@sema-agent/server 7.136.0 → 7.138.0

package/dist/http/routes/tasks.js

@@ -1,5 +1,6 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal.js";
 import { runWithVerification, runCascade, taskNotificationDedupKey, uuidv7 } from "@sema-agent/core";
+import { heldFor } from "../../peer-seat.js";
 import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, syncRefusalHttpStatus, zeroWorkRefusalFacts, releaseKeyIfZeroWorkRefusal, createPromptCommitReader, HEARTBEAT_MS } from "../../runs.js";
 import { sealResultForExit, outwardPlane } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
@@ -25,7 +26,7 @@ import { approvalPreambleReplays, createApprovalCardEmitter, declaredApprovalFra
 import { buildActiveRunConflict, isActiveRunConflictBody, toDoneFrameResult } from "../active-run-conflict.js";
 import { commitPlacement, devicePlacementErrorBody } from "../device-placement.js";
 import { commitSessionInheritEnv } from "../session-inherit-env.js";
-import { headerStr, gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+import { headerStr, gatedPrincipal, explicitOperatorOk, runIdentityOf } from "../principal-gate.js";
 import { failOpenTagForDroppedFrame, recordFailOpen } from "../../observability/fail-open.js";
 import { buildSyncSubmitBody } from "../sync-submit-body.js";
 import { assertNever } from "../route-ctx.js";
@@ -33,10 +34,12 @@ import * as facts from "../../capability-facts.js";
 import { persistSubmitCtx } from "../submit-ctx.js";
 import { serviceVersion } from "../../service-version.js";
 import { withModelReachScope } from "../../model-reach-scope.js";
+import { runSkillsOf } from "../../capabilities/skills.js";
 import { createInstructionSelectionLeg } from "../../instruction-selection.js";
 import { fieldConflictFacts } from "../../field-conflict.js";
 import { refusalBody } from "../refusal-body.js";
 import { heldWorkflowParkDecisions } from "../../parked-decide.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../../session-workspace.js";
 const DISCONNECT_PARK_GRACE_MS = 10_000;
 function sseData(res, payload) {
     const anchor = payload.eventId;
@@ -150,665 +153,616 @@ export async function handleTasks(req, res, match, ctx) {
         const prepared = await prepareSpec(req, res, keyedBody, undefined, { liveStream });
         if (!prepared)
             return;
-        const declaredFamilies = declaredApprovalFrameFamilies(prepared.body.settings);
-        const approvalLegInput = (streamApprovalOn) => {
-            const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
-            return {
-                streamApprovalOn,
-                windowMs: deps.config.streamApproval?.windowMs,
-                windowMarginMs: deps.config.streamAskWindowMarginMs,
-                ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
-                declaredFamilies,
+        try {
+            const declaredFamilies = declaredApprovalFrameFamilies(prepared.body.settings);
+            const approvalLegInput = (streamApprovalOn) => {
+                const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
+                return {
+                    streamApprovalOn,
+                    windowMs: deps.config.streamApproval?.windowMs,
+                    windowMarginMs: deps.config.streamAskWindowMarginMs,
+                    ...(legWalltimeMs !== undefined ? { legWalltimeMs } : {}),
+                    declaredFamilies,
+                };
             };
-        };
-        const assembleApprovalLeg = (streamApprovalOn) => resolveApprovalLeg({ ...approvalLegInput(streamApprovalOn), nowMonotonicMs: performance.now() });
-        const principal = prepared.auth?.principal;
-        const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
-        let wiringReceipt;
-        const instructionLeg = createInstructionSelectionLeg();
-        const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
-        if (liveStream) {
-            if (prepared.verify || prepared.cascade) {
-                sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs", fieldConflictFacts("cascade_verify", prepared.verify ? (prepared.cascade ? ["verify", "cascade"] : ["verify"]) : ["cascade"]));
-                return;
-            }
-            const earlyDurableTid = facts.durableRuns(deps).available && prepared.spec.sessionId ? uuidv7() : undefined;
-            const streamLegStartedAt = Date.now();
-            const detachOnDisconnect = headerStr(req.headers["x-detach-on-disconnect"]) === "true";
-            if (detachOnDisconnect && earlyDurableTid === undefined) {
-                sendError(res, 400, "request.precondition_unmet", "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable");
-                return;
-            }
-            reqState.streamTaskId = earlyDurableTid;
-            let usageKey;
-            reqState.streamDetached = detachOnDisconnect;
-            sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
-            if (earlyDurableTid)
-                writeMetaFrame(res, earlyDurableTid, prepared.spec.sessionId, prepared.warnings);
-            const ac = createRunAbort();
-            let closed = false;
-            let detachLogged = false;
-            let disconnectParkGrace;
-            const onDisconnect = () => {
-                if (detachOnDisconnect) {
-                    if (res.writableEnded)
-                        return;
-                    if (!detachLogged) {
-                        detachLogged = true;
-                        res.on("error", () => undefined);
-                        deps.logger?.info("stream_client_detached", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, detached: true });
-                    }
+            const assembleApprovalLeg = (streamApprovalOn) => resolveApprovalLeg({ ...approvalLegInput(streamApprovalOn), nowMonotonicMs: performance.now() });
+            const principal = prepared.auth?.principal;
+            const wiringOperatorFace = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
+            let wiringReceipt;
+            const instructionLeg = createInstructionSelectionLeg();
+            const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: runSkillsOf(prepared.spec) });
+            const withRunReceipt = (out) => wiringReceipt !== undefined ? { ...out, wiringManifest: wiringReceipt } : out;
+            if (liveStream) {
+                if (prepared.verify || prepared.cascade) {
+                    sendError(res, 400, "request.field_conflict", "verify / cascade are not supported on /v1/tasks/stream (both are multi-attempt, not a single stream) — use /v1/tasks or /v1/runs", fieldConflictFacts("cascade_verify", prepared.verify ? (prepared.cascade ? ["verify", "cascade"] : ["verify"]) : ["cascade"]));
+                    return;
+                }
+                const earlyDurableTid = facts.durableRuns(deps).available && prepared.spec.sessionId ? uuidv7() : undefined;
+                const streamLegStartedAt = Date.now();
+                const detachOnDisconnect = headerStr(req.headers["x-detach-on-disconnect"]) === "true";
+                if (detachOnDisconnect && earlyDurableTid === undefined) {
+                    sendError(res, 400, "request.precondition_unmet", "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable");
                     return;
                 }
-                if (deps.checkpointStore && earlyDurableTid && disconnectParkGrace === undefined) {
-                    const parked = deps.toolApproval?.parkOpenAsksForTask(earlyDurableTid) ?? 0;
-                    if (parked > 0) {
-                        res.on("error", () => undefined);
-                        deps.logger?.info("stream_disconnect_ask_parked", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, asks: parked, graceMs: DISCONNECT_PARK_GRACE_MS });
-                        disconnectParkGrace = setTimeout(() => {
-                            closed = true;
-                            ac.abort("ask_park_grace_exhausted");
-                        }, DISCONNECT_PARK_GRACE_MS);
-                        disconnectParkGrace.unref?.();
+                reqState.streamTaskId = earlyDurableTid;
+                let usageKey;
+                reqState.streamDetached = detachOnDisconnect;
+                sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
+                if (earlyDurableTid)
+                    writeMetaFrame(res, earlyDurableTid, prepared.spec.sessionId, prepared.warnings);
+                const ac = createRunAbort();
+                let closed = false;
+                let detachLogged = false;
+                let disconnectParkGrace;
+                const onDisconnect = () => {
+                    if (detachOnDisconnect) {
+                        if (res.writableEnded)
+                            return;
+                        if (!detachLogged) {
+                            detachLogged = true;
+                            res.on("error", () => undefined);
+                            deps.logger?.info("stream_client_detached", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, detached: true });
+                        }
                         return;
                     }
-                }
-                closed = true;
-                ac.abort("client_disconnected");
-            };
-            req.on("close", onDisconnect);
-            res.on("close", () => {
-                if (!res.writableEnded)
+                    if (deps.checkpointStore && earlyDurableTid && disconnectParkGrace === undefined) {
+                        const parked = deps.toolApproval?.parkOpenAsksForTask(earlyDurableTid) ?? 0;
+                        if (parked > 0) {
+                            res.on("error", () => undefined);
+                            deps.logger?.info("stream_disconnect_ask_parked", { taskId: earlyDurableTid, sessionId: prepared.spec.sessionId, asks: parked, graceMs: DISCONNECT_PARK_GRACE_MS });
+                            disconnectParkGrace = setTimeout(() => {
+                                closed = true;
+                                ac.abort("ask_park_grace_exhausted");
+                            }, DISCONNECT_PARK_GRACE_MS);
+                            disconnectParkGrace.unref?.();
+                            return;
+                        }
+                    }
+                    closed = true;
+                    ac.abort("client_disconnected");
+                };
+                req.on("close", onDisconnect);
+                res.on("close", () => {
+                    if (!res.writableEnded)
+                        onDisconnect();
+                });
+                if ((res.destroyed || res.closed) && !res.writableEnded)
                     onDisconnect();
-            });
-            if ((res.destroyed || res.closed) && !res.writableEnded)
-                onDisconnect();
-            const replayGate = resolveStreamApprovalGate({
-                toolApprovalEnabled: Boolean(deps.toolApproval),
-                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
-                backend: deps.backend,
-                checkpointStore: deps.checkpointStore,
-            });
-            const replaySessionId = approvalPreambleReplays(approvalLegInput(replayGate.active)) ? prepared.spec.sessionId : undefined;
-            const presentedOnConnection = new Set();
-            const presentedCompleted = new Set();
-            const admitPresentedComplete = (askId) => {
-                if (!presentedOnConnection.has(askId))
+                const replayGate = resolveStreamApprovalGate({
+                    toolApprovalEnabled: Boolean(deps.toolApproval),
+                    streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                    backend: deps.backend,
+                    checkpointStore: deps.checkpointStore,
+                });
+                const replaySessionId = approvalPreambleReplays(approvalLegInput(replayGate.active)) ? prepared.spec.sessionId : undefined;
+                const presentedOnConnection = new Set();
+                const presentedCompleted = new Set();
+                const admitPresentedComplete = (askId) => {
+                    if (!presentedOnConnection.has(askId))
+                        return true;
+                    if (presentedCompleted.has(askId))
+                        return false;
+                    presentedCompleted.add(askId);
                     return true;
-                if (presentedCompleted.has(askId))
-                    return false;
-                presentedCompleted.add(askId);
-                return true;
-            };
-            if (replaySessionId) {
-                const replayOwner = gatedPrincipal(req, deps.config) ?? null;
-                const askStore = replayGate.active ? replayGate.askStore : undefined;
-                let presentedAskIds = [];
-                const preambleFrames = await collectSsePreamble(async (signal) => {
-                    if (!askStore)
-                        return [];
-                    const rows = await askStore.listPendingBySession(replaySessionId, replayOwner, signal);
-                    const { frames, skipped, dropped } = buildApprovalPreamble(rows, Date.now(), deps.config.streamApproval.replayMax);
-                    presentedAskIds = frames.map((f) => f.askId);
-                    if (skipped > 0)
-                        deps.logger?.warn?.("approval_preamble_row_skipped", { sessionId: replaySessionId, skipped, face: "tasks.stream" });
-                    if (dropped > 0)
-                        deps.logger?.warn?.("approval_preamble_capped", { sessionId: replaySessionId, dropped, replayMax: deps.config.streamApproval.replayMax, face: "tasks.stream" });
-                    return buildApprovalPreambleSseFrames(frames);
-                }, (reason, err) => deps.logger?.warn?.("approval_preamble_failed", { sessionId: replaySessionId, reason, face: "tasks.stream", error: err instanceof Error ? err.message : String(err ?? "") }));
-                if (!res.writableEnded && !res.destroyed) {
-                    for (const f of preambleFrames)
-                        res.write(`event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
-                    if (deps.toolApproval && preambleFrames.length > 0) {
-                        for (const askId of presentedAskIds)
-                            presentedOnConnection.add(askId);
-                        const unwatch = deps.toolApproval.watchPresentedCards(presentedAskIds, (frame) => {
-                            if (res.writableEnded || res.destroyed || !admitPresentedComplete(frame.askId))
-                                return;
-                            res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
-                        });
-                        res.once("close", unwatch);
+                };
+                if (replaySessionId) {
+                    const replayOwner = gatedPrincipal(req, deps.config) ?? null;
+                    const askStore = replayGate.active ? replayGate.askStore : undefined;
+                    let presentedAskIds = [];
+                    const preambleFrames = await collectSsePreamble(async (signal) => {
+                        if (!askStore)
+                            return [];
+                        const rows = await askStore.listPendingBySession(replaySessionId, replayOwner, signal);
+                        const { frames, skipped, dropped } = buildApprovalPreamble(rows, Date.now(), deps.config.streamApproval.replayMax);
+                        presentedAskIds = frames.map((f) => f.askId);
+                        if (skipped > 0)
+                            deps.logger?.warn?.("approval_preamble_row_skipped", { sessionId: replaySessionId, skipped, face: "tasks.stream" });
+                        if (dropped > 0)
+                            deps.logger?.warn?.("approval_preamble_capped", { sessionId: replaySessionId, dropped, replayMax: deps.config.streamApproval.replayMax, face: "tasks.stream" });
+                        return buildApprovalPreambleSseFrames(frames);
+                    }, (reason, err) => deps.logger?.warn?.("approval_preamble_failed", { sessionId: replaySessionId, reason, face: "tasks.stream", error: err instanceof Error ? err.message : String(err ?? "") }));
+                    if (!res.writableEnded && !res.destroyed) {
+                        for (const f of preambleFrames)
+                            res.write(`event: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
+                        if (deps.toolApproval && preambleFrames.length > 0) {
+                            for (const askId of presentedAskIds)
+                                presentedOnConnection.add(askId);
+                            const unwatch = deps.toolApproval.watchPresentedCards(presentedAskIds, (frame) => {
+                                if (res.writableEnded || res.destroyed || !admitPresentedComplete(frame.askId))
+                                    return;
+                                res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
+                            });
+                            res.once("close", unwatch);
+                        }
                     }
                 }
-            }
-            const hb = setInterval(() => {
-                if (!res.writableEnded && !res.destroyed)
-                    res.write(`event: heartbeat\ndata: {}\n\n`);
-            }, 15_000);
-            hb.unref?.();
-            let ranLive = false;
-            let resp;
-            const runStreamSubmitLeg = async () => {
-                ranLive = true;
-                let finalResult;
-                let runRowSettled = false;
-                let durableTaskId;
-                let durableHeartbeat;
-                const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: errorMessage, cause });
-                let userMsgEntryId;
-                const promptCommit = createPromptCommitReader();
-                let anchorPut = false;
-                const putRewindAnchor = () => {
-                    if (anchorPut || !userMsgEntryId || !durableTaskId || !prepared.spec.sessionId || !deps.resumeAnchorStore)
-                        return;
-                    anchorPut = true;
-                    void deps.resumeAnchorStore
-                        .put(prepared.spec.sessionId, durableTaskId, userMsgEntryId, principal ?? null)
-                        .catch(() => deps.metrics?.inc("resume_anchor_capture_failed"));
-                };
-                if (deps.runStore && prepared.spec.sessionId) {
-                    const tid = earlyDurableTid ?? uuidv7();
-                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), idem: idem ?? null });
-                    if (created.ok)
-                        clearTurnActivity(tid);
-                    if (created.ok)
-                        recordResourceWindow(tid, prepared.spec.resourceSuspend);
-                    if (created.existing) {
-                        const replay = await replayOfExistingRun(created.existing, { principal: submitter, idem }, "sync", deps, deps.runStore);
-                        sseData(res, { type: "done", result: doneResultOfOutcome(replay), replay: true });
-                        return replay;
+                const hb = setInterval(() => {
+                    if (!res.writableEnded && !res.destroyed)
+                        res.write(`event: heartbeat\ndata: {}\n\n`);
+                }, 15_000);
+                hb.unref?.();
+                let ranLive = false;
+                let resp;
+                const runStreamSubmitLeg = async () => {
+                    ranLive = true;
+                    let finalResult;
+                    let runRowSettled = false;
+                    let durableTaskId;
+                    let durableHeartbeat;
+                    const cancelledResult = (errorMessage, cause) => mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: errorMessage, cause });
+                    let userMsgEntryId;
+                    const promptCommit = createPromptCommitReader();
+                    let anchorPut = false;
+                    const putRewindAnchor = () => {
+                        if (anchorPut || !userMsgEntryId || !durableTaskId || !prepared.spec.sessionId || !deps.resumeAnchorStore)
+                            return;
+                        anchorPut = true;
+                        void deps.resumeAnchorStore
+                            .put(prepared.spec.sessionId, durableTaskId, userMsgEntryId, principal ?? null)
+                            .catch(() => deps.metrics?.inc("resume_anchor_capture_failed"));
+                    };
+                    if (deps.runStore && prepared.spec.sessionId) {
+                        const tid = earlyDurableTid ?? uuidv7();
+                        const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
+                        if (created.ok)
+                            clearTurnActivity(tid);
+                        if (created.ok)
+                            recordResourceWindow(tid, prepared.spec.resourceSuspend);
+                        if (created.existing) {
+                            const replay = await replayOfExistingRun(created.existing, { principal: submitter, idem }, "sync", deps, deps.runStore);
+                            sseData(res, { type: "done", result: doneResultOfOutcome(replay), replay: true });
+                            return replay;
+                        }
+                        if (!created.ok) {
+                            const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId);
+                            const refused = { status: 409, body: conflict };
+                            sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
+                            return refused;
+                        }
+                        const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
+                        if (placementReject) {
+                            const body = devicePlacementErrorBody(placementReject);
+                            const refused = { status: placementReject.status, body };
+                            sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
+                            return refused;
+                        }
+                        durableTaskId = tid;
                     }
-                    if (!created.ok) {
-                        const conflict = await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId);
-                        const refused = { status: 409, body: conflict };
-                        sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
-                        return refused;
+                    if (deps.checkpointStore && prepared.spec.sessionId) {
+                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        if (ctxRefusal) {
+                            sseData(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
+                            return ctxRefusal;
+                        }
                     }
-                    const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
-                    if (placementReject) {
-                        const body = devicePlacementErrorBody(placementReject);
-                        const refused = { status: placementReject.status, body };
-                        sseData(res, { type: "done", result: doneResultOfOutcome(refused) });
-                        return refused;
+                    commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
+                    if (prepared.spec.sessionId)
+                        markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
+                    let ledgerSink;
+                    let ledgerTerminal = false;
+                    if (durableTaskId && deps.runStore) {
+                        const rs = deps.runStore;
+                        const tid = durableTaskId;
+                        ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), legSections: legWiringSections });
+                        usageKey = tid;
+                        deps.modelUsage?.register(tid);
+                        const owner = principal ?? null;
+                        const abortFromVerb = () => ac.abort("cancel_verb");
+                        durableHeartbeat = setInterval(() => {
+                            void rs.heartbeat(tid, owner).catch(() => undefined);
+                            if (!ac.signal.aborted) {
+                                void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
+                                    abortFromVerb(); }).catch(() => undefined);
+                            }
+                        }, HEARTBEAT_MS);
+                        durableHeartbeat.unref?.();
+                        inflightRuns.set(tid, ac);
+                        void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !ac.signal.aborted)
+                            abortFromVerb(); }).catch(() => undefined);
                     }
-                    durableTaskId = tid;
-                }
-                if (deps.checkpointStore && prepared.spec.sessionId) {
-                    const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
-                    if (ctxRefusal) {
-                        sseData(res, { type: "done", result: doneResultOfOutcome(ctxRefusal) });
-                        return ctxRefusal;
+                    let fleetPub;
+                    try {
+                        fleetPub = durableTaskId
+                            ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) })
+                            : undefined;
                     }
-                }
-                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
-                if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(ac.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
-                let ledgerSink;
-                let ledgerTerminal = false;
-                if (durableTaskId && deps.runStore) {
-                    const rs = deps.runStore;
-                    const tid = durableTaskId;
-                    ledgerSink = createLedgerSink({ appendEvent: (seq, type, data) => rs.appendEvent(tid, seq, type, data), persistThinking: deps.config.traceThinking, onActivity: (kind, statusData) => recordTurnActivity(tid, kind, statusData), instructionsSegment: instructionLeg.segment });
-                    usageKey = tid;
-                    deps.modelUsage?.register(tid);
-                    const owner = principal ?? null;
-                    const abortFromVerb = () => ac.abort("cancel_verb");
-                    durableHeartbeat = setInterval(() => {
-                        void rs.heartbeat(tid, owner).catch(() => undefined);
-                        if (!ac.signal.aborted) {
-                            void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
-                                abortFromVerb(); }).catch(() => undefined);
-                        }
-                    }, HEARTBEAT_MS);
-                    durableHeartbeat.unref?.();
-                    inflightRuns.set(tid, ac);
-                    void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !ac.signal.aborted)
-                        abortFromVerb(); }).catch(() => undefined);
-                }
-                let fleetPub;
-                try {
-                    fleetPub = durableTaskId
-                        ? fleetRunPublisher(deps.fleetBus, { runId: durableTaskId, scope: gatedPrincipal(req, deps.config) ?? "default", rootTaskId: durableTaskId, sessionId: prepared.spec.sessionId, ...fleetRunLabels(prepared.spec.objective) })
-                        : undefined;
-                }
-                catch (e) {
-                    if (durableHeartbeat)
-                        clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
-                        inflightRuns.delete(durableTaskId);
-                    throw e;
-                }
-                let fleetSettled = false;
-                const settleFleet = (status, residuals) => {
-                    if (fleetSettled)
-                        return;
-                    fleetSettled = true;
-                    fleetPub?.onTerminal(status, residuals);
-                };
-                let liveStreamRef;
-                const subagentHandleEvictions = [];
-                let syncLegLive = true;
-                const syncNotifiedKeys = new NotifiedKeys();
-                try {
-                    fleetPub?.onStart();
-                }
-                catch (e) {
-                    if (durableHeartbeat)
-                        clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
-                        inflightRuns.delete(durableTaskId);
-                    settleFleet("failed");
-                    throw e;
-                }
-                const noticeLedger = ledgerSink;
-                const unregisterEngineNotice = registerEngineNoticeLeg({
-                    sessionId: prepared.spec.sessionId,
-                    ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
-                    live: (row) => {
-                        if (res.writableEnded || res.destroyed) {
-                            recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
+                    catch (e) {
+                        if (durableHeartbeat)
+                            clearInterval(durableHeartbeat);
+                        if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
+                            inflightRuns.delete(durableTaskId);
+                        throw e;
+                    }
+                    let fleetSettled = false;
+                    const settleFleet = (status, residuals) => {
+                        if (fleetSettled)
                             return;
-                        }
-                        sseData(res, { type: "engine_notice", ...row });
-                    },
-                    ...(noticeLedger
-                        ? {
-                            durable: (row) => noticeLedger.append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`), false)),
-                        }
-                        : {}),
-                });
-                if (deps.userInputLedger && durableTaskId && prepared.spec.sessionId)
-                    await deps.userInputLedger.announceUndrained({ sessionId: prepared.spec.sessionId, taskId: durableTaskId });
-                try {
-                    const streamBody = async () => {
-                        await withPrincipal(principal, async () => {
-                            const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
-                            const childReasoning = createReasoningSegments();
-                            const topReasoning = createReasoningSegments();
-                            const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
-                            const fwdInternals = {
-                                ...heldDecisions,
-                                onForwardEvent: (e) => {
-                                    fleetPub?.onForwardEvent(e);
-                                    ledgerSink?.onForwardEvent(e);
-                                    {
-                                        const bg = e.bgAgentId;
-                                        if (bg !== undefined)
-                                            defaultSubagentTailBus.onForwardFrame(bg, tailContentMode, e);
-                                    }
-                                    if (res.writableEnded)
-                                        return;
-                                    for (const end of childReasoning.onEvent(e))
+                        fleetSettled = true;
+                        fleetPub?.onTerminal(status, residuals);
+                    };
+                    let liveStreamRef;
+                    const subagentHandleEvictions = [];
+                    let syncLegLive = true;
+                    const syncNotifiedKeys = new NotifiedKeys();
+                    try {
+                        fleetPub?.onStart();
+                    }
+                    catch (e) {
+                        if (durableHeartbeat)
+                            clearInterval(durableHeartbeat);
+                        if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
+                            inflightRuns.delete(durableTaskId);
+                        settleFleet("failed");
+                        throw e;
+                    }
+                    const noticeLedger = ledgerSink;
+                    const unregisterEngineNotice = registerEngineNoticeLeg({
+                        sessionId: prepared.spec.sessionId,
+                        ...(prepared.engineNotices !== undefined ? { pending: prepared.engineNotices } : {}),
+                        live: (row) => {
+                            if (res.writableEnded || res.destroyed) {
+                                recordFailOpen(failOpenTagForDroppedFrame("engine_notice"), "frame=engine_notice");
+                                return;
+                            }
+                            sseData(res, { type: "engine_notice", ...row });
+                        },
+                        ...(noticeLedger
+                            ? {
+                                durable: (row) => noticeLedger.append("engine_notice", row).then(() => true, () => (recordFailOpen("server.engine-notice.durable-append-failed", `leg=sync code=${row.code} task=${durableTaskId ?? ""}`), false)),
+                            }
+                            : {}),
+                    });
+                    if (deps.userInputLedger && durableTaskId && prepared.spec.sessionId)
+                        await deps.userInputLedger.announceUndrained({ sessionId: prepared.spec.sessionId, taskId: durableTaskId });
+                    try {
+                        const streamBody = async () => {
+                            await withPrincipal(principal, async () => {
+                                const tailContentMode = prepared.spec.forwardSubagentEvents === true ? "on" : "progress_only";
+                                const childReasoning = createReasoningSegments();
+                                const topReasoning = createReasoningSegments();
+                                const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
+                                const fwdInternals = {
+                                    ...heldDecisions,
+                                    onForwardEvent: (e) => {
+                                        fleetPub?.onForwardEvent(e);
+                                        ledgerSink?.onForwardEvent(e);
+                                        {
+                                            const bg = e.bgAgentId;
+                                            if (bg !== undefined)
+                                                defaultSubagentTailBus.onForwardFrame(bg, tailContentMode, e);
+                                        }
+                                        if (res.writableEnded)
+                                            return;
+                                        for (const end of childReasoning.onEvent(e))
+                                            sseData(res, end);
+                                        const t = e.type;
+                                        if (t === "task_progress") {
+                                            sseData(res, { type: "task_progress", ...taskProgressEventData(e) });
+                                        }
+                                        else if (t === "task_started") {
+                                            sseData(res, { type: "task_started", ...taskStartedEventData(e) });
+                                        }
+                                        else if (t === "tool_start") {
+                                            const tsv = e;
+                                            sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
+                                        }
+                                        else if (t === "tool_end") {
+                                            const te = e;
+                                            sseData(res, { type: "tool_end", ...toolEndEventData(te) });
+                                        }
+                                        else if (t === "text_delta") {
+                                            const td = e;
+                                            sseData(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
+                                        }
+                                        else if (t === "text_end") {
+                                            const tend = textEndEventData(e);
+                                            if (tend !== null)
+                                                sseData(res, { type: "text_end", ...tend });
+                                        }
+                                        else if (t === "reasoning_delta") {
+                                            const rd = e;
+                                            sseData(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
+                                        }
+                                    },
+                                    onTaskNotification: (n, opts) => {
+                                        if (n.task_type === "workflow")
+                                            return;
+                                        if (!res.writableEnded)
+                                            for (const end of childReasoning.cut(reasoningStreamOfTask(n.task_id, n.sessionId)))
+                                                sseData(res, end);
+                                        defaultSubagentTailBus.forgetHandle(n.task_id);
+                                        if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
+                                            defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
+                                        }
+                                        const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
+                                        const deliverable = syncLegLive && !res.writableEnded && !res.destroyed;
+                                        const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
+                                        deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
+                                        if (parked) {
+                                            void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                        }
+                                        else if (deliverable) {
+                                            const key = taskNotificationDedupKey(n);
+                                            if (syncNotifiedKeys.get(key) === undefined) {
+                                                syncNotifiedKeys.set(key, Promise.resolve(true));
+                                                sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
+                                            }
+                                        }
+                                    },
+                                    ...(deps.subagentSteerRegistry && durableTaskId
+                                        ? {
+                                            onSubagentSpawn: (handle) => {
+                                                subagentHandleEvictions.push(deps.subagentSteerRegistry.register(durableTaskId, handle));
+                                            },
+                                        }
+                                        : {}),
+                                };
+                                const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }, undefined, fwdInternals);
+                                liveStreamRef = liveStream;
+                                void heldFor(prepared.peerLease, () => Promise.allSettled([Promise.resolve().then(() => liveStream.result())]));
+                                if (durableTaskId)
+                                    steerableRuns.set(durableTaskId, liveStream);
+                                prepared.acceptance.attachStream({ reachable: () => !closed && !res.writableEnded && !res.destroyed, write: (frame) => sseData(res, { ...frame }) });
+                                const liveWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(prepared.spec));
+                                for await (const ev of liveStream) {
+                                    if (closed)
+                                        break;
+                                    for (const end of ev.type === "done" ? [...childReasoning.cut(), ...topReasoning.cut()] : topReasoning.onEvent(ev))
                                         sseData(res, end);
-                                    const t = e.type;
-                                    if (t === "task_progress") {
-                                        sseData(res, { type: "task_progress", ...taskProgressEventData(e) });
+                                    const promptEntryId = promptCommit(ev);
+                                    if (promptEntryId !== undefined)
+                                        userMsgEntryId = promptEntryId;
+                                    const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
+                                    await deps.userInputLedger?.observeLegEvent(liveStream, ev);
+                                    prepared.acceptance.observe(ev);
+                                    await liveWorkspace.observe(ev);
+                                    if (ev.type === "done") {
+                                        finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
+                                        if (durableTaskId && finalResult)
+                                            finalResult = { ...finalResult, taskId: durableTaskId };
+                                        if (causeAtDone !== undefined && finalResult !== undefined) {
+                                            finalResult = mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: "cancelled by user", cause: causeAtDone, engineResult: finalResult });
+                                        }
+                                        finalizeTaskResult(ev.result, principal, prepared.spec.objective);
+                                        noteRunOutcome(finalResult);
+                                        putRewindAnchor();
+                                        settleFleet(outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult));
+                                        if (ledgerSink && finalResult) {
+                                            if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
+                                                const rs2 = deps.runStore;
+                                                const tid2 = durableTaskId;
+                                                const fr = finalResult;
+                                                finalResult = await attachModelUsage(fr, { append: ledgerSink.append, getEvents: (_id, after) => rs2.getEvents(tid2, after), modelUsage: deps.modelUsage, taskId: usageKey }).catch(() => fr);
+                                            }
+                                            await ledgerSink.onDone(finalResult);
+                                            ledgerTerminal = true;
+                                        }
+                                        sseData(res, { ...ev, result: finalResult });
+                                        continue;
                                     }
-                                    else if (t === "task_started") {
-                                        sseData(res, { type: "task_started", ...taskStartedEventData(e) });
+                                    if (ledgerSink) {
+                                        await ledgerSink.onEvent(ev);
+                                        if (ev.type === "turn_end" && usageKey)
+                                            await appendModelUsageDelta(ledgerSink.append, deps.modelUsage, usageKey);
                                     }
-                                    else if (t === "tool_start") {
-                                        const tsv = e;
-                                        sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
+                                    fleetPub?.onEvent(ev);
+                                    if (ev.type === "status")
+                                        deps.metrics?.inc("brain_retry_total", { phase: String(ev.phase) });
+                                    if (ev.type === "status") {
+                                        sseData(res, { type: "status", ...brainStatusEventData(ev) });
                                     }
-                                    else if (t === "tool_end") {
-                                        const te = e;
+                                    else if (ev.type === "tool_end") {
+                                        const te = ev;
                                         sseData(res, { type: "tool_end", ...toolEndEventData(te) });
                                     }
-                                    else if (t === "text_delta") {
-                                        const td = e;
-                                        sseData(res, { type: "text_delta", delta: td.delta, ...(td.eventId ? { eventId: td.eventId } : {}), ...(td.parentToolCallId ? { parentToolCallId: td.parentToolCallId } : {}) });
+                                    else if (ev.type === "tool_start") {
+                                        const tsv = ev;
+                                        sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
                                     }
-                                    else if (t === "text_end") {
-                                        const tend = textEndEventData(e);
-                                        if (tend !== null)
-                                            sseData(res, { type: "text_end", ...tend });
+                                    else if (ev.type === "task_notification") {
+                                        const tnv = ev.notification;
+                                        const tnvKey = taskNotificationStreamKeyOf(tnv);
+                                        const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
+                                        if (tnvPrior === undefined || !(await tnvPrior)) {
+                                            if (tnvKey !== undefined)
+                                                syncNotifiedKeys.set(tnvKey, Promise.resolve(true));
+                                            sseData(res, { type: "task_notification", ...taskNotificationEventData(ev) });
+                                        }
                                     }
-                                    else if (t === "reasoning_delta") {
-                                        const rd = e;
-                                        sseData(res, { type: "reasoning_delta", delta: redactSecrets(rd.delta), ...(rd.eventId ? { eventId: rd.eventId } : {}), ...(rd.parentToolCallId ? { parentToolCallId: rd.parentToolCallId } : {}) });
+                                    else if (ev.type === "reasoning_delta" && typeof ev.delta === "string") {
+                                        sseData(res, { type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) });
                                     }
-                                },
-                                onTaskNotification: (n, opts) => {
-                                    if (n.task_type === "workflow")
-                                        return;
-                                    if (!res.writableEnded)
-                                        for (const end of childReasoning.cut(reasoningStreamOfTask(n.task_id, n.sessionId)))
-                                            sseData(res, end);
-                                    defaultSubagentTailBus.forgetHandle(n.task_id);
-                                    if (defaultSubagentTailBus.hasSubscribers(n.task_id)) {
-                                        defaultSubagentTailBus.publish(n.task_id, { type: "task_settled", taskId: n.task_id, status: n.status, ...(typeof n.seq === "number" ? { seq: n.seq } : {}), ...(n.summary ? { summary: redactSecrets(n.summary) } : {}) });
+                                    else if (ev.type === "task_progress") {
+                                        sseData(res, { type: "task_progress", ...taskProgressEventData(ev) });
                                     }
-                                    const hadRow = isFleetAgentTerminalNotification(n) ? (fleetPub?.onChildTerminal(n.sessionId ?? n.task_id, n.status, n.task_id, n.toolUseId) ?? false) : false;
-                                    const deliverable = syncLegLive && !res.writableEnded && !res.destroyed;
-                                    const parked = !deliverable && Boolean(deps.workflowCompletionInbox && prepared.spec.sessionId);
-                                    deps.logger?.info?.("task_notification_observed", { route: "sync-stream", taskId: n.task_id, taskType: n.task_type, status: n.status, hadFleetRow: hadRow, legLive: syncLegLive, parkedDurable: parked });
-                                    if (parked) {
-                                        void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(prepared.spec.sessionId, askOwner, n, Date.now(), durableTaskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "sync-stream", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                    else if (ev.type === "task_started") {
+                                        sseData(res, { type: "task_started", ...taskStartedEventData(ev) });
                                     }
-                                    else if (deliverable) {
-                                        const key = taskNotificationDedupKey(n);
-                                        if (syncNotifiedKeys.get(key) === undefined) {
-                                            syncNotifiedKeys.set(key, Promise.resolve(true));
-                                            sseData(res, { type: "task_notification", ...taskNotificationEventData({ notification: n, ...(opts?.priority !== undefined ? { priority: opts.priority } : {}) }) });
-                                        }
+                                    else if (ev.type === "compacted") {
+                                        sseData(res, { type: "compacted", ...compactedEventData(ev) });
                                     }
-                                },
-                                ...(deps.subagentSteerRegistry && durableTaskId
-                                    ? {
-                                        onSubagentSpawn: (handle) => {
-                                            subagentHandleEvictions.push(deps.subagentSteerRegistry.register(durableTaskId, handle));
-                                        },
+                                    else if (ev.type === "diagnostics") {
+                                        sseData(res, { type: "diagnostics", ...diagnosticsEventData(ev) });
                                     }
-                                    : {}),
-                            };
-                            const liveStream = prepared.runner.runTaskStream({ ...prepared.spec, signal: ac.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) }, undefined, fwdInternals);
-                            liveStreamRef = liveStream;
-                            if (durableTaskId)
-                                steerableRuns.set(durableTaskId, liveStream);
-                            prepared.acceptance.attachStream({ reachable: () => !closed && !res.writableEnded && !res.destroyed, write: (frame) => sseData(res, { ...frame }) });
-                            for await (const ev of liveStream) {
-                                if (closed)
-                                    break;
-                                for (const end of ev.type === "done" ? [...childReasoning.cut(), ...topReasoning.cut()] : topReasoning.onEvent(ev))
-                                    sseData(res, end);
-                                const promptEntryId = promptCommit(ev);
-                                if (promptEntryId !== undefined)
-                                    userMsgEntryId = promptEntryId;
-                                const causeAtDone = ev.type === "done" ? ac.cause() : undefined;
-                                await deps.userInputLedger?.observeLegEvent(liveStream, ev);
-                                prepared.acceptance.observe(ev);
-                                if (ev.type === "done") {
-                                    finalResult = await mintSubmitExitResult(ev.result, deps.checkpointStore);
-                                    if (durableTaskId && finalResult)
-                                        finalResult = { ...finalResult, taskId: durableTaskId };
-                                    if (causeAtDone !== undefined && finalResult !== undefined) {
-                                        finalResult = mintCancelledResult({ taskId: durableTaskId ?? "", sessionId: prepared.spec.sessionId ?? "", startedAtMs: streamLegStartedAt, message: "cancelled by user", cause: causeAtDone, engineResult: finalResult });
+                                    else if (ev.type === "steering_injected") {
+                                        sseData(res, { type: "steering_injected", ...steeringInjectedEventData(ev) });
                                     }
-                                    finalizeTaskResult(ev.result, principal, prepared.spec.objective);
-                                    noteRunOutcome(finalResult);
-                                    putRewindAnchor();
-                                    settleFleet(outwardPlane(finalResult.terminal).status, fleetRunResiduals(finalResult));
-                                    if (ledgerSink && finalResult) {
-                                        if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
-                                            const rs2 = deps.runStore;
-                                            const tid2 = durableTaskId;
-                                            const fr = finalResult;
-                                            finalResult = await attachModelUsage(fr, { append: ledgerSink.append, getEvents: (_id, after) => rs2.getEvents(tid2, after), modelUsage: deps.modelUsage, taskId: usageKey }).catch(() => fr);
-                                        }
-                                        await ledgerSink.onDone(finalResult);
-                                        ledgerTerminal = true;
+                                    else if (ev.type === "workspace_changed") {
+                                        sseData(res, { type: "workspace_changed", ...workspaceChangedEventData(ev) });
                                     }
-                                    sseData(res, { ...ev, result: finalResult });
-                                    continue;
-                                }
-                                if (ledgerSink) {
-                                    await ledgerSink.onEvent(ev);
-                                    if (ev.type === "turn_end" && usageKey)
-                                        await appendModelUsageDelta(ledgerSink.append, deps.modelUsage, usageKey);
-                                }
-                                fleetPub?.onEvent(ev);
-                                if (ev.type === "status")
-                                    deps.metrics?.inc("brain_retry_total", { phase: String(ev.phase) });
-                                if (ev.type === "status") {
-                                    sseData(res, { type: "status", ...brainStatusEventData(ev) });
-                                }
-                                else if (ev.type === "tool_end") {
-                                    const te = ev;
-                                    sseData(res, { type: "tool_end", ...toolEndEventData(te) });
-                                }
-                                else if (ev.type === "tool_start") {
-                                    const tsv = ev;
-                                    sseData(res, { type: "tool_start", ...toolStartEventData(tsv) });
-                                }
-                                else if (ev.type === "task_notification") {
-                                    const tnv = ev.notification;
-                                    const tnvKey = taskNotificationStreamKeyOf(tnv);
-                                    const tnvPrior = tnvKey !== undefined ? syncNotifiedKeys.get(tnvKey) : undefined;
-                                    if (tnvPrior === undefined || !(await tnvPrior)) {
-                                        if (tnvKey !== undefined)
-                                            syncNotifiedKeys.set(tnvKey, Promise.resolve(true));
-                                        sseData(res, { type: "task_notification", ...taskNotificationEventData(ev) });
+                                    else if (ev.type === "compaction_outcome") {
+                                        sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
+                                    }
+                                    else if (ev.type === "compaction_started") {
+                                        sseData(res, { type: "compaction_started", ...compactionStartedEventData(ev) });
+                                    }
+                                    else if (ev.type === "wiring_manifest") {
+                                        const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, legWiringSections());
+                                        wiringReceipt ??= wiringFace;
+                                        sseData(res, { type: "wiring_manifest", ...wiringFace });
+                                    }
+                                    else if (ev.type === "tool_roster_delta") {
+                                        const rosterDelta = toolRosterDeltaEventData(ev);
+                                        if (rosterDelta !== undefined)
+                                            sseData(res, { type: "tool_roster_delta", ...rosterDelta });
+                                    }
+                                    else if (ev.type === "tool_progress") {
+                                        const progress = toolProgressEventData(ev);
+                                        if (progress !== undefined)
+                                            sseData(res, { type: "tool_progress", ...progress });
+                                    }
+                                    else if (ev.type === "tool_disclosure") {
+                                        const disclosure = toolDisclosureEventData(ev);
+                                        if (disclosure !== undefined)
+                                            sseData(res, { type: "tool_disclosure", ...disclosure });
+                                    }
+                                    else if (ev.type === "human_input") {
+                                        sseData(res, { type: "human_input", ...humanInputEventData(ev) });
+                                    }
+                                    else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
+                                        const e = ev;
+                                        const ident = liveIdentityFields(e);
+                                        const textEnd = ev.type === "text_end" ? textEndEventData(e) : undefined;
+                                        const arm = ev.type === "text_delta"
+                                            ? { type: "text_delta", delta: e.delta, ...ident }
+                                            : ev.type === "text_end"
+                                                ?
+                                                    textEnd === null || textEnd === undefined ? null : { type: "text_end", ...textEnd }
+                                                : ev.type === "turn_end"
+                                                    ? { type: "turn_end", ...turnEndEventData(ev), ...ident }
+                                                    : ev.type === "message_committed"
+                                                        ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
+                                                        : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
+                                        if (arm !== null)
+                                            sseData(res, arm);
+                                    }
+                                    else {
+                                        sseData(res, { ...ev });
                                     }
                                 }
-                                else if (ev.type === "reasoning_delta" && typeof ev.delta === "string") {
-                                    sseData(res, { type: "reasoning_delta", delta: redactSecrets(ev.delta), ...(ev.eventId ? { eventId: ev.eventId } : {}), ...(ev.parentToolCallId ? { parentToolCallId: ev.parentToolCallId } : {}) });
-                                }
-                                else if (ev.type === "task_progress") {
-                                    sseData(res, { type: "task_progress", ...taskProgressEventData(ev) });
-                                }
-                                else if (ev.type === "task_started") {
-                                    sseData(res, { type: "task_started", ...taskStartedEventData(ev) });
-                                }
-                                else if (ev.type === "compacted") {
-                                    sseData(res, { type: "compacted", ...compactedEventData(ev) });
-                                }
-                                else if (ev.type === "diagnostics") {
-                                    sseData(res, { type: "diagnostics", ...diagnosticsEventData(ev) });
-                                }
-                                else if (ev.type === "steering_injected") {
-                                    sseData(res, { type: "steering_injected", ...steeringInjectedEventData(ev) });
-                                }
-                                else if (ev.type === "workspace_changed") {
-                                    sseData(res, { type: "workspace_changed", ...workspaceChangedEventData(ev) });
-                                }
-                                else if (ev.type === "compaction_outcome") {
-                                    sseData(res, { type: "compaction_outcome", ...compactionOutcomeEventData(ev) });
-                                }
-                                else if (ev.type === "compaction_started") {
-                                    sseData(res, { type: "compaction_started", ...compactionStartedEventData(ev) });
-                                }
-                                else if (ev.type === "wiring_manifest") {
-                                    const wiringFace = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
-                                    wiringReceipt ??= wiringFace;
-                                    sseData(res, { type: "wiring_manifest", ...wiringFace });
-                                }
-                                else if (ev.type === "tool_roster_delta") {
-                                    const rosterDelta = toolRosterDeltaEventData(ev);
-                                    if (rosterDelta !== undefined)
-                                        sseData(res, { type: "tool_roster_delta", ...rosterDelta });
-                                }
-                                else if (ev.type === "tool_progress") {
-                                    const progress = toolProgressEventData(ev);
-                                    if (progress !== undefined)
-                                        sseData(res, { type: "tool_progress", ...progress });
-                                }
-                                else if (ev.type === "tool_disclosure") {
-                                    const disclosure = toolDisclosureEventData(ev);
-                                    if (disclosure !== undefined)
-                                        sseData(res, { type: "tool_disclosure", ...disclosure });
-                                }
-                                else if (ev.type === "human_input") {
-                                    sseData(res, { type: "human_input", ...humanInputEventData(ev) });
-                                }
-                                else if (ev.type === "text_delta" || ev.type === "text_end" || ev.type === "turn_end" || ev.type === "message_committed" || ev.type === "context_usage") {
-                                    const e = ev;
-                                    const ident = liveIdentityFields(e);
-                                    const textEnd = ev.type === "text_end" ? textEndEventData(e) : undefined;
-                                    const arm = ev.type === "text_delta"
-                                        ? { type: "text_delta", delta: e.delta, ...ident }
-                                        : ev.type === "text_end"
-                                            ?
-                                                textEnd === null || textEnd === undefined ? null : { type: "text_end", ...textEnd }
-                                            : ev.type === "turn_end"
-                                                ? { type: "turn_end", ...turnEndEventData(ev), ...ident }
-                                                : ev.type === "message_committed"
-                                                    ? { type: "message_committed", entryId: e.entryId, role: e.role, ...(e.toolCallId !== undefined ? { toolCallId: e.toolCallId } : {}), ...ident }
-                                                    : { type: "context_usage", ...contextUsageEventData(ev), ...ident };
-                                    if (arm !== null)
-                                        sseData(res, arm);
-                                }
-                                else {
-                                    sseData(res, { ...ev });
-                                }
-                            }
-                        });
-                    };
-                    const askTaskId = durableTaskId ?? uuidv7();
-                    const askOwner = gatedPrincipal(req, deps.config) ?? null;
-                    const emitAsk = (frame) => {
-                        if (res.writableEnded || res.destroyed) {
-                            recordFailOpen(failOpenTagForDroppedFrame(frame.type), `frame=${frame.type}`);
-                            return;
-                        }
-                        res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
-                    };
-                    const faceAlive = () => !res.writableEnded && !res.destroyed;
-                    const emitElicitation = createLedgerTwinEmit({ sink: ledgerSink, writeLive: emitAsk, liveReachable: faceAlive });
-                    const writeQuestionLive = (frame) => {
-                        if (!faceAlive())
-                            throw new Error("live stream ended — question frame undeliverable");
-                        emitAsk(frame);
-                    };
-                    const emitQuestion = createLedgerTwinEmit({ sink: ledgerSink, writeLive: writeQuestionLive, liveReachable: faceAlive });
-                    await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, prepared.spec.sessionId, askOwner, (frame) => {
-                        if (closed || res.writableEnded || res.destroyed)
-                            throw new Error("stream ended before the completion frame was written");
-                        const f = frame;
-                        const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
-                        if (fKey !== undefined)
-                            syncNotifiedKeys.set(fKey, Promise.resolve(true));
-                        sseData(res, frame);
-                    }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
-                    const withElicit = deps.elicitation
-                        ? () => deps.elicitation.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitElicitation, abortSignal: ac.signal }, streamBody)
-                        : streamBody;
-                    const withQuestion = () => deps.question
-                        ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitQuestion, abortSignal: ac.signal, deliverable: faceAlive }, withElicit)
-                        : withElicit();
-                    const emitApproval = (frame) => {
-                        if (res.writableEnded || res.destroyed)
-                            throw new Error("live stream ended — approval card undeliverable");
-                        emitAsk(frame);
-                    };
-                    const streamApprovalOn = resolveStreamApprovalGate({
-                        toolApprovalEnabled: Boolean(deps.toolApproval),
-                        streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
-                        backend: deps.backend,
-                        checkpointStore: deps.checkpointStore,
-                    }).active;
-                    const approvalLeg = assembleApprovalLeg(streamApprovalOn);
-                    const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-                    const unattended = approvalLeg.unattended;
-                    const emitCard = createApprovalCardEmitter({
-                        ...(ledgerSink
-                            ? {
-                                appendDurable: async (frame) => {
-                                    const { type, ...rest } = frame;
-                                    await ledgerSink.append(type, rest);
-                                },
-                            }
-                            : {}),
-                        writeLive: (frame) => {
-                            if (res.writableEnded || res.destroyed)
-                                throw new Error("live stream ended");
-                            if (frame.type === "approval_complete" && !admitPresentedComplete(frame.askId))
+                            });
+                        };
+                        const askTaskId = durableTaskId ?? uuidv7();
+                        const askOwner = gatedPrincipal(req, deps.config) ?? null;
+                        const emitAsk = (frame) => {
+                            if (res.writableEnded || res.destroyed) {
+                                recordFailOpen(failOpenTagForDroppedFrame(frame.type), `frame=${frame.type}`);
                                 return;
+                            }
+                            res.write(`event: ${frame.type}\ndata: ${JSON.stringify(frame)}\n\n`);
+                        };
+                        const faceAlive = () => !res.writableEnded && !res.destroyed;
+                        const emitElicitation = createLedgerTwinEmit({ sink: ledgerSink, writeLive: emitAsk, liveReachable: faceAlive });
+                        const writeQuestionLive = (frame) => {
+                            if (!faceAlive())
+                                throw new Error("live stream ended — question frame undeliverable");
                             emitAsk(frame);
-                        },
-                    });
-                    const emitRevokeLive = (frame) => {
-                        if (!res.writableEnded && !res.destroyed)
+                        };
+                        const emitQuestion = createLedgerTwinEmit({ sink: ledgerSink, writeLive: writeQuestionLive, liveReachable: faceAlive });
+                        await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, prepared.spec.sessionId, askOwner, (frame) => {
+                            if (closed || res.writableEnded || res.destroyed)
+                                throw new Error("stream ended before the completion frame was written");
+                            const f = frame;
+                            const fKey = f.type === "task_notification" ? taskNotificationStreamKeyOf(f) : undefined;
+                            if (fKey !== undefined)
+                                syncNotifiedKeys.set(fKey, Promise.resolve(true));
+                            sseData(res, frame);
+                        }, { route: "sync-stream-open", connection: "live-sse", log: (m, x) => deps.logger?.info?.(m, x) });
+                        const withElicit = deps.elicitation
+                            ? () => deps.elicitation.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitElicitation, abortSignal: ac.signal }, streamBody)
+                            : streamBody;
+                        const withQuestion = () => deps.question
+                            ? deps.question.runWithContext({ taskId: askTaskId, owner: askOwner, emit: emitQuestion, abortSignal: ac.signal, deliverable: faceAlive }, withElicit)
+                            : withElicit();
+                        const emitApproval = (frame) => {
+                            if (res.writableEnded || res.destroyed)
+                                throw new Error("live stream ended — approval card undeliverable");
                             emitAsk(frame);
-                    };
-                    const approvalCtx = deps.toolApproval && unattended === undefined
-                        ? {
-                            taskId: askTaskId,
-                            owner: askOwner,
-                            abortSignal: ac.signal,
-                            ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
-                            ...(streamApprovalOn
+                        };
+                        const streamApprovalOn = resolveStreamApprovalGate({
+                            toolApprovalEnabled: Boolean(deps.toolApproval),
+                            streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
+                            backend: deps.backend,
+                            checkpointStore: deps.checkpointStore,
+                        }).active;
+                        const approvalLeg = assembleApprovalLeg(streamApprovalOn);
+                        const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
+                        const unattended = approvalLeg.unattended;
+                        const emitCard = createApprovalCardEmitter({
+                            ...(ledgerSink
                                 ? {
-                                    emitCard,
-                                    emitRevoke: emitRevokeLive,
-                                    legKey: "",
-                                    ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
+                                    appendDurable: async (frame) => {
+                                        const { type, ...rest } = frame;
+                                        await ledgerSink.append(type, rest);
+                                    },
                                 }
-                                : { emit: emitApproval }),
-                        }
-                        : undefined;
-                    if (deps.toolApproval) {
-                        const toolApproval = deps.toolApproval;
-                        prepared.spec.onAsk = unattended
-                            ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }, unattended)
-                            : toolApproval.boundAsk({
-                                owner: askOwner,
+                                : {}),
+                            writeLive: (frame) => {
+                                if (res.writableEnded || res.destroyed)
+                                    throw new Error("live stream ended");
+                                if (frame.type === "approval_complete" && !admitPresentedComplete(frame.askId))
+                                    return;
+                                emitAsk(frame);
+                            },
+                        });
+                        const emitRevokeLive = (frame) => {
+                            if (!res.writableEnded && !res.destroyed)
+                                emitAsk(frame);
+                        };
+                        const approvalCtx = deps.toolApproval && unattended === undefined
+                            ? {
                                 taskId: askTaskId,
+                                owner: askOwner,
+                                abortSignal: ac.signal,
                                 ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
-                                ...(streamApprovalOn ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
-                            });
-                    }
-                    const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
-                    await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope({ sessionId: prepared.spec.sessionId, taskId: durableTaskId }, () => deps.sendUserFile
-                        ? deps.sendUserFile.runWithContext({
-                            taskId: askTaskId,
-                            emit: async (f) => {
-                                void (await emitAsk(f));
-                                if (ledgerSink) {
-                                    const { type, ...rest } = f;
-                                    await ledgerSink.append(type, rest).catch(() => undefined);
-                                }
-                            },
-                        }, withApproval)
-                        : withApproval()));
-                    if (durableTaskId && deps.runStore) {
-                        const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
-                        if (finalResult && finalPlane?.status === "suspended" && deps.checkpointStore)
-                            await deps.runStore.setSuspended(durableTaskId, finalResult);
-                        else if (finalResult && finalPlane?.status === "needs_review" && deps.checkpointStore)
-                            await deps.runStore.setNeedsReview(durableTaskId, finalResult);
-                        else if (finalResult && finalPlane) {
-                            await deps.runStore.setTerminal(durableTaskId, finalPlane.status, finalResult, finalPlane.errorMessage ?? null);
-                            await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, finalResult);
-                        }
-                        else {
-                            putRewindAnchor();
-                            const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
-                            const dcCause = ac.cause();
-                            if (pending) {
-                                if (ledgerSink && !ledgerTerminal) {
-                                    ledgerTerminal = true;
-                                    await ledgerSink.flush().catch(() => undefined);
-                                    await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
-                                }
-                                await deps.runStore.setSuspended(durableTaskId, null);
-                                settleFleet("suspended");
+                                ...(streamApprovalOn
+                                    ? {
+                                        emitCard,
+                                        emitRevoke: emitRevokeLive,
+                                        legKey: "",
+                                        ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
+                                    }
+                                    : { emit: emitApproval }),
                             }
-                            else if (dcCause !== undefined) {
-                                const dcErr = "stream client disconnected before completion (run aborted)";
-                                const dc = cancelledResult(dcErr, dcCause);
-                                if (ledgerSink && !ledgerTerminal) {
-                                    ledgerTerminal = true;
-                                    await ledgerSink.flush().catch(() => undefined);
-                                    await ledgerSink.append("failed", buildCancelledLedgerRow(dc)).catch(() => undefined);
-                                }
-                                await deps.runStore.setTerminal(durableTaskId, "failed", dc, dcErr);
-                                noteRunOutcome(dc);
-                                settleFleet("failed");
+                            : undefined;
+                        if (deps.toolApproval) {
+                            const toolApproval = deps.toolApproval;
+                            prepared.spec.onAsk = unattended
+                                ? toolApproval.boundUnattendedAsk({ owner: askOwner, taskId: askTaskId, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) }, unattended)
+                                : toolApproval.boundAsk({
+                                    owner: askOwner,
+                                    taskId: askTaskId,
+                                    ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}),
+                                    ...(streamApprovalOn ? { legKey: "", ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
+                                });
+                        }
+                        const withApproval = () => approvalCtx && deps.toolApproval ? deps.toolApproval.runWithContext(approvalCtx, withQuestion) : withQuestion();
+                        await instructionLeg.run(prepared.spec.sessionId, () => withModelReachScope({ sessionId: prepared.spec.sessionId, taskId: durableTaskId }, () => deps.sendUserFile
+                            ? deps.sendUserFile.runWithContext({
+                                taskId: askTaskId,
+                                emit: async (f) => {
+                                    void (await emitAsk(f));
+                                    if (ledgerSink) {
+                                        const { type, ...rest } = f;
+                                        await ledgerSink.append(type, rest).catch(() => undefined);
+                                    }
+                                },
+                            }, withApproval)
+                            : withApproval()));
+                        if (durableTaskId && deps.runStore) {
+                            const finalPlane = finalResult ? outwardPlane(finalResult.terminal) : undefined;
+                            if (finalResult && finalPlane?.status === "suspended" && deps.checkpointStore)
+                                await deps.runStore.setSuspended(durableTaskId, finalResult);
+                            else if (finalResult && finalPlane?.status === "needs_review" && deps.checkpointStore)
+                                await deps.runStore.setNeedsReview(durableTaskId, finalResult);
+                            else if (finalResult && finalPlane) {
+                                await deps.runStore.setTerminal(durableTaskId, finalPlane.status, finalResult, finalPlane.errorMessage ?? null);
+                                await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, finalResult);
                             }
                             else {
-                                const err = "stream ended before a terminal event";
-                                if (ledgerSink && !ledgerTerminal) {
-                                    ledgerTerminal = true;
-                                    await ledgerSink.flush().catch(() => undefined);
-                                    await ledgerSink.append("failed", { errorMessage: err }).catch(() => undefined);
-                                }
-                                await deps.runStore.setTerminal(durableTaskId, "failed", null, err);
-                                settleFleet("failed");
-                            }
-                        }
-                        runRowSettled = true;
-                    }
-                }
-                finally {
-                    syncLegLive = false;
-                    unregisterEngineNotice();
-                    if (durableHeartbeat)
-                        clearInterval(durableHeartbeat);
-                    if (durableTaskId && steerableRuns.get(durableTaskId) === liveStreamRef)
-                        steerableRuns.delete(durableTaskId);
-                    if (liveStreamRef !== undefined)
-                        await deps.userInputLedger?.settleLeg(liveStreamRef);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
-                        inflightRuns.delete(durableTaskId);
-                    for (const evict of subagentHandleEvictions)
-                        evict();
-                    if (!runRowSettled && durableTaskId && deps.runStore) {
-                        try {
-                            const row = await deps.runStore.getRun(durableTaskId);
-                            if (row?.status === "running") {
-                                const pending = prepared.spec.sessionId ? await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId) : undefined;
-                                const backstopCause = ac.cause();
+                                putRewindAnchor();
+                                const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
+                                const dcCause = ac.cause();
                                 if (pending) {
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
@@ -818,195 +772,255 @@ export async function handleTasks(req, res, match, ctx) {
                                     await deps.runStore.setSuspended(durableTaskId, null);
                                     settleFleet("suspended");
                                 }
-                                else if (finalResult) {
-                                    if (ledgerSink && !ledgerTerminal) {
-                                        ledgerTerminal = true;
-                                        await ledgerSink.onDone(finalResult).catch(() => undefined);
-                                    }
-                                    const retryPlane = outwardPlane(finalResult.terminal);
-                                    await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
-                                    await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, finalResult);
-                                    settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
-                                }
-                                else if (backstopCause !== undefined) {
-                                    const err = "stream aborted before completion (run cancelled)";
-                                    const c = cancelledResult(err, backstopCause);
+                                else if (dcCause !== undefined) {
+                                    const dcErr = "stream client disconnected before completion (run aborted)";
+                                    const dc = cancelledResult(dcErr, dcCause);
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
                                         await ledgerSink.flush().catch(() => undefined);
-                                        await ledgerSink.append("failed", buildCancelledLedgerRow(c)).catch(() => undefined);
+                                        await ledgerSink.append("failed", buildCancelledLedgerRow(dc)).catch(() => undefined);
                                     }
-                                    await deps.runStore.setTerminal(durableTaskId, "failed", c, err);
+                                    await deps.runStore.setTerminal(durableTaskId, "failed", dc, dcErr);
+                                    noteRunOutcome(dc);
+                                    settleFleet("failed");
                                 }
                                 else {
-                                    const err = "stream leg threw before a terminal event";
+                                    const err = "stream ended before a terminal event";
                                     if (ledgerSink && !ledgerTerminal) {
                                         ledgerTerminal = true;
                                         await ledgerSink.flush().catch(() => undefined);
                                         await ledgerSink.append("failed", { errorMessage: err }).catch(() => undefined);
                                     }
                                     await deps.runStore.setTerminal(durableTaskId, "failed", null, err);
+                                    settleFleet("failed");
                                 }
                             }
-                        }
-                        catch {
+                            runRowSettled = true;
                         }
                     }
-                    settleFleet("failed");
-                }
-                return { status: 200, body: finalResult };
-            };
-            counters.uncountedBillableInflight++;
-            try {
-                resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runStreamSubmitLeg()));
-            }
-            catch (e) {
-                deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
-                if (!closed)
-                    throw e;
-            }
-            finally {
-                counters.uncountedBillableInflight--;
-                clearInterval(hb);
-                if (usageKey)
-                    deps.modelUsage?.clear(usageKey);
-            }
-            if (!ranLive && resp && !res.writableEnded) {
-                sseData(res, { type: "done", result: doneResultOfOutcome(resp), replay: true });
-            }
-            res.end();
-        }
-        else {
-            const withSyncSubmitKeys = (body) => {
-                const extra = {
-                    ...(prepared.verify || prepared.cascade ? { notice: MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE } : {}),
-                    ...(prepared.warnings !== undefined ? { warnings: prepared.warnings } : {}),
-                };
-                return Object.keys(extra).length > 0 ? { ...body, ...extra } : body;
-            };
-            const runSyncSubmitLeg = async () => {
-                const syncLegStartedAt = Date.now();
-                let durableTaskId;
-                let durableHeartbeat;
-                if (deps.runStore && prepared.spec.sessionId) {
-                    const tid = uuidv7();
-                    const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), idem: idem ?? null });
-                    if (created.ok)
-                        clearTurnActivity(tid);
-                    if (created.ok)
-                        recordResourceWindow(tid, prepared.spec.resourceSuspend);
-                    if (created.existing)
-                        return await replayOfExistingRun(created.existing, { principal: submitter, idem }, "sync", deps, deps.runStore);
-                    if (!created.ok)
-                        return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) };
-                    const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
-                    if (placementReject)
-                        return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
-                    durableTaskId = tid;
-                }
-                if (deps.checkpointStore && prepared.spec.sessionId) {
-                    const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
-                    if (ctxRefusal)
-                        return ctxRefusal;
-                }
-                commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
-                const syncCancelCtrl = createRunAbort();
-                if (prepared.spec.sessionId)
-                    markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
-                if (durableTaskId && deps.runStore) {
-                    const rs = deps.runStore;
-                    const tid = durableTaskId;
-                    const owner = principal ?? null;
-                    const abortFromVerb = () => syncCancelCtrl.abort("cancel_verb");
-                    durableHeartbeat = setInterval(() => {
-                        void rs.heartbeat(tid, owner).catch(() => undefined);
-                        if (!syncCancelCtrl.signal.aborted) {
-                            void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
-                                abortFromVerb(); }).catch(() => undefined);
+                    finally {
+                        syncLegLive = false;
+                        unregisterEngineNotice();
+                        if (durableHeartbeat)
+                            clearInterval(durableHeartbeat);
+                        if (durableTaskId && steerableRuns.get(durableTaskId) === liveStreamRef)
+                            steerableRuns.delete(durableTaskId);
+                        if (liveStreamRef !== undefined)
+                            await deps.userInputLedger?.settleLeg(liveStreamRef);
+                        if (durableTaskId && inflightRuns.get(durableTaskId) === ac)
+                            inflightRuns.delete(durableTaskId);
+                        for (const evict of subagentHandleEvictions)
+                            evict();
+                        if (!runRowSettled && durableTaskId && deps.runStore) {
+                            try {
+                                const row = await deps.runStore.getRun(durableTaskId);
+                                if (row?.status === "running") {
+                                    const pending = prepared.spec.sessionId ? await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId) : undefined;
+                                    const backstopCause = ac.cause();
+                                    if (pending) {
+                                        if (ledgerSink && !ledgerTerminal) {
+                                            ledgerTerminal = true;
+                                            await ledgerSink.flush().catch(() => undefined);
+                                            await ledgerSink.appendParked("suspended", {}).catch(() => undefined);
+                                        }
+                                        await deps.runStore.setSuspended(durableTaskId, null);
+                                        settleFleet("suspended");
+                                    }
+                                    else if (finalResult) {
+                                        if (ledgerSink && !ledgerTerminal) {
+                                            ledgerTerminal = true;
+                                            await ledgerSink.onDone(finalResult).catch(() => undefined);
+                                        }
+                                        const retryPlane = outwardPlane(finalResult.terminal);
+                                        await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
+                                        await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, finalResult);
+                                        settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
+                                    }
+                                    else if (backstopCause !== undefined) {
+                                        const err = "stream aborted before completion (run cancelled)";
+                                        const c = cancelledResult(err, backstopCause);
+                                        if (ledgerSink && !ledgerTerminal) {
+                                            ledgerTerminal = true;
+                                            await ledgerSink.flush().catch(() => undefined);
+                                            await ledgerSink.append("failed", buildCancelledLedgerRow(c)).catch(() => undefined);
+                                        }
+                                        await deps.runStore.setTerminal(durableTaskId, "failed", c, err);
+                                    }
+                                    else {
+                                        const err = "stream leg threw before a terminal event";
+                                        if (ledgerSink && !ledgerTerminal) {
+                                            ledgerTerminal = true;
+                                            await ledgerSink.flush().catch(() => undefined);
+                                            await ledgerSink.append("failed", { errorMessage: err }).catch(() => undefined);
+                                        }
+                                        await deps.runStore.setTerminal(durableTaskId, "failed", null, err);
+                                    }
+                                }
+                            }
+                            catch {
+                            }
                         }
-                    }, HEARTBEAT_MS);
-                    durableHeartbeat.unref?.();
-                    inflightRuns.set(tid, syncCancelCtrl);
-                    void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !syncCancelCtrl.signal.aborted)
-                        abortFromVerb(); }).catch(() => undefined);
-                }
-                else if (durableTaskId) {
-                    inflightRuns.set(durableTaskId, syncCancelCtrl);
-                }
-                const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) };
-                const observeSyncLegEvent = (ev) => {
-                    if (ev.type !== "wiring_manifest" || wiringReceipt !== undefined)
-                        return;
-                    wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, instructionLeg.segment());
+                        settleFleet("failed");
+                    }
+                    return { status: 200, body: finalResult };
                 };
-                let result;
                 counters.uncountedBillableInflight++;
                 try {
-                    const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
-                    const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, heldDecisions);
-                    const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
-                    const plainLeg = async () => {
-                        const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
-                        for await (const ev of stream) {
-                            observeSyncLegEvent(ev);
-                            prepared.acceptance.observe(ev);
-                        }
-                        return stream.result();
-                    };
-                    result = await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg()));
+                    resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runStreamSubmitLeg()));
+                }
+                catch (e) {
+                    deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
+                    if (!closed)
+                        throw e;
                 }
                 finally {
                     counters.uncountedBillableInflight--;
-                    if (durableHeartbeat)
-                        clearInterval(durableHeartbeat);
-                    if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl)
-                        inflightRuns.delete(durableTaskId);
+                    clearInterval(hb);
+                    if (usageKey)
+                        deps.modelUsage?.clear(usageKey);
                 }
-                const syncAbortCause = syncCancelCtrl.cause();
-                if (syncAbortCause !== undefined) {
-                    result = mintCancelledResult({
-                        taskId: durableTaskId ?? "",
-                        sessionId: prepared.spec.sessionId ?? "",
-                        startedAtMs: syncLegStartedAt,
-                        message: "cancelled by user",
-                        cause: syncAbortCause,
-                        engineResult: result,
-                    });
+                if (!ranLive && resp && !res.writableEnded) {
+                    sseData(res, { type: "done", result: doneResultOfOutcome(resp), replay: true });
                 }
-                const resumeAtStatus = syncRefusalHttpStatus(result);
-                if (resumeAtStatus) {
-                    const resumeAtPlane = outwardPlane(result.terminal);
+                res.end();
+            }
+            else {
+                const withSyncSubmitKeys = (body) => {
+                    const extra = {
+                        ...(prepared.verify || prepared.cascade ? { notice: MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE } : {}),
+                        ...(prepared.warnings !== undefined ? { warnings: prepared.warnings } : {}),
+                    };
+                    return Object.keys(extra).length > 0 ? { ...body, ...extra } : body;
+                };
+                const runSyncSubmitLeg = async () => {
+                    const syncLegStartedAt = Date.now();
+                    let durableTaskId;
+                    let durableHeartbeat;
+                    if (deps.runStore && prepared.spec.sessionId) {
+                        const tid = uuidv7();
+                        const created = await deps.runStore.createRun(tid, prepared.spec.sessionId, principal ?? null, deps.instanceId ?? "default", { ...runMeta(prepared, source), identity: runIdentityOf(req, deps.config, principal ?? null), idem: idem ?? null });
+                        if (created.ok)
+                            clearTurnActivity(tid);
+                        if (created.ok)
+                            recordResourceWindow(tid, prepared.spec.resourceSuspend);
+                        if (created.existing)
+                            return await replayOfExistingRun(created.existing, { principal: submitter, idem }, "sync", deps, deps.runStore);
+                        if (!created.ok)
+                            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, prepared.spec.sessionId, created.activeTaskId) };
+                        const placementReject = await commitPlacement(deps, deps.runStore, tid, prepared.bindingIntent);
+                        if (placementReject)
+                            return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+                        durableTaskId = tid;
+                    }
+                    if (deps.checkpointStore && prepared.spec.sessionId) {
+                        const ctxRefusal = await persistSubmitCtx(deps.checkpointStore, deps, durableTaskId !== undefined && deps.runStore ? { runStore: deps.runStore, taskId: durableTaskId } : undefined, prepared.spec.sessionId, { body: prepared.body, memoryScope: prepared.auth?.memoryScope, writerVersion: serviceVersion() });
+                        if (ctxRefusal)
+                            return ctxRefusal;
+                    }
+                    commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
+                    const syncCancelCtrl = createRunAbort();
+                    if (prepared.spec.sessionId)
+                        markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                     if (durableTaskId && deps.runStore) {
-                        await deps.runStore.setTerminal(durableTaskId, "failed", sealResultForExit(result), resumeAtPlane.errorMessage ?? null);
-                        await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, result);
+                        const rs = deps.runStore;
+                        const tid = durableTaskId;
+                        const owner = principal ?? null;
+                        const abortFromVerb = () => syncCancelCtrl.abort("cancel_verb");
+                        durableHeartbeat = setInterval(() => {
+                            void rs.heartbeat(tid, owner).catch(() => undefined);
+                            if (!syncCancelCtrl.signal.aborted) {
+                                void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c)
+                                    abortFromVerb(); }).catch(() => undefined);
+                            }
+                        }, HEARTBEAT_MS);
+                        durableHeartbeat.unref?.();
+                        inflightRuns.set(tid, syncCancelCtrl);
+                        void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !syncCancelCtrl.signal.aborted)
+                            abortFromVerb(); }).catch(() => undefined);
                     }
-                    const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
-                        ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
-                        : undefined;
-                    const refusalFacts = zeroWorkRefusalFacts(redactTerminalResult(sealResultForExit(result)).terminal, prepared.warnings);
-                    return { status: resumeAtStatus, body: refusalBody({ errorCode: httpErrorCode(resumeAtStatus, resumeAtPlane.errorCode), message: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", facts: { ...(retryAfterSec !== undefined ? { retryAfterSec } : {}), ...refusalFacts } }) };
-                }
-                const exitResult = await mintSubmitExitResult(result, deps.checkpointStore);
-                const syncPlane = outwardPlane(result.terminal);
-                if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
-                    await deps.runStore.setSuspended(durableTaskId, exitResult);
-                    return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" })) };
-                }
-                if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
-                    await deps.runStore.setNeedsReview(durableTaskId, exitResult);
-                    return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" })) };
-                }
-                if (durableTaskId && deps.runStore)
-                    await deps.runStore.setTerminal(durableTaskId, syncPlane.status, exitResult, syncPlane.errorMessage ?? null);
-                prepared.acceptance.settle(result);
-                finalizeTaskResult(result, principal, prepared.spec.objective);
-                noteRunOutcome(result);
-                return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult)) };
-            };
-            const resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runSyncSubmitLeg()));
-            sendSubmitResult(res, resp);
+                    else if (durableTaskId) {
+                        inflightRuns.set(durableTaskId, syncCancelCtrl);
+                    }
+                    const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) };
+                    const observeSyncLegEvent = (ev) => {
+                        if (ev.type !== "wiring_manifest" || wiringReceipt !== undefined)
+                            return;
+                        wiringReceipt = wiringManifestFaceEventData(ev, wiringOperatorFace, legWiringSections());
+                    };
+                    let result;
+                    counters.uncountedBillableInflight++;
+                    try {
+                        const heldDecisions = prepared.spec.sessionId !== undefined ? await heldWorkflowParkDecisions(deps, prepared.spec.sessionId) : {};
+                        const verifyLeg = (v) => runWithVerification(prepared.runner, specWithSignal, v, heldDecisions);
+                        const cascadeLeg = () => runCascade(prepared.runner, specWithSignal, cascadeConfig(deps.config.cascadeLadder, prepared.spec.limits?.maxCostUsd), heldDecisions);
+                        const plainLeg = async () => {
+                            const stream = prepared.runner.runTaskStream(specWithSignal, undefined, heldDecisions);
+                            const syncWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(prepared.spec));
+                            for await (const ev of stream) {
+                                observeSyncLegEvent(ev);
+                                prepared.acceptance.observe(ev);
+                                await syncWorkspace.observe(ev);
+                            }
+                            return stream.result();
+                        };
+                        result = await instructionLeg.run(prepared.spec.sessionId, () => withPrincipal(principal, () => prepared.verify ? verifyLeg(prepared.verify) : prepared.cascade ? cascadeLeg() : plainLeg()));
+                    }
+                    finally {
+                        counters.uncountedBillableInflight--;
+                        if (durableHeartbeat)
+                            clearInterval(durableHeartbeat);
+                        if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl)
+                            inflightRuns.delete(durableTaskId);
+                    }
+                    const syncAbortCause = syncCancelCtrl.cause();
+                    if (syncAbortCause !== undefined) {
+                        result = mintCancelledResult({
+                            taskId: durableTaskId ?? "",
+                            sessionId: prepared.spec.sessionId ?? "",
+                            startedAtMs: syncLegStartedAt,
+                            message: "cancelled by user",
+                            cause: syncAbortCause,
+                            engineResult: result,
+                        });
+                    }
+                    const resumeAtStatus = syncRefusalHttpStatus(result);
+                    if (resumeAtStatus) {
+                        const resumeAtPlane = outwardPlane(result.terminal);
+                        if (durableTaskId && deps.runStore) {
+                            await deps.runStore.setTerminal(durableTaskId, "failed", sealResultForExit(result), resumeAtPlane.errorMessage ?? null);
+                            await releaseKeyIfZeroWorkRefusal(deps.runStore, durableTaskId, result);
+                        }
+                        const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
+                            ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
+                            : undefined;
+                        const refusalFacts = zeroWorkRefusalFacts(redactTerminalResult(sealResultForExit(result)).terminal, prepared.warnings);
+                        return { status: resumeAtStatus, body: refusalBody({ errorCode: httpErrorCode(resumeAtStatus, resumeAtPlane.errorCode), message: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", facts: { ...(retryAfterSec !== undefined ? { retryAfterSec } : {}), ...refusalFacts } }) };
+                    }
+                    const exitResult = await mintSubmitExitResult(result, deps.checkpointStore);
+                    const syncPlane = outwardPlane(result.terminal);
+                    if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
+                        await deps.runStore.setSuspended(durableTaskId, exitResult);
+                        return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" })) };
+                    }
+                    if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && durableTaskId && prepared.spec.sessionId) {
+                        await deps.runStore.setNeedsReview(durableTaskId, exitResult);
+                        return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult, { taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" })) };
+                    }
+                    if (durableTaskId && deps.runStore)
+                        await deps.runStore.setTerminal(durableTaskId, syncPlane.status, exitResult, syncPlane.errorMessage ?? null);
+                    prepared.acceptance.settle(result);
+                    finalizeTaskResult(result, principal, prepared.spec.objective);
+                    noteRunOutcome(result);
+                    return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult)) };
+                };
+                const resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runSyncSubmitLeg()));
+                sendSubmitResult(res, resp);
+            }
+            return;
+        }
+        finally {
+            prepared.peerLease.release();
         }
-        return;
     }
 }
 export const TASKS_ROUTES = [