@sema-agent/server 7.149.0 → 7.151.0

package/dist/http/readiness.d.ts

@@ -72,7 +72,8 @@ export declare function sendReadyz(res: ServerResponse, v: ReadinessVerdict): vo
 export declare const BILLABLE_KINDS: readonly ["submit", "hitl-answer", "resume"];
 export type BillableKind = (typeof BILLABLE_KINDS)[number];
 /**
- * 计费面的拒因(**数组序 = 优先序**):就绪原因({@link READINESS_REASONS})∪ `lease_expired`(服务租约过期且中心不可达满 `T_max`)。
+ * 计费面的拒因(**数组序 = 优先序**):就绪原因({@link READINESS_REASONS})∪ `lease_expired`(服务租约过期且中心不可达满 `T_max` —— 含从起步起一直没听到
+ * 中心的成员:推定在围栏内,钟从本进程起点)。
  * `lease_expired` 刻意不是就绪原因:它不翻 `/readyz`(中心不可达不是本实例的病,摘它出路由只会把取消 / HITL / 读面一起摘掉)。
  */
 export declare const ADMISSION_REFUSALS: readonly ["draining", "model_roster_pending", "lease_expired"];
@@ -80,7 +81,8 @@ export type AdmissionRefusal = (typeof ADMISSION_REFUSALS)[number];
 /**
  * 计费面请求的**唯一**准入判(dispatch 的计费门、a2a `message/send`、PARKED 赎回席同调):按 {@link ADMISSION_REFUSALS} 序找第一条
  * 成立且按 {@link ADMISSION_TABLE} 拒这一种的拒因;没有 ⇒ `undefined`(放行)。入参是**判决**而不是 deps:就绪判由调用点经唯一谓词
- * {@link readinessOf} 现读(模块边界上那一只 —— 谓词单源钉注入它,任何读点自己读 `drainState` 都会当场红),租约读数取 `deps.servingLease`。
+ * {@link readinessOf} 现读(模块边界上那一只 —— 谓词单源钉注入它,任何读点自己读 `drainState` 都会当场红),租约读数经唯一读者
+ * `fleet/engine-signal.ts` 的 `memberLeaseOf`(只有 fleet 成员有租约;成员没有任何中心读数之前是推定的 `expired`,同一臂)。
  */
 export declare function admissionRefusalOf(verdict: ReadinessVerdict, lease: ServingLeaseView | undefined, kind: BillableKind): BillableRefusal | undefined;
 /** 计费提交门的拒绝(首条 reason 定码)。`retryAfterSec` 由发送形(`sendBillableRefusal`)镜像成头;交回

package/dist/http/resume-ctx-read.js

@@ -1,12 +1,49 @@
 import { openCheckpointCtx } from "./checkpoint-ctx.js";
 import { storeFaultClassOf } from "../plugins/store-fault.js";
 import { refusalBody } from "./refusal-body.js";
+import { frozenProjectContextOf } from "../project-context.js";
+import { frozenMemorySeedOf } from "../project-registry.js";
 export async function readResumeCtx(load, opening) {
     const read = await readStoredCtx(load);
     if (read.kind !== "ok")
         return read;
     const opened = openCheckpointCtx(read.ctx, opening.opener, opening.sessionId);
-    return opened.kind === "ok" ? { kind: "ok", ctx: opened.ctx } : { kind: "unsealable", field: opened.field, reason: opened.reason };
+    if (opened.kind !== "ok")
+        return { kind: "unsealable", field: opened.field, reason: opened.reason };
+    const where = (key) => ({ kind: "corrupt", where: `checkpoint ctx for session ${JSON.stringify(opening.sessionId)}: ${key}` });
+    const { memorySeed: _storedSeed, projectContext: _storedContext, ...rest } = opened.ctx;
+    const seed = frozenMemorySeedOf(opened.ctx.memorySeed);
+    const frozen = frozenProjectContextOf(opened.ctx.projectContext);
+    let seedPart;
+    switch (seed.kind) {
+        case "absent":
+            seedPart = {};
+            break;
+        case "none":
+            seedPart = { memorySeed: null };
+            break;
+        case "malformed":
+            return where("memorySeed");
+        case "ok":
+            seedPart = { memorySeed: seed.seed };
+            break;
+        default: {
+            const unhandled = seed;
+            throw new Error(`resume-ctx-read: unplaced frozen memory seed reading ${JSON.stringify(unhandled)}`);
+        }
+    }
+    switch (frozen.kind) {
+        case "absent":
+            return { kind: "ok", ctx: { ...rest, ...seedPart } };
+        case "malformed":
+            return where("projectContext");
+        case "ok":
+            return { kind: "ok", ctx: { ...rest, ...seedPart, projectContext: frozen.context } };
+        default: {
+            const unhandled = frozen;
+            throw new Error(`resume-ctx-read: unplaced frozen project context reading ${JSON.stringify(unhandled)}`);
+        }
+    }
 }
 async function readStoredCtx(load) {
     let stored;

package/dist/http/resume-legs.d.ts

@@ -129,7 +129,7 @@ export declare function createResumeLegs(ctx: {
     }) => void) => Promise<ResumeLegOutcome>;
     decisionRowAdmits: (cs: CheckpointStoreFull, token: CheckpointToken, who: KeyCaller | undefined, bodyScope: string | undefined) => Promise<boolean>;
     resumePreempted: (sessionId: string, req: IncomingMessage | undefined, acceptEarly?: boolean, decider?: KeyCaller, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
-    startFreshHostTurn: (sessionId: string, objective: string, subject: string | undefined, req: IncomingMessage, workflowDecision: WorkflowDecisionDelivery, runId: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
+    startFreshHostTurn: (sessionId: string, objective: string, subject: string | undefined, req: IncomingMessage | undefined, workflowDecision: WorkflowDecisionDelivery, runId: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     resumeWake: (sessionId: string, message: PendingSteerInput | undefined, caller: Subject | undefined, req: IncomingMessage | undefined, acceptEarly?: boolean, workflowDecision?: WorkflowDecisionDelivery, ownerLeaseAdmittedFor?: string, restatement?: ResumeRestatement) => Promise<ResumeLegOutcome>;
     preparePlanReview: (sessionId: string, log?: {
         taskId?: string;
@@ -146,6 +146,7 @@ export declare function createResumeLegs(ctx: {
     }>;
     drivePlanReview: (prepared: PreparedPlanReview, decision: "approve" | "edit" | "reject", editedPlan: string | undefined, reason: string | undefined, hostDecision: HostDecision, req: IncomingMessage | undefined, acceptEarly?: boolean, permissionModeAfter?: PlanApprovePermissionModeAfter) => Promise<ResumeLegOutcome>;
     sessionNotifyDoor: import("../session-notify-door.js").SessionNotifyDoor;
+    handOverRunEndedDecisions: (runId: string) => Promise<void>;
 };
 export {};
 //# sourceMappingURL=resume-legs.d.ts.map

package/dist/http/resume-legs.js

@@ -1,21 +1,23 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
-import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
+import { answerOfHolderFence, answerOfHolderRedeem, decideParkedAgent, deliverableEntryOf, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, holderFenceFaultAnswer, planWorkflowParkedDecide, redeemHere, runChannelEnded, workflowParkGuidance } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
-import { headReadOf } from "../session-incarnation.js";
+import { heldParksOf, readRunParks } from "../orchestration/workflow-agent-session-index.js";
+import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
+import { runFactsOf, sealRouteDeps, sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
 import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { keyAdmits } from "../owner-faces.js";
 import { personOf } from "../owner-brands.js";
 import { recoveredSubject } from "../owner-faces.js";
-import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { beatRunHeartbeat, createRunAnchorWriter, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
 import { commitParkRow } from "../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
 import { buildCancelledLedgerRow, CANCELLED_CODE, CARD_SETTLED_BY_CANCEL_MESSAGE, createRunAbort, mintCancelledResult, withCardSettledByCancelMessage } from "../run-cancel-context.js";
-import { isTerminalRunStatus, runProvenElsewhere } from "../plugins/store-contracts.js";
+import { createLegCtxClaim, isTerminalRunStatus } from "../plugins/store-contracts.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKeyOf, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
@@ -60,21 +62,28 @@ import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflic
 import { refusalAfterLostClaim } from "./claim-heartbeat.js";
 import { CONTINUATION_CLAIM_FACE, ClaimFaultAnswer, commitExecutionContext, faultedAnswerOf, isRootSessionGoneError, resolveBeforeClaim, rootSessionAbsentAnswer, stampSpecRoot, withdrawClaim } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
 import { readResumeCtx, resumeCtxCorruptAnswer, resumeCtxUnreadableAnswer, resumeCtxUnsealableAnswer, resumeStoreFailureOf } from "./resume-ctx-read.js";
 import { objectiveWithheldIn } from "./submit-ctx.js";
-import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields, withPermissionModeRewritten } from "./checkpoint-ctx.js";
+import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalWithCard, sealCheckpointCtx, storedBodyReplayAnswer, storedBodyReplayLogFields } from "./checkpoint-ctx.js";
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
+import { stampReplayEntryMode } from "../permission-mode-admission.js";
 import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { createSubmissionSeat } from "../submission-exit.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 import { createSessionNotifyDoor } from "../session-notify-door.js";
+const HANDOFF_RETRY_CODES = new Set(["conflict.session_active_run", "not_found.parked_checkpoint", "conflict.claim_lost"]);
+function handoffResultOf(refusal, refusedWhy) {
+    const errorCode = "errorCode" in refusal.body ? refusal.body.errorCode : undefined;
+    const code = typeof errorCode === "string" ? errorCode : `status_${refusal.status}`;
+    return refusal.status >= 500 || HANDOFF_RETRY_CODES.has(code) ? { kind: "retry", why: code } : { kind: "refused", why: refusedWhy ?? code };
+}
 function compositionUnlinkedAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context does not match this card — the run is a cascade but the card records no ladder rung, so the ladder cannot be continued" }) };
 }
@@ -302,6 +311,13 @@ export function decidedActionOf(binding) {
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const ctxOpening = (sessionId) => ({ sessionId, opener: deps.checkpointCtxSealing });
+    const replayCtxOf = (stored, restatement) => {
+        const restated = restateResumeCtx(stored, restatement);
+        if (restated.unattendedLeg === true)
+            return restated;
+        const body = stampReplayEntryMode(restated.body, deps.config);
+        return body === restated.body ? restated : { ...restated, body };
+    };
     const resumeFleetScope = (req, auth) => req ? (gatedSubject(req, deps.config) ?? "default") : (auth.subject ?? "default");
     function createRememberIntent(sessionId, remember) {
         let pending;
@@ -569,73 +585,56 @@ export function createResumeLegs(ctx) {
                 if (!plan.ok)
                     return plan.deny;
                 const fingerprint = parkDecisionFingerprint(plan.outcome, restatement);
-                const live = await deliverToHoldingRun(origin, { token, outcome: plan.outcome, decision: parkedReq.decision, fingerprint, restated: restatement !== undefined });
-                if (live.kind === "answered")
-                    return live.answer;
                 const decisions = deps.workflowParkDecisions;
-                const runStore = deps.runStore;
-                if (decisions === undefined || runStore === undefined) {
+                if (decisions === undefined || deps.runStore === undefined) {
                     return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
                 }
-                const liveReceiptOf = async (held) => {
-                    if (held === null || held.fingerprint !== fingerprint)
-                        return undefined;
-                    const run = await runStore.getRun(held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
-                };
-                const replay = await liveReceiptOf(await decisions.get(token));
-                if (replay !== undefined)
-                    return replay;
-                let recordFailure;
-                const answerOfRecordFailure = async (failed) => {
-                    if (failed.kind === "faulted")
-                        return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+                if (origin.run.status === "running") {
+                    let verdict;
                     try {
-                        return await refusalAfterLostClaim(deps, runStore, plan.hostSessionId, failed.deliveredTaskId);
+                        verdict = await decisions.recordForRunningHolder({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId: plan.runId, acceptedAtMs: Date.now() }, { restated: restatement !== undefined });
                     }
-                    catch (e) {
-                        return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+                    catch (err) {
+                        return faultedAnswerOf(err, () => holderFenceFaultAnswer(plan.runId));
                     }
-                };
-                const delivery = {
-                    carried: [{ runId: plan.runId, token, outcome: plan.outcome }],
-                    commitBeforeLaunch: async (deliveredTaskId) => {
-                        let recorded;
-                        try {
-                            recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
-                        }
-                        catch (err) {
-                            recordFailure = { kind: "faulted", err };
-                            throw err;
-                        }
-                        if (!recorded) {
-                            recordFailure = { kind: "not_recorded", deliveredTaskId };
-                            throw new Error(DELIVERY_NOT_RECORDED);
+                    switch (verdict) {
+                        case "not_running":
+                            break;
+                        case "not_held":
+                        case "restated":
+                        case "other_decision":
+                            return answerOfHolderFence(verdict, plan.runId);
+                        case "stands":
+                            return answerOfHolderRedeem(await redeemHere(plan.runId, origin.run.scope, { token, outcome: plan.outcome }), plan.runId, parkedReq.decision);
+                        default: {
+                            const unhandled = verdict;
+                            throw new Error(`unhandled workflow holder fence verdict: ${String(unhandled)}`);
                         }
-                    },
-                };
-                const hostToken = await cs
-                    .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
-                    .catch(() => undefined);
-                const admittedPayer = decodeCheckpointScope(cp.scope);
-                let out;
-                try {
-                    out = hostToken
-                        ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
-                        : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
+                    }
                 }
-                catch (err) {
-                    const failed = recordFailure;
-                    if (failed === undefined)
-                        throw err;
-                    return await answerOfRecordFailure(failed);
+                const laned = await deliverViaResumeLane({
+                    hostSessionId: plan.hostSessionId,
+                    runId: plan.runId,
+                    runScope: origin.run.scope,
+                    token,
+                    outcome: plan.outcome,
+                    fingerprint,
+                    message: plan.message,
+                    ...(restatement !== undefined ? { restatement } : {}),
+                    initiator: { kind: "decide", req, caller: decider?.subject, ...(acceptEarly === true ? { acceptEarly: true } : {}), admittedPayer: decodeCheckpointScope(cp.scope) },
+                });
+                switch (laned.kind) {
+                    case "launched":
+                    case "replayed":
+                    case "refused":
+                        return laned.out;
+                    case "record_failed":
+                        return await answerOfRecordFailure(laned.failure, plan.hostSessionId);
+                    default: {
+                        const unhandled = laned;
+                        throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+                    }
                 }
-                const failed = recordFailure;
-                if (failed !== undefined)
-                    return await answerOfRecordFailure(failed);
-                if (acceptedTaskIdOf(out) === undefined)
-                    return (await liveReceiptOf(await decisions.get(token))) ?? out;
-                return out;
             }
         }
         const runCtx = await ctxPromise;
@@ -644,7 +643,7 @@ export function createResumeLegs(ctx) {
         if (runCtx === undefined || runCtx.ctx === null)
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const { runSessionId, ctx: storedCtx } = runCtx;
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const auth = { sessionId: runSessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -690,6 +689,8 @@ export function createResumeLegs(ctx) {
             leg: "resume",
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
+            ...(ctx.projectContext !== undefined ? { projectContext: ctx.projectContext } : {}),
+            ...(ctx.memorySeed !== undefined ? { memorySeed: ctx.memorySeed } : {}),
             lease,
             execution,
         });
@@ -762,10 +763,10 @@ export function createResumeLegs(ctx) {
         };
         const commitResumeCtx = () => Promise.resolve().then(async () => {
             const sealed = sealCheckpointCtx({ ...resumeCtx.ctx, writerVersion: serviceVersion() }, deps.checkpointCtxSealing, resumeCtx.sessionId);
-            const claim = claimedRow && taskId !== undefined && deps.runStore !== undefined ? { fence: deps.runStore, taskId, legHolds: (run) => !runProvenElsewhere(run, deps.instanceId) } : undefined;
+            const claim = heldLeg !== undefined && taskId !== undefined && deps.runStore !== undefined ? createLegCtxClaim(deps.runStore, taskId, heldLeg) : undefined;
             const landed = await deps.checkpointStore.putCtx(resumeCtx.sessionId, sealed, claim);
             if (landed === "claim_released")
-                resumeCtxNotPersisted("claim_released: this run no longer holds the session claim (settled or reaped before the write-back landed) — nothing written");
+                resumeCtxNotPersisted("claim_released: this leg no longer holds the run (settled, reaped, or claimed again by a later leg before the write-back landed) — nothing written");
         }).catch((e) => resumeCtxNotPersisted(errorText(e)));
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
@@ -978,7 +979,7 @@ export function createResumeLegs(ctx) {
             ...heldDecisions,
             ...(workflowDecision !== undefined && taskId !== undefined ? { afterCheckpointResolve: () => workflowDecision.commitBeforeLaunch(taskId) } : {}),
         };
-        commitSessionInheritEnv(deps, sessionId, resumeCtx.ctx.body);
+        commitLegBindings(deps, undefined, sessionId, args.legFacts?.sessionBindings);
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
@@ -1035,7 +1036,7 @@ export function createResumeLegs(ctx) {
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...launchInternals,
-                        ...compositionLegRoot(args.legFacts?.registeredCwd),
+                        ...compositionLegRoot(args.legFacts?.sessionBindings.cwd),
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -1147,15 +1148,18 @@ export function createResumeLegs(ctx) {
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 cancelLedgerAppend = append;
                 await openEngineNoticePort(append);
-                const anchorOwner = subject ?? null;
-                const headOf = headReadOf(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && headOf
-                    ? async (eventId) => { const leaf = (await headOf(sessionId))?.leafId; if (leaf)
-                        await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
-                    : undefined;
-                const captureUserMessageAnchor = deps.resumeAnchorStore && taskId && freshRunClaimed
-                    ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-                    : undefined;
+                const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
+                const anchors = createRunAnchorWriter({
+                    seat: deps.backend?.landedAttendants(),
+                    sessionId,
+                    owner: subject ?? null,
+                    promptKey: taskId && freshRunClaimed ? taskId : undefined,
+                    witness: args.legFacts?.sessionWitness,
+                    occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+                    leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+                });
+                const captureTurnAnchor = anchors.turn;
+                const captureUserMessageAnchor = anchors.prompt;
                 const anchor = new TurnAnchorCapture(captureTurnAnchor, "resume", captureUserMessageAnchor);
                 const flush = async () => {
                     if (reasoning) {
@@ -1416,9 +1420,12 @@ export function createResumeLegs(ctx) {
                 const withElicitation = () => deps.elicitation && taskId
                     ? deps.elicitation.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withApproval)
                     : withApproval();
+                const withQuestion = () => deps.question && taskId
+                    ? deps.question.runWithContext({ taskId, owner: subject ?? null, transport: hitlTransport, abortSignal: cancelCtrl.signal }, withElicitation)
+                    : withElicitation();
                 return await (deps.sendUserFile && taskId
-                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withElicitation)
-                    : withElicitation());
+                    ? deps.sendUserFile.runWithContext({ taskId, emit: async (frame) => { const { type, ...rest } = frame; await append(type, rest); } }, withQuestion)
+                    : withQuestion());
             })));
         }
         catch (e) {
@@ -1619,7 +1626,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1664,7 +1671,7 @@ export function createResumeLegs(ctx) {
                 }),
             };
         }
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const windowDenial = await usageWindowDenialFor(subject === undefined ? undefined : personOf(recoveredSubject(subject)));
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
@@ -1753,7 +1760,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId: cp.sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1780,7 +1787,7 @@ export function createResumeLegs(ctx) {
                 ...(workflowDecision !== undefined ? { workflowDecision } : {}),
                 ...(engineNotices.length > 0 ? { engineNotices } : {}),
                 ...(acceptEarly === true ? { acceptEarly: true } : {}),
-                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(req !== undefined || workflowDecision !== undefined ? { callerInitiated: true } : {}),
                 ...(ownerLeaseAdmittedFor !== undefined && auth.subject === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
             });
         }
@@ -1788,6 +1795,183 @@ export function createResumeLegs(ctx) {
             resolved.peerLease.release();
         }
     }
+    async function answerOfRecordFailure(failed, hostSessionId) {
+        if (failed.kind === "faulted")
+            return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+        const runStore = deps.runStore;
+        if (runStore === undefined)
+            throw new Error("workflow park decide: a decision row failed to land without a run store — the claim fence it was written under is the run store");
+        try {
+            return await refusalAfterLostClaim(deps, runStore, hostSessionId, failed.deliveredTaskId);
+        }
+        catch (e) {
+            return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+        }
+    }
+    async function deliverViaResumeLane(d) {
+        const decisions = deps.workflowParkDecisions;
+        const runStore = deps.runStore;
+        const cs = deps.checkpointStore;
+        if (decisions === undefined || runStore === undefined || cs === undefined) {
+            return { kind: "refused", out: { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) } };
+        }
+        const liveReceiptOf = async (held) => {
+            if (held === null || held.fingerprint !== d.fingerprint)
+                return undefined;
+            const run = await runFactsOf(runStore, held.deliveredTaskId);
+            return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
+        };
+        const replay = await liveReceiptOf(await decisions.get(d.token));
+        if (replay !== undefined)
+            return { kind: "replayed", out: replay };
+        await runChannelEnded(d.runId, d.runScope);
+        const condition = d.initiator.kind === "run_ended" ? { expect: d.fingerprint } : undefined;
+        let recordFailure;
+        const delivery = {
+            carried: [{ runId: d.runId, token: d.token, outcome: d.outcome }],
+            commitBeforeLaunch: async (deliveredTaskId) => {
+                let recorded;
+                try {
+                    recorded = await decisions.record({ token: d.token, runId: d.runId, hostSessionId: d.hostSessionId, outcome: d.outcome, fingerprint: d.fingerprint, deliveredTaskId, acceptedAtMs: Date.now() }, condition);
+                }
+                catch (err) {
+                    recordFailure = { kind: "faulted", err };
+                    throw err;
+                }
+                if (!recorded) {
+                    recordFailure = { kind: "not_recorded", deliveredTaskId };
+                    throw new Error(DELIVERY_NOT_RECORDED);
+                }
+            },
+        };
+        const hostToken = await cs.findPendingTokenBySession(d.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" }).catch(() => undefined);
+        const req = d.initiator.kind === "decide" ? d.initiator.req : undefined;
+        const acceptEarly = d.initiator.kind === "decide" ? d.initiator.acceptEarly : undefined;
+        let out;
+        try {
+            out = hostToken
+                ? await resumeWake(d.hostSessionId, d.message, d.initiator.caller, req, acceptEarly, delivery, d.initiator.admittedPayer, d.restatement)
+                : await startFreshHostTurn(d.hostSessionId, d.message.text, d.initiator.admittedPayer, req, delivery, d.runId, d.restatement);
+        }
+        catch (err) {
+            const failed = recordFailure;
+            if (failed === undefined)
+                throw err;
+            return { kind: "record_failed", failure: failed };
+        }
+        const failed = recordFailure;
+        if (failed !== undefined)
+            return { kind: "record_failed", failure: failed };
+        if (acceptedTaskIdOf(out) === undefined) {
+            const raced = await liveReceiptOf(await decisions.get(d.token));
+            return raced !== undefined ? { kind: "replayed", out: raced } : { kind: "refused", out };
+        }
+        return { kind: "launched", out };
+    }
+    async function handOverRunEndedDecisions(runId) {
+        if (isAdoptionQuiescing())
+            throw new Error(`workflow run ${runId}: an adoption arc is running in this process — the decision handoff yields and is retried on the next recovery sweep`);
+        const handing = handOverHeldRows(runId);
+        trackMaintenanceLeg(handing);
+        await handing;
+    }
+    async function handOverHeldRows(runId) {
+        const decisions = deps.workflowParkDecisions;
+        const records = deps.workflowRunStore;
+        const cs = deps.checkpointStore;
+        const index = deps.workflowAgentSessionIndex;
+        if (decisions === undefined || records === undefined || cs === undefined || index === undefined)
+            return;
+        const run = await records.get(runId);
+        if (run === null)
+            return;
+        const parks = readRunParks(run);
+        if (parks === undefined) {
+            deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: "parks_unreadable" });
+            return;
+        }
+        const held = heldParksOf(runId, parks);
+        if (run.status === "running") {
+            for (const park of held) {
+                if ((await decisions.get(park.token)) !== null) {
+                    throw new Error(`workflow run ${runId}: its completion arrived while its record still reads running (the terminal record write did not land) and it holds an accepted decision — leaving the completion pending until recovery ends the record`);
+                }
+            }
+            return;
+        }
+        for (const park of held) {
+            const row = await decisions.get(park.token);
+            if (row === null)
+                continue;
+            const deliverable = await deliverableEntryOf({ checkpointStore: cs, workflowAgentSessionIndex: index, workflowRunStore: records }, row);
+            if (deliverable.kind === "unreadable")
+                throw new Error(`workflow run ${runId}: the card or the holder of a recorded decision could not be read — leaving the completion pending for the next recovery sweep`);
+            if (deliverable.kind === "not_deliverable" || deliverable.entry.runId !== runId)
+                continue;
+            const result = await handOverOne(runId, run.scope, deliverable, row);
+            deps.metrics?.inc("workflow_park_handoff_total", { result: result.kind });
+            switch (result.kind) {
+                case "delivered":
+                    continue;
+                case "retry":
+                    throw new Error(`workflow run ${runId}: the decision handoff must be retried (${result.why}) — leaving the completion pending for the next recovery sweep`);
+                case "refused":
+                    deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: result.why });
+                    continue;
+                default: {
+                    const unhandled = result;
+                    throw new Error(`unhandled workflow park handoff result: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+    }
+    async function handOverOne(runId, runScope, parkEntry, row) {
+        const cs = deps.checkpointStore;
+        const hostSessionId = parkEntry.origin.run.originatingSessionId;
+        if (hostSessionId === undefined || hostSessionId === "")
+            return { kind: "refused", why: "host_unknown" };
+        const ownerScope = parkEntry.card.scope;
+        const hostToken = await cs.findPendingTokenBySession(hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" });
+        if (hostToken) {
+            const hostCard = await cs.get(hostToken);
+            if (hostCard !== null && hostCard.scope !== ownerScope)
+                return { kind: "refused", why: "owner_mismatch" };
+        }
+        const parts = checkpointPartsOf(ownerScope);
+        const quota = ownerCostQuotaDenied(parts?.person);
+        if (quota !== undefined)
+            return handoffResultOf(quota, "payer_cost_quota");
+        const lease = await ownerFleetLeaseDenied(parts?.person);
+        if (lease !== undefined)
+            return handoffResultOf(lease, "payer_fleet_lease");
+        const laned = await deliverViaResumeLane({
+            hostSessionId,
+            runId,
+            runScope,
+            token: row.token,
+            outcome: row.outcome,
+            fingerprint: row.fingerprint,
+            message: workflowParkGuidance(runId, parkEntry.origin.park.callKey, row.outcome.decision === "allow" ? "approve" : "deny"),
+            initiator: { kind: "run_ended", caller: parts?.subject, admittedPayer: decodeCheckpointScope(ownerScope) },
+        });
+        switch (laned.kind) {
+            case "launched":
+            case "replayed":
+                return { kind: "delivered" };
+            case "refused":
+                return handoffResultOf(laned.out);
+            case "record_failed": {
+                if (laned.failure.kind === "faulted")
+                    return { kind: "retry", why: "store_fault" };
+                const now = await deps.workflowParkDecisions.get(row.token);
+                return now?.fingerprint === row.fingerprint ? { kind: "retry", why: "claim_lost" } : { kind: "refused", why: "superseded" };
+            }
+            default: {
+                const unhandled = laned;
+                throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
     async function preparePlanReview(sessionId, log, decider, sighting, restatement) {
         const cs = deps.checkpointStore;
         const refuse = (answer) => ({ ok: false, answer });
@@ -1861,7 +2045,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxUnreadableAnswer());
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) });
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
@@ -1877,7 +2061,7 @@ export function createResumeLegs(ctx) {
             throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
         const approvedMode = planReviewDecisionExitsPlan(decision) && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
-        const rebuildCtx = approvedMode === undefined ? ctx : withPermissionModeRewritten(ctx, { ...ctx.body, permissionMode: approvedMode });
+        const rebuildCtx = approvedMode === undefined ? ctx : { ...ctx, body: { ...ctx.body, permissionMode: approvedMode } };
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1907,15 +2091,15 @@ export function createResumeLegs(ctx) {
         activeTaskIdOf: async (sessionId) => deps.runStore?.getActiveTaskId?.(sessionId),
         liveRuns: steerableRuns,
         inbox: deps.workflowCompletionInbox,
-        headOf: headReadOf(deps.sessionStorage),
+        sessionStorage: deps.sessionStorage,
     });
     const routeCtxBase = {
-        deps,
+        deps: sealRouteDeps(deps),
         registry: { idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters },
         helpers: { readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode },
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview, sessionNotify: sessionNotifyDoor },
     };
-    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor };
+    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor, handOverRunEndedDecisions };
 }
 //# sourceMappingURL=resume-legs.js.map