@sema-agent/server 7.137.0 → 7.138.0

package/dist/http/dispatch.js

@@ -9,6 +9,7 @@ import { sendJson, sendError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
 import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
+import { deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { actsForDeployment, admitRunIdentity, authorized, systemFor, gatedPrincipal, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource, hasServiceAuth, devOpenDeployment } from "./principal-gate.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
 export function readCredentialOk(req, config) {
@@ -127,6 +128,7 @@ export function createDispatch(ctx) {
         if (req.method === "GET" && url === "/health") {
             const signal = mintEngineSignal(deps);
             const engineSignal = buildEngineSignal(signal);
+            const declaredMods = deploymentModPackagesFact(deps);
             const configHash = createHash("sha256")
                 .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
                 .digest("hex")
@@ -149,6 +151,7 @@ export function createDispatch(ctx) {
                 startedAt: PROCESS_STARTED_AT_MS,
                 port: req.socket.localPort,
                 ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
+                ...(declaredMods.available ? { mods: { deploymentPackages: declaredMods.count } } : {}),
                 ...buildHealthSelfReport(deps),
                 ...(signal.restart ? { ...(restartActionable(signal) ? { restartRequired: true } : {}), restart: signal.restart } : {}),
                 ...(() => {

package/dist/http/durable-run-leg.js

@@ -1,6 +1,7 @@
 import { uuidv7 } from "@sema-agent/core";
 import { heldWorkflowParkDecisions } from "../parked-decide.js";
 import { HEARTBEAT_MS, runInBackground } from "../runs.js";
+import { heldFor } from "../peer-seat.js";
 import { fleetRunPublisher, fleetRunLabels } from "../fleet/fleet-bus.js";
 import { cascadeConfig, runMeta } from "./run-meta.js";
 import { declaredApprovalFrameFamilies, resolveStreamApprovalGate } from "../tool-approval.js";
@@ -13,6 +14,7 @@ import { persistSubmitCtx } from "./submit-ctx.js";
 import { releaseClaimedRun } from "./claimed-run.js";
 import { serviceVersion } from "../service-version.js";
 import { headReadOf } from "../session-incarnation.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 export async function mintAndDriveDurableRun(ctx, runStore, args) {
     const { deps } = ctx;
     const { inflightRuns, preemptableRuns, steerableRuns } = ctx.registry;
@@ -78,7 +80,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
         sessionId,
         ...fleetRunLabels(args.prepared.spec.objective),
     });
-    void runInBackground(args.prepared.runner, { ...args.prepared.spec, sessionId }, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
+    void heldFor(args.prepared.peerLease, () => runInBackground(args.prepared.runner, { ...args.prepared.spec, sessionId }, runStore, taskId, deps.metrics, args.prepared.auth?.principal, args.prepared.verify, args.prepared.cascade ? cascadeConfig(deps.config.cascadeLadder, args.prepared.spec.limits?.maxCostUsd) : undefined, deps.instrumentDegenerate, deps.planCacheProbe, deps.config.traceThinking, inflightRuns, preemptableRuns, steerableRuns, deps.modelUsage, deps.elicitation, args.elicitOwner, captureTurnAnchor, fleetPub, captureUserMessageAnchor, deps.question, deps.workflowCompletionInbox, deps.subagentSteerRegistry, (m, x) => deps.logger?.info?.(m, x), deps.sendUserFile, deps.promptManifests, deps.toolApproval
         ? {
             coordinator: deps.toolApproval,
             streamApprovalOn: resolveStreamApprovalGate({
@@ -91,7 +93,7 @@ export async function mintAndDriveDurableRun(ctx, runStore, args) {
             windowMarginMs: deps.config.streamAskWindowMarginMs,
             declaredFamilies: declaredApprovalFrameFamilies(args.prepared.body.settings),
         }
-        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance);
+        : undefined, deps.checkpointStore, args.prepared.engineNotices, trustedInternals, deps.userInputLedger, args.prepared.acceptance, createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(args.prepared.spec))));
     return { status: 202, body: { taskId, sessionId, status: "running", ...(args.prepared.warnings !== undefined ? { warnings: args.prepared.warnings } : {}) } };
 }
 //# sourceMappingURL=durable-run-leg.js.map

package/dist/http/memory-compliance-failure-reply.js

@@ -8,6 +8,9 @@ function sentCoreCode(res, coreCode, coreMessage, audience) {
         case "config.memory_erasure_request":
             sendError(res, 400, "config.memory_erasure_request", textFor(audience, coreMessage, "session memory erasure refused — the erasure request is not valid; correct it and resend"));
             return true;
+        case "config.memory_erasure_scope":
+            sendError(res, 400, "config.memory_erasure_scope", textFor(audience, coreMessage, "session memory erasure refused — the request reaches memory outside the scopes it may erase; nothing was erased"));
+            return true;
         case "memory.erasure_evidence_unavailable":
             sendError(res, 409, "memory.erasure_evidence_unavailable", textFor(audience, coreMessage, "session memory erasure refused — this deployment's memory store cannot produce erasure evidence; resend with allowUnevidenced: true to erase without evidence, or ask the operator"));
             return true;

package/dist/http/resume-legs.d.ts

@@ -18,7 +18,7 @@ import type { CheckpointStoreFull } from "../plugins/store-backend.js";
 import type { HostDecision } from "../host-decision.js";
 import { type GateSighting } from "../approval-gate-currency.js";
 import { type PlanApprovePermissionModeAfter } from "../task-settings.js";
-import type { RouteCtxBase, DriveResumeArgs, HostLegOutcome, PreparedPlanReview, ResumeLegOutcome, WorkflowDecisionDelivery } from "./route-ctx.js";
+import type { RouteCtxBase, DriveResumeArgs, PreparedPlanReview, ResumeLegOutcome, WorkflowDecisionDelivery } from "./route-ctx.js";
 import type { RunRegistry, RouteHelpers, RouteLegs } from "./route-ctx.js";
 import type { createRequestGuards } from "./request-guards.js";
 import type { FlatServiceDeps } from "./server.js";
@@ -59,12 +59,9 @@ export declare function createResumeLegs(ctx: {
     resumePreempted: (sessionId: string, req: IncomingMessage | undefined, acceptEarly?: boolean, decider?: {
         principal?: string;
         explicitOperator: boolean;
-    }) => Promise<{
-        status: number;
-        body: object;
-    }>;
-    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string) => Promise<HostLegOutcome>;
-    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string) => Promise<HostLegOutcome>;
+    }) => Promise<ResumeLegOutcome>;
+    startFreshHostTurn: (sessionId: string, objective: string, principal: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string) => Promise<ResumeLegOutcome>;
+    resumeWake: (sessionId: string, message: string | undefined, caller: string | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string) => Promise<ResumeLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
         principalPresent?: boolean;
@@ -81,9 +78,6 @@ export declare function createResumeLegs(ctx: {
         readonly ok: true;
         readonly prepared: PreparedPlanReview;
     }>;
-    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<{
-        status: number;
-        body: object;
-    }>;
+    drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<ResumeLegOutcome>;
 };
 //# sourceMappingURL=resume-legs.d.ts.map

package/dist/http/resume-legs.js

@@ -4,6 +4,7 @@ import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, t
 import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
 import { headReadOf } from "../session-incarnation.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 const headUnavailable = async (sessionId) => {
     throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no head read (headOf; every built-in store has one) — refusing rather than resuming unverified`);
@@ -38,7 +39,10 @@ import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../task-settings.js";
-import { acceptedResumingReceipt, acceptedTaskIdOf, buildHostLegOutcome } from "./route-ctx.js";
+import { acceptedResumingReceipt, acceptedTaskIdOf } from "./route-ctx.js";
+import { heldFor } from "../peer-seat.js";
+import { NO_SETTLEMENT_EVIDENCE, buildSettlementEvidence, decisionCommittedOf } from "../gate-settlement.js";
+import { durableRowIdentity } from "../checkpoint-identity.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
 import { createSessionSyncLocal } from "./routes/session-sync.js";
@@ -75,6 +79,8 @@ const WORKER_SWAP_REDEEMABLE = {
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    tool_identity_missing: true,
+    bound_input_hash_missing: false,
     requirements_damaged: false,
     read_face_damaged: false,
     read_face_forged: false,
@@ -125,9 +131,9 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "checkpoint.gate_mismatch": "terminal",
     "checkpoint.reopen_failed": "terminal",
     "checkpoint.cwd_conflicts_restore": "terminal",
+    "steering.duplicate_input_id": "retriable",
     "checkpoint.already_exists": "terminal",
     "checkpoint.execution_outcome_conflict": "terminal",
-    "steering.duplicate_input_id": "terminal",
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
@@ -159,6 +165,10 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     feedback: "outcome_cell",
+    outcome: "outcome_cell",
+    updatedInput: "outcome_cell",
+    decision: "outcome_cell",
+    reason: "outcome_cell",
     taskConfig: "config",
     deps: "config",
     inheritedGate: "config",
@@ -365,9 +375,7 @@ export function createResumeLegs(ctx) {
             }
             : undefined;
         const noteLateSettleIfAccepted = (out) => {
-            if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
-                return;
-            if (out.body?.errorCode === "cancelled" && out.decisionCommitted !== true)
+            if (lateSettleSink === undefined || lateSettleAnchor === undefined || !decisionCommittedOf(out))
                 return;
             try {
                 lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
@@ -383,6 +391,7 @@ export function createResumeLegs(ctx) {
         if (parkedForkLeaseDenial)
             return parkedForkLeaseDenial;
         const ownerLeaseAdmittedHere = req !== undefined;
+        const captureSelectedGate = () => durableRowIdentity("decision-receipt", cp.checkpointId, token);
         if (req !== undefined) {
             const parkedAgentStore = deps.backgroundAgentStore;
             const parkedSurface = deps.parkedReviveSurface;
@@ -412,7 +421,7 @@ export function createResumeLegs(ctx) {
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
                     ...(deps.logger ? { warn: parkWarn } : {}),
-                }, parkedReq, { handle: origin.handle, row: origin.row }));
+                }, { ...parkedReq, selectedGate: captureSelectedGate() }, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
                 noteLateSettleIfAccepted(parked);
                 return parked;
@@ -440,7 +449,7 @@ export function createResumeLegs(ctx) {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
                     const run = await runStore.getRun(held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId) : undefined;
+                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
                 };
                 const replay = await liveReceiptOf(await decisions.get(token));
                 if (replay !== undefined)
@@ -486,42 +495,48 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const pendingTool = cp.pendingAction.toolName;
-        if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+        try {
+            const { spec, engineNotices } = resolved;
+            const pendingTool = cp.pendingAction.toolName;
+            if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+            }
+            if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+            }
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const pa = cp.pendingAction;
+            const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
+            const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+            const outcome = {
+                gate: "policy_ask",
+                boundCallId: binding?.boundCallId ?? persistedCallId,
+                boundInputHash: binding?.boundInputHash ?? persistedHash,
+                decision: decision === "approve" ? "allow" : "deny",
+                ...(decision === "approve" && !isEngineQuestionRow(pa) && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
+                ...(reason ? { reason } : {}),
+                ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
+                ...(answer !== undefined ? { answer } : {}),
+                hostDecision,
+            };
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const driven = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...captureSelectedGate() }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+            noteLateSettleIfAccepted(driven);
+            return driven;
         }
-        if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+        finally {
+            resolved.peerLease.release();
         }
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const pa = cp.pendingAction;
-        const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
-        const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-        const outcome = {
-            gate: "policy_ask",
-            boundCallId: binding?.boundCallId ?? persistedCallId,
-            boundInputHash: binding?.boundInputHash ?? persistedHash,
-            decision: decision === "approve" ? "allow" : "deny",
-            ...(decision === "approve" && !isEngineQuestionRow(pa) && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
-            ...(reason ? { reason } : {}),
-            ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
-            ...(answer !== undefined ? { answer } : {}),
-            hostDecision,
-        };
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
-        noteLateSettleIfAccepted(driven);
-        return driven;
     }
     const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments", "images"];
     const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (ctx, req, auth) => {
+    const resolveResumeSpec = async (ctx, req, auth, lease) => {
         const engineNotices = [];
         const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+            lease,
         });
         return { spec, engineNotices };
     };
@@ -533,11 +548,13 @@ export function createResumeLegs(ctx) {
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
+        const lease = deps.peerDesk.lease("resume");
         try {
-            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
-            return { ok: true, spec, engineNotices };
+            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth, lease);
+            return { ok: true, spec, engineNotices, peerLease: lease };
         }
         catch (e) {
+            lease.release();
             if (e instanceof HttpError) {
                 return { ok: false, answer: resumeRefusalWithCard(resumeBlockedByPolicyAnswer(httpErrorRefusal(e)), true) };
             }
@@ -546,11 +563,11 @@ export function createResumeLegs(ctx) {
     };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
-            return await driveResumeLeg(args);
+            return await heldFor(args.peerLease, () => driveResumeLeg(args));
         let settleAccepted;
         let wasAccepted = false;
         const accepted = new Promise((resolve) => { settleAccepted = resolve; });
-        const leg = driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); });
+        const leg = heldFor(args.peerLease, () => driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); }));
         void leg.then((out) => {
             if (wasAccepted && out.status >= 400) {
                 deps.logger?.warn?.("resume_leg_failed_after_accept", { sessionId: args.sessionId, status: out.status, body: out.body });
@@ -889,6 +906,7 @@ export function createResumeLegs(ctx) {
                 const driveResume = async () => {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
+                    const resumeWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(resumeTaskConfig));
                     const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         ...launchInternals,
                         onForwardEvent: (e) => {
@@ -951,12 +969,14 @@ export function createResumeLegs(ctx) {
                     if (taskId)
                         steerableRuns.set(taskId, stream);
                     if (!taskId || !rs) {
+                        for await (const ev of stream)
+                            await resumeWorkspace.observe(ev);
                         const rNoRow = await stream.result();
                         if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
                             reopenConfirmedPark = true;
                         return sealResultForExit(rNoRow);
                     }
-                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
+                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId, buildSettlementEvidence({ at: "engine_accepted", commitment: args.commitment })));
                     let causeAtDone;
                     for await (const ev of stream) {
                         if (ev.type === "done")
@@ -964,6 +984,7 @@ export function createResumeLegs(ctx) {
                         recordTurnActivity(taskId);
                         fleetPub?.onEvent(ev);
                         await deps.userInputLedger?.observeLegEvent(stream, ev);
+                        await resumeWorkspace.observe(ev);
                         await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
@@ -1221,13 +1242,13 @@ export function createResumeLegs(ctx) {
         settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
-            decisionCommitted: true,
             body: {
                 taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
                 ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
                 ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
+                ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
             },
         };
     }
@@ -1302,10 +1323,16 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     async function startFreshHostTurn(sessionId, objective, principal, req, workflowDecision, runId) {
         const cs = deps.checkpointStore;
@@ -1338,23 +1365,28 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const hostSpec = { ...spec, objective, sessionId };
-        const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), ...(engineNotices.length > 0 ? { engineNotices } : {}) },
-            fleetScope: resumeFleetScope(req, auth),
-            elicitOwner: principal ?? null,
-            source: "workflow_parked_decide",
-            identity: runIdentityOf(req, deps.config, principal ?? null),
-            workflowDecision,
-        });
-        if (out.existing) {
-            throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+        try {
+            const { spec, engineNotices } = resolved;
+            const hostSpec = { ...spec, objective, sessionId };
+            const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
+                prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), peerLease: resolved.peerLease, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                fleetScope: resumeFleetScope(req, auth),
+                elicitOwner: principal ?? null,
+                source: "workflow_parked_decide",
+                identity: runIdentityOf(req, deps.config, principal ?? null),
+                workflowDecision,
+            });
+            if (out.existing) {
+                throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+            }
+            if (out.status !== 202)
+                return { status: out.status, body: out.body };
+            const minted = out.body;
+            return acceptedResumingReceipt(minted.taskId, minted.sessionId, NO_SETTLEMENT_EVIDENCE);
+        }
+        finally {
+            resolved.peerLease.release();
         }
-        if (out.status !== 202)
-            return { status: out.status, body: out.body };
-        const minted = out.body;
-        return acceptedResumingReceipt(minted.taskId, minted.sessionId);
     }
     async function resumeWake(sessionId, message, caller, req, acceptEarly, workflowDecision, ownerLeaseAdmittedFor) {
         const cs = deps.checkpointStore;
@@ -1418,26 +1450,33 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        return buildHostLegOutcome(await driveResumeIntoRunLog({
-            runner: runnerFor(spec),
-            token,
-            sessionId: cp.sessionId,
-            principal: auth.principal,
-            fleetScope: resumeFleetScope(req, auth),
-            taskConfig,
-            resumeObjective,
-            outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
-            verifyRounds: undefined,
-            resumeCtx: { sessionId, ctx },
-            mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
-            ...(workflowDecision !== undefined ? { workflowDecision } : {}),
-            ...(engineNotices.length > 0 ? { engineNotices } : {}),
-            ...(acceptEarly === true ? { acceptEarly: true } : {}),
-            ...(req !== undefined ? { callerInitiated: true } : {}),
-            ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
-        }));
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            return await driveResumeIntoRunLog({
+                peerLease: resolved.peerLease,
+                runner: runnerFor(spec),
+                token,
+                sessionId: cp.sessionId,
+                principal: auth.principal,
+                fleetScope: resumeFleetScope(req, auth),
+                taskConfig,
+                resumeObjective,
+                outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
+                commitment: { kind: "delivered" },
+                verifyRounds: undefined,
+                resumeCtx: { sessionId, ctx },
+                mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
+                ...(workflowDecision !== undefined ? { workflowDecision } : {}),
+                ...(engineNotices.length > 0 ? { engineNotices } : {}),
+                ...(acceptEarly === true ? { acceptEarly: true } : {}),
+                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
+            });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     async function preparePlanReview(sessionId, log, decider, sighting) {
         const cs = deps.checkpointStore;
@@ -1530,18 +1569,24 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const outcome = {
-            gate: "plan_review",
-            decision,
-            ...(editedPlan !== undefined ? { editedPlan } : {}),
-            ...(reason ? { reason } : {}),
-            hostDecision,
-        };
-        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
-        return out;
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const outcome = {
+                gate: "plan_review",
+                decision,
+                ...(editedPlan !== undefined ? { editedPlan } : {}),
+                ...(reason ? { reason } : {}),
+                hostDecision,
+            };
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            return out;
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     const routeCtxBase = {
         deps,