@visual-z/xeno 0.8.4 → 0.9.1

package/src/runtime/loop.ts

@@ -1,3108 +0,0 @@
-/**
- * The agent loop.
- *
- * Deliberately thin. Everything that decides anything -- what the model sees,
- * when to cut a node, what the handoff says -- is a pure function in core, so
- * this file only sequences them and performs the I/O between. That split is
- * what makes the interesting behaviour testable without a network, and what
- * keeps the loop cheap to throw away when the next model generation wants a
- * different shape.
- *
- * One turn:
- *
- *   project the log -> send -> record the assistant turn -> run tools ->
- *   record results -> decide whether to cut -> maybe cut
- *
- * The cut decision happens only here, between complete turns, because a node
- * boundary between a tool_use and its result would produce an unpairable
- * request.
- */
-
-import type { LogEvent, AssistantBlock, NodeRef, CutReason, ToolInvocationEvent, FailureCause } from "../core/events.ts";
-import { userInputData, submissionImages, type UserInput, type ImageRef } from "../core/images.ts";
-import { hydrateImages } from "./images.ts";
-import type { Handoff } from "../core/handoff.ts";
-import { boundHandoff, DEFAULT_HANDOFF_TOKENS } from "../core/history.ts";
-import { CURRENT_WORKING_SET_VERSION } from "../core/working-set.ts";
-import { boundaryPreparation, continuationGuidance } from "../core/continuation.ts";
-import type { FrozenPrefix, Message, ProjectInput } from "../core/project.ts";
-import { projectContext, toolCallIdentityViolations } from "../core/project.ts";
-import { parseSessionContext, type SessionContext } from "../core/session-format.ts";
-import { activeGoal, goalContract, goalDecision, idleGoalChecks, type ActiveGoal } from "../core/goal.ts";
-import { counterCheck } from "./counter-check.ts";
-import { runBlindChecks } from "./blind-check.ts";
-import { blindExposure, type BlindChecks } from "../core/blind-checks.ts";
-import { deriveHandoff, carryForward } from "../core/derive.ts";
-import { latestObservedFileVersion } from "../core/file-precondition.ts";
-import { latestProcessReceipt } from "../core/process-receipt.ts";
-import { advanceRecovery, emptyRecoveryState, recoveryReview, type RecoveryState } from "../core/failure-recovery.ts";
-import { shouldStopAndAsk, type BoundaryConfig } from "../core/boundary.ts";
-import {
-  contextLimits, decideContext, DEFAULT_CONTEXT_POLICY, estimateBoundaryCost, isContextPolicy,
-  type ContextLimits, type ContextPolicy,
-} from "../core/context-policy.ts";
-import { retainedContext, selectRecentContext } from "../core/context-window.ts";
-import { advanceStall, emptyStallState, stallDecision, DEFAULT_STALL_LIMIT, type StallState } from "../core/stall.ts";
-import { questionRequest, validateQuestionReply } from "../core/question.ts";
-import { DEFAULT_OUTPUT_RECOVERY_LIMIT, isCompleteResponse, incompleteToolText, knownUnexecutedTool, outputRecoveryNotice, validateOutputRecoveryLimit } from "../core/response-recovery.ts";
-import { join, relative, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-import { pendingToolCalls } from "../core/execution.ts";
-import { declaredToolNames, recordedDeclarations } from "../core/tool-discovery.ts";
-import { DISCOVERY_TOOL, DISCOVERY_TOOL_NAME, currentDeferredTools, discoveryFingerprint, discoveryPermitted, searchDeferredTools } from "./tool-discovery.ts";
-import { executionOutcome, modelOutcome, type ExecutionOutcome, type ExecutionReason } from "../core/outcome.ts";
-import { finalizationNotice, requestPhase, validateRequestBudget } from "../core/request-budget.ts";
-import { stopReport } from "../core/stop-report.ts";
-import { supportsToolDisabling, type ProviderSendOptions } from "./provider-tool-policy.ts";
-import { commandCompletion } from "../core/command-contract.ts";
-import { ExecutionControl } from "./execution-control.ts";
-import { BranchJobs } from "./branch-jobs.ts";
-import { HistoryCache } from "./history-cache.ts";
-import { RuntimeTargets } from "./runtime-target.ts";
-import { ToolBroker, MAX_NESTED_ARGUMENT_BYTES, MAX_INLINE_RESULT_DATA_BYTES, type BrokerReceipt, type BrokerExecution } from "./tool-broker.ts";
-import { ToolQueue } from "./tool-queue.ts";
-import { NATIVE_COMMAND_NAME, nativeCommandContext, nativeCommandResult, type NativeCommandInput, type NativeCommandResult } from "./tools.ts";
-import { isJsonValue, type JsonValue } from "../core/tool-contract.ts";
-import { archiveObservation } from "../store/observations.ts";
-import { disposeExecSessions, runningSessions } from "./exec-sessions.ts";
-import { branchStatus, processStatus, deriveProcesses, type ProcessObservation } from "../core/process-state.ts";
-import { schedulingWindow } from "../core/scheduling.ts";
-import { estimateTokens, anchoredCount, scaledCounter, type TokenCounter, type Anchor } from "../core/tokens.ts";
-import { isContextOverflow } from "../core/overflow.ts";
-import { requestCompletion } from "../core/completion-review.ts";
-import { currentRequestRecords, deriveRequestState, type RequestState } from "../core/request-state.ts";
-import { churnReview } from "../core/churn.ts";
-import { deriveBranchReceipt } from "../core/branch-receipt.ts";
-import { skillTools, type Skill } from "../core/skills.ts";
-import type { WorkItem } from "../core/work-state.ts";
-import { parseAcceptanceContract, type AcceptanceContract, type AcceptanceCriterion, type AcceptanceState } from "../core/acceptance.ts";
-import { deadlineNotice } from "../core/deadline.ts";
-import { describeFailure, failureCause, statusOf } from "./retry.ts";
-import { XENO_VERSION } from "./version.ts";
-import { SECRET_GUIDANCE, SecretKeeper } from "./secrets.ts";
-import { secretEnvironmentValues } from "../core/secrets.ts";
-import { copyVault } from "../store/secrets.ts";
-import { assertNever } from "../core/exhaustive.ts";
-import { isLogEvent } from "../core/event-validation.ts";
-import {
-  initNode, appendEvent, readNode, closeNode, digestNode, handoffPath, nodePath, manifestPath,
-  listNodes, readManifest, readCursor, readCursorAt, writeCursor,
-} from "../store/log.ts";
-import { replayContext, carriedHandoff } from "../store/replay.ts";
-import { recoverCut } from "../store/recovery.ts";
-import { runHistoryTool } from "./history-tools.ts";
-import { prepareWorkingNote } from "./working-notes.ts";
-import { copyAncestryTo } from "../store/sessions.ts";
-import { FailedResponseError, type Provider, type Turn, type StreamDelta } from "./provider.ts";
-import { putBlob, getBlob } from "../store/blobs.ts";
-import { hydrateProcessReceipts } from "../store/process-receipts.ts";
-import { readNodeHistory } from "../store/restore.ts";
-import { createWorktree, listWorktrees, mainWorktree, persistentWorktreeParent, removeWorktree } from "../store/worktree.ts";
-import {
-  parseNote, matchGate, branchTools, finishToolResult, prepareNormalizedTool, presentObservation, toolDefinition, modelToolSchema, adviceTools,
-  BRANCH_TOOL_NAMES, WRITING_BRANCH_TOOL_NAMES,
-  type ToolContext, type Annotation, type ToolResult,
-} from "./tools.ts";
-import { diagnosePrefix, totalUsage, type UsageSample, type UsageTotals } from "./usage.ts";
-import { planResume } from "../core/resume.ts";
-import type { Phase } from "../core/queue.ts";
-import { sameModel } from "../core/session-position.ts";
-import type { Effort } from "./model.ts";
-import { providerReplayKey, nativeReplay } from "./model-replay.ts";
-import { needsReplayCheckpoint } from "../core/model-replay.ts";
-import { resolveHistoryPosition } from "../store/session-position.ts";
-import { observeCommand } from "../store/command.ts";
-import { headTailView } from "../core/observation-view.ts";
-import { withProgress } from "./progress.ts";
-import { WorkspaceLifecycle } from "./workspace-lifecycle.ts";
-import { changedPaths, invertFileChanges, sameVersion, type CheckpointEvent, type FileChanges } from "../core/checkpoints.ts";
-import type { GitCheckpoint } from "../store/git-checkpoints.ts";
-import { readEditableFile, preflightChanges, applyFileChanges } from "../store/file-checkpoints.ts";
-import { planCheckpointRestore } from "../store/checkpoint-history.ts";
-import { configDir } from "../store/config.ts";
-
-/** Ids and timestamps come from here so the loop stays the only impure part. */
-export interface Clock {
-  now(): string;
-  nextId(): string;
-}
-
-export function systemClock(): Clock {
-  return {
-    now: () => new Date().toISOString(),
-    nextId: () => randomUUID(),
-  };
-}
-
-/** Per-request options that are not session configuration. */
-export interface RequestOptions {
-  /**
-   * A read-only planning request (S.5 goal drafts). The Plan-mode tool gate
-   * refuses anything that could change the workspace, the request runs at
-   * most READ_ONLY_REQUEST_LIMIT model requests with the last one answering
-   * without tools, and no goal or completion check applies. A draft written
-   * without seeing the workspace guessed its commands, and a request with
-   * tools disabled outright was answered with tool calls anyway
-   * (fix-goal-read-only-draft).
-   */
-  readOnly?: boolean;
-}
-
-/**
- * Assumed, not measured: room to list the workspace and read a few files
- * before answering. The last request answers with tools disabled.
- */
-export const READ_ONLY_REQUEST_LIMIT = 8;
-const READ_ONLY_HINT = "this request only reads the workspace. Use read, find or grep, then answer.";
-
-export interface LoopEvent {
-  kind:
-    | "turn_start"
-    | "assistant_text"
-    | "thinking"
-    | "text_delta"
-    | "thinking_delta"
-    | "discard"
-    | "progress"
-    | "tool_call"
-    | "tool_result"
-    | "usage"
-    | "cut"
-    | "stop_and_ask"
-    | "branch_start"
-    | "branch_done"
-    | "done";
-  text?: string;
-  tool?: { name: string; input: unknown };
-  ok?: boolean;
-  usage?: UsageSample;
-  prefix?: string;
-  node?: number;
-  reason?: string;
-  /** branch_start: wall-clock milliseconds, for asserting the stagger. */
-  at?: number;
-  outcome?: ExecutionOutcome;
-  /** done: credential-free cause of a failed request, recorded on its outcome. */
-  failure?: FailureCause;
-  /** Q23: task evidence is separate from the execution outcome; rebuilt from original receipts. */
-  request?: RequestState;
-  progress?: Extract<StreamDelta, { kind: "tool" | "retry" }> | { kind: "output"; text: string; name: string }
-    | { kind: "waiting"; session: number; active: boolean };
-}
-
-/**
- * Ceilings on branching. Every one of them is a bound on an otherwise
- * unbounded resource, and the defaults are conservative because the measured
- * evidence says fan-out is usually a loss: 2.6x the tokens and about five
- * times the cost of the sequential path, while being slower.
- */
-export interface BranchLimits {
-  /** How deep branching may nest. 2 means the parent may branch, a branch may not. */
-  maxBranchDepth: number;
-  /** Branches one assistant turn may open. */
-  maxBranchesPerTurn: number;
-  /** Branches a whole session may open. */
-  maxBranchesPerSession: number;
-  /**
-   * Delay between starting sibling branches.
-   *
-   * Simultaneous cold spawns race the prompt cache: a sibling six seconds
-   * behind has been measured writing its full 52k prefix with zero cache
-   * read, because the first had not finished writing it.
-   */
-  branchStaggerMs: number;
-}
-
-export const DEFAULT_BRANCH_LIMITS: BranchLimits = {
-  maxBranchDepth: 2,
-  maxBranchesPerTurn: 3,
-  maxBranchesPerSession: 10,
-  branchStaggerMs: 1500,
-};
-
-export interface SessionConfig {
-  /**
-   * Where secret-named environment values are read from (S.9). Defaults to
-   * process.env; a test supplies its own so it never depends on the machine.
-   */
-  secretEnvironment?: Readonly<Record<string, string | undefined>>;
-  /** Runtime-only output contract, explicitly selected by the current caller. */
-  validateOutput?: (text: string) => { ok: boolean; error?: string };
-  /** Persist a selector, never persisted profile code or authorization (D6/D13). */
-  agentProfile?: { name: string; workflowExplicit: boolean };
-  /** An explicit mode command's capability default, independent of role authority. */
-  workflowToolProfile?: "foundation";
-  shellCheckpoints?: boolean;
-  skills?: readonly Skill[];
-  acceptanceContract?: AcceptanceContract | null;
-  /** feat-blind-checks: hidden checks, frozen at session start; never part of any projection. */
-  blindChecks?: BlindChecks;
-  strictVerification?: boolean;
-  /** O.10: opt-in carried view (source-priority, R9); evaluations compare it against D20's plain handoff. */
-  workingSet?: boolean;
-  logDir: string;
-  frozen: FrozenPrefix;
-  tools: ToolContext;
-  boundary?: Partial<BoundaryConfig>;
-  /** New sessions default to windowed replay; saved sessions keep their policy. */
-  contextPolicy?: ContextPolicy;
-  /** Complete tool exchanges without new evidence; zero disables this watchdog. */
-  stallLimit?: number;
-  /** Bounded appended continuations after output truncation; saved sessions keep this policy. */
-  outputRecoveryLimit?: number;
-  counter?: TokenCounter;
-  /** Hard ceiling on turns, so a non-converging run cannot spend forever. */
-  maxTurns: number;
-  /** Experimental ablation only; normal sessions append durable working-state guidance. */
-  guidance?: boolean;
-  /**
-   * One-time reconciliation notices: an unverified finish
-   * (core/completion-review.ts) and a rut of repeated failures or edits
-   * (core/churn.ts). On unless false. Benchmark runners turn them off so their
-   * protocol matches the runs they are compared against; a runtime policy,
-   * not persisted.
-   */
-  harnessReviews?: boolean;
-  /**
-   * Wall-clock budget per request, for runs judged against a deadline
-   * (core/deadline.ts). Absent means no notice; nothing is ever stopped by it.
-   */
-  timeBudgetMs?: number;
-  /** Replies before a missing next step is reminded (core/continuation.ts); absent means the core default. */
-  continuationAfter?: number;
-  branches?: Partial<BranchLimits>;
-  /**
-   * Provider for branches. A branch legitimately runs on its own model -- a
-   * cheaper one is often right for read-only exploration -- so this is a
-   * seam rather than a hook. Defaults to the parent's provider.
-   */
-  branchProvider?: () => Provider;
-  /** Depth of this session in the branch tree. Zero for a top-level session. */
-  branchDepth?: number;
-  /** O.2: stable across segment cuts; branches get independent work identities. */
-  workNamespace?: string;
-  /** O.5: default 3 is a conservative runtime quota, not a context threshold. */
-  maxParallelTools?: number;
-  /**
-   * Where blobs go. Snapshots are off when unset, which keeps the loop
-   * usable without the store -- a read-only branch has nothing to snapshot.
-   */
-  blobDir?: string;
-  imageOptions?: { readonly autoResize?: boolean; readonly blockImages?: boolean };
-}
-
-export interface SessionState {
-  node: number;
-  depth: number;
-  handoff: Handoff | null;
-  events: LogEvent[];
-  usage: UsageSample[];
-  /**
-   * The last prompt size the provider actually charged for. Boundary decisions
-   * anchor to it so only the delta since is estimated -- see core/tokens.ts.
-   */
-  anchor: Anchor | null;
-  /** Branches opened so far, against maxBranchesPerSession. */
-  branchesOpened: number;
-  /** Next free node number. Branches take one each. */
-  nextNode: number;
-  /** The workspace as of the last snapshot, for diffing the next one. */
-  /** Worktrees created for writing branches, by node. */
-  worktrees: Map<number, { path: string; branch: string }>;
-}
-
-function selfRef(dir: string, node: number, sha: string): NodeRef {
-  return { node, log_ref: nodePath(dir, node), sha256: sha };
-}
-
-/** Digest is I/O; core stays pure and the caller supplies the bytes. */
-async function digestedRef(dir: string, node: number): Promise<NodeRef> {
-  return selfRef(dir, node, await digestNode(dir, node));
-}
-
-/**
- * One completed exchange that changed files -- somewhere to go back to.
- *
- * The unit is a whole exchange, not a snapshot. A snapshot lands mid-turn,
- * after the tool results and before the model's closing message, so forking
- * there would cut a turn in half and drop the model's own summary of what it
- * just did. Claude Code lists prompts for the same reason: the thing a
- * person means by "before that" is a message they sent, not a tool call.
- */
-export interface RestorePoint {
-  node: number;
-  /** The user message is the editable navigation target; idle snapshots have none. */
-  userId?: string;
-  /** Last event of the exchange. Inclusive: the exchange itself is kept. */
-  atEvent: string;
-  /** The prompt that opened the exchange, for a caller that has to show it. */
-  prompt: string;
-  /** How many paths the exchange added, changed or removed. */
-  changed: number;
-  /**
-   * True when this exchange is in the context the session is currently in.
-   *
-   * False means a branch the session has left -- usually one it rewound away
-   * from. Those are listed too: a node that survives on disk but cannot be
-   * found again is undestroyed and unreachable, which is the same loss in a
-   * different shape.
-   */
-  onPath: boolean;
-}
-
-export type RewindPreview =
-  | { ok: true; willWrite: string[]; willDelete: string[] }
-  | { ok: false; error: string };
-
-/**
- * Which of the two halves move.
- *
- *   both     the default. Context and disk stay in agreement.
- *   files    the workspace goes back, the conversation does not.
- *   context  the conversation goes back, the workspace does not.
- */
-export type RewindMode = "both" | "files" | "context";
-
-export type RewindResult =
-  | { ok: true; node: number; restored: string[]; removed: string[]; unrecoverable: string[]; note: string }
-  | { ok: false; error: string };
-
-/** O.5: child execution returns facts; only the parent coordinator accepts them. */
-type DeferredToolResult = ToolResult & { accept?: () => Promise<LoopEvent[]>; annotation?: LogEvent; finalText?: string };
-type ToolCall = Extract<AssistantBlock, { type: "tool_use" }>;
-type SessionBrokerReceipt = BrokerReceipt<DeferredToolResult> & { events: LoopEvent[] };
-type PreparedBrokerCall = { run(emit?: (event: LoopEvent) => void): Promise<SessionBrokerReceipt> };
-export type CommittedItem = { node: number; id: string; type: LogEvent["t"] };
-
-export class Session {
-  private readonly execOwner = randomUUID();
-  private readonly jobs = new BranchJobs<DeferredToolResult>();
-  /**
-   * Branches the user started (/review-code), owned apart from `jobs`: an Esc
-   * on a parent turn cancels the model's branches, never these. Their joins
-   * wait in `pendingJoins` until the parent is idle and pairable.
-   */
-  private readonly userJobs = new BranchJobs<Extract<LogEvent, { t: "joined" }>>();
-  private readonly pendingJoins: { joined: LogEvent; note: string; usage: readonly UsageSample[] }[] = [];
-  /** Spawned but not yet handed to `userJobs` (its prelude is still recording): already running to an observer. */
-  private readonly startingUserBranches = new Set<number>();
-  private readonly children = new Map<number, Session>();
-  private cleanup: Promise<void> | null = null;
-  private closing: Promise<void> | null = null;
-  private turnTools: ToolContext | null = null;
-  /** The running request is read-only (RequestOptions.readOnly); every tool call goes through the Plan gate. */
-  private readOnlyRequest = false;
-  /** The source snapshot taken when the current goal request began; a counter-check reverts to it. In memory: a request never outlives its process. */
-  private goalBaseline: { request: string; snapshot: GitCheckpoint } | null = null;
-  private readonly execution = new ExecutionControl();
-  private readonly runtimeTargets = new RuntimeTargets();
-  private rootTools: ToolQueue | undefined;
-  private hostOwner: ReturnType<ExecutionControl["begin"]> | undefined;
-  private readonly hostPending = new Set<Promise<NativeCommandResult>>();
-  private stall: StallState | null = null;
-  private recovery: RecoveryState | null = null;
-  private processWake = new AbortController();
-  /**
-   * The exception the last provider request ended with, compared by identity
-   * in send()'s catch. Wrapping the error instead would break every check that
-   * reads it (FailedResponseError, statusOf, context overflow).
-   */
-  private providerFailure: { error: unknown; retries: number } | undefined;
-  private pendingAdoption: number | null = null;
-  /** A worktree enter/exit moves the root only once its tool round is paired, like adoption. */
-  private pendingRoot: string | null = null;
-  private readonly allocatedEventIds = new Set<string>();
-  private recordTail: Promise<void> = Promise.resolve();
-  private readonly recordListeners = new Set<(item: CommittedItem) => void>();
-  private readonly branchRecordListeners = new Set<(item: CommittedItem) => void>();
-  readonly config: SessionConfig;
-  /**
-   * Replaced by switchModel. Not readonly: a live session can change which
-   * adapter it talks to, and the replacement has to be the same field every
-   * send already reads.
-   */
-  provider: Provider;
-  readonly clock: Clock;
-  state: SessionState;
-  private readonly allocation: { next: number };
-  /** S.9: the vault behind placeholders. A branch is handed its parent's, like `allocation`. */
-  private secrets: SecretKeeper;
-
-  constructor(config: SessionConfig, provider: Provider, clock: Clock = systemClock(), allocation = { next: 1 }) {
-    if (config.acceptanceContract) parseAcceptanceContract(config.acceptanceContract);
-    if (config.contextPolicy !== undefined && !isContextPolicy(config.contextPolicy)) throw new Error("unknown context policy");
-    stallDecision(emptyStallState(), config.stallLimit ?? DEFAULT_STALL_LIMIT);
-    validateOutputRecoveryLimit(config.outputRecoveryLimit ?? DEFAULT_OUTPUT_RECOVERY_LIMIT);
-    schedulingWindow([], 0, config.maxParallelTools ?? 3);
-    validateRequestBudget(config.maxTurns, config.stallLimit ?? DEFAULT_STALL_LIMIT);
-    this.allocation = allocation;
-    this.secrets = new SecretKeeper(config.logDir, secretEnvironmentValues(config.secretEnvironment ?? process.env));
-    this.config = { ...config, ...(config.acceptanceContract ? { acceptanceContract: parseAcceptanceContract(config.acceptanceContract) } : {}), tools: { ...config.tools, execOwner: this.execOwner, historyCache: new HistoryCache(),
-      processWait: { wake: () => this.processWake.signal } } };
-    // A child or restored Session must never inherit another live invocation scope.
-    delete this.config.tools.invoke;
-    delete this.config.tools.invokeHost;
-    delete this.config.tools.runOwnedCommand;
-    delete this.config.tools.drainNested;
-    delete this.config.tools.origin;
-    delete this.config.tools.parentCallId;
-    delete this.config.tools.callId;
-    // Branch capability sets are owned by branchTools; a parent's optional catalog is not a grant.
-    if ((config.branchDepth ?? 0) > 0) delete this.config.tools.deferredTools;
-    this.config.tools.outputStore ??= join(config.logDir, "artifacts");
-    // Read at call time, so a branch that is handed its parent's keeper expands the parent's values.
-    this.config.tools.expandSecrets = input => this.secrets.expand(input);
-    this.config.tools.historyEvents = async () => {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw Error(history.error);
-      return history.nodes.flatMap(node => node.node === this.state.node ? structuredClone(this.state.events) : node.events);
-    };
-    if (config.blobDir) this.config.tools.checkpointBlobs = config.blobDir;
-    this.config.tools.frozenSystem = () => this.config.frozen.system;
-    // R4 / D8: full ancestry, not the bounded model view or a second mutable ledger.
-    // Each child Session installs its own callback even when contexts are copied.
-    this.config.tools.observedFileVersion = async absolute => {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw new Error(history.error);
-      return latestObservedFileVersion(history.nodes.flatMap(node => node.events), absolute, path => resolve(this.config.tools.root, path));
-    };
-    this.config.tools.observedProcess = async session => {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw new Error(history.error);
-      return latestProcessReceipt(await hydrateProcessReceipts(history.nodes, this.config.tools.outputStore!), session);
-    };
-    this.provider = provider;
-    this.clock = {
-      now: () => clock.now(),
-      nextId: () => {
-        let id = clock.nextId();
-        // Injected clocks may restart their sequence too. Event identity is a
-        // session invariant, independent of the clock's implementation.
-        if (this.allocatedEventIds.has(id)) id = randomUUID();
-        this.allocatedEventIds.add(id);
-        return id;
-      },
-    };
-    this.state = {
-      node: 0, depth: 1, handoff: null, events: [], usage: [],
-      anchor: null, branchesOpened: 0,
-      get nextNode() { return allocation.next; },
-      set nextNode(value: number) { allocation.next = value; },
-      worktrees: new Map(),
-    };
-    this.installWorkspace();
-  }
-
-  private installWorkspace(): void {
-    delete this.config.tools.workspace;
-    this.config.tools.ownedStatePaths = [this.config.logDir, ...(this.config.blobDir ? [this.config.blobDir] : [])];
-    if (this.config.blobDir) this.config.tools.workspace = new WorkspaceLifecycle(
-      this.config.tools.root, this.config.blobDir, this.config.shellCheckpoints === true,
-      event => this.record({ ...event, id: this.clock.nextId(), at: this.clock.now() }),
-      join(this.config.logDir, "checkpoints"),
-      this.config.tools.ownedStatePaths,
-    );
-  }
-
-  private async observeEvidence(): Promise<void> {
-    let proof = this.state.events.findLast(event => event.t === "tool_result" && event.effect?.kind === "command");
-    let prior = proof?.t === "tool_result" && proof.effect?.kind === "command" ? proof.effect.workspace_sha256 :
-      this.state.handoff?.state.completed.at(-1)?.evidence.workspace_sha256;
-    // A short task need not create a completed note. Its last command still
-    // establishes the comparison version when the current segment is empty.
-    if (!proof && this.config.tools.workspace) {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw new Error(history.error);
-      proof = history.nodes.flatMap(part => part.events).findLast(event => event.t === "tool_result" && event.effect?.kind === "command");
-      if (proof?.t === "tool_result" && proof.effect?.kind === "command") prior = proof.effect.workspace_sha256;
-    }
-    if (proof || prior || this.config.acceptanceContract) await this.config.tools.workspace?.observe(prior);
-  }
-
-  /**
-   * Opens the session: a new one, or the one this log already holds.
-   *
-   * Resuming restores the state a running session would have had, from the
-   * same ancestry walk the projection itself uses -- so what the model sees
-   * after a restart is what it would have seen had the process never exited.
-   * That equality is the whole contract; anything less makes a resumed
-   * session quietly different from a continuous one.
-   */
-  async start(): Promise<void> {
-    this.resetDerivedToolState();
-    const dir = this.config.logDir;
-    await this.secrets.load();
-    const model = this.provider.config.spec.id;
-    const existing = await listNodes(dir);
-    const recordedCursor = await readCursor(dir);
-    const cursor = recordedCursor === null ? null : await recoverCut(dir, recordedCursor);
-    const plan = planResume(cursor, model, existing.length > 0, this.provider.config.spec.provider);
-
-    switch (plan.kind) {
-      case "refuse":
-        throw new Error(plan.reason);
-
-      case "fresh":
-        this.config.contextPolicy ??= DEFAULT_CONTEXT_POLICY;
-        this.config.stallLimit ??= DEFAULT_STALL_LIMIT;
-        this.config.outputRecoveryLimit ??= DEFAULT_OUTPUT_RECOVERY_LIMIT;
-        await initNode(dir, 0, null, this.clock.now());
-        break;
-
-      case "resume": {
-        const replayed = await replayContext(dir, plan.cursor.node);
-        if (!plan.cursor.context_ref) throw new Error("missing frozen session context");
-        const saved = await getBlob(join(dir, "artifacts"), plan.cursor.context_ref);
-        if (saved === null) throw new Error("missing frozen session context");
-        // S.3: one format, parsed once. Every field below was written by a
-        // session of this format, so it is restored as recorded, not defaulted.
-        const context = parseSessionContext(JSON.parse(saved));
-        if (context.agentProfile) this.config.agentProfile = { ...context.agentProfile };
-        else delete this.config.agentProfile;
-        if (context.workflowMode) this.config.tools.workflowMode = context.workflowMode;
-        if (context.workflowToolProfile) this.config.workflowToolProfile = context.workflowToolProfile;
-        this.config.workingSet = context.workingSet;
-        this.config.shellCheckpoints = context.shellCheckpoints;
-        this.config.acceptanceContract = context.acceptanceContract ?? null;
-        this.config.strictVerification = context.strictVerification;
-        this.config.skills = context.skills;
-        this.installSkillResources();
-        this.config.workNamespace = context.workNamespace;
-        this.config.maxParallelTools = context.maxParallelTools;
-        this.config.stallLimit = context.stallLimit;
-        this.config.outputRecoveryLimit = context.outputRecoveryLimit;
-        this.config.frozen = context.frozen;
-        this.config.tools.gates = context.gates;
-        this.config.contextPolicy = context.contextPolicy;
-        if (context.boundary !== undefined) this.config.boundary = context.boundary;
-        else delete this.config.boundary;
-        if (context.guidance !== undefined) this.config.guidance = context.guidance;
-        else delete this.config.guidance;
-        if (context.blindChecks) this.config.blindChecks = context.blindChecks;
-        else delete this.config.blindChecks;
-        if (plan.cursor.workspace !== undefined) this.config.tools.root = plan.cursor.workspace;
-        if (plan.cursor.blob_dir !== undefined) this.config.blobDir = plan.cursor.blob_dir;
-        for (const id of existing) {
-          for (const event of (await readNode(dir, id)).events) {
-            this.allocatedEventIds.add(event.id);
-            if (event.t === "spawn") {
-              this.state.branchesOpened++;
-              if (event.workspace) this.state.worktrees.set(event.branch.node, event.workspace);
-            }
-            if (event.t === "discard") this.state.worktrees.delete(event.branch.node);
-          }
-        }
-
-        this.state.node = plan.cursor.node;
-        // From the allocator's recorded state, never from a node count: dead
-        // limbs and resolved branches hold ids, and recomputing this is the
-        // shape of the bug that once had a cut overwrite a branch's log.
-        // A crashed branch can reserve a node before the parent updates its
-        // allocator. Recovery only raises the recorded high-water mark.
-        this.state.nextNode = Math.max(plan.cursor.next_node, ...existing.map((n) => n + 1));
-        this.state.depth = replayed.depth;
-        this.state.events = replayed.contextEvents;
-        this.state.handoff = replayed.handoff;
-        await this.answerUnpairedTools("interrupted: tool outcome is unknown after restart; inspect the workspace or external operation before retrying");
-        // Nothing has been sent this process, so there is no billed prompt
-        // size to anchor to yet; the first response re-establishes it.
-        this.state.anchor = null;
-        // Compare disk against the durable file projection. Treating current
-        // disk as the baseline would erase unlogged effects of a crashed tool.
-        const pending = (await readNode(dir, plan.cursor.node)).events.findLast((e) => e.t === "adopt" && !e.applied);
-        if (pending?.t === "adopt") {
-          this.pendingAdoption = pending.branch.node;
-          await this.adoptPendingBranch();
-        }
-        break;
-      }
-
-      default:
-        return assertNever(plan, "Session.start");
-    }
-
-    this.installWorkspace();
-    await this.recoverFileOperations();
-    this.restoreDeclaredTools();
-    // Consume the original pending receipt before another checkpoint can replace this projection.
-    const declarationCut = await this.applyDiscoveredTools();
-    await this.refreshRuntimeTargets();
-    if (!declarationCut && (cursor?.needs_model_checkpoint || needsReplayCheckpoint(this.state.events, providerReplayKey(this.provider.config.spec), nativeReplay(this.provider.config.spec)))) {
-      await this.performCut("model_checkpoint", model);
-    }
-    await this.saveCursor();
-  }
-
-  /**
-   * Copies this session's current path into `destLogDir`, optionally
-   * stopping at `untilEvent` (inclusive). The source files are only read:
-   * a fork that rewrote the original would leave the user with one line
-   * when they thought they had two.
-   */
-  async fork(destLogDir: string, untilEvent?: string, position: "at" | "before" = "at"): Promise<void> {
-    await copyAncestryTo(this.config.logDir, destLogDir, this.clock.now(), untilEvent, position);
-    await copyVault(this.config.logDir, destLogDir);
-    if (untilEvent !== undefined) {
-      const cursor = await readCursor(destLogDir);
-      if (!cursor) throw new Error("missing fork cursor");
-      const tip = (await readNode(this.config.logDir, this.state.node)).events.at(-1);
-      const filesFrom = { ...await digestedRef(this.config.logDir, this.state.node), ...(tip ? { at_event: tip.id } : {}) };
-      const header = (await readNode(destLogDir, cursor.node)).header;
-      const event: LogEvent = { t: "rewind", id: this.clock.nextId(), at: this.clock.now(), mode: "context", from: header?.parent ?? filesFrom,
-        files_from: filesFrom, prompt: "Forked conversation", restored: [], removed: [], unrecoverable: [], divergence: [] };
-      await appendEvent(destLogDir, cursor.node, event);
-      await writeCursor(destLogDir, { ...cursor, at_event: event.id, updated_at: event.at });
-    }
-  }
-
-  async setThinking(effort: Effort): Promise<void> {
-    this.provider.config.effort = effort;
-    await this.saveCursor();
-  }
-
-  /** Trusted extension commands share the Session owner without inventing a user turn. */
-  runExtensionCommand(command: string, args: string[], options?: { cwd?: string; timeout?: number; signal?: AbortSignal }): Promise<NativeCommandResult> {
-    if (this.cleanup || this.closing) return Promise.reject(new Error("session is draining or disposed"));
-    const input: NativeCommandInput = { argv: [command, ...args], ...(options?.cwd !== undefined ? { cwd: options.cwd } : {}),
-      ...(options?.timeout !== undefined ? { timeout: options.timeout } : {}) };
-    if (!this.execution.running) this.hostOwner = this.execution.begin();
-    const signals = [this.execution.signal, options?.signal].filter((signal): signal is AbortSignal => signal !== undefined);
-    const signal = AbortSignal.any(signals);
-    const result = (async () => {
-      const call: ToolCall = { type: "tool_use", call_id: `host-${randomUUID()}`, name: NATIVE_COMMAND_NAME, input };
-      const preparation = this.prepareBrokerCall(call, () => 0, false, signal, true);
-      let prepared: PreparedBrokerCall;
-      for (;;) { const step = await preparation.next(); if (step.done) { prepared = step.value; break; } }
-      const receipt = await prepared.run();
-      await receipt.commit();
-      await this.saveCursor();
-      return nativeCommandResult(receipt.value, this.config.tools.outputStore!);
-    })();
-    this.hostPending.add(result);
-    const finished = () => {
-      this.hostPending.delete(result);
-      if (this.hostPending.size === 0 && this.hostOwner) { this.hostOwner.finish(); this.hostOwner = undefined; }
-    };
-    void result.then(finished, finished);
-    return result;
-  }
-
-  async runUserBash(command: string, excludeFromContext: boolean, signal?: AbortSignal,
-    onOutput?: (chunk: Uint8Array) => void): Promise<Extract<LogEvent, { t: "user_bash" }>> {
-    if (this.cleanup || this.closing) throw new Error("session is draining or disposed");
-    const owned = this.execution.begin(signal);
-    let release: (() => void) | undefined;
-    try {
-      this.rootTools ??= new ToolQueue(this.config.maxParallelTools ?? 3);
-      release = await this.rootTools.acquire("exclusive");
-      if (!command.trim()) throw new Error("empty user command");
-      const execute = async (): Promise<ToolResult> => {
-        const captured = await observeCommand({ command, cwd: this.config.tools.root,
-          outputStore: join(this.config.logDir, "artifacts"), maxOutputBytes: this.config.tools.maxOutputBytes,
-          timeoutMs: this.config.tools.timeoutMs, signal: owned.signal, ...(onOutput ? { onOutput } : {}) });
-        const completion = commandCompletion(captured.exit, captured.stopped, captured.cleanup);
-        const preview = headTailView(captured.head, captured.tail, captured.ref.bytes, this.config.tools.maxOutputBytes,
-          omitted => `\n[${omitted} bytes omitted; complete output: ${captured.ref.path}]\n`);
-        return { ...completion, content: `${preview}\nexit ${captured.exit} · ${completion.outcome.status} · ${completion.outcome.reason}` +
-          (captured.cleanup ? `\n${captured.cleanup.message}` : ""),
-          content_ref: captured.ref, effect: { kind: "command", cmd: command, exit: captured.exit } };
-      };
-      const result = this.config.tools.workspace ? await this.config.tools.workspace.command("bash", { command }, execute, owned.signal) : await execute();
-      if (result.effect?.kind !== "command" || !result.content_ref || !result.outcome) throw new Error("missing user command observation");
-      const event: Extract<LogEvent, { t: "user_bash" }> = { t: "user_bash", id: this.clock.nextId(), at: this.clock.now(),
-        command, content: result.content, exit: result.effect.exit, excludeFromContext, outcome: result.outcome, content_ref: result.content_ref };
-      await this.record(event);
-      await this.saveCursor();
-      return event;
-    } catch (error) {
-      await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
-        reason: "user command failed before completion; inspect the workspace before retrying", outcome: executionOutcome("execution_error") });
-      throw error;
-    } finally {
-      release?.();
-      while (this.hostPending.size > 0) await Promise.allSettled(this.hostPending);
-      owned.finish();
-    }
-  }
-
-  async userMessages(): Promise<{ id: string; node: number; text: string; images?: readonly ImageRef[] }[]> {
-    const messages: Awaited<ReturnType<Session["userMessages"]>> = [];
-    for (const node of await listNodes(this.config.logDir)) {
-      for (const event of (await readNode(this.config.logDir, node)).events) {
-        if (event.t === "user") messages.push({ id: event.id, node, ...userInputData(event) });
-      }
-    }
-    return messages;
-  }
-
-  /** Pi keeps the selected runtime model when navigating; N.8 checkpoints incompatible context. */
-  async navigateTo(eventId: string): Promise<{ editorText?: string; images?: readonly ImageRef[] }> {
-    const dir = this.config.logDir;
-    const users = await this.userMessages();
-    const target = await resolveHistoryPosition(dir, eventId, users.some(user => user.id === eventId) ? "before" : "at");
-    const previous = (await readNode(dir, this.state.node)).events.at(-1);
-    const filesFrom = { ...await digestedRef(dir, this.state.node), ...(previous ? { at_event: previous.id } : {}) };
-    const node = this.state.nextNode++;
-    await initNode(dir, node, target.parent, this.clock.now(), target.basis);
-    await appendEvent(dir, node, {
-      t: "rewind", id: this.clock.nextId(), at: this.clock.now(), mode: "context", from: target.parent ?? filesFrom,
-      files_from: filesFrom, prompt: target.editorText ?? "Selected conversation position", restored: [], removed: [], unrecoverable: [], divergence: [],
-    });
-    const cursor = await readCursor(dir);
-    if (!cursor) throw new Error("missing current session cursor");
-    const next = { ...cursor, node, next_node: this.state.nextNode, updated_at: this.clock.now(),
-      needs_model_checkpoint: target.parent !== null && (target.selection === null || !sameModel(target.selection, cursor)) };
-    delete next.at_event;
-    await writeCursor(dir, next);
-    await this.start();
-    const images = users.find(user => user.id === eventId)?.images;
-    return target.editorText === undefined ? {} : { editorText: target.editorText, ...(images?.length ? { images } : {}) };
-  }
-
-  /**
-   * Cuts the current node, then runs on a different provider.
-   *
-   * The cut is the whole point. Thinking blocks belong to the model that
-   * produced them, and every provider this harness talks to requires them
-   * replayed unchanged. Handing Anthropic's signed block to DeepSeek -- or
-   * even to another Anthropic model -- is a bad request. Filtering the
-   * blocks out of the projection would make what the model sees depend on
-   * a "we switched" flag that is not in the log. Cutting makes the switch
-   * a fact in the log: the new node starts from a handoff, which is plain
-   * YAML, and inherits none of the old blocks.
-   *
-   * Bypasses minNodeWorkTokens. That floor is a cost argument (a handoff
-   * only pays for itself once the node's own history exceeds it). A switch
-   * is a correctness argument, and must be allowed after two turns.
-   *
-   * Only legal between turns. A cut between tool_use and tool_result would
-   * leave the log unpairable (D5).
-   *
-   * Recorded as model_checkpoint, not trigger. "trigger" means this node
-   * reached the token threshold. A switch is not that -- it can happen on
-   * turn two -- and a later reader reconstructing the session from the log
-   * must see that a person changed models, not that the node filled up.
-   * boundary.ts already produces this reason when checkpointRequested is
-   * set; switchModel is the other caller that wants it.
-   *
-   * An empty projection is the exception (fix-switch-model-empty-segment).
-   * With no events there is no old model's block to keep away from the new
-   * one, and the frozen prefix does not change here, so the cursor alone
-   * records the switch. Cutting anyway sealed an empty segment and opened
-   * the next from an empty handoff, which the model read as earlier work to
-   * resume. The check is the projection, not the node file: an inherit-basis
-   * node can be empty on disk while still projecting ancestor thinking.
-   *
-   * Returns whether a segment was cut, so the caller can say so truthfully.
-   */
-  async switchModel(next: Provider): Promise<boolean> {
-    if (this.running || this.isHalfRound()) {
-      throw new Error(
-        "cannot switch models mid-turn: a tool_use is still unpaired. " +
-          "Wait for the turn to finish so every call has a result",
-      );
-    }
-
-    const cut = this.state.events.length > 0;
-    if (cut) await this.performCut("model_checkpoint", next.config.spec.id, undefined, next.config.spec.provider, next.config.effort);
-    else this.state.anchor = null;
-    this.provider = next;
-    await this.saveCursor();
-    return cut;
-  }
-
-  /** D6: changing the frozen prefix is an explicit checkpoint, never in-place prompt surgery. */
-  assertResourceIdle(): void {
-    if (this.running || this.isHalfRound()) throw new Error("cannot reload resources while a turn is active or a tool call is unpaired");
-  }
-
-  async reloadResources(frozen: FrozenPrefix, skills = this.config.skills, nextProvider?: Provider, forceCheckpoint = false): Promise<boolean> {
-    if (!nextProvider && !forceCheckpoint && JSON.stringify(frozen) === JSON.stringify(this.config.frozen) && JSON.stringify(skills) === JSON.stringify(this.config.skills)) return false;
-    this.assertResourceIdle();
-    const contextRef = await this.persistContext(frozen, skills);
-    const provider = nextProvider ?? this.provider;
-    await this.performCut("model_checkpoint", provider.config.spec.id, undefined,
-      provider.config.spec.provider, provider.config.effort, contextRef);
-    this.provider = provider;
-    this.config.frozen = frozen;
-    if (skills !== undefined) this.config.skills = skills;
-    this.installSkillResources();
-    this.config.tools.allow = frozen.tools.flatMap(tool => tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string" ? [tool.name] : []);
-    await this.saveCursor();
-    return true;
-  }
-
-  /** Restoring a declaration never installs code: only the current selected local catalog can supply it. */
-  private restoreDeclaredTools(): void {
-    const declared = new Set(declaredToolNames(this.config.frozen.tools));
-    const loaded = currentDeferredTools(this.config.tools).filter(tool => declared.has(tool.name)).map(tool => tool.name);
-    if (loaded.length && this.config.tools.allow !== undefined) this.config.tools.allow = [...new Set([...this.config.tools.allow, ...loaded])];
-  }
-
-  /** D5/D6: consume original discovery receipts only after every invocation has its result. */
-  private async applyDiscoveredTools(): Promise<boolean> {
-    if (this.isHalfRound() || (this.config.branchDepth ?? 0) > 0 || this.config.tools.extensions?.get(DISCOVERY_TOOL_NAME) !== DISCOVERY_TOOL) return false;
-    const declared = new Set(declaredToolNames(this.config.frozen.tools));
-    const requested = new Map(recordedDeclarations(this.state.events).map(item => [item.name, item.fingerprint]));
-    const additions = currentDeferredTools(this.config.tools).filter(tool => !declared.has(tool.name) &&
-      requested.get(tool.name) === discoveryFingerprint(tool) && discoveryPermitted(this.config.tools, tool.name));
-    if (additions.length === 0) return false;
-    const frozen = { ...this.config.frozen, tools: [...this.config.frozen.tools, ...additions] };
-    const contextRef = await this.persistContext(frozen);
-    await this.performCut("model_checkpoint", this.provider.config.spec.id, undefined,
-      this.provider.config.spec.provider, this.provider.config.effort, contextRef);
-    this.config.frozen = frozen;
-    this.restoreDeclaredTools();
-    // send() restores its base tool scope at the end; keep accepted declarations there too.
-    if (this.turnTools?.allow !== undefined) this.turnTools.allow = [...new Set([...this.turnTools.allow, ...additions.map(tool => tool.name)])];
-    await this.saveCursor();
-    return true;
-  }
-
-  /**
-   * The same pairing check switchModel already used. A user message
-   * between tool_use and tool_result is the same unpairable request a
-   * model switch would produce — so the queue reuses this, it does not
-   * invent a second half-round test.
-   */
-  private isHalfRound(): boolean {
-    const projected = projectContext({
-      frozen: this.config.frozen,
-      handoff: this.state.handoff,
-      events: this.state.events,
-    });
-    return projected.violations.some((v) => v.code === "UNPAIRED_TOOL_USE");
-  }
-
-  /**
-   * Offers after_tools only when the log is pairable. The UI still owns
-   * the queue; we just ask. A half-round returns null even if the UI
-   * offered a line — writing it would be the pairing bug this guards.
-   */
-  private async pullSteering(
-    pull?: (phase: Phase) => Promise<UserInput | null>,
-  ): Promise<UserInput | null> {
-    if (pull === undefined || this.isHalfRound()) return null;
-    // Rotate before pulling: an input queued during the async pull still wakes
-    // the next wait. A wake never cancels the process's lifetime signal.
-    this.processWake = new AbortController();
-    const text = await pull("after_tools");
-    if (text === null || typeof text === "string" && text.length === 0) return null;
-    if (this.turnTools) this.config.tools = { ...this.turnTools };
-    return text;
-  }
-
-  /**
-   * Records where the session is, after every move.
-   *
-   * Written at each move rather than at exit, because the failures worth
-   * resuming from -- a crash, a kill, a closed laptop -- do not run exit
-   * handlers.
-   */
-  private async persistContext(frozen = this.config.frozen, skills = this.config.skills): Promise<string> {
-    const context: SessionContext = {
-      frozen, gates: this.config.tools.gates,
-      shellCheckpoints: this.config.shellCheckpoints === true,
-      skills: skills ?? [],
-      strictVerification: this.config.strictVerification === true,
-      workingSet: this.config.workingSet === true,
-      workNamespace: this.config.workNamespace ?? "main",
-      maxParallelTools: this.config.maxParallelTools ?? 3,
-      contextPolicy: this.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY,
-      stallLimit: this.config.stallLimit ?? DEFAULT_STALL_LIMIT,
-      outputRecoveryLimit: this.config.outputRecoveryLimit ?? DEFAULT_OUTPUT_RECOVERY_LIMIT,
-      ...(this.config.acceptanceContract ? { acceptanceContract: this.config.acceptanceContract } : {}),
-      ...(this.config.tools.workflowMode ? { workflowMode: this.config.tools.workflowMode } : {}),
-      ...(this.config.agentProfile ? { agentProfile: this.config.agentProfile } : {}),
-      ...(this.config.workflowToolProfile ? { workflowToolProfile: this.config.workflowToolProfile } : {}),
-      ...(this.config.boundary ? { boundary: this.config.boundary } : {}),
-      ...(this.config.guidance === undefined ? {} : { guidance: this.config.guidance }),
-      ...(this.config.blindChecks ? { blindChecks: this.config.blindChecks } : {}),
-    };
-    return putBlob(join(this.config.logDir, "artifacts"), JSON.stringify(context));
-  }
-
-  private async saveCursor(model = this.provider.config.spec.id, provider = this.provider.config.spec.provider,
-    thinking = this.provider.config.effort, contextRef?: string): Promise<void> {
-    // Branches share storage but never own the parent's active cursor.
-    if ((this.config.branchDepth ?? 0) > 0) return;
-    const last = (await readNode(this.config.logDir, this.state.node)).events.at(-1);
-    await writeCursor(this.config.logDir, {
-      node: this.state.node,
-      next_node: this.state.nextNode,
-      model,
-      provider,
-      thinking,
-      ...(last ? { at_event: last.id } : {}),
-      ...(this.config.blobDir === undefined ? {} : { blob_dir: this.config.blobDir }),
-      updated_at: this.clock.now(),
-      workspace: this.config.tools.root,
-      context_ref: contextRef ?? await this.persistContext(),
-      xeno_version: XENO_VERSION,
-    });
-  }
-
-  /** Q24: publish identities only after durable append, including non-model user actions. */
-  /** Commits inside this session's branches (their node numbers), for a client showing one live. */
-  subscribeBranchRecords(listener: (item: CommittedItem) => void): () => void {
-    this.branchRecordListeners.add(listener); return () => { this.branchRecordListeners.delete(listener); };
-  }
-  subscribeRecords(listener: (item: CommittedItem) => void): () => void {
-    this.recordListeners.add(listener); return () => { this.recordListeners.delete(listener); };
-  }
-
-  private async record(event: LogEvent): Promise<void> {
-    // D8: runtime callers may retain mutable results. The in-memory projection
-    // must own the same JSON value that was appended, independent of later edits.
-    event = JSON.parse(JSON.stringify(event)) as LogEvent;
-    // S.9: credentials become placeholders before anything is written, so no
-    // projection, handoff, export or history page can carry the value.
-    const redacted = await this.secrets.redact(event, this.lastAssistantText());
-    event = redacted.event;
-    const saved = this.recordTail.then(async () => {
-      await appendEvent(this.config.logDir, this.state.node, event);
-      this.state.events.push(event);
-      if (this.stall !== null) this.stall = advanceStall(this.stall, [{ node: this.state.node, event }]);
-      if (this.recovery !== null) this.recovery = advanceRecovery(this.recovery, [event], path => resolve(this.config.tools.root, path));
-      for (const listener of this.recordListeners) {
-        try { listener({ node: this.state.node, id: event.id, type: event.t }); } catch { /* observers never own the append */ }
-      }
-    });
-    this.recordTail = saved.catch(() => {});
-    await saved;
-    if (redacted.added > 0 && !this.state.events.some(item => item.t === "guidance" && item.reason === "secret")) {
-      await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "secret", text: SECRET_GUIDANCE, sources: [event.id] });
-    }
-    if (event.t === "tool_result" && event.ok && event.effect?.kind === "read") {
-      const path = resolve(this.config.tools.root, event.effect.path);
-      const skill = this.config.skills?.find(item => item.filePath === path);
-      if (skill && !skill.disableModelInvocation) {
-        await this.recordSkill(skill, "read", "model");
-        this.config.tools.allow = skillTools(this.allowedNames(), skill);
-        // Restricted skill scopes cannot grow their capability set by searching a parent directory.
-        if (skill.allowedTools !== undefined || skill.disallowedTools !== undefined) this.config.tools.deferredTools = [];
-      }
-    }
-  }
-
-  /** The text the user is answering, for recognising a solicited credential. */
-  private lastAssistantText(): string | undefined {
-    for (let i = this.state.events.length - 1; i >= 0; i--) {
-      const event = this.state.events[i]!;
-      if (event.t === "user") return undefined;
-      if (event.t === "assistant") {
-        const text = event.blocks.flatMap(block => block.type === "text" ? [block.text] : []).join("\n");
-        if (text.trim()) return text;
-      }
-    }
-    return undefined;
-  }
-
-  private allowedNames(): string[] {
-    return this.config.frozen.tools.flatMap(tool => tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string" &&
-      (this.config.tools.allow === undefined || this.config.tools.allow.includes(tool.name)) ? [tool.name] : []);
-  }
-
-  private adviceNames(frozen = this.config.frozen): string[] {
-    const declared = frozen.tools.flatMap(tool => tool !== null && typeof tool === "object" && "name" in tool && typeof tool.name === "string" ? [tool.name] : []);
-    return adviceTools({ ...this.config.tools, advice: declared, ...(frozen === this.config.frozen ? {} : { allow: declared }) });
-  }
-
-  private installSkillResources(): void {
-    this.config.tools.skillResources = (this.config.skills ?? []).map(skill => ({ path: skill.filePath,
-      text: skill.sourceText ?? skill.body, modelInvocable: !skill.disableModelInvocation && skill.context !== "fork" }));
-  }
-
-  private async recordSkill(skill: Skill, mode: "inline" | "fork" | "read", origin: "user" | "model"): Promise<void> {
-    const artifact = await putBlob(join(this.config.logDir, "artifacts"), skill.sourceText ?? skill.body);
-    await this.record({ t: "skill_loaded", id: this.clock.nextId(), at: this.clock.now(), name: skill.name, path: skill.filePath,
-      sha256: artifact, artifact, mode, origin });
-  }
-
-  /** O.12: main instructions are durable; permissions apply to this invocation only. */
-  async *sendSkill(skill: Skill, prompt: UserInput, signal?: AbortSignal): AsyncGenerator<LoopEvent> {
-    if (this.running || this.cleanup || this.closing || this.isHalfRound()) throw new Error("a skill requires an idle paired session");
-    skill = this.config.skills?.find(item => item.name === skill.name && item.filePath === skill.filePath) ?? skill;
-    if (skill.userInvocable === false) throw new Error("this skill cannot be invoked by users");
-    const savedTools = this.config.tools;
-    this.config.tools = { ...savedTools, allow: skillTools(this.allowedNames(), skill) };
-    if (skill.allowedTools !== undefined || skill.disallowedTools !== undefined) this.config.tools.deferredTools = [];
-    try {
-      await this.recordSkill(skill, skill.context === "fork" ? "fork" : "inline", "user");
-      if (skill.context !== "fork") { yield* this.send(prompt, signal); return; }
-      const owned = this.execution.begin(signal);
-      try {
-        await this.record({ t: "user", id: this.clock.nextId(), at: this.clock.now(), text: `Run isolated skill ${skill.name}; source ${skill.filePath}.` });
-        const writes = skill.allowedTools?.some(name => this.allowedNames().includes(name) &&
-          WRITING_BRANCH_TOOL_NAMES.includes(name) && !BRANCH_TOOL_NAMES.includes(name)) ?? false;
-        const result = yield* this.runBranch({ purpose: `skill ${skill.name}`, prompt: userInputData(prompt).text, writes }, 0, owned.signal, skill);
-        await result.accept?.();
-        await this.record({ t: "extension", id: this.clock.nextId(), at: this.clock.now(), customType: "skill_result", content: result.content,
-          display: true, inContext: true });
-        // Evidence stays in the receipt; structured output validates the child's
-        // actual final message, never the human-readable receipt wrapper (D11).
-        const finalText = this.config.validateOutput ? result.finalText ?? "" : result.content;
-        let outcome = result.outcome ?? executionOutcome("execution_error"), reason = "isolated skill finished";
-        if (outcome.status === "completed") {
-          const error = await this.validateFinalOutput(finalText);
-          if (error !== undefined) { outcome = executionOutcome("execution_error"); reason = error; }
-        }
-        await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(), reason, outcome });
-        await this.saveCursor();
-        yield { kind: "assistant_text", text: finalText };
-        yield { kind: "done", outcome, reason };
-      } finally { owned.finish(); }
-    } finally { this.config.tools = savedTools; this.restoreDeclaredTools(); }
-  }
-
-  /** Every final publication path records the same validator receipt (D11). */
-  private async validateFinalOutput(text: string): Promise<string | undefined> {
-    if (!this.config.validateOutput) return undefined;
-    const validation = this.config.validateOutput(text);
-    await this.appendExtension({ customType: "output_validation", content: validation.ok ? "Final JSON output passed the selected schema." : `Final JSON output failed: ${validation.error ?? "schema mismatch"}`,
-      display: false, inContext: false, data: { valid: validation.ok } });
-    return validation.ok ? undefined : `output schema validation failed: ${validation.error ?? "schema mismatch"}`;
-  }
-
-  /** O.8: dispatch and diagnostics share exact source hints, including forks. */
-  contextInput(): ProjectInput {
-    return { frozen: this.config.frozen, handoff: this.state.handoff, events: this.state.events,
-      logHint: { manifestPath: manifestPath(this.config.logDir),
-        segmentPath: this.state.handoff?.predecessor?.log_ref ?? nodePath(this.config.logDir, this.state.node) } };
-  }
-
-  private async boundCarried(full: Handoff, tools = this.adviceNames()): Promise<Handoff> {
-    return carriedHandoff(this.config.logDir, this.state.node, full, { handoff_tokens: DEFAULT_HANDOFF_TOKENS,
-      ...(this.config.workingSet ? { working_set_version: CURRENT_WORKING_SET_VERSION } : {}), guidance_tools: tools });
-  }
-
-  async acceptanceState(): Promise<AcceptanceState | undefined> {
-    if (!this.running) await this.observeEvidence();
-    // External editor changes must invalidate proof before the user reads it.
-    if (!this.running) await this.refreshRuntimeTargets();
-    return (await this.currentHandoff()).acceptance;
-  }
-
-  /** S.5: the goal in force, derived from the active log ancestry, so it survives restarts and resume. */
-  async goal(): Promise<ActiveGoal | null> {
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    return activeGoal(history.nodes.flatMap(part => part.events));
-  }
-
-  /**
-   * Records a goal from criteria the user accepted out of a model draft. The
-   * draft event must be this session's assistant reply; the contract holds
-   * only what was accepted (S.2).
-   */
-  async setGoal(input: { objective: string; draft: string; criteria: readonly AcceptanceCriterion[]; accepted: readonly string[] }): Promise<ActiveGoal> {
-    if (this.running || this.isHalfRound()) throw new Error("a goal can be set only while the session is idle");
-    if (!input.objective.trim()) throw new Error("a goal needs an objective");
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    if (!history.nodes.some(part => part.events.some(event => event.t === "assistant" && event.id === input.draft))) throw new Error("the goal draft is not in this session");
-    const contract = goalContract(input.criteria, input.accepted);
-    const accepted = contract.criteria.map(item => item.id);
-    const event: ActiveGoal = { t: "goal", id: this.clock.nextId(), at: this.clock.now(), action: "set", objective: input.objective.trim(),
-      contract, draft: input.draft, accepted, rejected: input.criteria.map(item => item.id).filter(id => !accepted.includes(id)) };
-    await this.record(event);
-    await this.saveCursor();
-    return event;
-  }
-
-  /**
-   * The discriminating rung: each passing accepted check re-run in a clone with
-   * this request's changes undone, recorded as counter_check facts with the
-   * role each criterion was declared with. Guards run too: passing there is
-   * what makes a guard a guard (S.7). The goal's verdict does not depend on it;
-   * it tells the user which checks actually tested the change.
-   */
-  private async counterCheckRequest(state: RequestState, signal?: AbortSignal): Promise<void> {
-    const checks = state.criteria.flatMap(item => item.kind === "command" && item.status === "pass" && item.command
-      ? [{ id: item.id, command: item.command, ...(item.guard ? { guard: true as const } : {}) }] : []);
-    if (checks.length === 0 || signal?.aborted) return;
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    const events = currentRequestRecords(history.nodes).map(record => record.event);
-    // A snapshot taken when this request began reverts shell changes too; otherwise the journal does.
-    const workspace = this.config.tools.workspace, base = this.goalBaseline?.request === state.request.event ? this.goalBaseline.snapshot : null;
-    const now = base && workspace ? await workspace.snapshot(signal) : null;
-    const revert = base && now && workspace ? invertFileChanges(await workspace.snapshotChanges(base, now, signal)) : undefined;
-    const results = !this.config.blobDir ? checks.map(check => ({ ...check, reason: "this session keeps no file history to undo changes from" }))
-      : await counterCheck({ root: this.config.tools.root, blobs: this.config.blobDir, ownedPaths: this.config.tools.ownedStatePaths ?? [],
-        events, checks, timeoutMs: this.config.tools.timeoutMs, maxOutputBytes: this.config.tools.maxOutputBytes,
-        outputStore: join(this.config.logDir, "artifacts"), ...(revert ? { revert } : {}), ...(signal ? { signal } : {}) });
-    for (const result of results) await this.record({ t: "counter_check", id: this.clock.nextId(), at: this.clock.now(), request: state.request.event,
-      criterion: result.id, command: result.command, ...(result.guard ? { guard: true as const } : {}),
-      ...("exit" in result ? { exit: result.exit } : { reason: result.reason }) });
-  }
-
-  /**
-   * The independent rung: blind checks run on a clone of the final result once
-   * the goal's own checks pass. The scan for exposure covers the whole log, not
-   * just this request -- a blind file read yesterday is still seen.
-   */
-  private async blindCheckRequest(state: RequestState, signal?: AbortSignal): Promise<void> {
-    const blind = this.config.blindChecks;
-    if (!blind || signal?.aborted) return;
-    const nodes = await listNodes(this.config.logDir);
-    const everything = (await Promise.all(nodes.map(node => readNode(this.config.logDir, node)))).flatMap(read => read.events);
-    const exposure = blindExposure(everything, blind);
-    const results = await runBlindChecks({ root: this.config.tools.root, blind, timeoutMs: this.config.tools.timeoutMs,
-      maxOutputBytes: this.config.tools.maxOutputBytes, outputStore: join(this.config.logDir, "artifacts"), ...(signal ? { signal } : {}) });
-    for (const result of results) await this.record({ t: "blind_check", id: this.clock.nextId(), at: this.clock.now(), request: state.request.event,
-      check: result.id, exposed: exposure !== null, ...(exposure ? { exposure } : {}), ...("exit" in result ? { exit: result.exit } : { reason: result.reason }) });
-  }
-
-  async clearGoal(): Promise<boolean> {
-    if (this.running) throw new Error("a goal can be cleared only while the session is idle");
-    if (!await this.goal()) return false;
-    await this.record({ t: "goal", id: this.clock.nextId(), at: this.clock.now(), action: "clear", reason: "user" });
-    await this.saveCursor();
-    return true;
-  }
-
-  async requestState(): Promise<RequestState | undefined> {
-    // Use the same idle workspace/target observation boundary as /acceptance.
-    if (!this.running) await this.acceptanceState();
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    return deriveRequestState(history.nodes, { strict: this.config.strictVerification === true, blind: this.config.blindChecks !== undefined });
-  }
-
-  /** Only called at paired, owned boundaries; probes never enter a pending model tool exchange. */
-  private async refreshRuntimeTargets(): Promise<void> {
-    const state = (await this.currentHandoff()).acceptance;
-    const observations: string[] = [];
-    for (const target of state?.targets ?? []) if (target.observation || target.binding) {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw Error(history.error);
-      const observed = await this.runtimeTargets.perform(this.config.tools, history.nodes, { action: "inspect", target: target.id });
-      const id = this.clock.nextId();
-      await this.record({ t: "target_observation", id, at: this.clock.now(), observation: observed.observation });
-      observations.push(id);
-    }
-    if (!observations.length) return;
-    const current = (await this.currentHandoff()).acceptance;
-    if (current?.targets?.some(target => {
-      const before = state?.targets?.find(item => item.id === target.id);
-      return before?.status !== target.status || before.binding !== target.binding || before.build_event !== target.build_event;
-    })) await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "runtime_acceptance", sources: observations,
-      text: `Runtime acceptance observations changed. Status ${current.status}; targets ${JSON.stringify(current.targets)}. Only a ready owned instance can receive human acceptance; old observations do not grant current ownership.` });
-  }
-
-  async workItems(): Promise<readonly WorkItem[]> {
-    const replayed = await replayContext(this.config.logDir, this.state.node);
-    return deriveHandoff({ prev: replayed.fullHandoff, events: replayed.events, depth: replayed.depth,
-      self: await this.nodeRefFor(this.state.node) }).state.work_items ?? [];
-  }
-
-  /** What the next handoff would carry if the segment were cut now. Pure derivation; nothing is written. */
-  async previewHandoff(): Promise<Handoff> { return this.currentHandoff(); }
-
-  private async currentHandoff(): Promise<Handoff> {
-    const replayed = await replayContext(this.config.logDir, this.state.node);
-    return deriveHandoff({ prev: replayed.fullHandoff, events: replayed.events, depth: replayed.depth, self: await this.nodeRefFor(this.state.node) });
-  }
-  async branchStatuses() {
-    return (await this.currentHandoff()).branches.map(item => ({ ...item, status: branchStatus(item, this.jobs.state(item.node)) }));
-  }
-  async processStatuses() {
-    const handles = new Map(runningSessions(this.execOwner).map(session => [session.id, session.exit === null ? "running" as const : "ended_unobserved" as const]));
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    let processes: ProcessObservation[] = [];
-    for (const part of await hydrateProcessReceipts(history.nodes, this.config.tools.outputStore!)) processes = deriveProcesses(processes, part.events, part.node);
-    return processes.map(item => ({ ...item, status: processStatus(item, handles.get(item.session)) }));
-  }
-  /** User lifecycle commands share the coordinator; no model request is needed. */
-  async resolveBranch(node: number, resolution: "wait" | "cancel" | "status", waitMs = 10_000): Promise<ToolResult> {
-    if (this.running || this.cleanup || this.closing) throw new Error("branch commands require an idle session");
-    const owned = this.execution.begin();
-    try {
-      const result = await this.runResolve({ node, resolution, wait_ms: waitMs });
-      await this.saveCursor(); return finishToolResult(result);
-    } finally { owned.finish(); }
-  }
-
-  /**
-   * D14 for a branch the user opened rather than the model. Returns once
-   * `spawn` is recorded; the child runs in the background with the caller's
-   * explicit config (its own prompt, tools and roots: nothing of the parent's
-   * transcript, so a review stays independent of the work it judges). When it
-   * ends, `joined` plus one guidance line reach the parent at its next idle,
-   * pairable point -- the line is how the parent model learns to read it.
-   */
-  async startUserBranch(spec: {
-    purpose: string; prompt: string; config: SessionConfig; provider?: Provider;
-    /** Events the branch records before its first request (a review's premise receipt). */
-    prelude?: (branch: Session) => Promise<void>;
-    /** The guidance the parent model gets once the branch joined. */
-    note: (node: number, joined: Extract<LogEvent, { t: "joined" }>) => string;
-  }): Promise<number> {
-    if (this.cleanup || this.closing) throw new Error("session is draining or disposed");
-    const node = this.state.nextNode++;
-    this.startingUserBranches.add(node);
-    try { return await this.launchUserBranch(node, spec); } finally { this.startingUserBranches.delete(node); }
-  }
-  private async launchUserBranch(node: number, spec: Parameters<Session["startUserBranch"]>[0]): Promise<number> {
-    const sourceEvent = this.state.events.findLast(event => event.t === "user")?.id;
-    const { ref, branch } = await this.openBranch({ node, purpose: spec.purpose, background: true, ...(sourceEvent ? { sourceEvent } : {}),
-      inputWorkspace: { kind: "shared_readonly" }, worktree: null, config: spec.config, ...(spec.provider ? { provider: spec.provider } : {}) });
-    // Not in `children`: the parent's cancel() disposes those, and an Esc must not stop this one.
-    try { await spec.prelude?.(branch); await this.saveCursor(); }
-    catch (error) { await branch.dispose(); throw error; }
-    const controller = new AbortController();
-    this.userJobs.start(node, controller, async () => {
-      const { outcome, text } = await this.runChild(node, branch, spec.prompt, true, controller.signal, true);
-      const { joined } = await this.closeBranch(ref, branch, outcome, text);
-      if (joined.t !== "joined") throw new Error("a closed branch must produce a joined event");
-      this.pendingJoins.push({ joined, note: spec.note(node, joined), usage: [...branch.state.usage] });
-      await this.flushUserJoins();
-      return joined;
-    }, () => {});
-    return node;
-  }
-  /** User branches still running, so a client can show and stop them. */
-  get userBranches(): readonly number[] {
-    return [...this.startingUserBranches, ...this.userJobs.nodes().filter(node => this.userJobs.state(node) === "running")];
-  }
-  /** Every branch with a live child here: the model's (foreground or background) and the user's. */
-  get runningBranches(): readonly number[] { return [...new Set([...this.children.keys(), ...this.userBranches])]; }
-  cancelUserBranch(node: number): void { this.userJobs.cancel(node); }
-  /**
-   * The branch's join once it ended -- recorded, or still waiting for the
-   * parent to be idle and pairable. Undefined if its finalization failed.
-   */
-  async whenUserBranch(node: number): Promise<Extract<LogEvent, { t: "joined" }> | undefined> {
-    await this.userJobs.drain(node); return (await this.userJobs.wait(node, 0))?.value;
-  }
-  /** Appends joins that waited for an idle, pairable parent. Never mid-turn: the guidance enters model context. */
-  private async flushUserJoins(): Promise<void> {
-    while (this.pendingJoins.length > 0 && !this.running && !this.cleanup && !this.isHalfRound()) {
-      const item = this.pendingJoins.shift()!;
-      this.state.usage.push(...item.usage);
-      await this.record(item.joined);
-      await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "branch", text: item.note, sources: [item.joined.id] });
-      await this.saveCursor();
-    }
-  }
-
-  private async drainProcesses(): Promise<void> {
-    const results = await disposeExecSessions(this.execOwner, this.config.tools.outputStore!, this.config.tools.maxOutputBytes);
-    await this.config.tools.workspace?.abandonCommands();
-    for (const result of results) {
-      await this.record({ t: "process_exit", id: this.clock.nextId(), at: this.clock.now(), ...result, reason: "disposed" });
-    }
-    if (results.length > 0) await this.saveCursor();
-  }
-  private async acceptReadyBranches(): Promise<void> {
-    for (const node of this.jobs.nodes()) {
-      const done = await this.jobs.wait(node, 0);
-      if (done?.value?.accept) await done.value.accept();
-      this.jobs.forget(node);
-    }
-  }
-  dispose(): Promise<void> {
-    if (this.closing) return this.closing;
-    this.cancel();
-    // User branches outlive interrupts, not the session. Their joins are still recorded.
-    this.userJobs.cancel();
-    this.closing = this.whenIdle().then(async () => { await this.userJobs.drain(); await this.flushUserJoins(); }).then(() => this.rootTools?.close());
-    return this.closing;
-  }
-
-  /** Only the app's user command calls this; note never grants human acceptance. */
-  async acceptCriterion(criterion: string): Promise<AcceptanceState> {
-    if (this.running || this.isHalfRound()) throw new Error("acceptance requires an idle, paired request");
-    const current = await this.acceptanceState();
-    const item = current?.criteria.find(item => item.id === criterion && item.kind === "human");
-    if (!current || !item || item.kind !== "human") throw new Error("unknown human acceptance criterion");
-    const target = item.target ? current.targets?.find(target => target.id === item.target) : undefined;
-    if (item.target && (target?.status !== "ready" || !target.binding || !target.observation)) throw Error("human acceptance requires a current ready target instance");
-    await this.record({ t: "acceptance_decision", id: this.clock.nextId(), at: this.clock.now(), request: current.request,
-      contract_id: current.contract_id, criterion, actor: "user",
-      ...(target?.binding && target.observation ? { target_binding: target.binding, target_observation: target.observation } : {}) });
-    await this.saveCursor();
-    return (await this.acceptanceState())!;
-  }
-
-  async appendExtension(entry: Omit<Extract<LogEvent, { t: "extension" }>, "t" | "id" | "at">): Promise<void> {
-    // Messages are only pairable between tools. Private extension state may
-    // be recorded during execution because it never enters model context.
-    if (entry.inContext && (this.running || this.isHalfRound())) throw new Error("Custom messages must be queued until the active turn finishes");
-    const event = { ...entry, t: "extension" as const, id: this.clock.nextId(), at: this.clock.now() };
-    if (!isLogEvent(event)) throw new Error("Invalid extension entry");
-    await this.record(event);
-  }
-
-  get totals(): UsageTotals {
-    return totalUsage(this.state.usage);
-  }
-
-  cancel(): void {
-    this.execution.cancel(); this.jobs.cancel();
-    for (const child of this.children.values()) child.cancel();
-    if (!this.cleanup) this.cleanup = (async () => {
-      await this.execution.whenIdle(); await this.jobs.drain();
-      // A consumer can close at the preparation marker before execution is
-      // admitted. Those children still have an owner, even without a job.
-      for (const [node, child] of this.children) { await child.dispose(); this.children.delete(node); }
-      await this.acceptReadyBranches(); await this.drainProcesses();
-    })().then(() => { this.cleanup = null; });
-    // A void cancellation caller may await later. Preserve rejection for the
-    // owner while preventing an unhandled rejection from bypassing that path.
-    void this.cleanup.catch(() => {});
-  }
-  async whenIdle(): Promise<void> { await this.execution.whenIdle(); await this.cleanup; }
-  get running(): boolean { return this.execution.running; }
-
-  /**
-   * Runs one user message to completion: model turns and tool calls until the
-   * model stops asking for tools.
-   *
-   * `signal` is per-send, matching Provider.send. Abort is a decision, not a
-   * failure: the generator yields `done` with reason `interrupted` and
-   * returns. Any tool_use already on disk is answered with a tool_result
-   * that says so -- otherwise the next request is unpairable (D8: the log
-   * is append-only, so the alternative of deleting the tool_use is not
-   * available, and would also lie about a call that may have had effects).
-   */
-  async *send(
-    userText: UserInput,
-    signal?: AbortSignal,
-    pull?: (phase: Phase) => Promise<UserInput | null>,
-    requestId?: string,
-    options: RequestOptions = {},
-  ): AsyncGenerator<LoopEvent> {
-    if (this.cleanup || this.closing) throw new Error("session is draining or disposed");
-    const owned = this.execution.begin(signal);
-    this.processWake = new AbortController();
-    const savedTools = this.config.tools;
-    this.turnTools = savedTools;
-    this.config.tools = { ...savedTools };
-    this.installSkillResources();
-    const events = this.run(userText, owned.signal, pull, requestId, options);
-    let terminal = false;
-    let exhausted = false;
-    try {
-      for (;;) {
-        const item = await events.next();
-        if (item.done) { exhausted = true; break; }
-        if (item.value.kind === "done") {
-          terminal = true;
-          if (item.value.outcome && item.value.outcome.reason !== "model_end") await this.record({
-            t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
-            reason: item.value.reason ?? item.value.outcome.reason, outcome: item.value.outcome,
-            ...(item.value.failure ? { failure: item.value.failure } : {}),
-          });
-          const request = await this.requestState();
-          if (request) item.value.request = request;
-        }
-        yield item.value;
-      }
-      if (!terminal) {
-        // Every path through run() ends with `done` or throws; this records the impossible case honestly.
-        const outcome = executionOutcome("execution_error");
-        await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(), reason: "request ended without a terminal outcome", outcome });
-        const request = await this.requestState();
-        yield { kind: "done", reason: "stopped: request ended without a terminal outcome", outcome, ...(request ? { request } : {}) };
-      }
-    } catch (error) {
-      // Raw exceptions can contain credentials; persist the category, never the message.
-      // Only the provider request's own exception is a provider error: this catch
-      // also sees failures in history reads and in the harness itself.
-      const provider = this.providerFailure?.error === error ? this.providerFailure : undefined;
-      const failure = failureCause(error, provider);
-      await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
-        reason: `request failed before completion (${describeFailure(failure)}); no complete response was committed`,
-        outcome: executionOutcome(provider ? "provider_error" : "execution_error"), failure });
-      throw error;
-    } finally {
-      // Closing a consumer is not a user cancellation. Preserve the existing
-      // crash/recovery points; only an explicit signal can claim cancellation.
-      try {
-        if (!exhausted) {
-          await events.return(undefined);
-        }
-      } finally {
-        while (this.hostPending.size > 0) await Promise.allSettled(this.hostPending);
-        this.config.tools = savedTools; this.turnTools = null; this.readOnlyRequest = false;
-        if (owned.signal.aborted) this.cancel();
-        owned.finish();
-        if (owned.signal.aborted) await this.whenIdle();
-        // A user branch that ended mid-turn joins now that the parent is idle.
-        if (this.pendingJoins.length > 0) await this.flushUserJoins().catch(() => {});
-      }
-    }
-  }
-
-  private async *run(
-    userText: UserInput,
-    signal?: AbortSignal,
-    pull?: (phase: Phase) => Promise<UserInput | null>,
-    requestId?: string,
-    options: RequestOptions = {},
-  ): AsyncGenerator<LoopEvent> {
-    // A crash after a discovery receipt but before its cut is recovered from that same receipt.
-    if (!signal?.aborted) await this.applyDiscoveredTools();
-    if (needsReplayCheckpoint(this.state.events, providerReplayKey(this.provider.config.spec), nativeReplay(this.provider.config.spec))) {
-      if (this.isHalfRound()) throw new Error("Cannot change a wire profile while tool results are pending");
-      await this.performCut("model_checkpoint");
-    }
-    const blocked = this.config.imageOptions?.blockImages ?? false;
-    // A privacy change uses the existing mechanical checkpoint (D5/D8); it never edits old messages.
-    if (blocked && this.state.events.some(e => (e.t === "user" || e.t === "tool_result") && e.images?.some(image => !image.blocked))) {
-      if (this.isHalfRound()) throw new Error("Cannot change image transmission while tool results are pending");
-      await this.performCut("model_checkpoint");
-    }
-    const request = requestId ?? this.clock.nextId();
-    // S.5: a draft request has no goal yet and must not inherit the current one.
-    this.readOnlyRequest = options.readOnly === true;
-    const goal = options.readOnly ? null : await this.goal();
-    const contract = goal?.contract ?? this.config.acceptanceContract;
-    await this.record({ t: "user", id: request, at: this.clock.now(), ...userInputData(userText, blocked) });
-    if (contract) await this.record({ t: "acceptance_contract", id: this.clock.nextId(), at: this.clock.now(),
-      request: this.state.events.at(-1)!.id, contract });
-    // The state a counter-check must rebuild before it may run (feat-counter-check).
-    if (goal) {
-      await this.config.tools.workspace?.baseline(signal);
-      const snapshot = await this.config.tools.workspace?.snapshot(signal);
-      this.goalBaseline = snapshot ? { request, snapshot } : null;
-    }
-    // Idle changes belong to the new prompt. Recording them before `user`
-    // would silently move the preceding exchange's restore point forward.
-
-    const counter = this.config.counter ?? estimateTokens;
-
-    try {
-      let overflowRetried = false;
-      const requestStarted = this.clock.now();
-      const requestLimit = options.readOnly ? Math.min(READ_ONLY_REQUEST_LIMIT, this.config.maxTurns) : this.config.maxTurns;
-      const report = (cause: string, requests: number) => this.terminationReport(cause, requests, requestLimit);
-      for (let turn = 0; turn < requestLimit; turn++) {
-        const phase = requestPhase(turn, requestLimit);
-        if (signal?.aborted) {
-          yield* this.closeInterrupted();
-          return;
-        }
-
-        if (yield* this.checkStall(request, signal)) {
-          yield { kind: "done", reason: await report("repeated tool cycle without new evidence", turn), outcome: executionOutcome("stalled") };
-          return;
-        }
-        if (phase === "finalize" && !supportsToolDisabling(this.provider.config.spec.api)) {
-          yield { kind: "done", reason: await report("work budget exhausted; protocol cannot disable tools while preserving frozen definitions", turn), outcome: executionOutcome("max_turns") };
-          return;
-        }
-        yield { kind: "turn_start", node: this.state.node };
-
-        if (phase === "finalize") {
-          await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "budget", sources: [], text: finalizationNotice() });
-        } else if (!options.readOnly && this.config.guidance !== false) {
-          const names = this.adviceNames();
-          const guidance = (this.config.harnessReviews === false ? null : await this.recoveryGuidance(names)) ??
-            continuationGuidance({ events: this.state.events, handoff: this.state.handoff,
-            tools: names, remainingRequests: this.config.maxTurns - turn,
-            ...(this.config.continuationAfter === undefined ? {} : { minAssistantTurns: this.config.continuationAfter }) }) ??
-            (this.config.timeBudgetMs === undefined ? null
-              : deadlineNotice(requestStarted, this.clock.now(), this.config.timeBudgetMs, this.state.events)) ??
-            (this.config.harnessReviews === false ? null : churnReview(this.state.events));
-          if (guidance) await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...guidance });
-        }
-
-        // New user/steering input and guidance can overflow a previously safe view.
-        if ((this.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY) === "windowed" &&
-            (yield* this.maybeWindowCut(counter, true))) {
-          yield { kind: "done", reason: "stopped: context cannot fit the model window", outcome: executionOutcome("context_budget") };
-          return;
-        }
-        const projected = projectContext(this.contextInput());
-
-        // Pairing violations are a 400 waiting to happen; surface them here,
-        // where the cause is still visible, rather than as a request failure.
-        if (projected.violations.length > 0) {
-          yield {
-            kind: "done",
-            reason: `projection violations: ${projected.violations.map((v) => v.code).join(", ")}`,
-            outcome: executionOutcome("projection_invalid"),
-          };
-          return;
-        }
-
-        const window = this.provider.config.spec.contextWindow;
-        const estimated = anchoredCount(projected.messages, projected.system, this.state.anchor,
-          counter, this.config.frozen.tools).tokens;
-        if (window !== undefined && estimated + this.provider.config.maxTokens > window) {
-          yield { kind: "done", reason: `context budget exceeded: estimated input ${estimated} + output reserve ${this.provider.config.maxTokens} > window ${window}; shorten the input or switch to a larger verified window`, outcome: executionOutcome("context_budget") };
-          return;
-        }
-
-        let result: Turn;
-        try {
-          result = yield* this.awaitProvider(projected.messages, signal, phase === "finalize" ? { toolUse: "disabled" } : undefined);
-        } catch (error) {
-          // D11: retain a typed response receipt once, without anchoring rejected content or trusting arbitrary error fields.
-          if (error instanceof FailedResponseError && error.usage !== undefined) this.state.usage.push({ ...error.usage });
-          if (signal?.aborted) {
-            yield* this.closeInterrupted();
-            return;
-          }
-          if (phase === "finalize") {
-            yield { kind: "discard" };
-            const failure = failureCause(error, this.providerFailure?.error === error ? this.providerFailure : { retries: 0 });
-            yield { kind: "done", reason: await report(`final response failed (${describeFailure(failure)}); no additional request was made`, turn + 1),
-              outcome: executionOutcome("provider_error"), failure };
-            return;
-          }
-          if (!(error instanceof Error) || !isContextOverflow(error.message, statusOf(error))) throw error;
-          // The estimate said this fit and the provider says it does not: the
-          // estimate is wrong for this content. The only projection that can
-          // shrink is a cut, so force one and send once more; a second
-          // overflow means even the retained tail is misjudged, and another
-          // attempt would only be paid for.
-          if (overflowRetried || this.policyLimits().kind !== "window") {
-            yield { kind: "done", reason: `stopped: provider rejected the prompt as too long (${error.message})`, outcome: executionOutcome("context_budget") };
-            return;
-          }
-          overflowRetried = true;
-          if (yield* this.maybeWindowCut(counter, true, true)) {
-            yield { kind: "done", reason: "stopped: context cannot fit the model window", outcome: executionOutcome("context_budget") };
-            return;
-          }
-          continue;
-        }
-        overflowRetried = false;
-
-        const previous = this.state.usage.at(-1);
-        this.state.usage.push(result.usage);
-        // Q24: an adapter may finish after abort. Keep measured usage, but cancellation
-        // owns termination and a late response cannot enter context or execute tools.
-        if (signal?.aborted) {
-          yield { kind: "usage", usage: result.usage, ok: true };
-          yield { kind: "discard" };
-          yield* this.closeInterrupted();
-          return;
-        }
-        const promptTokens =
-          result.usage.input_tokens +
-          result.usage.cache_creation_input_tokens +
-          result.usage.cache_read_input_tokens;
-        // A stream that reported no usage at all maps onto zeros in the
-        // adapter. Anchoring to that fabrication would make shouldCut compare
-        // against a fake small number and never fire. Leave the previous
-        // anchor (null before the first measurement); anchoredCount already
-        // falls back to a plain estimate when anchor is null. Do not invent
-        // a substitute count — diagnosePrefix and /usage must not see a
-        // fabricated prompt size.
-        if (promptTokens > 0 || result.usage.output_tokens > 0) {
-          this.state.anchor = {
-            promptTokens,
-            outputTokens: result.usage.output_tokens,
-            messageCount: projected.messages.length,
-          };
-        }
-        const cache = this.provider.config.spec.cache;
-        if (cache === undefined) {
-          yield {
-            kind: "usage",
-            usage: result.usage,
-            prefix: "cache terms unknown",
-            ok: true,
-          };
-        } else {
-          const verdict = diagnosePrefix(result.usage, previous, cache);
-          yield {
-            kind: "usage",
-            usage: result.usage,
-            prefix: verdict.kind === "healthy"
-              ? `cache read ${verdict.read}, wrote ${verdict.wrote}`
-              : verdict.detail,
-            ok: verdict.kind !== "suspicious",
-          };
-        }
-
-        // D5: ambiguous IDs cannot be persisted or paired safely. Keep sampled
-        // usage, but stop before observer hooks or any tool effect can run.
-        const identityViolations = toolCallIdentityViolations(result.blocks);
-        if (identityViolations.length > 0) {
-          yield { kind: "done", outcome: executionOutcome("provider_error"),
-            reason: `stopped: invalid provider tool call identity (${identityViolations.map(violation => `${violation.code}: ${violation.detail}`).join("; ")})` };
-          return;
-        }
-
-        await this.record({
-          t: "assistant", id: this.clock.nextId(), at: this.clock.now(), blocks: result.blocks, stop_reason: result.stopReason,
-          replay_key: providerReplayKey(this.provider.config.spec),
-        });
-
-        for (const b of result.blocks) {
-          if (b.type === "text" && b.text.trim()) yield { kind: "assistant_text", text: b.text };
-          if (b.type === "thinking" && b.text.trim()) yield { kind: "thinking", text: b.text };
-        }
-
-        const calls = result.blocks.filter(
-          (b): b is Extract<AssistantBlock, { type: "tool_use" }> => b.type === "tool_use",
-        );
-
-        // Provider policy is a wire instruction, not authority. Pair every
-        // refused call, but never admit execution in the reserved final request.
-        if (phase === "finalize" && (calls.length > 0 || !isCompleteResponse(result.stopReason) ||
-            !result.blocks.some(block => block.type === "text" && block.text.trim()))) {
-          for (const item of await this.answerUnpairedTools("not executed: tools are disabled in the final request", "not_started"))
-            yield { kind: "tool_result", text: item.content, ok: false };
-          yield { kind: "done", reason: await report("request budget exhausted; final response did not provide a complete text answer", turn + 1), outcome: executionOutcome("max_turns") };
-          return;
-        }
-
-        // N.12: syntactically valid arguments in an unfinished response are not
-        // authorization to execute a partial batch. Pair without side effects.
-        if (!isCompleteResponse(result.stopReason)) {
-          for (const item of await this.answerUnpairedTools(incompleteToolText(result.stopReason))) {
-            yield { kind: "tool_result", text: item.content, ok: false };
-          }
-          const extra = await this.pullSteering(pull);
-          if (extra !== null) {
-            await this.record({ t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked) });
-            continue;
-          }
-          const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-          if (!history.ok) throw new Error(history.error);
-          const notice = outputRecoveryNotice(history.nodes.flatMap(node => node.events),
-            this.config.outputRecoveryLimit ?? DEFAULT_OUTPUT_RECOVERY_LIMIT, this.config.maxTurns - turn - 1);
-          if (notice) {
-            await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...notice });
-            if (yield* this.maybeCut(counter, true)) {
-              yield { kind: "done", reason: "stopped: no verifiable progress", outcome: executionOutcome("no_progress") };
-              return;
-            }
-            continue;
-          }
-          yield { kind: "done", reason: result.stopReason ?? "unknown model stop", outcome: modelOutcome(result.stopReason) };
-          return;
-        }
-
-        if (calls.length === 0) {
-          const extra = await this.pullSteering(pull);
-          if (extra !== null) {
-            await this.record({
-              t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked),
-            });
-            continue;
-          }
-          if (contract) await this.refreshRuntimeTargets();
-          const state = await this.requestState();
-          const remaining = requestLimit - turn - 1;
-          // S.5: an active goal replaces the one-time completion check. It keeps
-          // the request going until the ledger says the goal is met; a stated
-          // blocker, a spent budget or the stall watchdog still end the run.
-          const verdict = goal && state ? goalDecision(state, remaining, idleGoalChecks(this.state.events)) : null;
-          if (state && (verdict?.action === "met" || verdict?.action === "await_human")) {
-            await this.counterCheckRequest(state, signal);
-            await this.blindCheckRequest(state, signal);
-          }
-          if (verdict?.action === "met") await this.record({ t: "goal", id: this.clock.nextId(), at: this.clock.now(), action: "clear", reason: "met" });
-          const decision = verdict?.action === "continue" ? { action: "continue" as const, guidance: { reason: "goal" as const, sources: [state!.request.event], text: verdict.text } }
-            : verdict || !state || options.readOnly || this.config.guidance === false || this.config.harnessReviews === false ? { action: "finish" as const }
-            : requestCompletion(state, remaining);
-          if (decision.action === "continue") {
-            if (yield* this.maybeCut(counter, true)) {
-              yield { kind: "done", reason: "stopped: no verifiable progress", outcome: executionOutcome("no_progress") };
-              return;
-            }
-            // Q23: a notice appended before a cut can disappear from the next
-            // projection. Append at the destination so the provider sees it once.
-            await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...decision.guidance });
-            continue;
-          }
-          const stopped = yield* this.maybeCut(counter, false);
-          if (!stopped) {
-            const error = await this.validateFinalOutput(result.blocks.filter(block => block.type === "text").map(block => block.text).join("\n"));
-            if (error !== undefined) {
-              yield { kind: "done", reason: error, outcome: executionOutcome("execution_error") }; return;
-            }
-          }
-          yield {
-            kind: "done",
-            reason: stopped ? "stopped: no verifiable progress" : result.stopReason ?? "end_turn",
-            outcome: stopped ? executionOutcome("no_progress") : modelOutcome(result.stopReason),
-          };
-          return;
-        }
-
-        let branchesThisTurn = 0;
-        type Settled = { ok: true; value: SessionBrokerReceipt } | { ok: false; error: unknown };
-        const pending = new Map<string, Promise<Settled>>();
-        const modes = calls.map(call => this.executionMode(call));
-        try { for (let callIndex = 0; callIndex < calls.length; callIndex++) {
-          const call = calls[callIndex]!;
-          if (signal?.aborted && !pending.has(call.call_id)) {
-            yield* this.closeInterrupted();
-            return;
-          }
-
-          if (!pending.has(call.call_id)) {
-            const end = schedulingWindow(modes, callIndex, this.config.maxParallelTools ?? 3);
-            if (end - callIndex > 1) for (let index = callIndex; index < end; index++) {
-              const planned = calls[index]!;
-              yield { kind: "tool_call", tool: { name: planned.name, input: planned.input } };
-              if (signal?.aborted) break;
-              const dispatch = yield* this.prepareBrokerCall(planned, () => branchesThisTurn++, blocked, signal);
-              pending.set(planned.call_id, dispatch.run().then(value => ({ ok: true as const, value }), error => ({ ok: false as const, error })));
-            }
-          }
-
-          let receipt: SessionBrokerReceipt;
-          const dispatched = pending.get(call.call_id);
-          if (dispatched) {
-            const settled = await dispatched;
-            pending.delete(call.call_id);
-            if (!settled.ok) throw settled.error;
-            receipt = settled.value;
-          } else {
-            if (signal?.aborted) { yield* this.closeInterrupted(); return; }
-            yield { kind: "tool_call", tool: { name: call.name, input: call.input } };
-            if (signal?.aborted) { yield* this.closeInterrupted(); return; }
-            const prepared = yield* this.prepareBrokerCall(call, () => branchesThisTurn++, blocked, signal);
-            receipt = yield* withProgress<SessionBrokerReceipt, LoopEvent>(emit => prepared.run(emit));
-          }
-          await receipt.settle();
-          for (const event of receipt.events.splice(0)) yield event;
-          const out = finishToolResult(receipt.value);
-          // Observation still precedes persistence: crashes here remain unknown,
-          // while nested receipts have already been committed before their caller resumed.
-          yield { kind: "tool_result", text: out.content, ok: out.ok, outcome: out.outcome! };
-          await receipt.commit();
-
-          if (signal?.aborted && pending.size === 0) {
-            yield* this.closeInterrupted();
-            return;
-          }
-        } } finally { await Promise.allSettled(pending.values()); }
-
-        // One scan per turn, not per tool call: a turn is the smallest unit
-        // that means anything, and per-call would be the character-level
-        // granularity the research warns against.
-        const declarationNode = this.state.node;
-        if (!signal?.aborted && await this.applyDiscoveredTools()) yield { kind: "cut", node: declarationNode, reason: "model_checkpoint" };
-        if (this.pendingRoot !== null) await this.applyPendingRoot();
-        if (this.pendingAdoption !== null) await this.adoptPendingBranch();
-
-        // Between complete exchanges is the only safe place to cut.
-        if (yield* this.maybeCut(counter, turn + 1 < this.config.maxTurns)) {
-          yield { kind: "done", reason: "stopped: no verifiable progress", outcome: executionOutcome("no_progress") };
-          return;
-        }
-
-        const extra = await this.pullSteering(pull);
-        if (extra !== null) {
-          await this.record({
-            t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked),
-          });
-        }
-      }
-
-      yield { kind: "done", reason: await report("request budget exhausted", requestLimit), outcome: executionOutcome("max_turns") };
-    } finally {
-      // If the consumer aborts and stops pulling, the generator is closed
-      // without running the yield* closeInterrupted path. Pairing still
-      // has to happen: an unanswered tool_use on disk is a 400 next turn.
-      if (signal?.aborted) await this.answerUnpairedTools();
-    }
-  }
-
-  /**
-   * Answers every tool_use that has no tool_result yet.
-   *
-   * Append, never delete: the call was issued, and rolling it back would
-   * rewrite the log (D8) and hide a call that may already have touched
-   * disk. Same shape as a refused branch -- a result that says why.
-   */
-  private async answerUnpairedTools(
-    content = "interrupted: the user cancelled before this tool completed",
-    reason: ExecutionReason = "unknown",
-  ): Promise<{ callId: string; content: string }[]> {
-    const added: { callId: string; content: string }[] = [];
-    for (const block of pendingToolCalls(this.state.events)) {
-        const resultText = knownUnexecutedTool(this.state.events, block.call_id) ?? content;
-        await this.record({
-          t: "tool_result",
-          id: this.clock.nextId(),
-          at: this.clock.now(),
-          call_id: block.call_id,
-          ...(block.invocation_id ? { invocation_ref: { node: this.state.node, event: block.invocation_id } } : {}),
-          ...(block.parent_call_id ? { parent_call_id: block.parent_call_id } : {}),
-          ...(block.origin ? { origin: block.origin } : {}),
-          ok: false,
-          content: resultText,
-          outcome: executionOutcome(reason),
-        });
-        added.push({ callId: block.call_id, content: resultText });
-    }
-    return added;
-  }
-
-  private async *closeInterrupted(): AsyncGenerator<LoopEvent> {
-    const added = await this.answerUnpairedTools();
-    for (const item of added) {
-      yield { kind: "tool_result", text: item.content, ok: false };
-    }
-    await this.recordInterrupt();
-    yield { kind: "done", reason: "interrupted", outcome: executionOutcome("cancelled") };
-  }
-
-  /**
-   * Appends an interrupt event for the user turn this send opened.
-   *
-   * The cancel happened after that user event, so it is a later record --
-   * not a flag written back onto it (D8). Partial assistant text is omitted:
-   * a cancelled generation was never delivered (AGENT_PLAYBOOK: a failed
-   * request is not a conversation that happened).
-   */
-  private async recordInterrupt(): Promise<void> {
-    for (let i = this.state.events.length - 1; i >= 0; i--) {
-      const event = this.state.events[i]!;
-      if (event.t !== "user") continue;
-      await this.record({
-        t: "interrupt",
-        id: this.clock.nextId(),
-        at: this.clock.now(),
-        user_id: event.id,
-      });
-      return;
-    }
-  }
-
-  /**
-   * Runs the provider and yields display deltas as they arrive, so a long
-   * reply is visible before `send` resolves. The returned Turn is still the
-   * complete message -- that is what gets logged.
-   */
-  private async *awaitProvider(
-    messages: readonly Message[],
-    signal?: AbortSignal,
-    options?: ProviderSendOptions,
-  ): AsyncGenerator<LoopEvent, Turn> {
-    const hydrated = await hydrateImages(messages, this.config.blobDir ?? join(this.config.logDir, "blobs"),
-      this.provider.config.spec.input?.includes("image") ?? false);
-    let retries = 0;
-    this.providerFailure = undefined;
-    const progress = (emit: (event: LoopEvent) => void) => (delta: StreamDelta): void => {
-      switch (delta.kind) {
-        case "text":
-          emit({ kind: "text_delta", text: delta.text });
-          break;
-        case "thinking":
-          emit({ kind: "thinking_delta", text: delta.text });
-          break;
-        case "discard":
-          emit({ kind: "discard" });
-          break;
-        case "retry":
-          retries = Math.max(retries, delta.attempt);
-          emit({ kind: "progress", progress: delta });
-          break;
-        case "tool":
-          emit({ kind: "progress", progress: delta });
-          break;
-        default:
-          return assertNever(delta, "onDelta");
-      }
-    };
-    try {
-      return yield* withProgress<Turn, LoopEvent>(emit => this.provider.send(
-        this.config.frozen, hydrated, this.state.node, signal, progress(emit), options));
-    } catch (error) {
-      // The outcome needs to know this exception came from the request, and after how many retries.
-      this.providerFailure = { error, retries };
-      throw error;
-    }
-  }
-
-  /**
-   * Yields any boundary events and returns true when the session should stop.
-   *
-   * Returning the verdict rather than only announcing it is the point: an
-   * advisory the loop ignores looks like a guard while the budget drains.
-   */
-  private get limits(): BranchLimits {
-    return { ...DEFAULT_BRANCH_LIMITS, ...this.config.branches };
-  }
-
-  private nodeRefFor(node: number): Promise<NodeRef> {
-    return digestedRef(this.config.logDir, node);
-  }
-
-  /**
-   * Runs a read-only branch in its own node and returns a summary.
-   *
-   * The branch is an ordinary Session with a different node, a reduced tool
-   * set and no handoff -- the recursion is what keeps a branch and a session
-   * the same thing, so nothing here has to reimplement the loop.
-   */
-  private executionMode(call: ToolCall): "parallel" | "exclusive" {
-    if (this.config.tools.extensionHooks?.serial?.()) return "exclusive";
-    if (call.name === "read" && typeof call.input === "object" && call.input !== null &&
-      this.config.skills?.some(skill => skill.filePath === resolve(this.config.tools.root, String((call.input as Record<string, unknown>)["path"])))) return "exclusive";
-    if (call.name === "branch" && typeof call.input === "object" && call.input !== null &&
-        (call.input as Record<string, unknown>)["writes"] !== true && (call.input as Record<string, unknown>)["background"] !== true) return "parallel";
-    return toolDefinition(call.name, this.config.tools)?.execution ?? "exclusive";
-  }
-
-  private async *dispatchBranch(input: unknown, index: number, signal?: AbortSignal): AsyncGenerator<LoopEvent, DeferredToolResult> {
-    if (typeof input !== "object" || input === null || !("background" in input) || input.background !== true) return yield* this.runBranch(input, index, signal);
-    if (this.jobs.active >= (this.config.maxParallelTools ?? 3)) return { ok: false, content: "background branch capacity reached; wait or cancel an owned branch first" };
-    const controller = new AbortController();
-    const abort = () => controller.abort();
-    signal?.addEventListener("abort", abort, { once: true });
-    if (signal?.aborted) abort();
-    const detach = () => signal?.removeEventListener("abort", abort);
-    const child = this.runBranch(input, index, controller.signal);
-    let registered = false;
-    try {
-      for (;;) {
-        const step = await child.next();
-        if (step.done) return step.value;
-        yield step.value;
-        if (step.value.kind !== "branch_start") continue;
-        const node = step.value.node!;
-        this.jobs.start(node, controller, async () => {
-          const result = await child.next();
-          if (!result.done) throw new Error("unexpected background child yield");
-          return result.value;
-        }, detach);
-        registered = true;
-        return { ok: true, content: `branch ${node} running; ` + (this.adviceNames().includes("resolve")
-          ? `use resolve(node=${node}, resolution='status'|'wait'|'cancel')` : "branch-observation capability unavailable; completion is unknown"), data: { node, background: true, running: true } };
-      }
-    } finally { if (!registered) detach(); }
-  }
-
-  private async *prepareBrokerCall(call: ToolCall, nextBranch: () => number, blockedImages: boolean,
-    signal?: AbortSignal, native = false): AsyncGenerator<LoopEvent, PreparedBrokerCall> {
-    this.rootTools ??= new ToolQueue(this.config.maxParallelTools ?? 3);
-    const release = await this.rootTools.acquire(this.executionMode(call));
-    let transferred = false;
-    let scope: BrokerExecution<DeferredToolResult> | undefined;
-    try {
-      const events: LoopEvent[] = [];
-      let emit = (event: LoopEvent) => { events.push(event); };
-      let context: ToolContext = { ...this.config.tools, ...(this.readOnlyRequest ? { workflowMode: "plan" as const, planHint: READ_ONLY_HINT } : {}),
-        imageStore: this.config.blobDir ?? join(this.config.logDir, "blobs"),
-        advice: this.allowedNames(),
-        imageAutoResize: this.config.imageOptions?.autoResize ?? true, ...(signal ? { signal } : {}),
-        // feat-approval-events: the broker has already recorded this call's
-        // invocation, and its result comes after execution, so the order is fixed.
-        onApproval: approval => this.record({ t: "approval", id: this.clock.nextId(), at: this.clock.now(), ...approval }) };
-      if (native) context = nativeCommandContext(context);
-      const decoder = new TextDecoder();
-      context.onOutput = chunk => emit({ kind: "progress", progress: { kind: "output", name: call.name, text: decoder.decode(chunk, { stream: true }) } });
-      context.onProcessWait = (session, active) => emit({ kind: "progress", progress: { kind: "waiting", session, active } });
-      const broker = new ToolBroker<DeferredToolResult>({
-        parallelLimit: this.config.maxParallelTools ?? 3,
-        callId: () => `nested-${randomUUID()}`,
-        mode: request => this.executionMode(request),
-        invocation: (request, ctx, parent) => this.recordInvocation(request, ctx, parent),
-        prepare: (request, ctx) => this.prepareSessionAction(request, ctx, nextBranch, event => emit(event)),
-        settle: async result => {
-          if (result.accept) events.push(...await result.accept());
-          if (!result.content_ref) Object.assign(result, await presentObservation(context, result.content));
-        },
-        result: async (invocation, result) => {
-          if (result.annotation) await this.record(result.annotation);
-          await this.recordToolReceipt(invocation, finishToolResult(result), blockedImages);
-        },
-      });
-      const execute = yield* withProgress<BrokerExecution<DeferredToolResult>, LoopEvent>(async output => {
-        emit = output;
-        scope = await broker.prepare(call, context);
-        return scope;
-      });
-      emit = event => { events.push(event); };
-      transferred = true;
-      return { run: async output => {
-        if (output) emit = output;
-        let commitOwnsSlot = false;
-        try {
-          const receipt = await execute();
-          if (native) {
-            // An idle host result has no generator consumer to own its commit.
-            // Retain the slot so a checkpoint cannot split invocation from receipt.
-            commitOwnsSlot = true;
-            return { ...receipt, events, commit: async () => { try { await receipt.commit(); } finally { release(); } } };
-          }
-          return { ...receipt, events };
-        } finally { emit = event => { events.push(event); }; if (!commitOwnsSlot) release(); }
-      } };
-    } finally { if (!transferred) { try { await scope?.close(); } finally { release(); } } }
-  }
-
-  private async recordInvocation(call: ToolCall, ctx: ToolContext, parent?: ToolInvocationEvent): Promise<ToolInvocationEvent> {
-    const store = ctx.outputStore ?? join(this.config.logDir, "artifacts");
-    const encode = (value: unknown) => new TextEncoder().encode(JSON.stringify(value));
-    const archive = async (bytes: Uint8Array) => {
-      async function* source() { yield bytes; }
-      return (await archiveObservation(store, source(), 0)).ref;
-    };
-    let valid = false;
-    try { valid = isJsonValue(call.input); } catch { /* Cyclic or excessively deep host input is not a JSON request. */ }
-    const bytes = encode(valid ? call.input : { unavailable: "non-JSON arguments", type: typeof call.input });
-    const definition = toolDefinition(call.name, ctx);
-    const declared = this.config.frozen.tools.find(tool => tool !== null && typeof tool === "object" && "name" in tool && tool.name === call.name &&
-      "description" in tool && typeof tool.description === "string" && "input_schema" in tool) as ReturnType<typeof modelToolSchema> | undefined;
-    const schema = definition ? declared ?? modelToolSchema(definition, adviceTools(ctx)) : undefined;
-    const descriptor = definition ? { version: 1, ...schema,
-      ...(declared && JSON.stringify(declared.input_schema) !== JSON.stringify(definition.input_schema) ? { admission_schema: definition.input_schema } : {}),
-      access: definition.access, execution: definition.execution, branch: definition.branch, hiddenInputs: definition.hiddenInputs ?? [], result_version: 1 } : null;
-    const original = this.state.events.findLast(event => event.t === "assistant" && event.blocks.some(block => block.type === "tool_use" && block.call_id === call.call_id));
-    const originalInput = original?.t === "assistant" ? original.blocks.find(block => block.type === "tool_use" && block.call_id === call.call_id) : undefined;
-    const changed = originalInput?.type !== "tool_use" || valid && JSON.stringify(originalInput.input) !== JSON.stringify(call.input);
-    const event: ToolInvocationEvent = { t: "tool_invocation", id: this.clock.nextId(), at: this.clock.now(), call_id: call.call_id, name: call.name,
-      ...(ctx.origin ? { origin: ctx.origin } : {}),
-      input_ref: await archive(bytes), schema_ref: descriptor ? await archive(encode(descriptor)) : null,
-      ...(parent ? { parent_call_id: parent.call_id, parent_ref: { node: this.state.node, event: parent.id } } : {}),
-      ...(valid && bytes.length <= MAX_NESTED_ARGUMENT_BYTES && (parent || changed) ? { input: call.input as JsonValue } : {}) };
-    await this.record(event); return event;
-  }
-
-  private async recordToolReceipt(invocation: ToolInvocationEvent, out: ToolResult, blockedImages: boolean): Promise<void> {
-    let data = out.data;
-    let dataRef;
-    if (data !== undefined) {
-      const bytes = new TextEncoder().encode(JSON.stringify(data));
-      if (bytes.length > MAX_INLINE_RESULT_DATA_BYTES) {
-        async function* source() { yield bytes; }
-        dataRef = (await archiveObservation(this.config.tools.outputStore!, source(), 0)).ref;
-        data = undefined;
-      }
-    }
-    await this.record({ t: "tool_result", id: this.clock.nextId(), at: this.clock.now(), call_id: invocation.call_id,
-      invocation_ref: { node: this.state.node, event: invocation.id },
-      ...(invocation.origin ? { origin: invocation.origin } : {}),
-      ...(invocation.parent_call_id ? { parent_call_id: invocation.parent_call_id } : {}), ok: out.ok, content: out.content,
-      ...(out.outcome ? { outcome: out.outcome } : {}), ...(data !== undefined ? { data } : {}), ...(dataRef ? { data_ref: dataRef } : {}),
-      ...(out.observation_sha256 !== undefined ? { observation_sha256: out.observation_sha256 } : {}),
-      ...(out.observation ? { observation: out.observation } : {}), ...(out.diagnostic ? { diagnostic: out.diagnostic } : {}),
-      ...(out.warnings ? { warnings: out.warnings } : {}), ...(out.instructions ? { instructions: out.instructions } : {}),
-      ...(out.content_sha256 ? { content_sha256: out.content_sha256 } : {}),
-      ...(out.content_ref ? { content_ref: out.content_ref } : {}),
-      ...(out.images?.length ? { images: submissionImages(out.images, blockedImages) } : {}), ...(out.effect ? { effect: out.effect } : {}) });
-  }
-
-  private async prepareSessionAction(call: ToolCall, ctx: ToolContext, nextBranch: () => number,
-    emit: (event: LoopEvent) => void): Promise<DeferredToolResult | (() => Promise<DeferredToolResult>)> {
-    // SDK callers may omit allow or preauthorize an optional name. Permission is
-    // distinct from a declaration: neither direct nor nested calls may run it early.
-    const declared = declaredToolNames(this.config.frozen.tools);
-    if (ctx.deferredTools?.some(tool => tool.name === call.name) && !declared.includes(call.name)) {
-      return prepareNormalizedTool({ ...ctx, allow: (ctx.allow ?? declared).filter(name => name !== call.name) }, call.name, call.input);
-    }
-    const forkSkill = call.name === "read" && typeof call.input === "object" && call.input !== null ? this.config.skills?.find(skill =>
-      skill.context === "fork" && skill.filePath === resolve(ctx.root, String((call.input as Record<string, unknown>)["path"]))) : undefined;
-    const discovery = call.name === DISCOVERY_TOOL_NAME && ctx.extensions?.get(call.name) === DISCOVERY_TOOL;
-    if (!forkSkill && !discovery && !["note", "branch", "resolve", "history", "target", "worktree"].includes(call.name)) return prepareNormalizedTool(ctx, call.name, call.input);
-    const branchIndex = forkSkill || call.name === "branch" ? nextBranch() : 0;
-    return prepareNormalizedTool(ctx, call.name, call.input, async () => {
-      if (discovery) return async () => searchDeferredTools(ctx, call.input as Record<string, unknown>, this.allowedNames());
-      if (call.name === "history") return () => runHistoryTool(this.config.logDir, this.state.node, ctx, call.input);
-      if (call.name === "target") return async () => {
-        const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-        if (!history.ok) throw Error(history.error);
-        const observed = await this.runtimeTargets.perform(ctx, history.nodes, call.input as Parameters<RuntimeTargets["perform"]>[2]);
-        return { ...observed.result, annotation: { t: "target_observation" as const, id: this.clock.nextId(), at: this.clock.now(), observation: observed.observation } };
-      };
-      if (call.name === "note") return async () => {
-        await this.observeEvidence();
-        const parsed = parseNote(call.input);
-        const prepared = await prepareWorkingNote(this.config.logDir, this.state.node, this.config.workNamespace ?? "main",
-          parsed.annotation ? this.toEvent(parsed.annotation) : undefined, parsed.result);
-        return { ...prepared.out, ...(prepared.annotation ? { annotation: prepared.annotation } : {}) };
-      };
-      if (call.name === "resolve") return () => this.runResolve(call.input);
-      if (call.name === "worktree") return () => this.runWorktree(call.input, ctx.pathRoot);
-      if (forkSkill?.disableModelInvocation) return async () => ({ ok: false, content: "this skill requires explicit user invocation" });
-      if (forkSkill) await this.recordSkill(forkSkill, "fork", "model");
-      const task = this.state.events.findLast(event => event.t === "user");
-      const branch = forkSkill ? this.runBranch({ purpose: `skill ${forkSkill.name}`, prompt: `${forkSkill.body}\n\nCurrent task: ${task?.t === "user" ? task.text : ""}` },
-        branchIndex, ctx.signal, forkSkill, skillTools(this.allowedNames(), forkSkill), "model") : this.dispatchBranch(call.input, branchIndex, ctx.signal);
-      while (true) {
-        const step = await branch.next();
-        if (step.done) return async () => step.value;
-        emit(step.value);
-        if (step.value.kind === "branch_start") return async () => {
-          const result = await branch.next();
-          if (!result.done) throw new Error(`unexpected child execution event: ${result.value.kind}`);
-          return result.value;
-        };
-      }
-    });
-  }
-
-  private async *runBranch(
-    input: unknown,
-    indexThisTurn: number,
-    signal?: AbortSignal,
-    skill?: Skill,
-    allowedOverride?: readonly string[],
-    skillOrigin: "user" | "model" = "user",
-  ): AsyncGenerator<LoopEvent, DeferredToolResult> {
-    const limits = this.limits;
-    const depth = this.config.branchDepth ?? 0;
-    if (this.children.size >= (this.config.maxParallelTools ?? 3)) return { ok: false, content: "branch capacity reached; wait or cancel an owned branch first" };
-
-    // Every refusal is a normal tool_result: an unanswered tool_use makes the
-    // next request unpairable, and a refusal can say what to do instead.
-    if (depth + 1 >= limits.maxBranchDepth) {
-      return {
-        content:
-          `refused: branch depth limit (${limits.maxBranchDepth}) reached. ` +
-          "Do this work directly with your own tools.",
-        ok: false,
-      };
-    }
-    if (indexThisTurn >= limits.maxBranchesPerTurn) {
-      return {
-        content:
-          `refused: at most ${limits.maxBranchesPerTurn} branches per turn. ` +
-          "Run the rest in a later turn, or do them yourself -- branching is " +
-          "usually more expensive than working sequentially.",
-        ok: false,
-      };
-    }
-    if (this.state.branchesOpened >= limits.maxBranchesPerSession) {
-      return {
-        content:
-          `refused: this session has opened its ${limits.maxBranchesPerSession} branches. ` +
-          "Continue directly.",
-        ok: false,
-      };
-    }
-
-    const args = (typeof input === "object" && input !== null ? input : {}) as Record<string, unknown>;
-    const purpose = String(args["purpose"] ?? "").trim();
-    const prompt = String(args["prompt"] ?? "").trim();
-    const writes = args["writes"] === true;
-    if (!purpose || !prompt) {
-      return { content: "a branch needs both a purpose and a prompt", ok: false };
-    }
-    const parentAllow = allowedOverride ?? this.config.tools.allow;
-    const branchNames = writes ? WRITING_BRANCH_TOOL_NAMES : BRANCH_TOOL_NAMES;
-    const allowed: string[] = parentAllow
-      ? branchNames.filter(name => parentAllow.includes(name)) : [...branchNames];
-    const sourceEvent = this.state.events.findLast(event => event.t === "assistant")?.id ?? this.state.events.at(-1)!.id;
-    let inputWorkspace: { kind: "shared_readonly" } | { kind: "git_tree"; head: string; tree: string } = { kind: "shared_readonly" };
-
-    // Siblings are staggered so the second does not race the first for the
-    // prompt cache and rewrite the whole prefix.
-    if (indexThisTurn > 0 && limits.branchStaggerMs > 0) {
-      await new Promise((r) => setTimeout(r, limits.branchStaggerMs));
-    }
-
-    const node = this.state.nextNode++;
-    this.state.branchesOpened += 1;
-    // A fork point must include any preceding tool effects in this batch.
-
-    // A writing branch needs its own checkout, or parallel branches overwrite
-    // each other's files with nothing to show isolation was never in place.
-    // Refused rather than downgraded to read-only: the model asked to change
-    // files, and quietly not letting it would look like the work was done.
-    let worktree: { path: string; branch: string } | null = null;
-    if (writes) {
-      const created = await createWorktree(this.config.tools.root, `b${node}`);
-      if (!created.ok) {
-        this.state.branchesOpened -= 1;
-        this.state.nextNode -= 1;
-        return { content: `refused: ${created.error}`, ok: false };
-      }
-      worktree = { path: created.path, branch: created.branch };
-      inputWorkspace = { kind: "git_tree", ...created.snapshot };
-      this.state.worktrees.set(node, worktree);
-    }
-
-    const { ref, branch } = await this.openBranch({
-      node, purpose, background: args["background"] === true, sourceEvent, inputWorkspace, worktree,
-      config: {
-        ...this.config,
-        acceptanceContract: null,
-        frozen: { system: this.config.frozen.system, tools: branchTools(writes, allowed) },
-        // The same list twice: the schema shapes what the model asks for, the
-        // allow-list decides what actually runs. Intersected with the parent
-        // so `--exclude-tools bash` cannot be undone by opening a branch.
-        tools: {
-          ...this.config.tools,
-          ...(worktree ? { root: worktree.path } : {}),
-          allow: allowed,
-          readonlyBranch: !writes,
-        },
-        branchDepth: depth + 1,
-        workNamespace: `branch-${node}`,
-        maxTurns: Math.min(this.config.maxTurns, 15),
-      },
-    });
-    if (skill) await branch.recordSkill(skill, "fork", skillOrigin);
-    this.children.set(node, branch);
-    yield { kind: "branch_start", node, reason: purpose, at: Date.now() };
-
-    const { outcome, text } = await this.runChild(node, branch, prompt, args["background"] === true, signal);
-    const closed = await this.closeBranch(ref, branch, outcome, text);
-    const { tip, summary, receipt, receiptRef, joined } = closed;
-
-    // The worktree stays until the branch is resolved: its uncommitted work
-    // is the branch's result, and removing it here would discard exactly
-    // what the parent is about to decide on.
-    const where = worktree
-      ? `\n\nIts changes are in ${worktree.path} on branch ${worktree.branch}, ` +
-        "not in your files. Adopting continues in that checkout without merging it into this one."
-      : "";
-
-    // Only the summary crosses back. The branch's own calls stay in its node,
-    // which is the entire reason to branch rather than read in place.
-    return {
-      content:
-        `branch ${node} (${purpose}) ended: ${JSON.stringify(outcome)}.\n` +
-        `Evidence receipt: ${receipt.commands.length} commands, ${receipt.changes.length} file edits, ${receipt.unfinished.length} unfinished items; verification=${receipt.verification}; task acceptance=not assessed.\n` +
-        (this.adviceNames().includes("history") ? `Read history(artifact='${receiptRef}'), then history(branch=${node}, event='source ID') for original evidence.\n`
-          : `Evidence receipt artifact=${receiptRef}; original-source recovery capability unavailable.\n`) +
-        `Child closing statement (unverified):\n${summary}${where}\n\n` +
-        `Its full state is at ${handoffPath(this.config.logDir, tip)}. ` +
-        (this.adviceNames().includes("resolve") ? `Resolve it with resolve(node: ${node}, ...).` : "Branch-resolution capability unavailable."),
-      ok: outcome.status === "completed",
-      outcome,
-      finalText: text,
-      accept: async () => {
-        if ((await this.branchStatuses()).some(item => item.node === node && item.handoff_ref)) return [];
-        this.state.usage.push(...branch.state.usage);
-        await this.record(joined);
-        await this.saveCursor();
-        return [{ kind: "branch_done", node, text: summary, outcome, ok: outcome.status === "completed" }];
-      },
-      data: { node, outcome, handoff_ref: handoffPath(this.config.logDir, tip), requests: branch.state.usage.length,
-        receipt_ref: receiptRef,
-        input: { source_event: sourceEvent, workspace: inputWorkspace } },
-    };
-  }
-
-  /**
-   * D14: the parent records `spawn`, the branch gets its own node file with
-   * basis "none" (it starts fresh; the parent pointer is provenance only).
-   * Shared by model-spawned branches and user-started ones (/review-code).
-   */
-  private async openBranch(spec: {
-    /** Omitted for a user command in an empty session: the spawn is then its own request. */
-    node: number; purpose: string; background: boolean; sourceEvent?: string;
-    inputWorkspace: { kind: "shared_readonly" } | { kind: "git_tree"; head: string; tree: string };
-    worktree: { path: string; branch: string } | null; config: SessionConfig; provider?: Provider;
-  }): Promise<{ ref: NodeRef; branch: Session }> {
-    const { node, purpose, worktree } = spec;
-    const ref = await this.nodeRefFor(node), id = this.clock.nextId();
-    await this.record({
-      t: "spawn", id, at: this.clock.now(), branch: ref, purpose,
-      ...(spec.background ? { background: true as const } : {}),
-      input: { source_event: spec.sourceEvent ?? id, tools: spec.config.tools.allow ?? [], max_turns: spec.config.maxTurns, workspace: spec.inputWorkspace },
-      ...(worktree ? { workspace: worktree } : {}),
-    });
-    await initNode(this.config.logDir, node, {
-      ...await this.nodeRefFor(this.state.node), at_event: this.state.events.at(-1)!.id,
-    }, this.clock.now(), "none");
-    const branch = new Session(spec.config, spec.provider ?? (this.config.branchProvider ? this.config.branchProvider() : this.provider), this.clock, this.allocation);
-    branch.state.node = node;
-    branch.state.nextNode = this.state.nextNode;
-    branch.secrets = this.secrets;
-    branch.subscribeRecords(item => { for (const listener of this.branchRecordListeners) { try { listener(item); } catch { /* observers never own the append */ } } });
-    return { ref, branch };
-  }
-
-  /** Runs the child to its end. Its closing text is the last turn's text; a throw becomes a bounded outcome. */
-  private async runChild(node: number, branch: Session, prompt: string, background: boolean, signal?: AbortSignal, keepRecorded = false): Promise<{ outcome: ExecutionOutcome; text: string }> {
-    let finalParts: string[] = [];
-    let outcome = executionOutcome("unknown");
-    try {
-      for await (const e of branch.send(prompt, signal)) {
-        if (e.kind === "turn_start" || e.kind === "discard") finalParts = [];
-        if (e.kind === "assistant_text") finalParts.push(e.text ?? "");
-        if (e.kind === "done") outcome = e.outcome ?? executionOutcome("unknown");
-      }
-    } catch {
-      // Persist a bounded failure classification, never a provider's raw error body.
-      // A model's branch joins as execution_error (its caller sees a failed tool). A user branch keeps the
-      // classification its own send recorded (provider_error vs execution_error), as the detached review did.
-      const recorded = keepRecorded ? branch.state.events.findLast(event => event.t === "outcome") : undefined;
-      outcome = signal?.aborted ? executionOutcome("cancelled") : recorded?.t === "outcome" ? recorded.outcome : executionOutcome("execution_error");
-      await branch.answerUnpairedTools("the branch execution failed; this tool's outcome is unknown; inspect before retrying");
-    } finally { try { await branch.dispose(); } finally { this.children.delete(node); } }
-    if (background) await branch.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(), outcome, reason: "background branch execution ended" });
-    return { outcome, text: finalParts.join("\n") };
-  }
-
-  /** Closes the branch's tip with its derived handoff and builds the `joined` the parent will record (D15). */
-  private async closeBranch(ref: NodeRef, branch: Session, outcome: ExecutionOutcome, text: string) {
-    // Node numbers the branch allocated are taken.
-    const tip = branch.state.node;
-    const branchContext = await replayContext(this.config.logDir, tip);
-    // Re-digest now: `ref` was taken at spawn, before this node had events.
-    const handoff = deriveHandoff({
-      prev: branchContext.fullHandoff, depth: branchContext.depth, events: branchContext.events, self: await this.nodeRefFor(tip),
-      config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity },
-    });
-    await closeNode(this.config.logDir, tip, boundHandoff(handoff), (await readNode(this.config.logDir, tip)).events.length, this.clock.now());
-    const summary = text.trim() || "(the branch produced no closing message)";
-    const receiptHistory = await readNodeHistory(this.config.logDir, tip, undefined, "context");
-    if (!receiptHistory.ok) throw new Error(receiptHistory.error);
-    const receipt = deriveBranchReceipt({ source: await this.nodeRefFor(tip), outcome, handoff, nodes: receiptHistory.nodes });
-    const receiptRef = await putBlob(join(this.config.logDir, "artifacts"), JSON.stringify(receipt));
-    const joined: LogEvent = {
-      t: "joined", id: this.clock.nextId(), at: this.clock.now(),
-      branch: ref, tip: await this.nodeRefFor(tip), handoff_ref: handoffPath(this.config.logDir, tip), summary,
-      model: branch.provider.config.spec.id,
-      outcome,
-      receipt_ref: receiptRef,
-    };
-    return { tip, summary, receipt, receiptRef, joined };
-  }
-
-  private async runWorktree(input: unknown, pathRoot?: string): Promise<ToolResult> {
-    const args = (typeof input === "object" && input !== null ? input : {}) as Record<string, unknown>;
-    const root = this.config.tools.root;
-    // A branch already runs in its own checkout and never owns the parent's root.
-    if ((this.config.branchDepth ?? 0) > 0) return { content: "worktree is unavailable inside a branch; the branch already has its own checkout", ok: false };
-    if (this.pendingRoot !== null) return { content: "one worktree switch per tool round; the previous one applies after this round", ok: false };
-    const main = await mainWorktree(root);
-    if (main === null) return { content: `${root} is not inside a git repository, so there is nothing to make a worktree of`, ok: false };
-    const outside = (path: string) => pathRoot !== undefined && relative(pathRoot, path).startsWith("..");
-    if (args["action"] === "exit") {
-      if (main === root) return { content: `already in the main checkout ${main}; nothing to exit`, ok: false };
-      if (outside(main)) return { content: `the main checkout ${main} is outside --path-root ${pathRoot}`, ok: false };
-      const branch = (await listWorktrees(main)).find(wt => wt.path === root)?.branch ?? null;
-      this.pendingRoot = main;
-      return { ok: true, content: [`main ${main}`, `kept ${root}${branch ? ` on ${branch.replace(/^refs\/heads\//, "")}` : ""}`,
-        "The session root moves to the main checkout after this tool round. Nothing was merged or deleted; " +
-        `remove the worktree yourself with \`git worktree remove ${root}\` once its branch is merged or no longer needed.`].join("\n") };
-    }
-    if (args["action"] !== "enter") return { content: "worktree action must be enter or exit", ok: false };
-    const name = typeof args["name"] === "string" ? args["name"] : "";
-    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(name) || name.includes("..")) {
-      return { content: "worktree name must be 1-64 letters, digits, dot, dash or underscore, starting with a letter or digit", ok: false };
-    }
-    const parent = persistentWorktreeParent(configDir(), main);
-    if (outside(parent)) return { content: `xeno's worktree directory ${parent} is outside --path-root ${pathRoot}`, ok: false };
-    const created = await createWorktree(root, name, { location: { parent, leaf: name }, includeChanges: args["include_changes"] === true });
-    if (!created.ok) return { content: `refused: ${created.error}`, ok: false };
-    this.pendingRoot = created.path;
-    return { ok: true, content: [`worktree ${created.path}`, `branch ${created.branch}`, `from ${created.snapshot.head}`,
-      `The session root moves there after this tool round; relative paths, edits and commands then resolve in it. ` +
-      `The working directory in the system prompt still names ${root}. ` +
-      (args["include_changes"] === true ? "It starts from the current uncommitted files." : "It starts from HEAD; uncommitted files in the main checkout were not copied.")].join("\n"),
-      data: { path: created.path, branch: created.branch, head: created.snapshot.head } };
-  }
-
-  private async applyPendingRoot(): Promise<void> {
-    const root = this.pendingRoot;
-    this.pendingRoot = null;
-    if (root === null) return;
-    this.config.tools.root = root;
-    this.installWorkspace();
-    await this.saveCursor();
-  }
-
-  private async runResolve(input: unknown): Promise<ToolResult> {
-    const args = (typeof input === "object" && input !== null ? input : {}) as Record<string, unknown>;
-    const node = Number(args["node"]);
-    const resolution = String(args["resolution"] ?? "");
-    const why = typeof args["why"] === "string" ? args["why"].trim() : "";
-
-    if (!Number.isInteger(node)) return { content: "resolve needs a node number", ok: false };
-    const history = await readNodeHistory(this.config.logDir, this.state.node);
-    if (!history.ok) return { ok: false, content: history.error };
-    const events = history.nodes.flatMap((n) => n.events);
-    const spawned = events.some(
-      (e) => (e.t === "spawn" || e.t === "joined") && e.branch.node === node,
-    );
-    if (!spawned) {
-      return { content: `no branch ${node} was opened from this node`, ok: false };
-    }
-    if (events.some((e) => (e.t === "adopt" || e.t === "discard") && e.branch.node === node)) {
-      return { ok: false, content: `branch ${node} is already resolved` };
-    }
-
-    const joined = events.find((e) => e.t === "joined" && e.branch.node === node);
-    if (resolution === "status") {
-      const item = (await this.branchStatuses()).find(branch => branch.node === node)!;
-      return { ok: true, content: `branch ${node}: ${item.status}`, data: { node, status: item.status } };
-    }
-    if (resolution === "wait" || resolution === "cancel") {
-      if (joined) return { ok: true, content: `branch ${node} already joined; receipt ${joined.t === "joined" ? joined.receipt_ref ?? "not recorded" : ""}` };
-      if (resolution === "cancel" && this.jobs.state(node) === undefined) return { ok: false, content: `branch ${node}: unknown after restart; no owned handle to cancel` };
-      if (resolution === "cancel") { this.jobs.cancel(node); await this.jobs.drain(node); }
-      const waitMs = args["wait_ms"] === undefined ? 10_000 : args["wait_ms"];
-      if (typeof waitMs !== "number" || !Number.isFinite(waitMs) || waitMs < 0 || waitMs > 60_000) return { ok: false, content: "wait_ms must be between 0 and 60000" };
-      const result = await this.jobs.wait(node, waitMs);
-      if (result?.running) return { ok: true, content: `branch ${node} running; wait reached its deadline`, data: { node, running: true } };
-      if (result?.error) return { ok: false, content: result.error };
-      const complete = result?.value ?? await this.recoverBranchResult(node);
-      if (!complete) return { ok: false, content: `branch ${node}: unknown after restart; no sealed execution outcome; inspect before retrying` };
-      if (complete.accept) await complete.accept();
-      this.jobs.forget(node);
-      return complete;
-    }
-    if (this.jobs.state(node) === "running") return { ok: false, content: `branch ${node} running; wait or cancel before resolving it` };
-    if (!joined && this.jobs.state(node) === "ready") return { ok: false, content: `branch ${node} has not joined; wait before resolving it` };
-
-    const ref = await this.nodeRefFor(node);
-    if (resolution === "adopt") {
-      if ((await this.branchStatuses()).some(item => item.node !== node && item.background && !item.handoff_ref && item.resolution === null)) return { ok: false, content: "wait or cancel other unjoined background branches before adoption" };
-      if (this.pendingAdoption !== null) return { content: "resolve one adoption per tool round", ok: false };
-      if (!joined) return { content: `branch ${node} has not joined`, ok: false };
-      await this.record({ t: "adopt", id: this.clock.nextId(), at: this.clock.now(), branch: ref });
-      this.pendingAdoption = node;
-      return { content: `adopted branch ${node}; continuation moves after this tool round is paired`, ok: true };
-    }
-    if (resolution === "discard") {
-      await this.record({
-        t: "discard", id: this.clock.nextId(), at: this.clock.now(),
-        branch: ref, reason: why || "no reason given",
-      });
-      // Discarding is the decision that its worktree can go. A dirty one is
-      // reported rather than forced: those changes are what was discarded,
-      // and silently deleting them is the destructive-restore mistake again.
-      const wt = this.state.worktrees.get(node);
-      if (wt) {
-        const removed = await removeWorktree(this.config.tools.root, wt.path, wt.branch);
-        this.state.worktrees.delete(node);
-        if (!removed.ok) {
-          return {
-            content:
-              `discarded branch ${node}, but its checkout is still at ${wt.path}: ${removed.error}`,
-            ok: true,
-          };
-        }
-      }
-      return { content: `discarded branch ${node}`, ok: true };
-    }
-    return { content: `resolution must be wait, cancel, status, adopt or discard`, ok: false };
-  }
-
-  private async recoverBranchResult(root: number): Promise<DeferredToolResult | undefined> {
-    // Recover only a unique sealed continuation. An open or ambiguous branch
-    // cannot be replayed safely because tools may already have had effects.
-    const headers = await Promise.all((await listNodes(this.config.logDir)).map(async node => ({ node, header: (await readNode(this.config.logDir, node)).header })));
-    let tip = root;
-    const seen = new Set<number>();
-    for (;;) {
-      if (seen.has(tip)) return undefined;
-      seen.add(tip);
-      const children = headers.filter(item => item.header?.parent?.node === tip && item.header.basis !== "none");
-      if (children.length > 1) return undefined;
-      if (children.length === 0) break;
-      tip = children[0]!.node;
-    }
-    if (!(await readManifest(this.config.logDir)).nodes.some(item => item.node === tip && item.handoff_ref)) return undefined;
-    const history = await readNodeHistory(this.config.logDir, tip, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    const outcomeEvent = history.nodes.flatMap(part => part.events).findLast(event => event.t === "outcome");
-    if (outcomeEvent?.t !== "outcome") return undefined;
-    const handoff = await replayContext(this.config.logDir, tip);
-    const full = deriveHandoff({ prev: handoff.fullHandoff, events: handoff.events, depth: handoff.depth, self: await this.nodeRefFor(tip) });
-    const receipt = deriveBranchReceipt({ source: await this.nodeRefFor(tip), outcome: outcomeEvent.outcome, handoff: full, nodes: history.nodes });
-    const receiptRef = await putBlob(join(this.config.logDir, "artifacts"), JSON.stringify(receipt));
-    const last = history.nodes.flatMap(part => part.events).findLast(event => event.t === "assistant");
-    const summary = last?.t === "assistant" ? last.blocks.flatMap(block => block.type === "text" ? [block.text] : []).join("\n") : "(no closing message)";
-    return { ok: outcomeEvent.outcome.status === "completed", outcome: outcomeEvent.outcome,
-      content: `branch ${root} recovered from sealed node ${tip}; receipt ${receiptRef}; closing statement is unverified: ${summary}`,
-      data: { node: root, outcome: outcomeEvent.outcome, receipt_ref: receiptRef, handoff_ref: handoffPath(this.config.logDir, tip) },
-      accept: async () => {
-        if ((await this.branchStatuses()).some(item => item.node === root && item.handoff_ref)) return [];
-        await this.record({ t: "joined", id: this.clock.nextId(), at: this.clock.now(), branch: await this.nodeRefFor(root), tip: await this.nodeRefFor(tip),
-          handoff_ref: handoffPath(this.config.logDir, tip), receipt_ref: receiptRef, summary, outcome: outcomeEvent.outcome });
-        await this.saveCursor(); return [];
-      } };
-  }
-
-  /** D15: finish the parent's tool round before moving to the chosen branch. */
-  private async adoptPendingBranch(): Promise<void> {
-    this.rootTools ??= new ToolQueue(this.config.maxParallelTools ?? 3);
-    const release = await this.rootTools.acquire("exclusive");
-    let checkpoint = false;
-    try {
-      const root = this.pendingAdoption;
-      if (root === null) return;
-      const history = await readNodeHistory(this.config.logDir, this.state.node);
-      if (!history.ok) throw new Error(history.error);
-      const events = history.nodes.flatMap((n) => n.events);
-      const joined = events.find((e) => e.t === "joined" && e.branch.node === root);
-      const spawned = events.find((e) => e.t === "spawn" && e.branch.node === root);
-      if (joined?.t !== "joined" || spawned?.t !== "spawn") throw new Error(`missing provenance for adoption ${root}`);
-      const parent = this.state.node;
-      const annotations = carryForward(events, spawned.id, parent);
-      const tip = joined.tip ?? joined.branch;
-      const intent = events.findLast((e) => e.t === "adopt" && e.branch.node === root && e.next_node !== undefined);
-      const node = intent?.t === "adopt" && intent.next_node !== undefined ? intent.next_node : this.state.nextNode++;
-      if (!intent) await this.record({ t: "adopt", id: this.clock.nextId(), at: this.clock.now(), branch: joined.branch, next_node: node });
-      const parentRef = await this.nodeRefFor(parent);
-      const existing = await readNode(this.config.logDir, node);
-      if (existing.header === null) await initNode(this.config.logDir, node, tip, this.clock.now(), "inherit", { adopted_from: parentRef });
-      else if (existing.header.adopted_from?.node !== parent || existing.header.parent?.node !== tip.node) {
-        throw new Error(`INTEGRITY: adoption successor ${node} belongs to another transition`);
-      }
-      const rebuilt = await replayContext(this.config.logDir, node);
-      this.state.node = node;
-      this.state.nextNode = Math.max(this.state.nextNode, node + 1);
-      this.state.events = rebuilt.contextEvents;
-      this.resetDerivedToolState();
-      this.state.handoff = rebuilt.handoff;
-      this.state.depth = rebuilt.depth;
-      this.state.anchor = null;
-      const copied = new Set(existing.events.flatMap((e) => "carried_from" in e && e.carried_from ? [e.carried_from.event] : []));
-      for (const event of annotations) if (!copied.has(event.carried_from!.event)) await this.record({ ...event, id: this.clock.nextId() });
-      if (!existing.events.some((e) => e.t === "adopt" && e.applied && e.branch.node === root)) {
-        await this.record({ t: "adopt", id: this.clock.nextId(), at: this.clock.now(), branch: joined.branch, applied: true });
-      }
-      const checkout = this.state.worktrees.get(root);
-      if (checkout) this.config.tools.root = checkout.path;
-      this.installWorkspace();
-      await this.saveCursor();
-      this.pendingAdoption = null;
-      checkpoint = joined.model !== undefined && joined.model !== this.provider.config.spec.id;
-    } finally { release(); }
-    if (checkpoint) await this.performCut("model_checkpoint");
-  }
-
-  private toEvent(a: Annotation): LogEvent {
-    const stamp = { id: this.clock.nextId(), at: this.clock.now() };
-    switch (a.t) {
-      case "claim": {
-        // A citation naming a configured gate is recorded as a gate query, so
-        // it still resolves when the same suite is invoked differently later.
-        // Everything else stays an exact-command query.
-        const gate = a.proof ? matchGate(this.config.tools, a.proof) : undefined;
-        return {
-          t: "claim", ...stamp, what: a.what, ...(a.work_id ? { work_id: a.work_id } : {}),
-          evidence: gate !== undefined ? { gate } : a.evidence,
-        };
-      }
-      case "next_action":
-        return { t: "next_action", ...stamp, what: a.what, next_action: a.next_action, ...(a.work_id ? { work_id: a.work_id } : {}), ...(a.depends_on ? { depends_on: a.depends_on } : {}) };
-      case "work_owner": return { ...a, ...stamp, owner: this.config.workNamespace ?? "main" };
-      case "work_dependencies": return { ...a, ...stamp };
-      case "decision":
-        return {
-          t: "decision", ...stamp, chose: a.chose, because: a.because,
-          ...(a.rejected ? { rejected: a.rejected } : {}),
-        };
-      case "pitfall":
-        return { t: "pitfall", ...stamp, tried: a.tried, failed_because: a.failed_because };
-      case "blocked":
-        return { t: "blocked", ...stamp, what: a.what, reason: a.reason, ...(a.work_id ? { work_id: a.work_id } : {}) };
-      case "work_status":
-      case "evidence_link":
-        return { ...a, ...stamp };
-      case "question":
-        return { t: "question", ...stamp, text: a.text };
-      default:
-        return assertNever(a, "toEvent");
-    }
-  }
-
-  // ---- rewind ---------------------------------------------------------------
-
-  /** A prepared edit can be reconciled by its exact path; unknown commands are never replayed. */
-  private async recoverFileOperations(): Promise<void> {
-    if (!this.config.blobDir) return;
-    // A cut is only legal after paired tools, so pending operations belong to this node.
-    const history = (await readNode(this.config.logDir, this.state.node)).events.filter((event): event is CheckpointEvent => event.t === "checkpoint");
-    const pending = new Map<string, CheckpointEvent>();
-    for (const event of history) {
-      if (event.phase === "prepared") pending.set(event.operation, event);
-      else pending.delete(event.operation);
-    }
-    for (const event of pending.values()) {
-      let applied = event.source !== "git" && changedPaths(event.changes).length > 0;
-      for (const [path, change] of Object.entries(event.changes)) {
-        try { if (!sameVersion((await readEditableFile(this.config.tools.root, path)).version, change.after)) applied = false; }
-        catch { applied = false; }
-      }
-      await this.record({ ...event, id: this.clock.nextId(), at: this.clock.now(), phase: applied ? "applied" : "unavailable",
-        reason: applied ? "observed the prepared file version after restart; tool outcome remains unknown" : "interrupted checkpoint; inspect files before retrying" });
-    }
-  }
-
-  private async rewindJournal(point: RestorePoint, mode: RewindMode): Promise<RewindResult> {
-    const dir = this.config.logDir, root = this.config.tools.root, blobs = this.config.blobDir;
-    if (mode !== "context" && !blobs) return { ok: false, error: "this session stores no file checkpoints" };
-    try {
-      const target = { node: point.node, atEvent: point.atEvent };
-      // Reading the log validates the target. Context-only navigation never reads workspace contents.
-      const history = await readNodeHistory(dir, point.node);
-      if (!history.ok) throw new Error(history.error);
-      if (!history.nodes.find(part => part.node === point.node)?.events.some(event => event.id === point.atEvent)) throw new Error(`NO_SUCH_EVENT: ${point.atEvent}`);
-      const changes: FileChanges = await planCheckpointRestore(dir, this.state.node, target).catch(error => {
-        if (mode !== "context") throw error;
-        return {};
-      });
-      const paths = changedPaths(changes);
-      const historical = await readCursorAt(dir, point.node, point.atEvent);
-      const from: NodeRef = { ...await digestedRef(dir, point.node), at_event: point.atEvent };
-      const latest = (await readNode(dir, this.state.node)).events.at(-1);
-      const filesFrom: NodeRef = { ...await digestedRef(dir, this.state.node), ...(latest ? { at_event: latest.id } : {}) };
-      if (mode !== "context" && blobs) {
-        await preflightChanges(root, blobs, changes);
-        // Persist the intention before files move; recovery never invents command completion.
-        const operation = this.clock.nextId();
-        await this.record({ t: "checkpoint", id: operation, at: this.clock.now(), operation, source: "restore", phase: "prepared", changes });
-        await applyFileChanges(root, blobs, changes);
-        await this.record({ t: "checkpoint", id: this.clock.nextId(), at: this.clock.now(), operation, source: "restore", phase: "applied", changes });
-      }
-      const restored = mode === "context" ? [] : paths.filter(path => changes[path]!.after !== null);
-      const removed = mode === "context" ? [] : paths.filter(path => changes[path]!.after === null);
-      const event: LogEvent = { t: "rewind", id: this.clock.nextId(), at: this.clock.now(), mode, from, prompt: point.prompt,
-        restored, removed, unrecoverable: [], divergence: mode === "both" ? [] : paths,
-        ...(mode === "context" ? { files_from: filesFrom } : {}) };
-      if (mode === "files") await this.record(event);
-      else {
-        const node = this.state.nextNode++;
-        await initNode(dir, node, from, this.clock.now(), "inherit");
-        const replayed = await replayContext(dir, node);
-        this.state.node = node; this.state.events = [...replayed.contextEvents]; this.state.handoff = replayed.handoff;
-        this.state.depth = replayed.depth; this.state.anchor = null; this.resetDerivedToolState();
-        await this.record(event);
-        if (historical === null || !sameModel(historical, { model: this.provider.config.spec.id, provider: this.provider.config.spec.provider })) {
-          const cursor = await readCursor(dir);
-          if (cursor) await writeCursor(dir, { ...cursor, node, next_node: this.state.nextNode, needs_model_checkpoint: true });
-          await this.performCut("model_checkpoint", this.provider.config.spec.id);
-        }
-      }
-      await this.saveCursor();
-      return { ok: true, node: this.state.node, restored, removed, unrecoverable: [], note: mode === "context"
-        ? "Only the conversation moved; workspace files were left unchanged."
-        : "Restored recorded file changes. Unrelated files, ignored paths and external effects were left unchanged; command recovery requires captured Git checkpoints." };
-    } catch (error) { return { ok: false, error: String(error) }; }
-  }
-
-  /**
-   * Every completed exchange, including abandoned branches and conversation-only turns.
-   *
-   * An exchange runs from one user message to just before the next, so its
-   * last event is where a fork belongs: the conversation is whole there, and
-   * the files are as the exchange left them.
-   *
-   * EVERY exchange, including ones that changed no file. Going back to
-   * before a badly phrased instruction is the main use of a context-only
-   * rewind, and such a turn often only talked -- filtering on "this exchange
-   * wrote something" removes exactly those points. Claude Code lists every
-   * prompt for the same reason and hides only the code options; whether
-   * files would move is a question the preview answers, since what matters
-   * is changes AFTER the point, not changes in it.
-   */
-  async restorePoints(): Promise<RestorePoint[]> {
-    const dir = this.config.logDir;
-    const history = await readNodeHistory(dir, this.state.node);
-    if (!history.ok) return [];
-    // Per EVENT, not per node. A rewind usually forks inside the node it is
-    // sitting in, so that node is on the path and the abandoned exchange is
-    // in the same file, just past the fork point. Marking whole nodes would
-    // hide exactly the exchange most worth getting back to.
-    const onPath = new Set(history.nodes.flatMap((n) => n.events.map((e) => e.id)));
-
-    // Every node, read in full. A node the session rewound away from is
-    // still on disk, and listing only the current path would leave it
-    // undestroyed and unfindable at the same time.
-    const all: { node: number; events: LogEvent[] }[] = [];
-    for (const id of await listNodes(dir)) {
-      const { header, events } = await readNode(dir, id);
-      if (header === null) continue;
-      all.push({ node: id, events });
-    }
-
-    const points: RestorePoint[] = [];
-    for (const n of all) {
-      let open: { prompt: string; changed: number; last: string; userId: string } | null = null;
-      const close = () => {
-        if (open) {
-          points.push({
-            node: n.node, atEvent: open.last, prompt: open.prompt, userId: open.userId,
-            changed: open.changed, onPath: onPath.has(open.last),
-          });
-        }
-      };
-      for (const e of n.events) {
-        if (e.t === "workspace_observation") continue;
-        if (e.t === "checkpoint" && e.source === "restore") { close(); open = null; continue; }
-        if (e.t === "user") {
-          close();
-          open = { prompt: e.text, changed: 0, last: e.id, userId: e.id };
-          continue;
-        }
-        if (!open) continue;
-        open.last = e.id;
-        if (e.t === "checkpoint" && e.phase === "applied") open.changed += changedPaths(e.changes).length;
-      }
-      close();
-    }
-    return points;
-  }
-
-  /**
-   * What a rewind would do, without doing it.
-   *
-   * P.3 previews only logged paths and preflights conflicts when files will move.
-   * Context-only navigation consults history without reading workspace contents.
-   */
-  async previewRewind(point: RestorePoint, mode: RewindMode = "both"): Promise<RewindPreview> {
-    if (mode === "context") {
-      const history = await readNodeHistory(this.config.logDir, point.node);
-      if (!history.ok) return history;
-      if (!history.nodes.find(part => part.node === point.node)?.events.some(event => event.id === point.atEvent)) return { ok: false, error: `NO_SUCH_EVENT: ${point.atEvent}` };
-      const changes = await planCheckpointRestore(this.config.logDir, this.state.node, { node: point.node, atEvent: point.atEvent }).catch((): FileChanges => ({}));
-      return { ok: true, willWrite: changedPaths(changes).filter(path => changes[path]!.after !== null),
-        willDelete: changedPaths(changes).filter(path => changes[path]!.after === null) };
-    }
-    try {
-      const changes = await planCheckpointRestore(this.config.logDir, this.state.node, { node: point.node, atEvent: point.atEvent });
-      if (this.config.blobDir) await preflightChanges(this.config.tools.root, this.config.blobDir, changes);
-      return { ok: true, willWrite: changedPaths(changes).filter(path => changes[path]!.after !== null),
-        willDelete: changedPaths(changes).filter(path => changes[path]!.after === null) };
-    } catch (error) { return { ok: false, error: String(error) }; }
-  }
-
-  /**
-   * Goes back to a turn: the files and the conversation move together.
-   *
-   * FORKS, never truncates. claude-code#89646 is the argument for this: their
-   * rewind drops the context and starts a new session, so rewinding too far
-   * loses the work with no way back -- even though the transcript was
-   * append-only on disk the whole time. Here the node rewound away from is
-   * still a node, so it is still a restore target, and "rewound too far" is
-   * recoverable rather than terminal.
-   *
-   * P.3 records a separate physical file cursor for context-only navigation.
-   * In combined mode, file restoration must succeed before opening the new
-   * conversation node. File-only restoration appends its observed transition.
-   */
-  async rewind(point: RestorePoint, mode: RewindMode = "both"): Promise<RewindResult> {
-    return this.rewindJournal(point, mode);
-  }
-
-
-  private resetDerivedToolState(): void {
-    this.stall = null;
-    this.recovery = null;
-  }
-
-  private async recoveryGuidance(tools: readonly string[]): Promise<ReturnType<typeof recoveryReview>> {
-    if (this.recovery === null) {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw new Error(history.error);
-      this.recovery = advanceRecovery(emptyRecoveryState(), history.nodes.flatMap(node => node.events), path => resolve(this.config.tools.root, path));
-    }
-    return recoveryReview(this.recovery, tools);
-  }
-
-  /**
-   * S.8: a repeated cycle is pointed out to the model once; the next one is
-   * the user's call when a question client can answer -- continue, stop, or
-   * new instructions -- and ends the request only without one (headless) or
-   * when the user stops it. The answer is recorded as an event, never kept
-   * as loop state: a continue is a `stall` guidance, instructions are steering.
-   */
-  private async *checkStall(request: string, signal?: AbortSignal): AsyncGenerator<LoopEvent, boolean> {
-    const limit = this.config.stallLimit ?? DEFAULT_STALL_LIMIT;
-    if (limit === 0) return false;
-    if (this.stall === null) {
-      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-      if (!history.ok) throw new Error(history.error);
-      this.stall = advanceStall(emptyStallState(), history.nodes.flatMap(({ node, events }) => events.map((event) => ({ node, event }))));
-    }
-    const decision = stallDecision(this.stall, limit);
-    if (decision.cycle === null) return false;
-    const pattern = decision.cycle === 1 ? "the same tool call" : `a cycle of ${decision.cycle} tool calls`;
-    const facts = `${pattern} repeated ${decision.repeats} times without new evidence (${decision.failures} failed receipts; ${decision.emptyWaits} empty waits)`;
-    if (decision.warn) {
-      await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "stall", sources: [],
-        text: `Harness: ${facts}. Change the method, run a meaningful check, or give the final result with unresolved limits. If the pattern repeats again, the user decides whether the request continues.` });
-      return false;
-    }
-    const answer = await this.askAboutCycle(facts, signal);
-    if (answer?.kind === "continue") {
-      await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), reason: "stall", sources: [],
-        text: `Harness: the user reviewed this (${facts}) and chose to continue. Do not repeat the same calls expecting a different result; change the method or finish with the result and its limits.` });
-      return false;
-    }
-    if (answer?.kind === "steer") {
-      await this.record({ t: "user", id: this.clock.nextId(), at: this.clock.now(), request, text: answer.text });
-      return false;
-    }
-    yield { kind: "stop_and_ask", reason: `${facts}; change the approach or provide new input` };
-    return true;
-  }
-
-  /** Undefined means nobody answered: no question client (headless), cancelled, or an invalid reply. */
-  private async askAboutCycle(facts: string, signal?: AbortSignal): Promise<{ kind: "continue" } | { kind: "stop" } | { kind: "steer"; text: string } | undefined> {
-    const slot = this.config.tools.questionSlot, adapter = slot?.current, turn = slot?.activeTurn;
-    if (!adapter || !turn || signal?.aborted) return undefined;
-    const request = questionRequest(turn, `stall-${this.clock.nextId()}`, [{ id: "stall", header: "Repeated tool calls",
-      question: `The agent ${facts}. Continue, stop, or type instructions for it?`, multiple: false, custom: true,
-      options: [{ id: "continue", label: "Continue", description: "Let the agent keep working; it is told to change its method." },
-        { id: "stop", label: "Stop", description: "End this request; the log and evidence stay." }] }]);
-    try {
-      const reply = validateQuestionReply(request, await adapter(structuredClone(request), signal ?? new AbortController().signal));
-      const [answer] = reply.answers, text = answer?.text?.trim();
-      if (text) return { kind: "steer", text };
-      return answer?.choices[0] === "continue" ? { kind: "continue" } : answer?.choices[0] === "stop" ? { kind: "stop" } : undefined;
-    } catch { return undefined; }
-  }
-
-  /** A steering signal releases only the wait; cancellation owns process termination. */
-  wakeProcessWaits(): void { this.processWake.abort(); }
-
-  private async terminationReport(cause: string, requests: number, limit = this.config.maxTurns): Promise<string> {
-    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
-    if (!history.ok) throw new Error(history.error);
-    return stopReport(history.nodes.flatMap(part => part.events), requests, limit, cause);
-  }
-
-  /** N.8: build and check the replacement before committing a durable boundary. */
-  /**
-   * `overflowed` is the provider's own verdict that the current projection
-   * does not fit, which outranks any estimate: the cut is taken as a hard
-   * limit, and retention is sized against the estimate scaled so the rejected
-   * prompt reads as exactly over the usable window.
-   */
-  private async *maybeWindowCut(counter: TokenCounter, willContinue: boolean, overflowed = false): AsyncGenerator<LoopEvent, boolean> {
-    const budget = this.policyLimits();
-    if (!willContinue || budget.kind !== "window" || pendingToolCalls(this.state.events).length > 0) return false;
-    const project = () => projectContext({ frozen: this.config.frozen, handoff: this.state.handoff, events: this.state.events });
-    let projected = project();
-    const measured = anchoredCount(projected.messages, projected.system, this.state.anchor, counter, this.config.frozen.tools).tokens;
-    const scale = overflowed ? Math.max(1, (budget.usable + 1) / Math.max(1, measured)) : 1;
-    if (overflowed) counter = scaledCounter(counter, scale);
-    let tokens = Math.ceil(measured * scale);
-    if (tokens < budget.prepare) return false;
-    const replayed = await replayContext(this.config.logDir, this.state.node);
-    let draft: Handoff;
-    try {
-      draft = await this.boundCarried(deriveHandoff({ prev: replayed.fullHandoff, events: replayed.events,
-        depth: replayed.depth, self: await digestedRef(this.config.logDir, this.state.node),
-        config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity } }));
-    } catch (error) {
-      if (!(error instanceof RangeError)) throw error;
-      // An objective too large for a carried handoff cannot be repaired by another cut.
-      if (tokens <= budget.usable) return false;
-      yield { kind: "stop_and_ask", reason: `context cannot fit the model window: ${error instanceof Error ? error.message : "handoff construction failed"}` };
-      return true;
-    }
-    const noteEnabled = this.config.frozen.tools.some((tool) => tool !== null && typeof tool === "object" && "name" in tool && tool.name === "note") &&
-      (this.config.tools.allow === undefined || this.config.tools.allow.includes("note"));
-    if (this.config.guidance !== false && noteEnabled && tokens < budget.trigger && budget.trigger > 1) {
-      const notice = boundaryPreparation({ events: this.state.events, tokens, inheritedTokens: 0,
-        continuationReady: draft.continuation_valid,
-        config: { triggerTokens: budget.trigger, hardTokens: budget.trigger + (budget.trigger - budget.prepare), minNodeWorkTokens: 0 } });
-      if (notice) {
-        await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...notice });
-        projected = project();
-        tokens = anchoredCount(projected.messages, projected.system, this.state.anchor, counter, this.config.frozen.tools).tokens;
-      }
-    }
-    if (tokens < budget.trigger) return false;
-    const lastAssistant = this.state.events.findLastIndex((event) => event.t === "assistant");
-    const pendingUser = this.state.events.slice(lastAssistant + 1).find((event) => event.t === "user");
-    const retained = selectRecentContext({ events: this.state.events, frozen: this.config.frozen, handoff: draft,
-      counter, targetTokens: budget.target,
-      ...(pendingUser === undefined ? {} : { requiredUserId: pendingUser.id }) });
-    if (retained === null || retained.tokens >= tokens) {
-      // A large fresh prompt may still fit; let the model answer once. Never discard
-      // it to manufacture space, or record repeated cuts that cannot shrink it.
-      if (tokens <= budget.usable) return false;
-      yield { kind: "stop_and_ask", reason: "context cannot fit the model window while preserving the current request and a complete recent exchange; reduce the input or use a larger verified window" };
-      return true;
-    }
-    const node = this.state.node;
-    const reason = tokens > budget.usable ? "hard_limit" : "trigger";
-    await this.performCut(reason, this.provider.config.spec.id, retained.from);
-    yield { kind: "cut", node, reason };
-    return false;
-  }
-
-  /** Every threshold the loop acts at. The footer and banner read the same function. */
-  private policyLimits(): ContextLimits {
-    return contextLimits({
-      policy: this.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY,
-      contextWindow: this.provider.config.spec.contextWindow,
-      outputReserve: this.provider.config.maxTokens,
-      ...(this.config.boundary ? { boundary: this.config.boundary } : {}),
-    });
-  }
-
-  private async *maybeCut(counter: TokenCounter, canPrepare: boolean): AsyncGenerator<LoopEvent, boolean> {
-    const limits = this.policyLimits();
-    if (limits.kind === "window") {
-      return yield* this.maybeWindowCut(counter, canPrepare);
-    }
-    const projected = projectContext({
-      frozen: this.config.frozen,
-      handoff: this.state.handoff,
-      events: this.state.events,
-    });
-    let { tokens } = anchoredCount(
-      projected.messages, projected.system, this.state.anchor, counter,
-      this.config.frozen.tools,
-    );
-
-    // What this node would cost having done nothing: the frozen prefix plus
-    // the rendered handoff. Cutting cannot reduce it, so it does not count
-    // toward the node having earned a boundary.
-    const floor = projectContext({
-      frozen: this.config.frozen,
-      handoff: this.state.handoff,
-      events: [],
-    });
-    // Counted with the tools, because `tokens` above came from the anchor and
-    // the provider bills schemas on every request. Subtracting a figure that
-    // omitted them would read the difference as work the node had done.
-    const inheritedTokens = counter.count(floor.messages, floor.system, this.config.frozen.tools);
-
-    const policy = this.config.contextPolicy ?? DEFAULT_CONTEXT_POLICY;
-    let draft: Handoff | null = null;
-    if (limits.kind === "segment" && tokens >= limits.prepare) {
-      // Read the same full ancestry used by the actual cut. A bounded carried
-      // page is insufficient to decide whether all active work is completed.
-      const replayed = await replayContext(this.config.logDir, this.state.node);
-      draft = await this.boundCarried(deriveHandoff({ prev: replayed.fullHandoff, events: replayed.events,
-        depth: replayed.depth, self: await digestedRef(this.config.logDir, this.state.node),
-        config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity } }));
-      const noteEnabled = this.config.frozen.tools.some((tool) => tool !== null && typeof tool === "object" && "name" in tool && tool.name === "note") &&
-        (this.config.tools.allow === undefined || this.config.tools.allow.includes("note"));
-      if (canPrepare && this.config.guidance !== false && noteEnabled && tokens < limits.hard) {
-        const notice = boundaryPreparation({ events: this.state.events, tokens, inheritedTokens,
-          continuationReady: draft.continuation_valid, config: limits.config });
-        if (notice) {
-          await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...notice });
-          const updated = projectContext({ frozen: this.config.frozen, handoff: this.state.handoff, events: this.state.events });
-          tokens = anchoredCount(updated.messages, updated.system, this.state.anchor, counter, this.config.frozen.tools).tokens;
-        }
-      }
-    }
-    const price = this.provider.config.spec.price;
-    const usage = this.state.usage.at(-1);
-    const replacement = draft ? projectContext({ frozen: this.config.frozen, handoff: draft, events: [] }) : null;
-    const cost = replacement && price?.cacheRead !== undefined && price.cacheWrite !== undefined && usage &&
-      usage.input_tokens + usage.cache_read_input_tokens + usage.cache_creation_input_tokens > 0
-      ? estimateBoundaryCost({ retainedTokens: tokens,
-        rebuiltTokens: counter.count(replacement.messages, replacement.system, this.config.frozen.tools),
-        observedCachedTokens: usage.node === this.state.node ? usage.cache_read_input_tokens : 0,
-        inputPrice: price.input, cacheReadPrice: price.cacheRead, cacheWritePrice: price.cacheWrite }) : null;
-    const decision = decideContext({
-      policy, continuationReady: draft?.continuation_valid ?? false, cost,
-      tokens,
-      inheritedTokens,
-      atTurnBoundary: true,
-      ...(this.config.boundary ? { config: this.config.boundary } : {}),
-    });
-
-    if (!decision.cut) {
-      // A floor past the hard limit cannot be worked around by cutting; the
-      // caller has to widen the thresholds or shrink the frozen prefix.
-      if (decision.reason === "inherited_floor_exceeds_limit") {
-        yield {
-          kind: "stop_and_ask",
-          reason:
-            `the inherited context alone is ${inheritedTokens} tokens, at or past the hard ` +
-            `limit -- widen the thresholds or shrink the system prompt`,
-        };
-        return true;
-      }
-      return false;
-    }
-
-    const node = this.state.node;
-    await this.performCut(decision.reason);
-    yield { kind: "cut", node, reason: decision.reason };
-
-    // D9 uses observations and fresh successful checks, not model assertions.
-    // The closed node's handoff is now this.state.handoff.
-    const handoff = this.state.handoff;
-    if (handoff !== null && shouldStopAndAsk(handoff.budget.nodes_without_progress)) {
-      yield {
-        kind: "stop_and_ask",
-        reason:
-          `${handoff.budget.nodes_without_progress} nodes with no verifiable progress. ` +
-          `blocked: ${handoff.state.blocked.length}, open questions: ${handoff.open_questions.length}`,
-      };
-      return true;
-    }
-    return false;
-  }
-
-  /**
-   * Closes the current node and opens the next with a handoff basis.
-   *
-   * Shared by the automatic boundary and by switchModel. The caller decides
-   * WHETHER to cut -- this only performs it. Putting the work floor in here
-   * would make a model switch wait for minNodeWorkTokens, and the new model
-   * would see the old thinking blocks in the meantime.
-   */
-  private async performCut(reason: CutReason, nextModel = this.provider.config.spec.id, retainedFrom?: string,
-    nextProvider = this.provider.config.spec.provider, nextThinking = this.provider.config.effort, nextContextRef?: string): Promise<void> {
-    this.rootTools ??= new ToolQueue(this.config.maxParallelTools ?? 3);
-    const release = await this.rootTools.acquire("exclusive");
-    try {
-      const dir = this.config.logDir;
-      const node = this.state.node;
-
-      const replayed = await replayContext(dir, node);
-      const fromDisk = replayed.events;
-      const retained = retainedFrom === undefined ? [] : retainedContext(replayed.contextEvents, retainedFrom);
-      let guidanceTools = this.adviceNames();
-      if (nextContextRef !== undefined) {
-        const saved = await getBlob(join(dir, "artifacts"), nextContextRef);
-        if (saved === null) throw new Error("missing successor guidance context");
-        guidanceTools = this.adviceNames(parseSessionContext(JSON.parse(saved)).frozen);
-      }
-
-      // The cut event is part of the closed file. Digest after appending it
-      // so predecessor.sha256 matches what closeNode writes into the manifest.
-      await this.record({
-        t: "cut",
-        id: this.clock.nextId(),
-        at: this.clock.now(),
-        handoff_ref: handoffPath(dir, node),
-        predecessor: this.state.handoff?.predecessor ?? null,
-        reason,
-        next_node: this.state.nextNode,
-        next_model: nextModel,
-        next_provider: nextProvider,
-        next_thinking: nextThinking,
-        ...(nextContextRef === undefined ? {} : { next_context_ref: nextContextRef }),
-        handoff_tokens: DEFAULT_HANDOFF_TOKENS,
-        ...(this.config.workingSet ? { working_set_version: CURRENT_WORKING_SET_VERSION } : {}),
-        guidance_tools: guidanceTools,
-        ...(retainedFrom === undefined ? {} : { retained_from: retainedFrom }),
-      });
-      const self = await digestedRef(dir, node);
-      const handoff = await this.boundCarried(deriveHandoff({
-        prev: replayed.fullHandoff,
-        depth: replayed.depth,
-        events: fromDisk,
-        self,
-        config: { maxUserTurns: Infinity, maxUserTurnBytes: Infinity },
-      }), guidanceTools);
-      await closeNode(dir, node, handoff, (await readNode(dir, node)).events.length, this.clock.now());
-
-      // One allocator for the whole session. A cut used to take node + 1 while
-      // a branch took nextNode++, so a cut after a branch reached the branch's
-      // id and overwrote its log.
-      this.state.node = this.state.nextNode++;
-      this.state.depth += 1;
-      this.state.handoff = handoff;
-      this.state.events = retained;
-      // The new node's prefix has never been sent, so there is nothing to anchor
-      // to until its first response comes back.
-      this.state.anchor = null;
-      // A cut declares a handoff basis: the closed node's events do not replay,
-      // its derived state does. Relying on the default here would silently make
-      // every boundary a fork and replay the whole history.
-      await initNode(dir, this.state.node, self, this.clock.now(), "handoff");
-      // The durable successor already belongs to the target provider, even if
-      // the process exits before switchModel installs its in-memory adapter.
-      await this.saveCursor(nextModel, nextProvider, nextThinking, nextContextRef);
-    } finally { release(); }
-  }
-}