@sema-agent/server 7.137.0 → 7.139.0

package/dist/http/resume-legs.js

@@ -4,10 +4,8 @@ import { uuidv7, resumeWithVerification, CheckpointError, defaultTaskRegistry, t
 import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
 import { headReadOf } from "../session-incarnation.js";
+import { createSessionWorkspaceRecorder, legSessionWitnessOf, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
-const headUnavailable = async (sessionId) => {
-    throw new Error(`parked decide cannot verify which occupant session ${sessionId} belongs to: this deployment's session store has no head read (headOf; every built-in store has one) — refusing rather than resuming unverified`);
-};
 import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
 import { failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
@@ -38,7 +36,10 @@ import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { verifyRoundsFromBody } from "./verify-rounds.js";
 import { planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../task-settings.js";
-import { acceptedResumingReceipt, acceptedTaskIdOf, buildHostLegOutcome } from "./route-ctx.js";
+import { acceptedResumingReceipt, acceptedTaskIdOf } from "./route-ctx.js";
+import { heldFor } from "../peer-seat.js";
+import { NO_SETTLEMENT_EVIDENCE, buildSettlementEvidence, decisionCommittedOf } from "../gate-settlement.js";
+import { durableRowIdentity } from "../checkpoint-identity.js";
 import { mintAndDriveDurableRun } from "./durable-run-leg.js";
 import { createSessionsLocal } from "./routes/sessions.js";
 import { createSessionSyncLocal } from "./routes/session-sync.js";
@@ -46,7 +47,7 @@ import { createImagesLocal } from "./routes/images.js";
 import { createCapabilitiesLocal } from "./routes/capabilities.js";
 import { gatedPrincipal, explicitOperatorOk, runIdentityOf } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
-import { commitPlacement, devicePlacementErrorBody } from "./device-placement.js";
+import { commitExecutionContext, isRootSessionGoneError, resolveExecutionContext, rootSessionAbsentAnswer, stampSpecRoot } from "./execution-context.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
@@ -75,6 +76,8 @@ const WORKER_SWAP_REDEEMABLE = {
     ledger_event_unknown: true,
     real_approval_damaged: false,
     real_approval_forged: false,
+    tool_identity_missing: true,
+    bound_input_hash_missing: false,
     requirements_damaged: false,
     read_face_damaged: false,
     read_face_forged: false,
@@ -96,6 +99,7 @@ const WORKER_SWAP_REDEEMABLE = {
     unknown_model_ref: true,
     not_a_model_ref: true,
     unknown_role_word: true,
+    no_model_for_role: true,
 };
 function checkpointRowRedeemableElsewhere(reason) {
     return reason !== undefined && WORKER_SWAP_REDEEMABLE[reason] === true;
@@ -125,9 +129,9 @@ const CHECKPOINT_ERROR_DISPOSITION = {
     "checkpoint.gate_mismatch": "terminal",
     "checkpoint.reopen_failed": "terminal",
     "checkpoint.cwd_conflicts_restore": "terminal",
+    "steering.duplicate_input_id": "retriable",
     "checkpoint.already_exists": "terminal",
     "checkpoint.execution_outcome_conflict": "terminal",
-    "steering.duplicate_input_id": "terminal",
     "steering.invalid_content": "terminal",
     "steering.queue_full": "terminal",
 };
@@ -159,6 +163,10 @@ const CHECKPOINT_ERROR_FIELD_ROLE = {
     hostDecision: "outcome_cell",
     approver: "outcome_cell",
     feedback: "outcome_cell",
+    outcome: "outcome_cell",
+    updatedInput: "outcome_cell",
+    decision: "outcome_cell",
+    reason: "outcome_cell",
     taskConfig: "config",
     deps: "config",
     inheritedGate: "config",
@@ -365,9 +373,7 @@ export function createResumeLegs(ctx) {
             }
             : undefined;
         const noteLateSettleIfAccepted = (out) => {
-            if (lateSettleSink === undefined || lateSettleAnchor === undefined || out.status !== 200)
-                return;
-            if (out.body?.errorCode === "cancelled" && out.decisionCommitted !== true)
+            if (lateSettleSink === undefined || lateSettleAnchor === undefined || !decisionCommittedOf(out))
                 return;
             try {
                 lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
@@ -383,6 +389,7 @@ export function createResumeLegs(ctx) {
         if (parkedForkLeaseDenial)
             return parkedForkLeaseDenial;
         const ownerLeaseAdmittedHere = req !== undefined;
+        const captureSelectedGate = () => durableRowIdentity("decision-receipt", cp.checkpointId, token);
         if (req !== undefined) {
             const parkedAgentStore = deps.backgroundAgentStore;
             const parkedSurface = deps.parkedReviveSurface;
@@ -407,12 +414,32 @@ export function createResumeLegs(ctx) {
                     checkpointStore: cs,
                     registry: defaultTaskRegistry,
                     reviveSurface: parkedSurface,
-                    headOf: headReadOf(deps.sessionStorage) ?? headUnavailable,
                     ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
+                    execution: {
+                        resolve: async (root) => {
+                            let ctx;
+                            try {
+                                ctx = await resolveExecutionContext(deps, { kind: "continuation", root, principal: decodeCheckpointScope(cp.scope) });
+                            }
+                            catch (e) {
+                                if (isRootSessionGoneError(e))
+                                    return { ok: false, gone: true };
+                                if (e instanceof HttpError)
+                                    return { ok: false, gone: false, answer: resumeRefusalWithCard(resumeBlockedByPolicyAnswer(httpErrorRefusal(e)), true) };
+                                throw e;
+                            }
+                            const occupant = ctx.occupant;
+                            if (occupant === undefined) {
+                                throw new Error(`parked decide: root session ${root} resolved without an occupant reading — the parked revive leg is wired to a session store without an execution placement seat (sessionStorage.executionPlacement), which createHttpServer should have refused at startup; refusing rather than resuming with nobody judging the root session's occupant after the claim`);
+                            }
+                            return { ok: true, ctx: { ...ctx, occupant } };
+                        },
+                        commitDeps: deps,
+                    },
                     ...(deps.logger ? { warn: parkWarn } : {}),
-                }, parkedReq, { handle: origin.handle, row: origin.row }));
+                }, { ...parkedReq, selectedGate: captureSelectedGate() }, { handle: origin.handle, row: origin.row }));
                 void ctxPromise.catch(() => { });
                 noteLateSettleIfAccepted(parked);
                 return parked;
@@ -440,7 +467,7 @@ export function createResumeLegs(ctx) {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
                     const run = await runStore.getRun(held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId) : undefined;
+                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
                 };
                 const replay = await liveReceiptOf(await decisions.get(token));
                 if (replay !== undefined)
@@ -486,44 +513,52 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const pendingTool = cp.pendingAction.toolName;
-        if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+        try {
+            const { spec, engineNotices } = resolved;
+            const pendingTool = cp.pendingAction.toolName;
+            if (decision === "approve" && pendingTool === ASK_USER_QUESTION_TOOL_NAME && !answer) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: "pending action is AskUserQuestion — approve must carry body.answer ({ answers: [{ header, selected: string[], note? }] })", facts: { ...fieldConflictFacts("ask_answer", ["decision", "answer"]) } }) };
+            }
+            if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
+                return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+            }
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const pa = cp.pendingAction;
+            const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
+            const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
+            const outcome = {
+                gate: "policy_ask",
+                boundCallId: binding?.boundCallId ?? persistedCallId,
+                boundInputHash: binding?.boundInputHash ?? persistedHash,
+                decision: decision === "approve" ? "allow" : "deny",
+                ...(decision === "approve" && !isEngineQuestionRow(pa) && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
+                ...(reason ? { reason } : {}),
+                ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
+                ...(answer !== undefined ? { answer } : {}),
+                hostDecision,
+            };
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const driven = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...captureSelectedGate() }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+            noteLateSettleIfAccepted(driven);
+            return driven;
         }
-        if (answer && (decision !== "approve" || pendingTool !== ASK_USER_QUESTION_TOOL_NAME)) {
-            return { status: 400, body: refusalBody({ errorCode: "request.field_conflict", message: `body.answer is only valid when approving a pending AskUserQuestion (decision: "${decision}", pending: "${pendingTool ?? "unknown"}")`, facts: { ...fieldConflictFacts("ask_answer", ["answer", "decision"]) } }) };
+        finally {
+            resolved.peerLease.release();
         }
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const pa = cp.pendingAction;
-        const persistedCallId = pa.kind === "tool_approval" ? pa.toolCallId : "";
-        const persistedHash = pa.kind === "tool_approval" ? (pa.boundInputHash ?? "") : "";
-        const outcome = {
-            gate: "policy_ask",
-            boundCallId: binding?.boundCallId ?? persistedCallId,
-            boundInputHash: binding?.boundInputHash ?? persistedHash,
-            decision: decision === "approve" ? "allow" : "deny",
-            ...(decision === "approve" && !isEngineQuestionRow(pa) && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
-            ...(reason ? { reason } : {}),
-            ...(binding?.feedback !== undefined ? { feedback: binding.feedback } : {}),
-            ...(answer !== undefined ? { answer } : {}),
-            hostDecision,
-        };
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
-        noteLateSettleIfAccepted(driven);
-        return driven;
     }
-    const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "rewindFiles", "userAttachments", "images"];
+    const ONE_SHOT_SUBMIT_KEYS = ["resumeAt", "restoreFiles", "acceptPartialRestore", "rewindFilesTo", "userAttachments", "images"];
     const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
-    const resolveResumeSpec = async (ctx, req, auth) => {
+    const resolveResumeSpec = async (ctx, req, auth, lease) => {
         const engineNotices = [];
-        const spec = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
+        const execution = await resolveExecutionContext(deps, { kind: "continuation", root: auth.sessionId, principal: auth.principal });
+        const spec = stampSpecRoot(await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
-        });
-        return { spec, engineNotices };
+            lease,
+            execution,
+        }), execution);
+        return { spec, engineNotices, execution };
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
         deps.logger?.warn?.("resume_refused_stored_body", { sessionId, ...storedBodyReplayLogFields(refusal) });
@@ -533,11 +568,13 @@ export function createResumeLegs(ctx) {
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return { ok: false, answer: refuseStoredBodyReplay(auth.sessionId, replay) };
+        const lease = deps.peerDesk.lease("resume");
         try {
-            const { spec, engineNotices } = await resolveResumeSpec(ctx, req, auth);
-            return { ok: true, spec, engineNotices };
+            const { spec, engineNotices, execution } = await resolveResumeSpec(ctx, req, auth, lease);
+            return { ok: true, spec, engineNotices, execution, peerLease: lease };
         }
         catch (e) {
+            lease.release();
             if (e instanceof HttpError) {
                 return { ok: false, answer: resumeRefusalWithCard(resumeBlockedByPolicyAnswer(httpErrorRefusal(e)), true) };
             }
@@ -546,11 +583,11 @@ export function createResumeLegs(ctx) {
     };
     async function driveResumeIntoRunLog(args) {
         if (args.acceptEarly !== true)
-            return await driveResumeLeg(args);
+            return await heldFor(args.peerLease, () => driveResumeLeg(args));
         let settleAccepted;
         let wasAccepted = false;
         const accepted = new Promise((resolve) => { settleAccepted = resolve; });
-        const leg = driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); });
+        const leg = heldFor(args.peerLease, () => driveResumeLeg(args, (receipt) => { wasAccepted = true; settleAccepted?.(receipt); }));
         void leg.then((out) => {
             if (wasAccepted && out.status >= 400) {
                 deps.logger?.warn?.("resume_leg_failed_after_accept", { sessionId: args.sessionId, status: out.status, body: out.body });
@@ -566,7 +603,7 @@ export function createResumeLegs(ctx) {
     }
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
-        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx } = args;
+        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx, execution } = args;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
         const commitResumeCtx = () => Promise.resolve().then(() => deps.checkpointStore.putCtx(resumeCtx.sessionId, sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId))).catch((e) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
@@ -610,12 +647,14 @@ export function createResumeLegs(ctx) {
             if (created.existing) {
                 throw new Error(`wake fresh run: createRun observed an existing row for the freshly minted taskId ${freshId} (no idempotency key was sent) — refusing to treat it as a busy session`);
             }
+            if (created.sessionAbsent)
+                return rootSessionAbsentAnswer();
             if (!created.ok) {
                 return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
             }
-            const placementReject = await commitPlacement(deps, deps.runStore, freshId, undefined);
+            const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: freshId }, execution);
             if (placementReject)
-                return { status: placementReject.status, body: devicePlacementErrorBody(placementReject) };
+                return placementReject;
             taskId = freshId;
             freshRunClaimed = true;
         }
@@ -626,11 +665,12 @@ export function createResumeLegs(ctx) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.unattended
-                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId }, approvalLeg.unattended)
+                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId, executionLane: execution.lane }, approvalLeg.unattended)
                 : toolApproval.boundAsk({
                     owner: principal ?? null,
                     taskId,
                     sessionId,
+                    executionLane: execution.lane,
                     ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
                 });
         }
@@ -696,6 +736,11 @@ export function createResumeLegs(ctx) {
             claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
             if (!claimedRow)
                 return notResumableAnswer();
+            if (!freshRunClaimed) {
+                const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId }, execution);
+                if (placementReject)
+                    return placementReject;
+            }
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
             fleetPub?.onStart();
             const rs = deps.runStore;
@@ -889,6 +934,7 @@ export function createResumeLegs(ctx) {
                 const driveResume = async () => {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
+                    const resumeWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), legSessionWitnessOf(resumeTaskConfig));
                     const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         ...launchInternals,
                         onForwardEvent: (e) => {
@@ -951,12 +997,14 @@ export function createResumeLegs(ctx) {
                     if (taskId)
                         steerableRuns.set(taskId, stream);
                     if (!taskId || !rs) {
+                        for await (const ev of stream)
+                            await resumeWorkspace.observe(ev);
                         const rNoRow = await stream.result();
                         if (await reopenedAfterLeg(rNoRow, cancelCtrl.cause() !== undefined))
                             reopenConfirmedPark = true;
                         return sealResultForExit(rNoRow);
                     }
-                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId));
+                    onAccepted?.(acceptedResumingReceipt(taskId, sessionId, buildSettlementEvidence({ at: "engine_accepted", commitment: args.commitment })));
                     let causeAtDone;
                     for await (const ev of stream) {
                         if (ev.type === "done")
@@ -964,6 +1012,7 @@ export function createResumeLegs(ctx) {
                         recordTurnActivity(taskId);
                         fleetPub?.onEvent(ev);
                         await deps.userInputLedger?.observeLegEvent(stream, ev);
+                        await resumeWorkspace.observe(ev);
                         await appendPromptManifest(append, deps.promptManifests, taskId);
                         switch (ev.type) {
                             case "text_delta":
@@ -1119,6 +1168,7 @@ export function createResumeLegs(ctx) {
                         owner: principal ?? null,
                         abortSignal: cancelCtrl.signal,
                         sessionId,
+                        executionLane: execution.lane,
                         emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
                         emitRevoke: (f) => approvalEmit(f),
                         legKey,
@@ -1221,13 +1271,13 @@ export function createResumeLegs(ctx) {
         settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
         return {
             status: 200,
-            decisionCommitted: true,
             body: {
                 taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
                 ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
                 ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
+                ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
             },
         };
     }
@@ -1302,10 +1352,16 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     async function startFreshHostTurn(sessionId, objective, principal, req, workflowDecision, runId) {
         const cs = deps.checkpointStore;
@@ -1338,23 +1394,28 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const hostSpec = { ...spec, objective, sessionId };
-        const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-            prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), ...(engineNotices.length > 0 ? { engineNotices } : {}) },
-            fleetScope: resumeFleetScope(req, auth),
-            elicitOwner: principal ?? null,
-            source: "workflow_parked_decide",
-            identity: runIdentityOf(req, deps.config, principal ?? null),
-            workflowDecision,
-        });
-        if (out.existing) {
-            throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+        try {
+            const { spec, engineNotices } = resolved;
+            const hostSpec = { ...spec, objective };
+            const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
+                prepared: { spec: hostSpec, runner: runnerFor(hostSpec), auth, body: ctx.body, acceptance: createRunAcceptance({}, { objective }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                fleetScope: resumeFleetScope(req, auth),
+                elicitOwner: principal ?? null,
+                source: "workflow_parked_decide",
+                identity: runIdentityOf(req, deps.config, principal ?? null),
+                workflowDecision,
+            });
+            if (out.existing) {
+                throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
+            }
+            if (out.status !== 202)
+                return { status: out.status, body: out.body };
+            const minted = out.body;
+            return acceptedResumingReceipt(minted.taskId, minted.sessionId, NO_SETTLEMENT_EVIDENCE);
+        }
+        finally {
+            resolved.peerLease.release();
         }
-        if (out.status !== 202)
-            return { status: out.status, body: out.body };
-        const minted = out.body;
-        return acceptedResumingReceipt(minted.taskId, minted.sessionId);
     }
     async function resumeWake(sessionId, message, caller, req, acceptEarly, workflowDecision, ownerLeaseAdmittedFor) {
         const cs = deps.checkpointStore;
@@ -1418,26 +1479,34 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        return buildHostLegOutcome(await driveResumeIntoRunLog({
-            runner: runnerFor(spec),
-            token,
-            sessionId: cp.sessionId,
-            principal: auth.principal,
-            fleetScope: resumeFleetScope(req, auth),
-            taskConfig,
-            resumeObjective,
-            outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
-            verifyRounds: undefined,
-            resumeCtx: { sessionId, ctx },
-            mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
-            ...(workflowDecision !== undefined ? { workflowDecision } : {}),
-            ...(engineNotices.length > 0 ? { engineNotices } : {}),
-            ...(acceptEarly === true ? { acceptEarly: true } : {}),
-            ...(req !== undefined ? { callerInitiated: true } : {}),
-            ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
-        }));
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            return await driveResumeIntoRunLog({
+                peerLease: resolved.peerLease,
+                execution: resolved.execution,
+                runner: runnerFor(spec),
+                token,
+                sessionId: cp.sessionId,
+                principal: auth.principal,
+                fleetScope: resumeFleetScope(req, auth),
+                taskConfig,
+                resumeObjective,
+                outcome: { gate: "wake", ...(message !== undefined ? { message: { text: message, trusted } } : {}) },
+                commitment: { kind: "delivered" },
+                verifyRounds: undefined,
+                resumeCtx: { sessionId, ctx },
+                mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
+                ...(workflowDecision !== undefined ? { workflowDecision } : {}),
+                ...(engineNotices.length > 0 ? { engineNotices } : {}),
+                ...(acceptEarly === true ? { acceptEarly: true } : {}),
+                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
+            });
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     async function preparePlanReview(sessionId, log, decider, sighting) {
         const cs = deps.checkpointStore;
@@ -1530,18 +1599,24 @@ export function createResumeLegs(ctx) {
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
-        const { spec, engineNotices } = resolved;
-        const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-        const verifyRounds = verifyRoundsFromBody(ctx.body);
-        const outcome = {
-            gate: "plan_review",
-            decision,
-            ...(editedPlan !== undefined ? { editedPlan } : {}),
-            ...(reason ? { reason } : {}),
-            hostDecision,
-        };
-        const out = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
-        return out;
+        try {
+            const { spec, engineNotices } = resolved;
+            const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
+            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const outcome = {
+                gate: "plan_review",
+                decision,
+                ...(editedPlan !== undefined ? { editedPlan } : {}),
+                ...(reason ? { reason } : {}),
+                hostDecision,
+            };
+            const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
+            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            return out;
+        }
+        finally {
+            resolved.peerLease.release();
+        }
     }
     const routeCtxBase = {
         deps,