@sweny-ai/core 0.1.178 → 0.1.179

package/dist/journal.js

@@ -2,23 +2,42 @@
  * Run journal (#363): an append-only log of one workflow run, enough to resume
  * a killed or failed run without re-running the nodes that already finished.
  *
- * File: `.sweny/runs/<run-id>/journal.ndjson` (mode 0600), one JSON record per
- * line. Every record carries the format version (`v`), a sequence number (`seq`)
- * and an authentication code (`h`, HMAC-SHA256 of the record without `h`, under
- * a per-run key). Each append is written and fsync'd before the executor moves
- * on, so a record on disk is a fact.
+ * Location: the journal never lives in the workspace. Each run gets a private
+ * directory in the user's sweny state dir (`$SWENY_STATE_DIR`, else
+ * `$XDG_STATE_HOME/sweny`, else `~/.local/state/sweny`):
  *
- * Integrity: the key is 32 random bytes made when the run starts and kept
- * OUTSIDE the workspace, in the user's sweny state dir
- * (`$SWENY_STATE_DIR`, else `$XDG_STATE_HOME/sweny`, else
- * `~/.local/state/sweny`), under `run-keys/` (dir 0700, file 0600). Anything
- * that can write the workspace but not that dir (an agent confined to the
- * workspace, a checked-out branch, an artifact) cannot mint a record resume
- * accepts. Both sandboxes deny reading the key dir; an unsandboxed agent
- * running as the same OS user can still read it, which is why resume also
- * checks the record sequence (see {@link buildResumePlan}) and every replayed
- * route against the workflow's real edges. A resume on another machine needs
- * the same state dir.
+ *   runs/<workspace-hash>/<run-id>/   (dirs 0700, files 0600, opened O_NOFOLLOW)
+ *     key             32 random bytes, the run's HMAC key
+ *     journal.ndjson  one JSON record per line, fsync'd per append
+ *     head.json       the record being appended, written (atomically) first
+ *     meta.json       run id, workspace hash, creation time; authenticated, drives retention
+ *     lock            the process that owns the run (pid + start time)
+ *
+ * Both agent sandboxes deny reading AND writing the whole `runs/` tree, so an
+ * agent confined to the workspace cannot read the key, edit or cut the
+ * journal, delete the lock or fake a run. The workspace keeps only user-facing
+ * artifacts (`.sweny/runs/<run-id>/output.md` and the run history record).
+ * Journals an older sweny wrote in the workspace are refused for resume.
+ *
+ * Integrity: every record carries the format version (`v`), a sequence number
+ * (`seq`) and `h`, an HMAC-SHA256 under the run key over the run id, the seq,
+ * the previous record's `h` and the record body. The chain means records
+ * cannot be reordered, duplicated, or spliced in from another run. The head
+ * file holds the full record being appended, written and renamed into place
+ * BEFORE the journal append: a crash between the two leaves a journal exactly
+ * one record short, and resume restores that record from the head. A journal
+ * shorter than that, or one that disagrees with the head, is refused, so the
+ * end of the journal cannot be cut away even by something that can write the
+ * state dir but not read the key.
+ *
+ * All of this holds only for an agent under an enforced sandbox. An
+ * unsandboxed agent running as the same OS user can read the key and rewrite
+ * the state dir. Each such visit is journaled (`agent:unsandboxed`), and a
+ * resume of that run warns and marks the receipt `journal_unsandboxed`.
+ * Resume also checks the record sequence (see {@link buildResumePlan}) and
+ * every replayed route against the workflow's real edges. A state dir whose
+ * real path is inside the workspace is refused. A resume on another machine
+ * needs the same state dir.
  *
  * Records, in run order:
  *   run:start        workflow / instruction / input / tool hashes, harness id, input (redacted)
@@ -30,17 +49,31 @@
  *   output:applied   the write returned (key + the ids it produced)
  *   node:end         final result of the visit and the write-stage counters
  *   route            the edge taken after the visit (null = the run ended), and the rung that chose it
- *   usage            spend of one agent attempt (cumulative; live while it runs, final when it returns)
+ *   usage            spend of one agent attempt (cumulative; one per model turn that raised it, written
+ *                    synchronously, and the final figure when the attempt returns)
+ *   agent:unsandboxed the visit's agent ran without an enforced sandbox
  *   run:end          success | failed | crashed
  *
+ * Failure: an append that cannot be written (head or journal) is fatal. The
+ * executor stops the run before the next model call or side effect and fails
+ * the node with the reason, so a resume never under-counts spend or repeats a
+ * write the journal did not see.
+ *
  * Spend: a resume seeds the run budget with every attempt's journaled usage,
- * so a crash never resets the whole-run ceiling.
+ * from authenticated records only, so a crash never resets the whole-run ceiling.
  *
- * Recovery: a torn or corrupt tail (power loss mid-append) is truncated back to
- * the last valid record. Corruption in the middle of the file is refused.
+ * Recovery: an unterminated tail that is not complete JSON (power loss
+ * mid-append) is truncated. An unterminated tail that IS complete JSON is
+ * never assumed torn: it must authenticate as the next record, or the journal
+ * is refused. Corruption in the middle of the file is refused.
  *
- * Privacy: the journal is local and holds what the run needs to continue (node
- * data, eval verdicts, safe-output intents). It never holds environment values:
+ * Lock: taken with O_CREAT|O_EXCL before anything is read or repaired, and
+ * held for the whole run or resume. A lock whose process is gone (pid not
+ * alive, or alive with a different start time) is taken over under a
+ * second exclusive lock, re-checked first, so two resumes cannot both win.
+ *
+ * Privacy: the journal holds what the run needs to continue (node data, eval
+ * verdicts, safe-output intents). It never holds environment values:
  * secret-looking keys, known token shapes, and the values of secret env vars
  * and skill credentials are replaced with `[redacted]` before anything is
  * written. Tool call inputs and outputs are not journaled.
@@ -59,13 +92,19 @@ import path from "node:path";
 import { resolveNodePermissions } from "./node-policy.js";
 import { CURRENT_SPEC_VERSION } from "./migrations.js";
 import { spendOf } from "./budget.js";
-import { ensureDirNoFollow, openNoFollow, writeFileNoFollow } from "./safe-file.js";
-/** v2: records are authenticated with a per-run HMAC key (v1 used a public checksum and is refused). */
-export const JOURNAL_SCHEMA_VERSION = 2;
-export const JOURNAL_DIR = path.join(".sweny", "runs");
+/**
+ * v3: each record's HMAC chains the run id and the previous record's HMAC.
+ * (v2 authenticated records one by one; v1 used a public checksum. Both are refused.)
+ */
+export const JOURNAL_SCHEMA_VERSION = 3;
+/** Where journals lived before v3: in the workspace. Never read for resume, only recognized to refuse. */
+export const LEGACY_JOURNAL_DIR = path.join(".sweny", "runs");
 export const JOURNAL_FILE = "journal.ndjson";
-const LOCK_FILE = "journal.lock";
-/** Journals kept on disk; the oldest beyond this are deleted when a new run starts. */
+const KEY_FILE = "key";
+const HEAD_FILE = "head.json";
+const META_FILE = "meta.json";
+const LOCK_FILE = "lock";
+/** Journals kept per workspace; the oldest beyond this are deleted when a new run starts. */
 export const JOURNAL_KEEP = 20;
 export const REDACTED = "[redacted]";
 const RUN_ID_RE = /^\d{8}-\d{6}-[0-9a-f]{6}$/;
@@ -153,7 +192,7 @@ export function toolsHash(skills, swenyVersion, harnessId, secrets = []) {
 function recordMac(key, body) {
     return crypto.createHmac("sha256", key).update(body).digest("hex");
 }
-// ─── Run keys ─────────────────────────────────────────────────────
+// ─── State dir layout ─────────────────────────────────────────────
 /** sweny's per-user state dir: `$SWENY_STATE_DIR`, else `$XDG_STATE_HOME/sweny`, else `~/.local/state/sweny`. */
 export function swenyStateDir(env = process.env) {
     if (env.SWENY_STATE_DIR && env.SWENY_STATE_DIR.trim() !== "")
@@ -162,9 +201,9 @@ export function swenyStateDir(env = process.env) {
     const base = xdg && path.isAbsolute(xdg) ? xdg : path.join(os.homedir(), ".local", "state");
     return path.join(base, "sweny");
 }
-/** Where run keys live. Never inside the workspace. */
-export function runKeyDir(env = process.env) {
-    return path.join(swenyStateDir(env), "run-keys");
+/** Where every run journal (and its key, head, meta and lock) lives. Agents can neither read nor write it. */
+export function runStateRoot(env = process.env) {
+    return path.join(swenyStateDir(env), "runs");
 }
 function realOr(p) {
     try {
@@ -174,10 +213,93 @@ function realOr(p) {
         return path.resolve(p);
     }
 }
-/** The key file for one run in one workspace (the workspace path is hashed, not stored). */
-export function runKeyFile(cwd, runId, keyDir = runKeyDir()) {
-    const scope = sha256(realOr(cwd)).slice(0, 16);
-    return path.join(keyDir, `${scope}-${runId}.key`);
+/** The workspace's directory name under {@link runStateRoot}: its real path hashed, never stored. */
+export function workspaceScope(cwd) {
+    return sha256(realOr(cwd)).slice(0, 16);
+}
+/** One run's private directory: `<state>/runs/<workspace-hash>/<run-id>/`. */
+export function journalDir(cwd, runId, root = runStateRoot()) {
+    return path.join(root, workspaceScope(cwd), runId);
+}
+/** The run's key file (inside its private directory). */
+export function runKeyFile(cwd, runId, root = runStateRoot()) {
+    return path.join(journalDir(cwd, runId, root), KEY_FILE);
+}
+const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+/** Read a file without following a symlink at its last component. */
+function readNoFollow(file) {
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | NOFOLLOW);
+    try {
+        return fs.readFileSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** Create a new file (never an existing one, never through a symlink), write it and fsync it. */
+function writeNew(file, data) {
+    const c = fs.constants;
+    const fd = fs.openSync(file, c.O_WRONLY | c.O_CREAT | c.O_EXCL | NOFOLLOW, 0o600);
+    try {
+        fs.writeSync(fd, data);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function fsyncDir(dir) {
+    try {
+        const fd = fs.openSync(dir, "r");
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        // Not every platform can fsync a directory.
+    }
+}
+/** Replace a file atomically: write a new temp file, fsync, rename over, fsync the dir. */
+function writeAtomic(file, data) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.rmSync(tmp, { force: true });
+    try {
+        writeNew(tmp, data);
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+    fsyncDir(path.dirname(file));
+}
+/** Make a run's private directory (and its parents) 0700. */
+function makePrivateDir(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+}
+/** Thrown when the journal's state dir resolves into the workspace, where an agent could edit it. */
+export class JournalLocationError extends Error {
+    constructor(dir, cwd) {
+        super(`the run journal's state dir ${dir} resolves inside the workspace ${cwd}, where an agent can edit it. ` +
+            `Set SWENY_STATE_DIR to a dir outside the workspace, or pass --no-journal (the run then cannot be resumed)`);
+        this.name = "JournalLocationError";
+    }
+}
+/**
+ * Refuse a state dir that resolves into the workspace. Real paths are compared
+ * (the dir must exist), so a symlink anywhere in either chain counts as where
+ * it points. Throws {@link JournalLocationError}.
+ */
+export function assertStateOutsideWorkspace(dir, cwd) {
+    const real = fs.realpathSync(dir);
+    const ws = fs.realpathSync(cwd);
+    if (real === ws || real.startsWith(ws.endsWith(path.sep) ? ws : ws + path.sep)) {
+        throw new JournalLocationError(real, ws);
+    }
 }
 /** Thrown when a journal's key is missing or unreadable: its records cannot be checked. */
 export class JournalKeyError extends Error {
@@ -189,16 +311,14 @@ export class JournalKeyError extends Error {
 }
 function createRunKey(file) {
     const key = crypto.randomBytes(32);
-    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(file, key.toString("hex") + "\n", { mode: 0o600 });
-    fs.chmodSync(file, 0o600);
+    writeNew(file, key.toString("hex") + "\n");
     return key;
 }
 /** Read a run key. Throws {@link JournalKeyError}. */
 export function loadRunKey(file) {
     let text;
     try {
-        text = fs.readFileSync(file, "utf-8").trim();
+        text = readNoFollow(file).toString("utf-8").trim();
     }
     catch {
         throw new JournalKeyError(file, "missing");
@@ -207,6 +327,225 @@ export function loadRunKey(file) {
         throw new JournalKeyError(file, "not a valid key");
     return Buffer.from(text, "hex");
 }
+/** MAC of one record: run id, seq and the previous record's MAC chained in, so records cannot move. */
+function chainMac(key, runId, seq, prev, body) {
+    return recordMac(key, `sweny-journal\n${runId}\n${seq}\n${prev}\n${JSON.stringify(body)}`);
+}
+/** MAC of a side file (head, meta): domain-separated from records. */
+function sideMac(key, kind, body) {
+    return recordMac(key, `sweny-journal-${kind}\n${JSON.stringify(body)}`);
+}
+function sameMac(given, expected) {
+    if (typeof given !== "string" || !/^[0-9a-f]{64}$/.test(given))
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(given, "hex"), Buffer.from(expected, "hex"));
+}
+/** Thrown when the journal is shorter than, or disagrees with, the record its head file holds. */
+export class JournalRollbackError extends Error {
+    constructor(message) {
+        super(`${message}. Refusing to resume (not overridable by --force); start a new run.`);
+        this.name = "JournalRollbackError";
+    }
+}
+const SIDE_VERSION = 1;
+function writeJournalHead(dir, key, runId, head) {
+    const body = { v: SIDE_VERSION, run_id: runId, seq: head.seq, record: head.record };
+    writeAtomic(path.join(dir, HEAD_FILE), JSON.stringify({ ...body, h: sideMac(key, "head", body) }) + "\n");
+}
+/** Read and authenticate a run's head file. Throws {@link JournalRollbackError}. */
+export function loadJournalHead(dir, key, runId) {
+    const file = path.join(dir, HEAD_FILE);
+    let text;
+    try {
+        text = readNoFollow(file).toString("utf-8");
+    }
+    catch {
+        throw new JournalRollbackError(`cannot check the run journal's length: its head file ${file} is missing`);
+    }
+    const invalid = () => new JournalRollbackError(`the run journal's head file ${file} is not valid`);
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw invalid();
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw invalid();
+    const { h, ...body } = parsed;
+    if (!sameMac(h, sideMac(key, "head", body)))
+        throw invalid();
+    const { v, run_id, seq, record } = body;
+    if (v !== SIDE_VERSION || run_id !== runId)
+        throw invalid();
+    if (typeof seq !== "number" || !Number.isInteger(seq) || seq < 0)
+        throw invalid();
+    if (seq === 0 ? record !== null : !record || typeof record !== "object" || Array.isArray(record))
+        throw invalid();
+    return { seq, record: record };
+}
+function writeRunMeta(dir, key, runId, scope) {
+    const body = { v: SIDE_VERSION, run_id: runId, scope, created_at: new Date().toISOString() };
+    writeNew(path.join(dir, META_FILE), JSON.stringify({ ...body, h: sideMac(key, "meta", body) }) + "\n");
+}
+/** A run's authenticated metadata, or undefined when it is missing, unreadable or not this run's. */
+function loadRunMeta(dir, runId, scope) {
+    try {
+        const key = loadRunKey(path.join(dir, KEY_FILE));
+        const parsed = JSON.parse(readNoFollow(path.join(dir, META_FILE)).toString("utf-8"));
+        const { h, ...body } = parsed;
+        if (!sameMac(h, sideMac(key, "meta", body)))
+            return undefined;
+        if (body.v !== SIDE_VERSION || body.run_id !== runId || body.scope !== scope)
+            return undefined;
+        if (typeof body.created_at !== "string" || Number.isNaN(Date.parse(body.created_at)))
+            return undefined;
+        return { runId, createdAt: body.created_at };
+    }
+    catch {
+        return undefined;
+    }
+}
+// ─── Lock ─────────────────────────────────────────────────────────
+/** Thrown when another live process holds the run. */
+export class JournalLockedError extends Error {
+    pid;
+    constructor(pid) {
+        super(`run journal is in use by process ${pid}; wait for it to finish (or stop it) before resuming`);
+        this.pid = pid;
+        this.name = "JournalLockedError";
+    }
+}
+/** Start time (ms since epoch) of a process, where the OS exposes it cheaply (Linux); else undefined. */
+export function processStartTime(pid) {
+    if (process.platform !== "linux")
+        return undefined;
+    try {
+        const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf-8");
+        const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+        const ticks = Number(fields[19]);
+        const btime = Number(/^btime (\d+)$/m.exec(fs.readFileSync("/proc/stat", "utf-8"))?.[1]);
+        if (!Number.isFinite(ticks) || !Number.isFinite(btime))
+            return undefined;
+        return btime * 1000 + ticks * 10;
+    }
+    catch {
+        return undefined;
+    }
+}
+const SELF_STARTED = processStartTime(process.pid) ?? Math.round(Date.now() - process.uptime() * 1000);
+/** Start times are compared with this much slack (clock ticks, boot time rounding). */
+const START_SLACK_MS = 5000;
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === "EPERM";
+    }
+}
+function parseHolder(raw) {
+    try {
+        const p = JSON.parse(raw);
+        if (!Number.isInteger(p.pid) || p.pid <= 0 || typeof p.started !== "number")
+            return undefined;
+        return { pid: p.pid, started: p.started };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Is the process that wrote this lock still running? A reused pid (other
+ * start time) is not. Where the start time is not available (macOS, Windows),
+ * any live process with that pid counts as the holder: a reused pid errs
+ * toward refusing the resume, never toward two processes sharing the run.
+ */
+function holderAlive(h) {
+    if (h.pid === process.pid)
+        return Math.abs(h.started - SELF_STARTED) <= START_SLACK_MS;
+    if (!pidAlive(h.pid))
+        return false;
+    const started = processStartTime(h.pid);
+    return started === undefined || Math.abs(started - h.started) <= START_SLACK_MS;
+}
+function readText(file) {
+    try {
+        return readNoFollow(file).toString("utf-8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A takeover lock older than this belongs to a process that died mid-takeover. */
+const TAKEOVER_STALE_MS = 10_000;
+/**
+ * Take a run's lock: O_CREAT|O_EXCL in the run's private dir. A lock whose
+ * process is gone is taken over under a second exclusive lock, and only if it
+ * still holds the exact bytes judged stale, so two processes racing for a
+ * stale lock cannot both win. Throws {@link JournalLockedError}.
+ */
+export function acquireRunLock(dir, hooks = {}) {
+    const file = path.join(dir, LOCK_FILE);
+    const mine = JSON.stringify({
+        pid: process.pid,
+        started: SELF_STARTED,
+        nonce: crypto.randomBytes(8).toString("hex"),
+    });
+    let lastPid = 0;
+    for (let attempt = 0; attempt < 4; attempt++) {
+        try {
+            writeNew(file, mine);
+            return {
+                file,
+                release() {
+                    // Only ever remove our own lock.
+                    if (readText(file) === mine)
+                        fs.rmSync(file, { force: true });
+                },
+            };
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+        }
+        const stale = readText(file);
+        if (stale === undefined)
+            continue; // released meanwhile: try again
+        const holder = parseHolder(stale);
+        if (holder)
+            lastPid = holder.pid;
+        if (holder && holderAlive(holder))
+            throw new JournalLockedError(holder.pid);
+        hooks.afterStaleRead?.();
+        const takeover = `${file}.takeover`;
+        try {
+            writeNew(takeover, mine);
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            try {
+                if (Date.now() - fs.lstatSync(takeover).mtimeMs > TAKEOVER_STALE_MS)
+                    fs.rmSync(takeover, { force: true });
+            }
+            catch {
+                // gone already
+            }
+            continue;
+        }
+        try {
+            // Re-read under the takeover lock: remove it only if nobody replaced it since.
+            if (readText(file) === stale)
+                fs.rmSync(file, { force: true });
+        }
+        finally {
+            fs.rmSync(takeover, { force: true });
+        }
+    }
+    throw new JournalLockedError(lastPid);
+}
 // ─── Redaction ────────────────────────────────────────────────────
 const SECRET_KEY_PARTS = [
     "token",
@@ -314,7 +653,7 @@ export function redact(value, secrets = []) {
 export class JournalVersionError extends Error {
     constructor(version) {
         super(typeof version === "number" && version < JOURNAL_SCHEMA_VERSION
-            ? `run journal format v${version} predates authenticated records (v${JOURNAL_SCHEMA_VERSION}); it cannot be ` +
+            ? `run journal format v${version} predates chained records (v${JOURNAL_SCHEMA_VERSION}); it cannot be ` +
                 `resumed safely. Start a new run.`
             : `run journal format v${String(version)} is newer than this sweny understands (v${JOURNAL_SCHEMA_VERSION}); upgrade sweny to resume it`);
         this.name = "JournalVersionError";
@@ -337,14 +676,15 @@ export class JournalMismatchError extends Error {
         this.name = "JournalMismatchError";
     }
 }
-/** Thrown when another live process holds the run's journal. */
-export class JournalLockedError extends Error {
-    constructor(pid) {
-        super(`run journal is in use by process ${pid}; wait for it to finish (or stop it) before resuming`);
-        this.name = "JournalLockedError";
+/** Thrown when the journal cannot be written. Fatal: the executor stops the run before anything else happens. */
+export class JournalWriteError extends Error {
+    constructor(message) {
+        super(`run journal: ${message}; the run stopped so a resume cannot lose spend or repeat a write`);
+        this.name = "JournalWriteError";
     }
 }
-function verifyLine(line, expectedSeq, key) {
+/** Check one line as record `expectedSeq` following a record whose MAC is `prev`. Undefined = not complete JSON. */
+function verifyLine(line, expectedSeq, prev, runId, key) {
     let parsed;
     try {
         parsed = JSON.parse(line);
@@ -352,30 +692,24 @@ function verifyLine(line, expectedSeq, key) {
     catch {
         return undefined;
     }
+    // Complete JSON is never a torn append (no strict prefix of a record parses):
+    // from here on, anything that is not this run's next record is refused.
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
-        return undefined;
+        return "forged";
     const rec = parsed;
     if (typeof rec.v === "number" && rec.v !== JOURNAL_SCHEMA_VERSION && expectedSeq === 1)
         return "version";
     if (typeof rec.v === "number" && rec.v > JOURNAL_SCHEMA_VERSION)
         return "version";
     if (rec.v !== JOURNAL_SCHEMA_VERSION || typeof rec.type !== "string" || typeof rec.h !== "string")
-        return undefined;
-    const { h, ...body } = rec;
-    const expected = Buffer.from(recordMac(key(), JSON.stringify(body)), "hex");
-    const given = /^[0-9a-f]{64}$/.test(h) ? Buffer.from(h, "hex") : Buffer.alloc(0);
-    // A whole, well-formed line that fails its MAC is tampering, not a torn append.
-    if (given.length !== expected.length || !crypto.timingSafeEqual(given, expected))
         return "forged";
     if (rec.seq !== expectedSeq)
         return "forged";
+    const { h, ...body } = rec;
+    if (!sameMac(h, chainMac(key(), runId, expectedSeq, prev, body)))
+        return "forged";
     return rec;
 }
-/** `<cwd>/.sweny/runs/<run-id>/journal.ndjson` -> cwd and run id. */
-function journalLocation(file) {
-    const runDir = path.dirname(path.resolve(file));
-    return { runId: path.basename(runDir), cwd: path.dirname(path.dirname(path.dirname(runDir))) };
-}
 function looksLikeRecord(text) {
     try {
         const p = JSON.parse(text);
@@ -386,73 +720,118 @@ function looksLikeRecord(text) {
     }
 }
 /**
- * Read a journal. With `repair`, a torn tail is truncated on disk back to the
- * last valid record. Records are authenticated with the run's key (`key`, else
- * loaded from the state dir for the run the path names). Throws
- * {@link JournalVersionError} for another format and {@link JournalKeyError}
- * when the key is missing.
+ * Read a journal from a run's private directory. Records are authenticated
+ * and chained with the run key, then checked against the head: the journal
+ * must end at the head's record, or one short of it (then that record is
+ * restored from the head). Only an unterminated final segment that is not
+ * complete JSON is a torn append; with `repair` it is cut. Throws
+ * {@link JournalVersionError} for another format, {@link JournalKeyError}
+ * when the key is missing and {@link JournalRollbackError} when the journal
+ * was cut back or does not match its head.
  */
 export function readJournal(file, opts = {}) {
-    const buf = fs.readFileSync(file);
+    const dir = path.dirname(path.resolve(file));
+    const runId = opts.runId ?? path.basename(dir);
+    const buf = readNoFollow(file);
     let key = opts.key;
     const getKey = () => {
-        if (!key) {
-            const { cwd, runId } = journalLocation(file);
-            key = loadRunKey(runKeyFile(cwd, runId, opts.keyDir ?? runKeyDir()));
-        }
+        key ??= loadRunKey(path.join(dir, KEY_FILE));
         return key;
     };
     const records = [];
+    const prevMac = () => (records.length > 0 ? records[records.length - 1].h : "");
     let offset = 0;
     let validBytes = 0;
     let line = 0;
     let firstBad;
     let corruptAtLine;
     let forgedAtLine;
+    let missingNewline = false;
+    const forged = (at) => {
+        firstBad = at;
+        corruptAtLine = at;
+        forgedAtLine = at;
+    };
     while (offset < buf.length) {
         const nl = buf.indexOf(0x0a, offset);
         line++;
-        if (nl === -1) {
-            // A final segment without a newline is a torn append, whatever it parses as.
-            firstBad ??= line;
-            break;
+        const end = nl === -1 ? buf.length : nl;
+        const text = buf.subarray(offset, end).toString("utf-8");
+        offset = end + 1;
+        if (firstBad !== undefined) {
+            // A well-formed record after a bad line: the damage is not a torn tail.
+            if (corruptAtLine === undefined && looksLikeRecord(text))
+                corruptAtLine = firstBad;
+            continue;
         }
-        const text = buf.subarray(offset, nl).toString("utf-8");
-        offset = nl + 1;
-        if (firstBad === undefined) {
-            const rec = verifyLine(text, records.length + 1, getKey);
-            if (rec === "version")
-                throw new JournalVersionError(JSON.parse(text).v);
-            if (rec === "forged") {
-                firstBad = line;
-                corruptAtLine = line;
-                forgedAtLine = line;
-            }
-            else if (rec) {
-                records.push(rec);
-                validBytes = offset;
-            }
-            else {
-                firstBad = line;
+        const rec = verifyLine(text, records.length + 1, prevMac(), runId, getKey);
+        if (rec === "version")
+            throw new JournalVersionError(JSON.parse(text).v);
+        if (rec === "forged")
+            forged(line);
+        else if (rec === undefined)
+            firstBad = line;
+        else {
+            records.push(rec);
+            validBytes = Math.min(offset, buf.length);
+            // Complete JSON without its line end is the next record, authenticated like any other.
+            if (nl === -1)
+                missingNewline = true;
+        }
+    }
+    const truncatedBytes = buf.length - validBytes;
+    let restored;
+    if (corruptAtLine === undefined && opts.head !== false) {
+        const head = opts.head ?? loadJournalHead(dir, getKey(), runId);
+        const n = records.length;
+        if (n === head.seq - 1 && head.record) {
+            // A crash after the head was written, before the journal append: the record is in the head.
+            const rec = verifyLine(JSON.stringify(head.record), head.seq, prevMac(), runId, getKey);
+            if (!rec || rec === "version" || rec === "forged") {
+                throw new JournalRollbackError(`the run journal's head holds a record that does not follow record ${n}`);
             }
+            restored = rec;
         }
-        else if (corruptAtLine === undefined && looksLikeRecord(text)) {
-            // A well-formed record after a bad line: the damage is not a torn tail.
-            corruptAtLine = firstBad;
+        else if (n < head.seq) {
+            throw new JournalRollbackError(`the run journal ends at record ${n}, but the run had written ${head.seq}: records were removed from its end (rolled back)`);
+        }
+        else if (n > head.seq) {
+            throw new JournalRollbackError(`the run journal has ${n} records, but its head is record ${head.seq}: it was not written by this run alone`);
+        }
+        else if (n > 0 && records[n - 1].h !== head.record?.h) {
+            throw new JournalRollbackError(`run journal record ${n} is not the record the run wrote there`);
         }
     }
-    const truncatedBytes = buf.length - validBytes;
-    if (opts.repair && truncatedBytes > 0 && corruptAtLine === undefined) {
-        fs.truncateSync(file, validBytes);
+    if (restored)
+        records.push(restored);
+    if (opts.repair && corruptAtLine === undefined) {
+        if (truncatedBytes > 0)
+            fs.truncateSync(file, validBytes);
+        const tail = (missingNewline ? "\n" : "") + (restored ? JSON.stringify(restored) + "\n" : "");
+        if (tail)
+            appendDurably(file, tail);
     }
     return {
         file,
         records,
         truncatedBytes,
+        ...(missingNewline ? { missingNewline } : {}),
+        ...(restored ? { restored: true } : {}),
         ...(corruptAtLine !== undefined ? { corruptAtLine } : {}),
         ...(forgedAtLine !== undefined ? { forgedAtLine } : {}),
     };
 }
+function appendDurably(file, text) {
+    const c = fs.constants;
+    const fd = fs.openSync(file, c.O_WRONLY | c.O_APPEND | NOFOLLOW);
+    try {
+        fs.writeSync(fd, text);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 const visitKey = (node, iteration) => `${node}#${iteration}`;
 const RECORD_TYPES = new Set([
     "run:start",
@@ -464,6 +843,7 @@ const RECORD_TYPES = new Set([
     "node:end",
     "route",
     "usage",
+    "agent:unsandboxed",
     "run:end",
 ]);
 const isPosInt = (v) => typeof v === "number" && Number.isInteger(v) && v > 0;
@@ -574,6 +954,9 @@ export function checkRecordSequence(records) {
                     bad(r, "has invalid amounts");
                 }
                 break;
+            case "agent:unsandboxed":
+                inVisit(r);
+                break;
             case "node:end": {
                 inVisit(r);
                 const result = r.result;
@@ -798,6 +1181,7 @@ export function buildResumePlan(records) {
         intents,
         receipts,
         priorSpend: journaledSpend(records),
+        unsandboxed: [...new Set(records.filter((r) => r.type === "agent:unsandboxed").map((r) => String(r.node)))],
         ...(start.decider
             ? { decider: { ...start.decider, ...(deciderCounters ? { counters: { ...deciderCounters } } : {}) } }
             : {}),
@@ -845,12 +1229,57 @@ async function callRead(skill, name, args, ctx) {
         throw new Error(`no ${name} tool configured`);
     return tool.handler(args, ctx);
 }
+const hasRead = (skill, name) => !!skill?.tools.some((t) => t.name === name && t.access === "read");
+/** Pages of 100 a marker lookup reads before it gives up (cannot confirm). */
+const LIST_PAGE_SIZE = 100;
+const LIST_MAX_PAGES = 30;
+/**
+ * Look for a GitHub issue or comment by its marker through the listing
+ * endpoints (consistent, unlike search), page by page until the marker is
+ * found, the listing ends, or it reaches back past the write. Undefined when
+ * the skill has no listing tool, so the caller falls back to search. A page
+ * that cannot be read is "cannot confirm" (the caller's catch).
+ */
+async function listGitHubForMarker(toolName, args, token, since, skill, ctx) {
+    const hasBody = (i) => typeof i.body === "string" && i.body.includes(token);
+    const comments = toolName === "github_add_comment";
+    const tool = comments ? "github_list_issue_comments" : "github_list_issues";
+    if (!hasRead(skill, tool))
+        return undefined;
+    for (let page = 1; page <= LIST_MAX_PAGES; page++) {
+        const query = comments
+            ? { repo: args.repo, issue_number: args.issue_number, ...(since ? { since } : {}), page }
+            : { repo: args.repo, per_page: LIST_PAGE_SIZE, page };
+        const out = await callRead(skill, tool, query, ctx);
+        if (!Array.isArray(out))
+            return { state: "unknown", reason: `${comments ? "comment" : "issue"} list unavailable` };
+        const items = out;
+        // Issues listing includes pull requests; a marker only ever lands in an issue.
+        const hit = items.find((i) => hasBody(i) && (comments || !i.pull_request));
+        if (hit)
+            return { state: "applied", output: comments ? {} : hit };
+        // The listing ended: everything since the write was seen.
+        if (items.length < LIST_PAGE_SIZE)
+            return { state: "absent" };
+        // Issues come newest first: a page that reaches back past the write ends the search.
+        const oldest = items.at(-1)?.created_at;
+        if (!comments && since !== undefined && typeof oldest === "string" && oldest < since)
+            return { state: "absent" };
+    }
+    return {
+        state: "unknown",
+        reason: `too many ${comments ? "comments" : "issues"} to search (more than ${LIST_MAX_PAGES * LIST_PAGE_SIZE})`,
+    };
+}
 /**
  * Was this write applied before the crash? Writes that are idempotent by
  * nature (labels, state changes, a PR for the same head branch) are simply
- * re-applied. Creates and comments are searched for by their marker.
+ * re-applied. Creates and comments are looked up by their marker: GitHub's
+ * listing endpoints first (consistent), search otherwise; Linear comments by
+ * listing, Linear issues by search. A write with no lookup is `unknown`, and a
+ * pending one is not re-sent without `--allow-repeat-writes`.
  */
-async function probeProvider(toolName, args, key, skill, ctx) {
+async function probeProvider(toolName, args, key, skill, ctx, since) {
     const token = markerToken(key);
     try {
         switch (toolName) {
@@ -861,6 +1290,10 @@ async function probeProvider(toolName, args, key, skill, ctx) {
                 return { state: "reapply" };
             case "github_create_issue":
             case "github_add_comment": {
+                // Prefer the listing endpoints: unlike search, they see a write the moment it lands.
+                const listed = await listGitHubForMarker(toolName, args, token, since, skill, ctx);
+                if (listed)
+                    return listed;
                 const scope = toolName === "github_create_issue" ? "in:body is:issue" : "in:comments";
                 const out = (await callRead(skill, "github_search_issues", { query: `${token} ${scope}`, repo: args.repo }, ctx));
                 if (!out || !Array.isArray(out.items))
@@ -868,8 +1301,9 @@ async function probeProvider(toolName, args, key, skill, ctx) {
                 const hit = toolName === "github_create_issue"
                     ? out.items.find((i) => typeof i.body === "string" && i.body.includes(token))
                     : out.items.find((i) => Number(i.number) === Number(args.issue_number));
+                // The search index lags writes: a miss is not proof the write never landed.
                 if (!hit)
-                    return { state: "absent" };
+                    return { state: "unknown", reason: "not in GitHub search, which can lag a just-made write" };
                 return { state: "applied", output: toolName === "github_create_issue" ? hit : {} };
             }
             case "linear_create_issue": {
@@ -915,40 +1349,71 @@ function slimOutput(o, depth = 0) {
     }
     return out;
 }
-/** Minimum gap between two live usage records of one attempt. Final reports are always written. */
-export const USAGE_JOURNAL_INTERVAL_MS = 2000;
-export function journalDir(cwd, runId) {
-    return path.join(cwd, JOURNAL_DIR, runId);
+/** A run's journal file. */
+export function journalFile(cwd, runId, root = runStateRoot()) {
+    return path.join(journalDir(cwd, runId, root), JOURNAL_FILE);
 }
-/** Run ids with a journal on disk, oldest first. */
-export function listJournalRuns(cwd = process.cwd()) {
+/**
+ * Runs of this workspace with a journal, oldest first. Only the state dir is
+ * read, and only runs whose metadata authenticates count: nothing in the
+ * workspace can add, hide or reorder a run.
+ */
+export function listJournalRuns(cwd = process.cwd(), root = runStateRoot()) {
+    const scope = workspaceScope(cwd);
+    const base = path.join(root, scope);
+    let names;
     try {
-        return fs
-            .readdirSync(path.join(cwd, JOURNAL_DIR))
-            .filter((d) => RUN_ID_RE.test(d) && fs.existsSync(path.join(cwd, JOURNAL_DIR, d, JOURNAL_FILE)))
-            .sort();
+        names = fs.readdirSync(base);
     }
     catch {
         return [];
     }
+    const runs = [];
+    for (const name of names) {
+        if (!RUN_ID_RE.test(name))
+            continue;
+        const meta = loadRunMeta(path.join(base, name), name, scope);
+        if (meta)
+            runs.push(meta);
+    }
+    return runs
+        .sort((a, b) => a.createdAt.localeCompare(b.createdAt) || a.runId.localeCompare(b.runId))
+        .map((r) => r.runId);
 }
-/** Exact run id, or a unique prefix. */
-export function findJournalRun(ref, cwd = process.cwd()) {
-    const runs = listJournalRuns(cwd);
+/** Exact run id, or a unique prefix, among this workspace's journaled runs. */
+export function findJournalRun(ref, cwd = process.cwd(), root = runStateRoot()) {
+    const runs = listJournalRuns(cwd, root);
     if (runs.includes(ref))
         return ref;
     const matches = runs.filter((r) => r.startsWith(ref));
     return matches.length === 1 ? matches[0] : undefined;
 }
-/** Delete the oldest journals (and their keys) beyond `keep`, never `except`. Never throws. */
-export function pruneJournals(cwd, keep = JOURNAL_KEEP, except, keyDir = runKeyDir()) {
-    const runs = listJournalRuns(cwd).filter((r) => r !== except);
+/** A journal an older sweny left in the workspace for this run id (or unique prefix), if any. Never read. */
+export function findLegacyJournal(ref, cwd = process.cwd()) {
+    try {
+        const base = path.join(cwd, LEGACY_JOURNAL_DIR);
+        const hits = fs
+            .readdirSync(base)
+            .filter((d) => RUN_ID_RE.test(d) && (d === ref || d.startsWith(ref)))
+            .filter((d) => fs.existsSync(path.join(base, d, JOURNAL_FILE)));
+        return hits.length === 1 ? path.join(base, hits[0], JOURNAL_FILE) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Delete this workspace's oldest journals beyond `keep`, never `except`, by
+ * their authenticated creation time. Runs whose metadata does not
+ * authenticate are never deleted. Never throws.
+ */
+export function pruneJournals(cwd, keep = JOURNAL_KEEP, except, root = runStateRoot()) {
+    const runs = listJournalRuns(cwd, root).filter((r) => r !== except);
     const extra = runs.slice(0, Math.max(0, runs.length - Math.max(0, keep - (except ? 1 : 0))));
     let removed = 0;
     for (const r of extra) {
         try {
-            fs.rmSync(journalDir(cwd, r), { recursive: true, force: true });
-            fs.rmSync(runKeyFile(cwd, r, keyDir), { force: true });
+            fs.rmSync(journalDir(cwd, r, root), { recursive: true, force: true });
             removed++;
         }
         catch {
@@ -957,103 +1422,103 @@ export function pruneJournals(cwd, keep = JOURNAL_KEEP, except, keyDir = runKeyD
     }
     return removed;
 }
-function pidAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err.code === "EPERM";
-    }
+/** Take a run's lock before reading its journal (resume). Throws {@link JournalLockedError}. */
+export function lockRun(cwd, runId, root = runStateRoot(), hooks) {
+    return acquireRunLock(journalDir(cwd, runId, root), hooks);
 }
 const quietLogger = { info() { }, warn() { }, error() { }, debug() { } };
+const errText = (err) => (err instanceof Error ? err.message : String(err));
 export class RunJournal {
     runId;
     dir;
     file;
     cwd;
+    root;
     opts;
     logger;
     resume;
     fd;
     seq = 0;
-    dead = false;
+    /** MAC of the last record written: the next record chains to it. */
+    prev = "";
+    /** Set once an append failed: every later append throws it again. */
+    failure;
+    /** Set when a fault seam simulated the process dying: nothing more is written. */
+    killed = false;
     began = false;
     closed = false;
     secrets = [];
     consumed = new Set();
-    /** Per-run HMAC key; lives only here and in the key file outside the workspace. */
+    /** Per-run HMAC key; lives only here and in the run's private state dir. */
     key;
-    keyFile;
+    lock;
     /** Last live usage record per attempt: time and spend, for throttling. */
     lastUsage = new Map();
+    /** Visits already recorded as run without an enforced sandbox. */
+    uncontainedVisits = new Set();
     constructor(opts, resume) {
         this.opts = opts;
         this.runId = opts.runId;
         this.cwd = opts.cwd ?? process.cwd();
-        this.dir = journalDir(this.cwd, opts.runId);
+        this.root = opts.stateRoot ?? runStateRoot();
+        this.dir = journalDir(this.cwd, opts.runId, this.root);
         this.file = path.join(this.dir, JOURNAL_FILE);
         this.logger = opts.logger ?? quietLogger;
-        this.keyFile = runKeyFile(this.cwd, opts.runId, opts.keyDir ?? runKeyDir());
         if (resume) {
             this.resume = {
                 plan: resume.plan,
                 force: resume.force === true,
                 allowRepeatWrites: resume.allowRepeatWrites === true,
             };
-            this.seq = resume.read.records.length;
-            this.key = loadRunKey(this.keyFile);
+            this.lock = resume.lock;
+            const records = resume.read.records;
+            this.seq = records.length;
+            this.prev = records.length > 0 ? records[records.length - 1].h : "";
+            this.key = loadRunKey(path.join(this.dir, KEY_FILE));
         }
     }
     /** A journal for a new run. Nothing touches disk until the executor calls `begin`. */
     static create(opts) {
         return new RunJournal(opts);
     }
-    /** A journal that continues `opts.read` (already repaired) under the resume plan. */
+    /** A journal that continues `opts.read` (already repaired, under `opts.lock`) under the resume plan. */
     static openForResume(opts) {
-        const j = new RunJournal(opts, opts);
-        j.takeLock();
-        return j;
+        return new RunJournal(opts, opts);
     }
-    /** False once an append failed: the rest of the run is not journaled. */
+    /** False once an append failed (or the process was simulated dead): the run cannot be resumed past that point. */
     get active() {
-        return !this.dead;
-    }
-    takeLock() {
-        const lock = path.join(this.dir, LOCK_FILE);
-        try {
-            const pid = Number(fs.readFileSync(lock, "utf-8").trim());
-            if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && pidAlive(pid))
-                throw new JournalLockedError(pid);
-        }
-        catch (err) {
-            if (err instanceof JournalLockedError)
-                throw err;
-        }
-        this.makeDir();
-        writeFileNoFollow(lock, String(process.pid), { root: this.cwd, mode: 0o600 });
-    }
-    /** The run dir is private (0700); no link on the path from cwd is followed (safe-file.ts). */
-    makeDir() {
-        ensureDirNoFollow(this.dir, this.cwd);
+        return !this.failure && !this.killed;
     }
     releaseLock() {
         try {
-            fs.rmSync(path.join(this.dir, LOCK_FILE), { force: true });
+            this.lock?.release();
         }
         catch {
             // nothing to do
         }
+        this.lock = undefined;
+    }
+    /** Mark the journal failed and throw: the run must stop here. */
+    fail(what, err) {
+        this.failure = new JournalWriteError(err === undefined ? what : `${what} (${errText(err)})`);
+        this.closeFd();
+        this.logger.error(`  ${this.failure.message}`);
+        throw this.failure;
+    }
+    simulatedDeath(err) {
+        // Test seam: nothing after this point reaches the disk.
+        this.killed = true;
+        this.closeFd();
+        this.releaseLock();
+        throw err;
     }
     append(type, fields) {
-        if (this.dead)
-            return;
-        if (!this.key) {
-            // No key, no record resume could trust: stop journaling rather than write unauthenticated records.
-            this.dead = true;
-            this.logger.warn(`  run journal: no signing key for this run; this run cannot be resumed`);
+        if (this.failure)
+            throw this.failure;
+        if (this.killed)
             return;
-        }
+        if (!this.key)
+            return this.fail("no signing key for this run");
         const body = {
             v: JOURNAL_SCHEMA_VERSION,
             seq: this.seq + 1,
@@ -1061,34 +1526,48 @@ export class RunJournal {
             at: new Date().toISOString(),
             ...fields,
         };
-        const record = { ...body, h: recordMac(this.key, JSON.stringify(body)) };
+        const h = chainMac(this.key, this.runId, this.seq + 1, this.prev, body);
+        const record = { ...body, h };
         if (this.opts.faults?.beforeAppend) {
             try {
                 this.opts.faults.beforeAppend(record);
             }
             catch (err) {
-                // Simulated process death: nothing after this point reaches the disk.
-                this.dead = true;
-                this.closeFd();
-                this.releaseLock();
-                throw err;
+                this.simulatedDeath(err);
+            }
+        }
+        // Head first: a crash before the journal append leaves the record recoverable, never lost.
+        try {
+            writeJournalHead(this.dir, this.key, this.runId, { seq: this.seq + 1, record });
+        }
+        catch (err) {
+            this.fail(`could not write the head file in ${this.dir}`, err);
+        }
+        if (this.opts.faults?.afterHeadUpdate) {
+            try {
+                this.opts.faults.afterHeadUpdate(record);
+            }
+            catch (err) {
+                this.simulatedDeath(err);
             }
         }
         try {
             if (this.fd === undefined) {
-                this.makeDir();
-                this.fd = openNoFollow(this.file, { root: this.cwd, append: true, mode: 0o600 });
+                const c = fs.constants;
+                this.fd = fs.openSync(this.file, c.O_WRONLY | c.O_APPEND | c.O_CREAT | NOFOLLOW, 0o600);
             }
-            fs.writeSync(this.fd, JSON.stringify(record) + "\n");
+            const line = JSON.stringify(record) + "\n";
+            if (this.opts.faults?.writeJournal)
+                this.opts.faults.writeJournal(this.fd, line);
+            else
+                fs.writeSync(this.fd, line);
             fs.fsyncSync(this.fd);
-            this.seq++;
         }
         catch (err) {
-            this.dead = true;
-            this.closeFd();
-            this.logger.warn(`  run journal: could not write ${this.file} (${err instanceof Error ? err.message : String(err)}); ` +
-                `this run cannot be resumed past this point`);
+            this.fail(`could not write ${this.file}`, err);
         }
+        this.seq++;
+        this.prev = h;
     }
     closeFd() {
         if (this.fd === undefined)
@@ -1126,7 +1605,7 @@ export class RunJournal {
             if (changed.length > 0) {
                 if (!this.resume.force) {
                     // Nothing is appended for a refused resume: the journal stays as the crash left it.
-                    this.dead = true;
+                    this.killed = true;
                     this.closeFd();
                     this.releaseLock();
                     throw new JournalMismatchError(changed);
@@ -1148,22 +1627,28 @@ export class RunJournal {
             return;
         }
         try {
-            this.makeDir();
-            // Journals hold node output: keep them out of commits (an agent's `git add -A` included).
-            writeFileNoFollow(path.join(this.dir, ".gitignore"), "*\n", { root: this.cwd, mode: 0o644 });
-            this.takeLock();
+            makePrivateDir(this.dir);
+            assertStateOutsideWorkspace(this.dir, this.cwd);
         }
-        catch {
-            // append() reports the failure
+        catch (err) {
+            if (err instanceof JournalLocationError)
+                return this.fail(err.message);
+            return this.fail(`could not set up the run's journal in ${this.dir}; set SWENY_STATE_DIR to a writable dir, ` +
+                `or pass --no-journal (the run then cannot be resumed)`, err);
         }
         try {
-            this.key = createRunKey(this.keyFile);
+            this.lock = acquireRunLock(this.dir);
+            const key = createRunKey(path.join(this.dir, KEY_FILE));
+            writeRunMeta(this.dir, key, this.runId, workspaceScope(this.cwd));
+            writeJournalHead(this.dir, key, this.runId, { seq: 0, record: null });
+            this.key = key;
         }
         catch (err) {
-            this.logger.warn(`  run journal: could not write the run key under ${path.dirname(this.keyFile)} ` +
-                `(${err instanceof Error ? err.message : String(err)}); set SWENY_STATE_DIR to a writable dir`);
+            this.releaseLock();
+            this.fail(`could not set up the run's journal in ${this.dir}; set SWENY_STATE_DIR to a writable dir, ` +
+                `or pass --no-journal (the run then cannot be resumed)`, err);
         }
-        pruneJournals(this.cwd, this.opts.keep ?? JOURNAL_KEEP, this.runId, this.opts.keyDir ?? runKeyDir());
+        pruneJournals(this.cwd, this.opts.keep ?? JOURNAL_KEEP, this.runId, this.root);
         const input = redact(info.input, this.secrets);
         this.append("run:start", {
             run_id: this.runId,
@@ -1242,6 +1727,14 @@ export class RunJournal {
     route(from, to, rung, decider) {
         this.append("route", { from, to, ...(rung ? { rung } : {}), ...(decider ? { decider } : {}) });
     }
+    /**
+     * Journal one usage report, synchronously, whenever it raises the attempt's
+     * spend (reports are cumulative; the largest figure seen per unit counts).
+     * Nothing is held back: harnesses report once per model turn (Claude Code
+     * per assistant message, ACP per usage update), so every turn's spend is on
+     * disk before the next turn runs, and a process killed at any point has lost
+     * at most the turn it was in.
+     */
     usage(node, iteration, attempt, usage, final) {
         const s = spendOf(usage);
         if (s.tokens === undefined && s.costUsd === undefined)
@@ -1250,29 +1743,43 @@ export class RunJournal {
         const costUsd = s.costUsd ?? 0;
         const k = `${visitKey(node, iteration)}|${attempt}`;
         const last = this.lastUsage.get(k);
-        const now = Date.now();
-        if (!final && last) {
-            if (tokens <= last.tokens && costUsd <= last.costUsd)
-                return;
-            if (now - last.at < USAGE_JOURNAL_INTERVAL_MS)
-                return;
-        }
-        if (final && last && tokens <= last.tokens && costUsd <= last.costUsd)
+        if (last && tokens <= last.tokens && costUsd <= last.costUsd)
             return;
         this.lastUsage.set(k, {
-            at: now,
             tokens: Math.max(tokens, last?.tokens ?? 0),
             costUsd: Math.max(costUsd, last?.costUsd ?? 0),
         });
         this.append("usage", { node, iteration, attempt, tokens, cost_usd: costUsd, final });
     }
+    uncontained(node, iteration) {
+        const k = visitKey(node, iteration);
+        if (this.uncontainedVisits.has(k))
+            return;
+        this.uncontainedVisits.add(k);
+        this.append("agent:unsandboxed", { node, iteration });
+    }
+    degraded() {
+        const nodes = this.resume?.plan.unsandboxed ?? [];
+        if (nodes.length === 0)
+            return [];
+        return [
+            `journal_unsandboxed: an earlier attempt ran ${nodes.join(", ")} without an enforced sandbox, so its ` +
+                `journaled spend and write records could have been edited by that agent`,
+        ];
+    }
     priorSpend() {
         return this.resume ? { ...this.resume.plan.priorSpend } : undefined;
     }
-    /** Close the run: `run:end`, then release the lock. Safe to call twice (one run:end). */
+    /** Close the run: `run:end` (when the journal still works), then release the lock. Never throws. */
     end(status) {
-        if (this.began && !this.closed)
-            this.append("run:end", { status });
+        if (this.began && !this.closed && this.active) {
+            try {
+                this.append("run:end", { status });
+            }
+            catch {
+                // already reported by append
+            }
+        }
         this.closed = true;
         this.closeFd();
         this.releaseLock();
@@ -1301,7 +1808,10 @@ export class RunJournal {
                 const replayingStage = !!plan?.checkpoints.has(visitKey(node, iteration));
                 const pending = plan?.intents.has(key) === true;
                 if (pending || replayingStage) {
-                    const probe = await probeProvider(tool.name, (args ?? {}), key, skill, ctx);
+                    // Look back from a little before the intent (clock skew between this host and the provider).
+                    const intentAt = Date.parse(String(plan?.intents.get(key)?.at ?? ""));
+                    const since = Number.isFinite(intentAt) ? new Date(intentAt - 5 * 60_000).toISOString() : undefined;
+                    const probe = await probeProvider(tool.name, (args ?? {}), key, skill, ctx, since);
                     if (probe.state === "applied") {
                         const output = slimOutput(probe.output);
                         this.append("output:applied", { node, iteration, key, tool: tool.name, output, recovered: true });
@@ -1313,6 +1823,7 @@ export class RunJournal {
                             `check the target, then resume with --allow-repeat-writes to send it again`);
                     }
                 }
+                // A write the journal cannot record is never sent: append throws first.
                 this.append("output:intent", { node, iteration, key, tool: tool.name });
                 const output = await tool.handler(withMarker(tool.name, args, key), ctx);
                 this.append("output:applied", { node, iteration, key, tool: tool.name, output: slimOutput(output) });