@sema-agent/server 7.150.0 → 7.152.0

package/dist/http/resume-legs.js

@@ -1,16 +1,18 @@
 import { redactErrorMessage, redactHead } from "../observability/run-terminal.js";
 import { createHash } from "node:crypto";
 import { uuidv7, resumeWithVerification, resumeCascade, CheckpointError, judgeCheckpointRow, defaultTaskRegistry, taskNotificationDedupKey, validatePendingSteer, GLOBAL_USAGE_KEY } from "@sema-agent/core";
-import { decideParkedAgent, deliverToHoldingRun, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, planWorkflowParkedDecide } from "../parked-decide.js";
+import { answerOfHolderFence, answerOfHolderRedeem, decideParkedAgent, deliverableEntryOf, denyWorkflowParkForked, denyWorkflowParksUnreadable, findParkOrigin, heldWorkflowParkDecisions, holderFenceFaultAnswer, planWorkflowParkedDecide, redeemHere, runChannelEnded, workflowParkGuidance } from "../parked-decide.js";
 import { parkDecisionFingerprint } from "../orchestration/workflow-park-decision.js";
-import { runFactsOf, sealRouteDeps, sessionFactsReadOf } from "./owner-access.js";
+import { heldParksOf, readRunParks } from "../orchestration/workflow-agent-session-index.js";
+import { isAdoptionQuiescing, trackMaintenanceLeg } from "../adoption/quiesce.js";
+import { runFactsOf, sealRouteDeps, sessionFactsReadOf, sessionOccupantReadOf } from "./owner-access.js";
 import { createSessionWorkspaceRecorder, sessionWorkspaceStoreOf } from "../session-workspace.js";
 const DELIVERY_NOT_RECORDED = "workflow park decide: this delivery no longer holds the host session (its claim was released) — the decision was not recorded and this delivery was not started";
-import { HttpError, checkpointPartsOf, decodeCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { HttpError, checkpointPartsOf, decodeCheckpointScope, ownerOfCheckpointScope, scopeCellOf, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
 import { keyAdmits } from "../owner-faces.js";
 import { personOf } from "../owner-brands.js";
 import { recoveredSubject } from "../owner-faces.js";
-import { beatRunHeartbeat, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
+import { beatRunHeartbeat, createRunAnchorWriter, graftParkToolCallId, heldParkOf, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort, voidHeldParkCard } from "../runs.js";
 import { commitParkRow } from "../park-row-commit.js";
 import { atHostBoundary, failureCodeOf, nestedPauseOf, sealResultForExit, outwardPlane, outwardThrownMessage } from "../terminal.js";
 import { voidVerifierPauseCard } from "../verifier-pause-card.js";
@@ -22,7 +24,7 @@ import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotific
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus } from "../fleet/subagent-tail-bus.js";
 import { currentApprovalGateToken, currentGateFacesOf, sightsCurrentGate } from "../approval-gate-currency.js";
-import { approverFacingArgs, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
+import { approverFacingArgs, declaredApprovalFrameFamilies, parkRowStandingAnswerFacts, readCardRuleRecordOfAskRow, readCardRuleRecordOfParkRow, redeemCardRule, resolveApprovalLeg, resolveStreamApprovalGate, standingAnswerDurablyRecordable } from "../tool-approval.js";
 import { createHitlTransport } from "../hitl-delivery.js";
 import { buildCheckpointAnchorHash } from "../approval-ask-audit-store.js";
 import { APPROVAL_ENDING_CAUSES } from "../approval-deny-reasons.js";
@@ -60,7 +62,7 @@ import { buildActiveRunConflict, resumeEntryForGate } from "./active-run-conflic
 import { refusalAfterLostClaim } from "./claim-heartbeat.js";
 import { CONTINUATION_CLAIM_FACE, ClaimFaultAnswer, commitExecutionContext, faultedAnswerOf, isRootSessionGoneError, resolveBeforeClaim, rootSessionAbsentAnswer, stampSpecRoot, withdrawClaim } from "./execution-context.js";
 import { timeClaim } from "./claim-latency.js";
-import { commitSessionInheritEnv } from "./session-inherit-env.js";
+import { commitLegBindings } from "../session-bindings.js";
 import { ASK_USER_QUESTION_TOOL_NAME, isApprovalGateKind, isEngineQuestionRow } from "../approval-content-kind.js";
 import { deploymentListAsks } from "../approval.js";
 import { isParkLedgerEventType } from "../trace/ledger-events.js";
@@ -70,11 +72,18 @@ import { buildCheckpointVersionKeys, resumeAssemblyRefusalAnswer, resumeRefusalW
 import { refusalBody, resumeRefusalFacts } from "./refusal-body.js";
 import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { restateResumeCtx } from "./resume-restatement.js";
+import { stampReplayEntryMode, withStoredPermissionMode } from "../permission-mode-admission.js";
 import { httpErrorRefusal } from "./send.js";
 import { createRunAcceptance } from "../run-acceptance.js";
 import { createSubmissionSeat } from "../submission-exit.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 import { createSessionNotifyDoor } from "../session-notify-door.js";
+const HANDOFF_RETRY_CODES = new Set(["conflict.session_active_run", "not_found.parked_checkpoint", "conflict.claim_lost"]);
+function handoffResultOf(refusal, refusedWhy) {
+    const errorCode = "errorCode" in refusal.body ? refusal.body.errorCode : undefined;
+    const code = typeof errorCode === "string" ? errorCode : `status_${refusal.status}`;
+    return refusal.status >= 500 || HANDOFF_RETRY_CODES.has(code) ? { kind: "retry", why: code } : { kind: "refused", why: refusedWhy ?? code };
+}
 function compositionUnlinkedAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context does not match this card — the run is a cascade but the card records no ladder rung, so the ladder cannot be continued" }) };
 }
@@ -210,6 +219,35 @@ function decisionRefusalCauseOf(e, gate) {
 function notResumableAnswer() {
     return { status: 409, body: refusalBody({ errorCode: "conflict.not_resumable", message: "run is not in a resumable (suspended) state (already resumed, decided, or expired)" }) };
 }
+function planeOfEndedRow(row) {
+    return { status: row?.status ?? "failed", errorCode: row?.errorCode ?? undefined, errorMessage: row?.error ?? undefined };
+}
+async function landedTerminalRow(runStore, taskId, arm) {
+    let row;
+    try {
+        row = await runStore.getRun(taskId);
+    }
+    catch (e) {
+        recordFailOpen("server.resume.cancel-answer-row-unreadable", `task=${taskId} arm=${arm} err=${errorText(e)}`);
+        return undefined;
+    }
+    return row !== undefined && isTerminalRunStatus(row.status) ? row : undefined;
+}
+function settledLegAnswer(o) {
+    return {
+        status: 200,
+        body: {
+            ...(o.taskId !== undefined ? { taskId: o.taskId } : {}),
+            sessionId: o.sessionId,
+            status: o.plane.status,
+            bindingEnforced: true,
+            ...(o.plane.errorCode ? { errorCode: o.plane.errorCode } : {}),
+            ...(o.plane.errorMessage ? { errorMessage: redactErrorMessage(o.plane.errorMessage) ?? "" } : {}),
+            ...(o.reparked ? { retriable: true } : {}),
+            ...o.evidence,
+        },
+    };
+}
 function resumeClaimFaultAnswerOf(e) {
     return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
 }
@@ -270,7 +308,7 @@ function acceptableFormFacts(detail) {
     const rewritten = detail !== null && typeof detail === "object" ? detail.editRewritten : undefined;
     if (rewritten === null || typeof rewritten !== "object" || !Object.hasOwn(rewritten, "acceptableForm"))
         return {};
-    const shown = approverFacingArgs(rewritten.acceptableForm);
+    const shown = approverFacingArgs(rewritten.acceptableForm, undefined);
     return shown === undefined ? {} : { acceptableForm: shown };
 }
 export function checkpointRefusalAnswer(e, at) {
@@ -302,6 +340,12 @@ export function decidedActionOf(binding) {
 export function createResumeLegs(ctx) {
     const { deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor } = ctx;
     const ctxOpening = (sessionId) => ({ sessionId, opener: deps.checkpointCtxSealing });
+    const replayCtxOf = (stored, restatement) => {
+        const restated = restateResumeCtx(stored, restatement);
+        if (restated.unattendedLeg === true)
+            return restated;
+        return stampReplayEntryMode(restated, deps.config);
+    };
     const resumeFleetScope = (req, auth) => req ? (gatedSubject(req, deps.config) ?? "default") : (auth.subject ?? "default");
     function createRememberIntent(sessionId, remember) {
         let pending;
@@ -327,9 +371,23 @@ export function createResumeLegs(ctx) {
             },
         };
     }
-    async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, remember, acceptEarly, decider, restatement) {
+    function createRuleIntent(persistRule) {
+        let reading;
+        return {
+            record: (r) => {
+                reading = r;
+            },
+            settle: async (committed) => {
+                if (!committed || reading === undefined)
+                    return { rulePersisted: false, ruleRefusal: "rule_lane_unavailable" };
+                return redeemCardRule(deps.ruleConsent, reading, persistRule.slot, { inputWasEdited: persistRule.inputWasEdited, eligible: true });
+            },
+        };
+    }
+    async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, remember, acceptEarly, decider, restatement, persistRule) {
         const cs = deps.checkpointStore;
         const intent = remember !== undefined ? createRememberIntent(sessionId, remember) : undefined;
+        const ruleIntent = persistRule !== undefined ? createRuleIntent(persistRule) : undefined;
         const token = await currentApprovalGateToken(cs, sessionId);
         if (binding.checkpointToken && !sightsCurrentGate({ face: "checkpointToken", value: binding.checkpointToken }, token ? { checkpointToken: token } : null)) {
             let seenUnreadable = false;
@@ -460,12 +518,36 @@ export function createResumeLegs(ctx) {
             return approvalStaleAnswer(s57CurrentPending ? { currentPending: s57CurrentPending } : {});
         }
         const paForGrant = cp.pendingAction.kind === "tool_approval" ? cp.pendingAction : undefined;
+        const parkFacts = paForGrant !== undefined && paForGrant.toolName ? parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config, deploymentListAsks(deps.config, { toolName: paForGrant.toolName })) : undefined;
         const rememberableTool = paForGrant !== undefined &&
-            paForGrant.toolName &&
+            parkFacts !== undefined &&
             paForGrant.toolName !== ASK_USER_QUESTION_TOOL_NAME &&
-            standingAnswerDurablyRecordable(parkRowStandingAnswerFacts(paForGrant, cp.gate, deps.config, deploymentListAsks(deps.config, { toolName: paForGrant.toolName })))
+            standingAnswerDurablyRecordable(parkFacts)
             ? paForGrant.toolName
             : null;
+        if (ruleIntent !== undefined) {
+            const owner = ownerOfCheckpointScope(cp.scope);
+            if (paForGrant === undefined || parkFacts === undefined || !token || !paForGrant.toolCallId || !paForGrant.boundInputHash)
+                ruleIntent.record({ kind: "absent", refusal: "rule_material_absent" });
+            else {
+                const asked = deps.toolApproval !== undefined ? await deps.toolApproval.readParkedAskOfGate(cp.sessionId, { boundCallId: paForGrant.toolCallId, boundInputHash: paForGrant.boundInputHash }) : { kind: "none" };
+                switch (asked.kind) {
+                    case "row":
+                        ruleIntent.record(readCardRuleRecordOfAskRow(asked.row, owner));
+                        break;
+                    case "unreadable":
+                        ruleIntent.record({ kind: "absent", refusal: "rule_store_error" });
+                        break;
+                    case "none":
+                        ruleIntent.record(readCardRuleRecordOfParkRow(paForGrant, { owner, governanceForced: parkFacts.governanceForced, scopeRoot: await cs.cardScopeRootOf(token) }));
+                        break;
+                    default: {
+                        const unhandled = asked;
+                        throw new Error(`resumeCheckpoint: unhandled parked-ask reading ${JSON.stringify(unhandled)}`);
+                    }
+                }
+            }
+        }
         const boundGrant = intent
             ? (overrideSessionId) => intent.record({ ...(overrideSessionId !== undefined ? { overrideSessionId } : {}), rememberableToolName: rememberableTool })
             : undefined;
@@ -490,7 +572,11 @@ export function createResumeLegs(ctx) {
         const landAfterCommit = async (out) => {
             const committed = decisionCommittedOf(out);
             noteLateSettleIfAccepted(committed);
-            return intent === undefined ? out : { ...out, rememberApplied: await intent.settle(committed) };
+            return {
+                ...out,
+                ...(intent !== undefined ? { rememberApplied: await intent.settle(committed) } : {}),
+                ...(ruleIntent !== undefined ? { ruleReceipt: await ruleIntent.settle(committed) } : {}),
+            };
         };
         const parkedForkQuotaDenial = req !== undefined ? ownerCostQuotaDenied(checkpointPartsOf(cp.scope)?.person) : undefined;
         if (parkedForkQuotaDenial)
@@ -569,73 +655,56 @@ export function createResumeLegs(ctx) {
                 if (!plan.ok)
                     return plan.deny;
                 const fingerprint = parkDecisionFingerprint(plan.outcome, restatement);
-                const live = await deliverToHoldingRun(origin, { token, outcome: plan.outcome, decision: parkedReq.decision, fingerprint, restated: restatement !== undefined });
-                if (live.kind === "answered")
-                    return live.answer;
                 const decisions = deps.workflowParkDecisions;
-                const runStore = deps.runStore;
-                if (decisions === undefined || runStore === undefined) {
+                if (decisions === undefined || deps.runStore === undefined) {
                     return { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) };
                 }
-                const liveReceiptOf = async (held) => {
-                    if (held === null || held.fingerprint !== fingerprint)
-                        return undefined;
-                    const run = await runFactsOf(runStore, held.deliveredTaskId);
-                    return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
-                };
-                const replay = await liveReceiptOf(await decisions.get(token));
-                if (replay !== undefined)
-                    return replay;
-                let recordFailure;
-                const answerOfRecordFailure = async (failed) => {
-                    if (failed.kind === "faulted")
-                        return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+                if (origin.run.status === "running") {
+                    let verdict;
                     try {
-                        return await refusalAfterLostClaim(deps, runStore, plan.hostSessionId, failed.deliveredTaskId);
+                        verdict = await decisions.recordForRunningHolder({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId: plan.runId, acceptedAtMs: Date.now() }, { restated: restatement !== undefined });
                     }
-                    catch (e) {
-                        return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+                    catch (err) {
+                        return faultedAnswerOf(err, () => holderFenceFaultAnswer(plan.runId));
                     }
-                };
-                const delivery = {
-                    carried: [{ runId: plan.runId, token, outcome: plan.outcome }],
-                    commitBeforeLaunch: async (deliveredTaskId) => {
-                        let recorded;
-                        try {
-                            recorded = await decisions.record({ token, runId: plan.runId, hostSessionId: plan.hostSessionId, outcome: plan.outcome, fingerprint, deliveredTaskId, acceptedAtMs: Date.now() });
-                        }
-                        catch (err) {
-                            recordFailure = { kind: "faulted", err };
-                            throw err;
-                        }
-                        if (!recorded) {
-                            recordFailure = { kind: "not_recorded", deliveredTaskId };
-                            throw new Error(DELIVERY_NOT_RECORDED);
+                    switch (verdict) {
+                        case "not_running":
+                            break;
+                        case "not_held":
+                        case "restated":
+                        case "other_decision":
+                            return answerOfHolderFence(verdict, plan.runId);
+                        case "stands":
+                            return answerOfHolderRedeem(await redeemHere(plan.runId, origin.run.scope, { token, outcome: plan.outcome }), plan.runId, parkedReq.decision);
+                        default: {
+                            const unhandled = verdict;
+                            throw new Error(`unhandled workflow holder fence verdict: ${String(unhandled)}`);
                         }
-                    },
-                };
-                const hostToken = await cs
-                    .findPendingTokenBySession(plan.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" })
-                    .catch(() => undefined);
-                const admittedPayer = decodeCheckpointScope(cp.scope);
-                let out;
-                try {
-                    out = hostToken
-                        ? await resumeWake(plan.hostSessionId, plan.message, decider?.subject, req, acceptEarly, delivery, admittedPayer, restatement)
-                        : await startFreshHostTurn(plan.hostSessionId, plan.message.text, admittedPayer, req, delivery, plan.runId, restatement);
+                    }
                 }
-                catch (err) {
-                    const failed = recordFailure;
-                    if (failed === undefined)
-                        throw err;
-                    return await answerOfRecordFailure(failed);
+                const laned = await deliverViaResumeLane({
+                    hostSessionId: plan.hostSessionId,
+                    runId: plan.runId,
+                    runScope: origin.run.scope,
+                    token,
+                    outcome: plan.outcome,
+                    fingerprint,
+                    message: plan.message,
+                    ...(restatement !== undefined ? { restatement } : {}),
+                    initiator: { kind: "decide", req, caller: decider?.subject, ...(acceptEarly === true ? { acceptEarly: true } : {}), admittedPayer: decodeCheckpointScope(cp.scope) },
+                });
+                switch (laned.kind) {
+                    case "launched":
+                    case "replayed":
+                    case "refused":
+                        return laned.out;
+                    case "record_failed":
+                        return await answerOfRecordFailure(laned.failure, plan.hostSessionId);
+                    default: {
+                        const unhandled = laned;
+                        throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+                    }
                 }
-                const failed = recordFailure;
-                if (failed !== undefined)
-                    return await answerOfRecordFailure(failed);
-                if (acceptedTaskIdOf(out) === undefined)
-                    return (await liveReceiptOf(await decisions.get(token))) ?? out;
-                return out;
             }
         }
         const runCtx = await ctxPromise;
@@ -644,7 +713,7 @@ export function createResumeLegs(ctx) {
         if (runCtx === undefined || runCtx.ctx === null)
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
         const { runSessionId, ctx: storedCtx } = runCtx;
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const auth = { sessionId: runSessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -691,6 +760,7 @@ export function createResumeLegs(ctx) {
             onNotice: (n) => engineNotices.push(n),
             ...(ctx.unattendedLeg === true ? { unattendedLeg: true } : {}),
             ...(ctx.projectContext !== undefined ? { projectContext: ctx.projectContext } : {}),
+            ...(ctx.memorySeed !== undefined ? { memorySeed: ctx.memorySeed } : {}),
             lease,
             execution,
         });
@@ -771,7 +841,6 @@ export function createResumeLegs(ctx) {
         const legKey = createHash("sha256").update(String(token)).digest("hex");
         const streamApprovalOn = resolveStreamApprovalGate({
             toolApprovalEnabled: Boolean(deps.toolApproval),
-            streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
             backend: deps.backend,
             checkpointStore: deps.checkpointStore,
         }).active;
@@ -797,7 +866,7 @@ export function createResumeLegs(ctx) {
         let legClaim;
         let engineHandedOff = false;
         let restored;
-        const cancelledInClaimWindow = () => restored?.kind === "ended" && restored.row?.errorCode === CANCELLED_CODE;
+        const claimWindowCancelRow = () => (restored?.kind === "ended" && restored.row?.errorCode === CANCELLED_CODE ? restored.row : undefined);
         if (args.mintFreshRun && taskId && deps.runStore) {
             return { status: 409, body: await buildActiveRunConflict({ runStore: deps.runStore, checkpointStore: deps.checkpointStore, governance: deps.config, turnActivity: readTurnActivityMs }, sessionId, taskId) };
         }
@@ -948,7 +1017,8 @@ export function createResumeLegs(ctx) {
                 if (placementReject) {
                     if (inflightRuns.get(claimedTask) === cancelCtrl)
                         inflightRuns.delete(claimedTask);
-                    return cancelledInClaimWindow() ? { status: 200, body: { taskId: claimedTask, sessionId, status: "failed", errorCode: "cancelled" } } : placementReject;
+                    const cancelledRow = claimWindowCancelRow();
+                    return cancelledRow !== undefined ? settledLegAnswer({ taskId: claimedTask, sessionId, plane: planeOfEndedRow(cancelledRow), reparked: false, evidence: NO_SETTLEMENT_EVIDENCE }) : placementReject;
                 }
             }
             markChildrenStoppedByUserOnAbort(cancelCtrl.signal, taskId, subject);
@@ -979,7 +1049,7 @@ export function createResumeLegs(ctx) {
             ...heldDecisions,
             ...(workflowDecision !== undefined && taskId !== undefined ? { afterCheckpointResolve: () => workflowDecision.commitBeforeLaunch(taskId) } : {}),
         };
-        commitSessionInheritEnv(deps, sessionId, resumeCtx.ctx.body);
+        commitLegBindings(deps, undefined, sessionId, args.legFacts?.sessionBindings);
         if (args.onResumeCommitted)
             await args.onResumeCommitted();
         let unregisterEngineNotice;
@@ -1036,7 +1106,7 @@ export function createResumeLegs(ctx) {
                     const verifyTailContentMode = resumeTaskConfig.forwardSubagentEvents === true ? "on" : "progress_only";
                     const verifyInternals = {
                         ...launchInternals,
-                        ...compositionLegRoot(args.legFacts?.registeredCwd),
+                        ...compositionLegRoot(args.legFacts?.sessionBindings.cwd),
                         ...(taskId ? { onActivity: () => recordTurnActivity(taskId) } : {}),
                         onForwardEvent: (e) => {
                             fleetPub?.onForwardEvent(e);
@@ -1148,15 +1218,18 @@ export function createResumeLegs(ctx) {
                 const append = (type, data) => (rs && taskId ? serialAppend(type, data) : Promise.resolve());
                 cancelLedgerAppend = append;
                 await openEngineNoticePort(append);
-                const anchorOwner = subject ?? null;
                 const sessionFactsOf = sessionFactsReadOf(deps.sessionStorage);
-                const captureTurnAnchor = deps.resumeAnchorStore && sessionFactsOf
-                    ? async (eventId) => { const leaf = (await sessionFactsOf(sessionId))?.leafId; if (leaf)
-                        await deps.resumeAnchorStore.put(sessionId, eventId, leaf, anchorOwner); }
-                    : undefined;
-                const captureUserMessageAnchor = deps.resumeAnchorStore && taskId && freshRunClaimed
-                    ? async (entryId) => { await deps.resumeAnchorStore.put(sessionId, taskId, entryId, anchorOwner); }
-                    : undefined;
+                const anchors = createRunAnchorWriter({
+                    seat: deps.backend?.landedAttendants(),
+                    sessionId,
+                    owner: subject ?? null,
+                    promptKey: taskId && freshRunClaimed ? taskId : undefined,
+                    witness: args.legFacts?.sessionWitness,
+                    occupantOf: sessionOccupantReadOf(deps.sessionStorage),
+                    leafOf: sessionFactsOf === undefined ? undefined : async (id) => (await sessionFactsOf(id))?.leafId,
+                });
+                const captureTurnAnchor = anchors.turn;
+                const captureUserMessageAnchor = anchors.prompt;
                 const anchor = new TurnAnchorCapture(captureTurnAnchor, "resume", captureUserMessageAnchor);
                 const flush = async () => {
                     if (reasoning) {
@@ -1430,16 +1503,19 @@ export function createResumeLegs(ctx) {
                 const disposition = resumeRefusalDisposition(e);
                 if (disposition === "cancelled") {
                     const abortedText = (await settleCardForCancel()) ? CARD_SETTLED_BY_CANCEL_MESSAGE : e.message;
+                    const handleCause = cancelCtrl.cause();
+                    if (handleCause === undefined)
+                        recordFailOpen("server.runs.abort-cause-missing", `task=${taskId ?? ""} arm=resume-aborted`);
+                    const c = mintCancelledResult({ taskId: taskId ?? "", sessionId, startedAtMs: resumeLegStartedAt, message: abortedText, cause: handleCause ?? "cancel_verb" });
+                    const cancelled = outwardPlane(c.terminal);
+                    let landed;
                     if (claimedRow && taskId && deps.runStore) {
-                        const handleCause = cancelCtrl.cause();
-                        if (handleCause === undefined)
-                            recordFailOpen("server.runs.abort-cause-missing", `task=${taskId} arm=resume-aborted`);
-                        const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: abortedText, cause: handleCause ?? "cancel_verb" });
                         await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-resume-aborted ${errorText(err)}`));
-                        await deps.runStore.setTerminal(taskId, "failed", c, abortedText).catch(() => undefined);
+                        await deps.runStore.setTerminal(taskId, "failed", c, cancelled.errorMessage ?? null).catch(() => undefined);
+                        landed = await landedTerminalRow(deps.runStore, taskId, "resume-aborted");
                     }
                     settleFleet("failed");
-                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                    return settledLegAnswer({ taskId, sessionId, plane: landed !== undefined ? planeOfEndedRow(landed) : cancelled, reparked: false, evidence: NO_SETTLEMENT_EVIDENCE });
                 }
                 const retriable = disposition === "retriable";
                 let reparkEnded = false;
@@ -1466,22 +1542,26 @@ export function createResumeLegs(ctx) {
             }
             const thrownCause = cancelCtrl.cause();
             if (thrownCause !== undefined) {
+                const c = mintCancelledResult({ taskId: taskId ?? "", sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", cause: thrownCause });
+                const cancelled = outwardPlane(c.terminal);
+                let landed;
                 if (taskId && deps.runStore) {
                     await voidHeldParkCard(heldPark, sessionId, deps.checkpointStore, "resume");
-                    const c = mintCancelledResult({ taskId, sessionId, startedAtMs: resumeLegStartedAt, message: "cancelled by user", cause: thrownCause });
                     await cancelLedgerAppend?.("failed", buildCancelledLedgerRow(c)).catch((err) => recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=resume-append-thrown-cancel ${errorText(err)}`));
-                    await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
+                    await deps.runStore.setTerminal(taskId, "failed", c, cancelled.errorMessage ?? null).catch(() => undefined);
+                    landed = await landedTerminalRow(deps.runStore, taskId, "thrown-cancel");
                 }
                 settleFleet("failed");
-                return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                return settledLegAnswer({ taskId, sessionId, plane: landed !== undefined ? planeOfEndedRow(landed) : cancelled, reparked: false, evidence: NO_SETTLEMENT_EVIDENCE });
             }
             if (!engineHandedOff && legClaim !== undefined) {
                 const claim = legClaim;
                 await withdrawClaim(deps, claim, `the resume could not be handed to the engine: ${outwardThrownMessage(e, errorText(e))}`, "faulted");
                 const parkedAgain = claim.kind === "resumed" && restored?.kind !== "ended";
                 settleFleet(parkedAgain ? reparkStatus : "failed");
-                if (cancelledInClaimWindow())
-                    return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
+                const cancelledRow = claimWindowCancelRow();
+                if (cancelledRow !== undefined)
+                    return settledLegAnswer({ taskId, sessionId, plane: planeOfEndedRow(cancelledRow), reparked: false, evidence: NO_SETTLEMENT_EVIDENCE });
                 return resumeClaimFaultAnswerOf(e);
             }
             const heldParkWord = heldPark === undefined ? undefined : heldParkOf(heldPark);
@@ -1536,20 +1616,13 @@ export function createResumeLegs(ctx) {
                 await deps.runStore.setTerminal(taskId, resumePlane.status, sealed, resumePlane.errorMessage ?? null);
         }
         settleFleet(parkEnded !== undefined ? "failed" : checkpointReopened ? reparkStatus : resumePlane.status, fleetRunResiduals(sealed, sealed ? failureCodeOf(sealed.terminal) : undefined));
-        const answered = parkEnded !== undefined
-            ? { status: parkEnded.row?.status ?? "failed", errorCode: parkEnded.row?.errorCode ?? undefined, errorMessage: parkEnded.row?.error ?? undefined }
-            : { status: resumePlane.status, errorCode: resumePlane.errorCode, errorMessage: resumePlane.errorMessage };
-        return {
-            status: 200,
-            body: {
-                taskId, sessionId, status: answered.status,
-                bindingEnforced: true,
-                ...(answered.errorCode ? { errorCode: answered.errorCode } : {}),
-                ...(answered.errorMessage ? { errorMessage: redactErrorMessage(answered.errorMessage) ?? "" } : {}),
-                ...(checkpointReopened && parkEnded === undefined ? { retriable: true } : {}),
-                ...buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
-            },
-        };
+        return settledLegAnswer({
+            taskId,
+            sessionId,
+            plane: parkEnded !== undefined ? planeOfEndedRow(parkEnded.row) : resumePlane,
+            reparked: checkpointReopened && parkEnded === undefined,
+            evidence: buildSettlementEvidence({ at: "engine_terminal", commitment: args.commitment }),
+        });
     }
     async function mayDiscloseRowError(cs, token, decider) {
         if (decider === undefined || decider.operator)
@@ -1623,7 +1696,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1668,7 +1741,7 @@ export function createResumeLegs(ctx) {
                 }),
             };
         }
-        const ctx = restateResumeCtx(storedCtx, restatement);
+        const ctx = replayCtxOf(storedCtx, restatement);
         const windowDenial = await usageWindowDenialFor(subject === undefined ? undefined : personOf(recoveredSubject(subject)));
         if (windowDenial)
             return { status: windowDenial.status, body: windowDenial.body };
@@ -1680,7 +1753,7 @@ export function createResumeLegs(ctx) {
             const { spec, engineNotices } = resolved;
             const hostSpec = { ...spec, objective };
             const out = await mintAndDriveDurableRun(routeCtxBase, deps.runStore, {
-                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), seat: createSubmissionSeat({ deployment: deps.config }), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
+                prepared: { spec: hostSpec, runner: resolved.runner, legFacts: resolved.legFacts, auth, body: ctx.body, ...(objectiveWithheldIn(ctx) ? { bodyFromScreenedCtx: true } : {}), bodyPermissionModeWrite: { stored: ctx.permissionModeWrite }, seat: createSubmissionSeat({ deployment: deps.config }), acceptance: createRunAcceptance({}, { objective, screened: false }), peerLease: resolved.peerLease, execution: resolved.execution, ...(engineNotices.length > 0 ? { engineNotices } : {}) },
                 fleetScope: resumeFleetScope(req, auth),
                 elicitOwner: subject ?? null,
                 source: "workflow_parked_decide",
@@ -1706,7 +1779,7 @@ export function createResumeLegs(ctx) {
         const token = (await cs.findPendingTokenBySession(sessionId, undefined, wakeBinding)) ?? (await cs.findPendingTokenBySession(sessionId));
         if (!token)
             return { status: 404, body: refusalBody({ errorCode: "not_found.parked_checkpoint", message: "no parked checkpoint for this session (nothing to wake)" }) };
-        const who = { subject: caller, operator: explicitOperatorOk(caller === undefined ? undefined : personOf(caller), deps.config) };
+        const who = { subject: caller, operator: explicitOperatorOk(caller === undefined ? undefined : personOf(caller), deps.config, "operate") };
         if (!who.operator) {
             const scope = await cs.peekPendingScope(sessionId, wakeBinding).then((s) => (s === undefined ? cs.peekPendingScope(sessionId) : s)).catch(() => undefined);
             if (!keyAdmits("scope.decide", who, scopeCellOf(scope ?? CHECKPOINT_PUBLIC_SCOPE))) {
@@ -1757,7 +1830,7 @@ export function createResumeLegs(ctx) {
             return resumeCtxUnreadableAnswer();
         if (ctxRead.kind === "absent")
             return { status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) };
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const auth = { sessionId: cp.sessionId, subject: checkpointPartsOf(cp.scope)?.subject, memoryScope: ctx.memoryScope };
         const resolved = await resolveResumeSpecOrBlocked(ctx, req, auth);
         if (!resolved.ok)
@@ -1784,7 +1857,7 @@ export function createResumeLegs(ctx) {
                 ...(workflowDecision !== undefined ? { workflowDecision } : {}),
                 ...(engineNotices.length > 0 ? { engineNotices } : {}),
                 ...(acceptEarly === true ? { acceptEarly: true } : {}),
-                ...(req !== undefined ? { callerInitiated: true } : {}),
+                ...(req !== undefined || workflowDecision !== undefined ? { callerInitiated: true } : {}),
                 ...(ownerLeaseAdmittedFor !== undefined && auth.subject === ownerLeaseAdmittedFor ? { ownerLeaseAdmitted: true } : {}),
             });
         }
@@ -1792,6 +1865,183 @@ export function createResumeLegs(ctx) {
             resolved.peerLease.release();
         }
     }
+    async function answerOfRecordFailure(failed, hostSessionId) {
+        if (failed.kind === "faulted")
+            return faultedAnswerOf(failed.err, CONTINUATION_CLAIM_FACE.faulted);
+        const runStore = deps.runStore;
+        if (runStore === undefined)
+            throw new Error("workflow park decide: a decision row failed to land without a run store — the claim fence it was written under is the run store");
+        try {
+            return await refusalAfterLostClaim(deps, runStore, hostSessionId, failed.deliveredTaskId);
+        }
+        catch (e) {
+            return faultedAnswerOf(e, CONTINUATION_CLAIM_FACE.faulted);
+        }
+    }
+    async function deliverViaResumeLane(d) {
+        const decisions = deps.workflowParkDecisions;
+        const runStore = deps.runStore;
+        const cs = deps.checkpointStore;
+        if (decisions === undefined || runStore === undefined || cs === undefined) {
+            return { kind: "refused", out: { status: 501, body: refusalBody({ errorCode: "capability.run_store_required", message: "delivering this decision requires a durable run store (DB_BACKEND=mysql|pg|local)" }) } };
+        }
+        const liveReceiptOf = async (held) => {
+            if (held === null || held.fingerprint !== d.fingerprint)
+                return undefined;
+            const run = await runFactsOf(runStore, held.deliveredTaskId);
+            return run != null && !isTerminalRunStatus(run.status) ? acceptedResumingReceipt(held.deliveredTaskId, held.hostSessionId, NO_SETTLEMENT_EVIDENCE) : undefined;
+        };
+        const replay = await liveReceiptOf(await decisions.get(d.token));
+        if (replay !== undefined)
+            return { kind: "replayed", out: replay };
+        await runChannelEnded(d.runId, d.runScope);
+        const condition = d.initiator.kind === "run_ended" ? { expect: d.fingerprint } : undefined;
+        let recordFailure;
+        const delivery = {
+            carried: [{ runId: d.runId, token: d.token, outcome: d.outcome }],
+            commitBeforeLaunch: async (deliveredTaskId) => {
+                let recorded;
+                try {
+                    recorded = await decisions.record({ token: d.token, runId: d.runId, hostSessionId: d.hostSessionId, outcome: d.outcome, fingerprint: d.fingerprint, deliveredTaskId, acceptedAtMs: Date.now() }, condition);
+                }
+                catch (err) {
+                    recordFailure = { kind: "faulted", err };
+                    throw err;
+                }
+                if (!recorded) {
+                    recordFailure = { kind: "not_recorded", deliveredTaskId };
+                    throw new Error(DELIVERY_NOT_RECORDED);
+                }
+            },
+        };
+        const hostToken = await cs.findPendingTokenBySession(d.hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" }).catch(() => undefined);
+        const req = d.initiator.kind === "decide" ? d.initiator.req : undefined;
+        const acceptEarly = d.initiator.kind === "decide" ? d.initiator.acceptEarly : undefined;
+        let out;
+        try {
+            out = hostToken
+                ? await resumeWake(d.hostSessionId, d.message, d.initiator.caller, req, acceptEarly, delivery, d.initiator.admittedPayer, d.restatement)
+                : await startFreshHostTurn(d.hostSessionId, d.message.text, d.initiator.admittedPayer, req, delivery, d.runId, d.restatement);
+        }
+        catch (err) {
+            const failed = recordFailure;
+            if (failed === undefined)
+                throw err;
+            return { kind: "record_failed", failure: failed };
+        }
+        const failed = recordFailure;
+        if (failed !== undefined)
+            return { kind: "record_failed", failure: failed };
+        if (acceptedTaskIdOf(out) === undefined) {
+            const raced = await liveReceiptOf(await decisions.get(d.token));
+            return raced !== undefined ? { kind: "replayed", out: raced } : { kind: "refused", out };
+        }
+        return { kind: "launched", out };
+    }
+    async function handOverRunEndedDecisions(runId) {
+        if (isAdoptionQuiescing())
+            throw new Error(`workflow run ${runId}: an adoption arc is running in this process — the decision handoff yields and is retried on the next recovery sweep`);
+        const handing = handOverHeldRows(runId);
+        trackMaintenanceLeg(handing);
+        await handing;
+    }
+    async function handOverHeldRows(runId) {
+        const decisions = deps.workflowParkDecisions;
+        const records = deps.workflowRunStore;
+        const cs = deps.checkpointStore;
+        const index = deps.workflowAgentSessionIndex;
+        if (decisions === undefined || records === undefined || cs === undefined || index === undefined)
+            return;
+        const run = await records.get(runId);
+        if (run === null)
+            return;
+        const parks = readRunParks(run);
+        if (parks === undefined) {
+            deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: "parks_unreadable" });
+            return;
+        }
+        const held = heldParksOf(runId, parks);
+        if (run.status === "running") {
+            for (const park of held) {
+                if ((await decisions.get(park.token)) !== null) {
+                    throw new Error(`workflow run ${runId}: its completion arrived while its record still reads running (the terminal record write did not land) and it holds an accepted decision — leaving the completion pending until recovery ends the record`);
+                }
+            }
+            return;
+        }
+        for (const park of held) {
+            const row = await decisions.get(park.token);
+            if (row === null)
+                continue;
+            const deliverable = await deliverableEntryOf({ checkpointStore: cs, workflowAgentSessionIndex: index, workflowRunStore: records }, row);
+            if (deliverable.kind === "unreadable")
+                throw new Error(`workflow run ${runId}: the card or the holder of a recorded decision could not be read — leaving the completion pending for the next recovery sweep`);
+            if (deliverable.kind === "not_deliverable" || deliverable.entry.runId !== runId)
+                continue;
+            const result = await handOverOne(runId, run.scope, deliverable, row);
+            deps.metrics?.inc("workflow_park_handoff_total", { result: result.kind });
+            switch (result.kind) {
+                case "delivered":
+                    continue;
+                case "retry":
+                    throw new Error(`workflow run ${runId}: the decision handoff must be retried (${result.why}) — leaving the completion pending for the next recovery sweep`);
+                case "refused":
+                    deps.logger?.warn?.("workflow_park_handoff_refused", { runId, why: result.why });
+                    continue;
+                default: {
+                    const unhandled = result;
+                    throw new Error(`unhandled workflow park handoff result: ${JSON.stringify(unhandled)}`);
+                }
+            }
+        }
+    }
+    async function handOverOne(runId, runScope, parkEntry, row) {
+        const cs = deps.checkpointStore;
+        const hostSessionId = parkEntry.origin.run.originatingSessionId;
+        if (hostSessionId === undefined || hostSessionId === "")
+            return { kind: "refused", why: "host_unknown" };
+        const ownerScope = parkEntry.card.scope;
+        const hostToken = await cs.findPendingTokenBySession(hostSessionId, undefined, { gateKinds: TERMINAL_PARK_GATE_KINDS, pick: "oldest" });
+        if (hostToken) {
+            const hostCard = await cs.get(hostToken);
+            if (hostCard !== null && hostCard.scope !== ownerScope)
+                return { kind: "refused", why: "owner_mismatch" };
+        }
+        const parts = checkpointPartsOf(ownerScope);
+        const quota = ownerCostQuotaDenied(parts?.person);
+        if (quota !== undefined)
+            return handoffResultOf(quota, "payer_cost_quota");
+        const lease = await ownerFleetLeaseDenied(parts?.person);
+        if (lease !== undefined)
+            return handoffResultOf(lease, "payer_fleet_lease");
+        const laned = await deliverViaResumeLane({
+            hostSessionId,
+            runId,
+            runScope,
+            token: row.token,
+            outcome: row.outcome,
+            fingerprint: row.fingerprint,
+            message: workflowParkGuidance(runId, parkEntry.origin.park.callKey, row.outcome.decision === "allow" ? "approve" : "deny"),
+            initiator: { kind: "run_ended", caller: parts?.subject, admittedPayer: decodeCheckpointScope(ownerScope) },
+        });
+        switch (laned.kind) {
+            case "launched":
+            case "replayed":
+                return { kind: "delivered" };
+            case "refused":
+                return handoffResultOf(laned.out);
+            case "record_failed": {
+                if (laned.failure.kind === "faulted")
+                    return { kind: "retry", why: "store_fault" };
+                const now = await deps.workflowParkDecisions.get(row.token);
+                return now?.fingerprint === row.fingerprint ? { kind: "retry", why: "claim_lost" } : { kind: "refused", why: "superseded" };
+            }
+            default: {
+                const unhandled = laned;
+                throw new Error(`unhandled resume lane delivery: ${JSON.stringify(unhandled)}`);
+            }
+        }
+    }
     async function preparePlanReview(sessionId, log, decider, sighting, restatement) {
         const cs = deps.checkpointStore;
         const refuse = (answer) => ({ ok: false, answer });
@@ -1865,7 +2115,7 @@ export function createResumeLegs(ctx) {
             return refuse(resumeCtxUnreadableAnswer());
         if (ctxRead.kind === "absent")
             return refuse({ status: 409, body: refusalBody({ errorCode: "conflict.resume_context_unavailable", message: "resume context missing — cannot rebuild task config" }) });
-        const ctx = restateResumeCtx(ctxRead.ctx, restatement);
+        const ctx = replayCtxOf(ctxRead.ctx, restatement);
         const replay = storedBodyReplayRefusal(ctx, deps.config);
         if (replay !== undefined)
             return refuse(refuseStoredBodyReplay(sessionId, replay));
@@ -1881,7 +2131,7 @@ export function createResumeLegs(ctx) {
             throw new Error("drivePlanReview: permissionModeAfter was passed for a task whose stored permission mode is not \"plan\" — the caller must refuse this before any state changes (see the plan_review route's pre-nonce gate)");
         }
         const approvedMode = planReviewDecisionExitsPlan(decision) && effMode === "plan" ? (permissionModeAfter ?? "default") : undefined;
-        const rebuildCtx = approvedMode === undefined ? ctx : { ...ctx, body: { ...ctx.body, permissionMode: approvedMode } };
+        const rebuildCtx = approvedMode === undefined ? ctx : withStoredPermissionMode(ctx, approvedMode, "plan_review");
         const resolved = await resolveResumeSpecOrBlocked(rebuildCtx, req, auth);
         if (!resolved.ok)
             return resolved.answer;
@@ -1920,6 +2170,6 @@ export function createResumeLegs(ctx) {
         local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal(), capabilities: createCapabilitiesLocal() },
         legs: { prepareSpec, finalizeTaskResult, resumeCheckpoint, driveResumeIntoRunLog, resumePreempted, resumeWake, preparePlanReview, drivePlanReview, sessionNotify: sessionNotifyDoor },
     };
-    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor };
+    return { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, decisionRowAdmits, resumePreempted, startFreshHostTurn, resumeWake, preparePlanReview, drivePlanReview, sessionNotifyDoor, handOverRunEndedDecisions };
 }
 //# sourceMappingURL=resume-legs.js.map