@sema-agent/server 7.63.0 → 7.64.0

package/dist/http/route-ctx.d.ts

@@ -15,7 +15,8 @@
  * 本文件对 server.ts 的引用一律 `import type`(tsc 擦除,非装载边)。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { ApprovalSettledBy, TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
+import type { HostDecision } from "../host-decision.js";
+import type { TaskStream, TaskSpec, TaskResult, QuestionAnswer, CheckpointToken, ResumeOutcome, Runner } from "@sema-agent/core";
 import type { FlatServiceDeps, RequestAuth } from "./server.js";
 import type { TaskRequestBody, DecideBinding } from "./wire-types.js";
 import type { IdempotencyCache } from "./idempotency.js";
@@ -244,10 +245,12 @@ export interface RouteLegs {
     /** 同步腿的终局记账(计费/配额/指标),tasks 域用。 */
     finalizeTaskResult(result: TaskResult, principal: string | undefined, objective: string, sessionId: string | undefined): void;
     /** approvals 决策腿:session → pending checkpoint → markResuming CAS → 驱动续跑。
-     *  `settledBy` = **这次结算的出处**(core `ApprovalSettledBy`),必填:本腿有两个调用方(HTTP
-     *  `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
-     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。 */
-    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, settledBy: ApprovalSettledBy, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
+     *  `hostDecision` = **这次结算的事实**(谁结束了这次等待 + 通道自报的归属),必填:本腿有两个调用方
+     *  (HTTP `/decide` = 人;内部 D-D SLA deny-sweep = 窗到期),而函数内部分辨不出谁在叫它 —— 必填参数把
+     *  「漏报出处」变成编译错,不是一条下游把「没人答」渲染成「有人拒」的静默假出处。
+     *  🔴 S-136(core 7.6.0 S6-A):宿主报事实、core 铸词 —— server 不再传结算词(旧形传 core 的三词之一,
+     *  于是「哪个词配哪个 decision」这条相容规则要 server 自己记,而记错的方向恰是上面那句要防的)。 */
+    resumeCheckpoint(sessionId: string, decision: "approve" | "deny", reason: string | undefined, hostDecision: HostDecision, req?: IncomingMessage, answer?: QuestionAnswer, binding?: DecideBinding, 
     /** [ref] codex R4(验真后修):remember 豁免的 grant 挂点。**工具名不再由路由自己读**(那是与本函数
      *  载入行分歧的第三次 scope-less 读,三读分歧下会给他人工具落豁免=提权)——由本函数把**已属主校验的
      *  载入 cp** 的工具名(`validatedToolName`,非 tool_approval / AskUserQuestion / legacy null ⇒ `null`

package/dist/http/routes/a2a-serve.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { createHash } from "node:crypto";
 import { memoRedactedRead, redactErrorMessage } from "../../observability/run-terminal-log.js";
 import { A2A_TASK_STATES } from "@sema-agent/core";
@@ -84,8 +85,9 @@ function statusTextForRun(run, state) {
     const memo = (seat, raw) => (isTerminalRunStatus(run.status) ? memoRedactedRead(`a2a.${seat}`, raw, (v) => redactErrorMessage(v) ?? "") : (redactErrorMessage(raw) ?? ""));
     if (run.error)
         return memo("error", run.error);
-    if (run.result?.errorMessage)
-        return memo("errorMessage", run.result.errorMessage);
+    const runPlaneMessage = persistedPlaneOf(run.result).errorMessage;
+    if (runPlaneMessage)
+        return memo("errorMessage", runPlaneMessage);
     return undefined;
 }
 function taskFromRun(run, stale) {

package/dist/http/routes/approvals-assistant.d.ts

@@ -1,16 +1,3 @@
-/**
- * [ref] A9 域模块 —— 人在环审批面(durable F4 + legacy)与 assistant-scheduler 三动词。
- *
- * 路由(前缀 `/v1/approvals` 与 `/v1/assistant`):
- *   · durable 腿(接了 checkpointStore 时优先):list / stream(SSE 原生推送)/ decide|answer / preempt /
- *     resume / plan_review;
- *   · legacy 腿(approvalStore 轮询车道)已于 5.0.0 整体退役([ref]/[ref] A-5)——无 checkpointStore 时
- *     `/v1/approvals` 落 404(诚实缺席),不再有 trusted-header 决裁面。
- *
- * 所有会**烧模型**的续跑都经 `ctx.legs.*`(resumeCheckpoint / resumePreempted / resumePlanReview)走 resume
- * 家族的同一条腿:lease admission、markResuming CAS、写 run log、发 fleet 帧都在腿里,本域只做入站鉴权/形状门。
- * 本域零可变状态(抢占登记簿 `preemptableRuns` 属跨域 registry)。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";

package/dist/http/routes/approvals-assistant.js

@@ -1,3 +1,4 @@
+import { personDecision } from "../../host-decision.js";
 import { DECIDED_REPLAY_SCAN_CAP, approvalPayloadFingerprint } from "../../plugins/checkpoint-store-sql.js";
 import { APPROVAL_GATE_KINDS } from "../../tool-approval.js";
 import { isParkedRunStatus } from "../../plugins/store-contracts.js";
@@ -483,7 +484,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                     pendingGrant = { sessionId: grant.overrideSessionId ?? sessionId, toolName: canonical };
                 }
                 : undefined;
-            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, "human", req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
+            const out = await resumeCheckpoint(sessionId, decision, body.reason ?? undefined, personDecision(deciderPrincipal), req, answer, binding, grantOnCommit, true, { principal: deciderPrincipal, explicitOperator });
             const outErrorCode = out.body.errorCode;
             if (pendingGrant !== undefined && out.status === 200 && outErrorCode !== "cancelled" && deps.approvalExemptionStore) {
                 try {

package/dist/http/routes/runs.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { memoRedactedRead, memoRedactTerminalResult, redactErrorMessage, redactHead, redactLedgerEventData, redactTerminalResult } from "../../observability/run-terminal-log.js";
 import { z } from "zod";
 import { uuidv7, mintCheckpointToken, CheckpointError, validatePendingSteer } from "@sema-agent/core";
@@ -260,7 +261,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
                 result: isTerminalRunStatus(run.status) ? memoRedactTerminalResult("run.result", run.result ?? undefined) : redactTerminalResult(run.result ?? undefined),
                 supervisorCost,
                 suggestions,
-                errorCode: stale ? undefined : (run.result?.errorCode ?? undefined),
+                errorCode: stale ? undefined : (persistedPlaneOf(run.result).errorCode ?? undefined),
                 error: stale ? "run stalled (instance lost?)" : isTerminalRunStatus(run.status) ? memoRedactedRead("run.error", run.error ?? undefined, redactErrorMessage) : redactErrorMessage(run.error ?? undefined),
                 jobId: run.jobId ?? undefined,
                 source: run.source ?? undefined,
@@ -331,7 +332,7 @@ async function handleRunsBody(req, res, url, ctx, miss) {
             const err = note;
             try {
                 const cancelContext = buildCancelContext(taskId, Date.parse(run.createdAt));
-                const result = { taskId, sessionId: run.sessionId, status: "failed", errorCode: "cancelled", errorMessage: err, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
+                const result = { taskId, sessionId: run.sessionId, terminal: { kind: "failed", code: "cancelled", message: err }, stats: { turns: 0, tokens: 0 }, ...(cancelContext ? { cancelContext } : {}) };
                 let lastErr;
                 for (let attempt = 0;; attempt++) {
                     try {

package/dist/http/routes/tasks.js

@@ -1,6 +1,7 @@
 import { redactErrorMessage, redactHead, redactTerminalResult } from "../../observability/run-terminal-log.js";
-import { runWithVerification, runCascade, uuidv7 } from "@sema-agent/core";
-import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, stripCheckpointToken, HEARTBEAT_MS } from "../../runs.js";
+import { runWithVerification, runCascade, uuidv7, terminalProjection } from "@sema-agent/core";
+import { graftParkToolCallId, markChildrenStoppedByUserOnAbort, resumeAtHttpStatus, HEARTBEAT_MS } from "../../runs.js";
+import { stripResumeToken } from "../../terminal.js";
 import { withPrincipal } from "../../observability/principal-context.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals, isFleetAgentTerminalNotification } from "../../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../../fleet/subagent-tail-bus.js";
@@ -50,11 +51,12 @@ async function handleTasksBody(req, res, url, ctx, miss) {
     const reqState = ctx.req;
     const source = ctx.req.source;
     const noteRunOutcome = (r) => {
-        if (!r?.status)
+        if (!r?.terminal)
             return;
-        reqState.runStatus = r.status;
-        if (r.errorCode)
-            reqState.runErrorCode = r.errorCode;
+        const plane = terminalProjection(r.terminal);
+        reqState.runStatus = plane.status;
+        if (plane.errorCode)
+            reqState.runErrorCode = plane.errorCode;
     };
     if (req.method === "POST" && (url === "/v1/tasks" || url === "/v1/tasks/stream")) {
         const rawIdem = headerStr(req.headers["idempotency-key"]);
@@ -193,10 +195,8 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                     return {
                         taskId: durableTaskId ?? "",
                         sessionId: prepared.spec.sessionId ?? "",
-                        status: "failed",
+                        terminal: { kind: "failed", code: "cancelled", message: errorMessage },
                         result: "",
-                        errorCode: "cancelled",
-                        errorMessage,
                         stats: { turns: 0, tokens: 0 },
                         ...(ctx ? { cancelContext: ctx } : {}),
                     };
@@ -403,16 +403,16 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                 if (ev.type === "message_committed" && ev.role === "user")
                                     userMsgEntryId = ev.entryId;
                                 if (ev.type === "done") {
-                                    finalResult = redactTerminalResult(stripCheckpointToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
+                                    finalResult = redactTerminalResult(stripResumeToken(await graftParkToolCallId(ev.result, deps.checkpointStore)));
                                     if (durableTaskId && finalResult)
                                         finalResult = { ...finalResult, taskId: durableTaskId };
-                                    if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.status === "failed" && !finalResult.errorCode) {
-                                        finalResult = { ...finalResult, errorCode: "cancelled" };
+                                    if (durableTaskId && cancelledViaVerb.has(durableTaskId) && finalResult?.terminal.kind === "failed" && !finalResult.terminal.code) {
+                                        finalResult = { ...finalResult, terminal: { ...finalResult.terminal, code: "cancelled" } };
                                     }
                                     finalizeTaskResult(ev.result, principal, prepared.spec.objective, prepared.spec.sessionId);
                                     noteRunOutcome(finalResult);
                                     putRewindAnchor();
-                                    settleFleet(finalResult?.status ?? "completed", fleetRunResiduals(finalResult));
+                                    settleFleet(finalResult ? terminalProjection(finalResult.terminal).status : "completed", fleetRunResiduals(finalResult));
                                     if (ledgerSink && finalResult) {
                                         if (usageKey && deps.modelUsage && deps.runStore && durableTaskId) {
                                             const rs2 = deps.runStore;
@@ -622,12 +622,13 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         }, withApproval)
                         : withApproval());
                     if (durableTaskId && deps.runStore) {
-                        if (finalResult?.status === "suspended" && deps.checkpointStore)
+                        const finalPlane = finalResult ? terminalProjection(finalResult.terminal) : undefined;
+                        if (finalPlane?.status === "suspended" && deps.checkpointStore)
                             await deps.runStore.setSuspended(durableTaskId);
-                        else if (finalResult?.status === "needs_review" && deps.checkpointStore)
+                        else if (finalPlane?.status === "needs_review" && deps.checkpointStore)
                             await deps.runStore.setNeedsReview(durableTaskId);
-                        else if (finalResult)
-                            await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
+                        else if (finalResult && finalPlane)
+                            await deps.runStore.setTerminal(durableTaskId, finalPlane.status, finalResult, finalPlane.errorMessage ?? null);
                         else {
                             putRewindAnchor();
                             const pending = await deps.checkpointStore?.findPendingTokenBySession(prepared.spec.sessionId);
@@ -688,8 +689,9 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                                         ledgerTerminal = true;
                                         await ledgerSink.onDone(finalResult).catch(() => undefined);
                                     }
-                                    await deps.runStore.setTerminal(durableTaskId, finalResult.status, finalResult, finalResult.errorMessage ?? null);
-                                    settleFleet(finalResult.status, fleetRunResiduals(finalResult));
+                                    const retryPlane = terminalProjection(finalResult.terminal);
+                                    await deps.runStore.setTerminal(durableTaskId, retryPlane.status, finalResult, retryPlane.errorMessage ?? null);
+                                    settleFleet(retryPlane.status, fleetRunResiduals(finalResult));
                                 }
                                 else if (ac.signal.aborted) {
                                     const err = "stream aborted before completion (run cancelled)";
@@ -721,7 +723,7 @@ async function handleTasksBody(req, res, url, ctx, miss) {
             };
             counters.uncountedBillableInflight++;
             try {
-                resp = await idemCache.run(idemKey, runStreamSubmitLeg, (r) => r.body?.status === "completed");
+                resp = await idemCache.run(idemKey, runStreamSubmitLeg, (r) => r.body?.terminal.kind === "completed");
             }
             catch (e) {
                 deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
@@ -805,33 +807,35 @@ async function handleTasksBody(req, res, url, ctx, miss) {
                         cancelledViaVerb.delete(durableTaskId);
                     }
                 }
-                if (cancelVerbLabel && result.status === "failed" && !result.errorCode) {
-                    result = { ...result, errorCode: "cancelled" };
+                if (cancelVerbLabel && result.terminal.kind === "failed" && !result.terminal.code) {
+                    result = { ...result, terminal: { ...result.terminal, code: "cancelled" } };
                 }
                 const resumeAtStatus = resumeAtHttpStatus(result);
                 if (resumeAtStatus) {
+                    const resumeAtPlane = terminalProjection(result.terminal);
                     if (durableTaskId && deps.runStore)
-                        await deps.runStore.setTerminal(durableTaskId, "failed", stripCheckpointToken(result), result.errorMessage ?? null);
-                    const retryAfterSec = result.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
+                        await deps.runStore.setTerminal(durableTaskId, "failed", stripResumeToken(result), resumeAtPlane.errorMessage ?? null);
+                    const retryAfterSec = resumeAtPlane.errorCode === "memory.admission_required" && result.retryAfterMs !== undefined
                         ? Math.max(1, Math.ceil(result.retryAfterMs / 1000))
                         : undefined;
-                    return { status: resumeAtStatus, body: { errorCode: result.errorCode, error: redactErrorMessage(result.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
+                    return { status: resumeAtStatus, body: { errorCode: resumeAtPlane.errorCode, error: redactErrorMessage(resumeAtPlane.errorMessage) ?? "resume-at failed", ...(retryAfterSec !== undefined ? { retryAfterSec } : {}) } };
                 }
-                if (result.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
+                const syncPlane = terminalProjection(result.terminal);
+                if (syncPlane.status === "suspended" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setSuspended(durableTaskId);
                     return { status: 200, body: withDiscoveryNotice({ taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "suspended" }) };
                 }
-                if (result.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
+                if (syncPlane.status === "needs_review" && deps.checkpointStore && deps.runStore && prepared.spec.sessionId) {
                     if (durableTaskId)
                         await deps.runStore.setNeedsReview(durableTaskId);
                     return { status: 200, body: withDiscoveryNotice({ taskId: durableTaskId, sessionId: prepared.spec.sessionId, status: "needs_review" }) };
                 }
                 if (durableTaskId && deps.runStore)
-                    await deps.runStore.setTerminal(durableTaskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
+                    await deps.runStore.setTerminal(durableTaskId, syncPlane.status, stripResumeToken(result), syncPlane.errorMessage ?? null);
                 finalizeTaskResult(result, principal, prepared.spec.objective, prepared.spec.sessionId);
                 noteRunOutcome(result);
-                return { status: 200, body: withDiscoveryNotice(redactTerminalResult(stripCheckpointToken(result))) };
+                return { status: 200, body: withDiscoveryNotice(redactTerminalResult(stripResumeToken(result))) };
             };
             const resp = await idemCache.run(idemKey, runSyncSubmitLeg, (r) => r.status < 400);
             sendSubmitResult(res, resp);

package/dist/http/routes/workflows.d.ts

@@ -1,14 +1,3 @@
-/**
- * [ref] A9 域模块 —— S8 自编排 workflow 面([ref]/98)。
- *
- * 路由:`GET /v1/workflows`(列表)· `GET /v1/workflows/:id[/journal]`(详情)· `GET /v1/workflows/:id/stream`
- * (在进程内 live SSE)· `POST /v1/workflows/:id/agents/:label/steer`(SVC-5:给 workflow 里某个仍在跑的
- * agent 注入引导)。
- *
- * ⚠️ 只读三路跑在全局 service-credential 门**之前**(与 trace/fleet 同列),因此块内那道按 scope 的 per-tenant
- * 门就是这些读的唯一租户边界;steer 那路在门之后。两段在 `handle()` 里原本相隔很远(中间隔着 tasks/runs 两域),
- * 拆分保持了各自的相对位置 —— 本文件里的先后只是同域归并,不代表路由顺序变化。本域零可变状态。
- */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { RouteCtx } from "../route-ctx.js";
 export declare function handleWorkflows(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;

package/dist/http/routes/workflows.js

@@ -1,3 +1,4 @@
+import { persistedPlaneOf } from "../../terminal.js";
 import { z } from "zod";
 import { getWorkflowRun, subscribeWorkflow, deriveAgentDisplayStatus, callKeyOrdinal } from "@sema-agent/core";
 import { redactSteerIn, STEER_IN_MAX_CHARS, STEER_IN_MAX_REQUEST_CHARS } from "../../orchestration/workflow-agent-steer.js";
@@ -85,20 +86,23 @@ async function handleWorkflowsReadBody(req, res, url, ctx, miss) {
                 journalProjectionMemo.set(memoKey, out);
                 return out;
             };
-            const projectResultUncached = (callKey, r) => ({
-                callKey,
-                ordinal: callKeyOrdinal(callKey),
-                status: r.status,
-                ...(r.errorMessage ? { error: firstLine(r.errorMessage) } : {}),
-                ...(r.result
-                    ? {
-                        result: redactHead(r.result, MAX_RESULT_CHARS),
-                        ...(r.result.length > MAX_RESULT_CHARS ? { resultTruncated: true, resultChars: r.result.length } : {}),
-                    }
-                    : {}),
-                ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
-                ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
-            });
+            const projectResultUncached = (callKey, r) => {
+                const plane = persistedPlaneOf(r);
+                return {
+                    callKey,
+                    ordinal: callKeyOrdinal(callKey),
+                    status: plane.status,
+                    ...(plane.errorMessage ? { error: firstLine(plane.errorMessage) } : {}),
+                    ...(r.result
+                        ? {
+                            result: redactHead(r.result, MAX_RESULT_CHARS),
+                            ...(r.result.length > MAX_RESULT_CHARS ? { resultTruncated: true, resultChars: r.result.length } : {}),
+                        }
+                        : {}),
+                    ...(r.stats ? { tokens: r.stats.tokens, turns: r.stats.turns } : {}),
+                    ...(r.haltedOnUserRejection === true ? { haltedOnUserRejection: true } : {}),
+                };
+            };
             const js = deps.workflowJournalStore;
             let projected;
             if (js.loadPage) {

package/dist/http/server.js

@@ -2,7 +2,7 @@ import http from "node:http";
 import { redactErrorMessage, redactHead } from "../observability/run-terminal-log.js";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME } from "@sema-agent/core";
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow, GLOBAL_USAGE_KEY, usageRetryAfterMs, RUN_WORKFLOW_TOOL_NAME, terminalProjection, PAUSE_REGISTRY } from "@sema-agent/core";
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { isModelAllowlisted, matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
@@ -15,7 +15,9 @@ import { centerEntitlementSourceWired } from "../runtime-caps-resolver.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { normalizeApproachNotice, unknownTaskAgentModelRef, validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
-import { runInBackground, evictIfConflict, stripCheckpointToken, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { runInBackground, evictIfConflict, parkToolCallId, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
+import { failureCodeOf, nestedPauseOf, stripResumeToken } from "../terminal.js";
+import { personDecision } from "../host-decision.js";
 import { readTurnActivityMs, recordTurnActivity } from "../turn-activity.js";
 import { recordResumeResourceWindow } from "../resource-window.js";
 import { publicStoreProbeError } from "../store-live-probe.js";
@@ -122,17 +124,14 @@ function mentionableNames(config, catalog) {
     return Object.keys(catalog).filter((n) => n !== "default" && isModelAllowlisted(n, catalog, allowlist));
 }
 function isCheckpointReopenedFailure(r) {
-    return r.status === "failed" && (r.errorCode === "resume.env_failed" || r.errorCode === "resume.tool_unavailable");
+    const code = failureCodeOf(r.terminal);
+    return code === "resume.env_failed" || code === "resume.tool_unavailable";
 }
 function nestedParkStatusOf(r) {
-    switch (r.errorCode) {
-        case "unexpected.needs_review":
-            return "needs_review";
-        case "unexpected.suspended":
-            return "suspended";
-        default:
-            return undefined;
-    }
+    const paused = nestedPauseOf(r.terminal);
+    if (paused === undefined)
+        return undefined;
+    return PAUSE_REGISTRY[paused.gate.kind].taskStatus;
 }
 const ROUTE_DOMAINS = [
     handleTraceUsage,
@@ -1014,7 +1013,7 @@ export function createHttpServer(rawDeps) {
         }
     }
     const resumeFleetScope = (req, auth) => req ? (gatedPrincipal(req, deps.config) ?? "default") : (auth.principal ?? "default");
-    async function resumeCheckpoint(sessionId, decision, reason, settledBy, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
+    async function resumeCheckpoint(sessionId, decision, reason, hostDecision, req, answer, binding, onResumeCommitted, acceptEarly, decider) {
         const cs = deps.checkpointStore;
         const token = (await cs.findPendingTokenBySession(sessionId, undefined, { gateKinds: APPROVAL_GATE_KINDS })) ?? (await cs.findPendingTokenBySession(sessionId));
         if (binding?.checkpointToken && binding.checkpointToken !== token) {
@@ -1162,7 +1161,7 @@ export function createHttpServer(rawDeps) {
             if (out.body?.errorCode === "cancelled")
                 return;
             try {
-                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", settledBy, settledAtMs: Date.now() });
+                lateSettleSink.recordLateSettle({ ...lateSettleAnchor, outcome: decision === "approve" ? "allowed" : "denied", decidedBy: hostDecision.decidedBy, ...(hostDecision.approver !== undefined ? { approver: hostDecision.approver } : {}), settledAtMs: Date.now() });
             }
             catch (e) {
                 recordFailOpen("server.approval-ask-audit.append-failed", `kind=late_settle err=${e instanceof Error ? e.message : String(e)}`);
@@ -1188,7 +1187,7 @@ export function createHttpServer(rawDeps) {
                 ...(deps.logger ? { warn: (event, fields) => deps.logger?.warn?.(event, fields) } : {}),
             }, {
                 token, scope: cp.scope, sessionId: cp.sessionId, pendingAction: cp.pendingAction,
-                decision, settledBy, ...(reason !== undefined ? { reason } : {}),
+                decision, hostDecision, ...(reason !== undefined ? { reason } : {}),
                 ...(binding !== undefined ? { binding: { ...(binding.boundCallId !== undefined ? { boundCallId: binding.boundCallId } : {}), ...(binding.boundInputHash !== undefined ? { boundInputHash: binding.boundInputHash } : {}), ...(binding.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}) } } : {}),
                 ...(boundGrant ? { grantRemember: (rootSessionId) => boundGrant(rootSessionId) } : {}),
                 ...(answer !== undefined ? { answer } : {}),
@@ -1257,7 +1256,7 @@ export function createHttpServer(rawDeps) {
             ...(decision === "approve" && binding?.updatedInput !== undefined ? { updatedInput: binding.updatedInput } : {}),
             ...(reason ? { reason } : {}),
             ...(answer !== undefined ? { answer } : {}),
-            settledBy,
+            hostDecision,
         };
         const verifyRounds = verifyRoundsFromBody(ctx.body);
         const driven = await driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(boundGrant ? { onResumeCommitted: boundGrant } : {}), ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}), ...(ownerLeaseAdmittedHere ? { ownerLeaseAdmitted: true } : {}) });
@@ -1477,9 +1476,10 @@ export function createHttpServer(rawDeps) {
                     };
                     resumeLegLive = true;
                     const vr = await resumeWithVerification(legRunner, token, outcome, { ...resumeTaskConfig, signal: cancelCtrl.signal, preemptSignal: preemptCtrl.signal }, resumeObjective, verifyRounds, verifyInternals);
-                    let safe = stripCheckpointToken(vr);
+                    let safe = stripResumeToken(vr);
+                    const vrNested = nestedPauseOf(vr.terminal);
                     const reParkStatus = nestedParkStatusOf(vr);
-                    const reSuspended = reParkStatus !== undefined;
+                    const reSuspended = vrNested !== undefined;
                     const vrReopened = isCheckpointReopenedFailure(vr) && (await confirmCheckpointReopened());
                     if (vrReopened)
                         reopenConfirmedPark = true;
@@ -1490,8 +1490,8 @@ export function createHttpServer(rawDeps) {
                             await appendPromptManifest(ap, deps.promptManifests, taskId);
                             if (reSuspended || vrReopened) {
                                 await appendModelUsageDelta(ap, deps.modelUsage, taskId);
-                                const vrParkCallId = reSuspended ? await parkToolCallId({ ...vr, status: reParkStatus }, deps.checkpointStore) : undefined;
-                                await ap(reSuspended ? reParkStatus : "suspended", { gate: vr.checkpointGate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: vr.errorCode ?? null } : {}) });
+                                const vrParkCallId = vrNested !== undefined ? await parkToolCallId({ terminal: vrNested }, deps.checkpointStore) : undefined;
+                                await ap(reParkStatus ?? "suspended", { gate: vrNested?.gate ?? null, ...(vrParkCallId !== undefined ? { toolCallId: vrParkCallId } : {}), ...(vrReopened ? { reopened: failureCodeOf(vr.terminal) ?? null } : {}) });
                             }
                             else {
                                 safe = await attachModelUsage(safe, { append: ap, getEvents: (id, a) => rs2.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
@@ -1503,8 +1503,8 @@ export function createHttpServer(rawDeps) {
                                 throw e;
                         }
                     }
-                    if (reSuspended)
-                        return { ...safe, status: reParkStatus };
+                    if (vrNested !== undefined)
+                        return { ...safe, terminal: vrNested };
                     if (vr.verification?.verdict)
                         deps.metrics?.inc("verifications_total", { verdict: vr.verification.verdict });
                     return safe;
@@ -1699,30 +1699,31 @@ export function createHttpServer(rawDeps) {
                     }
                     await flush();
                     const r = await stream.result();
-                    if (r.status === "suspended") {
+                    const rPark = r.terminal.kind === "paused" ? terminalProjection(r.terminal).status : undefined;
+                    if (rPark === "suspended") {
                         const parkCallId = await parkToolCallId(r, deps.checkpointStore);
-                        await append("suspended", { gate: r.checkpointGate ?? null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
+                        await append("suspended", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null, ...(parkCallId !== undefined ? { toolCallId: parkCallId } : {}) });
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
-                    if (r.status === "needs_review") {
-                        await append("needs_review", { gate: r.checkpointGate ?? null });
+                    if (rPark === "needs_review") {
+                        await append("needs_review", { gate: r.terminal.kind === "paused" ? r.terminal.gate : null });
                         await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         return r;
                     }
                     if (isCheckpointReopenedFailure(r) && (await confirmCheckpointReopened())) {
                         reopenConfirmedPark = true;
                         try {
-                            await append("suspended", { gate: null, reopened: r.errorCode ?? null });
+                            await append("suspended", { gate: null, reopened: failureCodeOf(r.terminal) ?? null });
                             await appendModelUsageDelta(append, deps.modelUsage, taskId);
                         }
                         catch {
                         }
                         return r;
                     }
-                    const safe = await attachModelUsage(stripCheckpointToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
+                    const safe = await attachModelUsage(stripResumeToken(r), { append, getEvents: (id, a) => rs.getEvents(id, a), modelUsage: deps.modelUsage, taskId });
                     await append("done", { result: safe });
-                    if (taskConfig.suggestNextPrompts && safe.status === "completed") {
+                    if (taskConfig.suggestNextPrompts && safe.terminal.kind === "completed") {
                         const suggestions = await stream.suggestions().catch(() => []);
                         if (suggestions.length)
                             await append("suggestions", { suggestions: suggestions.map((s) => redactSecrets(s)) });
@@ -1772,8 +1773,8 @@ export function createHttpServer(rawDeps) {
                         }
                     }
                     if (claimedRow && taskId && deps.runStore) {
-                        const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
-                        await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
+                        const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: e.message }, stats: { turns: 0, tokens: 0 } };
+                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch(() => undefined);
                     }
                     settleFleet("failed");
                     return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
@@ -1793,8 +1794,8 @@ export function createHttpServer(rawDeps) {
                     (e.code === "checkpoint.unsupported_version" && checkpointRowRedeemableElsewhere(e.detail?.reason));
                 if (claimedRow && taskId && deps.runStore) {
                     if (retriable && freshRunClaimed) {
-                        const c = { taskId, sessionId, status: "failed", errorCode: e.code, errorMessage: e.message, stats: { turns: 0, tokens: 0 } };
-                        await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch((err) => {
+                        const c = { taskId, sessionId, terminal: { kind: "failed", code: e.code, message: e.message }, stats: { turns: 0, tokens: 0 } };
+                        await deps.runStore.setTerminal(taskId, "failed", c, e.message).catch((err) => {
                             deps.logger?.warn?.("wake_synthetic_run_release_failed", { taskId, sessionId, errorCode: e.code, error: err instanceof Error ? err.message : String(err), note: "the synthetic run row for this refused fresh-run resume could not be settled — its task_active claim is still held and the next attempt on this session will 409 conflict.session_active_run until reapStale collects it (runStaleSec)" });
                         });
                         settleFleet("failed");
@@ -1827,8 +1828,8 @@ export function createHttpServer(rawDeps) {
             }
             if (cancelCtrl.signal.aborted) {
                 if (taskId && deps.runStore) {
-                    const c = { taskId, sessionId, status: "failed", errorCode: "cancelled", errorMessage: "cancelled by user", stats: { turns: 0, tokens: 0 } };
-                    await deps.runStore.setTerminal(taskId, "failed", c, c.errorMessage ?? null).catch(() => undefined);
+                    const c = { taskId, sessionId, terminal: { kind: "failed", code: "cancelled", message: "cancelled by user" }, stats: { turns: 0, tokens: 0 } };
+                    await deps.runStore.setTerminal(taskId, "failed", c, "cancelled by user").catch(() => undefined);
                 }
                 settleFleet("failed");
                 return { status: 200, body: { taskId, sessionId, status: "failed", errorCode: "cancelled" } };
@@ -1859,22 +1860,23 @@ export function createHttpServer(rawDeps) {
         }
         evictIfConflict(deps.runner, sessionId, result);
         const checkpointReopened = reopenConfirmedPark;
+        const resumePlane = terminalProjection(result.terminal);
         if (taskId && deps.runStore) {
-            if (result.status === "suspended" || checkpointReopened)
+            if (resumePlane.status === "suspended" || checkpointReopened)
                 await deps.runStore.setSuspended(taskId);
-            else if (result.status === "needs_review")
+            else if (resumePlane.status === "needs_review")
                 await deps.runStore.setNeedsReview(taskId);
             else
-                await deps.runStore.setTerminal(taskId, result.status, stripCheckpointToken(result), result.errorMessage ?? null);
+                await deps.runStore.setTerminal(taskId, resumePlane.status, stripResumeToken(result), resumePlane.errorMessage ?? null);
         }
-        settleFleet(checkpointReopened ? "suspended" : result.status, fleetRunResiduals(result));
+        settleFleet(checkpointReopened ? "suspended" : resumePlane.status, fleetRunResiduals(result));
         return {
             status: 200,
             body: {
-                taskId, sessionId, status: result.status,
+                taskId, sessionId, status: resumePlane.status,
                 bindingEnforced: true,
-                ...(result.errorCode ? { errorCode: result.errorCode } : {}),
-                ...(result.errorMessage ? { errorMessage: redactErrorMessage(result.errorMessage) ?? "" } : {}),
+                ...(resumePlane.errorCode ? { errorCode: resumePlane.errorCode } : {}),
+                ...(resumePlane.errorMessage ? { errorMessage: redactErrorMessage(resumePlane.errorMessage) ?? "" } : {}),
                 ...(checkpointReopened ? { retriable: true } : {}),
             },
         };
@@ -2091,12 +2093,13 @@ export function createHttpServer(rawDeps) {
         return driveResumeIntoRunLog({ runner: runnerFor(spec), token, sessionId: cp.sessionId, principal: auth.principal, fleetScope: resumeFleetScope(req, auth), taskConfig, resumeObjective, outcome, verifyRounds, ...(acceptEarly === true ? { acceptEarly: true } : {}), ...(req !== undefined ? { callerInitiated: true } : {}) });
     }
     function recordTaskResult(result) {
-        deps.metrics?.inc("tasks_total", { status: result.status });
+        const plane = terminalProjection(result.terminal);
+        deps.metrics?.inc("tasks_total", { status: plane.status });
         if (result.stats.tokens)
             deps.metrics?.inc("task_tokens_total", {}, result.stats.tokens);
         if (result.stats.cacheHitRate !== undefined)
             deps.metrics?.observe("task_cache_hit_rate", result.stats.cacheHitRate);
-        const code = result.errorCode;
+        const code = plane.errorCode;
         if (code && code.startsWith("limits.")) {
             deps.metrics?.inc("budget_exceeded_total", { code });
         }
@@ -2110,7 +2113,7 @@ export function createHttpServer(rawDeps) {
     }
     function finalizeTaskResult(result, principal, objective, sessionId) {
         recordTaskResult(result);
-        deps.planCacheProbe?.record(principal, objective, result.status === "completed");
+        deps.planCacheProbe?.record(principal, objective, result.terminal.kind === "completed");
         evictIfConflict(deps.runner, sessionId, result);
     }
     function quotaExceeded(req, res) {
@@ -2347,7 +2350,7 @@ export function createHttpServer(rawDeps) {
                 parkedSkipped += 1;
                 continue;
             }
-            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", "timeout").then((r) => { if (r.status >= 400)
+            await resumeCheckpoint(sessionId, "deny", "approval SLA expired — auto-denied", { decidedBy: "sla_timeout" }).then((r) => { if (r.status >= 400)
                 deps.logger?.warn?.("deny_sweep_resume_blocked", { sessionId, status: r.status, errorCode: r.body?.errorCode }); }, (e) => deps.logger?.warn?.("deny_sweep_resume_failed", { sessionId, err: redactHead(e instanceof Error ? e.message : String(e), 2000) }));
         }
         if (parkedSkipped > 0)
@@ -2420,7 +2423,7 @@ export function createHttpServer(rawDeps) {
             ...(req.gateBoundInputHash !== null ? { boundInputHash: req.gateBoundInputHash } : {}),
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, "human", req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, personDecision(req.principal), req.httpReq, undefined, binding, undefined, true, { principal: req.principal, explicitOperator: false });
         return { status: out.status, body: out.body };
     }
     const isRunLiveOnThisReplica = (taskId) => inflightRuns.has(taskId) || steerableRuns.has(taskId);
@@ -2430,6 +2433,7 @@ const WORKER_SWAP_REDEEMABLE = {
     version_newer: true,
     env_factory_missing: true,
     governed_unwired: true,
+    origin_missing: true,
     real_approval_damaged: false,
     real_approval_forged: false,
     read_face_damaged: false,