts). Every terminal —
-     * throw OR returned result — asks one question: was the checkpoint consumed while this stayed false?
-     */
-    pendingActionStarted?: boolean;
-    /** Validated against `cp.gate.kind` at the resume entry: human/irreversible_ask→`policy_ask`,
-     *  resource_limit→`resource_limit` (design/74), needs_review→`dry_run_review` (design/76 §2.5),
-     *  plan_review→`plan_review` (design/80 D-B). The gate-match guard in `resumeStream` enforces the
-     *  correlation. design/144 §3: `wake` is the NON-GATE arm — only a checkpoint awaiting NO gate
-     *  decision passes the resume entry with it (gate purity, `wake.gate_pending`); the run loop skips
-     *  `applyResumeDecision` for it (no pending action to resolve) and re-enters via the continuation +
-     *  pendingSteer tail alone. */
-    outcome: Extract<ResumeOutcome, {
-        gate: "policy_ask" | "resource_limit" | "dry_run_review" | "plan_review" | "wake";
-    }>;
-    /** design/144 §3 (X5) — the wake's own operator message, validated (`validatePendingSteer`) at the
-     *  resume entry and carried SEPARATELY from the checkpoint's parked `pendingSteer`: a message-bearing
-     *  wake of a checkpoint that ALSO holds a parked steer must deliver BOTH (park order: parked first,
-     *  wake message second), each under its own trusted framing — the old merge-into-the-slot shape
-     *  silently DISPLACED the parked (undelivered) supervisor steer. Wake outcomes only. */
-    wakeMessage?: Omit<PendingSteerEntry, "seq">;
-    /** design/373 §4.3 (D2) — the userPromptSubmit screen's `additionalContext` for {@link wakeMessage},
-     *  captured at the resume ENTRY (the message is screened once, pre-CAS, on the resuming process's
-     *  hook) and delivered by the drain as the engine's own reminder AHEAD of the wake frame — carrying
-     *  it forward is what keeps the hook single-run (re-screening at the drain would be the double-run
-     *  §4.3-3 reserves for the cross-process parked leg). Present only when a wake message passed a
-     *  screen that supplied context. */
-    wakeMessageHookContext?: string;
-    /** Compensation hook (design/45/49): called iff the resumed run fails with `resume.env_failed` (post-CAS
-     *  workspace `resumeVM` failed) OR `resume.tool_unavailable` (P-7: the approved tool vanished) — in both
-     *  the CAS already consumed the checkpoint but the pending action never ran. `resumeStream` supplies a
-     *  closure that reopens the checkpoint (`resolved → pending`) so a retry re-resumes the SAME suspended work
-     *  instead of losing it to a forced "re-initiate". design/80 D-1 (reopen-by-reason): the `reason` is
-     *  recorded on the reopened row so the next re-resume validates per reason — an `env_failed` reopen must
-     *  replay the persisted winner (a system retry of the approved action), while a `tool_unavailable` reopen
-     *  lets a human re-decide with the tool present (a fresh decision is allowed — preserves P-7). */
-    onEnvRestoreFailed?: (reason: ReopenReason) => Promise<void>;
-    /** RB-471/FR-C1 — set in the run body right after `applyResumeDecision` completes: the negative-
-     *  decision twin of `pendingActionStarted`. A reject/deny consumes its gate BY BEING DELIVERED, and
-     *  this bit is the delivery fact — every throw-arm cause (prepare failure, `session_not_found`, a
-     *  pre-delivery abort) and the walltime-exhausted settle fire BEFORE it is set, so an undelivered
-     *  negative decision still reopens as `env_failed` (the retry replays the persisted decision; it
-     *  never re-asks — design/80 D-1), closing the RB-152/RB-70 loss class the first RB-471 cut reopened. */
-    decisionDelivered?: boolean;
-}
+import type { ResumeRun, ResumeTaskConfig, RunInternals, RunnerSelfSeat } from "./contracts.js";
+export type { ResumeTaskConfig } from "./contracts.js";
 /** The `tool_end` body fields projected from a harness tool result — output/truncated/totalChars via
  *  {@link toolOutputFrom} and the CC card via {@link structuredFrom}. Single construction point for BOTH
  *  the live loop's frames and the resumed batch's frames (`resolvePendingCall` + the deferred-sibling
@@ -145,7 +78,7 @@ export declare function raceUntilDeadline<T>(p: Promise<T>, deadline: number): P
  * A stateless task runner. Holds shared deps (the external brain, model catalog) and an
  * in-memory session store so that passing a `sessionId` continues a prior conversation.
  */
-export declare class Runner {
+export declare class Runner implements RunnerSelfSeat {
     private deps;
     readonly sessions: SessionStore;
     /** Per-sessionId serialization so two tasks never mutate one session concurrently. */

package/dist/core/runner/runtask.js

@@ -6,7 +6,7 @@ import { deliverDelegationLifecycle, deliverEngineNotice, undrainedUserInputNoti
 import { planRejectionClears, resolveTriggerWindow } from "../context-edit.js";
 import { AgentHarness, DEFAULT_COMPACTION_SETTINGS, isSyntheticApiErrorMessage, uuidv7 } from "../../internal/harness.js";
 import { snapshotActorAssertion } from "../../internal/llm.js";
-import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, realApprovalOrgFact } from "../checkpoint-store.js";
+import { CheckpointError, BINDING_CHECKPOINT_VERSION, checkpointVersionOf, F012_CHECKPOINT_VERSION, MAX_SUPPORTED_CHECKPOINT_VERSION, REAL_APPROVAL_CHECKPOINT_VERSION, FACE_CHECKPOINT_VERSION, remainingBudgetMicroUsd, readPendingSteerQueue, remainingTokens, resolveCheckpointStore, LEGACY_PENDING_STEER_INPUT_ID, MAX_STEER_INPUT_ID_CHARS, validatePendingSteer, winnerFromOutcome, realApprovalOrgFact } from "../checkpoint-store.js";
 import { GIT_STATUS_ECHO_PREVIEW, branchCarriesVisiblePositiveGitFrame, newestEngineGitFrame, stripGitStatusUnits } from "./git-status-frame.js";
 import { gitFrameContextVisible, normalizeGitAnnouncement } from "../../internal/harness.js";
 import { engineVersion } from "../version.js";
@@ -38,7 +38,10 @@ import { assembleResult, errorCodeOf } from "./assemble-result.js";
 import { amendTerminal, terminalProjection } from "./terminal-projection.js";
 import { ATTACHMENT_BYTE_CAP, CHANGED_FILES_MAX, TOTAL_TOKENS_REMINDER_DEFAULT_MODE, AGENT_LISTING_REMOVED_HEADER, SKILLS_LISTING_DELTA_HEADER, SKILLS_LISTING_REMOVED_HEADER, advanceCadenceClock, agentListingDeltaHeader, attachmentEnvelopeTags, agentListingInitialHeader, replayAnnouncedListing, replayAnnouncedModels, clipToBytes, collectDateChange, collectDueAttachments, collectInstructionsChange, commitAgentListing, commitInstructionsChange, commitSkillsListing, createAttachmentState, rebaseCadenceWindows, reduceToolEnd, renderAgentListingDelta, renderMcpDroppedTools, renderMcpInstructionsDelta, renderOrphanedBackgroundTasks, selectMcpDroppedBatch, renderSkillsListingDelta, renderToolsDelta, stampWriteAnchor } from "./turn-attachments.js";
 import { buildWorkingFileAttachments, centerAdoptionOption, contextInstructionFilesOption, emitInputTruncated, forkContextOption } from "./compaction-call-options.js";
-import { effectiveDelegationFacts, gatedCallIdOf, placementValueOrAbsent, prepareTask, resolveCheckpointStore } from "./prepare-task.js";
+import { effectiveDelegationFacts, prepareTask } from "./prepare-task.js";
+import { drainForwardedFramesBeforeDone } from "./prepare-run-refs.js";
+import { gatedCallIdOf } from "./park-commit.js";
+import { placementValueOrAbsent } from "./checkpoint-scope.js";
 import { SessionReadFileStates } from "./prepare-hands-readface.js";
 import { settleTeardownLeg } from "./teardown-bounded.js";
 import { TOOL_SEARCH_NAME } from "./tool-disclosure.js";
@@ -1480,6 +1483,11 @@ function makeHarnessHandlers(prepared, stats, rs, deps) {
     };
     return { onMessageUpdate, onMessageEnd, onToolStart, onToolEnd, onTurnEnd, announceWorkspaceMove };
 }
+const REFUSED_DECIDE_KEYS = [
+    ["gateOutcome", "the settlement record is minted by core from the host's decision facts and the row's origin, never supplied"],
+    ["settledBy", 'a retired key — the host supplies decision FACTS as hostDecision{decidedBy: "person" | "sla_timeout", approver?} and core mints the settlement word from them'],
+    ["approver", "a retired key — the attribution rides the facts it belongs to, as hostDecision.approver"],
+];
 export class Runner {
     deps;
     sessions;
@@ -1830,6 +1838,7 @@ export class Runner {
                     onError: (f) => console.warn(`[sema-core] ${f.site}: delegation-lifecycle observer threw (contained; further failures counted, not re-disclosed): ${f.error.message}`),
                 }), "runtask.onDelegationLifecycle");
             }
+            await drainForwardedFramesBeforeDone(spec);
             queue.push({ type: "done", result: resultValue });
             queue.close();
         });
@@ -4269,6 +4278,7 @@ export class Runner {
                 drainManualCompact("mooted");
             }
             manualCompactRef.emitMooted = undefined;
+            await drainForwardedFramesBeforeDone(spec);
             queue.push({ type: "done", result });
             queue.close();
             await prepared.fileHistoryBoundary?.settle();
@@ -4599,6 +4609,11 @@ export class Runner {
             if (decision !== "allow" && decision !== "deny") {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume decision "${describeSuppliedValue(decision)}" is outside the policy_ask domain — a decide is exactly "allow" or "deny"; refusing pre-CAS, the checkpoint stays pending`);
             }
+            for (const [key, why] of REFUSED_DECIDE_KEYS) {
+                if (Reflect.get(decide, key) !== undefined) {
+                    throw new CheckpointError("checkpoint.invalid_outcome", `resume carries \`${key}\` — ${why}; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
+                }
+            }
             const hostDecisionRaw = decide.hostDecision;
             if (typeof hostDecisionRaw !== "object" || hostDecisionRaw === null) {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume carries no hostDecision — a policy_ask decide names who decided it ({ decidedBy: "person" | "sla_timeout", approver? }); refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
@@ -4610,9 +4625,6 @@ export class Runner {
             if (decidedBy === "sla_timeout" && decision === "allow") {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume carries decision "allow" decided by "sla_timeout" — an elapsed SLA window cannot be what approved an action that EXECUTES; refusing pre-CAS, the checkpoint stays pending`, { field: "hostDecision" });
             }
-            if (decide.gateOutcome !== undefined) {
-                throw new CheckpointError("checkpoint.invalid_outcome", "resume carries a gateOutcome — the settlement record is minted by core from the host's decision facts and the row's origin, never supplied; refusing pre-CAS, the checkpoint stays pending", { field: "hostDecision" });
-            }
             const attribution = screenApproverAttribution(hostDecisionRaw.approver);
             if (attribution.defect !== undefined) {
                 throw new CheckpointError("checkpoint.invalid_outcome", `resume carries an approver attribution this engine refuses: ${attribution.defect}; refusing pre-CAS, the checkpoint stays pending`, { field: "approver" });
@@ -4974,7 +4986,7 @@ export class Runner {
         if (plainPolicyOutcome !== undefined) {
             const parkedOrigin = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction.origin : undefined;
             if (!isAskOrigin(parkedOrigin)) {
-                throw new CheckpointError("checkpoint.unsupported_version", "this checkpoint's pending approval carries no origin word (a row minted before the ask's origin was persisted on the park) — its settlement cannot be recorded; the checkpoint stays pending");
+                throw new CheckpointError("checkpoint.unsupported_version", "this checkpoint's pending approval carries no origin word (a row minted before the ask's origin was persisted on the park) — its settlement cannot be recorded; the checkpoint stays pending", { reason: "origin_missing" });
             }
             const facts = plainPolicyOutcome.hostDecision;
             const approverCell = facts.approver !== undefined ? { approver: facts.approver } : {};