@sema-agent/server 7.147.0 → 7.149.0

package/dist/http/resume-legs.js

@@ -1,41 +1,50 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
-import { uuidv7, resumeWithVerification, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
-import { decideParkedAgent, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
+import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
+import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
 import { headReadOf } from "../session-incarnation.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
-import { HttpError, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
-import { graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
-import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane } from "../terminal.js";
+import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { keyAdmits } from "../owner-faces.js";
+import { personOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
+import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { commitParkRow } from "../park-row-commit.js";
+import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
-import { buildCancelledLedgerRow, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
-import { isTerminalRunStatus } from "../plugins/store-contracts.js";
+import { buildCancelledLedgerRow, CANCELLED_CODE, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
+import { isTerminalRunStatus, runProvenElsewhere } from "../plugins/store-contracts.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
 import { currentApprovalGateToken, currentGateFacesOf, sightsCurrentGate } from "../approval-gate-currency.js";
-import { approverFacingArgs, createApprovalCardEmitter, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
+import { approverFacingArgs, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
+import { createHitlTransport } from "../hitl-delivery.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { serviceVersion } from "../service-version.js";
 import { TERMINAL_PARK_GATE_KINDS, UnreadableCheckpointRowError } from "../plugins/checkpoint-store-face.js";
-import { withPrincipal } from "../observability/principal-context.js";
+import { cancelSettlesCard } from "../run-cancel-card.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../card-settle-stored-scope.js";
+import { withSubject } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
+import { approvalLegOriginOf } from "../approval-leg-origin.js";
 import { legFactsOf } from "../leg-facts.js";
+import { compositionLegRoot } from "../task-cwd.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
 import { modelTextEventData, appendParkRow, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, createPromptManifestSeat } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
-import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { blockText, reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-import { verifyRoundsFromBody } from "./verify-rounds.js";
+import { resumeCompositionOf } from "./resume-composition.js";
 import { planReviewDecisionExitsPlan, storedBodyPermissionMode } from "../task-settings.js";
 import { acceptedResumingReceipt, acceptedTaskIdOf } from "./route-ctx.js";
 import { heldFor } from "../peer-seat.js";
@@ -46,15 +55,16 @@ import { createSessionsLocal } from "./routes/sessions.js";
 import { createSessionSyncLocal } from "./routes/session-sync.js";
 import { createImagesLocal } from "./routes/images.js";
 import { createCapabilitiesLocal } from "./routes/capabilities.js";
-import { gatedPrincipal, explicitOperatorOk, runIdentityOf } from "./principal-gate.js";
+import { gatedSubject, explicitOperatorOk, runIdentityOf } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
-import { commitExecutionContext, isRootSessionGoneError, resolveExecutionContext, rootSessionAbsentAnswer, stampSpecRoot } from "./execution-context.js";
+import { refusalAfterLostClaim } from "./claim-heartbeat.js";
+import { CONTINUATION_CLAIM_FACE, ClaimFaultAnswer, commitExecutionContext, faultedAnswerOf, isRootSessionGoneError, resolveBeforeClaim, rootSessionAbsentAnswer, stampSpecRoot, withdrawClaim } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
-import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnsealableAnswer } from "./resume-ctx-read.js";
+import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer, resumeStoreFailureOf } from "./resume-ctx-read.js";
 import { objectiveWithheldIn } from "./submit-ctx.js";
 import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
@@ -62,8 +72,12 @@ import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
 import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
+import { createSubmissionSeat } from "../submission-exit.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 import { createSessionNotifyDoor } from "../session-notify-door.js";
+function compositionUnlinkedAnswer() {
+    return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context does not match this card — the run is a cascade but the card records no ladder rung, so the ladder cannot be continued" }) };
+}
 function legMayHaveReopenedCheckpoint(r) {
     return r.terminal.kind === "failed" && nestedPauseOf(r.terminal) === undefined;
 }
@@ -196,6 +210,9 @@ function decisionRefusalCauseOf(e, gate) {
 function notResumableAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.not_resumable", message: "run is not in a resumable (suspended) state (already resumed, decided, or expired)" }) };
 }
+function resumeClaimFaultAnswerOf(e) {
+    return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+}
 function approvalStaleAnswer(facts) {
     return {
         status: 409,
@@ -209,9 +226,42 @@ function approvalStaleAnswer(facts) {
         }),
     };
 }
-function rowRefusalAnswer(verdict, diagnostic, ctx) {
+function rowRefusalAnswer(verdict, diagnostic, ctx, wayOut) {
     const refusal = new CheckpointError(verdict.code, diagnostic === undefined ? verdict.sentence : `${verdict.sentence} Diagnostic: ${diagnostic}`, verdict.reason === undefined ? undefined : { reason: verdict.reason });
-    return checkpointRefusalAnswer(refusal, { gate: "policy_ask", retriable: resumeRefusalDisposition(refusal) === "retriable", versionKeys: refusalVersionKeys(refusal, ctx) });
+    return checkpointRefusalAnswer(refusal, { gate: "policy_ask", retriable: resumeRefusalDisposition(refusal) === "retriable", versionKeys: refusalVersionKeys(refusal, ctx), ...(wayOut !== undefined ? { wayOut } : {}) });
+}
+export async function rowWayOutOf(seat, kind) {
+    switch (kind) {
+        case "lacking":
+            return "newer_worker";
+        case "damaged":
+            try {
+                return (await cancelSettlesCard(seat.cs, seat.runs, seat.token)) ? "cancel_run" : undefined;
+            }
+            catch (e) {
+                seat.logger?.warn?.("row_way_out_probe_failed", { note: "the store could not answer whether cancel would settle this card — no wayOut offered", err: errorText(e) });
+                return undefined;
+            }
+        default: {
+            const unhandled = kind;
+            throw new Error(`row verdict ${String(unhandled)} has no way out`);
+        }
+    }
+}
+async function loadedRowWayOut(cp, seat) {
+    const verdict = judgeCheckpointRow(cp);
+    return verdict.kind === "ok" ? undefined : rowWayOutOf(seat, verdict.kind);
+}
+async function loadedRowRefusal(cp, seat, writer) {
+    const verdict = judgeCheckpointRow(cp);
+    if (verdict.kind === "ok")
+        return undefined;
+    return rowRefusalAnswer(verdict, undefined, verdict.code === "checkpoint.unsupported_version" ? await writer() : {}, await rowWayOutOf(seat, verdict.kind));
+}
+export async function rowReadRefusalAnswer(e, seat) {
+    if (e instanceof UnreadableCheckpointRowError && e.rowVerdict.kind !== "ok")
+        return rowRefusalAnswer(e.rowVerdict, errorText(e), {}, seat === undefined ? undefined : await rowWayOutOf(seat, e.rowVerdict.kind));
+    return { status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: errorText(e) }) };
 }
 function refusalVersionKeys(e, ctx) {
     return e.code === "checkpoint.unsupported_version" ? buildCheckpointVersionKeys(ctx.writerVersion, serviceVersion()) : {};
@@ -239,6 +289,7 @@ export function checkpointRefusalAnswer(e, at) {
                     : {}),
                 ...at.versionKeys,
                 ...(e.code === "resume.constraint_rejected" ? acceptableFormFacts(detail) : {}),
+                ...(at.wayOut !== undefined ? { wayOut: at.wayOut } : {}),
             },
         }),
     }, at.retriable);
@@ -249,9 +300,9 @@ export function decidedActionOf(binding) {
     return missingKeys.length === 0 ? { action: { boundCallId: boundCallId, boundInputHash: boundInputHash } } : { missingKeys };
 }
 export function createResumeLegs(ctx) {
-    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
+    const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const ctxOpening = (sessionId) => ({ sessionId, opener: deps.checkpointCtxSealing });
-    const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
+    const resumeFleetScope = (req, auth) => req ? (gatedSubject(req, deps.config) ?? "default") : (auth.subject ?? "default");
     function createRememberIntent(sessionId, remember) {
         let pending;
         return {
@@ -302,8 +353,7 @@ export function createResumeLegs(ctx) {
                     return null;
                 });
                 const curPa = cur?.pendingAction;
-                const curOwner = cur ? decodeCheckpointScope(cur.scope) : undefined;
-                const scopeOk = cur !== null && (decider.explicitOperator || curOwner === undefined || curOwner === decider.principal);
+                const scopeOk = cur != null && (await decisionRowAdmits(cs, token, decider, cur.scope));
                 if (cur && cur.sessionId === sessionId && !scopeOk) {
                     deps.logger?.info?.("approval_decide_no_pending", { sessionId, staleTokenEchoed: true, foreignCurrentSuppressed: true });
                     return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
@@ -323,10 +373,23 @@ export function createResumeLegs(ctx) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
         const cpPromise = cs.get(token);
-        const ctxPromise = cs.getCtx(sessionId);
+        const runSessionPromise = cs.hostSessionOfCard(token).then((id) => (typeof id === "string" ? { kind: "owned", id } : { kind: "unowned" }), (e) => ({ kind: "failed", failure: resumeStoreFailureOf(e) }));
+        const runCtxOf = async () => {
+            const owner = await runSessionPromise;
+            if (owner.kind === "unowned")
+                return undefined;
+            const read = owner.kind === "failed" ? owner.failure : await readResumeCtx(cs.getCtx(owner.id), ctxOpening(owner.id));
+            if (read.kind === "corrupt")
+                return { refusal: resumeCtxCorruptAnswer(read.where) };
+            if (read.kind === "unsealable")
+                return { refusal: resumeCtxUnsealableAnswer(read) };
+            if (read.kind === "unreadable")
+                return { refusal: resumeCtxUnreadableAnswer() };
+            return owner.kind === "owned" ? { runSessionId: owner.id, ctx: read.kind === "ok" ? read.ctx : null } : undefined;
+        };
+        const ctxPromise = runCtxOf();
         void ctxPromise.catch(() => { });
         const noApproval = { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
-        const rowOwnRefusal = async (verdict, diagnostic) => rowRefusalAnswer(verdict, diagnostic, verdict.code === "checkpoint.unsupported_version" ? ((await ctxPromise.catch(() => null)) ?? {}) : {});
         let cp;
         try {
             cp = await cpPromise;
@@ -337,31 +400,28 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("approval_decide_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return noApproval;
             }
-            if (e instanceof UnreadableCheckpointRowError && e.rowVerdict.kind !== "ok")
-                return rowOwnRefusal(e.rowVerdict, errorText(e));
-            return { status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: errorText(e) }) };
+            return rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger });
         }
         if (!cp) {
             if (!(await mayDiscloseRowError(cs, token, decider)))
                 return noApproval;
             return { status: 404, body: refusalBody({ errorCode: "not_found.checkpoint", message: "checkpoint not found" }) };
         }
-        if (decider !== undefined && !decider.explicitOperator) {
-            const cpOwner = decodeCheckpointScope(cp.scope);
-            if (cpOwner !== undefined && cpOwner !== decider.principal) {
-                deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
-                return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
-            }
+        if (!(await decisionRowAdmits(cs, token, decider, cp.scope))) {
+            deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
+            return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
+        const rowOwn = await loadedRowRefusal(cp, { cs, runs: deps.runStore, token, logger: deps.logger }, () => ctxPromise.then((r) => (r !== undefined && "ctx" in r ? (r.ctx ?? {}) : {}), () => ({})));
+        if (rowOwn !== undefined)
+            return rowOwn;
         const decideGateKind = cp.gate?.kind;
         if (!isApprovalGateKind(decideGateKind)) {
-            const verdict = judgeCheckpointRow(cp);
-            if (verdict.kind !== "ok")
-                return rowOwnRefusal(verdict);
             if (typeof decideGateKind !== "string" || decideGateKind === "") {
                 return { status: 409, body: refusalBody({ errorCode: "gate_not_tool_approval", message: "task is suspended on a gate whose kind this engine cannot read, so it cannot say which endpoint resolves it" }) };
             }
-            const activeForPath = await deps.runStore?.getActiveTaskId(sessionId).catch(() => undefined);
+            const ownerForPath = await runSessionPromise;
+            const runSessionForPath = ownerForPath.kind === "owned" ? ownerForPath.id : undefined;
+            const activeForPath = typeof runSessionForPath === "string" ? await deps.runStore?.getActiveTaskId(runSessionForPath).catch(() => undefined) : undefined;
             const gnPath = activeForPath ? resumeEntryForGate(decideGateKind, { sessionId, taskId: activeForPath }) : null;
             return {
                 status: 409,
@@ -432,10 +492,10 @@ export function createResumeLegs(ctx) {
             noteLateSettleIfAccepted(committed);
             return intent === undefined ? out : { ...out, rememberApplied: await intent.settle(committed) };
         };
-        const parkedForkQuotaDenial = req !== undefined ? ownerCostQuotaDenied(decodeCheckpointScope(cp.scope)) : undefined;
+        const parkedForkQuotaDenial = req !== undefined ? ownerCostQuotaDenied(checkpointPartsOf(cp.scope)?.person) : undefined;
         if (parkedForkQuotaDenial)
             return parkedForkQuotaDenial;
-        const parkedForkLeaseDenial = req !== undefined ? await ownerFleetLeaseDenied(decodeCheckpointScope(cp.scope)) : undefined;
+        const parkedForkLeaseDenial = req !== undefined ? await ownerFleetLeaseDenied(checkpointPartsOf(cp.scope)?.person) : undefined;
         if (parkedForkLeaseDenial)
             return parkedForkLeaseDenial;
         const ownerLeaseAdmittedHere = req !== undefined;
@@ -460,21 +520,22 @@ export function createResumeLegs(ctx) {
                 ...(boundGrant && intent ? { remember: { anchor: (rootSessionId) => boundGrant(rootSessionId), laneCannotRecord: intent.laneCannotRecord } } : {}),
             };
             if (origin?.kind === "background" && parkedAgentStore !== undefined && parkedSurface !== undefined) {
-                const parked = await withPrincipal(decodeCheckpointScope(cp.scope), () => decideParkedAgent({
+                const parked = await withSubject(checkpointPartsOf(cp.scope)?.subject, () => decideParkedAgent({
                     agentStore: parkedAgentStore,
                     checkpointStore: cs,
                     registry: defaultTaskRegistry,
                     reviveSurface: parkedSurface,
-                    ...(deps.parkedKnownAgentTypes ? { knownAgentTypes: deps.parkedKnownAgentTypes } : {}),
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
                     execution: {
-                        resolve: async (root) => {
+                        resolve: async (root, face) => {
                             let ctx;
                             try {
-                                ctx = await resolveExecutionContext(deps, { kind: "continuation", root, principal: decodeCheckpointScope(cp.scope) });
+                                ctx = await resolveBeforeClaim(deps, { kind: "continuation", root, principal: checkpointPartsOf(cp.scope)?.person }, face);
                             }
                             catch (e) {
+                                if (e instanceof ClaimFaultAnswer)
+                                    return { ok: false, gone: false, answer: e.answer };
                                 if (isRootSessionGoneError(e))
                                     return { ok: false, gone: true };
                                 if (e instanceof HttpError)
@@ -507,12 +568,15 @@ export function createResumeLegs(ctx) {
                 const plan = planWorkflowParkedDecide(origin, parkedReq);
                 if (!plan.ok)
                     return plan.deny;
+                const fingerprint = parkDecisionFingerprint(plan.outcome, restatement);
+                const live = await deliverToHoldingRun(origin, { token, outcome: plan.outcome, decision: parkedReq.decision, fingerprint, restated: restatement !== undefined });
+                if (live.kind === "answered")
+                    return live.answer;
                 const decisions = deps.workflowParkDecisions;
                 const runStore = deps.runStore;
                 if (decisions === undefined || runStore === undefined) {
                     return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
                 }
-                const fingerprint = parkDecisionFingerprint(plan.outcome, restatement);
                 const liveReceiptOf = async (held) => {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
@@ -523,44 +587,65 @@ export function createResumeLegs(ctx) {
                 if (replay !== undefined)
                     return replay;
                 let recordFailure;
+                const answerOfRecordFailure = async (failed) => {
+                    if (failed.kind === "faulted")
+                        return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+                    try {
+                        return await refusalAfterLostClaim(deps, runStore, plan.hostSessionId, failed.deliveredTaskId);
+                    }
+                    catch (e) {
+                        return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+                    }
+                };
                 const delivery = {
                     carried: [{ runId: plan.runId, token, outcome: plan.outcome }],
                     commitBeforeLaunch: async (deliveredTaskId) => {
+                        let recorded;
                         try {
-                            const recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
-                            if (!recorded)
-                                throw new Error(DELIVERY_NOT_RECORDED);
+                            recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
                         }
                         catch (err) {
-                            recordFailure = { err };
+                            recordFailure = { kind: "faulted", err };
                             throw err;
                         }
+                        if (!recorded) {
+                            recordFailure = { kind: "not_recorded", deliveredTaskId };
+                            throw new Error(DELIVERY_NOT_RECORDED);
+                        }
                     },
                 };
                 const hostToken = await cs
                     .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
                     .catch(() => undefined);
                 const admittedPayer = decodeCheckpointScope(cp.scope);
-                const out = hostToken
-                    ? await resumeWake(plan.hostSessionId, plan.message, decider?.principal, req, acceptEarly, delivery, admittedPayer, restatement)
-                    : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
-                if (recordFailure !== undefined)
-                    throw recordFailure.err;
+                let out;
+                try {
+                    out = hostToken
+                        ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
+                        : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
+                }
+                catch (err) {
+                    const failed = recordFailure;
+                    if (failed === undefined)
+                        throw err;
+                    return await answerOfRecordFailure(failed);
+                }
+                const failed = recordFailure;
+                if (failed !== undefined)
+                    return await answerOfRecordFailure(failed);
                 if (acceptedTaskIdOf(out) === undefined)
                     return (await liveReceiptOf(await decisions.get(token))) ?? out;
                 return out;
             }
         }
-        const ctxRead0 = await readResumeCtx(ctxPromise, ctxOpening(sessionId));
-        if (ctxRead0.kind === "corrupt")
-            return resumeCtxCorruptAnswer(ctxRead0.where);
-        if (ctxRead0.kind === "unsealable")
-            return resumeCtxUnsealableAnswer(ctxRead0);
-        const storedCtx = ctxRead0.kind === "ok" ? ctxRead0.ctx : null;
-        if (!storedCtx)
+        const runCtx = await ctxPromise;
+        if (runCtx !== undefined && "refusal" in runCtx)
+            return runCtx.refusal;
+        if (runCtx === undefined || runCtx.ctx === null)
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
+        const { runSessionId, ctx: storedCtx } = runCtx;
         const ctx = restateResumeCtx(storedCtx, restatement);
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
+        const auth = { sessionId: runSessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -586,8 +671,10 @@ export function createResumeLegs(ctx) {
                 ...(answer !== undefined ? { answer } : {}),
                 hostDecision,
             };
-            const verifyRounds = verifyRoundsFromBody(ctx.body);
-            const driven = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...captureSelectedGate() }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
+            const composition = resumeCompositionOf(ctx.body, cp, deps.config.cascadeLadder);
+            if (composition?.entry === "cascade_unlinked")
+                return compositionUnlinkedAnswer();
+            const driven = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId: runSessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...captureSelectedGate() }, composition, resumeCtx: { sessionId: runSessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
             return await landAfterCommit(driven);
         }
         finally {
@@ -598,7 +685,7 @@ export function createResumeLegs(ctx) {
     const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
     const resolveResumeSpec = async (ctx, req, auth, lease) => {
         const engineNotices = [];
-        const execution = await resolveExecutionContext(deps, { kind: "continuation", root: auth.sessionId, principal: auth.principal });
+        const execution = await resolveBeforeClaim(deps, { kind: "continuation", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)) }, CONTINUATION_CLAIM_FACE);
         const resolved = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
@@ -608,7 +695,7 @@ export function createResumeLegs(ctx) {
         });
         const legFacts = legFactsOf(resolved);
         const runner = runnerFor(resolved);
-        const spec = stampSpecRoot(resolved, execution);
+        const spec = stampSpecRoot(resolved, execution, { use: "session", requireExistingSession: ctx.body.requireExistingSession });
         return { spec, runner, legFacts, engineNotices, execution };
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
@@ -626,6 +713,8 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             lease.release();
+            if (e instanceof ClaimFaultAnswer)
+                return { ok: false, answer: e.answer };
             if (e instanceof HttpError) {
                 return { ok: false, answer: resumeRefusalWithCard(resumeAssemblyRefusalAnswer(e.status, httpErrorRefusal(e)), true) };
             }
@@ -654,13 +743,30 @@ export function createResumeLegs(ctx) {
     }
     async function driveResumeLeg(args, onAccepted) {
         const resumeLegStartedAt = Date.now();
-        const { runner: legRunner, token, sessionId, principal, fleetScope, taskConfig, resumeObjective, outcome, verifyRounds, resumeCtx, execution } = args;
+        const { runner: legRunner, token, sessionId, subject, fleetScope, taskConfig, resumeObjective, outcome, composition, resumeCtx, execution } = args;
+        const legSubject = recoveredSubject(subject);
+        const payer = legSubject === undefined ? undefined : personOf(legSubject);
         const heldObjective = objectiveWithheldIn(resumeCtx.ctx) ? undefined : resumeObjective;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
-        const commitResumeCtx = () => Promise.resolve().then(() => deps.checkpointStore.putCtx(resumeCtx.sessionId, sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId))).catch((e) => {
+        const commitResumePark = (runStore, runId, word, parkResult, cardToken) => {
+            if (heldLeg === undefined)
+                throw new Error(`resume leg: run ${runId} parked without the holding leg its claim handed back — the park cannot be committed`);
+            return commitParkRow({
+                runStore, taskId: runId, word, result: parkResult, card: { token: cardToken, sessionId }, cards: deps.checkpointStore, leg: "resume",
+                legId: heldLeg, staleWindowMs: deps.config?.runStaleSec === undefined ? undefined : deps.config.runStaleSec * 1000,
+            });
+        };
+        const resumeCtxNotPersisted = (why) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
-            deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: errorText(e), note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one — its permission mode is never wider than this leg's, but if this leg restated its MCP / A2A peer tables (mcpServers / a2aPeers on the resume request), a later continuation that does not restate them runs with the previous tables again" });
-        });
+            deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: why, note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one — its permission mode is never wider than this leg's, but if this leg restated its MCP / A2A peer tables (mcpServers / a2aPeers on the resume request), a later continuation that does not restate them runs with the previous tables again" });
+        };
+        const commitResumeCtx = () => Promise.resolve().then(async () => {
+            const sealed = sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId);
+            const claim = claimedRow && taskId !== undefined && deps.runStore !== undefined ? { fence: deps.runStore, taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) } : undefined;
+            const landed = await deps.checkpointStore.putCtx(resumeCtx.sessionId, sealed, claim);
+            if (landed === "claim_released")
+                resumeCtxNotPersisted("claim_released: this run no longer holds the session claim (settled or reaped before the write-back landed) — nothing written");
+        }).catch((e) => resumeCtxNotPersisted(errorText(e)));
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
             toolApprovalEnabled: Boolean(deps.toolApproval),
@@ -677,38 +783,58 @@ export function createResumeLegs(ctx) {
             declaredFamilies: declaredApprovalFrameFamilies(resumeCtx.ctx.body.settings),
         });
         const legDeadlineMonotonic = approvalLeg.legDeadlineMonotonic;
-        const ownerQuotaDenial = args.callerInitiated === true ? ownerCostQuotaDenied(principal) : undefined;
+        const ownerQuotaDenial = args.callerInitiated === true ? ownerCostQuotaDenied(payer) : undefined;
         if (ownerQuotaDenial)
             return ownerQuotaDenial;
-        const ownerLeaseDenial = args.callerInitiated === true && args.ownerLeaseAdmitted !== true ? await ownerFleetLeaseDenied(principal) : undefined;
+        const ownerLeaseDenial = args.callerInitiated === true && args.ownerLeaseAdmitted !== true ? await ownerFleetLeaseDenied(payer) : undefined;
         if (ownerLeaseDenial)
             return ownerLeaseDenial;
         const heldDecisions = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
         let taskId = await deps.runStore?.getActiveTaskId(sessionId);
         let freshRunClaimed = false;
+        let heldLeg;
+        let legClaim;
+        let engineHandedOff = false;
+        let restored;
+        const cancelledInClaimWindow = () => restored?.kind === "ended" && restored.row?.errorCode === CANCELLED_CODE;
         if (args.mintFreshRun && taskId && deps.runStore) {
-            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, taskId) };
+            return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, taskId) };
         }
         if (!taskId && args.mintFreshRun && deps.runStore) {
             const freshId = uuidv7();
-            const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(freshId, sessionId, principal ?? null, deps.instanceId ?? "default", {
-                source: args.mintFreshRun.source,
-                identity: args.mintFreshRun.identity,
-                objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
-            }));
+            let created;
+            try {
+                created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(freshId, sessionId, subject ?? null, deps.instanceId ?? "default", {
+                    source: args.mintFreshRun.source,
+                    identity: args.mintFreshRun.identity,
+                    objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
+                }));
+            }
+            catch (e) {
+                return resumeClaimFaultAnswerOf(e);
+            }
             if (created.existing) {
                 throw new Error(`wake fresh run: createRun observed an existing row for the freshly minted taskId ${freshId} (no idempotency key was sent) — refusing to treat it as a busy session`);
             }
             if (created.sessionAbsent)
                 return rootSessionAbsentAnswer();
             if (!created.ok) {
-                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, runStaleSec: deps.config.runStaleSec, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+                return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
+            }
+            legClaim = { kind: "run", runStore: deps.runStore, taskId: freshId, legId: created.legId };
+            let placementReject;
+            try {
+                const refusal = await commitExecutionContext(deps, legClaim, execution);
+                placementReject = refusal === null ? null : CONTINUATION_CLAIM_FACE.refused(refusal);
+            }
+            catch (e) {
+                placementReject = resumeClaimFaultAnswerOf(e);
             }
-            const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: freshId }, execution);
             if (placementReject)
                 return placementReject;
             taskId = freshId;
             freshRunClaimed = true;
+            heldLeg = created.legId;
         }
         const fleetPub = taskId && deps.fleetBus
             ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(heldObjective) })
@@ -717,12 +843,12 @@ export function createResumeLegs(ctx) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.unattended
-                ? toolApproval.boundUnattendedAsk({ owner: principal ?? null, taskId, sessionId, executionLane: execution.lane }, approvalLeg.unattended)
+                ? toolApproval.boundUnattendedAsk({ owner: subject ?? null, taskId, sessionId, ...approvalLegOriginOf(execution) }, approvalLeg.unattended)
                 : toolApproval.boundAsk({
-                    owner: principal ?? null,
+                    owner: subject ?? null,
                     taskId,
                     sessionId,
-                    executionLane: execution.lane,
+                    ...approvalLegOriginOf(execution),
                     ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
                 });
         }
@@ -751,16 +877,15 @@ export function createResumeLegs(ctx) {
             }
         };
         const settleCardForCancel = async () => {
+            if (freshRunClaimed)
+                return false;
             const cs2 = deps.checkpointStore;
             if (!cs2)
                 return false;
             try {
-                const live = await cs2.get(token);
-                if (live?.status !== "pending")
-                    return false;
-                if (await cs2.expire(token, live.scope))
+                if ((await expireCardUnderStoredScope(cs2, token)) === CARD_EXPIRE_OUTCOME.expired)
                     return true;
-                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                deps.logger?.info?.("resume_cancel_checkpoint_not_settled", { taskId, sessionId });
                 return false;
             }
             catch (cancelSettleErr) {
@@ -786,26 +911,52 @@ export function createResumeLegs(ctx) {
         let resumeLegLive = false;
         const subagentHandleEvictions = [];
         let claimedRow = false;
-        const cancelCtrl = createRunAbort(principal ?? null);
+        const cancelCtrl = createRunAbort(subject ?? null);
         let cancelLedgerAppend;
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
-            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
+            if (freshRunClaimed)
+                claimedRow = true;
+            else {
+                try {
+                    heldLeg = await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
+                }
+                catch (e) {
+                    return resumeClaimFaultAnswerOf(e);
+                }
+                claimedRow = heldLeg !== undefined;
+            }
             if (!claimedRow)
                 return notResumableAnswer();
+            inflightRuns.set(taskId, cancelCtrl);
             if (!freshRunClaimed) {
-                const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId }, execution);
-                if (placementReject)
-                    return placementReject;
+                const rs0 = deps.runStore;
+                const claimedTask = taskId;
+                const restoreClaim = async () => {
+                    restored = await commitResumePark(rs0, claimedTask, reparkStatus, null, token);
+                };
+                legClaim = { kind: "resumed", runStore: rs0, taskId: claimedTask, restore: restoreClaim };
+                let placementReject;
+                try {
+                    const refusal = await commitExecutionContext(deps, legClaim, execution);
+                    placementReject = refusal === null ? null : CONTINUATION_CLAIM_FACE.refused(refusal);
+                }
+                catch (e) {
+                    placementReject = resumeClaimFaultAnswerOf(e);
+                }
+                if (placementReject) {
+                    if (inflightRuns.get(claimedTask) === cancelCtrl)
+                        inflightRuns.delete(claimedTask);
+                    return cancelledInClaimWindow() ? { status: 200, body: { taskId: claimedTask, sessionId, status: "failed", errorCode: "cancelled" } } : placementReject;
+                }
             }
-            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, principal);
+            markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, subject);
             fleetPub?.onStart();
             const rs = deps.runStore;
-            const owner = principal ?? null;
-            inflightRuns.set(taskId, cancelCtrl);
+            const owner = subject ?? null;
             preemptableRuns.set(taskId, preemptCtrl);
             resumeHeartbeat = setInterval(() => {
-                void rs.heartbeat(taskId, owner).catch(() => undefined);
+                beatRunHeartbeat(rs, taskId, owner, () => cancelCtrl.abort("stall_verdict"), () => undefined);
                 if (!cancelCtrl.signal.aborted) {
                     void rs.isCancelRequested(taskId, owner).then((c) => { if (c)
                         cancelCtrl.abort("cancel_verb"); }).catch(() => undefined);
@@ -831,15 +982,19 @@ export function createResumeLegs(ctx) {
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
+        const handToEngine = (start) => {
+            engineHandedOff = true;
+            return start();
+        };
         try {
             const instructionLeg = createInstructionSelectionLeg();
             const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: args.legFacts?.skills });
-            result = await instructionLeg.run(sessionId, () => withModelReachScope({ sessionId, taskId }, () => withPrincipal(principal, async () => {
+            result = await instructionLeg.run(sessionId, () => withModelReachScope({ sessionId, taskId }, () => withSubject(legSubject, async () => {
                 const resumeNotifiedKeys = new NotifiedKeys();
                 if (deps.runStore && taskId) {
                     const rs0 = deps.runStore;
                     let drainSeq = (await rs0.maxSeq(taskId)) + 1;
-                    await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, sessionId, principal ?? null, (frame) => {
+                    await emitPendingWorkflowCompletions(deps.workflowCompletionInbox, sessionId, subject ?? null, (frame) => {
                         const { type, ...rest } = frame;
                         const f = frame;
                         const write = rs0.appendEvent(taskId, drainSeq++, type, rest);
@@ -849,7 +1004,22 @@ export function createResumeLegs(ctx) {
                         return write;
                     }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
-                if (verifyRounds !== undefined) {
+                const openEngineNoticePort = async (append) => {
+                    unregisterEngineNotice = registerEngineNoticeLeg({
+                        sessionId,
+                        ...(taskId !== undefined ? { taskId } : {}),
+                        durable: (row) => append("engine_notice", row).then(() => true, (err) => {
+                            recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
+                            deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
+                            return false;
+                        }),
+                    });
+                    for (const notice of args.engineNotices ?? [])
+                        await defaultEngineNoticeRouter.routeConfirmed(notice);
+                    if (deps.userInputLedger && taskId)
+                        await deps.userInputLedger.announceUndrained({ sessionId, taskId });
+                };
+                if (composition !== undefined) {
                     const rsV = deps.runStore;
                     const vSeqBase = rsV && taskId ? await rsV.maxSeq(taskId) : 0;
                     const verifySink = createLedgerSink({
@@ -861,9 +1031,11 @@ export function createResumeLegs(ctx) {
                     });
                     const vAppend = (type, data) => verifySink.append(type, data);
                     cancelLedgerAppend = vAppend;
+                    await openEngineNoticePort(vAppend);
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...launchInternals,
+                        ...compositionLegRoot(args.legFacts?.registeredCwd),
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -891,7 +1063,7 @@ export function createResumeLegs(ctx) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume-verify", taskId: n.task_id, taskType: n.task_type, status: n.status, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, subject ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume-verify", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationDedupKey(n);
@@ -909,10 +1081,23 @@ export function createResumeLegs(ctx) {
                             : {}),
                     };
                     resumeLegLive = true;
-                    const vrEngine = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
+                    const legSpec = { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal };
+                    let vrEngine;
+                    switch (composition.entry) {
+                        case "verify":
+                            vrEngine = await handToEngine(() => resumeWithVerification(legRunner, token, outcome, legSpec, resumeObjective, composition.rounds, verifyInternals));
+                            break;
+                        case "cascade":
+                            vrEngine = await handToEngine(() => resumeCascade(legRunner, token, outcome, stampSpecRoot({ ...legSpec, ...composition.objectiveInputs, objective: resumeObjective }, execution, { use: "ladder_host" }), composition.config, composition.parkedLeg, verifyInternals));
+                            break;
+                        default: {
+                            const unhandled = composition;
+                            throw new Error(`unhandled resume composition: ${JSON.stringify(unhandled)}`);
+                        }
+                    }
                     const vrCause = cancelCtrl.cause();
                     await voidVerifierPauseCard(vrEngine, legRunner);
-                    const vrJudged = atHostBoundary(vrEngine, sessionId);
+                    const vrJudged = atHostBoundary(vrEngine);
                     if (vrJudged.terminal.kind === "paused")
                         heldPark = vrJudged;
                     const vrMinted = vrCause !== undefined && taskId !== undefined ? mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", engineResult: vrJudged, cause: vrCause }) : vrJudged;
@@ -940,8 +1125,9 @@ export function createResumeLegs(ctx) {
                             }
                         }
                         catch (e) {
-                            if (!vrReopened)
+                            if (!reSuspended && !vrReopened)
                                 throw e;
+                            recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-park-projection ${errorText(e)}`);
                         }
                     }
                     if (reSuspended)
@@ -960,18 +1146,8 @@ export function createResumeLegs(ctx) {
                 const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 cancelLedgerAppend = append;
-                unregisterEngineNotice = registerEngineNoticeLeg({
-                    sessionId,
-                    ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
-                    durable: (row) => append("engine_notice", row).then(() => true, (err) => {
-                        recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
-                        deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
-                        return false;
-                    }),
-                });
-                if (deps.userInputLedger && taskId)
-                    await deps.userInputLedger.announceUndrained({ sessionId, taskId });
-                const anchorOwner = principal ?? null;
+                await openEngineNoticePort(append);
+                const anchorOwner = subject ?? null;
                 const headOf = headReadOf(deps.sessionStorage);
                 const captureTurnAnchor = deps.resumeAnchorStore && headOf
                     ? async (eventId) => { const leaf = (await headOf(sessionId))?.leafId; if (leaf)
@@ -998,7 +1174,7 @@ export function createResumeLegs(ctx) {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const resumeWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.legFacts?.sessionWitness);
-                    const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
+                    const stream = await handToEngine(() => legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         ...launchInternals,
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -1037,7 +1213,7 @@ export function createResumeLegs(ctx) {
                             const parked = !resumeLegLive && Boolean(deps.workflowCompletionInbox && sessionId);
                             deps.logger?.info?.("task_notification_observed", { route: "resume", taskId: n.task_id, taskType: n.task_type, status: n.status, legLive: resumeLegLive, parkedDurable: parked });
                             if (parked) {
-                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, principal ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
+                                void deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(sessionId, subject ?? null, n, Date.now(), taskId, opts?.priority)).catch((err) => deps.logger?.warn?.("park_enqueue_failed", { route: "resume", taskId: n.task_id, err: err instanceof Error ? err.message : String(err) }));
                             }
                             else if (resumeLegLive) {
                                 const key = taskNotificationDedupKey(n);
@@ -1053,7 +1229,7 @@ export function createResumeLegs(ctx) {
                                 },
                             }
                             : {}),
-                    });
+                    }));
                     await commitResumeCtx();
                     resumeStreamRef = stream;
                     if (taskId)
@@ -1211,11 +1387,7 @@ export function createResumeLegs(ctx) {
                     const settledLeg = await reopenedAfterLeg(r, causeAtDone !== undefined);
                     if (settledLeg.reopened) {
                         reopenConfirmedPark = true;
-                        try {
-                            await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, reparkStatus, r, failureCodeOf(r.terminal) ?? null);
-                        }
-                        catch {
-                        }
+                        await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, reparkStatus, r, failureCodeOf(r.terminal) ?? null);
                         return r;
                     }
                     const safe = await attachModelUsage(sealResultForExit(settledLeg.leg), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -1227,25 +1399,22 @@ export function createResumeLegs(ctx) {
                     }
                     return safe;
                 };
-                const approvalEmit = (frame) => {
-                    const { type, ...rest } = frame;
-                    return append(type, rest);
-                };
+                const hitlTransport = createHitlTransport({ ledger: append });
                 const withApproval = () => deps.toolApproval && taskId && approvalLeg.active && approvalLeg.unattended === undefined
                     ? deps.toolApproval.runWithContext({
                         taskId,
-                        owner: principal ?? null,
+                        owner: subject ?? null,
                         abortSignal: cancelCtrl.signal,
                         sessionId,
-                        executionLane: execution.lane,
-                        emitCard: createApprovalCardEmitter({ appendDurable: (f) => approvalEmit(f) }),
-                        emitRevoke: (f) => approvalEmit(f),
+                        ...approvalLegOriginOf(execution),
+                        family: "approval_request",
+                        transport: hitlTransport,
                         legKey,
                         ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}),
                     }, driveResume)
                     : driveResume();
                 const withElicitation = () => deps.elicitation && taskId
-                    ? deps.elicitation.runWithContext({ taskId, owner: principal ?? null, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); }, abortSignal: cancelCtrl.signal }, withApproval)
+                    ? deps.elicitation.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withApproval)
                     : withApproval();
                 return await (deps.sendUserFile && taskId
                     ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
@@ -1269,6 +1438,7 @@ export function createResumeLegs(ctx) {
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
                 }
                 const retriable = disposition === "retriable";
+                let reparkEnded = false;
                 if (claimedRow && taskId && deps.runStore) {
                     if (retriable && freshRunClaimed) {
                         const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0, usageMissing: true } };
@@ -1278,15 +1448,17 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                     else if (retriable) {
-                        await (reparkStatus === "needs_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
-                        settleFleet(reparkStatus);
+                        const parked = await commitResumePark(deps.runStore, taskId, reparkStatus, null, token);
+                        reparkEnded = parked.kind === "ended";
+                        settleFleet(reparkEnded ? "failed" : reparkStatus);
                     }
                     else {
                         await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
                         settleFleet("failed");
                     }
                 }
-                return checkpointRefusalAnswer(e, { gate: outcome.gate, retriable, ...(taskId !== undefined ? { taskId } : {}), versionKeys: refusalVersionKeys(e, resumeCtx.ctx) });
+                const answerRetriable = retriable && !reparkEnded;
+                return checkpointRefusalAnswer(e, { gate: outcome.gate, retriable: answerRetriable, ...(taskId !== undefined ? { taskId } : {}), versionKeys: refusalVersionKeys(e, resumeCtx.ctx), ...(answerRetriable && args.rowWayOut !== undefined ? { wayOut: args.rowWayOut } : {}) });
             }
             const thrownCause = cancelCtrl.cause();
             if (thrownCause !== undefined) {
@@ -1299,12 +1471,28 @@ export function createResumeLegs(ctx) {
                 settleFleet("failed");
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
             }
-            if (claimedRow && taskId && deps.runStore) {
-                await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
-                await deps.runStore.setTerminal(taskId, "failed", null, errorText(e)).catch(() => undefined);
+            if (!engineHandedOff && legClaim !== undefined) {
+                const claim = legClaim;
+                await withdrawClaim(deps, claim, `the resume could not be handed to the engine: ${outwardThrownMessage(e, errorText(e))}`, "faulted");
+                const parkedAgain = claim.kind === "resumed" && restored?.kind !== "ended";
+                settleFleet(parkedAgain ? reparkStatus : "failed");
+                if (cancelledInClaimWindow())
+                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                return resumeClaimFaultAnswerOf(e);
             }
-            settleFleet("failed");
-            throw e;
+            const heldParkWord = heldPark === undefined ? undefined : heldParkOf(heldPark);
+            if (!(claimedRow && taskId && deps.runStore && heldPark !== undefined && heldParkWord !== undefined)) {
+                if (claimedRow && taskId && deps.runStore) {
+                    await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
+                    await deps.runStore.setTerminal(taskId, "failed", null, outwardThrownMessage(e, errorText(e))).catch(() => undefined);
+                }
+                settleFleet("failed");
+                throw e;
+            }
+            recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-park-held ${errorText(e)}`);
+            if (cancelLedgerAppend !== undefined)
+                await appendParkRow(cancelLedgerAppend, { modelUsage: deps.modelUsage, taskId }, heldParkWord.word, await graftParkToolCallId(heldPark, deps.checkpointStore));
+            result = heldPark;
         }
         finally {
             unregisterEngineNotice?.();
@@ -1329,31 +1517,38 @@ export function createResumeLegs(ctx) {
         const checkpointReopened = reopenConfirmedPark;
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
+        let parkEnded;
         if (taskId && deps.runStore) {
-            if (checkpointReopened && reparkStatus === "needs_review")
-                await deps.runStore.setNeedsReview(taskId, null);
-            else if (resumePlane.status === "suspended" || checkpointReopened)
-                await deps.runStore.setSuspended(taskId, sealed.terminal.kind === "paused" ? sealed : null);
-            else if (resumePlane.status === "needs_review")
-                await deps.runStore.setNeedsReview(taskId, sealed);
+            const park = checkpointReopened && reparkStatus === "needs_review" ? { word: "needs_review", result: null }
+                : resumePlane.status === "suspended" || checkpointReopened ? { word: "suspended", result: sealed.terminal.kind === "paused" ? sealed : null }
+                    : resumePlane.status === "needs_review" ? { word: "needs_review", result: sealed }
+                        : undefined;
+            if (park !== undefined) {
+                const parked = await commitResumePark(deps.runStore, taskId, park.word, park.result, heldPark?.terminal.kind === "paused" ? heldPark.terminal.token : token);
+                if (parked.kind === "ended")
+                    parkEnded = { row: parked.row };
+            }
             else
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed));
+        settleFleet(parkEnded !== undefined ? "failed" : checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed, sealed ? failureCodeOf(sealed.terminal) : undefined));
+        const answered = parkEnded !== undefined
+            ? { status: parkEnded.row?.status ?? "failed", errorCode: parkEnded.row?.errorCode ?? undefined, errorMessage: parkEnded.row?.error ?? undefined }
+            : { status: resumePlane.status, errorCode: resumePlane.errorCode, errorMessage: resumePlane.errorMessage };
         return {
             status: 200,
             body: {
-                taskId, sessionId, status: resumePlane.status,
+                taskId, sessionId, status: answered.status,
                 bindingEnforced: true,
-                ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
-                ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
-                ...(checkpointReopened ? { retriable: true } : {}),
+                ...(answered.errorCode ? { errorCode: answered.errorCode } : {}),
+                ...(answered.errorMessage ? { errorMessage: redactErrorMessage(answered.errorMessage) ?? "" } : {}),
+                ...(checkpointReopened && parkEnded === undefined ? { retriable: true } : {}),
                 ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
             },
         };
     }
     async function mayDiscloseRowError(cs, token, decider) {
-        if (decider === undefined || decider.explicitOperator)
+        if (decider === undefined || decider.operator)
             return true;
         let scope;
         try {
@@ -1365,24 +1560,28 @@ export function createResumeLegs(ctx) {
         }
         if (scope === undefined)
             return false;
-        const owner = decodeCheckpointScope(scope ?? CHECKPOINT_PUBLIC_SCOPE);
-        return owner === undefined || owner === decider.principal;
+        return keyAdmits("scope.decide", decider, scopeCellOf(scope ?? CHECKPOINT_PUBLIC_SCOPE));
+    }
+    async function decisionRowAdmits(cs, token, who, bodyScope) {
+        if (who === undefined)
+            return true;
+        const cell = bodyScope === undefined ? undefined : scopeCellOf(bodyScope);
+        return cell !== undefined ? keyAdmits("scope.decide", who, cell) : mayDiscloseRowError(cs, token, who);
     }
     async function resumePreempted(sessionId, req, acceptEarly, decider, restatement) {
         const cs = deps.checkpointStore;
         const RESUMABLE_GATE_KIND = "resource_limit";
-        const preemptBinding = { gateKinds: [RESUMABLE_GATE_KIND] };
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, preemptBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
+        const preemptBinding = { gateKinds: [RESUMABLE_GATE_KIND], axis: "run" };
+        const token = (await cs.findPendingTokenBySession(sessionId, undefined, preemptBinding)) ?? (await cs.findPendingTokenBySession(sessionId, undefined, { axis: "run" }));
         const noSuspension = { status: 404, body: refusalBody({ errorCode: "not_found.suspension", message: "no resumable suspension for this task (already running, resumed, or expired)" }) };
         if (!token)
             return noSuspension;
-        if (decider !== undefined && !decider.explicitOperator) {
+        if (decider !== undefined && !decider.operator) {
             const peeked = await cs
                 .peekPendingScope(sessionId, preemptBinding)
-                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
+                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId, { axis: "run" }) : sc))
                 .catch(() => undefined);
-            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
-            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
+            if (!keyAdmits("scope.decide", decider, scopeCellOf(peeked ?? CHECKPOINT_PUBLIC_SCOPE))) {
                 deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
                 return noSuspension;
             }
@@ -1396,14 +1595,14 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("assistant_resume_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return noSuspension;
             }
-            return { status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: e instanceof Error ? e.message : String(e) }) };
+            return rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger });
         }
         if (!cp) {
             if (!(await mayDiscloseRowError(cs, token, decider)))
                 return noSuspension;
             return { status: 404, body: refusalBody({ errorCode: "not_found.checkpoint", message: "checkpoint not found" }) };
         }
-        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
+        if (decider !== undefined && !keyAdmits("scope.decide", decider, scopeCellOf(cp.scope))) {
             deps.logger?.warn?.("assistant_resume_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
             return noSuspension;
         }
@@ -1416,25 +1615,30 @@ export function createResumeLegs(ctx) {
             return resumeCtxCorruptAnswer(ctxRead.where);
         if (ctxRead.kind === "unsealable")
             return resumeCtxUnsealableAnswer(ctxRead);
+        if (ctxRead.kind === "unreadable")
+            return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const ctx = restateResumeCtx(ctxRead.ctx, restatement);
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
+        const auth = { sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
         try {
             const { spec, engineNotices } = resolved;
             const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const composition = resumeCompositionOf(ctx.body, cp, deps.config.cascadeLadder);
+            if (composition?.entry === "cascade_unlinked")
+                return compositionUnlinkedAnswer();
             const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
-            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            const rowWayOut = await loadedRowWayOut(cp, { cs, runs: deps.runStore, token, logger: deps.logger });
+            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx }, ...(rowWayOut !== undefined ? { rowWayOut } : {}), ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         }
         finally {
             resolved.peerLease.release();
         }
     }
-    async function startFreshHostTurn(sessionId, objective, principal, req, workflowDecision, runId, restatement) {
+    async function startFreshHostTurn(sessionId, objective, subject, req, workflowDecision, runId, restatement) {
         const cs = deps.checkpointStore;
         if (!deps.runStore) {
             return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
@@ -1444,6 +1648,8 @@ export function createResumeLegs(ctx) {
             return resumeCtxCorruptAnswer(ctxRead.where);
         if (ctxRead.kind === "unsealable")
             return resumeCtxUnsealableAnswer(ctxRead);
+        if (ctxRead.kind === "unreadable")
+            return resumeCtxUnreadableAnswer();
         const storedCtx = ctxRead.kind === "ok" ? ctxRead.ctx : null;
         if (!storedCtx) {
             return {
@@ -1459,10 +1665,10 @@ export function createResumeLegs(ctx) {
             };
         }
         const ctx = restateResumeCtx(storedCtx, restatement);
-        const windowDenial = await usageWindowDenialFor(principal || GLOBAL_USAGE_KEY);
+        const windowDenial = await usageWindowDenialFor(subject === undefined ? undefined : personOf(recoveredSubject(subject)));
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
-        const auth = { sessionId, principal, memoryScope: ctx.memoryScope };
+        const auth = { sessionId, subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1470,12 +1676,13 @@ export function createResumeLegs(ctx) {
             const { spec, engineNotices } = resolved;
             const hostSpec = { ...spec, objective };
             const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), seat: createSubmissionSeat({ deployment: deps.config }), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
                 fleetScope: resumeFleetScope(req, auth),
-                elicitOwner: principal ?? null,
+                elicitOwner: subject ?? null,
                 source: "workflow_parked_decide",
-                identity: runIdentityOf(req, deps.config, principal ?? null),
+                identity: runIdentityOf(req, deps.config, subject ?? null),
                 workflowDecision,
+                face: CONTINUATION_CLAIM_FACE,
             });
             if (out.existing) {
                 throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
@@ -1495,11 +1702,10 @@ export function createResumeLegs(ctx) {
         const token = (await cs.findPendingTokenBySession(sessionId, undefined, wakeBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
         if (!token)
             return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
-        const operator = explicitOperatorOk(caller, deps.config);
-        if (!operator) {
+        const who = { subject: caller, operator: explicitOperatorOk(caller === undefined ? undefined : personOf(caller), deps.config) };
+        if (!who.operator) {
             const scope = await cs.peekPendingScope(sessionId, wakeBinding).then((s) => (s === undefined ? cs.peekPendingScope(sessionId) : s)).catch(() => undefined);
-            const decodedScope = scope != null ? decodeCheckpointScope(scope) : undefined;
-            if (decodedScope !== undefined && decodedScope !== caller) {
+            if (!keyAdmits("scope.decide", who, scopeCellOf(scope ?? CHECKPOINT_PUBLIC_SCOPE))) {
                 return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
             }
         }
@@ -1508,19 +1714,19 @@ export function createResumeLegs(ctx) {
             cp = await cs.get(token);
         }
         catch (e) {
-            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
+            if (!(await mayDiscloseRowError(cs, token, who))) {
                 deps.logger?.warn?.("wake_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
             }
-            return { status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: e instanceof Error ? e.message : String(e) }) };
+            return rowReadRefusalAnswer(e, undefined);
         }
         if (!cp) {
-            if (!(await mayDiscloseRowError(cs, token, { principal: caller, explicitOperator: operator }))) {
+            if (!(await mayDiscloseRowError(cs, token, who))) {
                 return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
             }
             return { status: 404, body: refusalBody({ errorCode: "not_found.checkpoint", message: "checkpoint not found" }) };
         }
-        if (!operator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== caller) {
+        if (!keyAdmits("scope.decide", who, scopeCellOf(cp.scope))) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
         }
         const gateKind = cp.gate?.kind;
@@ -1543,10 +1749,12 @@ export function createResumeLegs(ctx) {
             return resumeCtxCorruptAnswer(ctxRead.where);
         if (ctxRead.kind === "unsealable")
             return resumeCtxUnsealableAnswer(ctxRead);
+        if (ctxRead.kind === "unreadable")
+            return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const ctx = restateResumeCtx(ctxRead.ctx, restatement);
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
+        const auth = { sessionId: cp.sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1560,20 +1768,20 @@ export function createResumeLegs(ctx) {
                 legFacts: resolved.legFacts,
                 token,
                 sessionId: cp.sessionId,
-                principal: auth.principal,
+                subject: auth.subject,
                 fleetScope: resumeFleetScope(req, auth),
                 taskConfig,
                 resumeObjective,
                 outcome: { gate: "wake", ...(message !== undefined ? { message } : {}) },
                 commitment: { kind: "delivered" },
-                verifyRounds: undefined,
+                composition: undefined,
                 resumeCtx: { sessionId, ctx },
-                mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.principal ?? null) },
+                mintFreshRun: { source: "wake", identity: runIdentityOf(req, deps.config, auth.subject ?? null) },
                 ...(workflowDecision !== undefined ? { workflowDecision } : {}),
                 ...(engineNotices.length > 0 ? { engineNotices } : {}),
                 ...(acceptEarly === true ? { acceptEarly: true } : {}),
                 ...(req !== undefined ? { callerInitiated: true } : {}),
-                ...(ownerLeaseAdmittedFor !== undefined && auth.principal === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
+                ...(ownerLeaseAdmittedFor !== undefined && auth.subject === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
             });
         }
         finally {
@@ -1589,20 +1797,19 @@ export function createResumeLegs(ctx) {
             ...(log?.principalPresent !== undefined ? { principalPresent: log.principalPresent } : {}),
         });
         const PLAN_REVIEW_GATE_KIND = "plan_review";
-        const planReviewBinding = { gateKinds: [PLAN_REVIEW_GATE_KIND] };
-        const token = (await cs.findPendingTokenBySession(sessionId, undefined, planReviewBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
+        const planReviewBinding = { gateKinds: [PLAN_REVIEW_GATE_KIND], axis: "run" };
+        const token = (await cs.findPendingTokenBySession(sessionId, undefined, planReviewBinding)) ?? (await cs.findPendingTokenBySession(sessionId, undefined, { axis: "run" }));
         const noPending = { status: 404, body: refusalBody({ errorCode: "not_found.plan_review", message: "no pending plan_review for this session (already decided or expired)" }) };
         if (!token) {
             log404("no-pending-checkpoint");
             return refuse(noPending);
         }
-        if (decider !== undefined && !decider.explicitOperator) {
+        if (decider !== undefined && !decider.operator) {
             const peeked = await cs
                 .peekPendingScope(sessionId, planReviewBinding)
-                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId) : sc))
+                .then((sc) => (sc === undefined ? cs.peekPendingScope(sessionId, { axis: "run" }) : sc))
                 .catch(() => undefined);
-            const peekedOwner = peeked != null ? decodeCheckpointScope(peeked) : undefined;
-            if (peekedOwner !== undefined && peekedOwner !== decider.principal) {
+            if (!keyAdmits("scope.decide", decider, scopeCellOf(peeked ?? CHECKPOINT_PUBLIC_SCOPE))) {
                 deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "pending row is foreign to the verified caller — owner gate ahead of the row load" });
                 return refuse(noPending);
             }
@@ -1616,7 +1823,7 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("plan_review_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return refuse(noPending);
             }
-            return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: e instanceof Error ? e.message : String(e) }) });
+            return refuse(await rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger }));
         }
         if (!cp) {
             log404("checkpoint-missing");
@@ -1624,7 +1831,7 @@ export function createResumeLegs(ctx) {
                 return refuse(noPending);
             return refuse({ status: 404, body: refusalBody({ errorCode: "not_found.checkpoint", message: "checkpoint not found" }) });
         }
-        if (decider !== undefined && !decider.explicitOperator && cp.scope !== CHECKPOINT_PUBLIC_SCOPE && cp.scope !== decider.principal) {
+        if (decider !== undefined && !keyAdmits("scope.decide", decider, scopeCellOf(cp.scope))) {
             deps.logger?.warn?.("plan_review_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
             return refuse(noPending);
         }
@@ -1650,6 +1857,8 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxCorruptAnswer(ctxRead.where));
         if (ctxRead.kind === "unsealable")
             return refuse(resumeCtxUnsealableAnswer(ctxRead));
+        if (ctxRead.kind === "unreadable")
+            return refuse(resumeCtxUnreadableAnswer());
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) });
         const ctx = restateResumeCtx(ctxRead.ctx, restatement);
@@ -1660,9 +1869,9 @@ export function createResumeLegs(ctx) {
     }
     async function drivePlanReview(prepared, decision, editedPlan, reason, hostDecision, req, acceptEarly, permissionModeAfter) {
         const { sessionId, token, cp, ctx } = prepared;
-        if ((await deps.checkpointStore.findPendingTokenBySession(sessionId, undefined, { gateKinds: ["plan_review"] })) !== token)
+        if ((await deps.checkpointStore.findPendingTokenBySession(sessionId, undefined, { gateKinds: ["plan_review"], axis: "run" })) !== token)
             return notResumableAnswer();
-        const auth = { sessionId: cp.sessionId, principal: decodeCheckpointScope(cp.scope), memoryScope: ctx.memoryScope };
+        const auth = { sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const effMode = storedBodyPermissionMode(ctx.body);
         if (permissionModeAfter !== undefined && effMode !== "plan") {
             throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
@@ -1675,7 +1884,9 @@ export function createResumeLegs(ctx) {
         try {
             const { spec, engineNotices } = resolved;
             const { objective: resumeObjective, sessionId: _sessionId, ...taskConfig } = spec;
-            const verifyRounds = verifyRoundsFromBody(ctx.body);
+            const composition = resumeCompositionOf(ctx.body, cp, deps.config.cascadeLadder);
+            if (composition?.entry === "cascade_unlinked")
+                return compositionUnlinkedAnswer();
             const outcome = {
                 gate: "plan_review",
                 decision,
@@ -1684,7 +1895,8 @@ export function createResumeLegs(ctx) {
                 hostDecision,
             };
             const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
-            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, verifyRounds, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            const rowWayOut = await loadedRowWayOut(cp, { cs: deps.checkpointStore, runs: deps.runStore, token, logger: deps.logger });
+            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(rowWayOut !== undefined ? { rowWayOut } : {}), ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
             return out;
         }
         finally {
@@ -1700,10 +1912,10 @@ export function createResumeLegs(ctx) {
     const routeCtxBase = {
         deps,
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
-        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview, sessionNotify: sessionNotifyDoor },
     };
-    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor };
+    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor };
 }
 //# sourceMappingURL=resume-legs.js.map