@sema-agent/server 7.136.0 → 7.138.0

package/dist/http/resume-legs.js

@@ -4,12 +4,13 @@ import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, t
 import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
 import { headReadOf } from "../session-incarnation.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 const headUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no head read (headOf; every built-in store has one) — refusing rather than resuming unverified`);
 };
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
-import { parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
 import { buildCancelledLedgerRow, createRunAbort, mintCancelledResult } from "../run-cancel-context.js";
 import { isTerminalRunStatus } from "../plugins/store-contracts.js";
@@ -18,16 +19,17 @@ import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
-import { currentApprovalGateToken } from "../approval-gate-currency.js";
-import { createApprovalCardEmitter, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
+import { currentApprovalGateToken, currentGateFacesOf, sightsCurrentGate } from "../approval-gate-currency.js";
+import { approverFacingArgs, createApprovalCardEmitter, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { serviceVersion } from "../service-version.js";
 import { TERMINAL_PARK_GATE_KINDS } from "../plugins/checkpoint-store-sql.js";
 import { withPrincipal } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
+import { runSkillsOf } from "../capabilities/skills.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
-import { modelTextEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { modelTextEventData, parkEventData, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
@@ -37,17 +39,20 @@ import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../task-settings.js";
-import { acceptedResumingReceipt, acceptedTaskIdOf, buildHostLegOutcome } from "./route-ctx.js";
+import { acceptedResumingReceipt, acceptedTaskIdOf } from "./route-ctx.js";
+import { heldFor } from "../peer-seat.js";
+import { NO_SETTLEMENT_EVIDENCE, buildSettlementEvidence, decisionCommittedOf } from "../gate-settlement.js";
+import { durableRowIdentity } from "../checkpoint-identity.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
 import { createSessionSyncLocal } from "./routes/session-sync.js";
 import { createImagesLocal } from "./routes/images.js";
 import { createCapabilitiesLocal } from "./routes/capabilities.js";
-import { gatedPrincipal, explicitOperatorOk } from "./principal-gate.js";
+import { gatedPrincipal, explicitOperatorOk, runIdentityOf } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
-import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind } from "../approval-content-kind.js";
+import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "./resume-ctx-read.js";
 import { buildCheckpointVersionKeys, resumeBlockedByPolicyAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
@@ -74,11 +79,14 @@ const WORKER_SWAP_REDEEMABLE = {
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    tool_identity_missing: true,
+    bound_input_hash_missing: false,
     requirements_damaged: false,
     read_face_damaged: false,
     read_face_forged: false,
     write_face_damaged: false,
     skill_grants_damaged: false,
+    skill_scopes_damaged: false,
     constraint_chain_missing: false,
     hands_coordinates_damaged: false,
     installation_record_absent: true,
@@ -111,6 +119,7 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "resume.principal_mismatch": "retriable",
     "resume.placement_mismatch": "retriable",
     "resume.preflight_rejected": "retriable",
+    "resume.holder_superseded": "retriable",
     "wake.gate_pending": "retriable",
     "wake.nothing_to_deliver": "retriable",
     "checkpoint.config_refused": "retriable",
@@ -122,9 +131,9 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "checkpoint.gate_mismatch": "terminal",
     "checkpoint.reopen_failed": "terminal",
     "checkpoint.cwd_conflicts_restore": "terminal",
+    "steering.duplicate_input_id": "retriable",
     "checkpoint.already_exists": "terminal",
     "checkpoint.execution_outcome_conflict": "terminal",
-    "steering.duplicate_input_id": "terminal",
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
@@ -156,6 +165,10 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     feedback: "outcome_cell",
+    outcome: "outcome_cell",
+    updatedInput: "outcome_cell",
+    decision: "outcome_cell",
+    reason: "outcome_cell",
     taskConfig: "config",
     deps: "config",
     inheritedGate: "config",
@@ -183,6 +196,26 @@ function decisionRefusalCauseOf(e, gate) {
 function notResumableAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.not_resumable", message: "run is not in a resumable (suspended) state (already resumed, decided, or expired)" }) };
 }
+function approvalStaleAnswer(facts) {
+    return {
+        status: 409,
+        body: refusalBody({
+            errorCode: "approval_stale",
+            message: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
+            facts: {
+                ...(facts.terminal !== undefined ? { terminal: facts.terminal } : {}),
+                ...(facts.currentPending !== undefined ? { currentPending: facts.currentPending } : {}),
+            },
+        }),
+    };
+}
+function acceptableFormFacts(detail) {
+    const rewritten = detail !== null && typeof detail === "object" ? detail.editRewritten : undefined;
+    if (rewritten === null || typeof rewritten !== "object" || !Object.hasOwn(rewritten, "acceptableForm"))
+        return {};
+    const shown = approverFacingArgs(rewritten.acceptableForm);
+    return shown === undefined ? {} : { acceptableForm: shown };
+}
 export function checkpointRefusalAnswer(e, at) {
     const refusalCause = e.code === "checkpoint.invalid_outcome" ? decisionRefusalCauseOf(e, at.gate) : undefined;
     const detail = e.detail;
@@ -198,6 +231,7 @@ export function checkpointRefusalAnswer(e, at) {
                     ? { retryAfterSec: Math.max(1, Math.ceil(detail.retryAfterMs / 1000)) }
                     : {}),
                 ...at.versionKeys,
+                ...(e.code === "resume.constraint_rejected" ? acceptableFormFacts(detail) : {}),
             },
         }),
     }, at.retriable);
@@ -209,7 +243,7 @@ export function createResumeLegs(ctx) {
     async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const token = await currentApprovalGateToken(cs, sessionId);
-        if (binding?.checkpointToken && binding.checkpointToken !== token) {
+        if (binding?.checkpointToken && !sightsCurrentGate({ face: "checkpointToken", value: binding.checkpointToken }, token ? { checkpointToken: token } : null)) {
             let seenUnreadable = false;
             const seen = await cs.get(binding.checkpointToken).catch((e) => {
                 seenUnreadable = true;
@@ -245,17 +279,7 @@ export function createResumeLegs(ctx) {
                     };
                 }
             }
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "approval_stale",
-                    message: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
-                    facts: {
-                        ...(attributable ? { terminal: "resolved" } : {}),
-                        ...(currentPending ? { currentPending } : {}),
-                    },
-                }),
-            };
+            return approvalStaleAnswer({ ...(attributable ? { terminal: "resolved" } : {}), ...(currentPending ? { currentPending } : {}) });
         }
         if (!token) {
             deps.logger?.info?.("approval_decide_no_pending", { sessionId });
@@ -330,16 +354,7 @@ export function createResumeLegs(ctx) {
                     ...(cp.pendingAction.boundInputHash ? { boundInputHash: cp.pendingAction.boundInputHash } : {}),
                 };
             }
-            return {
-                status: 409,
-                body: refusalBody({
-                    errorCode: "approval_stale",
-                    message: "the approval you are deciding is no longer current (already resolved or superseded since you viewed it)",
-                    facts: {
-                        ...(s57CurrentPending ? { currentPending: s57CurrentPending } : {}),
-                    },
-                }),
-            };
+            return approvalStaleAnswer(s57CurrentPending ? { currentPending: s57CurrentPending } : {});
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
         const rememberableTool = paForGrant !== undefined &&
@@ -360,9 +375,7 @@ export function createResumeLegs(ctx) {
             }
             : undefined;
         const noteLateSettleIfAccepted = (out) => {
-            if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
-                return;
-            if (out.body?.errorCode === "cancelled" && out.decisionCommitted !== true)
+            if (lateSettleSink === undefined || lateSettleAnchor === undefined || !decisionCommittedOf(out))
                 return;
             try {
                 lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
@@ -378,6 +391,7 @@ export function createResumeLegs(ctx) {
         if (parkedForkLeaseDenial)
             return parkedForkLeaseDenial;
         const ownerLeaseAdmittedHere = req !== undefined;
+        const captureSelectedGate = () => durableRowIdentity("decision-receipt", cp.checkpointId, token);
         if (req !== undefined) {
             const parkedAgentStore = deps.backgroundAgentStore;
             const parkedSurface = deps.parkedReviveSurface;
@@ -407,7 +421,7 @@ export function createResumeLegs(ctx) {
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
-                }, parkedReq, { handle: origin.handle, row: origin.row }));
+                }, { ...parkedReq, selectedGate: captureSelectedGate() }, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
                 noteLateSettleIfAccepted(parked);
                 return parked;
@@ -435,7 +449,7 @@ export function createResumeLegs(ctx) {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
                     const run = await runStore.getRun(held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId) : undefined;
+                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
                 };
                 const replay = await liveReceiptOf(await decisions.get(token));
                 if (replay !== undefined)
@@ -481,42 +495,48 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const pendingTool = cp.pendingAction.toolName;
-        if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+        try {
+            const { spec, engineNotices } = resolved;
+            const pendingTool = cp.pendingAction.toolName;
+            if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+            }
+            if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+            }
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const pa = cp.pendingAction;
+            const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
+            const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+            const outcome = {
+                gate: "policy_ask",
+                boundCallId: binding?.boundCallId ?? persistedCallId,
+                boundInputHash: binding?.boundInputHash ?? persistedHash,
+                decision: decision === "approve" ? "allow" : "deny",
+                ...(decision === "approve" && !isEngineQuestionRow(pa) && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
+                ...(reason ? { reason } : {}),
+                ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
+                ...(answer !== undefined ? { answer } : {}),
+                hostDecision,
+            };
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const driven = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...captureSelectedGate() }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+            noteLateSettleIfAccepted(driven);
+            return driven;
         }
-        if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+        finally {
+            resolved.peerLease.release();
         }
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const pa = cp.pendingAction;
-        const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
-        const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-        const outcome = {
-            gate: "policy_ask",
-            boundCallId: binding?.boundCallId ?? persistedCallId,
-            boundInputHash: binding?.boundInputHash ?? persistedHash,
-            decision: decision === "approve" ? "allow" : "deny",
-            ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
-            ...(reason ? { reason } : {}),
-            ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
-            ...(answer !== undefined ? { answer } : {}),
-            hostDecision,
-        };
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
-        noteLateSettleIfAccepted(driven);
-        return driven;
     }
     const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments", "images"];
     const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (ctx, req, auth) => {
+    const resolveResumeSpec = async (ctx, req, auth, lease) => {
         const engineNotices = [];
         const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+            lease,
         });
         return { spec, engineNotices };
     };
@@ -528,11 +548,13 @@ export function createResumeLegs(ctx) {
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
+        const lease = deps.peerDesk.lease("resume");
         try {
-            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
-            return { ok: true, spec, engineNotices };
+            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth, lease);
+            return { ok: true, spec, engineNotices, peerLease: lease };
         }
         catch (e) {
+            lease.release();
             if (e instanceof HttpError) {
                 return { ok: false, answer: resumeRefusalWithCard(resumeBlockedByPolicyAnswer(httpErrorRefusal(e)), true) };
             }
@@ -541,11 +563,11 @@ export function createResumeLegs(ctx) {
     };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
-            return await driveResumeLeg(args);
+            return await heldFor(args.peerLease, () => driveResumeLeg(args));
         let settleAccepted;
         let wasAccepted = false;
         const accepted = new Promise((resolve) => { settleAccepted = resolve; });
-        const leg = driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); });
+        const leg = heldFor(args.peerLease, () => driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); }));
         void leg.then((out) => {
             if (wasAccepted && out.status >= 400) {
                 deps.logger?.warn?.("resume_leg_failed_after_accept", { sessionId: args.sessionId, status: out.status, body: out.body });
@@ -599,6 +621,7 @@ export function createResumeLegs(ctx) {
             const freshId = uuidv7();
             const created = await deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
                 source: args.mintFreshRun.source,
+                identity: args.mintFreshRun.identity,
                 objectivePreview: buildRunObjectivePreview(resumeObjective ?? ""),
             });
             if (created.existing) {
@@ -725,6 +748,7 @@ export function createResumeLegs(ctx) {
         let unregisterEngineNotice;
         try {
             const instructionLeg = createInstructionSelectionLeg();
+            const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(taskConfig) });
             result = await instructionLeg.run(sessionId, () => withModelReachScope({ sessionId, taskId }, () => withPrincipal(principal, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
@@ -748,7 +772,7 @@ export function createResumeLegs(ctx) {
                         persistThinking: deps.config.traceThinking,
                         notifiedKeys: resumeNotifiedKeys,
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
-                        instructionsSegment: instructionLeg.segment,
+                        legSections: legWiringSections,
                     });
                     const vAppend = (type, data) => verifySink.append(type, data);
                     cancelLedgerAppend = vAppend;
@@ -820,7 +844,7 @@ export function createResumeLegs(ctx) {
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
                                 const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
-                                await ap(reParkStatus ?? reparkStatus, { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
+                                await ap(reParkStatus ?? reparkStatus, parkEventData({ terminal: vrNested, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}) }, vrReopened ? (failureCodeOf(vr.terminal) ?? null) : undefined));
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -882,6 +906,7 @@ export function createResumeLegs(ctx) {
                 const driveResume = async () => {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
+                    const resumeWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(resumeTaskConfig));
                     const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         ...launchInternals,
                         onForwardEvent: (e) => {
@@ -944,12 +969,14 @@ export function createResumeLegs(ctx) {
                     if (taskId)
                         steerableRuns.set(taskId, stream);
                     if (!taskId || !rs) {
+                        for await (const ev of stream)
+                            await resumeWorkspace.observe(ev);
                         const rNoRow = await stream.result();
                         if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
                             reopenConfirmedPark = true;
                         return sealResultForExit(rNoRow);
                     }
-                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
+                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId, buildSettlementEvidence({ at: "engine_accepted", commitment: args.commitment })));
                     let causeAtDone;
                     for await (const ev of stream) {
                         if (ev.type === "done")
@@ -957,6 +984,7 @@ export function createResumeLegs(ctx) {
                         recordTurnActivity(taskId);
                         fleetPub?.onEvent(ev);
                         await deps.userInputLedger?.observeLegEvent(stream, ev);
+                        await resumeWorkspace.observe(ev);
                         await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
@@ -1017,7 +1045,7 @@ export function createResumeLegs(ctx) {
                                 break;
                             case "wiring_manifest":
                                 await flush();
-                                await append("wiring_manifest", wiringManifestEventData(ev, instructionLeg.segment()));
+                                await append("wiring_manifest", wiringManifestEventData(ev, legWiringSections()));
                                 break;
                             case "tool_roster_delta": {
                                 await flush();
@@ -1074,20 +1102,19 @@ export function createResumeLegs(ctx) {
                     const r = causeAtDone !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: rEngine, cause: causeAtDone }) : rEngine;
                     const rPark = r.terminal.kind === "paused" ? outwardPlane(r.terminal).status : undefined;
                     if (rPark === "suspended") {
-                        const parkCallId = await parkToolCallId(r, deps.checkpointStore);
-                        await append("suspended", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
+                        await append("suspended", parkEventData(await graftParkToolCallId(r, deps.checkpointStore)));
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
                     if (rPark === "needs_review") {
-                        await append("needs_review", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null });
+                        await append("needs_review", parkEventData(r));
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
                     if (await reopenedAfterLeg(r, causeAtDone !== undefined)) {
                         reopenConfirmedPark = true;
                         try {
-                            await append(reparkStatus, { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
+                            await append(reparkStatus, parkEventData(r, failureCodeOf(r.terminal) ?? null));
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
@@ -1215,13 +1242,13 @@ export function createResumeLegs(ctx) {
         settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
-            decisionCommitted: true,
             body: {
                 taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
                 ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
                 ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
+                ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
             },
         };
     }
@@ -1296,10 +1323,16 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     async function startFreshHostTurn(sessionId, objective, principal, req, workflowDecision, runId) {
         const cs = deps.checkpointStore;
@@ -1332,22 +1365,28 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const hostSpec = { ...spec, objective, sessionId };
-        const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), ...(engineNotices.length > 0 ? { engineNotices } : {}) },
-            fleetScope: resumeFleetScope(req, auth),
-            elicitOwner: principal ?? null,
-            source: "workflow_parked_decide",
-            workflowDecision,
-        });
-        if (out.existing) {
-            throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+        try {
+            const { spec, engineNotices } = resolved;
+            const hostSpec = { ...spec, objective, sessionId };
+            const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
+                prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), peerLease: resolved.peerLease, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                fleetScope: resumeFleetScope(req, auth),
+                elicitOwner: principal ?? null,
+                source: "workflow_parked_decide",
+                identity: runIdentityOf(req, deps.config, principal ?? null),
+                workflowDecision,
+            });
+            if (out.existing) {
+                throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+            }
+            if (out.status !== 202)
+                return { status: out.status, body: out.body };
+            const minted = out.body;
+            return acceptedResumingReceipt(minted.taskId, minted.sessionId, NO_SETTLEMENT_EVIDENCE);
+        }
+        finally {
+            resolved.peerLease.release();
         }
-        if (out.status !== 202)
-            return { status: out.status, body: out.body };
-        const minted = out.body;
-        return acceptedResumingReceipt(minted.taskId, minted.sessionId);
     }
     async function resumeWake(sessionId, message, caller, req, acceptEarly, workflowDecision, ownerLeaseAdmittedFor) {
         const cs = deps.checkpointStore;
@@ -1411,28 +1450,35 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        return buildHostLegOutcome(await driveResumeIntoRunLog({
-            runner: runnerFor(spec),
-            token,
-            sessionId: cp.sessionId,
-            principal: auth.principal,
-            fleetScope: resumeFleetScope(req, auth),
-            taskConfig,
-            resumeObjective,
-            outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
-            verifyRounds: undefined,
-            resumeCtx: { sessionId, ctx },
-            mintFreshRun: { source: "wake" },
-            ...(workflowDecision !== undefined ? { workflowDecision } : {}),
-            ...(engineNotices.length > 0 ? { engineNotices } : {}),
-            ...(acceptEarly === true ? { acceptEarly: true } : {}),
-            ...(req !== undefined ? { callerInitiated: true } : {}),
-            ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
-        }));
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            return await driveResumeIntoRunLog({
+                peerLease: resolved.peerLease,
+                runner: runnerFor(spec),
+                token,
+                sessionId: cp.sessionId,
+                principal: auth.principal,
+                fleetScope: resumeFleetScope(req, auth),
+                taskConfig,
+                resumeObjective,
+                outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
+                commitment: { kind: "delivered" },
+                verifyRounds: undefined,
+                resumeCtx: { sessionId, ctx },
+                mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
+                ...(workflowDecision !== undefined ? { workflowDecision } : {}),
+                ...(engineNotices.length > 0 ? { engineNotices } : {}),
+                ...(acceptEarly === true ? { acceptEarly: true } : {}),
+                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
+            });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
-    async function preparePlanReview(sessionId, log, decider) {
+    async function preparePlanReview(sessionId, log, decider, sighting) {
         const cs = deps.checkpointStore;
         const refuse = (answer) => ({ ok: false, answer });
         const log404 = (r) => deps.logger?.info?.("decide_404", {
@@ -1490,6 +1536,13 @@ export function createResumeLegs(ctx) {
                 }),
             });
         }
+        if (sighting !== undefined) {
+            const current = currentGateFacesOf(token, cp);
+            if (!sightsCurrentGate(sighting, current)) {
+                const currentId = decider !== undefined && cp.status === "pending" ? current.checkpointId : undefined;
+                return refuse(approvalStaleAnswer(currentId !== undefined ? { currentPending: { checkpointId: currentId } } : {}));
+            }
+        }
         const ctxRead = await readResumeCtx(cs.getCtx(sessionId), ctxOpening(sessionId));
         if (ctxRead.kind === "corrupt")
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
@@ -1516,18 +1569,24 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const outcome = {
-            gate: "plan_review",
-            decision,
-            ...(editedPlan !== undefined ? { editedPlan } : {}),
-            ...(reason ? { reason } : {}),
-            hostDecision,
-        };
-        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
-        return out;
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const outcome = {
+                gate: "plan_review",
+                decision,
+                ...(editedPlan !== undefined ? { editedPlan } : {}),
+                ...(reason ? { reason } : {}),
+                hostDecision,
+            };
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            return out;
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     const routeCtxBase = {
         deps,