@sema-agent/server 7.148.0 → 7.150.0

package/dist/http/resume-legs.js

@@ -3,18 +3,19 @@ import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
 import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
-import { headReadOf } from "../session-incarnation.js";
+import { runFactsOf, sealRouteDeps, sessionFactsReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { keyAdmits } from "../owner-faces.js";
 import { personOf } from "../owner-brands.js";
 import { recoveredSubject } from "../owner-faces.js";
-import { beatRunHeartbeat, graftParkToolCallId, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { commitParkRow } from "../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
-import { buildCancelledLedgerRow, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
-import { isTerminalRunStatus, runProvenElsewhere } from "../plugins/store-contracts.js";
+import { buildCancelledLedgerRow, CANCELLED_CODE, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
+import { createLegCtxClaim, isTerminalRunStatus } from "../plugins/store-contracts.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -27,15 +28,19 @@ import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
 import { serviceVersion } from "../service-version.js";
 import { TERMINAL_PARK_GATE_KINDS, UnreadableCheckpointRowError } from "../plugins/checkpoint-store-face.js";
+import { cancelSettlesCard } from "../run-cancel-card.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../card-settle-stored-scope.js";
 import { withSubject } from "../observability/principal-context.js";
 import { withModelReachScope } from "../model-reach-scope.js";
+import { approvalLegOriginOf } from "../approval-leg-origin.js";
 import { legFactsOf } from "../leg-facts.js";
+import { compositionLegRoot } from "../task-cwd.js";
 import { createInstructionSelectionLeg } from "../instruction-selection.js";
 import { modelTextEventData, appendParkRow, turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskStartedEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, compactionStartedEventData, workspaceChangedEventData, wiringManifestEventData, toolRosterDeltaEventData, toolDisclosureEventData, humanInputEventData, appendModelUsageDelta, attachModelUsage, createPromptManifestSeat } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { buildRunObjectivePreview } from "../user-authored-text.js";
 import { createForwardAppendFailedNote, createLedgerSink, createSerialLedgerAppend } from "../trace/ledger-sink.js";
-import { registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
+import { defaultEngineNoticeRouter, registerEngineNoticeLeg } from "../trace/engine-notice-wire.js";
 import { blockText, reasoningDeltaBytes, reasoningSegmentEventId } from "../trace/model-segment.js";
 import { errorText } from "../observability/err-text.js";
 import { recordFailOpen } from "../observability/fail-open.js";
@@ -52,15 +57,16 @@ import { createImagesLocal } from "./routes/images.js";
 import { createCapabilitiesLocal } from "./routes/capabilities.js";
 import { gatedSubject, explicitOperatorOk, runIdentityOf } from "./principal-gate.js";
 import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflict.js";
-import { commitExecutionContext, isRootSessionGoneError, resolveExecutionContext, rootSessionAbsentAnswer, stampSpecRoot } from "./execution-context.js";
+import { refusalAfterLostClaim } from "./claim-heartbeat.js";
+import { CONTINUATION_CLAIM_FACE, ClaimFaultAnswer, commitExecutionContext, faultedAnswerOf, isRootSessionGoneError, resolveBeforeClaim, rootSessionAbsentAnswer, stampSpecRoot, withdrawClaim } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
 import { commitSessionInheritEnv } from "./session-inherit-env.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
-import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer, resumeStoreReadFailureOf } from "./resume-ctx-read.js";
+import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer, resumeStoreFailureOf } from "./resume-ctx-read.js";
 import { objectiveWithheldIn } from "./submit-ctx.js";
-import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
@@ -204,6 +210,9 @@ function decisionRefusalCauseOf(e, gate) {
 function notResumableAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.not_resumable", message: "run is not in a resumable (suspended) state (already resumed, decided, or expired)" }) };
 }
+function resumeClaimFaultAnswerOf(e) {
+    return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+}
 function approvalStaleAnswer(facts) {
     return {
         status: 409,
@@ -217,13 +226,41 @@ function approvalStaleAnswer(facts) {
         }),
     };
 }
-function rowRefusalAnswer(verdict, diagnostic, ctx) {
+function rowRefusalAnswer(verdict, diagnostic, ctx, wayOut) {
     const refusal = new CheckpointError(verdict.code, diagnostic === undefined ? verdict.sentence : `${verdict.sentence} Diagnostic: ${diagnostic}`, verdict.reason === undefined ? undefined : { reason: verdict.reason });
-    return checkpointRefusalAnswer(refusal, { gate: "policy_ask", retriable: resumeRefusalDisposition(refusal) === "retriable", versionKeys: refusalVersionKeys(refusal, ctx) });
+    return checkpointRefusalAnswer(refusal, { gate: "policy_ask", retriable: resumeRefusalDisposition(refusal) === "retriable", versionKeys: refusalVersionKeys(refusal, ctx), ...(wayOut !== undefined ? { wayOut } : {}) });
+}
+export async function rowWayOutOf(seat, kind) {
+    switch (kind) {
+        case "lacking":
+            return "newer_worker";
+        case "damaged":
+            try {
+                return (await cancelSettlesCard(seat.cs, seat.runs, seat.token)) ? "cancel_run" : undefined;
+            }
+            catch (e) {
+                seat.logger?.warn?.("row_way_out_probe_failed", { note: "the store could not answer whether cancel would settle this card — no wayOut offered", err: errorText(e) });
+                return undefined;
+            }
+        default: {
+            const unhandled = kind;
+            throw new Error(`row verdict ${String(unhandled)} has no way out`);
+        }
+    }
+}
+async function loadedRowWayOut(cp, seat) {
+    const verdict = judgeCheckpointRow(cp);
+    return verdict.kind === "ok" ? undefined : rowWayOutOf(seat, verdict.kind);
+}
+async function loadedRowRefusal(cp, seat, writer) {
+    const verdict = judgeCheckpointRow(cp);
+    if (verdict.kind === "ok")
+        return undefined;
+    return rowRefusalAnswer(verdict, undefined, verdict.code === "checkpoint.unsupported_version" ? await writer() : {}, await rowWayOutOf(seat, verdict.kind));
 }
-export function rowReadRefusalAnswer(e) {
+export async function rowReadRefusalAnswer(e, seat) {
     if (e instanceof UnreadableCheckpointRowError && e.rowVerdict.kind !== "ok")
-        return rowRefusalAnswer(e.rowVerdict, errorText(e), {});
+        return rowRefusalAnswer(e.rowVerdict, errorText(e), {}, seat === undefined ? undefined : await rowWayOutOf(seat, e.rowVerdict.kind));
     return { status: 409, body: refusalBody({ errorCode: "conflict.checkpoint_unreadable", message: errorText(e) }) };
 }
 function refusalVersionKeys(e, ctx) {
@@ -252,6 +289,7 @@ export function checkpointRefusalAnswer(e, at) {
                     : {}),
                 ...at.versionKeys,
                 ...(e.code === "resume.constraint_rejected" ? acceptableFormFacts(detail) : {}),
+                ...(at.wayOut !== undefined ? { wayOut: at.wayOut } : {}),
             },
         }),
     }, at.retriable);
@@ -335,7 +373,7 @@ export function createResumeLegs(ctx) {
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
         const cpPromise = cs.get(token);
-        const runSessionPromise = cs.hostSessionOfCard(token).then((id) => (typeof id === "string" ? { kind: "owned", id } : { kind: "unowned" }), (e) => ({ kind: "failed", failure: resumeStoreReadFailureOf(e) }));
+        const runSessionPromise = cs.hostSessionOfCard(token).then((id) => (typeof id === "string" ? { kind: "owned", id } : { kind: "unowned" }), (e) => ({ kind: "failed", failure: resumeStoreFailureOf(e) }));
         const runCtxOf = async () => {
             const owner = await runSessionPromise;
             if (owner.kind === "unowned")
@@ -352,7 +390,6 @@ export function createResumeLegs(ctx) {
         const ctxPromise = runCtxOf();
         void ctxPromise.catch(() => { });
         const noApproval = { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
-        const rowOwnRefusal = async (verdict) => rowRefusalAnswer(verdict, undefined, verdict.code === "checkpoint.unsupported_version" ? await ctxPromise.then((r) => (r !== undefined && "ctx" in r ? (r.ctx ?? {}) : {}), () => ({})) : {});
         let cp;
         try {
             cp = await cpPromise;
@@ -363,7 +400,7 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("approval_decide_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return noApproval;
             }
-            return rowReadRefusalAnswer(e);
+            return rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger });
         }
         if (!cp) {
             if (!(await mayDiscloseRowError(cs, token, decider)))
@@ -374,9 +411,9 @@ export function createResumeLegs(ctx) {
             deps.logger?.warn?.("approval_decide_row_scope_mismatch", { sessionId, note: "loaded pending row is foreign to the verified caller — TOCTOU fold" });
             return { status: 404, body: refusalBody({ errorCode: "not_found.approval", message: "approval not found" }) };
         }
-        const verdict = judgeCheckpointRow(cp);
-        if (verdict.kind !== "ok")
-            return rowOwnRefusal(verdict);
+        const rowOwn = await loadedRowRefusal(cp, { cs, runs: deps.runStore, token, logger: deps.logger }, () => ctxPromise.then((r) => (r !== undefined && "ctx" in r ? (r.ctx ?? {}) : {}), () => ({})));
+        if (rowOwn !== undefined)
+            return rowOwn;
         const decideGateKind = cp.gate?.kind;
         if (!isApprovalGateKind(decideGateKind)) {
             if (typeof decideGateKind !== "string" || decideGateKind === "") {
@@ -491,12 +528,14 @@ export function createResumeLegs(ctx) {
                     ...(deps.parkedReviveInheritedGate ? { rebuildInheritedGate: deps.parkedReviveInheritedGate } : {}),
                     ...(deps.toolApproval ? { approverSeatFor: windowZeroSeatOf(deps.toolApproval) } : {}),
                     execution: {
-                        resolve: async (root) => {
+                        resolve: async (root, face) => {
                             let ctx;
                             try {
-                                ctx = await resolveExecutionContext(deps, { kind: "continuation", root, principal: checkpointPartsOf(cp.scope)?.person });
+                                ctx = await resolveBeforeClaim(deps, { kind: "continuation", root, principal: checkpointPartsOf(cp.scope)?.person }, face);
                             }
                             catch (e) {
+                                if (e instanceof ClaimFaultAnswer)
+                                    return { ok: false, gone: false, answer: e.answer };
                                 if (isRootSessionGoneError(e))
                                     return { ok: false, gone: true };
                                 if (e instanceof HttpError)
@@ -541,36 +580,59 @@ export function createResumeLegs(ctx) {
                 const liveReceiptOf = async (held) => {
                     if (held === null || held.fingerprint !== fingerprint)
                         return undefined;
-                    const run = await runStore.getRun(held.deliveredTaskId);
+                    const run = await runFactsOf(runStore, held.deliveredTaskId);
                     return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
                 };
                 const replay = await liveReceiptOf(await decisions.get(token));
                 if (replay !== undefined)
                     return replay;
                 let recordFailure;
+                const answerOfRecordFailure = async (failed) => {
+                    if (failed.kind === "faulted")
+                        return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+                    try {
+                        return await refusalAfterLostClaim(deps, runStore, plan.hostSessionId, failed.deliveredTaskId);
+                    }
+                    catch (e) {
+                        return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+                    }
+                };
                 const delivery = {
                     carried: [{ runId: plan.runId, token, outcome: plan.outcome }],
                     commitBeforeLaunch: async (deliveredTaskId) => {
+                        let recorded;
                         try {
-                            const recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
-                            if (!recorded)
-                                throw new Error(DELIVERY_NOT_RECORDED);
+                            recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
                         }
                         catch (err) {
-                            recordFailure = { err };
+                            recordFailure = { kind: "faulted", err };
                             throw err;
                         }
+                        if (!recorded) {
+                            recordFailure = { kind: "not_recorded", deliveredTaskId };
+                            throw new Error(DELIVERY_NOT_RECORDED);
+                        }
                     },
                 };
                 const hostToken = await cs
                     .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
                     .catch(() => undefined);
                 const admittedPayer = decodeCheckpointScope(cp.scope);
-                const out = hostToken
-                    ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
-                    : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
-                if (recordFailure !== undefined)
-                    throw recordFailure.err;
+                let out;
+                try {
+                    out = hostToken
+                        ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
+                        : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
+                }
+                catch (err) {
+                    const failed = recordFailure;
+                    if (failed === undefined)
+                        throw err;
+                    return await answerOfRecordFailure(failed);
+                }
+                const failed = recordFailure;
+                if (failed !== undefined)
+                    return await answerOfRecordFailure(failed);
                 if (acceptedTaskIdOf(out) === undefined)
                     return (await liveReceiptOf(await decisions.get(token))) ?? out;
                 return out;
@@ -623,17 +685,18 @@ export function createResumeLegs(ctx) {
     const ONE_SHOT_SUBMIT_STRIP = Object.fromEntries(ONE_SHOT_SUBMIT_KEYS.map((k) => [k, undefined]));
     const resolveResumeSpec = async (ctx, req, auth, lease) => {
         const engineNotices = [];
-        const execution = await resolveExecutionContext(deps, { kind: "continuation", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)) });
+        const execution = await resolveBeforeClaim(deps, { kind: "continuation", root: auth.sessionId, principal: auth.subject === undefined ? undefined : personOf(recoveredSubject(auth.subject)) }, CONTINUATION_CLAIM_FACE);
         const resolved = await deps.resolveSpec({ ...ctx.body, ...ONE_SHOT_SUBMIT_STRIP }, req, auth, {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+            ...(ctx.projectContext !== undefined ? { projectContext: ctx.projectContext } : {}),
             lease,
             execution,
         });
         const legFacts = legFactsOf(resolved);
         const runner = runnerFor(resolved);
-        const spec = stampSpecRoot(resolved, execution, ctx.body);
+        const spec = stampSpecRoot(resolved, execution, { use: "session", requireExistingSession: ctx.body.requireExistingSession });
         return { spec, runner, legFacts, engineNotices, execution };
     };
     const refuseStoredBodyReplay = (sessionId, refusal) => {
@@ -651,6 +714,8 @@ export function createResumeLegs(ctx) {
         }
         catch (e) {
             lease.release();
+            if (e instanceof ClaimFaultAnswer)
+                return { ok: false, answer: e.answer };
             if (e instanceof HttpError) {
                 return { ok: false, answer: resumeRefusalWithCard(resumeAssemblyRefusalAnswer(e.status, httpErrorRefusal(e)), true) };
             }
@@ -684,16 +749,24 @@ export function createResumeLegs(ctx) {
         const payer = legSubject === undefined ? undefined : personOf(legSubject);
         const heldObjective = objectiveWithheldIn(resumeCtx.ctx) ? undefined : resumeObjective;
         const reparkStatus = outcome.gate === "plan_review" ? "needs_review" : "suspended";
+        const commitResumePark = (runStore, runId, word, parkResult, cardToken) => {
+            if (heldLeg === undefined)
+                throw new Error(`resume leg: run ${runId} parked without the holding leg its claim handed back — the park cannot be committed`);
+            return commitParkRow({
+                runStore, taskId: runId, word, result: parkResult, card: { token: cardToken, sessionId }, cards: deps.checkpointStore, leg: "resume",
+                legId: heldLeg, staleWindowMs: deps.config?.runStaleSec === undefined ? undefined : deps.config.runStaleSec * 1000,
+            });
+        };
         const resumeCtxNotPersisted = (why) => {
             deps.metrics?.inc("resume_ctx_not_persisted_total");
             deps.logger?.warn?.("resume_ctx_not_persisted", { sessionId: resumeCtx.sessionId, gate: outcome.gate, error: why, note: "this continuation runs with the body it was given; the durable rebuild input still holds the PREVIOUS body, so the NEXT continuation of this session rebuilds from that one — its permission mode is never wider than this leg's, but if this leg restated its MCP / A2A peer tables (mcpServers / a2aPeers on the resume request), a later continuation that does not restate them runs with the previous tables again" });
         };
         const commitResumeCtx = () => Promise.resolve().then(async () => {
             const sealed = sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId);
-            const claim = claimedRow && taskId !== undefined && deps.runStore !== undefined ? { fence: deps.runStore, taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) } : undefined;
+            const claim = heldLeg !== undefined && taskId !== undefined && deps.runStore !== undefined ? createLegCtxClaim(deps.runStore, taskId, heldLeg) : undefined;
             const landed = await deps.checkpointStore.putCtx(resumeCtx.sessionId, sealed, claim);
             if (landed === "claim_released")
-                resumeCtxNotPersisted("claim_released: this run no longer holds the session claim (settled or reaped before the write-back landed) — nothing written");
+                resumeCtxNotPersisted("claim_released: this leg no longer holds the run (settled, reaped, or claimed again by a later leg before the write-back landed) — nothing written");
         }).catch((e) => resumeCtxNotPersisted(errorText(e)));
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
@@ -720,16 +793,27 @@ export function createResumeLegs(ctx) {
         const heldDecisions = await heldWorkflowParkDecisions(deps, sessionId, args.workflowDecision?.carried);
         let taskId = await deps.runStore?.getActiveTaskId(sessionId);
         let freshRunClaimed = false;
+        let heldLeg;
+        let legClaim;
+        let engineHandedOff = false;
+        let restored;
+        const cancelledInClaimWindow = () => restored?.kind === "ended" && restored.row?.errorCode === CANCELLED_CODE;
         if (args.mintFreshRun && taskId && deps.runStore) {
             return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, taskId) };
         }
         if (!taskId && args.mintFreshRun && deps.runStore) {
             const freshId = uuidv7();
-            const created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(freshId, sessionId, subject ?? null, deps.instanceId ?? "default", {
-                source: args.mintFreshRun.source,
-                identity: args.mintFreshRun.identity,
-                objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
-            }));
+            let created;
+            try {
+                created = await timeClaim(deps.metrics, "run_claim", deps.runStore.createRun(freshId, sessionId, subject ?? null, deps.instanceId ?? "default", {
+                    source: args.mintFreshRun.source,
+                    identity: args.mintFreshRun.identity,
+                    objectivePreview: heldObjective === undefined ? null : buildRunObjectivePreview(heldObjective),
+                }));
+            }
+            catch (e) {
+                return resumeClaimFaultAnswerOf(e);
+            }
             if (created.existing) {
                 throw new Error(`wake fresh run: createRun observed an existing row for the freshly minted taskId ${freshId} (no idempotency key was sent) — refusing to treat it as a busy session`);
             }
@@ -738,11 +822,20 @@ export function createResumeLegs(ctx) {
             if (!created.ok) {
                 return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, created.activeTaskId) };
             }
-            const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId: freshId }, execution);
+            legClaim = { kind: "run", runStore: deps.runStore, taskId: freshId, legId: created.legId };
+            let placementReject;
+            try {
+                const refusal = await commitExecutionContext(deps, legClaim, execution);
+                placementReject = refusal === null ? null : CONTINUATION_CLAIM_FACE.refused(refusal);
+            }
+            catch (e) {
+                placementReject = resumeClaimFaultAnswerOf(e);
+            }
             if (placementReject)
                 return placementReject;
             taskId = freshId;
             freshRunClaimed = true;
+            heldLeg = created.legId;
         }
         const fleetPub = taskId && deps.fleetBus
             ? fleetRunPublisher(deps.fleetBus, { runId: taskId, scope: fleetScope, rootTaskId: taskId, sessionId, ...fleetRunLabels(heldObjective) })
@@ -751,12 +844,12 @@ export function createResumeLegs(ctx) {
         if (deps.toolApproval && taskId) {
             const toolApproval = deps.toolApproval;
             resumeTaskConfig.onAsk = approvalLeg.unattended
-                ? toolApproval.boundUnattendedAsk({ owner: subject ?? null, taskId, sessionId, executionLane: execution.lane }, approvalLeg.unattended)
+                ? toolApproval.boundUnattendedAsk({ owner: subject ?? null, taskId, sessionId, ...approvalLegOriginOf(execution) }, approvalLeg.unattended)
                 : toolApproval.boundAsk({
                     owner: subject ?? null,
                     taskId,
                     sessionId,
-                    executionLane: execution.lane,
+                    ...approvalLegOriginOf(execution),
                     ...(approvalLeg.active ? { legKey, ...(legDeadlineMonotonic !== undefined ? { legDeadlineMonotonic } : {}) } : {}),
                 });
         }
@@ -791,12 +884,9 @@ export function createResumeLegs(ctx) {
             if (!cs2)
                 return false;
             try {
-                const live = await cs2.get(token);
-                if (live?.status !== "pending")
-                    return false;
-                if (await cs2.expire(token, live.scope))
+                if ((await expireCardUnderStoredScope(cs2, token)) === CARD_EXPIRE_OUTCOME.expired)
                     return true;
-                deps.logger?.warn?.("resume_cancel_checkpoint_settle_lost", { taskId, sessionId });
+                deps.logger?.info?.("resume_cancel_checkpoint_not_settled", { taskId, sessionId });
                 return false;
             }
             catch (cancelSettleErr) {
@@ -826,19 +916,45 @@ export function createResumeLegs(ctx) {
         let cancelLedgerAppend;
         const preemptCtrl = new AbortController();
         if (taskId && deps.runStore) {
-            claimedRow = freshRunClaimed ? true : await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
+            if (freshRunClaimed)
+                claimedRow = true;
+            else {
+                try {
+                    heldLeg = await deps.runStore.markResuming(taskId, deps.instanceId ?? "default");
+                }
+                catch (e) {
+                    return resumeClaimFaultAnswerOf(e);
+                }
+                claimedRow = heldLeg !== undefined;
+            }
             if (!claimedRow)
                 return notResumableAnswer();
+            inflightRuns.set(taskId, cancelCtrl);
             if (!freshRunClaimed) {
-                const placementReject = await commitExecutionContext(deps, { kind: "run", runStore: deps.runStore, taskId }, execution);
-                if (placementReject)
-                    return placementReject;
+                const rs0 = deps.runStore;
+                const claimedTask = taskId;
+                const restoreClaim = async () => {
+                    restored = await commitResumePark(rs0, claimedTask, reparkStatus, null, token);
+                };
+                legClaim = { kind: "resumed", runStore: rs0, taskId: claimedTask, restore: restoreClaim };
+                let placementReject;
+                try {
+                    const refusal = await commitExecutionContext(deps, legClaim, execution);
+                    placementReject = refusal === null ? null : CONTINUATION_CLAIM_FACE.refused(refusal);
+                }
+                catch (e) {
+                    placementReject = resumeClaimFaultAnswerOf(e);
+                }
+                if (placementReject) {
+                    if (inflightRuns.get(claimedTask) === cancelCtrl)
+                        inflightRuns.delete(claimedTask);
+                    return cancelledInClaimWindow() ? { status: 200, body: { taskId: claimedTask, sessionId, status: "failed", errorCode: "cancelled" } } : placementReject;
+                }
             }
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, subject);
             fleetPub?.onStart();
             const rs = deps.runStore;
             const owner = subject ?? null;
-            inflightRuns.set(taskId, cancelCtrl);
             preemptableRuns.set(taskId, preemptCtrl);
             resumeHeartbeat = setInterval(() => {
                 beatRunHeartbeat(rs, taskId, owner, () => cancelCtrl.abort("stall_verdict"), () => undefined);
@@ -867,6 +983,10 @@ export function createResumeLegs(ctx) {
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
+        const handToEngine = (start) => {
+            engineHandedOff = true;
+            return start();
+        };
         try {
             const instructionLeg = createInstructionSelectionLeg();
             const legWiringSections = () => ({ instructions: instructionLeg.segment(), skills: args.legFacts?.skills });
@@ -885,6 +1005,21 @@ export function createResumeLegs(ctx) {
                         return write;
                     }, { route: "resume-open", connection: "durable-append", log: (m, x) => deps.logger?.info?.(m, x) });
                 }
+                const openEngineNoticePort = async (append) => {
+                    unregisterEngineNotice = registerEngineNoticeLeg({
+                        sessionId,
+                        ...(taskId !== undefined ? { taskId } : {}),
+                        durable: (row) => append("engine_notice", row).then(() => true, (err) => {
+                            recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
+                            deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
+                            return false;
+                        }),
+                    });
+                    for (const notice of args.engineNotices ?? [])
+                        await defaultEngineNoticeRouter.routeConfirmed(notice);
+                    if (deps.userInputLedger && taskId)
+                        await deps.userInputLedger.announceUndrained({ sessionId, taskId });
+                };
                 if (composition !== undefined) {
                     const rsV = deps.runStore;
                     const vSeqBase = rsV && taskId ? await rsV.maxSeq(taskId) : 0;
@@ -897,9 +1032,11 @@ export function createResumeLegs(ctx) {
                     });
                     const vAppend = (type, data) => verifySink.append(type, data);
                     cancelLedgerAppend = vAppend;
+                    await openEngineNoticePort(vAppend);
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...launchInternals,
+                        ...compositionLegRoot(args.legFacts?.registeredCwd),
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -949,10 +1086,10 @@ export function createResumeLegs(ctx) {
                     let vrEngine;
                     switch (composition.entry) {
                         case "verify":
-                            vrEngine = await resumeWithVerification(legRunner, token, outcome, legSpec, resumeObjective, composition.rounds, verifyInternals);
+                            vrEngine = await handToEngine(() => resumeWithVerification(legRunner, token, outcome, legSpec, resumeObjective, composition.rounds, verifyInternals));
                             break;
                         case "cascade":
-                            vrEngine = await resumeCascade(legRunner, token, outcome, stampSpecRoot({ ...legSpec, ...composition.objectiveInputs, objective: resumeObjective }, execution, resumeCtx.ctx.body), composition.config, composition.parkedLeg, verifyInternals);
+                            vrEngine = await handToEngine(() => resumeCascade(legRunner, token, outcome, stampSpecRoot({ ...legSpec, ...composition.objectiveInputs, objective: resumeObjective }, execution, { use: "ladder_host" }), composition.config, composition.parkedLeg, verifyInternals));
                             break;
                         default: {
                             const unhandled = composition;
@@ -989,8 +1126,9 @@ export function createResumeLegs(ctx) {
                             }
                         }
                         catch (e) {
-                            if (!vrReopened)
+                            if (!reSuspended && !vrReopened)
                                 throw e;
+                            recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-park-projection ${errorText(e)}`);
                         }
                     }
                     if (reSuspended)
@@ -1009,21 +1147,11 @@ export function createResumeLegs(ctx) {
                 const serialAppend = createSerialLedgerAppend((s, type, data) => rs.appendEvent(taskId, s, type, data), startSeq);
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 cancelLedgerAppend = append;
-                unregisterEngineNotice = registerEngineNoticeLeg({
-                    sessionId,
-                    ...(args.engineNotices !== undefined && args.engineNotices.length > 0 ? { pending: [...args.engineNotices] } : {}),
-                    durable: (row) => append("engine_notice", row).then(() => true, (err) => {
-                        recordFailOpen("server.engine-notice.durable-append-failed", `leg=resume code=${row.code} task=${taskId ?? ""}`);
-                        deps.logger?.warn?.("engine_notice_append_failed", { taskId, noticeCode: row.code, sessionId: row.sessionId, err: err instanceof Error ? err.message : String(err) });
-                        return false;
-                    }),
-                });
-                if (deps.userInputLedger && taskId)
-                    await deps.userInputLedger.announceUndrained({ sessionId, taskId });
+                await openEngineNoticePort(append);
                 const anchorOwner = subject ?? null;
-                const headOf = headReadOf(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && headOf
-                    ? async (eventId) => { const leaf = (await headOf(sessionId))?.leafId; if (leaf)
+                const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+                const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
+                    ? async (eventId) => { const leaf = (await sessionFactsOf(sessionId))?.leafId; if (leaf)
                         await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
                     : undefined;
                 const captureUserMessageAnchor = deps.resumeAnchorStore && taskId && freshRunClaimed
@@ -1047,7 +1175,7 @@ export function createResumeLegs(ctx) {
                     resumeLegLive = true;
                     const tailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const resumeWorkspace = createSessionWorkspaceRecorder(sessionWorkspaceStoreOf(deps.sessionStorage), args.legFacts?.sessionWitness);
-                    const stream = await legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
+                    const stream = await handToEngine(() => legRunner.resumeStream(token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, {
                         ...launchInternals,
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -1102,7 +1230,7 @@ export function createResumeLegs(ctx) {
                                 },
                             }
                             : {}),
-                    });
+                    }));
                     await commitResumeCtx();
                     resumeStreamRef = stream;
                     if (taskId)
@@ -1260,11 +1388,7 @@ export function createResumeLegs(ctx) {
                     const settledLeg = await reopenedAfterLeg(r, causeAtDone !== undefined);
                     if (settledLeg.reopened) {
                         reopenConfirmedPark = true;
-                        try {
-                            await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, reparkStatus, r, failureCodeOf(r.terminal) ?? null);
-                        }
-                        catch {
-                        }
+                        await appendParkRow(append, { modelUsage: deps.modelUsage, taskId }, reparkStatus, r, failureCodeOf(r.terminal) ?? null);
                         return r;
                     }
                     const safe = await attachModelUsage(sealResultForExit(settledLeg.leg), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -1283,7 +1407,7 @@ export function createResumeLegs(ctx) {
                         owner: subject ?? null,
                         abortSignal: cancelCtrl.signal,
                         sessionId,
-                        executionLane: execution.lane,
+                        ...approvalLegOriginOf(execution),
                         family: "approval_request",
                         transport: hitlTransport,
                         legKey,
@@ -1293,9 +1417,12 @@ export function createResumeLegs(ctx) {
                 const withElicitation = () => deps.elicitation && taskId
                     ? deps.elicitation.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withApproval)
                     : withApproval();
+                const withQuestion = () => deps.question && taskId
+                    ? deps.question.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withElicitation)
+                    : withElicitation();
                 return await (deps.sendUserFile && taskId
-                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
-                    : withElicitation());
+                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withQuestion)
+                    : withQuestion());
             })));
         }
         catch (e) {
@@ -1315,6 +1442,7 @@ export function createResumeLegs(ctx) {
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
                 }
                 const retriable = disposition === "retriable";
+                let reparkEnded = false;
                 if (claimedRow && taskId && deps.runStore) {
                     if (retriable && freshRunClaimed) {
                         const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0, usageMissing: true } };
@@ -1324,15 +1452,17 @@ export function createResumeLegs(ctx) {
                         settleFleet("failed");
                     }
                     else if (retriable) {
-                        await (reparkStatus === "needs_review" ? deps.runStore.setNeedsReview(taskId, null) : deps.runStore.setSuspended(taskId, null)).catch(() => undefined);
-                        settleFleet(reparkStatus);
+                        const parked = await commitResumePark(deps.runStore, taskId, reparkStatus, null, token);
+                        reparkEnded = parked.kind === "ended";
+                        settleFleet(reparkEnded ? "failed" : reparkStatus);
                     }
                     else {
                         await deps.runStore.setTerminal(taskId, "failed", null, e.message).catch(() => undefined);
                         settleFleet("failed");
                     }
                 }
-                return checkpointRefusalAnswer(e, { gate: outcome.gate, retriable, ...(taskId !== undefined ? { taskId } : {}), versionKeys: refusalVersionKeys(e, resumeCtx.ctx) });
+                const answerRetriable = retriable && !reparkEnded;
+                return checkpointRefusalAnswer(e, { gate: outcome.gate, retriable: answerRetriable, ...(taskId !== undefined ? { taskId } : {}), versionKeys: refusalVersionKeys(e, resumeCtx.ctx), ...(answerRetriable && args.rowWayOut !== undefined ? { wayOut: args.rowWayOut } : {}) });
             }
             const thrownCause = cancelCtrl.cause();
             if (thrownCause !== undefined) {
@@ -1345,12 +1475,28 @@ export function createResumeLegs(ctx) {
                 settleFleet("failed");
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
             }
-            if (claimedRow && taskId && deps.runStore) {
-                await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
-                await deps.runStore.setTerminal(taskId, "failed", null, outwardThrownMessage(e, errorText(e))).catch(() => undefined);
+            if (!engineHandedOff && legClaim !== undefined) {
+                const claim = legClaim;
+                await withdrawClaim(deps, claim, `the resume could not be handed to the engine: ${outwardThrownMessage(e, errorText(e))}`, "faulted");
+                const parkedAgain = claim.kind === "resumed" && restored?.kind !== "ended";
+                settleFleet(parkedAgain ? reparkStatus : "failed");
+                if (cancelledInClaimWindow())
+                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                return resumeClaimFaultAnswerOf(e);
+            }
+            const heldParkWord = heldPark === undefined ? undefined : heldParkOf(heldPark);
+            if (!(claimedRow && taskId && deps.runStore && heldPark !== undefined && heldParkWord !== undefined)) {
+                if (claimedRow && taskId && deps.runStore) {
+                    await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
+                    await deps.runStore.setTerminal(taskId, "failed", null, outwardThrownMessage(e, errorText(e))).catch(() => undefined);
+                }
+                settleFleet("failed");
+                throw e;
             }
-            settleFleet("failed");
-            throw e;
+            recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-park-held ${errorText(e)}`);
+            if (cancelLedgerAppend !== undefined)
+                await appendParkRow(cancelLedgerAppend, { modelUsage: deps.modelUsage, taskId }, heldParkWord.word, await graftParkToolCallId(heldPark, deps.checkpointStore));
+            result = heldPark;
         }
         finally {
             unregisterEngineNotice?.();
@@ -1375,25 +1521,32 @@ export function createResumeLegs(ctx) {
         const checkpointReopened = reopenConfirmedPark;
         const sealed = sealResultForExit(result);
         const resumePlane = outwardPlane(sealed.terminal);
+        let parkEnded;
         if (taskId && deps.runStore) {
-            if (checkpointReopened && reparkStatus === "needs_review")
-                await deps.runStore.setNeedsReview(taskId, null);
-            else if (resumePlane.status === "suspended" || checkpointReopened)
-                await deps.runStore.setSuspended(taskId, sealed.terminal.kind === "paused" ? sealed : null);
-            else if (resumePlane.status === "needs_review")
-                await deps.runStore.setNeedsReview(taskId, sealed);
+            const park = checkpointReopened && reparkStatus === "needs_review" ? { word: "needs_review", result: null }
+                : resumePlane.status === "suspended" || checkpointReopened ? { word: "suspended", result: sealed.terminal.kind === "paused" ? sealed : null }
+                    : resumePlane.status === "needs_review" ? { word: "needs_review", result: sealed }
+                        : undefined;
+            if (park !== undefined) {
+                const parked = await commitResumePark(deps.runStore, taskId, park.word, park.result, heldPark?.terminal.kind === "paused" ? heldPark.terminal.token : token);
+                if (parked.kind === "ended")
+                    parkEnded = { row: parked.row };
+            }
             else
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed, sealed ? failureCodeOf(sealed.terminal) : undefined));
+        settleFleet(parkEnded !== undefined ? "failed" : checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed, sealed ? failureCodeOf(sealed.terminal) : undefined));
+        const answered = parkEnded !== undefined
+            ? { status: parkEnded.row?.status ?? "failed", errorCode: parkEnded.row?.errorCode ?? undefined, errorMessage: parkEnded.row?.error ?? undefined }
+            : { status: resumePlane.status, errorCode: resumePlane.errorCode, errorMessage: resumePlane.errorMessage };
         return {
             status: 200,
             body: {
-                taskId, sessionId, status: resumePlane.status,
+                taskId, sessionId, status: answered.status,
                 bindingEnforced: true,
-                ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
-                ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
-                ...(checkpointReopened ? { retriable: true } : {}),
+                ...(answered.errorCode ? { errorCode: answered.errorCode } : {}),
+                ...(answered.errorMessage ? { errorMessage: redactErrorMessage(answered.errorMessage) ?? "" } : {}),
+                ...(checkpointReopened && parkEnded === undefined ? { retriable: true } : {}),
                 ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
             },
         };
@@ -1446,7 +1599,7 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("assistant_resume_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return noSuspension;
             }
-            return rowReadRefusalAnswer(e);
+            return rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger });
         }
         if (!cp) {
             if (!(await mayDiscloseRowError(cs, token, decider)))
@@ -1482,7 +1635,8 @@ export function createResumeLegs(ctx) {
             if (composition?.entry === "cascade_unlinked")
                 return compositionUnlinkedAnswer();
             const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
-            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            const rowWayOut = await loadedRowWayOut(cp, { cs, runs: deps.runStore, token, logger: deps.logger });
+            return await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome: { gate: "resource_limit", decision: "continue" }, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx }, ...(rowWayOut !== undefined ? { rowWayOut } : {}), ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
         }
         finally {
             resolved.peerLease.release();
@@ -1532,6 +1686,7 @@ export function createResumeLegs(ctx) {
                 source: "workflow_parked_decide",
                 identity: runIdentityOf(req, deps.config, subject ?? null),
                 workflowDecision,
+                face: CONTINUATION_CLAIM_FACE,
             });
             if (out.existing) {
                 throw new Error(`decide host turn: createRun observed an existing row ${out.existing.taskId} for a freshly minted taskId (no idempotency key was sent)`);
@@ -1567,7 +1722,7 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("wake_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
             }
-            return rowReadRefusalAnswer(e);
+            return rowReadRefusalAnswer(e, undefined);
         }
         if (!cp) {
             if (!(await mayDiscloseRowError(cs, token, who))) {
@@ -1672,7 +1827,7 @@ export function createResumeLegs(ctx) {
                 deps.logger?.warn?.("plan_review_unreadable_row_withheld", { sessionId, note: "row unreadable and the caller's ownership of THAT token is unproven — folded into the uniform 404" });
                 return refuse(noPending);
             }
-            return refuse(rowReadRefusalAnswer(e));
+            return refuse(await rowReadRefusalAnswer(e, { cs, runs: deps.runStore, token, logger: deps.logger }));
         }
         if (!cp) {
             log404("checkpoint-missing");
@@ -1726,7 +1881,7 @@ export function createResumeLegs(ctx) {
             throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
         const approvedMode = planReviewDecisionExitsPlan(decision) && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
-        const rebuildCtx = approvedMode === undefined ? ctx : withPermissionModeRewritten(ctx, { ...ctx.body, permissionMode: approvedMode });
+        const rebuildCtx = approvedMode === undefined ? ctx : { ...ctx, body: { ...ctx.body, permissionMode: approvedMode } };
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1744,7 +1899,8 @@ export function createResumeLegs(ctx) {
                 hostDecision,
             };
             const selectedGate = durableRowIdentity("decision-receipt", cp.checkpointId, token);
-            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
+            const rowWayOut = await loadedRowWayOut(cp, { cs: deps.checkpointStore, runs: deps.runStore, token, logger: deps.logger });
+            const out = await driveResumeIntoRunLog({ peerLease: resolved.peerLease, execution: resolved.execution, runner: resolved.runner, legFacts: resolved.legFacts, token, sessionId, subject: auth.subject, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, commitment: { kind: "gate_resolved", ...selectedGate }, composition, resumeCtx: { sessionId, ctx: rebuildCtx }, ...(rowWayOut !== undefined ? { rowWayOut } : {}), ...(engineNotices.length > 0 ? { engineNotices } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
             return out;
         }
         finally {
@@ -1755,10 +1911,10 @@ export function createResumeLegs(ctx) {
         activeTaskIdOf: async (sessionId) => deps.runStore?.getActiveTaskId?.(sessionId),
         liveRuns: steerableRuns,
         inbox: deps.workflowCompletionInbox,
-        headOf: headReadOf(deps.sessionStorage),
+        sessionStorage: deps.sessionStorage,
     });
     const routeCtxBase = {
-        deps,
+        deps: sealRouteDeps(deps),
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },