@sema-ai/core 1.275.1

package/dist/core/runner/prepare-task.js

@@ -0,0 +1,3612 @@
+import { createHash, randomBytes } from "node:crypto";
+import { AgentHarness, DEFAULT_CHARS_PER_TOKEN, estimateContextTokens } from "../../internal/harness.js";
+// Per-process salt for the `prompt.assembled` manifest hashes (codex [E]: dictionary-preimage guard for
+// short/guessable blocks). Process-lifetime constant → same-process drift detection works; never persisted.
+const PROMPT_HASH_SALT = randomBytes(16);
+import { resolveModel, resolveTaskModel, roleModelIfSet } from "../roles.js";
+import { primaryActivityArg } from "../arg-summary.js";
+import { materializeMcpTools } from "../mcp.js";
+import { brainToRuntime } from "../runtime.js";
+import { MemoryEngine } from "../memory-engine/engine.js";
+import { deriveControlPlaneDir, deriveProjectControlDir, deriveProjectMemoryDir, deriveRepoMemoryDir, drainMemoryAnnouncements, enqueueMemoryAnnouncement, lookupProjectIdHint, recordProjectIdHint, resolveMemoryEngineRoot } from "../memory-engine/layout.js";
+import { assertScopeContractPlacement, parseScopeKey, resolveProjectId } from "../memory-engine/scope-contract.js";
+import { classifyScopePlanes, derivePersonalControlDir, derivePersonalMemoryDir, mergeHarvestReports, mergeInjections, needsDualRoots, parsedProjectPlane } from "../memory-engine/dual-root.js";
+import { FileMemoryEngineBackend } from "../memory-engine/file-backend.js";
+import { Session, isSessionConflict, hasSessionFork } from "../session.js";
+import { createAgentTranscriptTool, createSendMessageTool, createSubagentWorktreeHelper, forkGovernanceDenial, AGENT_TRANSCRIPT_TOOL_NAME, SEND_MESSAGE_TOOL_NAME, SubagentRetainLedger } from "../../agents/subagent.js";
+import { combinePolicies, createTranscriptIntegrityPolicy, createUnverifiableDeletePolicy, resolveAsk } from "../tool-policy.js";
+import { ActiveSkillScope, createActiveSkillScopePolicy } from "./active-skill-scope.js";
+import { computeCallCap, createCallCapRef, softExecDeadlineMs } from "./call-cap.js";
+import { CHANGED_FILES_MTIME_EPS_MS } from "./turn-attachments.js";
+import { emitTrace } from "../trace.js";
+import { createSessionRulePolicy } from "./session-rule-policy.js";
+import { cloneObserverInput, formatHookFeedback, runToolGate } from "../hooks.js";
+import { reconcileInterruptedSession } from "../session-reconcile.js";
+import { CacheBreakDetector, toolsToFingerprintInputs } from "../cache-break-detector.js";
+import { reservedCollisions, reservedFor } from "../../brain/request-params.js";
+import { defineTool } from "../tools.js";
+import { pathToUri } from "../lsp-protocol.js";
+import { DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, firstPartyOffloadPolicy, InMemoryToolResultStore, RunnerSharedToolResultStore, ScopedToolResultStore, isVolatileOffloadStore, OFFLOAD_TOOL_NAME, makeReadToolResultTool, withToolResultOffload, } from "../tool-result-store.js";
+import { OUTPUT_TOOL_NAME, SKILL_TOOL_NAME, buildSkillsBlock, makeOutputTool, makeReportBlockedTool, makeSkillTool, normalizeSkills } from "./synthetic-tools.js";
+import { compileOutputSchema } from "./strict-output-schema.js";
+import { TOOL_SEARCH_NAME, buildDeferredRegistry, classifyDeferred, extractDiscoveredToolNames, makePlaceholderTool, makeToolSearchTool, } from "./tool-disclosure.js";
+import { composeMemoryBlock, normalizeMemorySpec } from "../memory.js";
+import {} from "./memory-consolidation.js";
+import { composeSystemPrompt, composeConstitution, defaultPromptProvider, buildEnvironmentContext, buildGitSnapshot, formatLocalDate, isValidTimeZone, CYBER_RISK, URL_SAFETY, DEFAULT_SYSTEM_PROMPT, PROJECT_CONTEXT_FRAMING } from "../../prompts/default.js";
+import { clearStaleToolResults, dropEmptyFailureAssistants, editBudget } from "../context-edit.js";
+import { capAggregateToolResults } from "../tool-result-budget.js";
+import { capAggregateMediaBytes, AGGREGATE_MEDIA_BUDGET_BYTES } from "../media-byte-cap.js";
+import { dropOrphanToolResults, guardBudget, trimToBudget } from "../context-guard.js";
+import { StubExecutionEnv } from "../stub-env.js";
+import { hasDestroy, isIsolated, isRemoteExecutionEnv, isSuspendable } from "../remote-env.js";
+import { hasBackgroundShell } from "../background-shell.js";
+import { createTaskOutputTool, createTaskStopTool, defaultTaskRegistry } from "../task-registry.js";
+import { createMonitorTool } from "../../tools/monitor.js";
+import { createWorktreeTools } from "../../tools/worktree.js";
+import { bashReversibilityProbe, createHandsToolkit, seedReadFileStateFromContext, HAND_TOOL_EFFECTS, pdfModelCapabilitiesOf } from "../../tools/fs/index.js";
+import { decodeTextBytes } from "../../tools/fs/encoding.js";
+import { createAskUserQuestionTool } from "../ask-question.js";
+import { createSchedulerTools } from "../../tools/scheduler-tools.js";
+import { createPresentPlanTool, createEnterPlanModeTool, PRESENT_PLAN_TOOL_NAME, ENTER_PLAN_MODE_TOOL_NAME } from "../present-plan-tool.js";
+import { isSelfOrchestrationActive, selfOrchestrationFailClosedReason } from "../../orchestration/workflow-script-runner.js";
+import { createRunWorkflowTool, RUN_WORKFLOW_TOOL_NAME } from "../../orchestration/run-workflow-tool.js";
+import { createLspTool, gitCheckIgnoreFilter } from "../lsp.js";
+import { resolveKey } from "../../tools/fs/safety.js";
+import { BINDING_CHECKPOINT_VERSION, mintCheckpointToken, RESOURCE_CHECKPOINT_VERSION, buildRiskDescriptor, debitLedger, remainingBudgetMicroUsd, } from "../checkpoint-store.js";
+import { boundInputHashOf } from "../canonical-json.js";
+/**
+ * How many times to re-wake + re-reconcile a resumed session when a concurrent writer (another
+ * instance) wins the optimistic lock during reconciliation. Bounded so a persistently-contended
+ * session fails fast (with `errorCode="conflict"`) rather than spinning.
+ */
+const RECONCILE_MAX_RETRIES = 3;
+/** design/72 §2.2 (B): default suspend-loop cap. Loose by design — a real human-approval flow re-suspends
+ *  rarely, so 5 cleanly separates a normal resume (1–2 suspends) from a pathological restart loop (a model
+ *  re-issuing the gated call every resume). A task/deployment that genuinely needs more overrides via
+ *  `TaskSpec.maxSuspends` / `RunnerDeps.maxSuspends`. (Briefly raised to 100 on 2026-06-14, reverted 06-15 —
+ *  same misguided net-inflation as DEFAULT_MAX_TURNS; the cap is a runaway guard, not the long-run knob.) */
+const DEFAULT_MAX_SUSPENDS = 5;
+/** design/74 (search [136] HIGH-1): default resource-SLICE cap — the resumable-long-run analogue of
+ *  `DEFAULT_MAX_SUSPENDS`, kept SEPARATE so a legitimate multi-slice resource run (the whole point of
+ *  design/74) is not capped by the restart-loop safety. High (the design/74 spec's worker-suspend ceiling, here implemented as maxSlices): the $ ledger /
+ *  turns / walltime are the real bounds, this only backstops a $0-progress slice loop. Override via
+ *  `TaskSpec.resourceSuspend.maxSlices` (the leader sizes it to budget/slice). */
+const DEFAULT_MAX_SLICES = 100;
+/** design/96 §D (S4, P0): the "ultra" reasoning tiers that warrant the high-intensity ORCHESTRATION_AWARENESS
+ *  nudge — the TOP of the vendor ThinkingLevel ladder (off|minimal|low|medium|high|xhigh|max). Membership-based
+ *  (not a `=== "max"` point-check) so a future top tier slots in by adding it here, and so the threshold reads
+ *  as "ultra tiers" rather than a magic string. Caller-declared via the resolved `thinking`, never keyword-scanned. */
+const ULTRA_REASONING_TIERS = new Set(["xhigh", "max"]);
+/** design/74 (search [136] HIGH-2): default resource-checkpoint retention (30 days, the spec's
+ *  `RESOURCE_SUSPEND_TTL_SEC`). Stamped onto the checkpoint `deadline` so the durable reaper can GC an
+ *  ORPHANED resource suspend; a legitimate auto-resume fires long before this. Override via
+ *  `TaskSpec.resourceSuspend.ttlMs`. */
+const DEFAULT_RESOURCE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** design/80 D-2 (BLOCKER): abandonment TTL stamped on an UNATTENDED human/irreversible_ask suspend (no
+ *  `durableApproval` = no operator/resolver wired). Without it the checkpoint has `deadline=undefined` and the
+ *  reaper (which filters on a non-null deadline) can NEVER GC it → a pinned session + a stranded paused VM +
+ *  an orphan checkpoint leak forever. A `durableApproval` suspend keeps the operator's `ttlMs` (undefined =
+ *  unbounded by the operator's choice; D-D `terminalAt` is the eventual liveness backstop there). 30 days. */
+const DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** 飞轮 [520]③ — per-deployment dedupe for the LOUD ungated-write warning below: keyed by the RunnerDeps
+ *  object (a deployment's stable identity), holding the ungated tool-set shapes already warned about.
+ *  WeakMap: a discarded deployment's entry goes with it. */
+const ungatedWarnedShapes = new WeakMap();
+/** design/77 §4.4: the multi-tenant scope used when a durable suspend fires for an IRREVERSIBLE tool in an
+ *  unattended deployment that did NOT opt into `durableApproval` (so there is no caller-supplied scope). The
+ *  checkpoint carries this scope; resume reads it back from the checkpoint (`cp.scope`), so it is
+ *  self-consistent without needing the original `TaskSpec`. Kept distinct from any tenant key to make an
+ *  unattended irreversible suspend auditable as such. */
+export const DEFAULT_IRREVERSIBLE_SCOPE = "irreversible";
+/**
+ * From the resumed/active transcript, the batch position of `currentId` (design/45 §4.ter): the tool-call
+ * ids of the assistant message that issued it (the batch), and the subset already resolved (executed
+ * before the suspend — #1..k-1). ID-based, not positional (council Question #1): immune to reordering.
+ */
+function batchContextAt(messages, currentId) {
+    let batch = [];
+    for (const m of messages) {
+        if (m.role === "assistant") {
+            const ids = m.content.filter((c) => c.type === "toolCall").map((c) => c.id);
+            if (ids.includes(currentId))
+                batch = ids; // the latest assistant msg holding currentId wins
+        }
+    }
+    const resolved = new Set(messages.filter((m) => m.role === "toolResult").map((m) => m.toolCallId));
+    const completedCallIds = batch.filter((id) => id !== currentId && resolved.has(id));
+    return { batchToolCallIds: batch, completedCallIds };
+}
+/**
+ * Wrap a storage so a `SessionError("conflict")` from any append/leaf write flips `ref.hit`. The
+ * harness flattens a mid-run storage failure into a generic error (and, since a lost CAS makes every
+ * subsequent append fail, even its failure-reporting append fails) — so the conflict code is gone by
+ * the time the task result is assembled. Catching it here, at the storage boundary, keeps it
+ * recoverable as `TaskResult.errorCode = "conflict"`. Per-task and non-mutating (a Proxy over the
+ * shared storage), so it never stacks across tasks on a cached session.
+ */
+function detectConflicts(storage, ref) {
+    const guard = (fn) => async (...args) => {
+        try {
+            return await fn(...args);
+        }
+        catch (err) {
+            if (isSessionConflict(err)) {
+                ref.hit = true;
+            }
+            throw err;
+        }
+    };
+    return new Proxy(storage, {
+        get(target, prop, receiver) {
+            const value = Reflect.get(target, prop, receiver);
+            if (typeof value !== "function") {
+                return value;
+            }
+            const bound = value.bind(target);
+            return prop === "appendEntry" || prop === "setLeafId"
+                ? guard(bound)
+                : bound;
+        },
+    });
+}
+/** Race a promise against an abort signal; on abort, resolve with `onAbort()`. Cleans up its listener. */
+function raceAbort(p, signal, onAbort) {
+    if (signal.aborted)
+        return Promise.resolve(onAbort());
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => {
+            if (settled)
+                return;
+            settled = true;
+            // Necessary even with `{ once }`: `p` usually settles first, leaving the listener dangling on the
+            // signal (a leaked closure per check) until the signal is GC'd. Remove it explicitly.
+            signal.removeEventListener("abort", onAbortEvent);
+            resolve(v);
+        };
+        const onAbortEvent = () => finish(onAbort());
+        signal.addEventListener("abort", onAbortEvent, { once: true });
+        p.then(finish, () => finish(onAbort()));
+    });
+}
+/**
+ * Build everything a task run needs (council design/34 ②: a free function with EXPLICIT deps, not a
+ * Runner method — testable and decoupled). Resolves the model/role/thinking, acquires + reconciles the
+ * session (with the conflict-detecting Proxy + bounded re-wake on a lost CAS), assembles the tool set
+ * (caller tools + offload wrap + report_blocked + submit_output + MCP + memory + read_tool_result),
+ * builds the system prompt, constructs the harness, wires the tool-policy gate + context-edit/guard
+ * hooks + external-signal cancellation, and sets up the cache-break detector. **No run-loop control
+ * flow** lives here — that stays in the Runner loop.
+ */
+/** Best-effort cached-view drop on a prepare-phase throw (B-17-safe: `forget` only — NEVER `release`,
+ *  whose contract permits history deletion). No-op for stores without `forget`. */
+async function forgetQuietly(sessions, sessionId) {
+    try {
+        if (sessions.forget)
+            await sessions.forget(sessionId);
+    }
+    catch {
+        /* best-effort; the TTL sweep is the backstop */
+    }
+}
+export async function prepareTask(spec, deps, sessions, resume, 
+/** @deprecated design/138 S4 — served only the legacy selective/dynamic recall paths (retired);
+ *  ignored. Positional slot kept one major so the runtask call site compiles unchanged. */
+_memorySelector, internals, 
+/** design/98 §3.1 (S8c): a TRUSTED self-reference to the Runner, passed by the Runner itself (never a
+ *  TaskSpec field) so the `run_workflow` tool can execute child tasks via `runner.runTask`. Undefined when
+ *  prepareTask is exercised standalone (then run_workflow is simply not mounted). */
+runnerSelf) {
+    // design/99 §E18: config guards BEFORE acquiring anything (a throw here needs no session cleanup). resume-at
+    // needs a session to branch, and cannot combine with a durable `resume` (which sets the leaf from its checkpoint).
+    if (spec.resumeAt !== undefined) {
+        // Order matters: a durable `resume` already sets the leaf from its checkpoint, so resume+resumeAt is a caller
+        // bug REGARDLESS of sessionId — check it FIRST (the resume path may not have populated spec.sessionId yet).
+        if (resume) {
+            const e = new Error("resumeAt cannot be combined with a durable resume");
+            e.code = "resume_at.conflicts_resume";
+            throw e;
+        }
+        if (!spec.sessionId) {
+            const e = new Error("resumeAt requires a sessionId (the session to branch)");
+            e.code = "resume_at.no_session";
+            throw e;
+        }
+    }
+    // Resolve the model (and a role-supplied default thinking level) from spec.model or the role map.
+    const resolvedRole = resolveTaskModel(spec, deps);
+    const model = resolvedRole.model;
+    // design/111 — thinking resolution chain: caller-explicit > role default > MODEL default > undefined(off).
+    // `model.defaultThinking` lets a model "think by default" without every task/role re-specifying; the
+    // per-endpoint clamp (`resolveReasoning`) still bounds the resolved tier.
+    const thinking = spec.thinking ?? resolvedRole.thinking ?? model.defaultThinking;
+    // Compaction model: explicit wins; otherwise the `summarize` role if configured; else fall back
+    // to the main model inside maybeCompact (unchanged).
+    const compModel = spec.compactionModel
+        ? resolveModel(spec.compactionModel, deps.models)
+        : roleModelIfSet("summarize", spec, deps);
+    // Acquire the session and, when resuming, reconcile any interrupted (orphan) tool call before
+    // the turn. Both are retried together on a F2 optimistic-lock conflict: a concurrent writer on
+    // another instance can move the leaf during reconcile's append, and the fix can't be applied to
+    // a now-stale in-memory view — so we drop it and **re-wake**. Bounded; exhaustion → the conflict
+    // propagates and the task fails with `errorCode="conflict"` for the caller to retry.
+    const toolEffects = new Map();
+    // design/70: egress-marked tools (external writes — the gate never auto-allows them). Collected on the
+    // same pass as effects; validated here (BEFORE session acquire, so the throw needs no cleanup).
+    const egressTools = new Set();
+    // design/77 §4 (Gate 4): tools whose effect is irreversible (`always`, or `maybe` either explicitly or by
+    // declaring a `reversibilityProbe`). Collected on the SAME pass as egress — this set drives BOTH activation
+    // predicates (a no-policy/no-hook/no-egress unattended deployment must still register the gate for an
+    // irreversible tool, else it would silently auto-allow) and the per-call `irreversibility` gate wiring.
+    const irreversibleTools = new Set();
+    // Static tier resolution (read from the spec at prepare-time — not a runtime arg, so the model cannot
+    // monkey-patch it): an explicit `irreversibility`, else `"maybe"` when a `reversibilityProbe` is declared.
+    const irreversibilityTier = new Map();
+    const reversibilityProbes = new Map();
+    // design/80 D-E: set true when `bash` was tightened SOLELY by the coarse `shellGate` (no explicit per-tool
+    // mark) — drives the mint-site riskDescriptor's `shell` axis (severity 3, NOT the irreversible-marked 4).
+    let shellGatedBash = false;
+    // design/135 G2: same coarse-shellGate marker for the Monitor tool (its `command` is an arbitrary shell
+    // script — the tighten and the riskDescriptor grading mirror Bash exactly; 修类不修点).
+    let shellGatedMonitor = false;
+    for (const t of spec.tools ?? []) {
+        // design/110 F1 (① MCP-namespace alignment): a caller tool name MUST NOT contain `__`. That separator is
+        // reserved for the MCP namespace (`mcp__<server>__<tool>`); allowing it lets `canonicalToolName`'s old→new
+        // durable-resume heuristic mis-rewrite a persisted `my__tool` into `mcp__my__tool`, which never matches the
+        // live roster → a stranded orphan tool-call / approval across an upgrade. Reject up front — this runs BEFORE
+        // session acquire, so the throw needs no cleanup. (Injected first-party tools are added later, not via spec.tools.)
+        if (t.name.includes("__")) {
+            const e = new Error(`Tool name "${t.name}" is invalid: "__" is reserved for the MCP namespace (mcp__<server>__<tool>) and must not appear in a caller tool name.`);
+            e.code = "config.tool_name_invalid";
+            throw e;
+        }
+        if (t.effect) {
+            toolEffects.set(t.name, t.effect);
+        }
+        const tier = t.irreversibility ?? (t.reversibilityProbe ? "maybe" : undefined);
+        if (tier !== undefined) {
+            irreversibilityTier.set(t.name, tier);
+            if (tier === "always" || tier === "maybe")
+                irreversibleTools.add(t.name);
+        }
+        if (t.reversibilityProbe)
+            reversibilityProbes.set(t.name, t.reversibilityProbe);
+        if (t.egress) {
+            // design/70 council minor#1: an egress tool must be repeat-unsafe. An explicit read/idempotent
+            // would let wake/resume reconciliation auto-retry an interrupted EXTERNAL write (e.g. open the
+            // same PR twice). Omitted `effect` is fine — the default IS `write`.
+            if (t.effect !== undefined && t.effect !== "write") {
+                const e = new Error(`Tool "${t.name}" declares egress:true with effect:"${t.effect}" — an egress tool (external write) must have effect:"write" (or omit effect; write is the default).`);
+                e.code = "config.egress_requires_write_effect";
+                throw e;
+            }
+            egressTools.add(t.name);
+        }
+    }
+    // The injected reader is read-only; register it up front so an interrupted call reconciles as
+    // safe-to-retry instead of falling to the conservative "write" default (the tool is added later).
+    toolEffects.set(OFFLOAD_TOOL_NAME, "read");
+    // Same for the hand band (design/44): register every hand tool's effect up front (the tools mount
+    // later) so an interrupted hand call reconciles by its true effect, not the conservative "write".
+    // A per-task `executionEnvFactory` (design/48 remote seam) activates the hand exactly like a static
+    // `executionEnv`, so gate on either — this only needs to know the hand is enabled, not the env instance.
+    if (deps.executionEnvFactory || deps.executionEnv) {
+        for (const [name, effect] of Object.entries(HAND_TOOL_EFFECTS))
+            toolEffects.set(name, effect);
+        // Q6 (design/102 §3.6, release-gate review): `bash` + `bash_readonly` merged to the single name "Bash" with one
+        // `HAND_TOOL_EFFECTS` Bash:"write". Under `handsReadOnly` the MOUNTED Bash is the read-only band (effect:read).
+        // Set its effect HERE — before the wake-time `reconcileInterruptedSession` (~:683) AND the path/skill policies
+        // (active-skill-scope / session-rule-policy) read `toolEffects` — else a read-only Bash orphan is mis-classified
+        // as write (over-conservative reconcile note) and a read-only Bash command is FALSE-DENIED under allowPaths
+        // confinement (each Bash def still carries its own `effect` for the live gate; this is the by-name fallback).
+        if (spec.handsReadOnly === true)
+            toolEffects.set("Bash", "read");
+    }
+    // design/108 (review): register the plan pair's effects HERE — BEFORE the wake-time `reconcileInterruptedSession`
+    // (~:690), same as Bash above — so an orphaned present_plan/enter_plan_mode call (both effect:"read") reconciles
+    // as INTERRUPTED_SAFE, not mis-classified write→UNKNOWN. (The post-assembly sync below also covers them for the
+    // live plan-mode gate; this early set is purely for reconcile/path-policy reads that run before tool assembly.)
+    if (spec.enablePlanMode === true) {
+        toolEffects.set(PRESENT_PLAN_TOOL_NAME, "read");
+        toolEffects.set(ENTER_PLAN_MODE_TOOL_NAME, "read");
+    }
+    // design/114 Phase3 (M2): `requireExistingSession` without a `sessionId` is a caller error — there is no
+    // session to require. Silently creating a fresh one is exactly the footgun the flag exists to prevent, so
+    // fail loud with the same code a genuinely-missing session yields.
+    if (spec.requireExistingSession && !spec.sessionId) {
+        const e = new Error(`requireExistingSession requires a sessionId — cannot require an existing session without one (design/114 Phase3)`);
+        e.code = "resume.session_not_found";
+        throw e;
+    }
+    let acquired;
+    let session;
+    let conflictRef;
+    for (let attempt = 0;; attempt++) {
+        try {
+            // design/114 Phase3: `requireExistingSession` makes acquire FAIL LOUD on a missing session (never the
+            // silent create-on-miss that turns a reuse warm-resume into a fresh empty run). Map the store's `not_found`
+            // to a clear, caller-facing errorCode rather than a raw storage error.
+            acquired = await sessions.acquire(spec.sessionId, spec.requireExistingSession ? { requireExisting: true } : undefined);
+        }
+        catch (err) {
+            if (spec.requireExistingSession && err?.code === "not_found") {
+                const e = new Error(`requireExistingSession: session "${spec.sessionId}" does not exist — refusing a silent fresh run (design/114 Phase3)`);
+                e.code = "resume.session_not_found";
+                throw e;
+            }
+            throw err;
+        }
+        // Wrap the storage so a lost-CAS conflict on any append is recoverable (the harness would
+        // otherwise flatten it). Per-task Proxy; the underlying storage is unchanged.
+        conflictRef = { hit: false };
+        session = new Session(detectConflicts(acquired.session.getStorage(), conflictRef));
+        if (!spec.sessionId) {
+            break; // fresh session — nothing persisted yet, nothing to reconcile
+        }
+        try {
+            if (resume) {
+                // design/45 resume: rewind the branch leaf to the suspension point BEFORE reconcile. This
+                // discards the suspend abort's off-branch writes, and (with `suspendedBatch`) makes wake-
+                // reconcile SKIP the pending batch instead of orphan-closing it — the resume engine resolves
+                // those calls itself. Goes through the conflict proxy, so a lost CAS re-wakes like any append.
+                await session.getStorage().setLeafId(resume.leafId);
+            }
+            else if (spec.resumeAt !== undefined) {
+                // design/99 §E18: branch the session at an arbitrary prior MESSAGE entry, then run the new objective as
+                // the next turn. Validate the target is a real message-boundary entry on THIS session first (a non-
+                // message entry would make the reconcile below orphan-close a mid-batch call). `setLeafId` is
+                // non-destructive (appends a `leaf` entry) and goes through the same conflict proxy as a durable resume.
+                const entry = await session.getEntry(spec.resumeAt);
+                if (!entry) {
+                    const e = new Error(`resumeAt entry "${spec.resumeAt}" not found in session "${spec.sessionId}"`);
+                    e.code = "resume_at.not_found";
+                    throw e;
+                }
+                if (entry.type !== "message" && entry.type !== "custom_message") {
+                    const e = new Error(`resumeAt entry "${spec.resumeAt}" is a "${entry.type}" entry; resume-at requires a message boundary`);
+                    e.code = "resume_at.not_a_message";
+                    throw e;
+                }
+                // §E18: a resume-at target must be a SETTLED turn boundary (a user message or a finished assistant turn).
+                // Two intra-turn shapes are stored as `type:"message"` and slip the type guard above — reject both.
+                if (entry.type === "message") {
+                    const msg = entry.message;
+                    // A `toolResult` is stored as a `type:"message"` entry (so it slips the type guard above) but it sits
+                    // INSIDE a turn — it is the result of a tool call, not a turn boundary. Branching at a tool-result
+                    // preserves the very tool effect the caller most likely wants to redo, and `reconcileInterruptedSession`
+                    // would mishandle the open batch. Reject it (service [260]① — fail-loud for ALL deployments, not only
+                    // those with a service-side capture-gate). Valid targets: a user message or a finished assistant turn.
+                    if (msg?.role === "toolResult") {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" is a tool-result (mid-turn); resume-at requires a settled turn boundary (a user message or a finished assistant turn)`);
+                        e.code = "resume_at.not_a_message";
+                        throw e;
+                    }
+                    // An assistant message carrying an open `toolCall` is likewise an INTRA-turn boundary, not a turn
+                    // boundary — branching there leaves the call unresolved (its toolResults are off-branch children), so
+                    // `reconcileInterruptedSession` below would inject a synthetic [INTERRUPTED] for a call that actually
+                    // completed. Only branch at user messages or finished assistant-text turns.
+                    if (msg?.role === "assistant" && Array.isArray(msg.content) && msg.content.some((p) => p?.type === "toolCall")) {
+                        const e = new Error(`resumeAt entry "${spec.resumeAt}" ends a turn mid-tool-call; resume-at requires a settled turn boundary`);
+                        e.code = "resume_at.not_a_message";
+                        throw e;
+                    }
+                }
+                await session.getStorage().setLeafId(spec.resumeAt);
+            }
+            await reconcileInterruptedSession(session, toolEffects, resume?.suspendedBatch);
+            break;
+        }
+        catch (err) {
+            if (isSessionConflict(err) && attempt < RECONCILE_MAX_RETRIES) {
+                // Drop the STALE CACHED VIEW only, then re-wake. This must be `forget`, NEVER `release` (audit
+                // B-17): with the default in-memory store's `evict: "delete"`, release deleted the whole session
+                // from the repo — the re-acquire then created an EMPTY same-id session and the task continued on
+                // it (silent total context loss). A custom store WITHOUT `forget` gets NO fallback (B-17 council:
+                // its `release` contract permits deletion, so falling back would recreate the bug there) — the
+                // retry then re-acquires the same cached view and, if the conflict persists, exhausts the budget
+                // and propagates `errorCode="conflict"` to the caller. Fail-safe beats data loss.
+                if (sessions.forget) {
+                    await Promise.resolve(sessions.forget(spec.sessionId)).catch(() => undefined);
+                }
+                continue;
+            }
+            // Conflict budget exhausted / non-conflict reconcile failure: the caller never gets a Prepared to
+            // release, so drop our cached view on the way out (1.93.0 throw-cleanup gap; forget = history-safe).
+            await Promise.resolve(sessions.forget ? sessions.forget(acquired.sessionId) : undefined).catch(() => undefined);
+            throw err;
+        }
+    }
+    const sessionId = acquired.sessionId;
+    const hostTaskId = spec.taskId ?? sessionId;
+    const taskScope = spec.principal ?? "default";
+    defaultTaskRegistry.maybeGc(); // throttled sweep (design/115 review B5): at most once/min, not per prepare
+    // B-17 + 1.93.0 throw-cleanup contract: ANY prepare throw below leaves the acquired session unreachable
+    // to the caller (no Prepared is returned, so finish()/release never run). Forget the cached view on the
+    // way out — deliberately NOT release(): on the default in-memory store an existing session's history
+    // would be deleted by a transient prepare failure (the same silent-empty-rewake class as B-17).
+    // Catch-on-throw-ONLY, mirroring the ownedEnv teardown (design/48 council BUG#1 precedent).
+    const forgetOnThrow = () => forgetQuietly(sessions, sessionId);
+    // Request-param passthrough (design/40): the brain strips any `extraBody` key it owns (core wins), but
+    // the brain has no `onError`. Warn here, once at load time, if a deployment put a reserved key in
+    // `extraBody` so its silent drop is visible — the brain still enforces it regardless.
+    const extraBodyCollisions = reservedCollisions(model.extraBody, reservedFor(model.api));
+    if (extraBodyCollisions.length > 0) {
+        deps.onError?.(new Error(`model.extraBody contains reserved key(s) [${extraBodyCollisions.join(", ")}] that core owns and sets itself — they are ignored. Remove them from extraBody.`), { phase: "config", sessionId });
+    }
+    // Accumulate usage of any nested sub-runs (sub-agents) a tool spawns, so delegated cost (the
+    // multi-agent "~15×") shows up in the parent's `stats.nested`. Injected into each task tool's
+    // execute context; `createSubagentTool` reports its child's subtree total through it.
+    const nestedStats = { tokens: 0, turns: 0, tasks: 0, costUsd: 0, costMicroUsd: 0 };
+    if (resume) {
+        // design/45 §4.bis: re-seed pre-suspend nested sub-agent cost so delegated cost isn't lost on resume.
+        nestedStats.tokens = resume.seed.nestedStats.tokens;
+        nestedStats.turns = resume.seed.nestedStats.turns;
+        nestedStats.tasks = resume.seed.nestedStats.tasks;
+        nestedStats.costUsd = resume.seed.nestedStats.costUsd;
+        nestedStats.costMicroUsd = resume.seed.nestedStats.costMicroUsd;
+    }
+    const reportUsage = (u) => {
+        nestedStats.tokens += u.tokens;
+        nestedStats.turns += u.turns;
+        nestedStats.tasks += u.tasks;
+        nestedStats.costUsd += u.costUsd ?? 0;
+        nestedStats.costMicroUsd += u.costMicroUsd ?? 0;
+    };
+    // Large-tool-result offload (design/30): wrap caller (and below, MCP) tools so an oversized text
+    // result is moved to the store and replaced with a preview + ref before it reaches the session.
+    // An EXPLICIT global (spec/deps) is a deployment's coarse knob and wins over the CC per-tool defaults
+    // table below; only Read's structural exemption outranks it (see firstPartyOffloadPolicy).
+    const explicitGlobalThreshold = spec.toolResultThresholdChars ?? deps.toolResultThresholdChars;
+    const offloadThreshold = explicitGlobalThreshold ?? DEFAULT_TOOL_RESULT_THRESHOLD_CHARS;
+    const offloadEnabled = Number.isFinite(offloadThreshold) && offloadThreshold > 0;
+    // impl-review 2026-07-03 (codex 2 BLOCKER on the A2 shared fallback): the Runner-SHARED fallback
+    // instance is wrapped in a per-task SCOPED view — refs namespaced by trust scope (tenant B can't
+    // deref tenant A's ref; same-scope cross-task deref still works) and isEmpty() reflecting only THIS
+    // task's offloads (the D-2 durable-suspend gate's per-task semantics). An INJECTED store is used
+    // as-is (its deployment owns scoping); a per-prepare fresh InMemory (no runner self) stays task-local.
+    const rawOffloadStore = offloadEnabled ? (deps.toolResultStore ?? new InMemoryToolResultStore()) : undefined;
+    const offloadStore = rawOffloadStore instanceof RunnerSharedToolResultStore
+        ? new ScopedToolResultStore(rawOffloadStore, taskScope)
+        : rawOffloadStore;
+    const maybeOffload = (tool, perTool) => {
+        if (!offloadStore || perTool?.offload === false)
+            return tool;
+        return withToolResultOffload(tool, offloadStore, perTool?.offloadThresholdChars ?? offloadThreshold, sessionId);
+    };
+    // First-party mounts (band/task/monitor/worktree/SendMessage): CC per-tool persistence thresholds
+    // (PARITY-SPOT-USAGE-CONSTANTS F1/F2). Read's exemption is structural (its own paging gate owns the
+    // bound — offloading would re-truncate a page the tool already sized); the numeric table applies only
+    // when the deployment did NOT set an explicit global threshold (coarse knob wins).
+    const firstPartyOffload = (tool) => {
+        const policy = firstPartyOffloadPolicy(tool.name);
+        if (policy.offload === false)
+            return maybeOffload(tool, policy);
+        return maybeOffload(tool, explicitGlobalThreshold === undefined ? policy : undefined);
+    };
+    // MCP mounts: a server-declared `_meta["anthropic/maxResultSizeChars"]` (capped 500K in mcp.ts) is the
+    // server's own contract and wins over our defaults; else CC's MCP base declares 1e5 → min(1e5, 50K).
+    // An explicit deployment global still outranks both (caller = trust root, design F).
+    const mcpOffload = (tool) => {
+        if (explicitGlobalThreshold !== undefined)
+            return maybeOffload(tool);
+        return maybeOffload(tool, { offloadThresholdChars: tool.mcpMaxResultSizeChars ?? 50_000 });
+    };
+    if (offloadStore && (spec.tools ?? []).some((t) => t.name === OFFLOAD_TOOL_NAME)) {
+        // Same fail-fast as submit_output: a caller tool of the reserved name would shadow the injected reader.
+        const e = new Error(`Tool name "${OFFLOAD_TOOL_NAME}" is reserved when large-result offload is enabled.`);
+        e.code = "config.reserved_tool_name";
+        await forgetOnThrow();
+        throw e;
+    }
+    // Holds the harness once built, so a tool's execute can read the model the parent is CURRENTLY on
+    // (design/38 1B: `ToolExecuteContext.model` snapshot — a delegation tool uses it for `inherit`). Also
+    // breaks the harness↔tool_search build cycle (design/36 rematerialize). Populated before any run.
+    // The agent's "hand" execution env (design/44): injected, or the no-I/O stub (current default). Shared
+    // by the harness and the file tool band so both act on the same fs/shell.
+    // design/48 remote seam: a trusted control-plane `executionEnvFactory` mints a FRESH env per task (one
+    // isolated container per task in the remote model). It wins over a static `executionEnv`; the env it
+    // produces is `ownedEnv` — the Runner destroys it on task end (`finish()`), since this task owns its
+    // lifetime. Order: factory(ctx) → static executionEnv → no-I/O stub.
+    let ownedEnv;
+    // P-8 fix: hoist `mcp` to function scope so the prepare-throw catch (below) can dispose it. The MCP clients (stdio
+    // subprocesses / HTTP transports) are materialized INSIDE the big try; a throw after materialize (egress check /
+    // reserved-name guard / a throwing await) would otherwise strand them — the catch only disposed ownedEnv.
+    let mcp;
+    try {
+        ownedEnv = deps.executionEnvFactory
+            ? await deps.executionEnvFactory({
+                sessionId,
+                taskId: spec.taskId,
+                ...(internals?.isolation ? { isolation: internals.isolation } : {}),
+                // Sub-agent cwd inheritance (CC parity): let a TOC factory root the child at the parent's cwd.
+                ...(internals?.parentCwd ? { parentCwd: internals.parentCwd } : {}),
+            })
+            : undefined;
+    }
+    catch (factoryErr) {
+        await forgetOnThrow(); // factory threw before any env existed — only the session view needs cleanup
+        throw factoryErr;
+    }
+    const executionEnv = ownedEnv ?? deps.executionEnv ?? new StubExecutionEnv();
+    const handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined;
+    // design/97 CORE-6 audit MAJOR (codex): the task's effective root. For a worktree-isolated agent the factory
+    // rooted the env's cwd AT the worktree, so the root is the env's own cwd — `deps.rootPath` (a Runner-level base
+    // repo default) must NOT override it, or the agent's hands AND its LSP / prompt env-facts / session-rule
+    // policies would point at the SHARED base repo, defeating isolation. Computed ONCE here and used at every
+    // root-resolution site below (previously only the hands band applied the isolation rule).
+    const taskRootPath = internals?.isolation === "worktree" || !deps.rootPath ? executionEnv.cwd : deps.rootPath;
+    // Created early (before ANY env operation) so the resume VM-restore below can use it as the resumeVM
+    // abortSignal. The live listener that catches LATER external aborts is wired after the harness exists (it
+    // needs `harness.abort`); a signal already aborted at prepare start is propagated here so the restore honors it.
+    const abortController = new AbortController();
+    if (spec.signal?.aborted)
+        abortController.abort();
+    // NOTE: the LIVE `spec.signal` listener is attached below, after the harness exists. An abort that fires
+    // between this check and that listener is caught by the late check; the resume restore below additionally
+    // composes `spec.signal` into its abortSignal so a hung restore in that window is still short-circuited.
+    // design/48 (council BUG, minor/high): if a later prepare step throws AFTER the factory minted
+    // `ownedEnv`, it never reaches finish()'s teardown → a leaked remote container. Catch-on-throw-ONLY
+    // (deliberately NOT try/finally: on success the task owns the env and MUST keep it). Best-effort +
+    // destroy() is contractually idempotent. Mirrors the service reaper as belt-and-suspenders.
+    try {
+        // design/49 v1.5 + service[26]/[29] fix: restore the remote workspace snapshot (`resumeVM`) BEFORE any
+        // other env operation. The hand-toolkit setup below calls `executionEnv.canonicalPath()` (and tools later
+        // do fs/exec); a LAZY-CONNECT adapter would otherwise `doConnect` a FRESH empty sandbox on that first
+        // touch, after which a `resumeVM` (commonly idempotency-guarded to skip when already connected) is a no-op
+        // → the snapshot is never restored and the resumed task silently runs on an empty workspace (gated-write
+        // files lost). Restoring FIRST makes the snapshot the env's first and only connection. POST-CAS, so any
+        // failure here = resolved-but-unfinished (design/49 §4②): throw `resume.env_failed` → the prepare-throw
+        // catch destroys `ownedEnv` → `runTaskStream` surfaces a failed TaskResult (the human approval was
+        // consumed — re-initiate; the pre-CAS guard already rejected this resume if no factory was wired).
+        // abortSignal on resumeVM: a hung restore (network partition) cannot pin the resuming worker (BUG#2).
+        if (resume?.workspaceHandle !== undefined) {
+            const failResume = (message, cause) => {
+                const e = new Error(message, cause ? { cause } : undefined);
+                e.code = "resume.env_failed";
+                throw e;
+            };
+            const handle = resume.workspaceHandle;
+            if (ownedEnv === undefined || !isRemoteExecutionEnv(ownedEnv)) {
+                failResume("resume needs a RemoteExecutionEnv from executionEnvFactory to restore the workspace snapshot");
+            }
+            else if (handle.snapshotId === undefined) {
+                // service [500]② durable-park-only resume: a handle WITHOUT a snapshotId was minted by the park-only
+                // suspend degrade (non-suspendable remote env — SSH/ADB host; capabilities.suspendable:false). The
+                // suspend leg never paused a VM: the workspace persists on the target itself, and the factory above
+                // just reconnected to it — so there is nothing to restore; skip resumeVM/postResumeInit and proceed.
+                // (Before [500]② every remote suspend stamped a snapshotId, so this branch was a hard failResume.)
+                //
+                // codex review hardening (1.257.2): a missing snapshotId is only LEGITIMATE when the handle says so
+                // (`restoreMode:"park_only"`, stamped at park mint) — or, tolerance for park handles minted by
+                // 1.257.1 before the field existed, when the resumed env is itself non-suspendable. Any OTHER
+                // combination (no mode + suspendable env) = a snapshot handle that LOST its snapshotId (corrupt
+                // checkpoint / capability drift) → fail-closed rather than silently running on an unrestored fs.
+                // Deployment contract (unchanged, documented): the factory reconnects park-only workspaces by
+                // session identity — the engine has no seam to verify workspace identity beyond this guard.
+                if (handle.restoreMode !== "park_only" && isSuspendable(ownedEnv)) {
+                    failResume("checkpoint workspaceHandle has no snapshotId and is not a park_only handle, but the resumed env is suspendable — refusing to resume on a possibly-unrestored workspace (corrupt checkpoint?)");
+                }
+            }
+            else {
+                // Compose `spec.signal` into the restore's abortSignal (council finding): the live external-cancel
+                // listener is attached only after the harness exists (below), so without this a caller cancel that
+                // fires DURING the restore would not reach `abortController` until after it returns — a hung restore
+                // could pin the worker until the provider's own timeout. `AbortSignal.any` covers that window.
+                const restoreSignal = spec.signal
+                    ? AbortSignal.any([abortController.signal, spec.signal])
+                    : abortController.signal;
+                const restored = await ownedEnv.resumeVM(handle.snapshotId, { abortSignal: restoreSignal });
+                if (!restored.ok) {
+                    failResume(`resumeVM failed (${restored.error.code}): ${restored.error.message}`, restored.error);
+                }
+                const init = await ownedEnv.postResumeInit();
+                if (!init.ok) {
+                    failResume(`postResumeInit failed (${init.error.code}): ${init.error.message}`, init.error);
+                }
+            }
+        }
+        // design/101 §E19: when this task BRANCHED at a prior message (E18 `resumeAt`) AND rewind is enabled, restore
+        // the working tree to that message's snapshot. MUST be here (AFTER env resolution at :697 + the remote
+        // resumeVM block above) — at the `setLeafId` site in the acquire loop there is no env yet (grounding BLOCKER).
+        // GATE-SPLIT (service [263]): gate on STORE-PRESENCE + `handsEnabled`, NOT env locality. `applyManifest` runs
+        // against ANY ExecutionEnv's FileSystem ops (local OR remote host/e2b/k8s/…); the old `!isRemoteExecutionEnv`
+        // blocked E19 for host adapters (no VM) + cloud. `handsEnabled` (Opus M2) stays as the "real fs env" proxy —
+        // a stub-env deployment with rewindFiles on would otherwise enumerate_failed + spuriously warn.
+        // `not_found` (the target entry was never snapshotted — e.g. not a turn-end leaf) is an expected no-op; any
+        // OTHER failure is surfaced via onError(phase:"rewind") and prepare PROCEEDS — the session branch already
+        // committed, so the files are honestly reported as not-fully-restored rather than silently wrong.
+        // design/101 §E19 + R8 (CC Rewind modes): restore the working tree to a prior message's snapshot. Two
+        // entrypoints, mutually exclusive by construction:
+        //  - `rewindFiles` + `resumeAt` → CC "both": the setLeafId fork above already moved the conversation; restore
+        //    code to that SAME target. (`resumeAt` alone, rewindFiles false = CC "conversation" — no restore here.)
+        //  - `rewindFilesTo` (honored ONLY when `resumeAt` is ABSENT) → CC "code"-only: restore code to that target
+        //    WITHOUT a fork — the fork block (above) keys on `resumeAt`, so the leaf is untouched, conversation continues.
+        const rewindTarget = spec.resumeAt !== undefined ? (spec.rewindFiles ? spec.resumeAt : undefined) : spec.rewindFilesTo;
+        if (rewindTarget !== undefined && deps.fileSnapshotStore && handsEnabled) {
+            const restoreRoot = taskRootPath;
+            // Compose spec.signal (the live external-cancel listener attaches only after the harness exists below) so a
+            // caller cancel during a hung restore is honored, mirroring the remote resumeVM block above.
+            const restoreSignal = spec.signal ? AbortSignal.any([abortController.signal, spec.signal]) : abortController.signal;
+            const restored = await deps.fileSnapshotStore.restore(sessionId, rewindTarget, executionEnv, restoreRoot, restoreSignal);
+            if (!restored.ok) {
+                if (restored.error.code === "not_found") {
+                    // Opus M4: OBSERVABLE no-op — the target entry was never snapshotted (v1 snapshots only turn-end
+                    // leaves), so the session branch committed but the files are UNCHANGED. Surface it so a shell can tell
+                    // the user "no file snapshot at this point" rather than believing the tree was rewound.
+                    try {
+                        deps.onError?.(new Error(`rewind-files: no snapshot for entry "${rewindTarget}" — files left unchanged`), { phase: "rewind", sessionId });
+                    }
+                    catch {
+                        /* a throwing onError must not break prepare */
+                    }
+                }
+                else {
+                    // Opus M5: a real restore failure leaves a HALF-CONVERGED tree — FAIL the task (prepare-throw →
+                    // status:"failed" + errorCode) rather than run the agent on a tree it believes is clean. The session
+                    // branch already committed (non-destructive leaf); the caller can retry (restore is re-convergent).
+                    const e = new Error(`rewind-files restore failed (${restored.error.code}): ${restored.error.message}`);
+                    e.code = "rewind.restore_failed";
+                    throw e;
+                }
+            }
+        }
+        const harnessRef = {};
+        // design/77 §3 Gate-3: the per-task LIFO scope stack. Declared HERE (before the tool wrap below) so the
+        // wrapped `execute` can hand a delegation tool a live snapshot via `ctx.activeSkillScope()`. Frames are
+        // pushed later: the inherited-from-parent seed (design/77 §7) and the `skill` tool on a manifest load.
+        const skillScope = new ActiveSkillScope();
+        // design/99 (nested-subagent live tree, dual-review MINOR): the opt-in display sink. WRAPPED to forward ONLY
+        // `task_progress` — so a (3rd-party) tool that calls `ctx.forwardEvent` cannot push other event types onto the
+        // deployment's display channel — and EXPOSED on the tool ctx only when the deployment opted in (no `forwardEvent`
+        // key otherwise, so a non-forwarding run's ctx is unchanged). The forwarded tick is still an UNTRUSTED display
+        // hint (a tool could call `ctx.forwardEvent` with a forged `task_progress` / `parentTaskId`). Its blast is
+        // STRUCTURALLY bounded to the forwarding run's OWN scope: the deployment's fleet projection attributes the
+        // tick to THIS run (scope = run.scope), so a forged `parentTaskId` can at worst mis-nest a node within that
+        // scope's view — never cross-run / cross-tenant — i.e. cosmetic. A deployment MAY additionally validate
+        // `parentTaskId` against its known runs as defense-in-depth, but is NOT required to for isolation (service
+        // [305] #3 ruling: doc-as-LOW — the scope bound, not parentTaskId validation, is the load-bearing guarantee).
+        const forwardSink = internals?.onForwardEvent;
+        const forwardEvent = forwardSink
+            ? (e) => {
+                if (e.type === "task_progress")
+                    forwardSink(e);
+                // Blackboard 2026-07-03 (subagent viewing pane): the spec-level opt-in widens the render
+                // channel to the child's CONTENT events (still filtered — a tool can never push other
+                // types onto the deployment's display channel). Same UNTRUSTED-RAW/redact contract as the
+                // main stream's tool events (§E1); the child stream stays out of the model context.
+                else if (spec.forwardSubagentEvents === true &&
+                    (e.type === "text_delta" || e.type === "reasoning_delta" || e.type === "tool_start" || e.type === "tool_end")) {
+                    forwardSink(e);
+                }
+            }
+            : undefined;
+        // design/80 D-B: a tool's `ctx.requestReview()` / `present_plan` sets `pending` here; the run loop honors it
+        // at the next clean turn boundary (mints a `plan_review` checkpoint). First request in a batch wins. Declared
+        // BEFORE the tool-ctx build so the ctx closure can capture `requestReview`.
+        const reviewRequestRef = {};
+        const requestReview = (opts) => {
+            if (reviewRequestRef.pending === undefined) {
+                reviewRequestRef.pending = opts?.reason !== undefined ? { reason: opts.reason } : {};
+            }
+        };
+        // design/105: clean run-stop binding to the harness's existing one-way flag — exposed as the ctx primitive
+        // (for spec.tools) and still threaded to the scheduler-tool factory's context slot (design/136 §2.2: the
+        // Sleep tool that consumed it there was retired; the primitive itself is load-bearing for spec.tools).
+        const requestStopAfterTurn = () => {
+            harnessRef.current?.requestStopAfterTurn();
+        };
+        // design/108: mid-run read-only plan mode — a run-local one-way flag the first-party `enter_plan_mode` tool sets
+        // (via ctx) and the tool-call handler below enforces (reject write-effect tools). Run-local (NOT durable): a
+        // later approve-resume re-prepares with this clear, so the approved plan can write. NOT in the safety gate —
+        // plan mode is a fidelity mode, not a security boundary (the real gates apply independently).
+        const planModeRef = { active: false };
+        const enterPlanMode = () => {
+            planModeRef.active = true;
+        };
+        // design/122 D1: the parent-run subagent-retain LEDGER — created ONLY when the spec opts in
+        // (`retainSubagentSessions`; default OFF ⇒ undefined ⇒ the ctx gains no key and delegation is
+        // byte-identical). Threaded to delegation tools as the TRUSTED `ctx.subagentRetain`; the Runner
+        // disposes it (abort in-flight resumes + unpin + release every retained session) in the task's
+        // terminal `finally` (D4).
+        const subagentRetain = spec.retainSubagentSessions ? new SubagentRetainLedger(spec.retainSubagentSessions) : undefined;
+        // design/135 §0 — the Agent tool's per-call `isolation:"worktree"` capability: built ONCE over the run's
+        // trusted env + task root (lazy — no I/O until a delegation actually mints a worktree). Write-capable runs
+        // only: a read-only run must not create worktrees, so the ctx key is simply absent there and the Agent tool
+        // reports isolation as honestly unavailable (design/135: silent degrade is the disease this batch kills).
+        const worktreeIsolation = spec.handsReadOnly !== true ? createSubagentWorktreeHelper(executionEnv, taskRootPath) : undefined;
+        // design/136 §6 盲点①: the run's fork-governance verdict. Declared BEFORE the ctx-injection map below
+        // (whose execute closures read it at tool-call time) but ASSIGNED after runtimeCaps resolve (~:1290) —
+        // prepare completes before any tool executes, so the closure never observes the pre-assignment value.
+        let agentForkDenial;
+        // OBS-2: the observer gate verdict (RuntimeCaps.allowObservers === true, EXPLICIT opt-in — types.ts
+        // polarity note). Declared here, ASSIGNED after runtimeCaps resolve (same call-time-closure posture
+        // as agentForkDenial above); the delegation tool reads it through ctx at each call.
+        let observersActive = false;
+        const tools = (spec.tools ?? []).map((t) => maybeOffload(defineTool({
+            ...t,
+            // `?.` is type-level optionality (a tool can run outside a Runner); at task runtime harnessRef is
+            // always populated, so this resolves to the parent's current model — never undefined here.
+            // `activeSkillScope`: a read-only snapshot of THIS (parent) task's live skill-manifest frames so a
+            // delegation tool can propagate them into a spawned subagent (design/77 §3/§7). Captured lazily at
+            // call time → reflects manifests active at the spawn moment (LIFO grows/shrinks during the run).
+            execute: (args, ctx) => t.execute(args, {
+                ...ctx,
+                reportUsage,
+                model: harnessRef.current?.getModel(),
+                thinkingLevel: harnessRef.current?.getThinkingLevel(), // the model snapshot's companion (same call-time semantics)
+                principal: spec.principal,
+                clientContext: spec.clientContext, // design/112 C1/C5: inherit user TZ/email down the delegation tree
+                parentCwd: taskRootPath, // sub-agent cwd inheritance (CC parity) — delegation tools thread this down
+                activeSkillScope: () => skillScope.active(),
+                // design/99 (nested-subagent live tree): the host run's canonical taskId (SAME fallback as runtask's
+                // `taskId = spec.taskId ?? sessionId`, so a child's parentTaskId matches the parent's task_progress
+                // node id), plus the opt-in display sink — `forwardEvent` is OMITTED unless the deployment opted in
+                // (a non-forwarding run's ctx gains no sink key). A delegation tool threads both into the child.
+                taskId: hostTaskId,
+                // design/129: the session id + the deployment's background-lifetime scope, threaded read-only
+                // so a background child can register session-scoped (outlive the turn) when opted in.
+                sessionId,
+                ...(spec.backgroundScope !== undefined ? { backgroundScope: spec.backgroundScope } : {}),
+                // design/129-B ([444]): the process-level background-child observer — per-leg sinks go stale
+                // at leg settle; this one is wired once at Runner construction and never does.
+                ...(deps.onBackgroundChildEvent ? { onBackgroundChildEvent: deps.onBackgroundChildEvent } : {}),
+                // design/115 P3: the run-local notification lane, so a caller-mounted subagent tool's
+                // background completions reach THIS task's next turn (same lane as workflow/bash).
+                ...(internals?.onTaskNotification ? { onTaskNotification: internals.onTaskNotification } : {}),
+                ...(forwardEvent ? { forwardEvent } : {}),
+                // Subagent steer verb (blackboard 2026-07-03): the deployment's steer-handle sink.
+                ...(internals?.onSubagentSpawn ? { onSubagentSpawn: internals.onSubagentSpawn } : {}),
+                // design/122 D1: the retain ledger (present only when `spec.retainSubagentSessions` opted in).
+                ...(subagentRetain ? { subagentRetain } : {}),
+                // design/135 §0: the Agent tool's worktree-isolation capability (write-capable runs only) + the
+                // inside-fork marker (so a forked child's Agent tool refuses a nested `subagent_type:"fork"`).
+                ...(worktreeIsolation ? { worktreeIsolation } : {}),
+                ...(internals?.insideFork === true ? { insideFork: true } : {}),
+                // design/136 §6 盲点① + §2.1.a: thread the fork-GOVERNANCE verdict (read at call time — see
+                // the `agentForkDenial` declaration above) so Agent(subagent_type:"fork") answers to the
+                // enableFork/allowFork governance axes. Present only when DENIED.
+                ...(agentForkDenial !== undefined ? { forkAccess: { denied: agentForkDenial } } : {}),
+                // OBS-2: the observer auto-spawn gate (read at call time — see the `observersActive`
+                // declaration above). Present only when the principal's caps EXPLICITLY opted in.
+                ...(observersActive ? { observersAllowed: true } : {}),
+                // design/80 D-B: the general "yield to a human plan-review" primitive. Always present (it only sets
+                // a flag); the EFFECT is gated at the turn boundary — honored ONLY when `suspendForReview` exists (a
+                // checkpointStore is wired). A read-only/headless run sets the flag but the boundary drops it (no-op).
+                requestReview,
+                // design/105: clean run-stop after the current turn — a thin binding to the harness's existing one-way
+                // flag (NOT abort, so no orphan reconcile). E.g. a tool that persisted a delayed self-wake intent
+                // ends the run cleanly so the daemon owns the re-wake.
+                requestStopAfterTurn,
+                // design/108 (review fix): expose the plan-mode primitive ONLY when the deployment opted in
+                // (`enablePlanMode`). Otherwise a non-plan task's tool could call `ctx.enterPlanMode()` and — if the
+                // tool-call gate happens to be registered (e.g. a policy task) — flip the run read-only. Strictly
+                // opt-in keeps non-plan tasks byte-identical (no reachable way to set the flag).
+                ...(spec.enablePlanMode === true ? { enterPlanMode } : {}),
+            }),
+        }), t));
+        const blockedRef = {};
+        if (spec.enableBlockedReport !== false) {
+            tools.push(makeReportBlockedTool(blockedRef));
+        }
+        // design/80 D-B: mount the first-party `present_plan` tool ONLY when the task opted into plan mode. It is a
+        // thin caller of the `requestReview` primitive (which the engine honors at the turn boundary). When
+        // `enablePlanMode` is unset the tool is NOT mounted, NOT disclosed, and a non-plan-mode task is byte-identical.
+        if (spec.enablePlanMode === true) {
+            tools.push(defineTool(createPresentPlanTool(requestReview)));
+            // design/108: the model-callable `enter_plan_mode` (CC EnterPlanMode parity) — self-impose mid-run read-only
+            // plan mode (enforced by the tool-call handler's plan-mode short-circuit). Mounted alongside present_plan (the
+            // exit half). Sets `planModeRef` via the captured `enterPlanMode`. (Effect:"read"; lands in `toolEffects` via
+            // the early set above + the post-assembly sync, so the plan-mode write-deny doesn't block the read-only exit.)
+            //
+            // (review fix) Gate on a wired checkpointStore: the ONLY exit from plan mode is present_plan → plan_review →
+            // human approve-resume, which REQUIRES a checkpointStore. Without one, present_plan's pause is dropped (no-op)
+            // while `planModeRef.active` persists → the model would be trapped read-only until the turn limit. So we do
+            // NOT offer `enter_plan_mode` when it cannot be exited. (present_plan stays mounted — its no-op degradation is
+            // harmless: it's just plan text, no flag is set.) The user-driven path (enablePlanMode + handsReadOnly, often
+            // headless) is unaffected: that run is read-only by construction and never needed `enter_plan_mode`.
+            if ((spec.checkpointStore ?? deps.checkpointStore) !== undefined) {
+                tools.push(defineTool(createEnterPlanModeTool(enterPlanMode)));
+            }
+        }
+        // design/99 §K (service [305]/center [318]): per-principal runtime ENTITLEMENTS, resolved server-side by
+        // the deployment (the SERVICE maps center `GET /api/config/effective?principal=` → these caps). Resolved
+        // here ONCE. Entitlements are NOT a caller-facing TaskSpec field — an untrusted caller must never
+        // self-grant — so the engine pulls them from a TRUSTED deployment resolver keyed by `spec.principal`
+        // (symmetric with `sessionPolicyStore.getRules`). `undefined` (no resolver / unset cap) = NO per-principal
+        // restriction (tighten-only: a cap only ever DENIES/forces; absence falls back to the deployment default).
+        let runtimeCaps;
+        if (deps.runtimeCapsResolver) {
+            try {
+                runtimeCaps = (await deps.runtimeCapsResolver(spec.principal)) ?? undefined;
+            }
+            catch (err) {
+                // FAIL CLOSED, never open (security review BLOCKER): an entitlement-resolver outage must NOT silently
+                // GRANT a capability center may have denied. Deny EVERY optional per-principal privilege (workflows AND
+                // fork — both gate on `!== false`, so an undefined cap here would AUTO-GRANT) + surface the failure so the
+                // operator can repair the resolver. The deployment-level gates (capability + toolPolicy) still apply, and a
+                // remote policy `ask` with no forced durable gate falls to a sync onAsk → headless deny (more restrictive).
+                // We do NOT force the durable gate on error (that could strand an autonomous run on an absent operator);
+                // `{allowWorkflows:false, allowFork:false}` is the safe, minimal, SYMMETRIC degrade (service [356]②).
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+                runtimeCaps = { allowWorkflows: false, allowFork: false };
+            }
+        }
+        // design/136 §6 盲点① (1.256) + §2.1.a (BREAKING batch) — the run's fork-GOVERNANCE verdict, computed
+        // ONCE from the shared predicate (subagent.ts `forkGovernanceDenial`) and threaded to the Agent tool as
+        // `ctx.forkAccess` in the spec.tools ctx-injection map ABOVE (~:1204, same lane as `insideFork`; the
+        // closure reads this at CALL time, long after this assignment — prepare completes before any tool
+        // executes). `enableFork` is opt-OUT since the standalone Fork tool's removal: only an EXPLICIT
+        // `enableFork:false` / `allowFork:false` denies (undefined = Agent-fork available, bounded by the
+        // durable session capability — CC's default posture).
+        agentForkDenial = forkGovernanceDenial(spec.enableFork, runtimeCaps?.allowFork);
+        // OBS-2: `=== true` EXPLICIT opt-in (polarity note on RuntimeCaps.allowObservers — undefined ships dark).
+        observersActive = runtimeCaps?.allowObservers === true;
+        // design/98 §1.2/§3.1 (S8c): mount the `run_workflow` tool ONLY when self-orchestration is active (opt-in
+        // + hard sandbox + governance baseline) AND a trusted Runner self-ref is wired. The SAME gate
+        // (`selfOrchestrationActive`) drives the orchestration-prompt injection below (§6.3 lockstep). The runner
+        // is a TRUSTED internal (the Runner passes `this`); it is never a TaskSpec field. design/99 §K: a
+        // per-principal `allowWorkflows:false` entitlement DENIES it server-side even on a capable deployment
+        // (the third stage of the workflows gate: task opt-in ∧ deployment capability ∧ principal entitlement).
+        const deploymentWorkflowReady = runnerSelf !== undefined && isSelfOrchestrationActive(spec, deps);
+        const selfOrchestrationActive = deploymentWorkflowReady && runtimeCaps?.allowWorkflows !== false;
+        // Observability (security review MINOR): distinguish an ENTITLEMENT denial from a deployment misconfig — an
+        // opted-in run on a CAPABLE deployment gated purely by `allowWorkflows:false` emits a (governance, NOT
+        // misconfiguration) operator note, so "capable + opted-in + no workflow" is never silently confusing.
+        if (deploymentWorkflowReady && runtimeCaps?.allowWorkflows === false) {
+            deps.onError?.(new Error(`self-orchestration DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowWorkflows=false ` +
+                `(per-principal entitlement governance, not a misconfiguration — the run_workflow tool is not mounted)`), { phase: "config", sessionId });
+        }
+        let workflowToolsActive = false;
+        if (selfOrchestrationActive && runnerSelf && deps.workflowScriptRunner && deps.workflowGovernanceBaseline) {
+            workflowToolsActive = true;
+            toolEffects.set(RUN_WORKFLOW_TOOL_NAME, "write");
+            tools.push(await createRunWorkflowTool({
+                runner: runnerSelf,
+                scriptRunner: deps.workflowScriptRunner,
+                governanceBaseline: deps.workflowGovernanceBaseline,
+                models: deps.models,
+                agents: deps.agents, // F4 agentType registry (deployment SHADOW over built-ins)
+                builtinAgents: deps.builtinAgents,
+                store: deps.workflowRunStore,
+                journalStore: deps.workflowJournalStore, // CORE-9 Part A: durable resume for tool-launched workflows
+                scriptStore: deps.workflowScriptStore, // B5/F2 + design/140 1a: scriptPath/name surface + defaultArgs registry
+                builtinWorkflows: deps.builtinWorkflows, // design/140 1c: built-in named workflows opt-out
+                onAgentSpawn: deps.onWorkflowAgentSpawn, // CORE-9 Part B: steerable handle sink (opt-in)
+                scope: taskScope,
+                notifier: deps.workflowCompletionNotifier,
+                originatingSessionId: sessionId, // service [368]: lookup-free completion-inbox routing
+                taskRegistry: defaultTaskRegistry,
+                taskNotification: internals?.onTaskNotification,
+                taskOwner: hostTaskId,
+                limits: deps.workflowLimits,
+                sourceTaskId: hostTaskId,
+                principal: spec.principal,
+                // TRUSTED nesting depth (cross-process): a workflow-child task carries it so its run_workflow is
+                // rejected by the one-level guard. In-process nesting is caught by the engine's AsyncLocalStorage.
+                workflowDepth: internals?.workflowDepth,
+                // Sub-agent cwd inheritance (CC parity): every agent this workflow spawns carries the HOST task's
+                // effective root so a TOC env factory roots it there instead of an empty sandbox.
+                parentCwd: taskRootPath,
+                // Thinking inheritance: a spawned agent with no explicit script/baseline thinking inherits the
+                // HOST task's CURRENT level (call-time getter — mid-run degrade/boost included).
+                parentThinking: () => harnessRef.current?.getThinkingLevel() ?? thinking,
+            }));
+            // design/136 §2.3: the standalone WorkflowStatus poll tool was retired — the POLL companion to
+            // Workflow is TaskOutput (mounted below with `workflowStore: deps.workflowRunStore`, live alias
+            // "WorkflowStatus"), which carries the field superset + delimitUntrusted fencing + the same
+            // cross-replica store fallback. No separate mount here.
+        }
+        // design/45: holder the durable-suspend gate writes (token+gate); read by the run loop. Plus the
+        // hand's read-file state, captured here so the suspend closure can serialize it into the checkpoint
+        // (it lives in the hands-toolkit closure, not Prepared — §15.2 net-add #8). Undefined when no hand.
+        const suspendRef = {};
+        // design/76 §2.5: the DUAL holder for a dry-run `{kind:"needs_review"}` pause. The commit-side
+        // discriminant (`publishCommittedSuspend`) routes a committed checkpoint into THIS or `suspendRef` by
+        // `gate.kind` — never both, so assemble-result's slot 8.6 `needs_review` branch is never dead (v4 MAJOR-A).
+        const reviewRef = {};
+        const suspendLoopRef = { hit: false }; // design/72 §2.2 (B): set when a re-suspend is refused (loop cap)
+        const compactionReuseRef = { consecutive: 0 }; // design/84 Seam C: run-scoped consecutive provider-reuse counter
+        const trimPressureRef = { droppedMessages: false }; // design/123 D4: request-layer trim dropped messages → force next boundary compaction
+        // design/80 D-E-core (A3): the run loop sets `.get` (after `stats` exists) so an approval suspend can debit
+        // this leg's live cumulative spend onto the durable approval ledger. Captured by the `suspendAsk` closure.
+        const liveSpendRef = {};
+        // design/91: human-review timing. `now` is the injectable wall-clock (default Date.now) — ALL human-time
+        // timestamps (synchronous resolveAsk wait, checkpoint.suspendedAt, resume latency) read it, so a test can
+        // pin them with a controllable clock (design/87 §4.3 flaky-guard: no bare Date.now in a hard-gate test).
+        // `humanReviewRef` is the per-task accumulator: seeded from the resumed checkpoint's carried prior-leg
+        // burden (cross-leg accumulation, like suspendCount/ledger), then appended to by each synchronous ask
+        // here (resolveAskBound) and by the durable-resume latency (runtask). Snapshotted onto a re-suspend's
+        // checkpoint (`humanReview`) so the chain reports the WHOLE burden. **Budget-EXCLUDED** — never a cost/gate input.
+        const now = deps.now ?? Date.now;
+        const humanReviewRef = {
+            count: resume?.priorHumanReview?.count ?? 0,
+            totalWaitMs: resume?.priorHumanReview?.totalWaitMs ?? 0,
+            gates: resume?.priorHumanReview?.gates ? [...resume.priorHumanReview.gates] : [],
+        };
+        // design/72 §2.2 (B): suspend-loop cap. `priorSuspendCount` is how many times this task already
+        // suspended (carried on the resumed checkpoint); the next suspend would be `+1`. Past `maxSuspends`
+        // we fail the run rather than mint another checkpoint — a restart-prone model re-issuing the gated
+        // call every resume can otherwise suspend forever. Default deliberately loose (a real HITL flow
+        // rarely re-suspends): legit multi-step approvals stay well under it.
+        const priorSuspendCount = resume?.priorSuspendCount ?? 0;
+        const maxSuspends = spec.maxSuspends ?? deps.maxSuspends ?? DEFAULT_MAX_SUSPENDS;
+        // design/74 (search [136] HIGH-1): the resource-SLICE cap — INDEPENDENT of the restart-loop `maxSuspends`.
+        // A resource suspend is counted on the ledger's `sliceCount` (priorLedger below), NOT the shared
+        // `suspendCount`: a legitimate long resource run must not trip the (low, default 5) restart-loop safety,
+        // and restart-loop suspends must not consume the slice allowance. The cross-slice $ ledger is the PRIMARY
+        // bound; this is a backstop against a $0-progress slice loop. Default 100 (the design/74 spec's worker-suspend ceiling).
+        const maxSlices = spec.resourceSuspend?.maxSlices ?? DEFAULT_MAX_SLICES;
+        // design/74 Slice 4: the cross-slice budget ledger carried forward from the resumed checkpoint (undefined on
+        // the first slice), plus the human total ($→micro) seeded ONLY on the first slice (later slices read the
+        // frozen total off the ledger — `debitLedger` keeps `prior` wins). `prepared.resourceLedger` exposes the
+        // prior ledger so the run loop can size this slice's effective ceiling = min(maxCostUsd, remaining).
+        const priorLedger = resume?.priorLedger;
+        const resourceTotal = spec.resourceSuspend
+            ? {
+                totalBudgetMicroUsd: spec.resourceSuspend.totalBudgetUsd !== undefined ? Math.round(spec.resourceSuspend.totalBudgetUsd * 1e6) : undefined,
+            }
+            : undefined;
+        // design/80 D-E-core (Part A): the read-only per-leg budget snapshot a STATELESS policy self-limits
+        // against (a fresh in-memory counter resets every resume leg). Computed ONCE here from the DURABLE state
+        // (the resumed resource ledger + the durable suspend chain) and frozen onto every `ToolCallRequest` the
+        // gate builds (per-leg-immutable, read-only — the policy cannot write it back). The prior ledger
+        // (`priorLedger`, carried on the resumed checkpoint regardless of gate kind — design/80 attaches it to
+        // approval suspends too, A3) gives cumulative spend + remaining across legs; on the FIRST leg (no ledger)
+        // the remaining falls back to the configured total so the policy still sees the leg-1 ceiling (mirrors
+        // runtask's first-slice `remainingMicroUsd`). NEVER falsy-test the remaining (0 = exhausted, not unlimited).
+        const budgetSnapshot = {
+            resourceRemainingMicroUsd: priorLedger
+                ? remainingBudgetMicroUsd(priorLedger)
+                : resourceTotal?.totalBudgetMicroUsd,
+            resourceSpentMicroUsd: priorLedger?.spentMicroUsd ?? 0,
+            suspendCount: priorSuspendCount,
+        };
+        let readFileStateForCheckpoint;
+        // parity-204 (CC seededFromContext): set inside the hands block below (needs the env + canonical
+        // roots), consumed by the loadProjectMemory block — undefined on a hands-less task (nothing to seed).
+        let seedContextFiles;
+        // design/99 §E13: the per-task logical cwd ref, OWNED here (not inside createHandsToolkit) when a real
+        // shell is mounted, so the Runner can observe `cd` moves and emit `workspace_changed`. Undefined when no
+        // shell / readOnly (no `cd` possible).
+        let handsCwdRef;
+        // codex 终审 1.255 F2: the EnterWorktree session's shared serializable state — owned HERE (like
+        // handsCwdRef) so the durable-suspend serialization below can stamp it into the checkpoint and a
+        // resume can re-seed it. Undefined ⇔ worktree tools not mounted (no tracked cwd).
+        let worktreeSessionRef;
+        let backgroundTaskToolsActive = false;
+        // design/74 Slice 3c: forward-declared at TASK scope (assigned inside the tool-gate block below, which is
+        // widened to run when resource-suspend is eligible even with no policy). Lives here — not block-local — so
+        // the Prepared return can expose it to the run loop's turn-boundary trigger. Undefined ⇒ not eligible. The
+        // `sliceSpend` arg (Slice 4) is THIS slice's cost/tokens/turns, debited onto the ledger at suspend.
+        let suspendForResource;
+        // design/80 D-B: forward-declared (like `suspendForResource`) so it is in scope at the Prepared return;
+        // ASSIGNED inside the suspend-setup block below (where the commit-saga helpers live).
+        let suspendForReview;
+        // Structured output (1.41): inject `submit_output` whose params ARE the schema. Reject a caller tool
+        // of the same name up front (the harness tool Map is last-write-wins → silent shadowing otherwise).
+        const outputRef = {};
+        if (resume?.seed.outputRef) {
+            // design/45 §4.bis: restore a pre-suspend submit_output so resume doesn't lose the structured result.
+            outputRef.value = resume.seed.outputRef.value;
+            outputRef.set = resume.seed.outputRef.set;
+        }
+        if (spec.outputSchema) {
+            if ((spec.tools ?? []).some((t) => t.name === OUTPUT_TOOL_NAME)) {
+                const e = new Error(`Tool name "${OUTPUT_TOOL_NAME}" is reserved when TaskSpec.outputSchema is set.`);
+                e.code = "config.reserved_tool_name";
+                throw e;
+            }
+            // CC 2.1.205 parity (strict-output-schema.ts): validate + strict-derive the caller's schema.
+            // Invalid schema → FAIL FAST to the caller (CC: Ajv `validateSchema` error surfaces as a thrown
+            // TypeError in workflow `agent({schema})` / a hard CLI error — never a silent no-validation run).
+            // In-subset schema → the strict form (additionalProperties:false stamped) is what the model sees.
+            // Valid-but-unsupported → serve as-is, with an observable warning (CC: telemetry outcome=fallback).
+            const compiled = compileOutputSchema(spec.outputSchema);
+            if ("error" in compiled) {
+                const e = new Error(`TaskSpec.outputSchema is not a valid JSON Schema: ${compiled.error}`);
+                e.code = "config.invalid_output_schema";
+                throw e;
+            }
+            if (!compiled.strict) {
+                try {
+                    deps.onError?.(new Error(`structured-output: strict schema derivation fell back to non-strict (${compiled.fallbackReason}) — the schema is served to the model as-is`), { phase: "config", sessionId });
+                }
+                catch {
+                    /* a throwing onError must not break prepare */
+                }
+            }
+            tools.push(makeOutputTool(outputRef, spec.outputSchema, compiled.strict ? compiled.modelSchema : undefined));
+        }
+        mcp = spec.mcp?.length
+            ? await materializeMcpTools(spec.mcp, spec.principal, deps.onElicit, deps.mcpImageResizer) // design/62 principal → MCP header; §E23 elicit; design/116 image-resize seam
+            : { tools: [], toolAxes: [], warnings: [], serverInstructions: [], instructionsDelta: { pendingAdds: [], pendingRemovals: [] }, statuses: [], dispose: async () => { } };
+        // Fail-open (design/29): servers that couldn't connect were skipped, not thrown — surface each as
+        // an operational warning so a brick'd MCP server is visible without failing the task.
+        for (const w of mcp.warnings)
+            deps.onError?.(w, { phase: "mcp", sessionId });
+        // Reserved-name fail-fast (codex review): an injected MCP tool name/alias (esp. the first-party global resource
+        // tools ListMcpResourcesTool/ReadMcpResourceTool) colliding with a caller tool would SILENTLY shadow (harness Map is
+        // last-write-wins) — reject up front, like submit_output / read_tool_result do above.
+        {
+            const callerNames = new Set((spec.tools ?? []).flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+            const clash = mcp.tools.find((t) => [t.name, ...(t.aliases ?? [])].some((name) => callerNames.has(name)));
+            if (clash) {
+                await mcp.dispose();
+                const e = new Error(`Tool name "${clash.name}" is reserved by an injected MCP tool — a caller tool of the same name would silently shadow it.`);
+                e.code = "config.reserved_tool_name";
+                throw e;
+            }
+        }
+        tools.push(...mcp.tools.map((t) => mcpOffload(t))); // MCP results can be large too (per-tool: _meta-declared → 50K default)
+        // MAJOR-1 fix (design/77 §4 / design/70): a materialized MCP tool carries its safety axes in a sidecar
+        // (the vendored AgentTool has no axis fields). Fold them into the SAME irreversibleTools/egressTools sets
+        // that `spec.tools` fed above — so a `destructiveHint` MCP tool REGISTERS the gate + tightens (else a
+        // no-policy deployment would silently auto-allow it). TIGHTEN-ONLY: a server's hints can add an ask/egress,
+        // never remove one. The effect comes from the axis (`read` for a `readOnlyHint` tool — so it is NOT treated
+        // as write-capable: no spurious LOUD ungated-write warning, no path-confine deny under a skill); otherwise
+        // it defaults to `write` (the gate's repeat-unsafe default) for any other tightened tool.
+        for (const axis of mcp.toolAxes) {
+            if (axis.irreversibility === "always") {
+                irreversibilityTier.set(axis.name, "always");
+                irreversibleTools.add(axis.name);
+            }
+            if (axis.egress) {
+                // SAME invariant as first-party tools above (design/70 council minor#1): an egress tool must be
+                // repeat-UNSAFE — an effect:read/idempotent would let wake/resume reconciliation auto-replay an
+                // interrupted EXTERNAL write. A caller `toolAxes` that lowers a server open-world tool's effect WITHOUT
+                // clearing egress reaches this (the server hint set egress, the override set effect:read). Fail-fast,
+                // exactly like first-party, so the caller resolves it: `egress:false` to vouch a pure read, or
+                // `effect:"write"`. (design F — the MCP fold previously skipped this validation = the bypass.)
+                if (axis.effect !== undefined && axis.effect !== "write") {
+                    const e = new Error(`MCP tool "${axis.name}" resolves to egress:true with effect:"${axis.effect}" — an egress tool (external write) must have effect:"write". Clear egress (toolAxes egress:false) if it is a pure read, or set effect:"write".`);
+                    e.code = "config.egress_requires_write_effect";
+                    throw e;
+                }
+                egressTools.add(axis.name);
+            }
+            if (!toolEffects.has(axis.name))
+                toolEffects.set(axis.name, axis.effect ?? "write");
+        }
+        // design/130 P1+P2: wall-clock-aware per-call cap + finalize estimation state. The ref exists
+        // when EITHER knob is on (codex delta ⑤: P2's est() needs the sample EWMAs even with the cap
+        // disabled — `callCapByDeadline:false` must not silently kill the finalize); the cap PROVIDER
+        // on the harness below is wired only when P1 itself is on. Inert until the run loop arms
+        // `deadlineMs` (non-resource-suspend tasks only, codex ⑤). Static ceiling: the spec cap when
+        // set, else the model's maxTokens — a mid-run degrade tightens it via the ref (codex delta ②).
+        // P2b: hoisted ABOVE the hands toolkit so the shell's soft tool-deadline clamp can close over it.
+        const callCapOn = spec.limits?.callCapByDeadline !== false;
+        const callCapRef = spec.limits?.timeoutSec &&
+            spec.limits.timeoutSec > 0 &&
+            (callCapOn || spec.limits.gracefulFinalize !== false)
+            ? createCallCapRef()
+            : undefined;
+        if (callCapRef) {
+            callCapRef.staticCapTokens =
+                spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
+                    ? spec.limits.maxOutputTokens
+                    : model.maxTokens;
+        }
+        // design/130 P2b: the soft tool-deadline clamp handed to the hands toolkit — inert until runtask
+        // arms BOTH deadlineMs and cushionMs on the ref (softExecDeadlineMs returns undefined before).
+        const execClamp = callCapRef
+            ? {
+                deadlineMs: () => softExecDeadlineMs(callCapRef),
+                onClamp: () => {
+                    callCapRef.toolClamps = (callCapRef.toolClamps ?? 0) + 1; // → stats.mechanisms.toolClamps
+                },
+            }
+            : undefined;
+        // The "hand" (design/44): injecting `executionEnv` is the opt-in — mount the hand tool band over it,
+        // closure-bound to a FRESH per-task read state (§11 ruling A) + the canonicalized containment root
+        // (§4 inv 7). `includeShell` gates the shell tool on a real (non-stub) shell so a no-op bash never
+        // reaches the model (S1); `handsReadOnly` mounts the effect:read-only band — the verifier boundary
+        // (§6). Large read/grep results offload like any other tool. Default stub (no inject) → no hand tools.
+        // design/119: hoisted so the # Environment block announces the EFFECTIVE canonical allow-roots,
+        // not the raw spec values (a skipped/dead entry must not be advertised to the model).
+        // design/138 S2-C — the memory write gate seam. The hands toolkit is built BEFORE the memory
+        // engine session (which owns the writable-root coordinate), so the toolkit gets a late-bound ref:
+        // until the session block below installs the gate, every write passes untouched (byte-compat);
+        // afterwards Write/Edit/NotebookEdit run their FINAL text through MemoryEngine.gateWrite (memory
+        // domain only — one prefix comparison for everything else).
+        const memoryWriteGateRef = {};
+        const additionalRootsCanonical = [];
+        if (handsEnabled) {
+            // design/97 CORE-6: an isolated (worktree) agent's env IS the worktree (the factory rooted its cwd there),
+            // so use the env's own cwd — `deps.rootPath` (a Runner-level default repo root) must NOT override it, else
+            // the agent's hands would confine to the shared base repo, defeating the isolation.
+            const rootRaw = taskRootPath;
+            const canon = await executionEnv.canonicalPath(rootRaw);
+            const rootCanonical = canon.ok ? canon.value : rootRaw;
+            // design/119 (CC --add-dir parity): canonicalize the extra allowed roots once (containment
+            // compares canonical keys, so a raw/symlinked entry here would silently never match).
+            for (const dir of spec.additionalDirectories ?? []) {
+                if (!dir || !dir.trim())
+                    continue; // an empty entry must never reach the allowlist (within("") = allow-all)
+                const c = await executionEnv.canonicalPath(dir);
+                // Fail-closed (codex review MAJOR): a directory that fails to canonicalize (missing, or a
+                // dangling/rejected symlink) is SKIPPED, never admitted raw — a raw prefix in the allowlist
+                // plus the ancestor-canonicalize fallback would let a symlinked entry smuggle writes outside
+                // every root. Skipping only narrows access (the primary root still applies).
+                if (c.ok) {
+                    additionalRootsCanonical.push(c.value);
+                }
+                else {
+                    deps.onError?.(new Error(`additionalDirectories entry skipped (cannot canonicalize): ${dir}`), {
+                        phase: "config",
+                        sessionId,
+                    });
+                }
+            }
+            // per-task; design/45 serializes this into a Checkpoint and re-seeds it on resume (§15.2 #8) — else
+            // a resumed `edit_file` is rejected "file not read in this task".
+            const readFileState = new Map(resume?.seed.readFileState ?? []);
+            readFileStateForCheckpoint = readFileState; // expose to the suspend closure (§15.2 net-add #8)
+            // parity-204 (CC 2.1.204 seededFromContext, cc204-bundle @17917159): the deployment declares
+            // startup-seeded context files via ProjectMemoryLoad.seededFiles (loadProjectMemory block below);
+            // seed the hands' read state through the SAME resolveKey containment as a real Read, so the
+            // canonical keys collide with real Read/Edit entries and an out-of-root declaration is silently
+            // skipped (best-effort, never blocks the task — matching the loadProjectMemory posture).
+            seedContextFiles = async (files) => {
+                for (const f of files) {
+                    const rk = await resolveKey(executionEnv, rootCanonical, f.path, undefined, undefined, additionalRootsCanonical);
+                    if (rk.ok)
+                        seedReadFileStateFromContext(readFileState, rk.key, f.content);
+                }
+            };
+            const handsIncludeShell = !(executionEnv instanceof StubExecutionEnv);
+            const handsReadOnly = spec.handsReadOnly === true;
+            backgroundTaskToolsActive = handsIncludeShell && !handsReadOnly && hasBackgroundShell(executionEnv);
+            if (handsIncludeShell && !handsReadOnly) {
+                handsCwdRef = { current: rootCanonical }; // §E13: observable `cd`
+                // codex 终审 1.255 F2: a durable resume restores the pre-suspend LOGICAL cwd (a `cd` or an
+                // EnterWorktree switch) — without this the cwd silently reset to the task root while the model's
+                // history says otherwise. The directory is plain on-disk state that survived the suspend; if it
+                // was removed externally, tools fail with their ordinary honest ENOENT texts (no special case).
+                if (resume?.seed.handsCwd !== undefined)
+                    handsCwdRef.current = resume.seed.handsCwd;
+            }
+            const band = createHandsToolkit(executionEnv, readFileState, rootCanonical, {
+                ...(additionalRootsCanonical.length > 0 ? { additionalRoots: additionalRootsCanonical } : {}),
+                includeShell: handsIncludeShell,
+                readOnly: handsReadOnly,
+                ...(handsCwdRef ? { cwdRef: handsCwdRef } : {}),
+                taskRegistry: defaultTaskRegistry,
+                taskOwner: hostTaskId,
+                taskScope,
+                // 黑板 [636]① (design/129, same unconditional posture as the Monitor mount): inside a session a
+                // background command registers session-resident and survives the run teardown — the per-task
+                // ISOLATED env case is handled at the teardown (envDying settle + empty keep-alive list), not here.
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                // design/116 §7 G2b: a finished background command notifies the SOURCE task ("next" boundary interrupt).
+                ...(internals?.onTaskNotification !== undefined ? { taskNotification: internals.onTaskNotification } : {}),
+                // design/116 detach: mid-flight ctrl+b — Bash threads the per-call detach signal into env.exec.
+                ...(internals?.detachHub !== undefined ? { detachHub: internals.detachHub } : {}),
+                // design/130 P2b: foreground shell timeouts clamp to the task's soft tool deadline.
+                ...(execClamp !== undefined ? { execClamp } : {}),
+                // PDF degradation chain v2: Read forks on the SERVING model's capability profile — a model without
+                // native document input degrades to pdftotext text extraction / rendered pages IN the tool (the
+                // layer holding env.exec), instead of a brain-level placeholder.
+                pdfModelCapabilities: pdfModelCapabilitiesOf(model),
+                // design/141 件2 — RunnerDeps.hands: the deployment's SAFE hands subset, synthesized here (the
+                // factory itself stays unexported — self-assembly into spec.tools would be name-shadowed by this
+                // band). Runner-internal fields (registry/detachHub/execClamp/cwdRef/mount) are NOT reachable.
+                ...(deps.hands?.bashReadonlyAllow !== undefined ? { bashReadonlyAllow: deps.hands.bashReadonlyAllow } : {}),
+                ...(deps.hands?.commitCoAuthor !== undefined ? { commitCoAuthor: deps.hands.commitCoAuthor } : {}),
+                ...(deps.hands?.readImageDownsampler !== undefined ? { readImageDownsampler: deps.hands.readImageDownsampler } : {}),
+                // design/138 S2-C: late-bound memory write gate — COMPOSED with the deployment's hands.beforeWrite
+                // (design/141 件2): the deployment hook judges first (a rejection short-circuits; a throw is the
+                // band's fail-closed), then the engine's memory-scan gate ALWAYS runs. Deployment config can only
+                // tighten the write path, never bypass the engine gate.
+                beforeWrite: async (w) => {
+                    const deploymentGate = deps.hands?.beforeWrite;
+                    if (deploymentGate) {
+                        const verdict = await deploymentGate(w);
+                        if (verdict !== undefined && verdict.ok === false)
+                            return verdict;
+                    }
+                    return memoryWriteGateRef.current?.(w);
+                },
+                mountBackgroundTaskTools: false,
+            });
+            // design/141 Q4 — hands 同名 shadow 保护: this band pushes AFTER spec.tools and the harness tool
+            // Map is last-write-wins, so a caller tool sharing a hands name (Read/Write/Bash/…) is SILENTLY
+            // dropped — the deployment loses its tool with no trace (and the duplicate name rides into the
+            // default activeToolNames, duplicating the band tool's definition in the provider payload). The
+            // shadow direction is the SAFE one (the gated built-in stays in force: beforeWrite/shellGate keep
+            // judging), so this is ONE operator-visible warning per prepare (onError phase "config", the
+            // design/138 S4 posture) — NOT the reserved-name fail-fast: 下游可能已依赖现状,先 warn 观察
+            // (design/141 §5). Name+alias matching mirrors the MCP clash check above (~:1558). CC 无此锚:
+            // 其三方工具结构性带 mcp__ 前缀,与内置名不可能相撞——自研口径。
+            {
+                const bandNames = new Set(band.flatMap((t) => [t.name, ...(t.aliases ?? [])]));
+                const shadowed = (spec.tools ?? []).filter((t) => [t.name, ...(t.aliases ?? [])].some((n) => bandNames.has(n)));
+                if (shadowed.length > 0) {
+                    const names = shadowed.map((t) => `"${t.name}"`).join(", ");
+                    deps.onError?.(new Error(`spec.tools ${shadowed.length > 1 ? "entries" : "entry"} ${names} collide${shadowed.length > 1 ? "" : "s"} with the built-in hands tool band — the built-in wins (registered later; the harness tool Map is last-write-wins) and the caller tool never dispatches this task. Rename the caller tool, or don't inject executionEnv if you intend to replace the band.`), { phase: "config", sessionId });
+                }
+            }
+            tools.push(...band.map((t) => firstPartyOffload(t)));
+            // (Q6 read-only-Bash effect override is hoisted to the toolEffects seeding above, so the wake-time reconcile
+            // sees it too — design/102 §3.6.)
+            // design/80 D-2 (part-1): gate the hands `bash` per the deployment's shellGate doctrine — a full shell is
+            // treated as egress+irreversible (a command can `curl`/`git push`/`rm`, which the per-tool axis marks
+            // otherwise miss). Fold into the SAME irreversibleTools/irreversibilityTier/reversibilityProbes the
+            // gate reads below (the irreversibility tighten covers egress too via the classifier). "always" → every
+            // command tightens to an irreversible_ask suspend (fail-closed); "classify" → a provably-benign single
+            // allowlisted read-only command auto-allows, everything else (writes, egress, pipes, unknown) tightens.
+            // No effect under `handsReadOnly` (mounts the already-allowlisted bash_readonly) or with no real shell.
+            const shellGate = spec.shellGate ?? "off";
+            if (shellGate !== "off" && !(executionEnv instanceof StubExecutionEnv) && spec.handsReadOnly !== true) {
+                // design/80 D-E: `bash`'s irreversibility comes from the COARSE shellGate tighten UNLESS the deployment
+                // also wired an explicit per-tool mark on a tool literally named `bash` (egress, or an irreversibility
+                // tier set in the spec loop above). The coarse case grades as the `shell` axis (severity 3) at the mint,
+                // never the `irreversible` axis (4) of an explicitly-marked tool — capture that BEFORE shellGate sets the
+                // tier (else its own `set` would look like an explicit mark).
+                shellGatedBash = !egressTools.has("Bash") && !irreversibilityTier.has("Bash");
+                irreversibilityTier.set("Bash", shellGate === "always" ? "always" : "maybe");
+                irreversibleTools.add("Bash");
+                if (shellGate === "classify")
+                    reversibilityProbes.set("Bash", bashReversibilityProbe());
+                // design/135 G2: Monitor runs an arbitrary shell `command` through the SAME env seam — it must sit
+                // behind the SAME shellGate tighten (else it becomes a policy side-door around a gated Bash). The
+                // probe reuses bashReversibilityProbe verbatim (same `command` arg shape). Marked only when the
+                // Monitor tool will actually mount (backgroundTaskToolsActive), mirroring the Bash-present premise.
+                if (backgroundTaskToolsActive) {
+                    shellGatedMonitor = !egressTools.has("Monitor") && !irreversibilityTier.has("Monitor");
+                    irreversibilityTier.set("Monitor", shellGate === "always" ? "always" : "maybe");
+                    irreversibleTools.add("Monitor");
+                    if (shellGate === "classify")
+                        reversibilityProbes.set("Monitor", bashReversibilityProbe());
+                }
+            }
+        }
+        if (backgroundTaskToolsActive || workflowToolsActive) {
+            toolEffects.set("TaskOutput", "read");
+            toolEffects.set("TaskStop", "write");
+            tools.push(firstPartyOffload(createTaskOutputTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore })), // design/129: session dimension for cross-turn poll of session-scoped bg
+            firstPartyOffload(createTaskStopTool({ registry: defaultTaskRegistry, owner: hostTaskId, scope: taskScope, sessionId, workflowStore: deps.workflowRunStore })));
+            // 深挖 G3 — SendMessage: continue a completed background agent with its context intact (the design/122
+            // resume face made MODEL-VISIBLE). Mounted with the same background surface as TaskOutput/TaskStop
+            // (the a* ids it addresses come from that lane) + a runner self (the resume executes child runs).
+            // Mounted even with retain OFF (clay 拍 ①+②): the call then returns the honest not-retained text.
+            // A caller-supplied tool of the same name wins (skip, not throw — this mount is unconditional within
+            // the gate, unlike the opt-in Fork whose collision is a config error).
+            if (runnerSelf && !(spec.tools ?? []).some((t) => t.name === SEND_MESSAGE_TOOL_NAME)) {
+                tools.push(firstPartyOffload(createSendMessageTool({
+                    runner: runnerSelf,
+                    registry: defaultTaskRegistry,
+                    ...(subagentRetain ? { retain: subagentRetain } : {}),
+                    owner: hostTaskId,
+                    scope: taskScope,
+                    ...(sessionId !== undefined ? { sessionId } : {}),
+                    ...(internals?.onTaskNotification !== undefined ? { notify: internals.onTaskNotification } : {}),
+                    ...(internals?.onSubagentSpawn !== undefined ? { sink: internals.onSubagentSpawn } : {}),
+                })));
+                // 黑板 [558] C — AgentTranscript: read a retained background child's recent tool steps ON DEMAND
+                // (pull face, does not inflate context). Same background surface + self-runner (reads sessions),
+                // same skip-on-collision posture. Complements the stop-time residual the notification carries.
+                if (!(spec.tools ?? []).some((t) => t.name === AGENT_TRANSCRIPT_TOOL_NAME)) {
+                    tools.push(firstPartyOffload(createAgentTranscriptTool({
+                        runner: runnerSelf,
+                        registry: defaultTaskRegistry,
+                        owner: hostTaskId,
+                        scope: taskScope,
+                        ...(sessionId !== undefined ? { sessionId } : {}),
+                    })));
+                }
+            }
+        }
+        // design/135 G2 (审计 [485]①): the Monitor tool — watch a background command's stdout as batched
+        // notification events (the自主循环 companion to Bash run_in_background). Same preconditions as the
+        // background half above (real shell + write hands + background-capable env); same security posture as
+        // Bash (arbitrary shell ⇒ effect:"write", folded into the shellGate tighten above). Events ride the
+        // run-local task-notification lane at "later" priority; the m* handle gets TaskOutput/TaskStop for free.
+        if (backgroundTaskToolsActive) {
+            toolEffects.set("Monitor", "write");
+            tools.push(firstPartyOffload(createMonitorTool(executionEnv, {
+                registry: defaultTaskRegistry,
+                owner: hostTaskId,
+                scope: taskScope,
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                ...(internals?.onTaskNotification !== undefined ? { onTaskNotification: internals.onTaskNotification } : {}),
+                ...(handsCwdRef !== undefined ? { cwdRef: handsCwdRef } : {}),
+            })));
+        }
+        // 审计[485]③ G4: EnterWorktree/ExitWorktree — session-level git-worktree isolation (CC parity). Mounted
+        // only with real WRITE hands over a tracked cwd (`handsCwdRef` exists ⇔ real shell + !handsReadOnly —
+        // the same premise family as the Monitor/background mounts): the tools' whole point is switching the
+        // shared mutable cwd, which read-only/stub hands don't have. Git-ness is probed honestly at Enter time
+        // (subagent-worktree-helper posture — no per-task prepare-time git exec); effect:"write" ⇒ plan mode
+        // gates Enter/Exit like every other write tool.
+        if (handsCwdRef !== undefined) {
+            toolEffects.set("EnterWorktree", "write");
+            toolEffects.set("ExitWorktree", "write");
+            // codex 终审 1.255 F2: seed the session ref from the checkpoint (Enter→suspend→resume→Exit works:
+            // the worktree dir survived on disk; Exit re-derives removal without any Enter-leg closure).
+            worktreeSessionRef = { ...(resume?.seed.activeWorktree ? { current: { ...resume.seed.activeWorktree } } : {}) };
+            tools.push(...createWorktreeTools(executionEnv, { repoRoot: taskRootPath, cwdRef: handsCwdRef, session: worktreeSessionRef }).map((t) => firstPartyOffload(t)));
+        }
+        // Inject the reader once, so the model can fetch any offloaded result (design/30). Not itself offloaded.
+        if (offloadStore)
+            tools.push(makeReadToolResultTool(offloadStore));
+        // AskUserQuestion (design/64 §5): mount only when a content-ask seam is wired (deployment opt-in).
+        // The model issues the question; the tool routes it to onQuestion (a real human/UI) and returns the
+        // choice. Headless deployments simply don't wire onQuestion, so the tool isn't offered.
+        const onQuestion = spec.onQuestion ?? deps.onQuestion;
+        if (onQuestion)
+            // design S1d §1.2: pass Runner-held source identity so an aggregating onQuestion can attribute per worker.
+            tools.push(createAskUserQuestionTool(onQuestion, { principal: spec.principal, sourceTaskId: sessionId }));
+        // design/105: scheduler tools (CronCreate/CronDelete/CronList — design/136 §2.2: Sleep retired) — mounted only when the env carries an
+        // injected scheduler daemon backend (`hasScheduler`, checked inside the factory → returns [] otherwise = INERT).
+        // Runner-held identity (principal/scope/sessionId) is closure-captured, NOT a model arg (防自排提权, mirrors
+        // AskUserQuestion/present_plan). Write tools → not in the read-only verifier band (`handsReadOnly`).
+        if (spec.handsReadOnly !== true) {
+            const schedScope = sessionId ?? spec.principal ?? spec.taskId ?? "default";
+            tools.push(...createSchedulerTools(executionEnv, {
+                scope: schedScope,
+                ...(spec.principal !== undefined ? { principal: spec.principal } : {}),
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                requestStopAfterTurn,
+            }));
+        }
+        // design/136 §2.1: the standalone FORK tool was retired — fork lives ONLY in `Agent(subagent_type:
+        // "fork")` (1.254 收编 + the [417]① background lane migrated in this batch). Governance travels as
+        // `ctx.forkAccess` (computed above from the shared `forkGovernanceDenial` predicate, opt-OUT default:
+        // only an explicit `enableFork:false` / `runtimeCaps.allowFork:false` denies, honestly, at call time).
+        // Observability (mirrors allowWorkflows): a fork-CAPABLE run (session + fork-capable durable store,
+        // not itself a forked child) denied purely by the per-principal `runtimeCaps.allowFork=false`
+        // entitlement emits a governance (NOT misconfiguration) operator note, so "capable + no fork" is
+        // never silently confusing. A `denied:"task"` (explicit enableFork:false) is the deployment's own
+        // choice — no note.
+        if (internals?.insideFork !== true &&
+            runnerSelf &&
+            sessionId !== undefined &&
+            hasSessionFork(runnerSelf.sessions) &&
+            agentForkDenial === "principal" // ⇔ runtimeCaps.allowFork === false (shared predicate, design/136 §6 盲点①)
+        ) {
+            deps.onError?.(new Error(`Fork DENIED for principal "${spec.principal ?? ""}" by runtimeCaps.allowFork=false ` +
+                `(per-principal entitlement governance, not a misconfiguration — Agent(subagent_type:"fork") will refuse honestly)`), { phase: "config", sessionId });
+        }
+        // LSP code intelligence (design/64 §13.1): mounted only when a manager is wired (deployment opt-in).
+        // Results are filtered through git check-ignore (CC parity); no server for a language → graceful degrade.
+        const lspManager = spec.lspManager ?? deps.lspManager;
+        if (lspManager) {
+            const lspRoot = taskRootPath;
+            // Pass the per-task env (the agent's sandbox) so the manager can be stateless — no sessionId→env
+            // registry needed (design/64 §13.1 wiring, answering service[59]). Env injection stays off TaskSpec
+            // (design/44 §7 Q4): it flows from the trusted Runner env here, never from untrusted caller input.
+            tools.push(createLspTool(lspManager, { isPathIgnored: gitCheckIgnoreFilter(executionEnv, lspRoot), env: executionEnv }));
+        }
+        // design/121 (CC 198 <new-diagnostics> parity): the diagnostics lane. Preconditions = a manager
+        // whose sessions FEED a registry + write-capable hands on the roster (CC's same gate) + not opted
+        // out. When live: ① every successful edit/write nudges the file's LSP session (didChange push, so
+        // the server re-analyzes and pushes publishDiagnostics — the session's own sync is lazy and only
+        // runs on the next LSP op) and clears the file's delivered-set (a persisting problem resurfaces
+        // against the new text); ② runtask drains the registry at each turn boundary (injection + frame).
+        const lspDiagnostics = spec.lspDiagnostics !== false && lspManager?.diagnostics !== undefined && handsEnabled && spec.handsReadOnly !== true
+            ? lspManager.diagnostics
+            : undefined;
+        const nudgeLspOnEdit = lspDiagnostics
+            ? (rawPath) => {
+                // The tool details carry the RAW arg path — resolve like the fs band does (relative against
+                // the task's live cwd, else the root) so the LSP session/URI sees the same canonical file.
+                // [K-PLATFORM-SWEEP] MAJOR#3: FORM-aware absolute check + family-consistent join — the raw arg
+                // path comes from the ExecutionEnv lane and may be the OTHER family than the host (host
+                // node:path isAbsolute/resolve mangles a cross-family path). Same philosophy as fs/safety.ts.
+                const baseDir = handsCwdRef?.current ?? taskRootPath;
+                const isAbsForm = rawPath.startsWith("/") || /^[A-Za-z]:[\\/]/.test(rawPath);
+                const joinSep = baseDir.includes("\\") ? "\\" : "/";
+                // codex 1.237 F2: normalize dot-segments FAMILY-AGNOSTICALLY after the join — a raw `./x` or
+                // `a/../x` arg otherwise mints a URI (`/root/./x`) that diverges from the session's canonical
+                // key (delivered diagnostics never clear; didChange hits a duplicate doc). Pure string walk.
+                const normalizeSegments = (pth) => {
+                    const isUnc = pth.startsWith("\\\\");
+                    const drive = /^[A-Za-z]:/.exec(pth)?.[0] ?? "";
+                    const rest = pth.slice(drive.length + (isUnc ? 2 : 0));
+                    const sep = pth.includes("\\") ? "\\" : "/";
+                    const abs = rest.startsWith("/") || rest.startsWith("\\");
+                    const outSegs = [];
+                    for (const seg of rest.split(/[\\/]+/)) {
+                        if (!seg || seg === ".")
+                            continue;
+                        if (seg === "..") {
+                            if (outSegs.length > 0 && outSegs[outSegs.length - 1] !== "..")
+                                outSegs.pop();
+                            else if (!abs)
+                                outSegs.push("..");
+                            continue;
+                        }
+                        outSegs.push(seg);
+                    }
+                    return (isUnc ? sep + sep : "") + drive + (abs ? sep : "") + outSegs.join(sep);
+                };
+                const filePath = normalizeSegments(isAbsForm ? rawPath : baseDir.replace(/[\\/]+$/, "") + joinSep + rawPath);
+                lspDiagnostics.fileEdited(pathToUri(filePath));
+                // Fire-and-forget: sessionFor() resolves the file's language server (spawning at most the
+                // same set the LSP tool would); a language with no server degrades silently.
+                void lspManager
+                    .sessionFor(filePath, undefined, executionEnv)
+                    .then((session) => session?.notifyFileChanged?.(filePath))
+                    .catch(() => undefined);
+            }
+            : undefined;
+        // Long-term memory (L2): inject the scope(s)' memory block + a `remember` tool (opt-in, scoped).
+        // design/84 Seam A: normalize the (backward-compatible) memory union ONCE to a canonical
+        // {scopes, writeScope, enabled}; every consumer below reads ONLY this, never the raw union (zero narrowing).
+        const memorySpec = normalizeMemorySpec(spec.memory);
+        // design/138 S1 — the NEW memory-engine path. `deps.memoryBackend` is THE switch: when configured
+        // (and the task enables memory), the injection-first file-based lifecycle replaces the legacy
+        // memoryStore path WHOLESALE for this task — no remember/recall tools, no legacy <user_memory>
+        // block, no legacy consolidation/dynamic-recall (S2 rewires consolidation onto the entry plane).
+        // Unset ⇒ the legacy path below is byte-identical (this leg adds; a later slice switches defaults).
+        const useMemoryEngine = Boolean(memorySpec && memorySpec.enabled && deps.memoryBackend);
+        let memoryEngineSession;
+        if (useMemoryEngine && memorySpec) {
+            try {
+                const backend = deps.memoryBackend;
+                // Directory resolution (§2.7): a FileBackend pins its own directory (zero-copy — the dir IS
+                // the storage); any other backend gets the derived per-repo projection dir under the config root.
+                const pinned = backend.directoryRoot;
+                const engineRoot = resolveMemoryEngineRoot(deps.memoryEngineDir);
+                const repoRoot = deps.rootPath ?? taskRootPath;
+                // design/142 §1.5 — marker-first identity keying (v2 opt-in only): a resolved project marker
+                // switches the derived mount key from the PATH to the projectId, so rename/move/re-clone/
+                // container remounts stop breaking the memory link. resolveProjectId throws config.-coded on
+                // a nested marker (rethrown below = fail-loud). A missing marker with a recorded hint is the
+                // §1.5 recovery breadcrumb: warn (restorable), fall through to the path key — never mint.
+                let identityKey;
+                if (memorySpec.scopeContract === "v2" && repoRoot) {
+                    // 独立轨 F6: a nested-marker refusal is a PROJECT-IDENTITY violation — it must only fail
+                    // sessions that actually consume project identity (proj:/userproj: keys). A pure
+                    // personal/legacy session in the same checkout degrades to a warning + path key.
+                    const consumesProjectIdentity = [...memorySpec.scopes, ...(memorySpec.writeScope !== null ? [memorySpec.writeScope] : [])]
+                        .map(parseScopeKey)
+                        .some((k) => k.kind === "proj" || k.kind === "userproj");
+                    let marker = null;
+                    try {
+                        marker = resolveProjectId(repoRoot);
+                    }
+                    catch (err) {
+                        if (consumesProjectIdentity)
+                            throw err;
+                        deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+                    }
+                    if (marker) {
+                        identityKey = marker.projectId;
+                        const firstSwitch = lookupProjectIdHint(engineRoot, repoRoot) !== marker.projectId;
+                        recordProjectIdHint(engineRoot, repoRoot, marker.projectId);
+                        // 独立轨 F4 — key-switch control-plane carry-over: the OLD path-keyed control dir may hold
+                        // announcements queued for the next session's disclosure; switching the mount key must not
+                        // silently orphan them (backend entries are key-independent; the control plane is not).
+                        // One-shot, best-effort: drain old → enqueue new on the FIRST session that sees this marker.
+                        if (firstSwitch) {
+                            try {
+                                const oldCtl = deriveControlPlaneDir(engineRoot, repoRoot);
+                                const newCtl = deriveProjectControlDir(engineRoot, marker.projectId);
+                                const drained = drainMemoryAnnouncements(oldCtl);
+                                for (const ann of drained.queue)
+                                    enqueueMemoryAnnouncement(newCtl, ann);
+                            }
+                            catch {
+                                /* carry-over is best-effort — announcements are disclosure, never CAS-load-bearing */
+                            }
+                        }
+                        // codex 复审 B2 (142 §1.4 一致性核): the WRITE target's projectId must match the marker —
+                        // writing proj:t/B while standing in marker-A's checkout is a mis-addressed write, fail-loud.
+                        // READ layers may reference other projects (cross-project reference is legal); only the
+                        // write face is identity-checked.
+                        if (memorySpec.writeScope !== null) {
+                            const w = parseScopeKey(memorySpec.writeScope);
+                            if ((w.kind === "proj" || w.kind === "userproj") && w.projectId !== marker.projectId) {
+                                const e = new Error(`memory scope contract v2: writeScope ${memorySpec.writeScope} targets projectId ${w.projectId}, ` +
+                                    `but this checkout's marker (.sema/project) declares ${marker.projectId} — refusing a mis-addressed write.`);
+                                e.code = "config.memory_project_identity";
+                                throw e;
+                            }
+                        }
+                    }
+                    else {
+                        const hint = lookupProjectIdHint(engineRoot, repoRoot);
+                        if (hint !== undefined) {
+                            deps.onError?.(new Error(`memory project marker missing but recoverable: ${repoRoot} previously carried projectId ${hint} ` +
+                                `(.sema/project deleted?). Restore the marker to keep the identity-keyed memory mount; this session ` +
+                                `falls back to the path-derived key.`), { phase: "config", sessionId });
+                        }
+                    }
+                }
+                // repoKey derives from the BASE repo root (deps.rootPath) when configured — a worktree-isolated
+                // task must share the same repo-level memory dir as the base checkout (§2.7 worktree-shared).
+                const memoryDir = typeof pinned === "string" && pinned
+                    ? pinned
+                    : identityKey !== undefined
+                        ? deriveProjectMemoryDir(engineRoot, identityKey)
+                        : deriveRepoMemoryDir(engineRoot, repoRoot);
+                // design/142 S2b — dual physical roots (S1b 清账): under v2, personal scopes (`user:`/
+                // `userproj:`) route to the PERSONAL plane (a cross-project home mount under the config
+                // root) while proj:/org:/legacy stay on the project plane. Assembly is OUTSIDE the engine
+                // (two instances, each keeping its single-root invariants); exactly one owns the write face.
+                const planes = memorySpec.scopeContract === "v2" ? classifyScopePlanes(memorySpec.scopes, memorySpec.writeScope) : undefined;
+                const dual = planes !== undefined && needsDualRoots(planes);
+                const personalOnly = planes !== undefined && !dual && planes.project.length === 0 && planes.writePlane !== "project" && (planes.personal.length > 0 || planes.writePlane === "personal");
+                // design/142 §7 S1 硬门 (复审 F9): the PROJECT plane must never carry a personal key into an
+                // in-repo memory dir. With S2b routing this is structural (the project plane is personal-free
+                // by construction) — the assert stays as the invariant's fail-loud backstop. config.-coded →
+                // rethrown past the fail-open catch below.
+                if (memorySpec.scopeContract === "v2" && !personalOnly) {
+                    assertScopeContractPlacement({
+                        parsedScopes: dual
+                            ? parsedProjectPlane(planes, memorySpec.writeScope)
+                            : [...memorySpec.scopes, ...(memorySpec.writeScope !== null ? [memorySpec.writeScope] : [])].map(parseScopeKey),
+                        memoryDir,
+                        repoRoot,
+                    });
+                }
+                // Personal-plane seat (dual or personal-only): a directory-pinned File backend keeps the
+                // project plane zero-copy, so the personal plane gets its OWN File backend pinned to the
+                // personal mount (the home mount IS the personal authority disk); a DB backend is shared —
+                // the scope column partitions, both instances copy-out into their own roots.
+                const personalMemoryDir = derivePersonalMemoryDir(engineRoot);
+                const personalControlDir = derivePersonalControlDir(engineRoot);
+                const makePersonalEngine = () => new MemoryEngine({
+                    backend: typeof pinned === "string" && pinned
+                        ? new FileMemoryEngineBackend(personalMemoryDir, { controlDir: personalControlDir })
+                        : backend,
+                    memoryDir: personalMemoryDir,
+                    controlDir: personalControlDir,
+                });
+                // Assemble the session faces (single write gate, merged inject, merged harvest) so the rest
+                // of the runner keeps ONE session shape regardless of how many roots are underneath.
+                let writeEngine;
+                let writeHandle;
+                let injectFn;
+                let harvestBoth;
+                if (dual) {
+                    const projectEngine = new MemoryEngine({
+                        backend,
+                        memoryDir,
+                        controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveControlPlaneDir(engineRoot, repoRoot),
+                    });
+                    const personalEngine = makePersonalEngine();
+                    const p = planes;
+                    const projectHandle = await projectEngine.materialize(p.project, p.writePlane === "project" ? memorySpec.writeScope : null);
+                    const personalHandle = await personalEngine.materialize(p.personal, p.writePlane === "personal" ? memorySpec.writeScope : null);
+                    const writeIsPersonal = p.writePlane === "personal";
+                    writeEngine = writeIsPersonal ? personalEngine : projectEngine;
+                    writeHandle = writeIsPersonal ? personalHandle : projectHandle;
+                    injectFn = () => mergeInjections(projectEngine.inject(projectHandle), personalEngine.inject(personalHandle));
+                    // codex 复审 H12 — the WRITE plane's harvest is the hard half (the session's actual yield):
+                    // run it FIRST and let its failure propagate (harvestSafe surfaces it via onError). The
+                    // read-only plane's harvest is tamper-detection only — its failure degrades to a warning
+                    // on the merged report instead of silently discarding the write plane's completed half.
+                    harvestBoth = async () => {
+                        const writeFirst = writeIsPersonal ? [personalEngine, personalHandle] : [projectEngine, projectHandle];
+                        const readOther = writeIsPersonal ? [projectEngine, projectHandle] : [personalEngine, personalHandle];
+                        const writeReport = await writeFirst[0].harvest(writeFirst[1]);
+                        let readReport;
+                        let readFailure;
+                        try {
+                            readReport = await readOther[0].harvest(readOther[1]);
+                        }
+                        catch (err) {
+                            readFailure = err instanceof Error ? err.message : String(err);
+                        }
+                        const merged = readReport !== undefined ? mergeHarvestReports(writeReport, readReport) : writeReport;
+                        if (readFailure !== undefined)
+                            merged.warnings.push(`read-plane harvest failed (write-plane yield committed): ${readFailure}`);
+                        return merged;
+                    };
+                }
+                else if (personalOnly) {
+                    const personalEngine = makePersonalEngine();
+                    const handle = await personalEngine.materialize(memorySpec.scopes, memorySpec.writeScope);
+                    writeEngine = personalEngine;
+                    writeHandle = handle;
+                    injectFn = () => personalEngine.inject(handle);
+                    harvestBoth = () => personalEngine.harvest(handle);
+                }
+                else {
+                    const engine = new MemoryEngine({
+                        backend,
+                        memoryDir,
+                        controlDir: identityKey !== undefined ? deriveProjectControlDir(engineRoot, identityKey) : deriveControlPlaneDir(engineRoot, repoRoot),
+                    });
+                    const handle = await engine.materialize(memorySpec.scopes, memorySpec.writeScope);
+                    writeEngine = engine;
+                    writeHandle = handle;
+                    injectFn = () => engine.inject(handle);
+                    harvestBoth = () => engine.harvest(handle);
+                }
+                // design/138 S2-C (C-F2): install the write gate — Write/Edit/NotebookEdit now run their
+                // FINAL text through the engine's shared scan when (and only when) the target lands inside
+                // the memory writable root. gateWrite never throws (its sidecar bookkeeping is fail-open).
+                // Dual roots: the write face lives on exactly ONE plane; the other plane's trees are
+                // chmod-protected + harvest-tamper-checked (the same protection non-write scopes always had).
+                memoryWriteGateRef.current = (w) => writeEngine.gateWrite(writeHandle, w.key, w.content);
+                const harvestSafe = async (phase = "terminal") => {
+                    // Never throws: harvest is a boundary side-effect (task end / checkpoint mint) — a memory
+                    // failure must not fail or strand the run. Incidents/rejections surface via onError + the report.
+                    try {
+                        const report = await harvestBoth();
+                        if (!report.ok && report.incident) {
+                            deps.onError?.(new Error(`memory harvest refused (${report.incident.kind}): ${report.incident.detail}`), { phase: "memory", sessionId });
+                        }
+                        // S2-B (O-F7/C-F3): the report is returned to the Runner's owner — never dropped on the
+                        // floor. Swallow-guarded like onError: a throwing consumer must not fail the boundary.
+                        try {
+                            deps.onMemoryHarvestReport?.(report, { sessionId, phase });
+                        }
+                        catch {
+                            /* consumer errors never escape a best-effort harvest */
+                        }
+                        return report;
+                    }
+                    catch (err) {
+                        try {
+                            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "memory", sessionId });
+                        }
+                        catch {
+                            /* a throwing onError must not escape a best-effort harvest */
+                        }
+                        return undefined;
+                    }
+                };
+                memoryEngineSession = { engine: writeEngine, handle: writeHandle, inject: injectFn, harvest: harvestSafe };
+            }
+            catch (err) {
+                // design/142 S1 硬门: a `config.`-coded violation is a DELIBERATE refusal (scope-contract
+                // placement / malformed v2 key) — rethrow, never degrade to "runs memory-less" (F9: the
+                // leak-shaped config must not silently proceed without its memory gate).
+                if (typeof err.code === "string" && (err.code.startsWith("config.memory_scope") || err.code.startsWith("config.memory_project"))) {
+                    throw err;
+                }
+                // Fail-open like loadProjectMemory: a broken memory mount must not block the task; the task
+                // simply runs memory-less this session (surfaced via onError).
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "memory", sessionId });
+            }
+        }
+        // design/138 S4 — the legacy MemoryStore path is RETIRED (BREAKING; clay 拍「直接弃用不迁移」).
+        // A task that enables memory WITHOUT a memoryBackend no longer mounts remember/recall tools,
+        // injects no legacy <user_memory> block, and runs NO legacy consolidation/selective/dynamic
+        // recall. Fail-loud: ONE operator-visible deprecation warning per prepare (onError, phase
+        // "config") so a deployment still wiring the retired deps.memoryStore learns to migrate to
+        // RunnerDeps.memoryBackend (the design/138 injection-first memory engine) instead of silently
+        // losing memory. Model-facing: a NEW Remember/Recall call gets the TOMBSTONED_TOOLS migration
+        // text (agent-loop roster-miss branch); a pre-retirement checkpoint whose APPROVED pending
+        // action was remember/recall resumes down the established P-7 `resume.tool_unavailable` reopen
+        // (the checkpoint reopens for a fresh operator decision — the suspended work is never dropped).
+        let memoryBlock;
+        if (memorySpec && memorySpec.enabled && !useMemoryEngine) {
+            const detail = deps.memoryStore
+                ? "RunnerDeps.memoryStore is retired (design/138 S4): the legacy remember/recall tools and <user_memory> injection no longer run. Configure RunnerDeps.memoryBackend (memory engine) instead; this task runs memory-less."
+                : "TaskSpec.memory is enabled but RunnerDeps.memoryBackend is not configured; memory is inactive for this task (the legacy memoryStore fallback was retired in design/138 S4).";
+            deps.onError?.(new Error(detail), { phase: "config", sessionId });
+        }
+        // design/138 S1 — the memory-engine INJECTION replaces the legacy block wholesale on the new path:
+        // ① the CC-verbatim `# Memory` instruction section (system authority — the §0.3 逐字 surface) and
+        // ② the derived MEMORY.md index, truncated to CC parameters and FENCED untrusted (composeMemoryBlock
+        // family — memory CONTENT never gets system-prompt authority). Mounted in the SAME stable-prefix
+        // memory slot as the legacy memoryBlock (finishStable places it at the tail, before the project layer).
+        if (memoryEngineSession) {
+            const injection = memoryEngineSession.inject();
+            if (injection.block.trim())
+                memoryBlock = injection.block;
+        }
+        // === C4 (design/113) proactive project startup — load the deployment's project context (CLAUDE.md ± git
+        // narrative) via the TRUSTED RunnerDeps seam and append it as a READ-ONLY, FENCED virtual "project" memory
+        // layer at the TAIL. DECOUPLED from any memory feature (H5; the legacy `if (memoryEnabled…)` block this
+        // note once referenced was retired in design/138 S4 — this layer always runs). Reuses composeMemoryBlock's
+        // sanitize/fence (H2 — repo-controlled CLAUDE.md is UNTRUSTED). The project layer NEVER enters
+        // memorySpec.scopes/writeScope (S4: the memory ENGINE owns the real scopes). Seam unwired OR null/blank
+        // content ⇒ memoryBlock UNCHANGED = byte-identical (H3). Re-read every prepare incl. durable resume
+        // (H8 — fresher than CC's conversation-frozen snapshot; documented in design/113 §6).
+        if (deps.loadProjectMemory) {
+            let loaded = null;
+            try {
+                loaded = await Promise.resolve(deps.loadProjectMemory({
+                    cwd: taskRootPath,
+                    handsEnabled,
+                    isSubagent: internals?.parentTaskId !== undefined,
+                    ...(internals?.agentName ? { agentName: internals.agentName } : {}),
+                }));
+            }
+            catch (err) {
+                deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId }); // best-effort, never block the task
+            }
+            // parity-204: the structured return declares startup-seeded context files — pre-seed the hands'
+            // read state (seedContextFiles above; undefined on a hands-less task = nothing to seed). Best-effort
+            // like the load itself: a failing canonicalization must never block the task.
+            const projectMem = loaded !== null && typeof loaded === "object" ? loaded.content : loaded;
+            const seededFiles = loaded !== null && typeof loaded === "object" ? loaded.seededFiles : undefined;
+            if (seededFiles?.length && seedContextFiles) {
+                try {
+                    await seedContextFiles(seededFiles);
+                }
+                catch (err) {
+                    deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "config", sessionId });
+                }
+            }
+            if (projectMem != null && projectMem.trim()) {
+                // design/113 §4.5: a TRUSTED framing PRECEDES the FENCED content so the model ORIENTS to the project (the
+                // live test showed content-injection alone left a small model project-aware but PASSIVE on a bare greeting).
+                const projectBlock = `${PROJECT_CONTEXT_FRAMING}\n\n${composeMemoryBlock(projectMem, "project")}`; // sanitized + fenced (H2)
+                memoryBlock = memoryBlock ? `${memoryBlock}\n\n${projectBlock}` : projectBlock; // project at the TAIL (closest to the model); appended (NOT re-composed) so selective recall above is preserved
+            }
+        }
+        // Skills (design/71 黑盒#5 fix): first-party disclosure + invocation. One normalized list feeds
+        // BOTH halves (the `<skills>` system-prompt block below and the `skill` tool here), so the prompt
+        // promises exactly what the tool serves. On the legacy free-form `provider.system` path the block
+        // is the provider's to place; the tool's own description still names every skill, so disclosure
+        // never silently vanishes there.
+        const skillSpecs = normalizeSkills(spec.skills);
+        // design/77 §3 Gate-3: the `skillScope` LIFO stack (declared above, before the tool wrap) is populated
+        // here. The `skill` tool pushes a loaded skill's manifest onto it; the scope policy (composed into the
+        // adjudicate chain below) deny-narrows tool calls to the intersection of active manifests. The stack
+        // stays empty (a no-op policy) for a task with no manifested skills AND no inherited parent scope — so
+        // such a task behaves exactly as before.
+        // 🔴 design/77 §3 / §7: skill→subagent manifest-scope PROPAGATION. When this task is a SUBAGENT spawned
+        // while a skill manifest was active on the PARENT, the parent's active frames arrive via the trusted
+        // `internals.inheritedManifestScope` channel (never TaskSpec — design/44 §7 Q4). Seed them onto this
+        // child's scope stack FIRST (as the base of the LIFO), so the child's tool gate inherits the parent
+        // skill's deny-narrowing. The child's OWN skill loads then push ON TOP → the scope policy intersects
+        // ALL live frames (parent + child), so the child can only narrow FURTHER, never re-grant. A DENY-ALL
+        // `unresolved` frame the subagent tool threaded as a fail-closed fallback applies the same way. Empty/
+        // absent → no inheritance (backward-compatible).
+        const inheritedFrames = internals?.inheritedManifestScope ?? [];
+        for (const frame of inheritedFrames) {
+            skillScope.push(frame);
+        }
+        // Apply manifest scoping when THIS task carries a manifested skill OR inherits a parent manifest frame.
+        const hasSkillManifest = skillSpecs.some((s) => s.manifest !== undefined) || inheritedFrames.length > 0;
+        if (skillSpecs.length > 0) {
+            // Same reservation rule as `tool_search`/`submit_output`: the harness tool Map is last-write-wins,
+            // so a caller/MCP tool of the same name would silently shadow (or be shadowed by) ours.
+            if (tools.some((t) => t.name === SKILL_TOOL_NAME)) {
+                const e = new Error(`Tool name "${SKILL_TOOL_NAME}" is reserved when spec.skills is present.`);
+                e.code = "config.reserved_tool_name";
+                throw e;
+            }
+            tools.push(makeSkillTool(skillSpecs, skillScope));
+        }
+        const skillsBlock = buildSkillsBlock(skillSpecs);
+        // design/138 S4: legacy consolidation retired with the memoryStore path — never active anymore
+        // (a resumed pre-retirement checkpoint's `seed.consolidationNotes` are ignored: the task-end
+        // reconcile pass they fed no longer runs). The prompt flags below stay wired (always-off) so the
+        // constitution seam is unchanged.
+        const provider = spec.promptProvider ?? deps.promptProvider ?? defaultPromptProvider;
+        // design/64 §6.3: tell the harness-context block which runtime features are actually active for this
+        // task so it never claims a mechanism the task lacks. Cheap derivations of spec/deps (the real policy/
+        // hooks are resolved the same way for the tool gate below); evaluating them here has no side effects.
+        const promptPolicyEnabled = Boolean(spec.toolPolicy ?? deps.toolPolicy);
+        const promptHooks = spec.hooks ?? deps.hooks;
+        const promptHooksEnabled = Boolean(promptHooks?.preToolUse || promptHooks?.postToolUse);
+        // design/98 §1.2 (S8a): the orchestration prompt is injected iff self-orchestration is ACTIVE — the SAME
+        // gate that mounted the run_workflow tool above (`selfOrchestrationActive`, §6.3 lockstep). When the task
+        // opted in but the bar is unmet, emit ONE operator-visible warning (fail-closed; never run an LLM script
+        // in the dev vm).
+        const failClosedReason = selfOrchestrationFailClosedReason(spec, deps);
+        if (failClosedReason) {
+            deps.onError?.(new Error(failClosedReason), { phase: "config", sessionId });
+        }
+        // Isolation (1.257.x capability-split follow-up, mirrors [500]② suspendable): drive the prompt's
+        // isolation claim off the DECLARED capability (`isIsolated` = capabilities.isolation), NOT the
+        // structural remote check — an SSH host / ADB device is remote but `capabilities.isolation:false`,
+        // and the old `isRemoteExecutionEnv` gate OVER-CLAIMED an isolated sandbox to the model on exactly
+        // the un-isolated targets where design/53 zero-trust wants the tighter posture (§16.2: never claim
+        // isolation that isn't there). Behavior change: un-isolated remote envs without a policy gate no
+        // longer get the # Execution environment contract block (hooks-only tasks regain the standalone
+        // deny-don't-retry line instead, per the harnessContext gap-fill gate).
+        const featureFlags = {
+            policyEnabled: promptPolicyEnabled,
+            hooksEnabled: promptHooksEnabled,
+            isolationEnabled: isIsolated(executionEnv),
+            // design/98 §1.2 (S8a): inject ORCHESTRATION_GUIDANCE iff self-orchestration is really active (same gate
+            // as the run_workflow tool mount).
+            orchestrationEnabled: selfOrchestrationActive,
+            // design/96 §C (S2): inject GOAL_COMPLETION_GUIDANCE iff this run is a `runGoal` iteration — the trusted
+            // internal flag is set ONLY by runGoal (never a TaskSpec field), so the prompt's "declaring done stops
+            // iteration" promise is always backed by a real loop (§6.3).
+            goalEnabled: internals?.goalMode === true,
+            // design/96 §D (S4, P0): inject ORCHESTRATION_AWARENESS iff the task runs at an ULTRA reasoning tier. The
+            // honest reasoning-tier analogue of CC's ultracode nudge — driven by the CALLER-DECLARED, role-default-
+            // folded `thinking` (resolved above at L514: `spec.thinking ?? resolvedRole.thinking`), NOT a keyword scan
+            // of untrusted input (design/53). Independent of orchestrationEnabled (the run_workflow gate): a task can
+            // be ultra AND self-orchestrating → both blocks compose.
+            awarenessEnabled: thinking !== undefined && ULTRA_REASONING_TIERS.has(thinking),
+            // design/97 CORE-6 (P1b): inject WORKTREE_NOTICE iff this task ACTUALLY runs in an isolated git worktree.
+            // Driven by the TRUSTED internal channel (set by the workflow `{ isolation: "worktree" }` option), never a
+            // TaskSpec field. AND-gated on `ownedEnv` (a factory actually minted the isolated env): a worktree request
+            // with NO worktree-capable `executionEnvFactory` falls back to the static/stub env (no real worktree) — in
+            // that case claiming an isolated worktree would be a §6.3 over-claim, so fail closed (codex review).
+            worktreeIsolated: internals?.isolation === "worktree" && ownedEnv !== undefined,
+            // design/64 §25 (A): same derivation as the runtask turn-boundary handler — the prompt's
+            // context-management line must claim mid-task summarization ONLY when it will actually run (§6.3).
+            withinTaskCompactionEnabled: (spec.compaction?.enabled ?? true) && (spec.compaction?.withinTask ?? true),
+        };
+        // Explicit task prompt wins; else the requested role's preset (e.g. a dev role's CODE_AGENT_PROMPT);
+        // else a core caller's trusted default persona (合车复审修②: the delegation tool's lean
+        // SUBAGENT_PROMPT rides here so a roles.* preset is never shadowed by the built-in default);
+        // else the provider's own default (domain-neutral). Keeps the global default neutral while letting
+        // coding roles opt into a coding prompt.
+        const userSystemPrompt = spec.systemPrompt ?? resolvedRole.systemPrompt ?? internals?.defaultSystemPrompt;
+        // TaskSpec.appendSystemPrompt (caller-trusted): threaded into the stable prompt context, composed as the
+        // LAST stable block (keeps the base + harness/safety; before the volatile memory tail — prefix-cache safe).
+        const userAppendSystemPrompt = spec.appendSystemPrompt;
+        // MCP server instructions (design/64 §17.3): STABLE per-task → woven between the base and the volatile
+        // memory tail (composeSystemPrompt twice) so the cacheable prefix is preserved.
+        const mcpInstructionsBlock = mcp.serverInstructions.length
+            ? `# MCP Server Instructions\n${mcp.serverInstructions.map((s) => `## ${s.server}\n${s.text}`).join("\n\n")}`
+            : undefined;
+        // Environment context (design/64 §20): situational facts in the VARIABLE tail (date changes daily). cwd/
+        // git/platform/OS come from the ExecutionEnv (remote = the container's values) — best-effort, one probe.
+        // design/112 C1/C5: USER facts from the client-supplied clientContext (NOT execution-env probes). Localize
+        // "today" to the user's zone (TOB: the container runs UTC, the user is elsewhere); absent ⇒ UTC (annotated).
+        const userTz = spec.clientContext?.timeZone;
+        // Hardening (cross-feature review): validate the zone ONCE so the date basis and the `(zone)` annotation can
+        // NEVER disagree. An INVALID client zone must take the UTC path (date) AND stay unannotated → the env block
+        // shows `(UTC)`, never `(Asia/Faketown)` over a UTC date (§25 honesty: don't claim a localization that didn't
+        // happen). `formatLocalDate` alone silently falls back to UTC but `timeZone` being merely PRESENT would still
+        // mislabel it; gating on validity keeps both the initial render and the per-turn re-render (below) consistent.
+        const tzValid = userTz !== undefined && isValidTimeZone(userTz);
+        const envFacts = { date: formatLocalDate(new Date(), tzValid ? userTz : undefined), modelId: model.id };
+        if (tzValid)
+            envFacts.timeZone = userTz;
+        if (spec.clientContext?.userEmail)
+            envFacts.userEmail = spec.clientContext.userEmail;
+        // P1a (knowledge cutoff): deployment-declared per model — core hardcodes no model→date map (a stale cutoff
+        // would be a §25 honesty breach). Looked up by the resolved model id; omitted when the deployment didn't declare it.
+        const declaredCutoff = deps.modelKnowledgeCutoffs?.[model.id];
+        if (declaredCutoff)
+            envFacts.knowledgeCutoff = declaredCutoff;
+        // 黑板 [442] A1 — DEPLOYMENT-supplied sandbox facts (TaskSpec.envFacts): rendered by the same
+        // buildEnvironmentContext (sanitize + bound happen at render). Copied field-by-field (whitelist shape —
+        // unknown keys never ride into the block).
+        if (spec.envFacts?.profile)
+            envFacts.sandboxProfile = spec.envFacts.profile;
+        if (spec.envFacts?.capabilities && spec.envFacts.capabilities.length > 0)
+            envFacts.sandboxCapabilities = [...spec.envFacts.capabilities];
+        if (spec.envFacts?.pkgSource)
+            envFacts.sandboxPkgSource = spec.envFacts.pkgSource;
+        // codex 1.240 ④: validate at the JS boundary — an out-of-union egress from an untyped caller must not
+        // fall into the "full" render branch (claiming open egress that isn't).
+        if (spec.envFacts?.egress === "none" || spec.envFacts?.egress === "allowlist" || spec.envFacts?.egress === "full")
+            envFacts.sandboxEgress = spec.envFacts.egress;
+        // codex 1.257.3 review (MED): standard-Runner path for the Scratchpad section (CC parity) — without
+        // this copy `buildScratchpadSection` was reachable only via a manual buildEnvironmentContext call.
+        if (spec.envFacts?.scratchpadDir)
+            envFacts.scratchpadDir = spec.envFacts.scratchpadDir;
+        if (handsEnabled) {
+            envFacts.cwd = taskRootPath;
+            // design/119 (CC --add-dir parity): announce the extra allowed roots in # Environment.
+            if (additionalRootsCanonical.length > 0) {
+                envFacts.additionalDirectories = [...additionalRootsCanonical];
+            }
+            try {
+                // design/99 §E14: one batched probe (one round-trip). Each sub-command MUST emit EXACTLY ONE line so the
+                // position-based parse stays in sync: osName, osVer, isInsideWorkTree, branch, worktreeRoot, dirty|clean.
+                // Branch uses `symbolic-ref` (NOT `rev-parse --abbrev-ref HEAD`): on an UNBORN branch (`git init`, no commit)
+                // abbrev-ref prints "HEAD" to stdout AND exits non-zero, so `|| echo` emits a SECOND line and every later
+                // field shifts. `symbolic-ref --short -q` prints the branch (even unborn) on success / nothing on detached,
+                // so `|| echo "HEAD (detached)"` yields exactly one line and never mislabels an unborn branch as detached.
+                // P1a (shell): a 7th sub-command appended LAST (one line, always) — the basename of the shell ACTUALLY
+                // RUNNING this probe (the env's exec interpreter), so the agent picks shell-correct syntax. Uses
+                // `ps -p $$ -o comm=` (the current shell process), NOT `$SHELL` — `$SHELL` is the login shell, which can
+                // differ from the interpreter the env spawns (e.g. NodeExecutionEnv runs commands under bash even when
+                // `$SHELL` is zsh; codex review). Strips dir + leading `-` (login marker); empty (e.g. no `ps`) ⇒ omitted.
+                // Appended at the END so the existing 6-field position parse is unaffected; read independently below.
+                const probe = await executionEnv.exec('uname -s; uname -r; (git rev-parse --is-inside-work-tree 2>/dev/null || echo false); (git symbolic-ref --short -q HEAD 2>/dev/null || echo "HEAD (detached)"); (git rev-parse --show-toplevel 2>/dev/null || echo); (test -n "$(git status --porcelain 2>/dev/null | head -1)" && echo dirty || echo clean); (s=$(ps -p $$ -o comm= 2>/dev/null); s=${s##*/}; echo "${s#-}"); (test "$(git rev-parse --git-dir 2>/dev/null)" != "$(git rev-parse --git-common-dir 2>/dev/null)" && echo linked || echo main)', { cwd: envFacts.cwd, timeout: 10 });
+                if (probe.ok && probe.value.exitCode === 0) {
+                    const lines = probe.value.stdout.split("\n");
+                    // Self-checking: the 6 sub-commands each emit one line, plus a trailing newline → ≥ 6 elements. Fewer
+                    // means a sub-command was swallowed (de-sync) — omit the shell-derived facts rather than mis-parse.
+                    if (lines.length >= 6) {
+                        const [osName, osVer, git, branch, worktreeRoot, dirty] = lines;
+                        if (osName?.trim())
+                            envFacts.platform = osName.trim();
+                        if (osVer?.trim())
+                            envFacts.osVersion = osVer.trim();
+                        envFacts.isGitRepo = (git ?? "").trim() === "true";
+                        if (envFacts.isGitRepo) {
+                            // §E14: branch/worktree/dirty only when actually a repo (else the empty/`clean` lines are noise).
+                            const b = (branch ?? "").trim();
+                            if (b)
+                                envFacts.gitBranch = b; // probe already emits "HEAD (detached)" for a detached HEAD
+                            const root = (worktreeRoot ?? "").trim();
+                            if (root)
+                                envFacts.gitWorktreeRoot = root;
+                            const d = (dirty ?? "").trim();
+                            if (d === "dirty" || d === "clean")
+                                envFacts.gitDirty = d === "dirty";
+                        }
+                        // P1a: shell is the 7th line (independent of the >=6 git/OS guard — a swallowed shell line just omits it).
+                        const sh = (lines[6] ?? "").trim();
+                        if (sh)
+                            envFacts.shell = sh;
+                        // design/119 (CC 198 parity): 8th line — linked-worktree detection (git-dir ≠ git-common-dir).
+                        // CC's # Environment carries an isolated-copy directive for a linked worktree; feed the same
+                        // fact so buildEnvironmentContext can emit it even when the caller didn't set isolation:"worktree".
+                        if (envFacts.isGitRepo && (lines[7] ?? "").trim() === "linked")
+                            envFacts.isLinkedWorktree = true;
+                    }
+                }
+            }
+            catch {
+                /* best-effort: a stub/odd env just omits the shell-derived facts */
+            }
+            // H4 (CC 2.1.198 ENV git snapshot, 考据档 B1/B2) — one more batched round-trip through the SAME
+            // ExecutionEnv seam (TOB e2b = the container's repo), only when the §E14 probe confirmed a repo.
+            // Four sections split by a sentinel line: main-branch inference (CC qP: origin/HEAD symref →
+            // [inferred, main, master] each `show-ref --verify --quiet` → renderer falls back "main"),
+            // `git config user.name`, `git --no-optional-locks status --short`, and
+            // `git --no-optional-locks log --oneline -n 5` (CC-exact commands). 1.256 复审 MED-4: the two
+            // REQUIRED sections (status, log) are captured explicitly and fail the WHOLE script with a
+            // distinct exit code (41 = status, 42 = log) — previously the script's exit code was only the
+            // LAST command's, so a failing status with a succeeding log rendered an EMPTY status section as
+            // "(clean)" (a half-rendered snapshot lying about a dirty tree). Either required failure now
+            // skips the whole section + degraded telemetry (CC's Promise.all catch → null is the same
+            // all-or-nothing shape; an unborn repo still skips via exit 42). The main-branch/user sections
+            // stay best-effort degradable. Failure/timeout = silent skip + onError telemetry with reason.
+            if (envFacts.isGitRepo === true) {
+                const SEP = "@@SEMA_ENV_GIT_SPLIT@@";
+                try {
+                    const snap = await executionEnv.exec(`(m=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null); m=\${m#origin/}; for s in "$m" main master; do if [ -n "$s" ] && git show-ref --verify --quiet "refs/remotes/origin/$s"; then echo "$s"; break; fi; done) || true; echo "${SEP}"; (git config user.name 2>/dev/null || true); echo "${SEP}"; gs=$(git --no-optional-locks status --short) || exit 41; printf '%s\\n' "$gs"; echo "${SEP}"; gl=$(git --no-optional-locks log --oneline -n 5) || exit 42; printf '%s\\n' "$gl"`, { cwd: envFacts.cwd, timeout: 10 });
+                    if (snap.ok && snap.value.exitCode === 0) {
+                        const parts = snap.value.stdout.split(`${SEP}\n`);
+                        if (parts.length === 4) {
+                            envFacts.gitSnapshot = buildGitSnapshot({
+                                // Reuse the §E14 probe's branch ("HEAD (detached)" on detached — richer than CC's bare
+                                // "HEAD"; recorded deviation, keeps this block consistent with the `Git branch:` line).
+                                branch: envFacts.gitBranch ?? "HEAD",
+                                mainBranch: parts[0].trim() || "main",
+                                ...(parts[1].trim() ? { userName: parts[1].trim() } : {}),
+                                status: parts[2],
+                                log: parts[3],
+                            });
+                        }
+                    }
+                    else {
+                        // Silent-fallback telemetry (C1-C11 discipline: a degrade always carries its reason).
+                        // MED-4: the explicit required-section exit codes get a named reason so the degrade is diagnosable.
+                        const reason = snap.ok
+                            ? snap.value.exitCode === 41
+                                ? "git status failed (exit 41)"
+                                : snap.value.exitCode === 42
+                                    ? "git log failed (exit 42)"
+                                    : `git exited ${snap.value.exitCode}`
+                            : `exec failed: ${snap.error.message}`;
+                        deps.onError?.(new Error(`env git snapshot skipped — ${reason}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
+                    }
+                }
+                catch (err) {
+                    deps.onError?.(new Error(`env git snapshot skipped — ${err instanceof Error ? err.message : String(err)}`), { phase: "degraded", sessionId, classification: "env-git-snapshot" });
+                }
+            }
+        }
+        // Definite assignment: every branch below assigns via finishStable() or the legacy path (TS can't
+        // see through the closure).
+        let systemPrompt;
+        // design/66 date_change: a multi-day task must see the CURRENT date. Everything except the date is
+        // frozen at prepare time (stable base, MCP block, probed env facts, memory block), so re-rendering
+        // with a new date changes ONLY the `Today's date:` line — the rest stays byte-identical (prefix-cache
+        // loses just the variable tail, by §20 design). Set on the stableSystem/default paths; the legacy
+        // free-form `provider.system` owns its own ordering and stays a static string.
+        let renderWithDate;
+        // Prompt-constitution assembly (sema 提示词主权批): the constitution layer (harness context + safety
+        // blocks + mode blocks + memory guidance) is composed HERE, OUTSIDE the provider — same tier as the
+        // skills/MCP/env/memory tails — so a custom role provider physically cannot drop it (the class of bug
+        // where a deployment's `stablePrompt(base)` replacement silently ran business scenarios with no
+        // truth/safety blocks). `replaceAll: true` is the explicit personalization escape hatch. Every path
+        // records a labelled block manifest → the `prompt.assembled` trace event (black-box killer: "which
+        // blocks were in the prompt" becomes a runtime fact, not archaeology).
+        // design/138 S4: memoryEnabled/consolidationEnabled are the LEGACY-path prompt flags (MEMORY_SAFETY/
+        // MEMORY_HYGIENE constitution blocks) — permanently false now; the engine path injects the CC-verbatim
+        // `# Memory` instruction via injection.block instead (same as pre-S4, which also passed false here).
+        const promptCtx = { userSystemPrompt, userAppendSystemPrompt, tools, memoryEnabled: false, consolidationEnabled: false, ...featureFlags };
+        let promptConstitution = "core";
+        let promptBlocks = [];
+        const finishStable = (stableCore) => {
+            const stable = composeSystemPrompt(composeSystemPrompt(stableCore, skillsBlock), mcpInstructionsBlock);
+            if (skillsBlock?.trim())
+                promptBlocks.push({ id: "skills.block", text: skillsBlock });
+            if (mcpInstructionsBlock?.trim())
+                promptBlocks.push({ id: "mcp.instructions", text: mcpInstructionsBlock });
+            renderWithDate = (date) => composeSystemPrompt(composeSystemPrompt(stable, buildEnvironmentContext({ ...envFacts, date }) || undefined), memoryBlock);
+            systemPrompt = renderWithDate(envFacts.date);
+            const envBlock = buildEnvironmentContext({ ...envFacts, date: envFacts.date });
+            if (envBlock?.trim())
+                promptBlocks.push({ id: "env.context", text: envBlock });
+            if (memoryBlock?.trim())
+                promptBlocks.push({ id: "memory.tail", text: memoryBlock });
+        };
+        if (provider === defaultPromptProvider) {
+            // No custom provider (the ?? fallback): default role base + constitution. Checked FIRST —
+            // defaultPromptProvider implements stableSystem whose output contains the constitution anchor,
+            // so falling into the generic branch below would misroute every plain task through the
+            // migration guard (caught by the prompt-constitution test suite on first run).
+            const c = composeConstitution(userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT, promptCtx);
+            promptBlocks = [...c.blocks];
+            finishStable(c.text);
+        }
+        else if (provider.stableSystem) {
+            const roleOut = provider.stableSystem(promptCtx);
+            if (provider.replaceAll) {
+                // Explicit full replacement: the provider owns the whole stable base (constitution deliberately
+                // omitted — the manifest marks it so the omission is observable, never accidental).
+                promptConstitution = "replaced";
+                promptBlocks = [{ id: "provider.replace_all", text: roleOut }];
+                finishStable(roleOut);
+            }
+            else if (roleOut.includes(CYBER_RISK) && roleOut.includes(URL_SAFETY) && roleOut.includes("# Harness")) {
+                // Migration guard: a historic provider that returns an ALREADY-assembled prompt (e.g. it wraps
+                // `defaultPromptProvider.stableSystem`) — appending the constitution again would double every
+                // safety block. Pass through un-doubled, but surface the upgrade path loudly.
+                // Detection = ALL THREE anchors (codex [B]): a role base merely QUOTING one safety line no longer
+                // trips it (that path gets the constitution appended; a duplicated quote is harmless). Adversarial
+                // bound: a provider is CODE (function-valued, in-process only — a wire-level TaskSpec cannot carry
+                // one), so whoever can spoof this already runs deployment code; and the manifest records the mode,
+                // so a pass-through is observable, never silent.
+                promptConstitution = "provider-assembled";
+                promptBlocks = [{ id: "provider.assembled", text: roleOut }];
+                deps.onError?.(new Error("prompt-constitution: this PromptProvider returns an already-assembled prompt (constitution anchor found). Core now appends the constitution structurally — return ONLY the role base from stableSystem (or set replaceAll:true to own the whole base). Passed through un-doubled."), { phase: "prompt-constitution", sessionId });
+                finishStable(roleOut);
+            }
+            else {
+                // Role-layer semantics (the new contract): provider supplies the role base; core appends the
+                // constitution structurally. The easy path is now the correct path.
+                const c = composeConstitution(roleOut, promptCtx);
+                promptBlocks = [...c.blocks];
+                finishStable(c.text);
+            }
+        }
+        else if (provider.system) {
+            // Legacy free-form path: the provider owns ordering. Lint it — memory present but NOT at the tail
+            // means the cacheable prefix shifts every turn (vLLM/Anthropic prefix cache misses). Surface loudly.
+            systemPrompt = provider.system({ ...promptCtx, memoryBlock });
+            promptConstitution = "legacy";
+            promptBlocks = [{ id: "provider.legacy", text: systemPrompt }];
+            const memTrim = memoryBlock?.trim();
+            if (memTrim && systemPrompt.includes(memTrim) && !systemPrompt.trimEnd().endsWith(memTrim)) {
+                deps.onError?.(new Error("prompt-cache: the <user_memory> block is not at the END of the system prompt — the cacheable prefix changes every turn, so vLLM/Anthropic prefix caching will miss. Put memoryBlock LAST (STABLE→VARIABLE), or implement PromptProvider.stableSystem and let core place memory."), { phase: "prompt-cache", sessionId });
+            }
+        }
+        else {
+            // No provider: default role base (task systemPrompt or the neutral default) + constitution.
+            const c = composeConstitution(userSystemPrompt ?? DEFAULT_SYSTEM_PROMPT, promptCtx);
+            promptBlocks = [...c.blocks];
+            finishStable(c.text);
+        }
+        // design/119 S3: model-declared prompt guidance (CC 198 per-model mitigations, declaratively).
+        // Appended at the very end of the assembled prompt via the same renderWithDate wrapper the
+        // date_change re-render uses, so a mid-task date rollover keeps the guidance.
+        if (model.promptGuidance && model.promptGuidance.length > 0) {
+            const guidance = model.promptGuidance.join("\n\n");
+            const baseRender = renderWithDate;
+            if (baseRender) {
+                renderWithDate = (date) => composeSystemPrompt(baseRender(date), guidance);
+                systemPrompt = renderWithDate(envFacts.date);
+            }
+            else {
+                // Legacy PromptProvider.system path has no date re-render — append once (workflow review:
+                // the previous non-null assertion crashed this branch at runtime).
+                systemPrompt = composeSystemPrompt(systemPrompt, guidance) ?? systemPrompt;
+            }
+            promptBlocks.push({ id: "model.guidance", text: guidance });
+        }
+        // 提示词主权批: the labelled composition manifest (id + size + short content hash per block) —
+        // emitted by the run loop as `prompt.assembled` right after `task.start`. Hashes let a deployment
+        // spot "same block id, different content" drift without shipping prompt text into traces. SALTED
+        // with a per-process random value (codex [E]): an unsalted sha256 of a short, guessable block
+        // (env facts, a one-line memory note) is a dictionary-preimage surface for whoever can read traces
+        // but not prompts. Same-process comparability (drift detection) survives; cross-process hash
+        // equality is deliberately not a feature.
+        const promptManifest = {
+            constitution: promptConstitution,
+            blocks: promptBlocks.map((b) => ({ id: b.id, chars: b.text.length, hash: createHash("sha256").update(PROMPT_HASH_SALT).update(b.text).digest("hex").slice(0, 12) })),
+        };
+        // Deferred-tool disclosure (design/36): when any caller/MCP tool is deferred, it ships as a name-only
+        // placeholder and an injected `tool_search` materializes full schemas on demand. Materialization runs
+        // as a side-effect of `tool_search.execute`, which completes BEFORE the harness snapshots tools for the
+        // next turn — so the run loop is untouched and the new schemas land in the next request.
+        const userToolNames = (spec.tools ?? []).map((t) => t.name);
+        const mcpToolNames = mcp.tools.map((t) => t.name);
+        const deferred = classifyDeferred({
+            specs: spec.tools ?? [],
+            mcpToolNames,
+            fullTools: tools.filter((t) => userToolNames.includes(t.name) || mcpToolNames.includes(t.name)),
+            deferMode: deps.deferMode,
+            model,
+        });
+        const activeTools = new Set();
+        // `harnessRef` declared above (tool ctx.model + harness↔tool_search cycle). `fpRef` lets `rematerialize`
+        // reach the fingerprint object built after the harness; both are populated before any tool_search runs.
+        const fpRef = {}; // fp = cache fingerprint
+        let harnessTools = tools;
+        // G1 [482]: created inside the deferred branch below (a task without deferred tools has no delta source).
+        let toolsDeltaRef;
+        if (deferred.size > 0) {
+            // Our injected tool_search must not collide with a caller/MCP tool (the harness Map is last-write-wins).
+            if (deferred.has(TOOL_SEARCH_NAME) || tools.some((t) => t.name === TOOL_SEARCH_NAME)) {
+                const e = new Error(`Tool name "${TOOL_SEARCH_NAME}" is reserved when deferred tools are present.`);
+                e.code = "config.reserved_tool_name";
+                throw e;
+            }
+            const registry = buildDeferredRegistry(deferred, tools);
+            const placeholders = new Map([...registry.values()].map((i) => [i.name, makePlaceholderTool(i)]));
+            // Seed the active set from the log so a RESUMED session keeps its previously-activated tools (else
+            // they'd silently revert to placeholders). `buildContext` returns [] for a fresh session.
+            const { messages } = await session.buildContext();
+            for (const n of extractDiscoveredToolNames(messages, registry)) {
+                if (deferred.has(n))
+                    activeTools.add(n);
+            }
+            if (resume) {
+                // design/45 §4.bis: re-seed the activated set from the checkpoint (authoritative), on top of what
+                // the rewound transcript implies, so a resumed task never reverts an activated tool to a placeholder.
+                for (const n of resume.seed.activeTools)
+                    if (deferred.has(n))
+                        activeTools.add(n);
+            }
+            let toolSearch;
+            const buildToolList = (active) => {
+                const list = tools.map((t) => (deferred.has(t.name) && !active.has(t.name) ? placeholders.get(t.name) : t));
+                list.push(toolSearch);
+                return list;
+            };
+            // G1 通告层 [482] (CC deferred_tools_delta parity): track which activations the model has been
+            // TOLD about at a boundary. Seeded with the prepare-time actives (transcript-derived + resume
+            // checkpoint reseed above) — those were active before this leg's first turn, so a resume never
+            // replays old announcements (TD3). The diff below is append-only and dedup'd by this set.
+            const announcedTools = new Set(activeTools);
+            toolsDeltaRef = { pending: [] };
+            const deltaRef = toolsDeltaRef;
+            const rematerialize = async (active) => {
+                const list = buildToolList(active);
+                await harnessRef.current.setTools(list);
+                if (fpRef.current)
+                    fpRef.current.tools = toolsToFingerprintInputs(list);
+                // Diff AFTER the setTools landed (announce only what is truly live on the harness).
+                for (const n of active) {
+                    if (!announcedTools.has(n)) {
+                        announcedTools.add(n);
+                        deltaRef.pending.push(n);
+                    }
+                }
+            };
+            toolSearch = makeToolSearchTool({ registry, active: activeTools, rematerialize });
+            harnessTools = buildToolList(activeTools);
+        }
+        // G1 通告层续批 (CC agent_listing_delta) — the announce face: read the roster off the mounted
+        // delegation tool (ToolSpec.agentListing, filled by createSubagentTool; deployment tools normally
+        // leave it unset). Static per-leg; on a durable resume leg the run loop seeds the producer as
+        // already-announced ONLY after confirming a listing reminder in the transcript (MED-3② — TD3
+        // discipline, made delivery-confirmed instead of leg-assumed).
+        const agentListingSpec = (spec.tools ?? []).find((t) => t.agentListing !== undefined && t.agentListing.length > 0);
+        const agentListing = agentListingSpec
+            ? { entries: agentListingSpec.agentListing, toolName: agentListingSpec.name, seedAnnounced: resume !== undefined }
+            : undefined;
+        // design/66 date_change: the vendored harness re-evaluates a systemPrompt FUNCTION at every turn
+        // boundary (createTurnState), so a multi-day task picks up a date flip on the next request. Memoized:
+        // same date ⇒ the SAME string instance is returned (byte-stability is trivially guaranteed). On a
+        // flip, the design/31 fingerprint is refreshed in lockstep so the resulting one-off cache miss is
+        // truthfully attributed to "system-prefix" instead of surfacing as a mystery break (frozen
+        // fingerprint = false-negative direction). Legacy `provider.system` path keeps the static string.
+        let promptDate = envFacts.date;
+        let renderedPrompt = systemPrompt;
+        const liveSystemPrompt = renderWithDate
+            ? () => {
+                // C1: re-derive in the user's zone so the date flips at the USER's midnight, not the container's UTC midnight.
+                // Use the VALIDATED zone (tzValid) — an invalid zone re-renders as UTC, consistent with the `(UTC)` annotation.
+                const today = formatLocalDate(new Date(), tzValid ? userTz : undefined);
+                if (today !== promptDate) {
+                    promptDate = today;
+                    // Non-null: this closure only exists on the renderWithDate branch of the ternary below;
+                    // assignment now happens inside finishStable, which TS's flow analysis can't see through.
+                    renderedPrompt = renderWithDate(today);
+                    if (fpRef.current)
+                        fpRef.current.systemPrompt = renderedPrompt;
+                }
+                return renderedPrompt;
+            }
+            : undefined;
+        const harness = new AgentHarness({
+            // design/119 #2: per-request output cap (spec.limits.maxOutputTokens → provider max_tokens).
+            // Guard: a non-positive cap would ride to the wire as max_tokens=0 → provider 400; ignore it
+            // loudly instead (design/120 review).
+            ...(spec.limits?.maxOutputTokens !== undefined && spec.limits.maxOutputTokens > 0
+                ? { maxOutputTokens: spec.limits.maxOutputTokens }
+                : {}),
+            ...(callCapRef !== undefined && callCapOn
+                ? {
+                    maxOutputTokensPerCall: () => {
+                        // service [405] P0: a model OBSERVED emitting self-directed reasoning is never shrunk
+                        // again — reasoning tokens bill against max_tokens with no visible output, so the
+                        // wall-clock cap math decapitates the thought mid-stream. Observation (a thinking
+                        // block, or a shrunk call ending `length` with zero output — both set in runtask) is
+                        // the ONLY stand-down source: a `Model.reasoning` metadata gate would ALSO switch off
+                        // Anthropic budget-thinking's live [1024,2047] computeCallCap contract (镜头A MED #5)
+                        // and a wrong `false` was exactly the TB hole (镜头B Q4). Worst case = ONE capped
+                        // first call, which the dynamicCut length-recovery turns into a continue, not a death.
+                        if (callCapRef.reasoningObserved === true)
+                            return undefined;
+                        const cap = computeCallCap(callCapRef, Date.now(), (thinking ?? "off") !== "off");
+                        if (cap !== undefined)
+                            callCapRef.shrinks = (callCapRef.shrinks ?? 0) + 1; // B2: mechanisms.capShrinks
+                        return cap;
+                    },
+                }
+                : {}),
+            // design/130 P2b: soft per-call wall-clock deadline — the brain cuts a stream that crosses it
+            // (salvaging the prefix) instead of riding into the hard abort. Inert until runtask arms
+            // deadlineMs + cushionMs on the ref (gracefulFinalize gates the cushion).
+            ...(callCapRef !== undefined
+                ? { callDeadlineMsPerCall: () => softExecDeadlineMs(callCapRef) }
+                : {}),
+            // design/131: per-task resilience intent → every provider call (decorators stand aside).
+            ...(spec.resilience !== undefined ? { resilience: spec.resilience } : {}),
+            // service [398] C2: bridge the loop's self-heal recoveries to the trace stream (`loop.recovery`).
+            // Only RECOVERY continues are bridged — the three normal drive reasons (next_turn / steer /
+            // follow_up) are the loop's ordinary heartbeat, not fallback events.
+            loopTrace: (step) => {
+                if (step.kind !== "continue")
+                    return;
+                if (step.reason === "next_turn" || step.reason === "steer_injected" || step.reason === "follow_up_injected")
+                    return;
+                emitTrace(deps.tracer, () => ({
+                    kind: "loop.recovery",
+                    version: 1,
+                    taskId: spec.taskId ?? sessionId,
+                    reason: step.reason,
+                    ts: Date.now(),
+                }));
+            },
+            // design/120 P2: in-stream tool execution opt-in. The harness's own run-start snapshot
+            // (no `tool_call` handler registered) is the real gate keeper — on a run where the policy/
+            // approval gate below registers its handler, the flag never reaches the loop.
+            ...(spec.streamingToolExecution === true ? { streamingToolExecution: true } : {}),
+            // Blackboard 2026-07-03 (clay transcript 40e3f65f): the followUp queue's only producer in a
+            // runtask deployment is the task-notification lane ("later" priority — workflow/agent
+            // completions). The default one-at-a-time drain turned 8 buffered completions into 8 chained
+            // turns, each interrupting the final answer. Drain them ALL into one boundary turn instead —
+            // one turn digests every pending notification. (User steering keeps its own queue/mode.)
+            followUpMode: "all",
+            env: executionEnv,
+            session,
+            tools: harnessTools,
+            model,
+            thinkingLevel: thinking ?? "off",
+            systemPrompt: liveSystemPrompt ?? systemPrompt,
+            getApiKeyAndHeaders: spec.getApiKeyAndHeaders,
+            runtime: brainToRuntime(deps.brain),
+            // No `resources`: harness resources (skills/promptTemplates) were a write-only sink here — the
+            // vendored readers were deleted in design/71 P0/P1. Skills are first-party now (see above).
+        });
+        // Now that the harness exists, let `tool_search`'s `rematerialize` reach it (design/36).
+        harnessRef.current = harness;
+        // `abortController` is created early (above, before any env op) for the resume VM-restore. It releases a
+        // pending human-approval gate on abort so the worker isn't hung past its deadline (F4). Here — now that
+        // the harness exists — wire the LIVE external-cancellation listener.
+        // External cancellation: a caller (or a parent task's tool, via ToolExecuteContext.signal) can pass
+        // `spec.signal` to abort this run. Mirror the timeout path: release the policy gate first
+        // (abortController) then stop the loop (harness.abort) — the controller alone does not terminate it.
+        let releaseSignal = () => undefined;
+        if (spec.signal) {
+            if (spec.signal.aborted) {
+                // Already aborted before we started: mark the controller; run() short-circuits before prompt.
+                abortController.abort();
+            }
+            else {
+                const sig = spec.signal;
+                const onExternalAbort = () => {
+                    abortController.abort();
+                    void harness.abort();
+                };
+                sig.addEventListener("abort", onExternalAbort, { once: true });
+                // Must be removed on task end: a never-fired {once} listener otherwise lingers on a caller's
+                // long-lived/shared signal and pins this run's controller + harness (leak across many tasks).
+                releaseSignal = () => sig.removeEventListener("abort", onExternalAbort);
+            }
+        }
+        // Two-phase tool gate (design/37): a SINGLE `tool_call` handler runs PreToolUse hooks (collect arg
+        // rewrites + context) then the tool policy (adjudicate on the final args). Funneling both phases
+        // through one handler — instead of two `tool_call` handlers raced by the harness's last-write-wins
+        // `emitHook` — makes the load-bearing invariant ("a hook's allow cannot bypass a policy deny/ask")
+        // structural: the policy always runs last, in this call stack. A task's own policy/hooks/onAsk
+        // override the Runner defaults.
+        const policy = spec.toolPolicy ?? deps.toolPolicy;
+        // design/99 §E6: per-session permission rules (deny-narrowing), composed BEFORE the caller policy like the
+        // skill scope below. Read ONLY when a `sessionPolicyStore` is wired AND this task carries its own
+        // `sessionId` — a delegated subagent has no `spec.sessionId`, so it inherits no session rules (symmetric
+        // with the rules being keyed on the owner's session). v1 reads the LATEST rules at prepare time (an operator
+        // change takes effect on resume), unlike the leg-frozen durable budget. Unset store / no sessionId / no
+        // rules ⇒ undefined ⇒ zero behavior change (fully backward-compatible, opt-in).
+        let sessionRulePolicy;
+        if (deps.sessionPolicyStore && spec.sessionId) {
+            const rules = await deps.sessionPolicyStore.getRules(spec.sessionId, spec.principal);
+            if (rules) {
+                sessionRulePolicy = createSessionRulePolicy(rules, { env: executionEnv, rootPath: taskRootPath, toolEffects });
+            }
+        }
+        // design/77 §3 Gate-3: the manifest deny-narrowing policy. Active when ≥1 skill carries a manifest OR this
+        // task INHERITED a parent manifest frame across the subagent boundary (design/77 §7 propagation).
+        const skillScopePolicy = hasSkillManifest
+            ? createActiveSkillScopePolicy({
+                scope: skillScope,
+                env: executionEnv,
+                rootPath: taskRootPath,
+                // MAJOR-2 fail-closed: the same effects map (spec.tools + hand band + folded MCP) so the scope can
+                // DENY an allowlisted mutating tool that `allowPaths` cannot path-confine (e.g. bash).
+                toolEffects,
+            })
+            : undefined;
+        // The DENY-NARROWING layers (session rules, then skill scope — deny/allow-only, no ask, no rewrite). Each
+        // layer's `deny` short-circuits the `deny > ask > allow` fold (tool-policy.ts:196): they can only SUBTRACT
+        // capability, and a caller `allow` can never widen them back. Core OWNS this composition (the caller's
+        // `spec.toolPolicy` cannot remove a narrowing layer). Re-checked on RESUME before an approved pending tool
+        // (runtask.ts) so a rule TIGHTENED during suspend still applies.
+        const narrowingLayers = [sessionRulePolicy, skillScopePolicy].filter((p) => p !== undefined);
+        const denyNarrowingPolicy = narrowingLayers.length === 0 ? undefined : narrowingLayers.length === 1 ? narrowingLayers[0] : combinePolicies(...narrowingLayers);
+        // SECURITY (bug-hunt MAJOR): the caller `policy` may return `allow{updatedInput}` — a REWRITE the LEADING
+        // narrowing already passed (it checked the ORIGINAL args). combinePolicies cascades the rewrite forward, so
+        // RE-APPEND the narrowing layers AFTER the caller to re-check the REWRITTEN args → a rewrite that escapes
+        // allowDirs/skill-scope is DENIED (the live-path twin of the resume-path re-check). The narrowing layers are
+        // deny/allow-only + idempotent, so the trailing re-check never perturbs ask-precedence or rewrites.
+        const policyLayers = policy !== undefined ? [...narrowingLayers, policy, ...narrowingLayers] : narrowingLayers;
+        // feat(parity-206) — CC 2.1.205/206 auto-mode safety rules, ALWAYS-ON and core-owned (a caller's
+        // `spec.toolPolicy` cannot remove them, same doctrine as the narrowing layers): ① session-transcript
+        // tamper deny (keyed on SEMA's real transcript dir, `($AGENT_DATA_DIR ?? ~/.ai-agent)/sessions`) and
+        // ② unverifiable recursive-delete deny (`rm -rf $VAR` with no in-window assignment — «Fail closed»).
+        // Both are DENY-only (deny short-circuits the deny>ask>allow fold → not auto-allowable by any permission
+        // rule or `onAsk:"allow"`, the CC rule's exact clause) and fire only on two ultra-narrow signatures, so
+        // the design/77 §4 stance (no blanket bash auto-tighten; unattended operation stays cheap) is preserved.
+        // LEADING so they adjudicate original args; RE-APPENDED after a caller policy for the same rewrite-escape
+        // reason as the narrowing layers above.
+        const integrityGuardLayers = [createTranscriptIntegrityPolicy(), createUnverifiableDeletePolicy()];
+        const guardedPolicyLayers = policy !== undefined ? [...integrityGuardLayers, ...policyLayers, ...integrityGuardLayers] : [...integrityGuardLayers, ...policyLayers];
+        const effectivePolicy = guardedPolicyLayers.length === 1 ? guardedPolicyLayers[0] : combinePolicies(...guardedPolicyLayers);
+        const hooks = spec.hooks ?? deps.hooks;
+        const onAsk = spec.onAsk ?? deps.onAsk;
+        // ── MAJOR-1 (design/77 §4 / design/70): write-capable hand band + destructive MCP visibility. ─────────────
+        // DESIGN STANCE (chief designer's call): bash's irreversible-action protection is the DEPLOYMENT SANDBOX —
+        // the egress/microVM boundary (design/53 §2.H, design/76 §4.2) — NOT a built-in per-bash suspend. The
+        // per-tool irreversibility axis reliably covers TYPED tools (spec.tools AND the now-folded MCP tools).
+        // Making every bash 'always' would force every shell command to suspend and break unattended operation, so
+        // we DO NOT auto-tighten bash here. A finance/high-stakes profile may opt the hand band into 'always' via
+        // its tool policy (an `ask`/deny on bash) — that knob is PROFILE-side, not built here.
+        //
+        // (b) The effect:write/idempotent hand-band tools (bash/edit_file/write_file, from toolEffects when a hand
+        // env is injected) are CONSIDERED in the gate-registration predicate below: when the deployment HAS an
+        // effect-aware policy/hook, the gate registers and the policy can adjudicate bash. (No-op when a policy/hook
+        // already forces registration — but explicit, so the link is documented and survives a refactor.)
+        const handWriteTools = handsEnabled
+            ? Object.keys(HAND_TOOL_EFFECTS).filter((name) => {
+                const eff = HAND_TOOL_EFFECTS[name];
+                return eff === "write" || eff === "idempotent";
+            })
+            : [];
+        // feat(parity-206): keyed on the CALLER-facing layers (`policyLayers`), NOT `effectivePolicy` — the
+        // always-on integrity guard makes `effectivePolicy` unconditionally defined, and counting it here would
+        // permanently silence the loud UNGATED warning below (the guard fires on two narrow tamper/delete
+        // signatures only; it is not an effect-aware adjudicator for the write band).
+        const hasEffectAwareGate = Boolean(policyLayers.length > 0 || hooks?.preToolUse);
+        // (c) 🔴 LOUD fail-safe: a write-capable hand band OR a destructive MCP tool is present, but NO effect-aware
+        // gate covers it (no policy, no PreToolUse hook) AND it is not otherwise marked egress/irreversible → its
+        // irreversible actions are UNADJUDICATED. Emit a one-time loud warning so the misconfiguration is OBSERVABLE
+        // instead of a silent auto-allow. (The MCP fold above already marks `destructiveHint` tools irreversible, so
+        // a destructive MCP tool only reaches here when its server advertised NO destructiveHint annotation.)
+        const destructiveMcpUngated = mcp.tools.some((t) => !irreversibleTools.has(t.name) && !egressTools.has(t.name) && (toolEffects.get(t.name) ?? "write") !== "read");
+        // design/53 GAP3 (defense-in-depth): a FIRST-PARTY effect:"write" tool that FORGOT to declare egress:true /
+        // irreversibility (e.g. a future external-write tool like open_gitea_issue) is also unadjudicated under no
+        // policy/hook. Scan spec.tools the same way (egress/irreversible-marked tools are already covered by the
+        // egressTools.size / irreversibleTools.size gate-registration above, so exclude them here) so the omission
+        // is at least OBSERVABLE, not silent. Effect comes from toolEffects (filled on the spec.tools pass).
+        const firstPartyWriteUngated = (spec.tools ?? [])
+            .map((t) => t.name)
+            .filter((name) => !irreversibleTools.has(name) && !egressTools.has(name) && toolEffects.get(name) === "write");
+        if (!hasEffectAwareGate && (handWriteTools.length > 0 || destructiveMcpUngated || firstPartyWriteUngated.length > 0)) {
+            // Compose the "what" label ADDITIVELY: when MULTIPLE surfaces are ungated the warning must name each, not
+            // just the hand band (a destructive MCP / first-party write tool would otherwise be silently elided).
+            const what = [
+                handWriteTools.length > 0 ? `hand tools [${handWriteTools.join(", ")}]` : undefined,
+                destructiveMcpUngated ? "MCP write tools" : undefined,
+                firstPartyWriteUngated.length > 0 ? `write tools [${firstPartyWriteUngated.join(", ")}]` : undefined,
+            ]
+                .filter(Boolean)
+                .join(" + ");
+            // 飞轮 [520]③ (hookAgent noise): a deployment whose hook-runner spins a child run per hook firing
+            // re-triggered this on EVERY firing — same deps, same shape, an error-level line each time. The warning
+            // is deployment-configuration observability, so it dedupes per (deps, shape): the FIRST task with a
+            // given ungated shape still fires loud (nothing goes silent — C-telemetry discipline), repeats of the
+            // exact same shape on the same deployment are spam and are dropped. A DIFFERENT shape (new tool set)
+            // fires again. Proper fix for the hook-runner remains spec-side (inherit a baseline policy).
+            if (!ungatedWarnedShapes.get(deps)?.has(what)) {
+                let shapes = ungatedWarnedShapes.get(deps);
+                if (!shapes) {
+                    shapes = new Set();
+                    ungatedWarnedShapes.set(deps, shapes);
+                }
+                shapes.add(what);
+                deps.onError?.(new Error(`write-capable ${what} are present but UNGATED — wire an effect-aware tool policy (or a PreToolUse hook). ` +
+                    `bash/MCP irreversible actions are otherwise unadjudicated; the deployment sandbox/egress boundary is the only protection (design/77 §4, design/53 §2.H). ` +
+                    `(This warning fires once per deployment per tool-set shape.)`), { phase: "config", sessionId });
+            }
+        }
+        // PreToolUse `additionalContext`, stashed per tool-call id in phase 1 and drained onto the result in
+        // the PostToolUse handler below (the `tool_call` return shape has no context channel of its own).
+        const preToolContexts = new Map();
+        // design/134 R3: tool-call ids the gate BLOCKED (policy/hook deny, plan-mode deny) or SUSPENDED.
+        // Their error results are not tool EXECUTION failures — CC scopes them to the PermissionDenied
+        // event domain — so the tool_result handler below fires NEITHER postToolUse NOR postToolUseFailure
+        // for them, and the runner's postToolBatch collector excludes them from the turn batch. Entries
+        // are one-shot (deleted on consumption), same discipline as preToolContexts.
+        const blockedToolCalls = new Set();
+        // design/134 复审 (codex HIGH): populate ONLY when a consumer exists. A blocked call's "immediate"
+        // result skips the loop's finalize, so the tool_result handler never drains its entry — the real
+        // consumers are (a) that handler's defensive delete (any per-tool post/pre hook wired) and (b) the
+        // runner's batch-collector delete (postToolBatch wired). With neither, adds would only accumulate.
+        const blockedTracked = Boolean(hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure || hooks?.postToolBatch);
+        // design/70: egress tools force the gate even with no policy/hooks wired — otherwise an
+        // unconfigured deployment would auto-allow an external write (the exact thing the marker forbids).
+        // design/74 Slice 3c: ALSO enter this block when resource-suspend is eligible — the suspend helpers
+        // (serializeCheckpointState / commitSuspendSaga / suspendForResource) live here and must be assigned even
+        // for a task with no policy/hooks/egress (resourceSuspend is independent of durableApproval). The gate
+        // *handler* itself stays guarded below, so a pure resource-suspend task keeps the default tool path.
+        const resourceSuspendEligible = spec.resourceSuspend !== undefined &&
+            (spec.checkpointStore ?? deps.checkpointStore) !== undefined &&
+            !(offloadStore !== undefined && isVolatileOffloadStore(offloadStore)) &&
+            // Structural remote check is CORRECT here (≠ the [500]② suspendVM-target capability split below): ANY
+            // remote per-task env is eligible — a suspendable one snapshots via suspendVM, a non-suspendable one
+            // (SSH/ADB host) takes the durable-park-only degrade (workspace persists on the target). Only a
+            // NON-remote per-task env is ineligible (destroyed on suspend → corrupt resume).
+            (ownedEnv === undefined || isRemoteExecutionEnv(ownedEnv));
+        if (spec.resourceSuspend !== undefined && !resourceSuspendEligible) {
+            // design/74 (council #5): opted into resource-slice suspend but NOT eligible — say WHY, else a resource
+            // limit silently hard-fails (failed/limit.max_turns) where the operator expects a resumable `suspended`.
+            const why = (spec.checkpointStore ?? deps.checkpointStore) === undefined
+                ? "no CheckpointStore is wired"
+                : offloadStore !== undefined && isVolatileOffloadStore(offloadStore)
+                    ? "tool-result offload uses the in-memory store (a resume needs durable results)"
+                    : "the per-task execution env is not a RemoteExecutionEnv (it would be destroyed on suspend)";
+            deps.onError?.(new Error(`resourceSuspend is set but INACTIVE: ${why}; resource limits will hard-fail, not suspend`), {
+                phase: "config",
+                sessionId,
+            });
+        }
+        // `effectivePolicy` folds the Gate-3 manifest scope (design/77 §3) over the caller policy; `irreversibleTools`
+        // gates registration too (design/77 §4) so an irreversible tool in a no-policy deployment still registers.
+        // MAJOR-1 (b): the write-capable hand band (`handWriteTools`) is adjudicated via this same predicate — when a
+        // deployment wires an effect-aware policy/hook (`hasEffectAwareGate`), `effectivePolicy || hooks?.preToolUse`
+        // is already true here, so the gate registers and the policy can adjudicate bash/edit_file/write_file. We do
+        // NOT add hand tools as an independent activation term (that would force the gate — and a default-allow no-op
+        // — on a no-policy deployment, breaking the unattended default path); the LOUD warning above makes a
+        // no-policy + write-hands deployment OBSERVABLE instead.
+        // feat(parity-206): `effectivePolicy` is now ALWAYS defined (the always-on integrity guard), so this
+        // predicate — and the handler-registration twin below — always registers the gate. Deliberate: the CC
+        // 2.1.205/206 auto-mode rules must hold precisely in the no-policy unattended deployment ("auto mode");
+        // for every call outside the two guard signatures the adjudication is a cheap string-scan allow.
+        if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || resourceSuspendEligible || spec.enablePlanMode === true) {
+            // Bound the policy check by the task's abort signal: even a policy that ignores `signal` (or an
+            // operator who never answers) cannot hang the loop past timeout/cancel — on abort it resolves to a
+            // deny so the harness can proceed to its own abort handling. `effectivePolicy` includes the Gate-3
+            // manifest scope (design/77 §3) when a manifested skill is present, so the narrowing rides this same
+            // abort-bound adjudicate path.
+            const adjudicate = effectivePolicy
+                ? (req) => raceAbort(
+                // design/80 D-E-core (Part A2): inject the read-only durable budget snapshot onto EVERY request
+                // the gate adjudicates (per-leg-immutable; the same wrapper D-2's safety axis flows through). A
+                // stateless escalation policy reads `req.budget` to self-limit across resume legs; it cannot
+                // widen it (frozen here, no write-back). Same object every call — read-only by contract.
+                Promise.resolve(effectivePolicy.check({ ...req, budget: budgetSnapshot }, abortController.signal)), abortController.signal, () => ({
+                    action: "deny",
+                    reason: "policy check aborted (task timed out or cancelled)",
+                }))
+                : undefined;
+            const resolveAskBound = async (decision, req) => {
+                // design/91: time the SYNCHRONOUS human-review wait (the in-process `onAsk` await). `t0`/`t1` come from
+                // the injectable `now` (NOT bare Date.now) so a test clock pins `waitMs`. Recorded for EVERY resolveAsk
+                // — including the headless auto-deny / `"allow"` fast paths, which return ~0ms (a real human wait shows
+                // a real delay). The wait is bucketed under `kind:"human"` (a synchronous policy ask has no durable
+                // gate kind; it is the in-process analog of the `human` durable gate). **Budget-EXCLUDED** observable.
+                const t0 = now();
+                const resolved = await resolveAsk({
+                    toolName: req.toolName,
+                    toolCallId: req.toolCallId,
+                    args: req.args,
+                    message: decision.message ?? decision.reason ?? `approval required for "${req.toolName}"`,
+                    // design S1d §1.2: Runner-filled source identity so an AGGREGATING onAsk (one approver fanning
+                    // over N delegated workers) can attribute each ask per worker (sourceTaskId) / user (principal).
+                    // Non-aggregating approvers ignore these (additive, no-op).
+                    principal: spec.principal,
+                    sourceTaskId: sessionId,
+                }, onAsk, abortController.signal);
+                const waitMs = Math.max(0, now() - t0); // clamp: a non-monotonic injected clock must never refund time
+                humanReviewRef.count += 1;
+                humanReviewRef.totalWaitMs += waitMs;
+                // design/99 MF-24 (Service AI [297]): record the gated tool + a SHORT, SECRET-SCRUBBED input summary for
+                // the permission-denial ledger ("denied: Bash(rm …)"). The input is in scope on this synchronous path.
+                const toolArg = primaryActivityArg(req.args);
+                humanReviewRef.gates.push({
+                    kind: "human",
+                    waitMs,
+                    // `resolveAsk` only ever returns a terminal allow/deny (never `ask`) — record which the operator chose.
+                    decision: resolved.action === "allow" ? "allow" : "deny",
+                    toolName: req.toolName,
+                    ...(toolArg !== undefined ? { toolArg } : {}),
+                });
+                return resolved;
+            };
+            // design/134 R5 (CC PermissionDenied parity, service [418]③): the pre-wrapped deny observer — the
+            // SAME three-way swallow posture as every 1.252 lifecycle callback (hook throw → onError(phase:
+            // "hook") → a throwing onError sink is itself swallowed). Built ONCE here and consumed at exactly
+            // TWO deny short-circuits: the plan-mode write-deny below and runToolGate's single deny exit (which
+            // funnels policy/hook-ask/safety/shellGate denies). A durable suspend and a PreToolUse hook deny
+            // never reach either site (R5 exclusions, enforced structurally in runToolGate).
+            const hooksWithPermissionDenied = hooks?.permissionDenied ? hooks : undefined;
+            const notifyPermissionDenied = hooksWithPermissionDenied
+                ? async (payload) => {
+                    try {
+                        // Called THROUGH the hooks object so a class-instance Hooks keeps its `this` binding.
+                        await hooksWithPermissionDenied.permissionDenied(payload);
+                    }
+                    catch (err) {
+                        try {
+                            deps.onError?.(err instanceof Error ? err : new Error(String(err)), { phase: "hook", sessionId });
+                        }
+                        catch {
+                            /* throwing onError sink — swallowed */
+                        }
+                    }
+                }
+                : undefined;
+            // design/45 durable suspend-on-approval (F4) + design/49 v1.5 remote suspend. Active only when BOTH a
+            // CheckpointStore is wired and the task opted into `durableApproval` — else `undefined`, so the gate keeps
+            // the synchronous onAsk path (opt-in, default-off). On a policy `ask` it persists a checkpoint with enough
+            // per-task state to resume on any replica (§4.bis whitelist + the hand's readFileState + the remote
+            // workspaceHandle), then aborts the run so it assembles as `status:"suspended"` (M2 blocked-pattern —
+            // capture + abort + suspendRef, no vendored change).
+            //
+            // The closure is ordered as a commit protocol (design/49 §1/§4①, code-ready council BUG#1): a remote
+            // `suspendVM()` (E2B pause) is the FIRST, atomic side effect; `checkpointStore.put()` is the commit point,
+            // after which `suspendRef` is set with NO intervening await and the run NEVER falls back to onAsk (a durable
+            // checkpoint plus an onAsk both resolving the same approval would double-resolve it). A PRE-commit failure
+            // (including a `{ok:false}` suspendVM) returns `undefined` → safe onAsk fallback (VM untouched). The one
+            // post-pause/pre-commit window — `put` fails after the VM is already paused — is handled explicitly by
+            // unpausing (resumeVM) before any onAsk, or aborting if it can't be unpaused (§4①.split).
+            // `pin` is best-effort and runs only AFTER the commit (its failure must not undo a durable suspend).
+            const checkpointStore = spec.checkpointStore ?? deps.checkpointStore;
+            // design/99 §K (center [318] forceDurableGate): a per-principal entitlement can FORCE this run onto the
+            // durable-approval path — so a plain policy `ask` suspends to the wire (per-tool CC-faithful gate) even
+            // when the caller did not opt into `durableApproval`. center's fleet-wide "every interactive run gates"
+            // mandate. We synthesize the same `{scope}` the caller would supply (principal-isolated, no TTL → the
+            // operator decides), letting the existing suspendAsk path below take over unchanged. Caller-supplied
+            // `durableApproval` always wins (it may carry a tighter scope/ttl).
+            // scope = `spec.principal || DEFAULT` (NOT `??`, DELIBERATELY — same council-MINOR pattern as the scope
+            // read at ~L2223): an EMPTY-string principal must fall to the default ISOLATION scope, never be kept as a
+            // shared `""` bucket that would collapse every empty-principal task into one cross-tenant scope. This
+            // synthesized scope is exactly what L2223 would compute for a `forceDurableGate` ask, so the two agree.
+            const durableApproval = spec.durableApproval ??
+                (runtimeCaps?.forceDurableGate ? { scope: spec.principal || DEFAULT_IRREVERSIBLE_SCOPE } : undefined);
+            // design/74 Slice 3a: the §4.bis correctness-state whitelist, extracted so BOTH the human-gate suspend
+            // (below) and the design/74 resource-slice suspend (the turn-boundary trigger) serialize the SAME live
+            // state. Typed `SerializedCheckpointState` (P3): a new CheckpointState field is a COMPILE error here
+            // until handled — never a silent resume drop. `workspaceHandle` is the suspend-specific snapshot identity
+            // (or undefined for a process-local suspend).
+            const serializeCheckpointState = (workspaceHandle) => ({
+                activeTools: [...activeTools],
+                outputRef: { value: outputRef.value, set: outputRef.set },
+                nestedStats: { ...nestedStats },
+                consolidationNotes: undefined, // design/138 S4: legacy consolidation retired — nothing to carry
+                readFileState: readFileStateForCheckpoint ? [...readFileStateForCheckpoint.entries()] : undefined,
+                // design/78 Slice-1 (MAJOR-3 wiring): the SAFE-tier repair bundle is held in-memory by `runRepairLoop`
+                // OUTSIDE the Runner (a thin composition over runTask). Two sources, in order:
+                //   1. the LIVE bundle threaded by `runRepairLoop` for an in-flight repair attempt
+                //      (`internals.repairBundle`) — so a checkpoint minted MID-attempt (attemptCount>0) carries the
+                //      live Reflexion state + attemptCount, not `undefined` (the unwired-producer bug);
+                //   2. else the RESUME seed (`resume.seed.repairBundle`) — the pass-through for a re-suspend of a run
+                //      that was itself resumed WITH a bundle (multi-suspend chain preservation, like consolidationNotes).
+                // A worker that was never repair-driven serializes `undefined`. The bundle is `structuredClone`d (no
+                // fn/Date) so the persisted copy is independent of the loop's mutable closure object.
+                repairBundle: internals?.repairBundle !== undefined
+                    ? structuredClone(internals.repairBundle)
+                    : resume?.seed.repairBundle !== undefined
+                        ? structuredClone(resume.seed.repairBundle)
+                        : undefined,
+                workspaceHandle,
+                // codex 终审 1.255 F2: the live LOGICAL cwd + active EnterWorktree session at suspend — without
+                // these a resume reset the cwd to the task root and orphaned the worktree session (Exit no-op,
+                // double-Enter accepted). `undefined` when no tracked cwd / no active session (both optional).
+                handsCwd: handsCwdRef?.current,
+                activeWorktree: worktreeSessionRef?.current ? { ...worktreeSessionRef.current } : undefined,
+                // SR-7 (CC F6c :698391-698398 + resume leg :707384-707399): snapshot this run's still-live
+                // background tasks (SAME owner triple as listBackgroundTasks / the TaskOutput mounts) so the
+                // resume leg can diff them against its own registry and announce the orphans in ONE CC-shaped
+                // notice. Serialized at suspend COMMIT time (the saga runs mid-task, BEFORE the run-exit
+                // teardown settles/evicts these rows) — the pre-kill truth lands on the checkpoint.
+                runningBackgroundTasks: (() => {
+                    const live = defaultTaskRegistry
+                        .list({ owner: hostTaskId, scope: taskScope, sessionId })
+                        .filter((t) => t.status === "pending" || t.status === "running")
+                        .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}) }));
+                    return live.length > 0 ? live : undefined;
+                })(),
+                // design/80 D-A: a `pendingSteer` is CONSUMED by the resume that injects it (runtask.ts, right after the
+                // resume-continuation prompt) — it is NOT carried onto the next checkpoint. Re-seeding it would re-inject
+                // the SAME guidance on every subsequent resume (a duplicate delivery). So a re-suspend mints
+                // `pendingSteer: undefined`; a supervisor steers the NEW checkpoint with a fresh `setPendingSteer`. (This
+                // is deliberately UNLIKE the `consolidationNotes`/`repairBundle` pass-through — those are cumulative
+                // correctness state; a steer is a one-shot message already delivered to the model.)
+                pendingSteer: undefined,
+            });
+            // design/74 Slice 3b: the put-commit + put-failure split (design/49 §4①), extracted so BOTH the
+            // human-gate suspend (below) and the design/74 resource-slice suspend reuse the SAME commit semantics.
+            // `put` is the point of no return; on put-failure a paused remote VM is unpaused (or the run aborted if
+            // it can't be) so a paused VM is NEVER left without a committed checkpoint. Returns true iff committed —
+            // the caller then sets suspendRef + stops the run ITS way (abort for the human gate, requestStopAfterTurn
+            // for resource). `checkpointStore` is captured; callers gate on it being defined (the guard is defensive).
+            const commitSuspendSaga = async (token, cp, remoteEnv, remoteHandle) => {
+                if (!checkpointStore)
+                    return false;
+                // design/138 §2.2 — harvest at the CHECKPOINT MINT point: memory written this slice must be
+                // durable in the backend BEFORE the run suspends (the resume may land on another replica /
+                // after the workspace is gone). Swallow-guarded — a memory failure never blocks the suspend.
+                if (memoryEngineSession)
+                    await memoryEngineSession.harvest("checkpoint");
+                try {
+                    await checkpointStore.put(token, cp);
+                    return true;
+                }
+                catch (putErr) {
+                    deps.onError?.(putErr, { phase: "config", sessionId });
+                    if (remoteEnv !== undefined && remoteHandle?.snapshotId !== undefined) {
+                        const back = await remoteEnv.resumeVM(remoteHandle.snapshotId, { abortSignal: abortController.signal });
+                        if (back.ok) {
+                            const init = await remoteEnv.postResumeInit();
+                            if (init.ok)
+                                return false; // VM restored to running → safe fallback (caller: NOT suspended)
+                            deps.onError?.(init.error, { phase: "config", sessionId });
+                        }
+                        else {
+                            deps.onError?.(back.error, { phase: "config", sessionId });
+                        }
+                        // Could not restore the paused VM → fatal: abort the run, never continue on a paused VM.
+                        abortController.abort();
+                        void harness.abort();
+                        return false;
+                    }
+                    // No remote VM was paused (process-local suspend) → put failure is safe to fall back.
+                    return false;
+                }
+            };
+            // design/76 §2.5 — THE COMMIT-SIDE DISCRIMINANT (v4 MAJOR-A, the load-bearing dry-run fix). Called
+            // AFTER `commitSuspendSaga` returns true (the checkpoint is durably committed) to publish which holder
+            // the run loop reads for the terminal status. Branch on the COMMITTED `gate.kind`: a REVIEW-PAUSE gate
+            // writes `reviewRef` (→ assemble-result slot 8.6 → `status:"needs_review"` / `review.pending`); every
+            // approval/resource gate (human / irreversible_ask / resource_limit / task_done) writes `suspendRef` as
+            // before (→ slot 8.5 → `status:"suspended"`). NEVER both — a review pause that also set `suspendRef`
+            // would assemble as `"suspended"` and make slot 8.6 dead code. The review-pause family is BOTH the
+            // dry-run `{kind:"needs_review"}` gate (design/76 §2.5) AND the design/80 D-B `{kind:"plan_review"}`
+            // gate — both are human-review pauses that share the `needs_review` terminal (a `plan_review` resumes
+            // with a `plan_review` outcome, a `needs_review` with `dry_run_review`; the distinct gate.kind keeps the
+            // resume discriminant unambiguous). (The review checkpoints themselves are minted by a PROFILE, out of
+            // core scope; core only owns this routing seam + the gate/status/resume discriminants.)
+            const publishCommittedSuspend = (token, gate, scope) => {
+                const ref = gate.kind === "needs_review" || gate.kind === "plan_review" ? reviewRef : suspendRef;
+                ref.token = token;
+                ref.gate = gate;
+                // design/80 D-2 (r3 BLOCKER): stash the COMMITTED scope so the reap/cancel path reads it verbatim
+                // instead of re-deriving from `spec` (which, after the cross-scope re-scope above, would mismatch the
+                // row's scope → expire()'s WHERE never fires → stranded paused VM + orphan checkpoint).
+                ref.scope = scope;
+            };
+            // design/72 §2.2 (B) / council design/74 #4: the shared suspend-loop-cap guard for BOTH the human gate
+            // (`suspendAsk`) and the resource suspend (`suspendForResource`) — extracted so the cap logic can't drift
+            // between them. Returns true when the cap is hit (the caller then bails with its own no-suspend value).
+            // SAFETY STATE FIRST, diagnostic SECOND (council 2026-06-13 BUG): a deployment-owned `onError` that throws
+            // must NOT skip the safety mutations and leave the run looping — commit hit + abort, THEN report.
+            // design/74 (search [136] HIGH-1): generalized over (count, cap) so the restart-loop path and the
+            // resource-slice path use SEPARATE counters/caps (suspendCount/maxSuspends vs ledger.sliceCount/maxSlices)
+            // while sharing the safety-state-first commit (hit + abort, THEN best-effort diagnostic).
+            const suspendLoopCapHit = (count, cap, detail) => {
+                if (count + 1 <= cap)
+                    return false;
+                suspendLoopRef.hit = true;
+                abortController.abort();
+                void harness.abort();
+                // design/74 (codex Vector 5): a deployment-owned `onError` that THROWS must not unwind past the safety
+                // state already committed above (which would reject `suspendForResource` instead of returning, breaking
+                // the turn_boundary hook). The diagnostic is best-effort; the loop-fail state stands regardless.
+                try {
+                    deps.onError?.(new Error(`suspend loop: task already suspended ${count} time(s) (max ${cap}); refusing to suspend again${detail}`), { phase: "config", sessionId });
+                }
+                catch {
+                    /* ignore a throwing onError — safety state is already set */
+                }
+                return true;
+            };
+            // design/74 Slice 3c: opt-in resource-slice suspend. A resource limit (turns/budget/walltime) hit at a
+            // CLEAN turn boundary (no pending tool) mints a `resource_limit` checkpoint + pauses the workspace, then
+            // stops the loop CLEANLY (requestStopAfterTurn — NOT abort, so NO orphan-[INTERRUPTED] reconcile), so the
+            // run is RESUMABLE instead of failed. Reuses `serializeCheckpointState` (3a) + `commitSuspendSaga` (3b).
+            // Exposed (≠ undefined) ONLY when ELIGIBLE: opted in, a durable store, durable tool-results, and a remote
+            // per-task env — or a static caller-owned env (process-local, no workspace pause). A non-remote PER-TASK
+            // env would be destroyed on suspend → corrupt resume, so it is refused (= human gate).
+            //
+            // service [500]② capability-split: pick the `suspendVM` target by CAPABILITY (`isSuspendable`), NOT the
+            // structural `isRemoteExecutionEnv` — a non-suspendable remote env (SSH host / ADB:
+            // `capabilities.suspendable:false`) has the method structurally but it returns `"unsupported"`, which used
+            // to fail the whole suspend (plan_review park never landed → approval flow broke). Such an env instead
+            // takes the DURABLE-PARK-ONLY degrade shared by all three suspend paths (resource / plan_review / ask):
+            // no `suspendVM`, the checkpoint is minted as usual, and the workspaceHandle is captured WITHOUT a
+            // `snapshotId` — resume then skips `resumeVM` (the host/device workspace persists on the target itself;
+            // the factory reconnects to it). Both consts are task-constant (ownedEnv never changes after prepare).
+            //
+            // ⚠️ INVARIANT this selection rests on (opus review 1.257.2): `suspendable:false` remote ⇒ the
+            // workspace is EXTERNALLY DURABLE (see the capabilities.suspendable doc in remote-env.ts). A
+            // non-suspendable-but-EPHEMERAL adapter must not exist under this contract — it would take this
+            // branch and silently resume onto a fresh workspace. If such a backend class appears, add an
+            // explicit workspace-durability capability and gate `parkOnlyRemoteEnv` on it (fall back to the
+            // human gate instead of parking).
+            const suspendableEnv = ownedEnv !== undefined && isSuspendable(ownedEnv) ? ownedEnv : undefined;
+            const parkOnlyRemoteEnv = suspendableEnv === undefined && ownedEnv !== undefined && isRemoteExecutionEnv(ownedEnv) ? ownedEnv : undefined;
+            // Park-only identity capture: STRIP any snapshotId the env's handle may carry (`WorkspaceHandle.snapshotId`
+            // = "this env was produced by resuming a snapshot", i.e. lineage — the park itself minted NO snapshot).
+            // Persisting a stale lineage id would make the resume path call `resumeVM` on the non-suspendable env
+            // ("unsupported" → failed resume); the ABSENT id is exactly what routes resume onto the skip-restore branch.
+            const parkOnlyHandle = (env) => {
+                const { snapshotId: _lineage, ...identity } = env.workspaceHandle();
+                // `restoreMode` makes the park EXPLICIT in the durable record: resume distinguishes "parked on
+                // purpose" from "snapshot handle that LOST its snapshotId" (corruption → fail-closed there).
+                return { ...identity, restoreMode: "park_only" };
+            };
+            // Assign the task-scoped `suspendForResource` (forward-declared above). `resourceSuspendEligible` (computed
+            // before this block, for the block guard) is the SAME eligibility predicate — reuse it so the two can't
+            // drift; `suspendableEnv`/`parkOnlyRemoteEnv` re-derive the capability split the closure needs.
+            suspendForResource = resourceSuspendEligible
+                ? async (reason, sliceSpend) => {
+                    const rs = spec.resourceSuspend;
+                    if (!checkpointStore || !rs)
+                        return false;
+                    // A cancelling run must not mint an irreversible checkpoint (design/51 §5, same as the human gate).
+                    if (abortController.signal.aborted)
+                        return false;
+                    // design/72 §2.2 (B): refuse a re-suspend past the cap — fail the run instead of looping forever.
+                    // design/74 (search [136] HIGH-1): bound on the RESOURCE-slice counter (ledger.sliceCount) vs the
+                    // independent `maxSlices` — NOT the restart-loop suspendCount/maxSuspends. A long resource run is
+                    // legitimate; only a $0-progress slice loop trips this backstop (the $ ledger is the real bound).
+                    if (suspendLoopCapHit(priorLedger?.sliceCount ?? 0, maxSlices, " (resource slice limit)"))
+                        return false;
+                    const leafId = await session.getLeafId();
+                    if (!leafId)
+                        return false; // no committed leaf → no consistent resume point
+                    // LOW-10 (search [136]): re-check abort AFTER the async getLeafId — a cancel that landed DURING that
+                    // await must not proceed to mint an irreversible checkpoint + pause the VM (the human-gate path does
+                    // the same second check before its first durable side effect). Cheap insurance against a TOCTOU race.
+                    if (abortController.signal.aborted)
+                        return false;
+                    // suspendVM = the FIRST durable side effect (atomic seam: {ok:false} ⇒ VM untouched ⇒ safe to skip).
+                    let remoteHandle;
+                    if (suspendableEnv !== undefined) {
+                        // design/103 §3.7: kill background processes BEFORE suspendVM — a suspendable TOB env would otherwise
+                        // snapshot them and resume revive untracked zombies (breaking 不跨 suspend). Detached jobs are OUTSIDE
+                        // suspendVM's in-flight contract, so the runner MUST dispose explicitly here, not rely on the adapter.
+                        if (hasBackgroundShell(suspendableEnv))
+                            await suspendableEnv.disposeBackgroundShells();
+                        const snap = await suspendableEnv.suspendVM({ abortSignal: abortController.signal });
+                        if (!snap.ok) {
+                            deps.onError?.(new Error(`resource suspendVM failed (${snap.error.code}): ${snap.error.message}`, { cause: snap.error }), { phase: "config", sessionId });
+                            return false;
+                        }
+                        remoteHandle = { ...suspendableEnv.workspaceHandle(), snapshotId: snap.value };
+                    }
+                    else if (parkOnlyRemoteEnv !== undefined) {
+                        // service [500]② durable-park-only: a non-suspendable remote env (SSH/ADB host) is NOT paused —
+                        // its workspace persists on the target itself. Capture identity WITHOUT a snapshotId so the
+                        // resume skips resumeVM and simply reconnects via the factory. Background shells are still
+                        // disposed (the run is stopping; a detached job must not outlive the leg untracked).
+                        if (hasBackgroundShell(parkOnlyRemoteEnv))
+                            await parkOnlyRemoteEnv.disposeBackgroundShells();
+                        remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
+                    }
+                    const token = mintCheckpointToken();
+                    const gate = { kind: "resource_limit", reason };
+                    const cp = {
+                        token,
+                        version: RESOURCE_CHECKPOINT_VERSION, // v2 — an old worker rejects it pre-CAS
+                        scope: rs.scope,
+                        sessionId,
+                        leafId,
+                        gate,
+                        pendingAction: { kind: "resource_limit", reason },
+                        state: serializeCheckpointState(remoteHandle),
+                        status: "pending",
+                        createdAt: Date.now(),
+                        // design/74 (search [136] HIGH-2): stamp a `deadline` (createdAt + ttl, default 30 days) so the
+                        // durable reaper — which filters on `deadline` — can GC an ORPHANED (never-resumed) resource
+                        // suspend. Without it the `pending` row + in-memory pin leak forever. A legit auto-resume fires
+                        // long before this; the deadline only bounds abandonment.
+                        deadline: Date.now() + (rs.ttlMs ?? DEFAULT_RESOURCE_TTL_MS),
+                        // design/74 (search [136] HIGH-1): the resource slice does NOT advance the restart-loop
+                        // `suspendCount` — its place in the chain is the ledger's `sliceCount`. Carrying suspendCount
+                        // UNCHANGED keeps the restart-loop safety (maxSuspends) counting only restart suspends, and stops
+                        // resource slices from tripping that (low) cap. (The cap for slices is `maxSlices`, checked above.)
+                        suspendCount: priorSuspendCount,
+                        // design/91: a resource_limit suspend is NOT a human-review wait (no `suspendedAt`), but it must
+                        // CARRY FORWARD any human-review burden already accumulated this chain (a prior approval leg) so it
+                        // isn't lost across a resource leg. Snapshot the accumulator (omitted when empty). The resume reads
+                        // it back into the accumulator; no new latency is added for a resource resume (no human waited).
+                        humanReview: humanReviewRef.count > 0
+                            ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
+                            : undefined,
+                        // design/74 Slice 4: debit THIS slice's spend onto the cross-slice ledger (prior + this slice; the
+                        // first slice seeds the human total from spec.resourceSuspend.totalBudgetUsd). The next resume
+                        // reads it to size its own budget = min(maxCostUsd, total − spent) — so a resume can't refresh it.
+                        resourceLedger: debitLedger(priorLedger, sliceSpend, resourceTotal),
+                    };
+                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)))
+                        return false;
+                    // ── COMMITTED. Set suspendRef + pin, then stop the loop CLEANLY (Slice 2: requestStopAfterTurn, NOT
+                    //    abort): a resource suspend is at a clean turn boundary with no orphan tool calls, so the loop
+                    //    exits via `agent_end` and the session is left resumable (no interrupted-reconcile corruption).
+                    // Via the commit-side discriminant (design/76 §2.5): a `resource_limit` gate routes to `suspendRef`.
+                    publishCommittedSuspend(token, gate, rs.scope); // design/80 D-2: stash the COMMITTED scope (== cp.scope)
+                    try {
+                        await sessions.pin?.(sessionId);
+                    }
+                    catch (pinErr) {
+                        deps.onError?.(pinErr, { phase: "config", sessionId });
+                    }
+                    harness.requestStopAfterTurn();
+                    return true;
+                }
+                : undefined;
+            // design/80 D-B: mint a `plan_review` checkpoint at a CLEAN turn boundary when a tool requested review via
+            // `ctx.requestReview()`. Mirrors the human/resource suspend commit saga (suspendVM → put → publish), but the
+            // gate is a REVIEW pause: it routes to `reviewRef` (→ `status:"needs_review"`), binds NO tool call
+            // (`pendingAction:{kind:"plan_review"}`), and ABORTS the loop (like the human gate — the run stops here and
+            // assembles as needs_review; resume continues with a `plan_review` outcome). Present only with a
+            // checkpointStore (else `ctx.requestReview` is a silent no-op). The plan text is in the tool's transcript
+            // content, NOT on the gate (design/76 §9).
+            suspendForReview = checkpointStore
+                ? async (reason) => {
+                    if (!checkpointStore)
+                        return false;
+                    // A cancelling run must not mint a checkpoint (design/51 §5, same as the human/resource gates).
+                    if (abortController.signal.aborted)
+                        return false;
+                    // Refuse a re-suspend past the restart-loop cap (a model that re-requests review every resume) —
+                    // fail the run instead of looping (design/72 §2.2 B), same backstop as the human gate.
+                    if (suspendLoopCapHit(priorSuspendCount, maxSuspends, " for a plan_review (likely a resume/restart loop)."))
+                        return false;
+                    const leafId = await session.getLeafId();
+                    if (!leafId) {
+                        // 飞轮 [506]④ diagnosability: this was the ONLY silent drop on the plan_review park path (every
+                        // other failure logs via onError). A dropped HITL plan review must never vanish without signal.
+                        // codex 1.257.3 (LOW): diagnostic sink swallow-guarded — a throwing deployment onError would
+                        // otherwise reject this async branch instead of returning false (run continues).
+                        try {
+                            deps.onError?.(new Error("plan_review park skipped: no committed session leaf (the plan-review request was dropped; the run continues without pausing)"), { phase: "config", sessionId });
+                        }
+                        catch {
+                            /* diagnostic only — never fault the park path */
+                        }
+                        return false; // no committed leaf → no consistent resume point
+                    }
+                    if (abortController.signal.aborted)
+                        return false; // TOCTOU re-check after the async getLeafId
+                    // suspendVM = the FIRST durable side effect (atomic seam: {ok:false} ⇒ VM untouched ⇒ safe to skip).
+                    // service [500]② capability-split: `suspendableEnv` (NOT the structural isRemoteExecutionEnv) picks
+                    // the suspendVM target; a non-suspendable remote env takes the park-only branch below instead of
+                    // calling suspendVM (which returned "unsupported" → the plan_review park failed → approval flow broke).
+                    let remoteHandle;
+                    if (suspendableEnv !== undefined) {
+                        // design/103 §3.7: dispose background processes before suspendVM (see resource path) — no snapshot zombies.
+                        if (hasBackgroundShell(suspendableEnv))
+                            await suspendableEnv.disposeBackgroundShells();
+                        const snap = await suspendableEnv.suspendVM({ abortSignal: abortController.signal });
+                        if (!snap.ok) {
+                            deps.onError?.(new Error(`plan_review suspendVM failed (${snap.error.code}): ${snap.error.message}`, { cause: snap.error }), { phase: "config", sessionId });
+                            return false;
+                        }
+                        remoteHandle = { ...suspendableEnv.workspaceHandle(), snapshotId: snap.value };
+                    }
+                    else if (parkOnlyRemoteEnv !== undefined) {
+                        // durable-park-only (see resource path): no pause; identity without snapshotId; resume reconnects.
+                        if (hasBackgroundShell(parkOnlyRemoteEnv))
+                            await parkOnlyRemoteEnv.disposeBackgroundShells();
+                        remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
+                    }
+                    const token = mintCheckpointToken();
+                    // Review pause is principal-isolated (operator `/decide` arrives in the task's scope), same `|| DEFAULT`
+                    // empty-string rule as the human gate (L2253). A caller `durableApproval` scope/ttl, if any, wins.
+                    const scope = spec.durableApproval?.scope ?? (spec.principal || DEFAULT_IRREVERSIBLE_SCOPE);
+                    const gate = { kind: "plan_review", reason: reason ?? `plan review requested` };
+                    const cp = {
+                        token,
+                        version: BINDING_CHECKPOINT_VERSION, // ≤ MAX_SUPPORTED ⇒ current workers accept; plan_review resume already supported
+                        scope,
+                        sessionId,
+                        leafId,
+                        gate,
+                        pendingAction: { kind: "plan_review" },
+                        state: serializeCheckpointState(remoteHandle),
+                        status: "pending",
+                        createdAt: Date.now(),
+                        // A plan_review is a HUMAN-DECISION wait (like the approval gate, NOT a resource slice): stamp
+                        // `suspendedAt` so resume derives this leg's human-review latency = `resumeNow − suspendedAt`
+                        // (design/91), and ADVANCE `suspendCount` so the maxSuspends restart-loop cap actually bounds a
+                        // present_plan→reject→present_plan loop (a non-advancing count would never trip the cap above).
+                        suspendedAt: now(),
+                        deadline: Date.now() + (spec.durableApproval?.ttlMs ?? DEFAULT_RESOURCE_TTL_MS), // bound an abandoned review
+                        suspendCount: priorSuspendCount + 1,
+                        humanReview: humanReviewRef.count > 0
+                            ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
+                            : undefined,
+                        resourceLedger: priorLedger, // carry forward unchanged (no slice debit for a review pause)
+                        // Source attribution (parity with the approval gate) so a service supervisor inbox can attribute a
+                        // plan_review pause to the issuing task/principal (worker-unforgeable: sessionId, not a tool arg).
+                        sourceTaskId: sessionId,
+                        ...(spec.principal ? { principal: spec.principal } : {}),
+                    };
+                    if (!(await commitSuspendSaga(token, cp, suspendableEnv, remoteHandle)))
+                        return false;
+                    // ── COMMITTED. Route plan_review → reviewRef (design/76 §2.5 discriminant), pin, then ABORT the loop
+                    //    (like the human gate — the run stops here and assembles as needs_review; design/45 capture+abort).
+                    publishCommittedSuspend(token, gate, scope);
+                    try {
+                        await sessions.pin?.(sessionId);
+                    }
+                    catch (pinErr) {
+                        deps.onError?.(pinErr, { phase: "config", sessionId });
+                    }
+                    abortController.abort();
+                    void harness.abort();
+                    return true;
+                }
+                : undefined;
+            // design/77 §4.4 (load-bearing build-time fix): arm the durable suspend for an IRREVERSIBLE tool even
+            // when the deployment did NOT opt into `durableApproval`. Otherwise the Gate-4 tighten (allow→ask) in an
+            // unattended deployment degrades to a headless auto-DENY (a model-facing deny = reward-hack retry
+            // surface) — the exact surface this gate exists to remove. The closure below is PARAMETERIZED: with
+            // `durableApproval` it mints the normal `{kind:"human"}` checkpoint under its scope/ttl; without it
+            // (irreversible-only case) it mints `{kind:"irreversible_ask"}` under the DEFAULT_IRREVERSIBLE_SCOPE and
+            // no TTL. Reading `durableApproval.scope`/`.ttlMs` unconditionally here would throw TypeError →
+            // `undefined` → the headless deny it must avoid (that is the inert-gate bug §4.4 calls out).
+            const suspendAsk = 
+            // design/80 D-2 (egress predicate): egress-marked tools must arm the durable suspend too — a THIRD OR
+            // inside the `checkpointStore &&` conjunction (not a sibling), so a no-store deployment still falls to
+            // the store-gated headless path and never crash/hangs. Without this, an egress tighten with no
+            // `durableApproval` falls to a headless auto-DENY (design/77 §4.4 reward-hack retry surface).
+            checkpointStore && (durableApproval || irreversibleTools.size > 0 || egressTools.size > 0)
+                ? async (req, postHookArgs, safety) => {
+                    // ── PRE-COMMIT (read-only prep + the remote pause). Any failure here is SAFE: the checkpoint
+                    //    is not yet persisted and (per the suspendVM atomicity contract) the remote VM is untouched,
+                    //    so we fall back to the synchronous onAsk gate rather than silently dropping the approval.
+                    let token;
+                    let gate;
+                    let cp;
+                    // The remote workspace handle: with a snapshotId when a remote per-task env was actually
+                    // `suspendVM`-paused below, WITHOUT one on the [500]② park-only degrade (non-suspendable remote
+                    // env; identity only) — drives both the checkpoint field and the put-failure unpause path
+                    // (design/49 §4①.split — the unpause is keyed on `snapshotId`, so a park never "unpauses").
+                    let remoteHandle;
+                    const remoteEnv = suspendableEnv;
+                    try {
+                        // §4.bis / Minor #1: durable suspend requires durable tool-result storage. The default
+                        // in-memory offload store would deref to null after a resume on a fresh instance — refuse
+                        // to suspend (fail-fast) rather than resume into corrupt state. Offload disabled (no store)
+                        // is fine: results stay inline in the session and are durable with it.
+                        // design/80 D-2 (council MAJOR): fail-fast ONLY if the in-memory store ACTUALLY holds offloaded
+                        // results a cross-replica resume would lose. An EMPTY in-memory store has nothing to lose, so a
+                        // durable suspend is safe — this is what makes the D-2 egress/irreversible_ask suspend WORK on
+                        // the common "wire only a checkpointStore" deployment (default offload, but small args that
+                        // never offloaded) instead of silently throwing here → caught below → headless auto-DENY (the
+                        // very reward-hack surface D-2's egress predicate removes). A store with entries still fails fast.
+                        if (offloadStore && isVolatileOffloadStore(offloadStore) && !offloadStore.isEmpty()) {
+                            throw new Error("durable suspend requires a durable toolResultStore (the default InMemoryToolResultStore " +
+                                "holds offloaded results that are lost across a cross-replica resume); inject " +
+                                "RunnerDeps.toolResultStore or disable offload.");
+                        }
+                        // design/49 v1.5: a per-task `executionEnvFactory` env that is REMOTE survives the suspend via
+                        // `suspendVM()` (E2B pause) instead of being destroyed — resume rebuilds it + `resumeVM()`. A
+                        // per-task env that is NOT remote (theoretical — the factory only mints remote) cannot be
+                        // paused, so it would still be destroyed on finish() → a fresh empty env on resume → corrupt
+                        // readFileState. Refuse that one (the v1 fail-fast, now narrowed to non-remote per-task envs).
+                        // A static, caller-owned `deps.executionEnv` (ownedEnv === undefined) survives in-process and
+                        // suspends process-locally (no workspaceHandle), exactly as in v1. A NON-SUSPENDABLE remote
+                        // per-task env ([500]② park-only: `parkOnlyRemoteEnv`) is fine too — its workspace persists on
+                        // the target itself, so no pause is needed; only a non-remote per-task env is refused.
+                        if (ownedEnv !== undefined && remoteEnv === undefined && parkOnlyRemoteEnv === undefined) {
+                            throw new Error("durable suspend is not supported with a non-remote per-task executionEnvFactory env: the " +
+                                "minted env is destroyed on suspend, so a resumed file/shell tool would act on a fresh " +
+                                "(empty) env. Use a RemoteExecutionEnv factory (it is paused, not destroyed) or a static, " +
+                                "caller-owned RunnerDeps.executionEnv.");
+                        }
+                        const leafId = await session.getLeafId();
+                        if (!leafId) {
+                            // A suspend always happens after the suspending assistant message is persisted, so the
+                            // branch has a leaf. Guard defensively: no leaf → no consistent resume point → don't suspend.
+                            throw new Error("cannot suspend: session has no committed leaf to resume from");
+                        }
+                        const { messages } = await session.buildContext();
+                        const { batchToolCallIds, completedCallIds } = batchContextAt(messages, req.toolCallId);
+                        // design/51 §5: a run being CANCELLED must not mint an irreversible durable checkpoint (the
+                        // budget→cancel race: an orchestrator detects over-budget and aborts the shared signal just as
+                        // a worker is about to suspend). Check the abort HERE — after the read-only prep, immediately
+                        // before the first side effect (suspendVM on the remote path; `put` on the process-local
+                        // path, which has NO suspendVM) — so neither path commits for a cancelling run. Aborted ⇒
+                        // return undefined = safe onAsk fallback (the run is aborting anyway → the abort-bounded onAsk
+                        // gate resolves to deny → the loop ends cancelled, no durable checkpoint).
+                        //
+                        // This is a CORRECTNESS guard, not just an optimization: on the process-local suspend path
+                        // there is no suspendVM, so `put` is the first side effect and this check is the ONLY thing
+                        // gating the commit on cancel; on the remote path it is also defense-in-depth, since
+                        // suspendVM's abortSignal is best-effort (a backend may finish the pause before honoring it).
+                        // The residual micro-race (passes here, THEN abort fires, THEN put commits) is covered by
+                        // TaskStream.destroy() reaping the resulting suspension (design/51 §4) — the two are
+                        // complementary = atomic cancel.
+                        if (abortController.signal.aborted) {
+                            return undefined;
+                        }
+                        // design/72 §2.2 (B): refuse a re-suspend past the cap BEFORE any side effect (no suspendVM,
+                        // no put) — fail the run instead of looping. Checked here, after the read-only prep and the
+                        // abort check, so a cancelling run still takes the abort path above. The shared helper commits
+                        // `suspendLoopRef` + abort (safety-state-first) so assembleResult reports `failed`/`suspend.loop`.
+                        if (suspendLoopCapHit(priorSuspendCount, maxSuspends, ` for tool "${req.toolName}" — likely a resume/restart loop.`))
+                            return undefined;
+                        // suspendVM = the FIRST durable side effect, and it is ATOMIC (seam contract): {ok:false} ⇒ the
+                        // VM is left running/untouched ⇒ safe to fall back to onAsk. Done BEFORE `put` so a paused VM
+                        // is always paired with a committed checkpoint (or, on the put-failure split path, unpaused).
+                        // abortSignal: a hung pause (network partition) cannot pin the worker (council BUG#2).
+                        if (remoteEnv !== undefined) {
+                            // design/103 §3.7: dispose background processes before suspendVM (see resource path) — no snapshot zombies.
+                            if (hasBackgroundShell(remoteEnv))
+                                await remoteEnv.disposeBackgroundShells();
+                            const snap = await remoteEnv.suspendVM({ abortSignal: abortController.signal });
+                            if (!snap.ok) {
+                                throw new Error(`suspendVM failed (${snap.error.code}): ${snap.error.message}`, { cause: snap.error });
+                            }
+                            // Capture identity AFTER the pause and stamp the returned snapshotId ourselves (don't rely on
+                            // the env to mutate workspaceHandle() in place) — this is what resume's resumeVM() reads.
+                            remoteHandle = { ...remoteEnv.workspaceHandle(), snapshotId: snap.value };
+                        }
+                        else if (parkOnlyRemoteEnv !== undefined) {
+                            // durable-park-only (see resource path): no pause; identity without snapshotId; resume reconnects.
+                            if (hasBackgroundShell(parkOnlyRemoteEnv))
+                                await parkOnlyRemoteEnv.disposeBackgroundShells();
+                            remoteHandle = parkOnlyHandle(parkOnlyRemoteEnv);
+                        }
+                        token = mintCheckpointToken();
+                        // design/77 §4.4/§4.5: pick the gate kind + scope + ttl by whether `durableApproval` is wired.
+                        // WITH it → the normal `{kind:"human"}` durable-approval suspend (unchanged). WITHOUT it (the
+                        // irreversible-only case, where `durableApproval.scope`/`.ttlMs` would throw TypeError) → mint
+                        // the DISJOINT `{kind:"irreversible_ask"}` gate under the default scope, no TTL. Both are
+                        // pre-action approval suspends (suspendRef → `status:"suspended"`), resumed identically with a
+                        // `policy_ask` outcome (the new third gateMatch arm in runtask.ts).
+                        // design/80 D-2 (mint-site safety axis): a SAFETY tighten (`safety !== undefined` — the egress/
+                        // irreversibility gate forced this ask) mints the DISJOINT `irreversible_ask` kind with its
+                        // persisted `safetyAxis` — EVEN WHEN `durableApproval` is wired (which supplies scope/ttl, NOT
+                        // the kind). This is the load-bearing fix: a network budget resolver keys on `kind` to NEVER
+                        // auto-approve a safety ask. A plain (non-safety) ask keeps the normal choice: `human` under
+                        // `durableApproval`, else `irreversible_ask` (the §4.4 unattended-irreversible-only case).
+                        // design/80 D-E: a DETERMINISTIC, REDACTED risk summary attached AT MINT so a supervisor inbox
+                        // sorts/triages by TRUE severity. INERT — it is display/triage metadata ONLY: nothing below
+                        // reads it to gate/budget/suppress (structural ask still strictly wins). `shellGated` is true only
+                        // for a bash call coarsely gated by `shellGate` (grades as the `shell` axis, severity 3, not 4).
+                        // Pure (no clock/random) — same call ⇒ identical descriptor. `postHookArgs` are the SHOWN args.
+                        const riskDescriptor = buildRiskDescriptor({
+                            toolName: req.toolName,
+                            args: postHookArgs,
+                            safety,
+                            shellGated: (req.toolName === "Bash" && shellGatedBash) || (req.toolName === "Monitor" && shellGatedMonitor),
+                        });
+                        gate =
+                            safety !== undefined
+                                ? {
+                                    kind: "irreversible_ask",
+                                    reason: `human approval required before safety-tightened tool "${req.toolName}"`,
+                                    toolName: req.toolName,
+                                    safetyAxis: safety,
+                                    riskDescriptor,
+                                }
+                                : durableApproval
+                                    ? {
+                                        kind: "human",
+                                        reason: `human approval required for tool "${req.toolName}"`,
+                                        toolName: req.toolName,
+                                        riskDescriptor,
+                                    }
+                                    : {
+                                        kind: "irreversible_ask",
+                                        reason: `human approval required before irreversible tool "${req.toolName}"`,
+                                        toolName: req.toolName,
+                                        riskDescriptor,
+                                    };
+                        // design/80 D-2 (cross-scope mint): an UNATTENDED safety/irreversible_ask (no `durableApproval`)
+                        // must be resumable by the operator whose `/decide` arrives in the task's principal scope — so
+                        // re-scope to `spec.principal` (the authenticated end-user, design/62) when no durableApproval
+                        // scope is set, else the resolve scope-WHERE never matches (or a fixed DEFAULT cross-tenant
+                        // leaks). The reap path reads the COMMITTED `cp.scope` (below), never re-derives — so this
+                        // re-scope can't strand the paused VM (r3 BLOCKER).
+                        // `|| DEFAULT` (not `??`): an EMPTY-string principal must NOT become a shared scope bucket
+                        // (council MINOR) — `?? spec.principal` would keep `""` and collapse every empty-principal task
+                        // into one cross-tenant scope. Falsy "" falls through to the default isolation scope.
+                        const scope = durableApproval?.scope ?? (spec.principal || DEFAULT_IRREVERSIBLE_SCOPE);
+                        const ttlMs = durableApproval?.ttlMs;
+                        // §4.bis whitelist of correctness state (snapshot of the live values at suspend), via the shared
+                        // serializer (Slice 3a) so the resource-slice suspend captures the SAME state. `remoteHandle`
+                        // is undefined for a process-local suspend (design/49 v1.5).
+                        const checkpointState = serializeCheckpointState(remoteHandle);
+                        cp = {
+                            token,
+                            // design/80 D-1 (version-skew fix): binding-bearing human/irreversible_ask checkpoints stamp
+                            // v3 so a pre-D-1 worker (MAX_SUPPORTED=2, no binding enforcement) REJECTS them pre-CAS
+                            // instead of resuming them with the decision-action binding silently voided (council BLOCKER).
+                            version: BINDING_CHECKPOINT_VERSION,
+                            scope,
+                            sessionId,
+                            leafId,
+                            gate,
+                            pendingAction: {
+                                kind: "tool_approval",
+                                toolCallId: req.toolCallId,
+                                toolName: req.toolName,
+                                args: postHookArgs, // design/37 post-hook (rewritten) args — resume executes these
+                                // design/80 D-1 §2 (slice 1a.2): server-minted opaque boundInputHash over the SAME
+                                // post-hook args — computed ONCE here, persisted on the row, echoed by the operator and
+                                // verified by opaque equality on resume (never re-serialized resume-side).
+                                boundInputHash: boundInputHashOf(postHookArgs),
+                                batchToolCallIds,
+                                completedCallIds,
+                            },
+                            state: checkpointState,
+                            // design/80 D-2 (BLOCKER): an UNATTENDED suspend (no durableApproval = no operator to ever
+                            // resolve it) MUST carry an abandonment deadline so the reaper can GC it; else the egress/
+                            // irreversible_ask suspend pins the session + strands the paused VM forever. A durableApproval
+                            // suspend keeps the operator's ttlMs (undefined = unbounded; D-D terminalAt is the backstop).
+                            deadline: ttlMs !== undefined
+                                ? Date.now() + ttlMs
+                                : durableApproval !== undefined
+                                    ? undefined
+                                    : Date.now() + DEFAULT_UNATTENDED_APPROVAL_TTL_MS,
+                            status: "pending",
+                            createdAt: Date.now(),
+                            // design/91: the wall-clock instant this approval gate suspended, from the injectable `now`.
+                            // Resume derives this leg's human-review latency as `resumeNow − suspendedAt`. (createdAt/
+                            // deadline stay on Date.now — they are reaper/SLA fields, not the human-time observable.)
+                            suspendedAt: now(),
+                            // design/91: snapshot the PRIOR-leg human-review burden onto the row so the resume that wakes
+                            // this checkpoint seeds the accumulator + adds THIS leg's latency = the whole chain's burden.
+                            // Snapshot the gate array (independent of the mutable ref). Omitted when nothing accumulated yet.
+                            humanReview: humanReviewRef.count > 0
+                                ? { count: humanReviewRef.count, totalWaitMs: humanReviewRef.totalWaitMs, gates: [...humanReviewRef.gates] }
+                                : undefined,
+                            suspendCount: priorSuspendCount + 1, // design/72 §2.2 (B): this suspend's place in the chain
+                            // design/80 D-E-core (A3): attach the durable resource ledger to this APPROVAL suspend so a
+                            // STATELESS policy can read cumulative spend across the resume chain (a fresh in-memory counter
+                            // resets every leg). Debit THIS leg's live cumulative spend onto the prior ledger (reuse the
+                            // resource-slice `debitLedger`: prior-wins frozen total, monotonic spend, never refunded) — the
+                            // event-driven gate reads the live spend via `liveSpendRef` (the resource-slice path passes it
+                            // explicitly instead). On the FIRST suspend the first slice seeds the human total from
+                            // `resourceTotal` (undefined when no resource budget is configured → an unbounded read).
+                            // **READ-ONLY for stats**: this ledger rides the approval suspend purely for the `req.budget`
+                            // read — the final-stats aggregate fold (runtask) is GATED to the resource-slice gate kind, so
+                            // an approval resume is NEVER double-counted (design/80 A3, the single subtle correctness point).
+                            // `debitLedger` is pure + total (never throws) so it cannot leak a paused VM in this try block.
+                            resourceLedger: debitLedger(priorLedger, liveSpendRef.get?.() ?? { costMicroUsd: 0, tokens: 0, turns: 0 }, resourceTotal, { countSlice: false }),
+                            // design S1d (source-tag persistence, service [198]/[199]): stamp the SAME source identity the
+                            // synchronous ask carries (resolveAskBound above: principal = spec.principal, sourceTaskId =
+                            // sessionId) onto the durable approval checkpoint — the suspend path never invokes onAsk, so a
+                            // supervisor inbox would otherwise have no per-worker/per-user attribution for a PAUSED ask.
+                            // ECHO-ONLY triage metadata, NEVER a gate input (no gate/CAS/winner/resume-validation reads it).
+                            // `sourceTaskId = sessionId` is worker-unforgeable for a Runner-created delegated subagent (the
+                            // child never sets its own sessionId). Only the APPROVAL (human/irreversible_ask) suspend stamps
+                            // these — the resource_limit suspend has no ask source (mirrors the winnerFromOutcome/policy_ask
+                            // binding scope). Omitted via `||`/conditional spread when absent (empty principal → omit).
+                            sourceTaskId: sessionId,
+                            ...(spec.principal ? { principal: spec.principal } : {}),
+                        };
+                    }
+                    catch (err) {
+                        // Reaching here means the VM is still running: suspendVM was either never called or returned
+                        // {ok:false} (atomic seam contract: VM untouched). The only post-pause statements above are the
+                        // SYNCHRONOUS `workspaceHandle()` (documented as data the env already holds, remote-env.ts),
+                        // `boundInputHashOf(postHookArgs)` (canonical-json.ts — TOTAL by construction, never throws, so a
+                        // pathological arg can't leak the paused VM here; design/80 D-1 §2 / round-2 MAJOR), and pure
+                        // object construction — by contract they don't throw, so a paused VM never falls through to here.
+                        // (A contract-violating throw from a post-pause backend would be the same class as the
+                        // put-failure split path below; it is out of scope, not silently mishandled.) → safe onAsk.
+                        deps.onError?.(err, { phase: "config", sessionId });
+                        return undefined;
+                    }
+                    // ── COMMIT (Slice 3b: shared put + put-failure split, see `commitSuspendSaga`). ──────────────
+                    if (!(await commitSuspendSaga(token, cp, remoteEnv, remoteHandle))) {
+                        return undefined; // put failed → rolled back / aborted → safe onAsk fallback (NOT suspended)
+                    }
+                    // ── COMMITTED (point of no return). No await/throw before setting suspendRef; NEVER onAsk now. ──
+                    // Via the commit-side discriminant (design/76 §2.5): a human/irreversible_ask gate routes to
+                    // `suspendRef` (the dry-run `needs_review` gate — minted by a profile — would route to `reviewRef`).
+                    publishCommittedSuspend(token, gate, cp.scope); // design/80 D-2: stash the COMMITTED scope (after the cross-scope re-scope)
+                    // pin is best-effort: a failure only risks idle eviction of an IN-MEMORY session (durable store:
+                    // pin is a no-op) — it must NOT undo a committed suspend, so swallow + log rather than throw.
+                    try {
+                        await sessions.pin?.(sessionId); // protect the session from idle eviction until resume (§5)
+                    }
+                    catch (pinErr) {
+                        deps.onError?.(pinErr, { phase: "config", sessionId });
+                    }
+                    // Abort the run (capture is durable now): release the policy gate then stop the harness —
+                    // the loop returns an aborted message and assembleResult sees suspendRef → "suspended".
+                    abortController.abort();
+                    void harness.abort();
+                    return { token, gate };
+                }
+                : undefined;
+            // design/108: sync `toolEffects` from the FINAL tool set so the plan-mode write-deny sees every tool's real
+            // effect. First-party tools pushed AFTER the toolEffects build (~590) — present_plan, enter_plan_mode,
+            // AskUserQuestion, Skill, recall, repo_map, … — carry their `effect` on the AgentTool (defineTool preserves
+            // it; raw factories already set it). Without this they read as unknown→"write" and plan mode over-rejects
+            // read tools. Only fill MISSING entries (never override an explicit earlier set, e.g. handsReadOnly's Bash:read).
+            for (const t of tools) {
+                const eff = t.effect;
+                if (eff !== undefined && !toolEffects.has(t.name))
+                    toolEffects.set(t.name, eff);
+            }
+            // design/74 Slice 3c: register the tool-gate handler ONLY for real gate work (a policy / PreToolUse
+            // hook / egress tool / irreversible tool / design/77 §3 manifest scope). A task that entered this block
+            // solely for resource-suspend has no gate work — runToolGate would no-op — so skipping registration keeps
+            // its tool path provably the default. `effectivePolicy` covers the caller policy AND the Gate-3 scope;
+            // design/77 §4: `irreversibleTools.size > 0` MUST gate registration too, else an `always`/`maybe` tool in
+            // a no-policy/no-hook/no-egress unattended deployment would never be tightened → silently auto-allow.
+            // design/108: `spec.enablePlanMode` MUST also register the handler — a plan-mode task with no policy/hook/egress
+            // /irreversible would otherwise skip the tool_call handler entirely → the plan-mode write-deny below never runs.
+            if (effectivePolicy || hooks?.preToolUse || egressTools.size > 0 || irreversibleTools.size > 0 || spec.enablePlanMode === true) {
+                harness.on("tool_call", async (e) => {
+                    // design/134 复审 (codex HIGH): drop any stale blocked-marker for this id FIRST — a provider
+                    // reusing a toolCallId across calls must not have the new call's post hooks suppressed by an
+                    // old call's block record (the set is otherwise only drained on tool_result/batch collect).
+                    blockedToolCalls.delete(e.toolCallId);
+                    // design/108: plan-mode write-deny — a FIDELITY check kept SEPARATE from the safety gate below (plan mode
+                    // is a read-only behavior mode the model self-imposes, NOT a security boundary; the real gates run on read
+                    // tools as usual). Short-circuit BEFORE runToolGate so a write-effect call in plan mode is rejected without
+                    // running policy/onAsk/probe/durable-mint. Unknown effect ⇒ "write" (fail-closed: gated in plan mode).
+                    //
+                    // NOT a security bypass (review): this short-circuit can only ADD a denial (for write-effect tools while
+                    // the model is in plan mode) — it never ALLOWS anything runToolGate would have denied. Net effect on a
+                    // write tool in plan mode = DENY, which is ≥ as restrictive as any policy/PreToolUse verdict. The only
+                    // thing skipped is the gate's SIDE EFFECTS (PreToolUse audit/arg-rewrite, reversibility probe) for a call
+                    // that DID NOT EXECUTE; the plan-block itself is recorded as the tool's error result. Deployments that
+                    // need every blocked write attempt to traverse their PreToolUse hook should not rely on plan mode for that.
+                    if (planModeRef.active && (toolEffects.get(e.toolName) ?? "write") !== "read") {
+                        if (blockedTracked)
+                            blockedToolCalls.add(e.toolCallId); // design/134 R3: a plan-mode deny is not an execution failure
+                        const planDenyReason = `Plan mode is active — "${e.toolName}" is a write/mutating tool and is read-only-blocked. ` +
+                            `Research with read-only tools, then call ${PRESENT_PLAN_TOOL_NAME} with your plan to get it approved before acting.`;
+                        // design/134 R5: the plan-mode write-deny is a PermissionDenied-domain outcome (R3 already scopes
+                        // it OUT of the post-tool callbacks) — the second of the two deny short-circuits the observer covers.
+                        if (notifyPermissionDenied) {
+                            // 1.256 复审 MED-1: clone the live args before the observe-only payload — a hook mutating
+                            // `payload.input` must never pollute the harness event's input object.
+                            await notifyPermissionDenied({ toolName: e.toolName, input: cloneObserverInput(e.input), toolCallId: e.toolCallId, reason: planDenyReason, source: "planMode" });
+                        }
+                        return {
+                            block: true,
+                            reason: formatHookFeedback(planDenyReason),
+                            preToolContext: [],
+                        };
+                    }
+                    const result = await runToolGate({
+                        event: e,
+                        preToolUse: hooks?.preToolUse,
+                        adjudicate,
+                        resolveAsk: resolveAskBound,
+                        suspendAsk,
+                        egress: egressTools.has(e.toolName), // design/70: the gate tightens allow→ask for these
+                        // design/77 §4: per-call irreversibility tier + probe (read from the spec at prepare-time,
+                        // captured here — not a tool argument the model can monkey-patch). The probe is time-bounded by
+                        // the task abort signal (its real deadline) and fails closed to `ask`.
+                        irreversibility: irreversibilityTier.get(e.toolName),
+                        reversibilityProbe: reversibilityProbes.get(e.toolName),
+                        abortSignal: abortController.signal,
+                        // design/134 R5: the deny observer (pre-wrapped, never throws) + the coarse-shellGate marker so
+                        // a tighten-deny on a shell-gated Bash/Monitor attributes to "shellGate" (not "safety").
+                        ...(notifyPermissionDenied ? { permissionDenied: notifyPermissionDenied } : {}),
+                        shellGated: (e.toolName === "Bash" && shellGatedBash) || (e.toolName === "Monitor" && shellGatedMonitor),
+                    });
+                    // Stash PreToolUse context only for calls that will EXECUTE: a blocked call skips the loop's
+                    // finalize step, so its `tool_result` hook never fires to drain the map — stashing it there would
+                    // both leak the entry and never deliver it (the block reason already carries the model-facing
+                    // text). A suspended call is likewise aborted, so don't stash it either.
+                    if (!result.block && !result.suspend && result.preToolContext.length > 0) {
+                        preToolContexts.set(e.toolCallId, result.preToolContext);
+                    }
+                    // design/134 R3: remember blocked/suspended ids so a tool_result carrying their error text
+                    // (if any path ever emits one) triggers neither post callback.
+                    if (blockedTracked && (result.block || result.suspend)) {
+                        blockedToolCalls.add(e.toolCallId);
+                    }
+                    // A suspend has already aborted the run inside `suspendAsk`; let the harness's own abort handling
+                    // produce the aborted result for this call (no block/updatedInput to return here).
+                    return result.block
+                        ? { block: true, reason: result.reason }
+                        : result.updatedInput !== undefined
+                            ? { updatedInput: result.updatedInput }
+                            : undefined;
+                });
+            }
+        }
+        // PostToolUse (design/37): rewrite the tool result content and/or append `<system-reminder>` context
+        // (both the hook's own `additionalContext` and any PreToolUse context stashed for this call).
+        // design/134 §2 (BREAKING): success/failure results are MUTUALLY EXCLUSIVE — an `isError` result
+        // fires postToolUseFailure ONLY (additionalContext-only, no rewrite), never postToolUse.
+        if (hooks?.postToolUse || hooks?.preToolUse || hooks?.postToolUseFailure) {
+            harness.on("tool_result", async (e) => {
+                // design/134 R3: a blocked/suspended call's result is a PermissionDenied-domain outcome, not a
+                // tool execution — fire NEITHER post callback. One-shot: consume the entry so it can't leak.
+                // (preToolContexts never stashes blocked calls, so there is nothing to drain here either.)
+                if (blockedToolCalls.delete(e.toolCallId)) {
+                    return undefined;
+                }
+                let content = e.content;
+                let changed = false;
+                if (e.isError) {
+                    if (hooks?.postToolUseFailure) {
+                        // design/134 复审 (codex MED): isolate the failure payload from the live result the loop
+                        // is about to commit — an element-level clone of `content` (a hook mutating a block's
+                        // `text` must not rewrite the transcript) and a best-effort deep clone of `details`
+                        // (non-cloneable graphs — functions/handles — fall back to the live reference; the
+                        // HookToolFailure.details contract documents that read-only expectation).
+                        let clonedDetails = e.details;
+                        try {
+                            clonedDetails = structuredClone(e.details);
+                        }
+                        catch {
+                            /* best-effort: pass the live reference for non-structured-cloneable details */
+                        }
+                        const patch = await hooks.postToolUseFailure(e.toolName, e.input, {
+                            error: e.content
+                                .filter((c) => c.type === "text")
+                                .map((c) => c.text)
+                                .join("\n"),
+                            // Wide any-abort semantics (⊇ CC is_interrupt, which is user-interrupt only): the task
+                            // abort signal covers timeout/budget/cancel/suspend too — documented on HookToolFailure.
+                            isInterrupt: abortController.signal.aborted || spec.signal?.aborted === true,
+                            // No durationMs: the harness tool_result event carries no execution-time field today,
+                            // and the design forbids adding a timer just for it.
+                            content: e.content.map((c) => ({ ...c })),
+                            details: clonedDetails,
+                        }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                        if (patch?.additionalContext) {
+                            content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
+                            changed = true;
+                        }
+                    }
+                }
+                else if (hooks?.postToolUse) {
+                    const patch = await hooks.postToolUse(e.toolName, e.input, { content: e.content, details: e.details, isError: e.isError }, { toolCallId: e.toolCallId, toolName: e.toolName });
+                    if (patch?.updatedOutput) {
+                        content = patch.updatedOutput;
+                        changed = true;
+                    }
+                    if (patch?.additionalContext) {
+                        content = [...content, { type: "text", text: formatHookFeedback(patch.additionalContext) }];
+                        changed = true;
+                    }
+                }
+                const pre = preToolContexts.get(e.toolCallId);
+                if (pre) {
+                    preToolContexts.delete(e.toolCallId); // one-shot: drain so it can't leak onto a later call
+                    content = [...content, ...pre.map((t) => ({ type: "text", text: formatHookFeedback(t) }))];
+                    changed = true;
+                }
+                return changed ? { content } : undefined;
+            });
+        }
+        // In-task context management, applied before each provider request (request-only, non-destructive):
+        //   0. per-message aggregate tool-result budget — cap a single turn's batch if N parallel results SUM
+        //      past 200K chars (design/64 §17.2; largest-first offload). Deterministic ⇒ cache-safe, resume-free.
+        //   1. context-editing — clear old tool-result *content* (lightest; keeps turn structure)
+        //   2. guard trim — if still over the hard budget, drop oldest messages at safe boundaries
+        // Between-task compaction (LLM summary) handles the normal long-conversation case.
+        const editAt = editBudget(model);
+        const guardAt = guardBudget(model);
+        // design/123 D2: the task model's structural coefficient — the request-layer defenses below and
+        // the prompt-overhead term must share ONE coordinate with the compaction trigger estimate.
+        const charsPerToken = model.charsPerToken ?? DEFAULT_CHARS_PER_TOKEN;
+        harness.on("context", async ({ messages }) => {
+            // audit A-1: heal pre-1.92 sessions that persisted a synthetic empty failure assistant inside an
+            // interrupted batch (API-invalid on strict providers; append-only sessions can't be rewritten).
+            const healed = dropEmptyFailureAssistants(messages);
+            const capped = await capAggregateToolResults(healed, {
+                store: offloadStore,
+                sessionId,
+                // service [398] C8: every capped result (offloaded or degraded to a self-contained preview)
+                // gets a metadata-only trace frame; storeFallback flags the lost-read-back face.
+                onCapped: (info) => emitTrace(deps.tracer, () => ({
+                    kind: "tool_result.capped",
+                    version: 1,
+                    taskId: spec.taskId ?? sessionId,
+                    ...(info.tool !== undefined ? { tool: info.tool } : {}),
+                    sizeChars: info.sizeChars,
+                    storeFallback: info.storeFallback,
+                    ts: Date.now(),
+                })),
+            });
+            // batch-C/§17.2: bound aggregate inline-media (image) bytes — the multimodal sibling of the text budget
+            // above (image reads accumulate across turns; per-image cap doesn't bound the SUM). Request-only.
+            const mediaCapped = capAggregateMediaBytes(capped, {
+                limitBytes: deps.mediaByteCapBytes ?? AGGREGATE_MEDIA_BUDGET_BYTES,
+                onStripped: deps.onMediaStripped,
+            });
+            const edited = clearStaleToolResults(mediaCapped, {
+                budgetTokens: editAt,
+                // design/123 D3: hand the defense the ANCHORED estimate of the processed messages (billed
+                // truth — the same coordinate the compaction trigger uses) plus the model's coefficient, so
+                // its gate and internal bookkeeping stop self-certifying via the chars/4 structural sum.
+                anchoredTotalTokens: estimateContextTokens(mediaCapped, charsPerToken).tokens,
+                charsPerToken,
+                // roadmap #6② (CC contentReplacementState parity): offload-then-clear — the cleared marker
+                // carries a ReadToolResult ref so the model can page a cleared result back. Deterministic
+                // ref (sessionId+toolCallId) + write-once put ⇒ the per-request re-clear stays byte-stable
+                // (prefix-cache safe). Only wired when offload is enabled (same store as the size cap above).
+                ...(offloadStore
+                    ? {
+                        offload: {
+                            persist: (toolCallId, fullText) => {
+                                const ref = `tr_${sessionId}_${toolCallId}`;
+                                void offloadStore.put(ref, fullText); // write-once; a repeat put is a no-op
+                                return ref;
+                            },
+                        },
+                    }
+                    : {}),
+            });
+            // design/123 D3: same anchored coordinate for the guard trim, re-estimated on the EDITED array
+            // (pre-anchor clears don't lower the anchored estimate — deliberately; see trimToBudget doc).
+            const trimmed = trimToBudget(edited, guardAt, estimateContextTokens(edited, charsPerToken).tokens, charsPerToken);
+            // design/123 D4: a REAL message drop by the trim (shorter output — content-only clears keep the
+            // length) means the request layer was forced to discard history → arm the trim-pressure flag so
+            // the next turn boundary force-compacts (see Prepared.trimPressureRef).
+            if (trimmed.length < edited.length) {
+                trimPressureRef.droppedMessages = true;
+                // service [398] C9: the model didn't see these messages THIS turn (request-only drop) —
+                // previously only the D4 pressure flag knew, and only indirectly via the next compaction.
+                emitTrace(deps.tracer, () => ({
+                    kind: "context.trim",
+                    version: 1,
+                    taskId: spec.taskId ?? sessionId,
+                    dropped: edited.length - trimmed.length,
+                    ts: Date.now(),
+                }));
+            }
+            // design/123 D3 belt (invariant, live-caught 16k 400s): NO pipeline combination may ship an
+            // orphan toolResult to the provider ("role 'tool' must respond to tool_calls" is a strict-
+            // gateway hard 400). Producers are individually turn-aligned; this is the last line. An actual
+            // drop indicates a producer bug — surface it via onError with attribution detail.
+            const swept = dropOrphanToolResults(trimmed);
+            if (swept.dropped.length > 0) {
+                try {
+                    deps.onError?.(new Error(`context belt: dropped ${swept.dropped.length} orphan toolResult(s) whose tool-call assistant was not in the request view — ` +
+                        swept.dropped
+                            .map((d) => `toolCallId=${d.toolCallId} at index ${d.index} (prev=${d.prevRole}, next=${d.nextRole})`)
+                            .join("; ")), { phase: "hook", sessionId });
+                }
+                catch {
+                    /* a throwing onError must never break the request build */
+                }
+            }
+            return { messages: swept.messages };
+        });
+        // Two-phase cache-break detection (design/31): default on. Fingerprints the prefix (system + the tools
+        // ACTUALLY sent — placeholders included) here; `tool_search` refreshes `cacheFingerprint.tools` in place
+        // when it materializes a deferred tool (design/36 blocker #2), so the detector never goes blind to a
+        // mid-task tool-schema change. The run loop feeds per-turn cacheRead + the served modelKey.
+        const cacheBreakDetector = deps.cacheBreakDetection === false ? undefined : new CacheBreakDetector();
+        const cacheFingerprint = cacheBreakDetector
+            ? { systemPrompt, tools: toolsToFingerprintInputs(harnessTools) }
+            : undefined;
+        fpRef.current = cacheFingerprint;
+        // Fixed prompt overhead for the compaction trigger's anchor-less regime (design/64 §26.7): the
+        // chars/4 fallback sees messages only; system prompt + tool schemas are billed on every request.
+        // design/123 D2: divided by the model's charsPerToken (not a hard /4) — this term is ADDED to the
+        // anchor-less trigger estimate, so it must share that estimate's structural coordinate.
+        const promptOverheadTokens = Math.ceil((systemPrompt.length +
+            harnessTools.reduce((a, t) => a + t.name.length + (t.description?.length ?? 0) + JSON.stringify(t.parameters ?? {}).length, 0)) / charsPerToken);
+        // Working-file attachments reader (LONGRUN-2): same env as the hands, so attachments are read
+        // from the workspace the task actually modified. Best-effort by contract — errors become null.
+        // 编码 parity 批 (codex 镜头1 MED): SAME decode coordinate as the Read tool — a BOM'd UTF-16 file
+        // the model read as clean text must not re-enter the compaction summary as utf8 mojibake (the
+        // summary tells the model to TRUST attachment content); a malformed body degrades to null.
+        const readTaskFile = handsEnabled
+            ? async (path) => {
+                try {
+                    const r = await executionEnv.readBinaryFile(path);
+                    if (!r.ok)
+                        return null;
+                    const d = decodeTextBytes(r.value);
+                    return d.malformed ? null : d.text;
+                }
+                catch {
+                    return null;
+                }
+            }
+            : undefined;
+        // CC post-compact restore parity (blackboard 2026-07-03): most-recently-READ files, newest first.
+        // Closure over the live readFileState — evaluated AT COMPACTION TIME, so it reflects reads up to
+        // that boundary. Entries without lastReadAt (seeded from an older design/45 checkpoint) sort last.
+        const recentlyReadFiles = handsEnabled && readFileStateForCheckpoint
+            ? () => [...readFileStateForCheckpoint.entries()]
+                .sort((a, b) => (b[1].lastReadAt ?? 0) - (a[1].lastReadAt ?? 0))
+                .map(([path]) => path)
+            : undefined;
+        // design/133 F5 (CC getChangedFiles 同构): boundary-time stat over the most-recently-read files.
+        // Lives HERE (not the run loop) because readFileState + the hands' env are prepare-task closures;
+        // the run loop only decides WHEN (opt-in + boundary gate). Judged against `lastReadAt` + EPS —
+        // no new ReadEntry field, hot read/write paths do zero extra stats, and the agent's own
+        // write-backs are immune because every fs write site already refreshes lastReadAt. Entries
+        // without lastReadAt (old-checkpoint seeds) can't be compared ⇒ skipped, never false-fired.
+        const detectExternalChanges = handsEnabled && readFileStateForCheckpoint
+            ? async (maxFiles) => {
+                const candidates = [...readFileStateForCheckpoint.entries()]
+                    .filter(([, e]) => e.lastReadAt !== undefined)
+                    .sort((a, b) => (b[1].lastReadAt ?? 0) - (a[1].lastReadAt ?? 0))
+                    .slice(0, Math.max(0, maxFiles));
+                const changed = [];
+                const evicted = [];
+                for (const [path, entry] of candidates) {
+                    try {
+                        const info = await executionEnv.fileInfo(path, abortController.signal);
+                        if (!info.ok) {
+                            // CC evict-only-on-ENOENT (attachments.ts:2146-2155 / PR #18525): an atomic-save race,
+                            // EACCES churn or a network-fs hiccup must NOT evict, or the next Edit fails "not read"
+                            // while the file still exists. Only a true not_found deletes the entry.
+                            if (info.error.code === "not_found") {
+                                readFileStateForCheckpoint.delete(path);
+                                evicted.push(path);
+                            }
+                            continue;
+                        }
+                        if (info.value.mtimeMs > (entry.lastReadAt ?? 0) + CHANGED_FILES_MTIME_EPS_MS) {
+                            changed.push({ path, mtimeMs: info.value.mtimeMs });
+                        }
+                    }
+                    catch {
+                        /* best-effort scan: a throwing env must never fault the turn boundary */
+                    }
+                }
+                return { changed, evicted };
+            }
+            : undefined;
+        // G1 通告层 [482]: post-compact background-task snapshot — the SAME identity triple the
+        // TaskOutput/TaskStop tool mounts use (hostTaskId/taskScope/sessionId), so the announce surface
+        // can never see a task the model's own tools couldn't reach. Bounded projection, pending/running
+        // only (a terminal task needs no post-compact continuity note — its completion notification
+        // already rode the task_notification lane).
+        const listBackgroundTasks = () => defaultTaskRegistry
+            .list({ owner: hostTaskId, scope: taskScope, sessionId })
+            .filter((t) => t.status === "pending" || t.status === "running")
+            .map((t) => ({ id: t.task_id, ...(t.description !== undefined ? { description: t.description } : {}), status: t.status }));
+        return { harness, session, sessionId, taskRootPath, model, thinking, compModel, mcp, blockedRef, outputRef, abortController, conflictRef, blockedToolCalls, nestedStats, cwdRef: handsCwdRef, denyNarrowingPolicy, releaseSignal, cacheBreakDetector, cacheFingerprint, promptManifest, activeTools, ownedEnv, suspendRef, reviewRef, reviewRequestRef, suspendLoopRef, suspendForResource, ...(callCapRef ? { callCapRef } : {}), suspendForReview, resourceLedger: priorLedger, liveSpendRef, humanReviewRef, now, tools, toolEffects, promptOverheadTokens, readTaskFile, recentlyReadFiles, compactionReuseRef, trimPressureRef, ...(memoryEngineSession ? { memoryEngineSession } : {}), ...(subagentRetain ? { subagentRetain } : {}), ...(lspDiagnostics && nudgeLspOnEdit ? { lspDiagnostics: { registry: lspDiagnostics, nudge: nudgeLspOnEdit } } : {}), planModeRef, ...(detectExternalChanges ? { detectExternalChanges } : {}), ...(toolsDeltaRef ? { toolsDeltaRef } : {}), ...(agentListing ? { agentListing } : {}), listBackgroundTasks };
+    }
+    catch (prepareErr) {
+        // P-8: dispose disposables in REVERSE acquisition order, each best-effort + independent so one failure neither
+        // masks prepareErr nor blocks the others. mcp (acquired after ownedEnv) first; the `if (mcp)` guard skips a
+        // pre-materialize throw (mcp still undefined). NEVER on the success path — there runtask owns prepared.mcp.dispose().
+        if (mcp) {
+            try {
+                await mcp.dispose();
+            }
+            catch {
+                /* best-effort; closing MCP clients must not mask the prepare error */
+            }
+        }
+        if (ownedEnv && hasDestroy(ownedEnv)) {
+            try {
+                await ownedEnv.destroy();
+            }
+            catch {
+                /* best-effort teardown; the service reaper is the backstop */
+            }
+        }
+        await forgetOnThrow(); // 1.93.0 throw-cleanup: the caller can never release what it never received
+        throw prepareErr;
+    }
+}
+//# sourceMappingURL=prepare-task.js.map