agentfootprint 13.0.0 → 14.0.0

package/dist/esm/core/Agent.js

@@ -1,20 +1,14 @@
+import { refuseFollowUpIdentity, refuseKnownSpentAnswer, refuseMissingPlainAnswer, } from './agent/resumeAnswer.js';
+import { hostedTurns } from './agent/hostTurn.js';
+import { componentResources } from './agent/componentResources.js';
+import { resumeStateOf, resumeSessionOf } from './agent/resumeCheckpoint.js';
+import { capturePauseOwnership, pendingQuestionOf, preservePendingQuestion, abandonStoredPause, abandonPendingQuestion, } from './agent/pauseOwnership.js';
+import { registerRunnerLive, runnerLive } from './runnerLive.js';
+import { agentComponentObservers, componentEvidence } from './agent/componentObservers.js';
+import { bindScopeComputation, captureLateEmitter } from '../redaction/runRedaction.js';
+import { createAgentRunValues } from './agent/runValues.js';
+import { bindRunnerStage, } from './runnerExecution.js';
 import { findingsContextBytes } from './agent/findings/context.js';
-/**
- * Agent — ReAct primitive (LLM + tools + iteration loop).
- *
- * Pattern: Builder (GoF) → produces a Runner backed by a footprintjs FlowChart.
- * Role:    Layer-5 primitive (core/). Assembles the 3-slot context
- *          pipeline + callLLM + route decider + tool-calls subflow +
- *          loopTo. Composition nestable anywhere that accepts a Runner.
- * Emits:   Via internal recorders:
- *            agentfootprint.agent.turn_start / turn_end
- *            agentfootprint.agent.iteration_start / iteration_end
- *            agentfootprint.agent.route_decided
- *            agentfootprint.stream.llm_start / llm_end
- *            agentfootprint.stream.tool_start / tool_end
- *            agentfootprint.context.* (via ContextRecorder)
- */
-import { FlowChartExecutor, } from 'footprintjs';
 import { ReliabilityFailFastError } from '../reliability/types.js';
 import { extractSequence } from '../security/extractSequence.js';
 import { PolicyHaltError } from '../security/PolicyHaltError.js';
@@ -28,8 +22,8 @@ import { assistantReplayFields } from './agent/assistantReplay.js';
 import { buildBrainFor, describeServingBrain } from './agent/skillBrains.js';
 import { SUBFLOW_IDS } from '../lib/conventions.js';
 import { readDisplayName } from '../lib/displayName.js';
-import { DecisionRequiredError, ResumeDecisionError, assertDecisionIsNotStale, isPaused, pauseDemandsDecision, } from './pause.js';
-import { checkDecisionAgainst, noteDecisionTakenUp, pausedRequestIdOf, processDecisionLedger, registerConsentLedger, registerConsentRules, } from './consentRequest.js';
+import { assertDecisionIsNotStale, isPaused, pauseDemandsDecision, } from './pause.js';
+import { checkDecisionAgainst, processDecisionLedger, registerConsentLedger, registerConsentRules, } from './consentRequest.js';
 import { assertArtifactPlacement } from '../artifacts/placement.js';
 import { recordingPutInput } from '../artifacts/recordingArtifact.js';
 import { recordRunWhere } from '../recorders/observability/recordRun.js';
@@ -54,76 +48,33 @@ import { toolsRecorder } from '../recorders/core/ToolsRecorder.js';
 import { reliabilityRecorder } from '../recorders/core/ReliabilityRecorder.js';
 import { resilienceRecorder } from '../recorders/core/ResilienceRecorder.js';
 import { checkInEventsBridge } from '../recorders/core/CheckInRecorder.js';
-import { compactionMeter } from '../recorders/core/CompactionMeter.js';
-import { assertRedactionPolicy, CarriedPolicyError, carriedVocabularyOf, policyFromCarried, policyOfMarks, unionRedactionPolicies, } from '../redaction/policy.js';
-import { coverageOfExecutor } from '../redaction/runRedaction.js';
+import { assertRedactionPolicy, unionRedactionPolicies } from '../redaction/policy.js';
 import { policyOfCoverage } from '../redaction/coverage.js';
 import { ResumeRedactionError } from './conversation.js';
-import { declareRedaction, redactionDeclaredBy } from '../redaction/declared.js';
-import { carriedRunPolicy, conversationRedaction, withCurrentVocabulary, } from '../redaction/conversation.js';
-import { createEvictedTurnsHandle } from './agent/window/evictedTurns.js';
-import { createReceiptDigests } from './agent/receipt/receiptDigests.js';
+import { privateResumeOf } from '../redaction/privateCheckpoint.js';
+import { declareRedaction, redactionDeclaredBy, declarePrivateFields, } from '../redaction/declared.js';
+import { carriedRunPolicy, conversationRedaction } from '../redaction/conversation.js';
 import { packRecording } from '../recorders/observability/recordingPack.js';
 import { pendingDurableWrite } from './durabilityBarrier.js';
 import { ToolSessionTier, TOOL_TEARDOWN_TIMEOUT_MS, } from '../tools/toolSessions.js';
 import { buildEventMeta, eventBelongsToRun } from '../bridge/eventMeta.js';
-import { assertIdentityShape, callerIdentityOf, pausedSessionOf, restoredIdentityOf, sameIdentity, } from './agent/callerIdentity.js';
+import { assertIdentityShape, callerIdentityOf, restoredIdentityOf, sameIdentity, } from './agent/callerIdentity.js';
 import { hostedConversationKey, hostedConversationOf, registerServingConversation, sessionConversationKey, } from './agent/servingConversation.js';
 import { buildRunManifest } from './agent/runManifest.js';
 import { beginIntegrityRun } from '../integrity/disposition/lifecycle.js';
-/**
- * The pseudo-stage a tool-teardown event is stamped with.
- *
- * `session_closed` and `session_close_failed` fire after the run's last stage
- * has committed — there is no runtimeStageId to inherit, and inventing one that
- * looked like a real stage would put a fictitious node in every consumer's step
- * strip. This says plainly where it came from, the way `'<stageId>#paused'`
- * does at the pause boundary. Their two siblings, `session_started` and
- * `session_reused`, happen inside a real stage and carry its real id.
- */
-const TOOL_TEARDOWN_STAGE_ID = 'tool-teardown#0';
-/**
- * The pseudo-stage a LATE artifact fact is stamped with — one that lands after
- * the run its binding was made in had ended (a tool's floating upload). Its
- * stage is long gone; like the teardown events it says plainly where it came
- * from, and carries the run it belongs to rather than the one that is live.
- */
-const LATE_ARTIFACT_FACT_STAGE_ID = 'artifact-late#0';
-/**
- * The pseudo-stage the run-configuration manifest is stamped with (9.41.0).
- *
- * Same reasoning as the teardown id above, at the other end of the run: the
- * manifest is dispatched before the chart starts, so there is no stage to
- * inherit and inventing a plausible one would put a node in every step strip
- * that no traversal ever visited. This says plainly where it came from.
- */
-const RUN_MANIFEST_STAGE_ID = 'run-configured#0';
-/**
- * Pseudo-stage for `agentfootprint.integrity.disposition` (9.60.0) — the
- * ledger is filed at the run boundary, after the last stage committed, so it
- * states where it came from exactly as the teardown id above does.
- */
-const INTEGRITY_DISPOSITION_STAGE_ID = 'integrity-disposition#0';
-/**
- * Pseudo-stage for `agentfootprint.skill.graph_declared` (9.50.0) — same
- * reasoning as the manifest id directly above: dispatched before the chart
- * starts, so it states where it came from instead of inheriting a stage no
- * traversal visited.
- */
-const GRAPH_DECLARED_STAGE_ID = 'graph-declared#0';
 import { EmitBridge } from '../recorders/core/EmitBridge.js';
 import { buildWindowStage } from './agent/stages/window.js';
 import { requireKeepLastToolResults } from './agent/window/options.js';
-import { assertDeliverableRole, buildDeliverStage } from './agent/stages/deliver.js';
+import { buildDeliverStage } from './agent/stages/deliver.js';
 import { providerTargets } from './agent/providerTargets.js';
-import { messagesContentRefusal } from '../injection-engine/messagesSlotRefusal.js';
+import { assertInjectionDelivery } from './agent/run/injectionDelivery.js';
 import { CompactionUnmeasurableError } from './agent/window/errors.js';
 import { resolveCheckInConfig, } from './checkin.js';
 import { assertCostBudgetHasPricing, resolveCostBudget } from './cost.js';
-import { causalEvidenceRecorder, } from '../memory/causal/evidenceRecorder.js';
 import { buildSystemPromptSlot } from './slots/buildSystemPromptSlot.js';
 import { buildMessagesSlot } from './slots/buildMessagesSlot.js';
-import { buildToolsSlot, } from './slots/buildToolsSlot.js';
+import { buildToolsSlot } from './slots/buildToolsSlot.js';
+import { ensureDiscoveredTools } from './slots/discoverTools.js';
 import { isDevMode } from 'footprintjs';
 import { buildReadSkillTool } from '../injection-engine/skillTools.js';
 import { foldStepPlans } from '../injection-engine/skillSteps.js';
@@ -144,14 +95,14 @@ import { makeRouteTurnStage } from './agent/stages/routeTurn.js';
 import { applyOutputFallback, } from './outputFallback.js';
 import { assertContinuable, buildCheckpoint, checkpointReplayHistory, retainReplayRetirements, classifyFailurePhase, RunCheckpointError, validateCheckpoint, } from './runCheckpoint.js';
 import { requireVerificationOnResume } from './agent/findings/verificationCheckpoint.js';
-import { NoConversationError, PendingQuestionError, ResumeIdentityConflictError, RunInFlightError, } from './conversation.js';
+import { NoConversationError, PendingQuestionError, ResumeIdentityConflictError, } from './conversation.js';
 import { applyInputResponse, readAwaitingInput, } from '../tools/inputRequest.js';
 import { applyOutputSchema, OutputSchemaError, } from '../answer-validation/outputSchema.js';
 import { InvalidRunInputError, normalizeRunInput } from './runInput.js';
-import { clockOf } from '../time/rows.js';
-import { draftClock, readRunTime, readTimeOptions, } from '../time/clock.js';
+import '../time/rows.js';
+import { draftClock, readTimeOptions, } from '../time/clock.js';
 import { buildOutputRetryStage } from './agent/stages/outputRetry.js';
-import { RunnerBase, makeRunId, runSignalOf } from './RunnerBase.js';
+import { RunnerBase } from './RunnerBase.js';
 import { clampIterations, validateMemoryIdUniqueness, validateToolNameUniqueness, } from './agent/validators.js';
 import { buildRouteDeciderStage } from './agent/stages/route.js';
 import { negativeCheckpointOf } from './agent/negativeClaims/checkpoint.js';
@@ -163,7 +114,7 @@ import { withAnswerCoverage } from './agent/stages/answerCoverage.js';
 import { AnswerValidationError, resolveAnswerValidation, } from '../answer-validation/index.js';
 import { buildSeedStage } from './agent/stages/seed.js';
 import { buildCallLLMStage } from './agent/stages/callLLM.js';
-import { buildToolCallsHandler, notServedResult } from './agent/stages/toolCalls.js';
+import { buildToolCallsHandler, notServedResult } from './agent/stages/toolCalls/index.js';
 import { buildToolResolver } from './agent/stages/toolResolver.js';
 import { answeredValuesOf, declaredDefaultsFrom } from './agent/stages/route.js';
 import { isRefused, rulesOf } from '../tools/declare.js';
@@ -180,40 +131,15 @@ import { buildToolRegistry } from './agent/buildToolRegistry.js';
 import { AgentBuilder } from './agent/AgentBuilder.js';
 import { buildThinkingSubflow } from './slots/buildThinkingSubflow.js';
 import { thinkingForProviders } from '../thinking/dispatch.js';
+import { TOOL_TEARDOWN_STAGE_ID, LATE_ARTIFACT_FACT_STAGE_ID, RUN_MANIFEST_STAGE_ID, INTEGRITY_DISPOSITION_STAGE_ID, GRAPH_DECLARED_STAGE_ID, } from './agent/run/eventStageIds.js';
+import { requireKeepLedgerFacts, resolveKeepLedgerFacts } from './agent/run/ledgerFacts.js';
+import { withoutTime } from './agent/run/withoutTime.js';
+import { resumeRedactionOf } from './agent/run/resumeRedaction.js';
+import { draftAgentClock, clockForSeed, readAgentTime, agentTimeAnswerContext, } from './agent/run/clocks.js';
 export { AgentBuilder };
 // Public types (AgentOptions, AgentInput, AgentOutput) extracted to
 // ./agent/types.ts and re-exported above (v2.11.1).
 // AgentState extracted to ./agent/types.ts (v2.11.1).
-/**
- * The ledger-fact hold's default ceiling (9.102.0): how many fact turns the
- * window holds beyond `keepRecentTurns` when `.findings()` and a window
- * strategy are both configured and nobody named a number. Resolved in the
- * constructor, ONCE, and threaded to `buildWindowStage` as a plain number —
- * the stage applies no default of its own (absent = unarmed = no hold), so a
- * reader has one place to look. `window/options.ts ·
- * DEFAULT_KEEP_LAST_TOOL_RESULTS` is the pin's twin of this constant.
- */
-const DEFAULT_KEEP_LEDGER_FACTS = 4;
-/**
- * Validate the `keepLedgerFacts` dial — `window/options.ts ·
- * requireKeepLastToolResults`'s twin: the same rule, the same moment.
- * Refused at construction, never mid-run.
- */
-function requireKeepLedgerFacts(value, label) {
-    if (value === false)
-        return;
-    if (!Number.isInteger(value) || value < 0) {
-        throw new Error(`${label}: keepLedgerFacts must be a whole number >= 0, or false, got ` +
-            `${String(value)}. It is how many fact turns the window holds beyond ` +
-            `keepRecentTurns under .findings(); 0 and false both switch the hold off.`);
-    }
-}
-/** `false` → `0`; a number as named; nothing named → the default. */
-function resolveKeepLedgerFacts(named) {
-    if (named === false)
-        return 0;
-    return named ?? DEFAULT_KEEP_LEDGER_FACTS;
-}
 export class Agent extends RunnerBase {
     name;
     id;
@@ -316,7 +242,6 @@ export class Agent extends RunnerBase {
     skillGraphCascade;
     /** Side channel for the conversation's inherited skill cursor (SG-C) —
      *  stashed by `applyContinuation`, consumed-and-cleared by seed. */
-    pendingResumeSkillCursor;
     pricingTable;
     /** Normalized at construction: a bare number is `{ usd, onExceed: 'warn' }`. */
     costBudget;
@@ -383,18 +308,15 @@ export class Agent extends RunnerBase {
      *  cleared when `run()` ends, so a later turn this agent did not start (its
      *  chart mounted in a composition) never stamps a clock nobody declared for
      *  it (`seedClockDraft`). */
-    runClockDraft;
     /** The incoming request each of this agent's OWN scopes serves — recorded
      *  by the executor that made the scope (`createExecutor`), so a scope keeps
      *  ITS run's request for as long as it lives: a stage still running after
      *  its run was aborted can never be served the next run's request. A stage
      *  mounted in another runner's executor reads its run's request by link
      *  (`memberRun.ts`). Never written to scope. */
-    scopeRequests = new WeakMap();
     /** The `time` the CURRENT resume passed, as read — TAKEN once by the first
      *  ToolCalls pass of the resumed leg (`ToolCallsHandlerDeps.time`), and
      *  cleared when `run()` or `resume()` ends. */
-    resumePassedTime;
     /** Tool choice by classifier (9.105.0, `.toolChoice()`): the classifier,
      *  the serve dial and the app's own doors. Threaded to the tools slot (the
      *  pick and the narrowing), to call-llm (`toolChoice: true`, the outcome
@@ -438,13 +360,6 @@ export class Agent extends RunnerBase {
     /** The message chain (`.messageMiddleware()`), in declaration order. Empty
      *  keeps seed synchronous and prepare-final untouched. */
     messageMiddleware;
-    /** The instrument the window stage reads mid-run (adapter-reported usage +
-     *  per-message provenance). Only ever created alongside a strategy. */
-    compactionMeterHandle;
-    /** The window stage's seam to the receipt (9.93.0): what left the window at
-     *  this iteration's head, read by the call-llm mint in the same iteration.
-     *  Only ever created alongside a strategy, like the meter. */
-    evictedTurnsHandle;
     /** Snapshot read-tracking policy (#18/#14) — forwarded to the internal
      *  executor. Agent default is `'summary'` (cheap markers), NOT
      *  footprintjs's `'full'`. See AgentOptions.readTracking. */
@@ -494,9 +409,6 @@ export class Agent extends RunnerBase {
      * plumbing, never scope state). `run()` resets it; the run boundary
      * files its report and clears it.
      */
-    integrityLedgerHolder = {
-        current: undefined,
-    };
     /** Set at chart build: whether any tool in the FULL declared catalog
      *  (static registry + skill-carried tools) declared `argumentsFrom`. */
     integrityDanglingPresent = false;
@@ -531,9 +443,6 @@ export class Agent extends RunnerBase {
      * every `run()` / `resume()` so one run can never raise on another's block,
      * and cleared per service the moment that credential is issued.
      */
-    consentOutstanding = new Map();
-    /** Evidence bridge (#5) — present iff a CAUSAL memory is mounted. */
-    causalEvidence;
     /** Observer delivery tier (RFC-001 Block 10). `'inline'` (default) is
      *  byte-identical to pre-10 releases; `'deferred'` routes the bridge
      *  recorders + consumer attachments through footprintjs's bounded
@@ -552,11 +461,6 @@ export class Agent extends RunnerBase {
     appName;
     commentaryTemplates;
     thinkingTemplates;
-    currentRunContext = {
-        runStartMs: 0,
-        runId: 'pending',
-        compositionPath: [],
-    };
     /**
      * The typed ask the CURRENT run's resume answered — set by
      * `resume()` when a person's answer completed an `awaitingInput`, cleared
@@ -565,8 +469,6 @@ export class Agent extends RunnerBase {
      * `ToolCallsHandlerDeps.answeredAsk`. The count crosses checkpoints on the
      * awaiting-input shape itself (`repeat.count`), not here.
      */
-    answeredAsk;
-    // `lastExecutor` is now inherited as a protected field from RunnerBase
     // (single canonical source for footprintjs snapshot access across all
     // runners). Agent's `getLastSnapshot()` delegates to the inherited
     // implementation but is kept here for the JSDoc + clearer return type.
@@ -610,28 +512,21 @@ export class Agent extends RunnerBase {
      *  instead of starting fresh, and appends this turn's user entry when
      *  `appendsUserTurn` says so. Cleared on first read so subsequent runs
      *  start clean. */
-    pendingResumeHistory;
     /** Retried request's repair state; never inherited by a new human turn. */
-    pendingEvidenceRecovery;
     /** Its sibling for the folded spans. A restored conversation that dropped
      *  them would carry summaries nobody could unpack — the evidence would be
      *  destroyed by the act of continuing, which is the one thing retention
      *  exists to prevent. Cleared on first read, exactly like the history. */
-    pendingResumeFolded;
     /** Its sibling for the findings ledger (9.101.0) — the model's standings
      *  on results this process never saw, carried by the checkpoint and
      *  restored as a stored record. Cleared on first read, like the history. */
-    pendingResumeFindingsLedger;
     /** The last completed run's final answer — see `checkpoint()` for why it is
      *  kept here rather than read back from the recording. Undefined after a run
      *  that failed or paused. */
-    lastRunAnswer;
     /** Last run's checkpoint owner, including explicit replay edits from a failed child stage. */
-    checkpointTracker;
     /** Whether any run on this instance got past input admission — so a
      *  refused FIRST turn is reported as 'never-run', never as "continue from
      *  your earlier accepted checkpoint" when there is none. */
-    hadAdmittedRun = false;
     /** The id the CONSUMER chose, or undefined when they took the default.
      *  `this.id` cannot answer that question — it is `'agent'` either way — and
      *  the stored-conversation fingerprint refuses only on ids somebody picked
@@ -647,28 +542,22 @@ export class Agent extends RunnerBase {
      *  paused run's own record (`agent/callerIdentity.ts · callerIdentityOf`).
      *  A resume that inherited it instead stored another person's identity on
      *  a shared agent and none on a rebuilt pooled one. */
-    lastRunIdentity;
     /** Run ids this instance minted, most recent last (bounded) — evidence that a
      *  checkpoint's `{ conversationId: '<runId>' }` is the per-run default
      *  (`agent/callerIdentity.ts`). */
-    mintedRunIds = new Set();
     /** The self-explain evidence key of the run in flight (or served last):
      *  its session, else a host's per-request key, else undefined
      *  (`agent/servingConversation.ts`). */
-    servingConversation;
     /** How long ONE tool teardown may take before the runner stops waiting.
      *  See `AgentOptions.toolTeardownTimeoutMs`. */
     toolTeardownTimeoutMs;
     /** The run in flight, by id — the whole of the one-turn-at-a-time guard.
      *  Set before the executor is built and cleared in `finally`, so a run that
      *  throws does not leave the agent permanently refusing. */
-    inFlightRunId;
     /** The scopes this agent's OWN executors made — see the `isOwnRun` seed dep. */
-    ownScopes = new WeakSet();
     /** The question a person still owes this agent an answer to. Set when a run
      *  ends paused, cleared by `resume()`, `abandonPause()`, or a run that
      *  completes. Read by the `run()` guard — see `PendingQuestionError`. */
-    pendingQuestion;
     /** The `.selfExplain()` binding, when the builder mounted one. Held so
      *  `canExplain()` can answer the same question the trace tools answer, from
      *  the same fact. Undefined on every agent that never called `.selfExplain()`. */
@@ -741,9 +630,6 @@ export class Agent extends RunnerBase {
     /** `AgentOptions.recordReceipt` (9.88.0) — ON by default. `false` declines
      *  the mint at `callLLM`; nothing else about the run changes. */
     recordReceiptValue = true;
-    /** The receipt memo every call of a run mints through — one per agent,
-     *  rebinding itself to each run id (`core/agent/receipt/receiptDigests.ts`). */
-    receiptDigests = createReceiptDigests();
     answerValidationConfig;
     negativeClaimsConfig;
     typedNegativeClaimsConfig;
@@ -753,11 +639,15 @@ export class Agent extends RunnerBase {
         // Which conversation this instance's self-explain evidence belongs to —
         // held in a module registry, not on the class, so it is not public API
         // (`agent/servingConversation.ts`).
-        registerServingConversation(this, () => ({
-            conversation: this.servingConversation,
-            runId: this.currentRunContext.runId,
-            ...(this.servingConversation?.startsWith('hosted:') === true && { oneShot: true }),
-        }));
+        registerServingConversation(this, () => {
+            const selected = this.runExecution().selected();
+            const conversation = selected?.value.servingConversation;
+            return {
+                conversation,
+                runId: selected?.context.runId ?? 'pending',
+                ...(conversation?.startsWith('hosted:') === true && { oneShot: true }),
+            };
+        });
         this.negativeClaimsConfig = negativeClaimsConfig;
         this.typedNegativeClaimsConfig =
             negativeClaimsConfig?.mode === 'typed' ? negativeClaimsConfig : undefined;
@@ -850,20 +740,6 @@ export class Agent extends RunnerBase {
         // Eager validation: memory ids must be unique so per-id scope keys
         // (`memoryInjection_${id}`) don't collide.
         validateMemoryIdUniqueness(memories);
-        // Evidence bridge (#5): a CAUSAL memory gets a run-scoped harvest recorder
-        // (decisions/toolCalls/iterations/duration/tokens). Attached per run below;
-        // its `collect` is threaded into the write mount via chartDeps.
-        if (memories.some((m) => m.type === 'causal')) {
-            const evidence = causalEvidenceRecorder();
-            this.causalEvidence = evidence;
-            // A causal memory is working state: its store keeps what a later run
-            // replays to the MODEL, so its tool calls are read on the real-value
-            // path, never off the served events — a policy keeps a run's records
-            // clean, never what the agent will compute on (`src/redaction/`). The
-            // decisions it keeps come from footprintjs's flow channel, which serves
-            // them under the policy (a named limit in `src/redaction/README.md`).
-            this.dispatcher.onRealEvent((event) => evidence.onEmit({ name: event.type, payload: event.payload }));
-        }
         // A dial without its switch — refused rather than run as a no-op (8.13.0).
         // Same policy as `observerDeliveryOptions` below; the message and the check
         // are shared with LLMCall, which takes the identical pair.
@@ -958,20 +834,8 @@ export class Agent extends RunnerBase {
         // (attached per run, cleared between runs like every other recorder)
         // because the window stage closes over it at chart-build time — and the
         // chart is built once.
-        if (windowStrategy !== undefined) {
+        if (windowStrategy !== undefined)
             this.windowStrategy = windowStrategy;
-            const meter = compactionMeter();
-            this.compactionMeterHandle = meter;
-            this.evictedTurnsHandle = createEvictedTurnsHandle();
-            // The provider's token count is a MEASUREMENT the window decides on, so
-            // the meter reads it on the real-value path, never off the served event:
-            // a redaction pattern that happens to match `input` must not switch
-            // compaction off (`src/redaction/runRedaction.ts`).
-            this.dispatcher.onRealEvent((event) => {
-                if (event.type === 'agentfootprint.stream.llm_end')
-                    meter.noteLlmEnd(event.payload);
-            });
-        }
         // The two governance chains. Empty arrays (not undefined) so every read
         // site is a plain `.length > 0` test rather than an optional dance.
         this.toolMiddleware = toolMiddleware ?? [];
@@ -1200,20 +1064,60 @@ export class Agent extends RunnerBase {
         this.appName = voice.appName;
         this.commentaryTemplates = voice.commentaryTemplates;
         this.thinkingTemplates = voice.thinkingTemplates;
-        // Eager chart construction — see `RunnerBase.initChart` JSDoc.
-        // Note re Agent specifics (footprintjs inventor's review):
-        // - `providerToolCache: { current: Tool[] }` is closed over by the
-        //   chart's Discover + dispatch stages. It's shared across
-        //   sequential runs of this Agent instance, but the Discover stage
-        //   overwrites `current` at the start of every iteration (line 158
-        //   of `buildToolsSlot.ts`), so stale data never reaches a tool
-        //   call. Concurrent runs on the SAME Agent instance already share
-        //   `currentRunContext` and the recorder dispatcher — eager build
-        //   doesn't change that constraint.
-        // - `currentRunContext` is read by the per-stage `getRunCtx`
-        //   lambda at execution time (not at chart-build time), so a fresh
-        //   value per run still flows through correctly.
-        this.initChart(() => this.buildChart());
+        // Build the chart once. Private executable tool catalogs and their domain
+        // handlers are initialized in the actual native component, shared with
+        // its internal charts and isolated from other mounts and admissions.
+        this.initChart(() => this.buildChart(), {
+            runnerId: this.id,
+            compositionPath: [`Agent:${this.id}`],
+            initialize: () => {
+                const values = createAgentRunValues({ window: this.windowStrategy !== undefined });
+                this.beginIntegrityLedger(values);
+                return values;
+            },
+            options: {
+                readTracking: this.readTracking,
+                commitValues: this.commitValues,
+                writeProvenance: this.writeProvenance,
+            },
+            componentSetup: (component, value, entry) => {
+                value.resources = componentResources(component, () => this.toolSessions());
+                if (entry?.kind === 'resume')
+                    value.resources.expectAnswer();
+                const observers = agentComponentObservers(component, value, entry, {
+                    causal: this.memories.some((memory) => memory.type === 'causal'),
+                    window: this.windowStrategy !== undefined,
+                });
+                return {
+                    recorder: observers.recorder,
+                    bindScope: (scope) => {
+                        const run = this.runExecution().forScope(scope);
+                        value.resources?.bindReporter((status) => captureLateEmitter(scope, TOOL_TEARDOWN_STAGE_ID)?.('agentfootprint.tools.resource_restore', status));
+                        bindScopeComputation(scope, {
+                            owner: component,
+                            retired: () => run.retired,
+                            emit: observers.emit,
+                        });
+                    },
+                };
+            },
+        });
+        const live = runnerLive(this);
+        if (live === undefined)
+            throw new TypeError('Agent live taps were not initialized');
+        registerRunnerLive(this, {
+            ...live,
+            turn: hostedTurns(this.runExecution(), {
+                run: (run, input, options) => this.runOwned(run, input, options),
+                resume: (run, checkpoint, input, options) => this.resumeOwned(run, checkpoint, input, options),
+                prepareResume: (checkpoint) => this.noteResumeTakenUp(checkpoint),
+                checkpoint: (run) => this.checkpointFor(run),
+            }),
+            pause: {
+                capture: (outcome) => capturePauseOwnership(this.runExecution().selected()?.value, outcome),
+                abandon: (checkpoint) => this.runExecution().withRun(() => abandonStoredPause(checkpoint, () => this.toolSessions())),
+            },
+        });
     }
     static create(opts) {
         return new AgentBuilder(opts);
@@ -1259,13 +1163,26 @@ export class Agent extends RunnerBase {
      * The one difference is the timeline's filter: a recording filed FOR a
      * person keeps only the events of that person's run.
      */
-    startRunRecording() {
+    startRunRecording(invocation) {
         if (this.artifactRecordings === undefined || this.artifactStore === undefined)
             return undefined;
         // Only THIS run's events: on an instance serving several sessions, the
         // hosting door emits facts for other sessions while this run is in flight,
         // and a recording is redeemable by the person it was filed for.
-        return recordRunWhere(this, (event) => this.ownsEvent(event));
+        const recording = recordRunWhere(this, (event) => invocation.run.origin !== undefined && eventBelongsToRun(event.meta, invocation.context()));
+        let outcome;
+        // Registered before component setup. Native reverse finalization joins
+        // resource cleanup first, then files this recording, then detaches it.
+        invocation.run.onFinalize(() => recording.stop());
+        invocation.run.onFinalize(async () => {
+            if (outcome !== undefined)
+                await this.fileRunRecording(invocation, recording, outcome);
+        });
+        return {
+            complete(value) {
+                outcome = value;
+            },
+        };
     }
     /**
      * Does `event` belong to the run this agent is serving (or served last)? The
@@ -1276,13 +1193,14 @@ export class Agent extends RunnerBase {
      * @internal
      */
     ownsEvent(event) {
-        return eventBelongsToRun(event.meta, this.currentRunContext);
+        const selected = this.runExecution().selected();
+        return selected !== undefined && eventBelongsToRun(event.meta, selected.context);
     }
     /**
      * File the finished recording into the artifact store.
      *
      * ── When ────────────────────────────────────────────────────────────────
-     * After the answer is composed, and only for a run that COMPLETED. A pause
+     * After the answer and joined component resource cleanup, only for a run that COMPLETED. A pause
      * is not a finished run (the turn continues, and the resume mints its own);
      * a throw never reaches here at all.
      *
@@ -1306,14 +1224,14 @@ export class Agent extends RunnerBase {
      * The recording is FROZEN before the mint, so it can never contain the
      * `artifacts.minted` event describing itself.
      */
-    async fileRunRecording(recorder, outcome) {
+    async fileRunRecording(invocation, recorder, outcome) {
         const store = this.artifactStore;
         if (recorder === undefined || store === undefined || this.artifactRecordings === undefined) {
             return;
         }
         if (isPaused(outcome))
             return;
-        const runId = this.currentRunContext?.runId;
+        const runId = invocation.context().runId;
         let input;
         try {
             const recording = recorder.toRecording();
@@ -1329,7 +1247,7 @@ export class Agent extends RunnerBase {
             return;
         }
         try {
-            const result = await store.put(this.runArtifactScope(), input);
+            const result = await store.put(this.runArtifactScope(invocation), input);
             // Sweeps ride the put result, so retention that evicted an older
             // recording to make room says so on the record — the same law a tool's
             // own mint follows.
@@ -1373,14 +1291,14 @@ export class Agent extends RunnerBase {
      * the one the run's tools used, and a recording filed in a different scope
      * from the artifacts it describes is a recording nobody can find.
      */
-    runArtifactScope() {
-        const identity = this.liveSnapshot()?.sharedState
+    runArtifactScope(invocation) {
+        const identity = invocation.view.snapshot()?.sharedState
             ?.runIdentity;
         if (identity === undefined) {
             // No state to read means no run happened, which this path cannot reach —
             // but a scope is required and inventing a tenant would be worse than a
             // conversation id that names the run itself.
-            return { conversationId: this.currentRunContext?.runId ?? 'unknown' };
+            return { conversationId: invocation.context().runId };
         }
         return {
             conversationId: identity.conversationId,
@@ -1426,14 +1344,13 @@ export class Agent extends RunnerBase {
      * read or write of a selected key reads `[REDACTED]`, and an `[emit]` line
      * shows the event's served payload (`src/redaction/runRedaction.ts`).
      */
+    /** Empty during preparation before native origin; capture prior entries before the next call. */
     getLastNarrativeEntries() {
-        if (this.lastExecutor === undefined)
-            return [];
-        // The snapshot's terms: an executor no run of this agent opened serves
-        // nothing — its narrative was written under no rule anyone knows.
-        if (coverageOfExecutor(this.lastExecutor).state === 'unknown')
+        const selected = this.runExecution().selected();
+        const coverage = selected?.value.redaction?.coverage;
+        if (selected === undefined || coverage === undefined || coverage.state === 'unknown')
             return [];
-        return this.lastExecutor.getNarrativeEntries();
+        return selected.view.getNarrativeEntries();
     }
     /**
      * The FlowChart compiled for the most recent run (or a freshly-built
@@ -1518,7 +1435,7 @@ export class Agent extends RunnerBase {
      * `OutputSchemaError` — hand it to the 3-tier fallback. The one settle for
      * `parseOutputAsync`'s parse failure and `runTyped`'s native stop failure.
      */
-    async settleTypedFailure(raw, err) {
+    async settleTypedFailure(raw, err, invocation) {
         const parser = this.outputSchemaParser;
         if (!this.outputFallbackCfg || !(err instanceof OutputSchemaError))
             throw err;
@@ -1534,13 +1451,16 @@ export class Agent extends RunnerBase {
                     type: eventType,
                     timestamp: Date.now(),
                     payload,
+                    ...(invocation !== undefined && {
+                        meta: buildEventMeta({ runtimeStageId: '__typed_output__' }, invocation.context()),
+                    }),
                 });
             }
             catch {
                 /* observability errors must not poison the fallback path */
             }
         };
-        return applyOutputFallback(raw, parser, this.outputFallbackCfg, emit, err, this.lastRunRetriesSpent());
+        return applyOutputFallback(raw, parser, this.outputFallbackCfg, emit, err, invocation === undefined ? undefined : this.retriesSpent(invocation));
     }
     /**
      * Corrective re-asks the agent's LAST run paid for, read off its own ledger.
@@ -1549,8 +1469,8 @@ export class Agent extends RunnerBase {
      * any string, including one that never came from this agent, and reporting
      * `0` for "I do not know" would be an invented fact in an event payload.
      */
-    lastRunRetriesSpent() {
-        const state = this.liveSnapshot()?.sharedState;
+    retriesSpent(invocation) {
+        const state = invocation.view.snapshot()?.sharedState;
         if (state === undefined)
             return undefined;
         return Math.max(0, (state.outputAttempts?.length ?? 1) - 1);
@@ -1571,36 +1491,43 @@ export class Agent extends RunnerBase {
      * `agent.answerCoverage()`.
      */
     async runTyped(input, options) {
-        if (!this.outputSchemaParser) {
-            throw new Error(`Agent.runTyped: this agent has no outputSchema. Use ` +
-                `Agent.create({...}).outputSchema(parser).build() to enable typed output.`);
-        }
-        const out = await this.run(input, options);
-        if (typeof out !== 'string') {
-            throw new Error('Agent.runTyped: run paused — typed mode does not support pauses. ' +
-                'Use agent.run() + agent.parseOutput(...) after resume.');
-        }
-        // `strategy: 'native'`: an answer whose last attempt failed on a refusal
-        // or truncation stop is refused here even when its text parses — the
-        // format did not hold for it (outputEnforcement.ts · nativeStopFailure).
-        // FIRST, before any delivery path. It takes the same path a parse failure
-        // takes, `.outputFallback()` included.
-        const stopped = this.outputEnforcement?.outputFormat !== undefined ? this.outputContractUnmet() : undefined;
-        if (stopped?.stopReason !== undefined) {
-            return this.settleTypedFailure(out, new OutputSchemaError(stopped.error, { rawOutput: out, stage: stopped.stage }));
-        }
-        if (this.answerValidationConfig !== undefined) {
-            // The validator judged the schema's JSON output. Do not run a transforming
-            // or stateful parser again and hand back a value the validator never saw.
-            if (this.answerValidation()?.schemaAccepted !== true) {
-                throw new OutputSchemaError('Answer validation could not establish a JSON schema result.', {
-                    rawOutput: out,
-                    stage: 'schema-validate',
-                });
+        return this.runExecution().withRun(async (invocation) => {
+            if (!this.outputSchemaParser) {
+                throw new Error(`Agent.runTyped: this agent has no outputSchema. Use ` +
+                    `Agent.create({...}).outputSchema(parser).build() to enable typed output.`);
             }
-            return applyOutputSchema(out, { parse: (value) => value });
-        }
-        return this.parseOutputAsync(out);
+            const out = await this.runOwned(invocation, input, options);
+            if (typeof out !== 'string') {
+                throw new Error('Agent.runTyped: run paused — typed mode does not support pauses. ' +
+                    'Use agent.run() + agent.parseOutput(...) after resume.');
+            }
+            // `strategy: 'native'`: an answer whose last attempt failed on a refusal
+            // or truncation stop is refused here even when its text parses — the
+            // format did not hold for it (outputEnforcement.ts · nativeStopFailure).
+            // FIRST, before any delivery path. It takes the same path a parse failure
+            // takes, `.outputFallback()` included.
+            const stopped = this.outputEnforcement?.outputFormat !== undefined ? this.outputContractUnmet() : undefined;
+            if (stopped?.stopReason !== undefined) {
+                return this.settleTypedFailure(out, new OutputSchemaError(stopped.error, { rawOutput: out, stage: stopped.stage }), invocation);
+            }
+            if (this.answerValidationConfig !== undefined) {
+                // The validator judged the schema's JSON output. Do not run a transforming
+                // or stateful parser again and hand back a value the validator never saw.
+                if (this.answerValidation()?.schemaAccepted !== true) {
+                    throw new OutputSchemaError('Answer validation could not establish a JSON schema result.', {
+                        rawOutput: out,
+                        stage: 'schema-validate',
+                    });
+                }
+                return applyOutputSchema(out, { parse: (value) => value });
+            }
+            try {
+                return applyOutputSchema(out, this.outputSchemaParser);
+            }
+            catch (error) {
+                return this.settleTypedFailure(out, error, invocation);
+            }
+        });
     }
     /**
      * Answer one turn.
@@ -1640,6 +1567,10 @@ export class Agent extends RunnerBase {
      * ```
      */
     async run(input, options) {
+        return this.runExecution().withRun((invocation) => this.runOwned(invocation, input, options));
+    }
+    async runOwned(invocation, input, options) {
+        invocation.value.hadAdmitted = invocation.previous?.value.hadAdmitted === true;
         // Normalize or refuse BEFORE anything is created. A bare string is the
         // message; anything that is not a message is named and refused here
         // rather than becoming `content: undefined` inside the messages slot.
@@ -1669,13 +1600,12 @@ export class Agent extends RunnerBase {
         // never on the server's zone.
         const clockDraft = this.clockDraftFor(runInput.time ?? options?.time, 'Agent.run');
         // The engine's options; the run's signal (and its deadline) is armed just
-        // before the run starts and released in its `finally` (`runSignalOf`).
+        // before native execution, whose lifecycle releases it.
         const engineOptions = withoutTime(options);
         // Timing next, and before the executor exists: both of these refuse a call
         // that would have SUCCEEDED into corrupted per-instance state or an
         // orphaned human question. See ./conversation.ts for why they are throws.
-        this.assertNotRunning('Agent.run');
-        this.assertNoPendingQuestion('Agent.run');
+        this.assertNoPendingQuestion('Agent.run', invocation.previous?.value);
         // A conversation handed in continues through the same side channel
         // `resumeOnError` uses — one restoration path, so the two doors cannot
         // drift about what "continue" means. This turn's message IS appended:
@@ -1684,97 +1614,98 @@ export class Agent extends RunnerBase {
         let continued;
         if (runInput.continueFrom !== undefined) {
             continued = validateCheckpoint(runInput.continueFrom);
-            this.applyContinuation(continued, 'Agent.run({ continueFrom })', true);
+            this.applyContinuation(invocation.value, continued, 'Agent.run({ continueFrom })', true);
         }
         // Only an EXPLICIT identity is remembered for `checkpoint()`; see the
         // field's note. `input.identity` wins over `options.identity` because the
         // input bag is where a caller looks first, and both win over the stored
         // conversation's — but the conversation's is used when neither was given,
         // so a continued turn stays in the namespace it started in.
-        this.lastRunIdentity =
+        invocation.value.identity =
             runInput.identity ?? options?.identity ?? (continued ? continued.identity : undefined);
         // Recordings-as-artifacts (9.26.0). BEFORE `createExecutor`, because
         // `attach()` collects recorders for the executor that has not been built
         // yet — a recording started one line later would be missing its
         // boundaries, which is the failure mode `recordRun` exists to prevent.
         // Returns `undefined` (and touches nothing) unless the dial is on.
-        const recording = this.startRunRecording();
+        const recording = this.startRunRecording(invocation);
         // (helper used in the catch block below — module-private function
         // declared at file end via hoisting)
-        this.answeredAsk = undefined;
-        this.resumePassedTime = undefined;
-        const executor = this.createExecutor(engineOptions, runRequest);
-        this.inFlightRunId = this.currentRunContext.runId;
+        invocation.value.answeredAsk = undefined;
+        invocation.value.resumePassedTime = undefined;
+        const prepared = this.prepareAgentRun(invocation, engineOptions, runRequest);
         // One disposition ledger per run (9.60.0) — registration mirrors what
         // this agent's configuration makes applicable; dev posture runs the
         // canaries here, BEFORE any real work, so a dead check is named first.
-        this.beginIntegrityLedger();
         // Auto-checkpoint at iteration boundaries — captures the latest
         // conversation history into a per-run tracker. On error, we
         // wrap the underlying error in `RunCheckpointError` carrying
         // this checkpoint so `agent.resumeOnError(checkpoint)` can
         // continue from the last good iteration.
         const tracker = {
-            runId: this.currentRunContext?.runId ?? 'unknown',
+            get runId() {
+                return invocation.context().runId;
+            },
             originalInput: { message: runInput.message },
             history: [],
             lastCompletedIteration: 0,
         };
-        this.checkpointTracker = tracker;
-        const stopTracking = this.installCheckpointTracker(tracker);
+        invocation.value.checkpointTracker = tracker;
         // The answer this run produces is the only place the final assistant turn
         // exists (nothing writes it back into `scope.history`), so `checkpoint()`
         // keeps it. Cleared here so a failed or paused run cannot hand back the
         // previous run's answer.
-        this.lastRunAnswer = undefined;
+        invocation.value.answer = undefined;
         // One run can never raise on another run's consent block.
-        this.consentOutstanding.clear();
+        invocation.value.consentOutstanding.clear();
         // Set here, beside the `try` whose `finally` clears it, so no exit path
         // can leave it behind for a turn this `run()` did not start.
-        this.runClockDraft = clockDraft;
+        invocation.value.clockDraft = clockDraft;
         // Armed here, beside the `try` whose `finally` releases it: no refused
         // call above can leave a deadline running.
-        const runSignal = runSignalOf(engineOptions);
         try {
-            const result = await executor.run({
-                input: {
-                    message: runInput.message,
-                    ...(this.lastRunIdentity !== undefined && { identity: this.lastRunIdentity }),
-                    // A composed message reaches seed only on an agent that reads it
-                    // (declared sources, or the time layer's reader) — every other run's
-                    // input is the bytes it was.
-                    ...(messageFrom === 'composed' &&
-                        (this.argumentSourcesArmed === true || this.timeOptions?.reader !== undefined) && {
-                        messageFrom: 'composed',
-                    }),
+            const result = await invocation.execute({
+                kind: 'run',
+                options: {
+                    input: {
+                        message: runInput.message,
+                        ...(invocation.value.identity !== undefined && {
+                            identity: invocation.value.identity,
+                        }),
+                        // A composed message reaches seed only on an agent that reads it
+                        // (declared sources, or the time layer's reader) — every other run's
+                        // input is the bytes it was.
+                        ...(messageFrom === 'composed' &&
+                            (this.argumentSourcesArmed === true || this.timeOptions?.reader !== undefined) && {
+                            messageFrom: 'composed',
+                        }),
+                    },
+                    // Co-engineered boundary (#16): the engine's loop-iteration limit
+                    // (footprintjs 9 default 1000) must never fire BELOW the agent's own
+                    // budget — give it headroom (×2 + 10 covers double-hop loop shapes).
+                    // Consumer-provided options win.
+                    maxIterations: this.maxIterations * 2 + 10,
+                    ...(engineOptions ?? {}),
                 },
-                // Co-engineered boundary (#16): the engine's loop-iteration limit
-                // (footprintjs 9 default 1000) must never fire BELOW the agent's own
-                // budget — give it headroom (×2 + 10 covers double-hop loop shapes).
-                // Consumer-provided options win.
-                maxIterations: this.maxIterations * 2 + 10,
-                ...(runSignal.options ?? {}),
-            });
-            const finalized = this.finalizeResult(executor, result);
+            }, prepared.setup, prepared.binding);
+            const finalized = this.finalizeResult(invocation, result);
             if (typeof finalized === 'string')
-                this.lastRunAnswer = finalized;
-            this.recordPendingQuestion(finalized);
-            await this.endRunToolSessions(finalized);
+                invocation.value.answer = finalized;
+            this.recordPendingQuestion(invocation.value, finalized);
             // The answer is FINISHED before this line and cannot be changed by it.
             // The liveness theorems (9.60.0, dev posture only) — a run that would
             // return green while its registered checkers demonstrably never ran
             // fails HERE instead, before the recording is filed. A finished run is
             // itself the proof work existed: the loop cannot finish without at
             // least one model call.
-            this.assertIntegrityAlive();
+            this.assertIntegrityAlive(invocation);
             // See `fileRunRecording` for why the write is awaited rather than left
             // in flight, and why it can never fail the run.
-            await this.fileRunRecording(recording, finalized);
+            recording?.complete(finalized);
             return finalized;
         }
         catch (cause) {
             // A THROWN pause is still a pause — see `endRunToolSessions`.
-            await this.endRunToolSessions(cause);
             // Wrap recoverable errors with the last-known-good checkpoint.
             // Don't wrap intentional terminal signals — let them propagate as
             // their typed shapes so callers can `instanceof` them:
@@ -1813,7 +1744,10 @@ export class Agent extends RunnerBase {
                     // 9.60.0 — a dead checker is a WIRING verdict on this build, not a
                     // recoverable run state: resuming would run the same dead wiring.
                     cause.name === 'CheckerDeadError');
-            if (cause instanceof Error && !isTerminalTypedError && tracker.history.length > 0) {
+            if (cause instanceof Error &&
+                !isTerminalTypedError &&
+                !invocation.value.checkpointObservationFailed &&
+                tracker.history.length > 0) {
                 // Observation beats the heuristic: if a bracket was open, it says
                 // exactly what the run was doing. `classifyFailurePhase` only decides
                 // when nothing was — a failure between brackets, where the error's own
@@ -1835,7 +1769,7 @@ export class Agent extends RunnerBase {
                 // resuming after a crash would be the one path that still lost the
                 // identity, and the memory written after the recovery would land
                 // where nothing could read it.
-                this.conversationOwner(), 
+                this.conversationOwner(invocation.value), 
                 // …and the same graph cursor (SG-C), from the same snapshot reader —
                 // one reader, two carriers, so neither can lose what the other keeps.
                 this.continuityCursorOf(this.liveSnapshot()?.sharedState), this.evidenceRecoveryOf(this.liveSnapshot()?.sharedState), 
@@ -1852,32 +1786,28 @@ export class Agent extends RunnerBase {
             throw cause;
         }
         finally {
-            // The run's deadline and signal links end with the run (`runSignalOf`).
-            runSignal.release();
+            // Native admission owns deadlines, signal links and final joining.
             // The time layer's per-run inputs end with the run: a stale draft would
             // be stamped by the next seed this agent did not start (a composition
             // mounting its chart) as if the app had declared it.
-            this.runClockDraft = undefined;
-            this.resumePassedTime = undefined;
+            invocation.value.clockDraft = undefined;
+            invocation.value.resumePassedTime = undefined;
             // The run's disposition rows, on EVERY path — success, failure, pause —
             // and BEFORE the recording stops, so a recording carries its run's
             // checker accounting (9.60.0).
-            this.fileIntegrityDisposition();
+            this.fileIntegrityDisposition(invocation);
             // Always released: a recording left subscribed would keep listening
             // through the next run and grow a tail nobody reads.
-            this.noteAdmittedRun();
-            recording?.stop();
-            stopTracking();
-            this.inFlightRunId = undefined;
+            this.noteAdmittedRun(invocation);
             // `seed` consumes the restored conversation on its way past. A run that
             // died BEFORE seed never did, and a history left armed here would be
             // picked up by the next run — which would then continue a conversation
             // nobody asked it to. One run, one continuation.
-            this.pendingResumeHistory = undefined;
-            this.pendingResumeFolded = undefined;
-            this.pendingResumeFindingsLedger = undefined;
-            this.pendingResumeSkillCursor = undefined;
-            this.pendingEvidenceRecovery = undefined;
+            invocation.value.pendingResumeHistory = undefined;
+            invocation.value.pendingResumeFolded = undefined;
+            invocation.value.pendingResumeFindingsLedger = undefined;
+            invocation.value.pendingResumeSkillCursor = undefined;
+            invocation.value.pendingEvidenceRecovery = undefined;
         }
     }
     /**
@@ -1913,17 +1843,24 @@ export class Agent extends RunnerBase {
      * ```
      */
     async followUp(message, options) {
-        // Refuse BEFORE the timing guards, so "there is nothing to follow up on"
-        // is never reported as "a run is in flight" for an agent that has simply
-        // not run yet.
-        if (this.liveSnapshot() === undefined || (this.lastInputRefused() && !this.hadAdmittedRun)) {
-            throw new NoConversationError('Agent.followUp', 'never-run');
-        }
-        const conversation = this.checkpoint();
-        if (conversation === undefined || conversation.history.length === 0) {
-            throw new NoConversationError('Agent.followUp', this.lastInputRefused() ? 'last-input-refused' : 'last-run-unfinished');
-        }
-        return this.run({ message, continueFrom: conversation }, options);
+        return this.runExecution().withRun(async (invocation) => {
+            assertIdentityShape(options?.identity, 'Agent.followUp');
+            // A continuation must exist before any history can be selected.
+            if (invocation.previous?.view.snapshot() === undefined ||
+                (this.lastInputRefused(invocation.previous?.view) &&
+                    !invocation.previous?.value.hadAdmitted)) {
+                throw new NoConversationError('Agent.followUp', 'never-run');
+            }
+            const conversation = this.checkpointFor(invocation.previous);
+            if (conversation === undefined || conversation.history.length === 0) {
+                throw new NoConversationError('Agent.followUp', this.lastInputRefused(invocation.previous?.view)
+                    ? 'last-input-refused'
+                    : 'last-run-unfinished');
+            }
+            if (conversation.identity !== undefined)
+                refuseFollowUpIdentity(options?.identity, conversation.identity);
+            return this.runOwned(invocation, { message, continueFrom: conversation }, options);
+        });
     }
     /**
      * Drop the question this agent's last run paused to ask, on the record.
@@ -1940,10 +1877,8 @@ export class Agent extends RunnerBase {
      * does not touch the paused run's checkpoint: if you still hold that, it
      * remains resumable.
      */
-    abandonPause() {
-        const dropped = this.pendingQuestion;
-        this.pendingQuestion = undefined;
-        return dropped;
+    async abandonPause() {
+        return this.runExecution().withRun((invocation) => abandonPendingQuestion(invocation.previous?.value));
     }
     /**
      * Whether {@link Agent.selfExplain}'s why-questions have a run to answer
@@ -2011,32 +1946,33 @@ export class Agent extends RunnerBase {
      * ```
      */
     async resumeOnError(checkpoint, options) {
-        const cp = validateCheckpoint(checkpoint);
-        // The timing guards run HERE, not only inside `run()`, because the line
-        // below writes the side channel: a refusal after that write would leave a
-        // restored history armed and the NEXT run would silently continue somebody
-        // else's conversation.
-        this.assertNotRunning('Agent.resumeOnError');
-        this.assertNoPendingQuestion('Agent.resumeOnError');
-        // A request `run()` would refuse is refused HERE, before the side channel
-        // below is armed — a refusal after it would leave the restored history for
-        // the next, unrelated run.
-        requestOf(options, 'Agent.resumeOnError');
-        // Stash the checkpointed history on the side channel; the seed function
-        // reads + clears it before scope.history initializes. No message is
-        // appended — the failing run's message is already the last user turn in
-        // that history, and adding it again would ask twice.
-        this.applyContinuation(cp, 'Agent.resumeOnError', false);
-        return this.run({
-            message: cp.originalInput.message,
-            // The conversation's own identity, unless this call named one. Until
-            // 9.2.0 there was no way to pass either, so a recovered run silently
-            // re-namespaced its memory under a fresh runId and wrote turn two
-            // where turn three could not read it.
-            ...(this.identityFor(options, cp) !== undefined && {
-                identity: this.identityFor(options, cp),
-            }),
-        }, options);
+        return this.runExecution().withRun(async (invocation) => {
+            const cp = validateCheckpoint(checkpoint);
+            // The timing guards run HERE, not only inside `run()`, because the line
+            // below writes the side channel: a refusal after that write would leave a
+            // restored history armed and the NEXT run would silently continue somebody
+            // else's conversation.
+            this.assertNoPendingQuestion('Agent.resumeOnError', invocation.previous?.value);
+            // A request `run()` would refuse is refused HERE, before the side channel
+            // below is armed — a refusal after it would leave the restored history for
+            // the next, unrelated run.
+            requestOf(options, 'Agent.resumeOnError');
+            // Stash the checkpointed history on the side channel; the seed function
+            // reads + clears it before scope.history initializes. No message is
+            // appended — the failing run's message is already the last user turn in
+            // that history, and adding it again would ask twice.
+            this.applyContinuation(invocation.value, cp, 'Agent.resumeOnError', false);
+            return this.runOwned(invocation, {
+                message: cp.originalInput.message,
+                // The conversation's own identity, unless this call named one. Until
+                // 9.2.0 there was no way to pass either, so a recovered run silently
+                // re-namespaced its memory under a fresh runId and wrote turn two
+                // where turn three could not read it.
+                ...(this.identityFor(options, cp) !== undefined && {
+                    identity: this.identityFor(options, cp),
+                }),
+            }, options);
+        });
     }
     /**
      * Which identity a continued turn runs under: the caller's if they named
@@ -2047,141 +1983,21 @@ export class Agent extends RunnerBase {
     identityFor(options, cp) {
         return options?.identity ?? cp.identity;
     }
-    /**
-     * A run's `time`, read into the turn's clock draft (the time layer) — or
-     * refused, before the turn starts: `time` on an agent without `.time()` or
-     * a malformed value. No zone anywhere (the run's, else the builder's) is no
-     * refusal: the zone is UNKNOWN (`zoneSource: 'unknown'`, G15) — never the
-     * server's, never guessed; the person is asked it before any time they
-     * wrote is read. `undefined` on an agent without the layer.
-     *
-     * @internal
-     */
     clockDraftFor(time, runner) {
-        const passed = this.passedTimeFor(time, runner);
-        if (this.timeOptions === undefined)
-            return undefined;
-        return draftClock(passed, this.timeOptions);
+        return draftAgentClock(time, runner, this.timeOptions);
     }
-    /**
-     * The clock draft seed stamps (the time layer): the one `run()` read — or,
-     * for a turn this agent's `run()` did not start (its chart mounted in a
-     * composition, which passes no `time`), the builder's fallback zone with
-     * the turn's start as `now` (`zoneSource: 'builder'`, `nowSource:
-     * 'default'` — the same record a `run()` with no `time` files). With no
-     * fallback zone that turn's zone is unknown, as a `run()`'s is (G15): the
-     * server's zone is never used.
-     *
-     * @internal
-     */
-    seedClockDraft() {
-        if (this.runClockDraft !== undefined)
-            return this.runClockDraft;
-        return draftClock(undefined, this.timeOptions ?? {});
+    seedClockDraft(values) {
+        return clockForSeed(values, this.timeOptions);
     }
-    /**
-     * A `time` passed to a run or a resume, read — or refused by name: passed to
-     * an agent without `.time()` (a door that ignored it would look configured
-     * and do nothing), or malformed.
-     *
-     * @internal
-     */
     passedTimeFor(time, runner) {
-        if (time === undefined)
-            return undefined;
-        if (this.timeOptions === undefined) {
-            throw new InvalidRunInputError({
-                runner,
-                received: 'time',
-                hint: 'this agent reads no clock — arm the time layer with .time() to pass time',
-            });
-        }
-        const read = readRunTime(time);
-        if ('problem' in read) {
-            throw new InvalidRunInputError({ runner, received: 'a malformed time', hint: read.problem });
-        }
-        return read.value;
-    }
-    /**
-     * Install a per-run checkpoint tracker. Listens for the agent's own
-     * iteration and stream brackets and snapshots the conversation history into
-     * the tracker. Returns a stop function.
-     *
-     * It listens on the REAL-value path (`EventDispatcher · onRealEvent`), never
-     * on the served one: the crash checkpoint it builds is what
-     * `resumeOnError` replays to the model, and a resume checkpoint keeps real
-     * values — a redaction policy that names `history` must not turn the
-     * conversation a crash resumes into placeholders (`src/redaction/`).
-     *
-     * @internal
-     */
-    installCheckpointTracker(tracker) {
-        return this.dispatcher.onRealEvent((event) => {
-            switch (event.type) {
-                case 'agentfootprint.agent.iteration_start': {
-                    const p = event.payload;
-                    if (typeof p?.iterIndex === 'number')
-                        tracker.inFlightIteration = p.iterIndex;
-                    return;
-                }
-                // Phase OBSERVATION (8.14.0) — the run's own stream brackets. A crash
-                // inside one of these is attributable without asking the error to
-                // describe itself. `'call-llm'` is a literal and `toolName` is a name
-                // the app declared: no URL, no credential, no payload ever reaches the
-                // checkpoint.
-                case 'agentfootprint.stream.llm_start':
-                    tracker.inFlightPhase = { phase: 'llm', stage: 'call-llm' };
-                    return;
-                case 'agentfootprint.stream.llm_end':
-                    tracker.inFlightPhase = undefined;
-                    return;
-                // A bracket carrying `notDispatched` (9.113.0) is a call a paused batch
-                // never dispatched: nothing of it was ever in flight, so it neither
-                // opens nor clears the phase. Nothing observable depends on this today
-                // — the settlement emits both halves back to back with no await between
-                // them (`toolCalls.ts` · `bracketSettled`), so a crash can never land
-                // inside one — it keeps the phase true to the marker should that ever
-                // change.
-                case 'agentfootprint.stream.tool_start': {
-                    const p = event.payload;
-                    if (p?.notDispatched !== undefined)
-                        return;
-                    const name = p?.toolName;
-                    tracker.inFlightPhase = {
-                        phase: 'tool',
-                        stage: typeof name === 'string' ? name : 'tool',
-                    };
-                    return;
-                }
-                case 'agentfootprint.stream.tool_end': {
-                    const p = event.payload;
-                    if (p?.notDispatched !== undefined)
-                        return;
-                    tracker.inFlightPhase = undefined;
-                    return;
-                }
-                case 'agentfootprint.agent.iteration_end': {
-                    const p = event.payload;
-                    if (typeof p?.iterIndex === 'number')
-                        tracker.lastCompletedIteration = p.iterIndex;
-                    if (Array.isArray(p?.history)) {
-                        tracker.history = p.history;
-                    }
-                    tracker.inFlightIteration = undefined;
-                    tracker.inFlightPhase = undefined;
-                    return;
-                }
-                default:
-                    return;
-            }
-        });
+        return readAgentTime(time, runner, this.timeOptions);
     }
     /**
      * Continue a run that paused to ask a person something, with their answer.
      *
      * WHO the resumed run is for is the paused run's caller, read off the
      * checkpoint (`agent/callerIdentity.ts`) — never whatever this instance ran
-     * last; which SESSION, the call's `sessionId`, else the paused run's. A
+     * last; the session is the paused run's. A supplied `sessionId` must match. A
      * checkpoint names who it is for; it is not proof: a host that lets
      * checkpoints leave its trust boundary signs them or keeps them
      * server-side, and passes the identity it verified as `options.identity`.
@@ -2204,11 +2020,15 @@ export class Agent extends RunnerBase {
      * ```
      */
     async resume(checkpoint, input, options) {
+        this.noteResumeTakenUp(checkpoint);
+        return this.runExecution().withRun((invocation) => preservePendingQuestion(invocation.previous?.value, () => invocation.value.resources?.answer.consumed === true, () => this.resumeOwned(invocation, checkpoint, input, options)));
+    }
+    async resumeOwned(invocation, checkpoint, input, options) {
         // Taken up, before anything can refuse: from here every use of a consent
         // decision passes through the one spend a door watching this pause sees
         // (`consentRequest.ts` · `watchDecisionUse`) — so a resume that fails
         // without reaching it, refused or aborted, used nothing.
-        noteDecisionTakenUp(pausedRequestIdOf(checkpoint));
+        resumeStateOf(checkpoint);
         // ── A consent gate is answered with a DECISION (8.13.0) ─────────────
         // Refused HERE, before the engine is handed the checkpoint, so nothing
         // executes and the checkpoint is unchanged — the caller can answer the same
@@ -2226,8 +2046,6 @@ export class Agent extends RunnerBase {
         // The incoming request is the RESUMING caller's — never the paused one's:
         // a checkpoint carries no request, and a resume without one serves none.
         const resumeRequest = requestOf(options, 'Agent.resume');
-        // Native guard lands with the new checkpoint protocol, before its runtime
-        // opt-in is mounted. Until then no Agent is armed to consume this carrier.
         requireVerificationOnResume(checkpoint.sharedState ?? {}, false);
         if (this.negativeClaimsConfig !== undefined) {
             const prior = negativeCheckpointOf(checkpoint.sharedState ?? {});
@@ -2245,6 +2063,7 @@ export class Agent extends RunnerBase {
             options?.redact,
             conversationRedaction(),
         ]);
+        Object.assign(invocation.value, privateResumeOf(checkpoint));
         // A resume's `time` (the time layer) is read or refused before anything
         // moves; it is never applied — the paused turn's clock is kept, and a
         // differing value is recorded by the ToolCalls resume door.
@@ -2259,10 +2078,7 @@ export class Agent extends RunnerBase {
         // principal and stored ownership. A checkpoint names who it is for; it is
         // not proof — a host that lets checkpoints leave its trust boundary signs
         // them or keeps them server-side, and passes the identity it verified here.
-        const pausedFor = callerIdentityOf(checkpoint.sharedState, {
-            ...(this.lastRunIdentity !== undefined && { named: this.lastRunIdentity }),
-            minted: this.mintedRunIds,
-        });
+        const pausedFor = callerIdentityOf(checkpoint.sharedState);
         // The identity the run's memory namespace and credentials are restored
         // from, WHATEVER its source (a caller's, the session rung, the per-run
         // default). One run, one identity: a call that names an identity must
@@ -2275,6 +2091,9 @@ export class Agent extends RunnerBase {
                 (restored === undefined || !sameIdentity(options.identity, restored)))) {
             throw new ResumeIdentityConflictError();
         }
+        const sessionId = resumeSessionOf(checkpoint);
+        if (options?.sessionId !== undefined && options.sessionId !== sessionId)
+            throw new ResumeIdentityConflictError('session');
         // …and the decision must be for THIS request and this exact call
         // (`core/consentRequest.ts`): refused here, before anything moves, when it
         // names no request, another request, a call the checkpoint no longer
@@ -2287,11 +2106,12 @@ export class Agent extends RunnerBase {
             // A request minted under a ledger that can prove is spent only there.
             this.decisionLedger ?? processDecisionLedger());
         }
+        if (gate !== undefined)
+            await refuseKnownSpentAnswer(this.decisionLedger ?? processDecisionLedger(), input, gate, options?.signal, options?.env?.signal);
         // Typed data collection is not consent. Validate before changing any run state.
         const awaitingInput = gate === undefined ? readAwaitingInput(checkpoint.pauseData) : undefined;
         let answeredAsk;
         if (awaitingInput !== undefined) {
-            this.assertNotRunning('Agent.resume');
             const answered = applyInputResponse(awaitingInput, input, this.timeAnswerContextOf(checkpoint.sharedState));
             if ('cancel' in answered) {
                 throw new TypeError('[input request] Cancel a hosted request through its host, or abandonPause() before starting another run.');
@@ -2308,7 +2128,7 @@ export class Agent extends RunnerBase {
                     pauseData,
                     awaitingInput: answered,
                 };
-                this.recordPendingQuestion(outcome);
+                this.recordPendingQuestion(invocation.value, outcome);
                 return outcome;
             }
             answeredAsk = {
@@ -2329,77 +2149,62 @@ export class Agent extends RunnerBase {
         // the same door and before any state moves, because a resume that has begun
         // is a resume that has already used the value.
         assertDecisionIsNotStale(checkpoint.pauseData, input);
-        // The same one-turn-at-a-time guard `run()` carries: a resume writes the
-        // same per-instance state a run does. Answering the question is what this
-        // door is FOR, so it never checks `pendingQuestion` — it clears it.
-        this.assertNotRunning('Agent.resume');
-        // Settled the moment the answer is handed over, not when the resumed run
-        // finishes: a resume that then FAILS must not leave the agent refusing
-        // every later message on behalf of a question that has been answered.
-        // Kept to put back when the run refuses the answer itself (a replay of a
-        // request already answered): that resume answered nothing.
-        const questionBefore = this.pendingQuestion;
-        this.pendingQuestion = undefined;
-        // WHO this resumed run is for — set BEFORE the executor exists, because the
-        // run context's principal (every event's `EventMeta.principal`), a tool's
-        // `ctx.identity` and `checkpoint()` all read it: the identity the PAUSED
-        // run's caller named (a named `options.identity` was checked equal to the
-        // restored one at the top of this method) — never the identity of whatever
-        // this instance ran last, which on a shared or pooled agent is another
-        // person's, or nobody's (`callerIdentity.ts`).
-        this.lastRunIdentity = options?.identity ?? pausedFor;
-        // …and WHICH session: the call's, else the one the paused run recorded in
-        // its own state (`runSessionId`, or the session rung's) — one source, no
-        // instance memory — so a host that resumes without repeating the session
-        // does not file the resumed turn (its tool teardown, its events, its
-        // self-explain evidence) as sessionless.
-        const sessionId = options?.sessionId ?? pausedSessionOf(checkpoint.sharedState);
+        if (gate === undefined && awaitingInput === undefined)
+            refuseMissingPlainAnswer(checkpoint, input);
+        // A native-admitted answer settles the old question even if its leg fails.
+        // The outer pause-ownership boundary restores pre-origin refusals; named
+        // unanswered refusals after origin are restored below.
+        const questionBefore = invocation.previous?.value.pendingQuestion;
+        // Capture this paused conversation's identity before native origin; selected readers
+        // on a shared instance can belong to another conversation (`callerIdentity.ts`).
+        invocation.value.identity = options?.identity ?? pausedFor;
+        // Resume retains the paused transport session; an override was checked equal above.
         const sessionResumeOptions = sessionId !== undefined && options?.sessionId === undefined
             ? { ...options, sessionId }
             : options;
         // The leg's policy — the carried one, the caller's, and the paused leg's
         // marks — comes back from the emitter and goes to THIS leg's executor
-        // (`createExecutor` → `openRunRedaction`); nothing per-run is held on the instance.
+        // (native setup → `prepareRunRedaction`); nothing per-run is held on the instance.
         const resumeLeg = this.emitPauseResume(checkpoint, input, unionRedactionPolicies(carriedRedaction, sessionResumeOptions?.redact));
         const resumeOptions = resumeLeg === sessionResumeOptions?.redact
             ? sessionResumeOptions
             : { ...sessionResumeOptions, redact: resumeLeg };
-        // Fresh executor — footprintjs 4.17.0+ seeds the runtime from
-        // `checkpoint.sharedState` (and nested subflow states) automatically
-        // on a fresh executor's `resume()`. No need to retain a paused
-        // executor between run/resume.
-        // Recorded on the same terms a fresh run is (9.26.0) — and the recording
-        // covers the RESUMED run, which is what the recorder saw. A turn that
-        // paused and resumed is two runs, and each mints its own recording when
-        // (and only when) it completes.
-        const recording = this.startRunRecording();
-        this.answeredAsk = answeredAsk;
-        const executor = this.createExecutor(resumeOptions, resumeRequest);
+        // Fresh native execution restores its checkpoint; no paused executor is retained.
+        // Each resumed native leg files its own recording when it completes.
+        const recording = this.startRunRecording(invocation);
+        invocation.value.answeredAsk = answeredAsk;
+        const prepared = this.prepareAgentRun(invocation, resumeOptions, resumeRequest);
         // The leg's WHOLE policy rides its own state too (`runRedaction`), so a
         // later pause carries what this leg was covered by — names the resume
         // added included — and a third leg is never less covered than this one.
         // `createExecutor` opened this executor's run; one it did not is refused
         // before anything is held or runs — a leg whose policy nothing knows must
         // not start.
-        const legCoverage = coverageOfExecutor(executor);
+        const legCoverage = invocation.value.redaction?.coverage;
+        if (legCoverage === undefined)
+            throw new ResumeRedactionError('unreadable');
         if (legCoverage.state === 'unknown')
             throw new ResumeRedactionError('unreadable');
         const leg = { policy: policyOfCoverage(legCoverage) };
-        this.inFlightRunId = this.currentRunContext.runId;
         // A resumed turn is two runs, and each keeps its own ledger — exactly
         // the recording's terms one comment up.
-        this.beginIntegrityLedger();
-        this.lastRunAnswer = undefined;
-        this.checkpointTracker = {
-            runId: this.currentRunContext.runId,
-            originalInput: { message: '' },
-            history: [],
-            lastCompletedIteration: 0,
-        };
+        invocation.value.answer = undefined;
+        const resumedMessage = checkpoint.sharedState.userMessage;
+        invocation.value.checkpointTracker =
+            typeof resumedMessage === 'string'
+                ? {
+                    get runId() {
+                        return invocation.context().runId;
+                    },
+                    originalInput: { message: resumedMessage },
+                    history: [],
+                    lastCompletedIteration: 0,
+                }
+                : undefined;
         // One run can never raise on another run's consent block.
-        this.consentOutstanding.clear();
+        invocation.value.consentOutstanding.clear();
         // Beside the `try` whose `finally` clears it (the fresh-run path's terms).
-        this.resumePassedTime = passedTime;
+        invocation.value.resumePassedTime = passedTime;
         const legCheckpoint = leg.policy === undefined
             ? checkpoint
             : {
@@ -2409,81 +2214,38 @@ export class Agent extends RunnerBase {
                     runRedaction: carriedRunPolicy(leg.policy),
                 },
             };
-        // A resume arms its own run signal and deadline (`runSignalOf`), released in
-        // the `finally` below.
-        const runSignal = runSignalOf(resumeOptions);
+        // The native resumed leg owns its signal and deadline.
         try {
-            const result = await executor.resume(legCheckpoint, input, runSignal.options);
-            const finalized = this.finalizeResult(executor, result);
+            const result = await invocation.execute({ kind: 'resume', mode: 'fresh', checkpoint: legCheckpoint, input, options: resumeOptions }, prepared.setup, prepared.binding);
+            const finalized = this.finalizeResult(invocation, result);
             if (typeof finalized === 'string')
-                this.lastRunAnswer = finalized;
+                invocation.value.answer = finalized;
             // The question this resume answered is settled; a resume that paused
             // AGAIN has asked a new one, and that one is outstanding from here.
-            this.recordPendingQuestion(finalized);
-            await this.endRunToolSessions(finalized);
+            this.recordPendingQuestion(invocation.value, finalized);
             // Same liveness gate the fresh-run path applies (9.60.0).
-            this.assertIntegrityAlive();
-            await this.fileRunRecording(recording, finalized);
+            this.assertIntegrityAlive(invocation);
+            recording?.complete(finalized);
             return finalized;
         }
-        catch (cause) {
-            // An answer the run refused ran nothing and answered nothing: the
-            // question this agent was waiting on (if any) is still outstanding, and
-            // no tool session ended — a replayed decision must not tear down the
-            // sandbox a live pause is holding.
-            if (cause instanceof ResumeDecisionError || cause instanceof DecisionRequiredError) {
-                this.pendingQuestion = questionBefore;
-                throw cause;
-            }
-            await this.endRunToolSessions(cause);
-            throw cause;
-        }
         finally {
-            runSignal.release();
+            if (invocation.value.resources?.answer.consumed === true) {
+                if (invocation.previous !== undefined)
+                    invocation.previous.value.pendingQuestion = undefined;
+            }
+            else {
+                invocation.value.pendingQuestion = questionBefore;
+                if (invocation.previous !== undefined)
+                    invocation.previous.value.pendingQuestion = questionBefore;
+            }
             // A resume's passed `time` ends with the resume (the fresh-run path's terms).
-            this.resumePassedTime = undefined;
+            invocation.value.resumePassedTime = undefined;
             // Same terms as the fresh-run path: rows on every exit, before the
             // recording stops (9.60.0).
-            this.fileIntegrityDisposition();
-            this.noteAdmittedRun();
-            recording?.stop();
-            this.inFlightRunId = undefined;
+            this.fileIntegrityDisposition(invocation);
+            this.noteAdmittedRun(invocation);
         }
     }
-    /**
-     * Fire `'run'`-scoped tool teardown — IF this run really ended.
-     *
-     * **Not on `finally`, and that is the whole point.** `finally` runs on every
-     * exit including a pause, and a pause exits TWO ways: a returned
-     * `RunnerPauseOutcome` and a thrown `PauseSignal`. A check-in on a
-     * code-interpreter call pauses the run so a person can approve the code —
-     * tearing the sandbox down there destroys the exact state the resume needs,
-     * and it fails QUIETLY, as a resumed run that "just re-ran everything".
-     * Both shapes are discriminated here and both are skipped.
-     *
-     * An error IS a terminal: the run is over, nobody is coming back, and a
-     * sandbox held by a run that crashed is the clearest kind of leak. Only a
-     * pause survives.
-     *
-     * Fired for the TURN, not for `currentRunContext.runId` — `resume()` mints a
-     * fresh run id, so a pause and its resume are one turn across two runs, and
-     * filtering on the id would leave everything a paused turn opened alive
-     * forever. Hosted turns are scoped to their session, preserving other pauses. See `ToolSessionTier.fireRun`.
-     *
-     * @param outcome what `run()`/`resume()` is about to return, or about to throw.
-     */
-    async endRunToolSessions(outcome) {
-        if (!this.toolSessionTier)
-            return;
-        if (isPaused(outcome))
-            return;
-        if (outcome instanceof Error && outcome.name === 'PauseSignal')
-            return;
-        if (this.currentRunContext.sessionId !== undefined)
-            await this.toolSessionTier.fireSessionRuns(this.currentRunContext.sessionId);
-        else
-            await this.toolSessionTier.fireRun();
-    }
     /**
      * The conversation this agent's LAST completed run leaves behind, packed as
      * the same `AgentRunCheckpoint` that `resumeOnError(...)` accepts. Store it,
@@ -2538,35 +2300,39 @@ export class Agent extends RunnerBase {
      * // it does not rewrite entries manually appended to that history.
      * ```
      */
+    /** During preparation before native origin this is undefined; capture before the next call. */
     checkpoint() {
-        const snapshot = this.liveSnapshot();
+        return this.checkpointFor(this.runExecution().selected());
+    }
+    checkpointFor(selected) {
+        const snapshot = selected?.view.snapshot();
         if (!snapshot)
             return undefined;
         const state = snapshot.sharedState;
         // Admission is decided by seed, before any conversation state is written.
         // Do not manufacture a blank replay carrier for an unadmitted attempt.
-        if (this.lastInputRefused())
+        if (this.lastInputRefused(selected?.view))
             return undefined;
         const recorded = (state?.history ?? []);
         const history = [...recorded];
-        if (this.lastRunAnswer !== undefined &&
-            (this.lastRunAnswer.length > 0 || state?.llmLatestReplay !== undefined)) {
+        if (selected.value.answer !== undefined &&
+            (selected.value.answer.length > 0 || state?.llmLatestReplay !== undefined)) {
             history.push({
                 role: 'assistant',
-                content: this.lastRunAnswer,
+                content: selected.value.answer,
                 ...assistantReplayFields(state ?? {}),
             });
         }
         const folded = this.foldedSpansOf(state);
-        const owner = this.conversationOwner();
+        const owner = this.conversationOwner(selected.value);
         const skillCursor = this.continuityCursorOf(state);
         const evidenceRecovery = this.evidenceRecoveryOf(state);
         const findingsLedger = this.findingsLedgerOf(state);
         const turnNumber = this.turnNumberOf(state);
         return {
             version: 1,
-            runId: this.currentRunContext.runId,
-            history: structuredClone(checkpointReplayHistory(history, this.checkpointTracker)),
+            runId: selected.context.runId,
+            history: structuredClone(checkpointReplayHistory(history, selected.value.checkpointTracker)),
             lastCompletedIteration: typeof state?.iteration === 'number' ? state.iteration : 0,
             originalInput: { message: typeof state?.userMessage === 'string' ? state.userMessage : '' },
             checkpointedAt: Date.now(),
@@ -2594,9 +2360,9 @@ export class Agent extends RunnerBase {
         };
     }
     /** Called as each run/resume ends: remember a run that got past input admission. */
-    noteAdmittedRun() {
-        if (this.liveSnapshot() !== undefined && !this.lastInputRefused()) {
-            this.hadAdmittedRun = true;
+    noteAdmittedRun(invocation) {
+        if (invocation.view.snapshot() !== undefined && !this.lastInputRefused(invocation.view)) {
+            invocation.value.hadAdmitted = true;
         }
     }
     /**
@@ -2610,8 +2376,8 @@ export class Agent extends RunnerBase {
             this.evidenceGate?.toolsOffAfterRevision === true);
     }
     /** Whether input middleware refused the last run's message — the one reading both doors ask. */
-    lastInputRefused() {
-        const state = this.liveSnapshot()?.sharedState;
+    lastInputRefused(view) {
+        const state = view?.snapshot()?.sharedState;
         return state?.messageDeniedPhase === 'input';
     }
     /** Both checkpoint doors keep the repair budget separately from conversation text. */
@@ -2668,27 +2434,8 @@ export class Agent extends RunnerBase {
             return undefined;
         return structuredClone(spans);
     }
-    /**
-     * What the resume door checks a time field's answer with (the time design
-     * § 6.2, step T4): the paused turn's clock zone — the kept `clock` row, so
-     * a resume that passes another `time` changes nothing — and the app's
-     * catalog overrides. `undefined` without `.time()`: a `format` field is
-     * then judged for shape, order and offset only, in the default words.
-     *
-     * @internal
-     */
     timeAnswerContextOf(state) {
-        if (this.timeOptions === undefined)
-            return undefined;
-        const ledger = state?.findingsLedger;
-        const clock = clockOf(Array.isArray(ledger) ? ledger : undefined);
-        // An unknown zone (G15) judges no wall time: `zone` is then only the UTC spelling.
-        const zone = clock?.zoneSource === 'unknown' ? undefined : clock?.zone;
-        const messages = this.timeOptions.messages;
-        return {
-            ...(zone !== undefined && { zone }),
-            ...(messages !== undefined && { messages }),
-        };
+        return agentTimeAnswerContext(state, this.timeOptions);
     }
     /**
      * The findings ledger for a checkpoint (9.101.0) — `foldedSpansOf`'s twin:
@@ -2732,9 +2479,9 @@ export class Agent extends RunnerBase {
      *
      * @internal
      */
-    conversationOwner() {
+    conversationOwner(values) {
         return {
-            ...(this.lastRunIdentity !== undefined && { identity: this.lastRunIdentity }),
+            ...(values.identity !== undefined && { identity: values.identity }),
             ...(this.explicitId !== undefined && { agentId: this.explicitId }),
         };
     }
@@ -2761,12 +2508,12 @@ export class Agent extends RunnerBase {
      *
      * @internal
      */
-    applyContinuation(cp, door, appendsUserTurn) {
+    applyContinuation(values, cp, door, appendsUserTurn) {
         assertContinuable(cp, this.explicitId, door);
         requireVerificationOnResume(cp, false);
         if (this.negativeClaimsConfig === undefined && negativeCheckpointOf(cp) !== undefined)
             throw new TypeError('Continuation requires the negative-claims setting used by the recording agent.');
-        this.pendingResumeHistory = {
+        values.pendingResumeHistory = {
             history: cp.history,
             appendsUserTurn,
             // The turn the stored history ends on (honesty layers) — seed continues
@@ -2777,36 +2524,30 @@ export class Agent extends RunnerBase {
         // The folded spans beside it. A conversation stored before 8.2 has none,
         // and `undefined` is the right answer there — it means "this conversation
         // recorded no folds", which is exactly true.
-        this.pendingResumeFolded = cp.folded;
+        values.pendingResumeFolded = cp.folded;
         // The findings ledger beside it (9.101.0). Stashed whether or not THIS
         // agent is armed: seed restores it only under `.findings()` (the deps
         // gate), and an unarmed continuation consumes and ignores it — exactly
         // like a `folded` field on an agent that never folds.
-        this.pendingResumeFindingsLedger = cp.findingsLedger;
+        values.pendingResumeFindingsLedger = cp.findingsLedger;
         // The conversation's skill cursor (SG-C). Stashed unconditionally —
         // whether it is HONORED is seed's `restoreSkillCursor` gate, which reads
         // the mounted graph's `continuity` declaration; a checkpoint written by a
         // continuity graph and continued on a `'turn'` one is consumed and
         // ignored, exactly like a `folded` field on an agent that never folds.
-        this.pendingResumeSkillCursor = cp.skillCursor;
+        values.pendingResumeSkillCursor = cp.skillCursor;
         // Same failed request retains its single repair budget. A new user turn
         // receives neither the rejected draft nor a spent retry allowance.
-        this.pendingEvidenceRecovery =
+        values.pendingEvidenceRecovery =
             !appendsUserTurn && cp.evidenceRecovery !== undefined
                 ? structuredClone(cp.evidenceRecovery)
                 : undefined;
     }
-    /** One turn at a time — see `RunInFlightError`. @internal */
-    assertNotRunning(door) {
-        if (this.inFlightRunId !== undefined) {
-            throw new RunInFlightError(door, this.id, this.inFlightRunId);
-        }
-    }
     /** A person's unanswered question outranks a new message — see
      *  `PendingQuestionError`. @internal */
-    assertNoPendingQuestion(door) {
-        if (this.pendingQuestion !== undefined) {
-            throw new PendingQuestionError(door, this.pendingQuestion);
+    assertNoPendingQuestion(door, values) {
+        if (values?.pendingQuestion !== undefined) {
+            throw new PendingQuestionError(door, values.pendingQuestion);
         }
     }
     /**
@@ -2819,17 +2560,14 @@ export class Agent extends RunnerBase {
      *
      * @internal
      */
-    recordPendingQuestion(outcome) {
+    recordPendingQuestion(values, outcome) {
         if (typeof outcome === 'string') {
-            this.pendingQuestion = undefined;
+            values.pauseOutcome = undefined;
+            values.pendingQuestion = undefined;
             return;
         }
-        const data = outcome.pauseData;
-        this.pendingQuestion = {
-            ...(typeof data?.toolName === 'string' && { toolName: data.toolName }),
-            ...(typeof data?.toolCallId === 'string' && { toolCallId: data.toolCallId }),
-            ...(typeof data?.question === 'string' && { question: data.question }),
-        };
+        values.pauseOutcome = outcome;
+        values.pendingQuestion = pendingQuestionOf(outcome.pauseData);
     }
     /**
      * Hand the `.selfExplain()` binding to the agent that owns it.
@@ -2897,21 +2635,21 @@ export class Agent extends RunnerBase {
      * is withheld here for that reason — `sessionId` beside it is the fact the
      * transport really delivered.
      */
-    toolRunFacts() {
+    toolRunFacts(run) {
         return {
-            runContext: { ...this.currentRunContext },
-            runId: this.currentRunContext.runId,
-            ...(this.currentRunContext.sessionId !== undefined && {
-                sessionId: this.currentRunContext.sessionId,
+            runContext: { ...run.context },
+            runId: run.context.runId,
+            ...(run.context.sessionId !== undefined && {
+                sessionId: run.context.sessionId,
             }),
-            ...(this.lastRunIdentity !== undefined && { identity: this.lastRunIdentity }),
+            ...(run.value.identity !== undefined && { identity: run.value.identity }),
         };
     }
     /**
-     * The teardown tier, built on FIRST registration.
+     * The existing teardown tier, built on first component resource admission.
      *
-     * An agent whose tools never hold a session never allocates one, and its
-     * terminals stay a single `undefined` check.
+     * Admission precedes tool resource effects so restored owners cannot be
+     * borrowed concurrently. Components without tool admission do not allocate it.
      */
     toolSessions() {
         if (!this.toolSessionTier) {
@@ -2953,14 +2691,18 @@ export class Agent extends RunnerBase {
         const type = report.kind === 'closed'
             ? 'agentfootprint.tools.session_closed'
             : 'agentfootprint.tools.session_close_failed';
+        const { kind: _kind, ...payload } = report;
+        if (origin.emit !== undefined) {
+            origin.emit(type, payload);
+            return;
+        }
         const dispatcher = this.getDispatcher();
         if (!dispatcher.hasListenersFor(type))
             return;
-        const { kind: _kind, ...payload } = report;
         dispatcher.dispatch({
             type,
             payload,
-            meta: buildEventMeta({ runtimeStageId: TOOL_TEARDOWN_STAGE_ID }, origin.runContext ?? this.currentRunContext),
+            meta: buildEventMeta({ runtimeStageId: TOOL_TEARDOWN_STAGE_ID }, origin.runContext ?? { runId: 'consumer-scope', runStartMs: 0, compositionPath: [] }),
         });
     }
     openSkillIds() {
@@ -3091,7 +2833,8 @@ export class Agent extends RunnerBase {
         return async (scope) => {
             // The caller of THIS run: the instance's caller on its own run, the
             // member's run (never the instance's last caller) on a mount.
-            const identity = this.ownScopes.has(scope) ? this.lastRunIdentity : memberIdentityIn(scope);
+            const run = this.runExecution().forScope(scope);
+            const identity = run.own ? run.value.identity : memberIdentityIn(scope);
             const hidden = [];
             for (const id of skillIds) {
                 let allowed = false;
@@ -3118,27 +2861,7 @@ export class Agent extends RunnerBase {
         };
     }
     assertDeliverableRoles() {
-        const providers = providerTargets(this.provider, this.model, this.reliabilityConfig?.providers).map((target) => target.provider);
-        for (const inj of this.injections) {
-            for (const msg of inj.inject?.messages ?? []) {
-                assertDeliverableRole(providers, msg.role, `Agent injection '${inj.id}'`);
-                // Content, judged at the same funnel as role (8.18.0). The named
-                // factories refuse empty content; a hand-built Injection reached the
-                // delivery stage unchecked and put a contentless turn on the wire.
-                const content = msg.content;
-                if (typeof content !== 'string' || content.trim() === '') {
-                    throw new Error(messagesContentRefusal({
-                        site: `Agent injection '${inj.id}'`,
-                        role: msg.role,
-                        received: typeof content !== 'string'
-                            ? content === undefined
-                                ? 'missing'
-                                : `a ${content === null ? 'null' : typeof content}`
-                            : 'empty',
-                    }));
-                }
-            }
-        }
+        assertInjectionDelivery(this.injections, providerTargets(this.provider, this.model, this.reliabilityConfig?.providers).map((target) => target.provider));
     }
     /**
      * Refuse, at run start, a `'tool-forced'` output strategy on a provider
@@ -3206,7 +2929,7 @@ export class Agent extends RunnerBase {
             `not in this release. Use { strategy: 'instruct', retries: N } on this provider — it ` +
             `works on every wire — or run the native strategy on a provider that declares it.`);
     }
-    createExecutor(runOptions, request) {
+    prepareAgentRun(invocation, runOptions, request) {
         this.assertDeliverableRoles();
         this.assertForcedToolChoiceSupported();
         this.assertNativeOutputSchemaSupported();
@@ -3228,71 +2951,33 @@ export class Agent extends RunnerBase {
         // is exactly the string an auditor must not read as "who did this".
         // `conversationId` is deliberately not carried: it is a thread, not a
         // person, and `sessionId` beside it is the fact the transport delivered.
-        const actor = runOptions?.identity ?? this.lastRunIdentity;
+        const actor = runOptions?.identity ?? invocation.value.identity;
+        invocation.value.request = request;
         // A fresh run starts with no evictions filed — the previous run's last
         // visit must not be read as this run's (`window/evictedTurns.ts`).
-        this.evictedTurnsHandle?.clear();
-        const runId = makeRunId();
-        this.mintedRunIds.add(runId);
-        boundInsertionOrder(this.mintedRunIds, MAX_REMEMBERED_RUNS);
         const hosted = hostedConversationOf(runOptions);
-        this.servingConversation =
+        invocation.value.servingConversation =
             sessionId !== undefined
                 ? sessionConversationKey(sessionId)
                 : hosted !== undefined
                     ? hostedConversationKey(hosted)
                     : undefined;
-        this.currentRunContext = {
-            runStartMs: Date.now(),
-            runId,
+        const metadata = {
             compositionPath: [`Agent:${this.id}`],
             ...(correlationId !== undefined && { correlationId }),
             ...(traceId !== undefined && { traceId }),
-            // Session identity rides beside runId, not instead of it: one session
-            // produces many runs, and an event needs to say which of each it is.
             ...(sessionId !== undefined && { sessionId }),
             ...(actor?.principal !== undefined && { principal: actor.principal }),
             ...(actor?.tenant !== undefined && { tenant: actor.tenant }),
         };
-        const getRunCtx = () => this.currentRunContext;
+        const getRunCtx = () => invocation.context();
         // The run's redaction (`src/redaction/`): this agent's `redact` joined
         // with any policy the caller handed down for this run (a tool's
         // `ctx.redact`). Opened for EVERY run — with no policy the serving is the
         // identity, but the stages' scopes still feed the real-value path the
         // crash checkpoint and the window's meter read.
-        const redaction = this.openRunRedaction(runOptions?.redact, getRunCtx);
-        // Reuse the cached chart built at constructor time.
-        // The Agent's executor dials: readTracking (#18/#14, snapshot stageReads),
-        // commitValues (#13c-B, commit-log value encoding) and writeProvenance
-        // (#P1, per-write read provenance — the exact-dataflow debugging dial).
-        const spec = this.getSpec();
-        // Every scope THIS executor makes is marked as the agent's own, so a stage
-        // can tell its own run from a mount in another runner's executor
-        // (`memberRun.ts`) — per scope, never by instance state.
-        const scopeFactory = redaction.scopeFactoryFor(spec);
-        const ownScopes = this.ownScopes;
-        const scopeRequests = this.scopeRequests;
-        const executor = new FlowChartExecutor(spec, {
-            readTracking: this.readTracking,
-            commitValues: this.commitValues,
-            writeProvenance: this.writeProvenance,
-            scopeFactory: (...args) => {
-                const scope = scopeFactory(...args);
-                if (scope !== null && typeof scope === 'object') {
-                    ownScopes.add(scope);
-                    // THIS executor's request, bound to the scope for its whole life.
-                    if (request !== undefined)
-                        scopeRequests.set(scope, request);
-                }
-                return scope;
-            },
-        });
-        redaction.applyTo(executor);
-        // Enable structured narrative so `getLastNarrativeEntries()` can
-        // hand a populated array to consumer Trace views (ExplainableShell).
-        // Cheap when no consumer reads it; the recorder accumulates only.
-        executor.enableNarrative();
-        this.lastExecutor = executor;
+        const redaction = this.prepareRunRedaction(invocation, runOptions?.redact);
+        const attachments = redaction.recorders.map((recorder) => ({ recorder }));
         const dispatcher = this.getDispatcher();
         // RFC-001 Block 10 — observer delivery tier. With 'deferred', every
         // bridge below is attached onto footprintjs's bounded capture queue
@@ -3304,35 +2989,11 @@ export class Agent extends RunnerBase {
             ? { delivery: 'deferred', ...this.observerDeliveryOptions }
             : undefined;
         const attachObserver = (rec) => {
-            if (deferredOpts)
-                executor.attachCombinedRecorder(rec, deferredOpts);
-            else
-                executor.attachCombinedRecorder(rec);
+            attachments.push({ recorder: rec, ...(deferredOpts && { options: deferredOpts }) });
         };
         attachObserver(new ContextRecorder({ dispatcher, getRunContext: getRunCtx, realWrites: redaction }));
-        // Evidence bridge (#5): harvest decisions/toolCalls/tokens for causal snapshots.
-        // ALWAYS INLINE — never routed through the deferred queue: the memory
-        // write stage consumes its accumulators MID-run (`collect()` via
-        // `evidenceSource`, mountMemoryPipeline). Deferred delivery would run
-        // `collect()` before the queue flushed the turn's tool/token/decision
-        // events, persisting an incomplete causal snapshot.
-        if (this.causalEvidence) {
-            // Its emits arrive on the real-value path (constructor); the executor
-            // feeds it the flow channel's decisions and the per-run reset only.
-            const evidence = this.causalEvidence;
-            executor.attachCombinedRecorder({
-                id: evidence.id,
-                onDecision: (event) => evidence.onDecision(event),
-                onSelected: (event) => evidence.onSelected(event),
-                clear: () => evidence.clear(),
-            });
-        }
-        // Compaction's instrument. ALWAYS INLINE, for the same reason the evidence
-        // bridge is: the compaction stage reads it MID-run, at the loop head, to
-        // decide whether this iteration's window is over budget. A measurement
-        // delivered one beat behind would be a measurement of the wrong window.
-        if (this.compactionMeterHandle) {
-            executor.attachCombinedRecorder(this.compactionMeterHandle);
+        // Computational observers belong to native component setup, always inline.
+        if (this.windowStrategy !== undefined) {
             // Folds speak the context vocabulary consumers already subscribe to
             // (`context.evicted` / `context.budget_pressure`) — no new event types.
             // ContextRecorder only dispatches those from writes INSIDE a slot
@@ -3489,17 +3150,30 @@ export class Agent extends RunnerBase {
             // `{ id, delivery: 'inline', ...hooks }` stays inline under an
             // observerDelivery: 'deferred' agent, and vice versa.
             if (r.delivery !== undefined)
-                executor.attachCombinedRecorder(r);
+                attachments.push({ recorder: r });
             else
                 attachObserver(r);
         }
-        // LAST, so the manifest describes a fully-wired run — and so it is the
-        // first event of this runId that any listener sees.
-        this.emitRunManifest();
-        // …then the declared skill map (9.50.0), so a recording opens with the
-        // arm's configuration and the author's topology before any stage event.
-        this.emitSkillGraphDeclared();
-        return executor;
+        return {
+            setup: {
+                redaction: redaction.recordPolicy,
+                narrative: {},
+                attachments,
+                onOrigin: () => {
+                    // Native is the only ID/clock authority. Remaining domain consumers
+                    // still migrate to captured component values; no private ID is minted.
+                    this.bindRunServing(invocation);
+                    this.emitRunManifest(invocation.context());
+                    this.emitSkillGraphDeclared(invocation.context());
+                },
+            },
+            binding: {
+                metadata,
+                bindScope: (scope, context) => {
+                    redaction.bindScope(scope, context);
+                },
+            },
+        };
     }
     /**
      * File the run-configuration manifest (9.41.0) — which adapters and
@@ -3527,8 +3201,8 @@ export class Agent extends RunnerBase {
      * with `'*'` before the run starts, so every recording carries one.
      */
     /** Fresh per-run ledger — see AgentOptions.integrityPosture (9.60.0). */
-    beginIntegrityLedger() {
-        this.integrityLedgerHolder.current = beginIntegrityRun({
+    beginIntegrityLedger(values) {
+        values.integrityLedger.current = beginIntegrityRun({
             wire: true,
             composeInvariant: this.mapsPlan !== undefined,
             dangling: this.integrityDanglingPresent,
@@ -3554,11 +3228,11 @@ export class Agent extends RunnerBase {
      * uncaught. Called on the SUCCESS path before the recording files, so the
      * failure is the run's result, never a masked afterthought.
      */
-    assertIntegrityAlive() {
+    assertIntegrityAlive(invocation) {
         if (this.integrityPosture !== 'dev')
             return;
-        this.integrityLedgerHolder.current?.assertAlive({
-            workExisted: this.integrityWorkExisted(),
+        invocation.value.integrityLedger.current?.assertAlive({
+            workExisted: this.integrityWorkExisted(invocation),
         });
     }
     /**
@@ -3573,8 +3247,8 @@ export class Agent extends RunnerBase {
      * circular: an unhooked check would report "no work existed" and silence
      * the very alarm it should be tripping.
      */
-    integrityWorkExisted() {
-        const state = this.liveSnapshot()?.sharedState;
+    integrityWorkExisted(invocation) {
+        const state = invocation.view.snapshot()?.sharedState;
         return state !== undefined && state.llmLatestContent !== undefined;
     }
     /**
@@ -3583,9 +3257,9 @@ export class Agent extends RunnerBase {
      * before the recording stops. Listener-gated like every typed event, and
      * deliberately throw-proof: accounting must never change a run's outcome.
      */
-    fileIntegrityDisposition() {
-        const ledger = this.integrityLedgerHolder.current;
-        this.integrityLedgerHolder.current = undefined;
+    fileIntegrityDisposition(invocation) {
+        const ledger = invocation.value.integrityLedger.current;
+        invocation.value.integrityLedger.current = undefined;
         if (ledger === undefined)
             return;
         try {
@@ -3597,17 +3271,17 @@ export class Agent extends RunnerBase {
                 type,
                 payload: {
                     posture: this.integrityPosture,
-                    workExisted: this.integrityWorkExisted(),
+                    workExisted: this.integrityWorkExisted(invocation),
                     rows: ledger.report(),
                 },
-                meta: buildEventMeta({ runtimeStageId: INTEGRITY_DISPOSITION_STAGE_ID }, this.currentRunContext),
+                meta: buildEventMeta({ runtimeStageId: INTEGRITY_DISPOSITION_STAGE_ID }, invocation.context()),
             });
         }
         catch {
             // Recorder/dispatcher failures never abort a run — the house rule.
         }
     }
-    emitRunManifest() {
+    emitRunManifest(context) {
         const type = 'agentfootprint.agent.run_configured';
         const dispatcher = this.getDispatcher();
         if (!dispatcher.hasListenersFor(type))
@@ -3658,7 +3332,7 @@ export class Agent extends RunnerBase {
                     },
                 }),
             }),
-            meta: buildEventMeta({ runtimeStageId: RUN_MANIFEST_STAGE_ID }, this.currentRunContext),
+            meta: buildEventMeta({ runtimeStageId: RUN_MANIFEST_STAGE_ID }, context),
         });
     }
     /**
@@ -3677,7 +3351,7 @@ export class Agent extends RunnerBase {
      * No graph, or a graph that could not state its map ⇒ no event — absent,
      * never guessed.
      */
-    emitSkillGraphDeclared() {
+    emitSkillGraphDeclared(context) {
         if (this.skillGraphDeclared === undefined)
             return;
         const type = 'agentfootprint.skill.graph_declared';
@@ -3687,7 +3361,7 @@ export class Agent extends RunnerBase {
         dispatcher.dispatch({
             type,
             payload: this.skillGraphDeclared,
-            meta: buildEventMeta({ runtimeStageId: GRAPH_DECLARED_STAGE_ID }, this.currentRunContext),
+            meta: buildEventMeta({ runtimeStageId: GRAPH_DECLARED_STAGE_ID }, context),
         });
     }
     /**
@@ -3711,9 +3385,10 @@ export class Agent extends RunnerBase {
      * ```
      */
     drainObservers(opts) {
-        if (!this.lastExecutor)
+        const view = this.runExecution().view();
+        if (view === undefined)
             return Promise.resolve({ done: 0, failed: 0, pending: 0 });
-        return this.lastExecutor.drainObservers(opts);
+        return view.drainObservers(opts);
     }
     /**
      * Did the last turn stop because a LIMIT cut it short — and if so, which?
@@ -3959,15 +3634,16 @@ export class Agent extends RunnerBase {
      * ```
      */
     async assessment(declarations) {
-        const snapshot = this.liveSnapshot();
+        const selected = this.runExecution().selected();
+        const snapshot = selected?.view.snapshot();
         if (snapshot === undefined)
             return undefined;
         // Settled before the fold, which cannot tell a crash from its committed state: an answer
         // this run RETURNED (`lastRunAnswer`, cleared at every run's start), or a pause — the fold
         // reads that one from the committed state itself. Read BEFORE the import resolves, so a
         // run started meanwhile cannot change which run is assessed.
-        const paused = this.lastExecutor?.isPaused() === true;
-        if (!paused && this.lastRunAnswer === undefined)
+        const paused = selected?.view.isPaused() === true;
+        if (!paused && selected?.value.answer === undefined)
             return undefined;
         // Loaded on first use, off the default graph (the findings/peel.ts precedent).
         // The live state, read as values — never as a served record (`assess.ts` · `assessLive`).
@@ -4102,11 +3778,13 @@ export class Agent extends RunnerBase {
         }
         return undefined;
     }
-    finalizeResult(executor, result) {
-        const paused = this.detectPause(executor, result);
+    finalizeResult(invocation, result) {
+        const paused = this.detectPause(invocation, result);
         if (paused)
             return paused;
-        const snap = executor.getSnapshot();
+        const snap = invocation.view.snapshot();
+        if (snap === undefined)
+            throw new TypeError('The native execution has no ready snapshot');
         const state = snap.sharedState;
         const refusal = this.refusalVerdictOf(state);
         if (refusal !== undefined) {
@@ -4122,7 +3800,7 @@ export class Agent extends RunnerBase {
                         stage: '__output_admission__',
                         scope: 'run',
                     },
-                    meta: buildEventMeta({ runtimeStageId: '__output_admission__' }, this.currentRunContext),
+                    meta: buildEventMeta({ runtimeStageId: '__output_admission__' }, invocation.context()),
                 });
             }
             // The verdict was decoded from the LIVE state above; the snapshot a
@@ -4143,10 +3821,10 @@ export class Agent extends RunnerBase {
         // `'pause'` this is unreachable for the first block (the run pauses and
         // `detectPause` returned above); it still fires if a RESUME found consent
         // ungranted and the model then finished the turn on its own.
-        if (this.consentOutstanding.size > 0) {
-            const [record] = [...this.consentOutstanding.values()];
+        if (invocation.value.consentOutstanding.size > 0) {
+            const [record] = [...invocation.value.consentOutstanding.values()];
             if (record) {
-                this.consentOutstanding.clear();
+                invocation.value.consentOutstanding.clear();
                 throw new CredentialConsentRequiredError(record);
             }
         }
@@ -4227,163 +3905,177 @@ export class Agent extends RunnerBase {
         // keep them. Negative-claim observations also persist independently of those
         // layers. Still value-conditional inside seed (only when rows exist).
         let ledgerRestoreArmed = this.findingsOptions !== undefined || this.negativeClaimsConfig !== undefined;
-        const consumeResumeLedger = () => {
-            const l = this.pendingResumeFindingsLedger;
-            this.pendingResumeFindingsLedger = undefined;
-            return l;
-        };
-        const seed = buildSeedStage({
-            maxIterations,
-            // The forced-output tool's name (9.88.0) — a build-time constant, put on
-            // the record once so a rebuild can name it without reading a receipt.
-            ...(this.outputEnforcement?.schemaTool !== undefined && {
-                forcedOutputToolName: this.outputEnforcement.schemaTool.name,
-            }),
-            cachingDisabled,
-            ...(costBudget !== undefined && { costBudgetOnExceed: costBudget.onExceed }),
-            get toolSchemas() {
-                return toolSchemasResolved;
-            },
-            get toolWantsByName() {
-                return seededToolWants;
-            },
-            get ruledTools() {
-                return seededRuledTools;
-            },
-            get honestyLayers() {
-                return seededHonestyLayers;
-            },
-            // The time layer's clock: the draft `run()` read (refusing a run with no
-            // zone), stamped by seed as the turn's one `clock` row. Absent → the
-            // deps object seed always had.
-            // The caller's clock belongs to the agent's OWN run: a member (another
-            // runner's executor) gets the builder's fallback, never a concurrent
-            // direct caller's `time` (`memberRun.ts`).
-            ...(this.timeOptions !== undefined && {
-                timeClock: (scope) => this.ownScopes.has(scope)
-                    ? this.seedClockDraft()
-                    : draftClock(undefined, this.timeOptions ?? {}),
-            }),
-            // The time layer's reader: seed reads the person's words once per turn,
-            // after the clock. Absent → nothing is read.
-            ...(this.timeOptions?.reader !== undefined &&
-                this.timeOptions.policy !== undefined && {
-                timeReader: { reader: this.timeOptions.reader, policy: this.timeOptions.policy },
-            }),
-            // Declared sources (honesty layer 2): the seed twin plants `_findings.from`
-            // on ruled tools, and the run's `messageFrom` constant is written — only
-            // under the arm (refused at build without the inputs layer).
-            ...(this.argumentSourcesArmed === true && { argumentSources: true }),
-            // The answer check's tool-call ledger — value-conditional, so an agent
-            // without answer validation or negative claims keeps its prior shape.
-            ...((this.answerValidationConfig !== undefined ||
-                this.negativeClaimsConfig !== undefined) && { toolCallLedger: true }),
-            ...(this.negativeClaimsConfig !== undefined && { negativeClaimsArmed: true }),
-            get consumePendingResumeFindingsLedger() {
-                return ledgerRestoreArmed ? consumeResumeLedger : undefined;
-            },
-            consumePendingResumeHistory: () => {
-                const h = this.pendingResumeHistory;
-                this.pendingResumeHistory = undefined;
-                return h;
-            },
-            ...(this.evidenceGate !== undefined &&
-                this.evidenceGate.posture !== 'assist' && {
-                consumePendingEvidenceRecovery: () => {
-                    const recovery = this.pendingEvidenceRecovery;
-                    this.pendingEvidenceRecovery = undefined;
-                    return recovery;
+        const seedFor = (run) => {
+            const consumeResumeLedger = () => {
+                const l = run.value.pendingResumeFindingsLedger;
+                run.value.pendingResumeFindingsLedger = undefined;
+                return l;
+            };
+            return buildSeedStage({
+                maxIterations,
+                // The forced-output tool's name (9.88.0) — a build-time constant, put on
+                // the record once so a rebuild can name it without reading a receipt.
+                ...(this.outputEnforcement?.schemaTool !== undefined && {
+                    forcedOutputToolName: this.outputEnforcement.schemaTool.name,
+                }),
+                cachingDisabled,
+                ...(costBudget !== undefined && { costBudgetOnExceed: costBudget.onExceed }),
+                get toolSchemas() {
+                    return toolSchemasResolved;
                 },
-            }),
-            consumePendingResumeFolded: () => {
-                const f = this.pendingResumeFolded;
-                this.pendingResumeFolded = undefined;
-                return f;
-            },
-            // The findings ledger (9.101.0): the arm, the serve mode it puts on the
-            // record (the `forcedOutputToolName` precedent — a build-time constant
-            // the rebuild reads instead of the receipt), and the continued
-            // conversation's rows, all under the one gate — an unarmed agent hands
-            // seed exactly the deps object it always did.
-            ...(this.findingsOptions !== undefined && {
-                findings: true,
-                findingsServe: this.findingsOptions.serve ?? 'ledger-and-facts',
-                findingsContextBytes: this.findingsOptions.maxContextBytes,
-                // The answer-turn ask (9.103.0): VALUE-conditional inside the arm —
-                // the default `'none'` threads nothing and writes no key.
-                ...(this.findingsOptions.answerAsk === 'quote-facts' && {
-                    findingsAnswerAsk: 'quote-facts',
+                get toolWantsByName() {
+                    return seededToolWants;
+                },
+                get ruledTools() {
+                    return seededRuledTools;
+                },
+                get honestyLayers() {
+                    return seededHonestyLayers;
+                },
+                // The time layer's clock: the draft `run()` read (refusing a run with no
+                // zone), stamped by seed as the turn's one `clock` row. Absent → the
+                // deps object seed always had.
+                // The caller's clock belongs to the agent's OWN run: a member (another
+                // runner's executor) gets the builder's fallback, never a concurrent
+                // direct caller's `time` (`memberRun.ts`).
+                ...(this.timeOptions !== undefined && {
+                    timeClock: () => run.own
+                        ? this.seedClockDraft(run.value)
+                        : draftClock(undefined, this.timeOptions ?? {}),
                 }),
-            }),
-            // The declared ontology (9.106.0): the whole frozen map, which seed
-            // writes ONCE as the run constant `ontology` — the `findingsServe`
-            // precedent, a build-time fact the rebuild reads from the RECORD. An
-            // unarmed agent hands seed exactly the deps object it always did.
-            ...(this.ontology !== undefined && {
-                ontology: this.ontology,
-                ontologyTools: () => this.ontologyTools,
-            }),
-            // The conversation's inherited skill cursor (SG-C). Consumed (cleared)
-            // on every run; HONORED only when the mounted graph declared
-            // `continuity: 'conversation'` — the same one-option-one-behavior gate
-            // the write side (`checkpoint()`) applies.
-            consumePendingResumeSkillCursor: () => {
-                const c = this.pendingResumeSkillCursor;
-                this.pendingResumeSkillCursor = undefined;
-                return c;
-            },
-            restoreSkillCursor: this.skillGraphCascade?.continuity === 'conversation',
-            // Steps (9.18.0): gate the per-run stepPointer/stepNudgeSpent reset on
-            // the feature, so every other agent seeds exactly the keys it always did.
-            ...(stepPlanFor !== undefined && { hasSteps: true }),
-            // Escalation (9.19.0): same gate discipline — the per-run counter/flip
-            // reset exists only when the policy does (de-escalation IS the seed).
-            ...(this.skillBrains?.escalation !== undefined && { hasEscalation: true }),
-            // The evidence gate's one bounded revision (9.35.0) — a per-turn budget,
-            // reset here. Only a posture that can revise writes the key.
-            ...((this.typedNegativeClaimsConfig !== undefined ||
-                (this.evidenceGate !== undefined && this.evidenceGate.posture !== 'assist')) && {
-                hasEvidenceRevision: true,
-            }),
-            // Under an enforcing answer validation the tools stay off for a run
-            // resumed after its revision was asked (`toolsOffAfterRevision`).
-            ...(this.revisionWithholdsTools() && { toolsOffAfterRevision: true }),
-            getCurrentRunId: () => this.currentRunContext?.runId,
-            // WHO this run is for, when the caller named nobody (9.10.0). Seed uses
-            // it for exactly one rung of the identity ladder — see `seedFrom` — and
-            // an explicit identity outranks it there. Read through an accessor for
-            // the same reason the runId is: the chart is built once, and this
-            // changes every run.
-            getCurrentSessionId: () => this.currentRunContext?.sessionId,
-            // Whether this stage runs in THIS agent's own executor, or inside another
-            // runner's (a composition, a chart a caller built) — where the accessors
-            // above describe some other run (`memberRun.ts`). Asked per scope.
-            isOwnRun: (scope) => this.ownScopes.has(scope),
-            // WHICH TURN THIS IS (9.6.0). Only memories that WRITE the conversation
-            // are consulted: they are the ones whose entry ids are turn-stamped, and
-            // a corpus (`.rag(...)`, which reads under its own namespace) has no
-            // turns at all. Empty list → seed stays synchronous and makes no store
-            // call, so an agent without memory is unchanged.
-            ...(conversationStores.length > 0 && { conversationStores }),
-            // The `'input'` half of the message chain, run BEFORE `userMessage` and
-            // `history` are committed — see SeedStageDeps.messageMiddleware.
-            ...(this.messageMiddleware.length > 0 && { messageMiddleware: this.messageMiddleware }),
-            // `.configure()` — seed is where run-level facts are decided and
-            // committed, so the resolver rides that commit. The closure supplies
-            // the build-time defaults so a resolver can decide RELATIVE to them
-            // ("upgrade the model when the message is long") instead of having to
-            // restate them.
-            ...(this.runConfigFn && {
-                resolveRunConfig: (input) => {
-                    const ctx = {
-                        message: input.message,
-                        ...(input.identity !== undefined && { identity: input.identity }),
-                        runId: this.currentRunContext?.runId ?? 'unknown',
-                        defaults: { model, instructions: systemPromptValue },
-                    };
-                    return this.runConfigFn?.(ctx);
+                // The time layer's reader: seed reads the person's words once per turn,
+                // after the clock. Absent → nothing is read.
+                ...(this.timeOptions?.reader !== undefined &&
+                    this.timeOptions.policy !== undefined && {
+                    timeReader: { reader: this.timeOptions.reader, policy: this.timeOptions.policy },
+                }),
+                // Declared sources (honesty layer 2): the seed twin plants `_findings.from`
+                // on ruled tools, and the run's `messageFrom` constant is written — only
+                // under the arm (refused at build without the inputs layer).
+                ...(this.argumentSourcesArmed === true && { argumentSources: true }),
+                // The answer check's tool-call ledger — value-conditional, so an agent
+                // without answer validation or negative claims keeps its prior shape.
+                ...((this.answerValidationConfig !== undefined ||
+                    this.negativeClaimsConfig !== undefined) && { toolCallLedger: true }),
+                ...(this.negativeClaimsConfig !== undefined && { negativeClaimsArmed: true }),
+                get consumePendingResumeFindingsLedger() {
+                    return ledgerRestoreArmed ? consumeResumeLedger : undefined;
                 },
-            }),
+                consumePendingResumeHistory: () => {
+                    const h = run.value.pendingResumeHistory;
+                    run.value.pendingResumeHistory = undefined;
+                    return h;
+                },
+                ...(this.evidenceGate !== undefined &&
+                    this.evidenceGate.posture !== 'assist' && {
+                    consumePendingEvidenceRecovery: () => {
+                        const recovery = run.value.pendingEvidenceRecovery;
+                        run.value.pendingEvidenceRecovery = undefined;
+                        return recovery;
+                    },
+                }),
+                consumePendingResumeFolded: () => {
+                    const f = run.value.pendingResumeFolded;
+                    run.value.pendingResumeFolded = undefined;
+                    return f;
+                },
+                // The findings ledger (9.101.0): the arm, the serve mode it puts on the
+                // record (the `forcedOutputToolName` precedent — a build-time constant
+                // the rebuild reads instead of the receipt), and the continued
+                // conversation's rows, all under the one gate — an unarmed agent hands
+                // seed exactly the deps object it always did.
+                ...(this.findingsOptions !== undefined && {
+                    findings: true,
+                    findingsServe: this.findingsOptions.serve ?? 'ledger-and-facts',
+                    findingsContextBytes: this.findingsOptions.maxContextBytes,
+                    // The answer-turn ask (9.103.0): VALUE-conditional inside the arm —
+                    // the default `'none'` threads nothing and writes no key.
+                    ...(this.findingsOptions.answerAsk === 'quote-facts' && {
+                        findingsAnswerAsk: 'quote-facts',
+                    }),
+                }),
+                // The declared ontology (9.106.0): the whole frozen map, which seed
+                // writes ONCE as the run constant `ontology` — the `findingsServe`
+                // precedent, a build-time fact the rebuild reads from the RECORD. An
+                // unarmed agent hands seed exactly the deps object it always did.
+                ...(this.ontology !== undefined && {
+                    ontology: this.ontology,
+                    ontologyTools: () => this.ontologyTools,
+                }),
+                // The conversation's inherited skill cursor (SG-C). Consumed (cleared)
+                // on every run; HONORED only when the mounted graph declared
+                // `continuity: 'conversation'` — the same one-option-one-behavior gate
+                // the write side (`checkpoint()`) applies.
+                consumePendingResumeSkillCursor: () => {
+                    const c = run.value.pendingResumeSkillCursor;
+                    run.value.pendingResumeSkillCursor = undefined;
+                    return c;
+                },
+                restoreSkillCursor: this.skillGraphCascade?.continuity === 'conversation',
+                // Steps (9.18.0): gate the per-run stepPointer/stepNudgeSpent reset on
+                // the feature, so every other agent seeds exactly the keys it always did.
+                ...(stepPlanFor !== undefined && { hasSteps: true }),
+                // Escalation (9.19.0): same gate discipline — the per-run counter/flip
+                // reset exists only when the policy does (de-escalation IS the seed).
+                ...(this.skillBrains?.escalation !== undefined && { hasEscalation: true }),
+                // The evidence gate's one bounded revision (9.35.0) — a per-turn budget,
+                // reset here. Only a posture that can revise writes the key.
+                ...((this.typedNegativeClaimsConfig !== undefined ||
+                    (this.evidenceGate !== undefined && this.evidenceGate.posture !== 'assist')) && {
+                    hasEvidenceRevision: true,
+                }),
+                // Under an enforcing answer validation the tools stay off for a run
+                // resumed after its revision was asked (`toolsOffAfterRevision`).
+                ...(this.revisionWithholdsTools() && { toolsOffAfterRevision: true }),
+                getCurrentRunId: () => run.context.runId,
+                // WHO this run is for, when the caller named nobody (9.10.0). Seed uses
+                // it for exactly one rung of the identity ladder — see `seedFrom` — and
+                // an explicit identity outranks it there. Read through an accessor for
+                // the same reason the runId is: the chart is built once, and this
+                // changes every run.
+                getCurrentSessionId: () => run.context.sessionId,
+                // Whether this stage runs in THIS agent's own executor, or inside another
+                // runner's (a composition, a chart a caller built) — where the accessors
+                // above describe some other run (`memberRun.ts`). Asked per scope.
+                isOwnRun: () => run.own,
+                // WHICH TURN THIS IS (9.6.0). Only memories that WRITE the conversation
+                // are consulted: they are the ones whose entry ids are turn-stamped, and
+                // a corpus (`.rag(...)`, which reads under its own namespace) has no
+                // turns at all. Empty list → seed stays synchronous and makes no store
+                // call, so an agent without memory is unchanged.
+                ...(conversationStores.length > 0 && { conversationStores }),
+                // The `'input'` half of the message chain, run BEFORE `userMessage` and
+                // `history` are committed — see SeedStageDeps.messageMiddleware.
+                ...(this.messageMiddleware.length > 0 && { messageMiddleware: this.messageMiddleware }),
+                // `.configure()` — seed is where run-level facts are decided and
+                // committed, so the resolver rides that commit. The closure supplies
+                // the build-time defaults so a resolver can decide RELATIVE to them
+                // ("upgrade the model when the message is long") instead of having to
+                // restate them.
+                ...(this.runConfigFn && {
+                    resolveRunConfig: (input) => {
+                        const ctx = {
+                            message: input.message,
+                            ...(input.identity !== undefined && { identity: input.identity }),
+                            runId: run.context.runId ?? 'unknown',
+                            defaults: { model, instructions: systemPromptValue },
+                        };
+                        return this.runConfigFn?.(ctx);
+                    },
+                }),
+            });
+        };
+        const seed = bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (scope) => {
+            run.value.resources?.seed(scope);
+            // Mounted runs have no Agent.run() admission. Seed's actual input is
+            // their original message; never read another run's selected values.
+            run.value.checkpointTracker ??= {
+                runId: run.context.runId,
+                originalInput: { message: scope.$getArgs().message },
+                history: [],
+                lastCompletedIteration: 0,
+            };
+            return (run.value.seed ??= seedFor(run))(scope);
         });
         // Tool registry composition extracted to ./agent/buildToolRegistry.ts.
         // Composes static .tool() registry + auto-attached read_skill (+ the
@@ -4399,6 +4091,8 @@ export class Agent extends RunnerBase {
             // plants `_findings.from` on it and its sentences name that argument.
             ...(this.argumentSourcesArmed === true && { argumentSources: true }),
         });
+        if ([...registryByName.values()].some(carriesArgumentView))
+            declarePrivateFields(this);
         // The declared ontology's tool edges (9.106.0): every name a node's `via`
         // names must be a tool this registry can dispatch — the static registry,
         // the framework's doors and every skill's tools, `registryByName` being
@@ -4646,44 +4340,22 @@ export class Agent extends RunnerBase {
         const messagesSubflow = buildMessagesSlot({
             ...(budget?.messages !== undefined && { budgetCap: budget.messages }),
         });
-        // Cache shared between buildToolsSlot (writer, each iteration) and
-        // buildToolCallsHandler (reader, same iteration). Holds the resolved
-        // Tool[] from `provider.list(ctx)` so dispatch doesn't re-invoke `list()`
-        // — vital for async network providers.
-        //
-        // LIFETIME, stated correctly (9.92.0): the chart is built ONCE, at
-        // construction (`initChart`), and reused by every `run()` and `resume()`
-        // of this Agent — so this cache and the record below outlive a run. They
-        // are safe because one Agent runs one turn at a time and the slot
-        // overwrites them every iteration before dispatch reads them. What that
-        // does NOT cover is a resume in a FRESH instance, whose closure is empty
-        // and whose Compose never re-runs before the resumed dispatch — which is
-        // why the pause paths carry `pausedToolParty` on the checkpoint.
-        const providerToolCache = { current: [] };
-        // Who put each name on the wire (9.92.0) — the same closure-shared shape,
-        // written by the tools slot's merge and read by dispatch so the party
-        // whose contract the model read is the party that answers. `lastServed`
-        // is the run's memory of the same fact, for a name that left the wire.
-        const servedTools = { current: new Map(), lastServed: new Map() };
-        // THE ONE DISPATCH RESOLVER, for the inputs layer (honesty layer 2): built
-        // from the SAME deps objects the dispatch handler builds its own from, so
-        // the layer reads a call's rules off the implementation that will answer.
-        const resolveForLayer = buildToolResolver({
+        // Every reader binds the same native component's private catalog.
+        const resolverForValues = (values) => buildToolResolver({
             registryByName,
             ...(this.externalToolProvider && { externalToolProvider: this.externalToolProvider }),
-            ...(this.externalToolProvider && { providerToolCache }),
-            servedTools,
+            ...(this.externalToolProvider && { providerToolCache: values.providerToolCache }),
+            servedTools: values.servedTools,
             toolClaimants,
             notServed: notServedResult,
         });
-        // A tool's `displayName` — the app's words for a call, read by a person — read
-        // through the same resolver, so a ToolProvider's tool is read as well, and through
-        // the one rule (`lib/displayName.ts` · `readDisplayName`), so a value nobody vetted
-        // is never printed. Wired only where a tool can declare one: on every other agent
-        // the final branch is the one it always was.
-        const displayNameOf = this.externalToolProvider !== undefined ||
+        const resolveForLayer = (scope) => resolverForValues(this.runExecution().forScope(scope).value);
+        const displayNameOfFor = this.externalToolProvider !== undefined ||
             [...registryByName.values()].some((tool) => tool.displayName !== undefined)
-            ? (toolName) => readDisplayName(resolveForLayer(toolName).tool?.displayName)
+            ? (scope) => {
+                const resolve = resolveForLayer(scope);
+                return (toolName) => readDisplayName(resolve(toolName).tool?.displayName);
+            }
             : undefined;
         const readSkillFor = this.readSkillOfferFor();
         // Per-role skill visibility. The Injection Engine resolves the ids once per
@@ -4692,9 +4364,9 @@ export class Agent extends RunnerBase {
         // mount. Since 9.86.0 the description is NOT the only reader — the read_skill gate's refusals, the
         // `skill.rejected` payload, the propose-transition refusal and the dispatch
         // roster all filter through that published set
-        // (`stages/toolCalls.ts` · "── Skill-graph read_skill GATE" the gate, `toolCalls.ts` ·
+        // (`stages/toolCalls/routing/readSkillRoute.ts` · `applyReadSkillRoute` the gate, `toolCalls/routing/effectsOperations.ts` ·
         // "── THE REFUSAL SPEAKS WITH THE FILTERED SETS" the propose-transition refusal,
-        // `toolCalls.ts` · `dispatchRoster`). Nothing is cached here: an
+        // `toolCalls/execution/catalogOperations.ts` · `dispatchRoster`). Nothing is cached here: an
         // earlier draft of 9.84.0 cached the resolved ids so the gate could filter
         // the self-call notice's move offer through them; the notice no longer names
         // a destination at all (see `selfCallNotice`), so there is nothing left to
@@ -4762,17 +4434,20 @@ export class Agent extends RunnerBase {
             ...(this.mapsPlan !== undefined && {
                 mountedMaps: this.mapsPlan.maps.map((m) => ({ id: m.id, toolNames: m.toolNames })),
             }),
-            integrityLedger: this.integrityLedgerHolder,
+            runtime: (scope) => {
+                const value = this.runExecution().forScope(scope).value;
+                return { ...value, integrityLedger: value.integrityLedger };
+            },
             ...(this.externalToolProvider && { toolProvider: this.externalToolProvider }),
-            ...(this.externalToolProvider && { providerToolCache }),
             // The caller of THIS run, for `ToolDispatchContext.callerIdentity`: the
             // instance's caller on its own run, the member's run on a mount — never a
             // derived identity (the `hiddenSkillIdsNow` precedent).
             ...(this.externalToolProvider && {
-                callerIdentity: (scope) => this.ownScopes.has(scope) ? this.lastRunIdentity : memberIdentityIn(scope),
+                callerIdentity: (scope) => this.runExecution().forScope(scope).own
+                    ? this.runExecution().forScope(scope).value.identity
+                    : memberIdentityIn(scope),
             }),
             toolClaimants,
-            servedTools,
             ...(readSkillFor && { readSkillFor }),
             ...(budget?.tools !== undefined && { budgetCap: budget.tools }),
             // Steps (9.18.0): per-step narrowing + banner + the skip_step offer.
@@ -4815,11 +4490,11 @@ export class Agent extends RunnerBase {
         });
         // callLLM extracted to ./agent/stages/callLLM.ts (v2.11.2). Same
         // late-binding pattern as seed for toolSchemas (computed below).
-        const callLLM = buildCallLLMStage({
+        const callLLMFor = (run) => buildCallLLMStage({
             onReplayPrepared: (preparation) => {
-                if (this.checkpointTracker !== undefined &&
-                    this.inFlightRunId === this.checkpointTracker.runId)
-                    retainReplayRetirements(this.checkpointTracker, preparation);
+                if (run.value.checkpointTracker !== undefined &&
+                    run.context.runId === run.value.checkpointTracker.runId)
+                    retainReplayRetirements(run.value.checkpointTracker, preparation);
             },
             ...((this.typedNegativeClaimsConfig !== undefined ||
                 (this.evidenceGate !== undefined && this.evidenceGate.posture !== 'assist')) && {
@@ -4865,17 +4540,19 @@ export class Agent extends RunnerBase {
             // layer). Step T8: the same line carries the turn's time limits.
             ...(this.timeOptions !== undefined && { timeLine: true }),
             // The receipt's salt (9.88.0) — read per call, like seed's own accessor.
-            getRunId: () => this.currentRunContext?.runId,
+            getRunId: () => run.context.runId,
             // …and its off switch. Value-conditional, so an agent on the default
             // hands `callLLM` exactly the dep bag it always did.
             ...(this.recordReceiptValue === false && { recordReceipt: false }),
             // …and the window's evictions for `omittedForAttention` (9.93.0) — only
             // an agent with a window strategy has any, and only it hands the seam.
-            ...(this.evictedTurnsHandle !== undefined && { evictedTurns: this.evictedTurnsHandle }),
+            ...(run.value.evictedTurnsHandle !== undefined && {
+                evictedTurns: run.value.evictedTurnsHandle,
+            }),
             // …and the receipt memo, so a run hashes each message once rather than
             // once per call (`core/agent/receipt/receiptDigests.ts`). Only where a
             // receipt is minted at all.
-            ...(this.recordReceiptValue !== false && { receiptDigests: this.receiptDigests }),
+            ...(this.recordReceiptValue !== false && { receiptDigests: run.value.receiptDigests }),
             provider,
             model,
             ...(temperature !== undefined && { temperature }),
@@ -4908,7 +4585,7 @@ export class Agent extends RunnerBase {
             // was called this response" not-applicable notes.
             ...(this.checkColumnTypes !== 'off' &&
                 toolColumns.size > 0 && { columnDeclaringTools: new Set(toolColumns.keys()) }),
-            integrityLedger: this.integrityLedgerHolder,
+            integrityLedger: run.value.integrityLedger,
             ...(this.reliabilityConfig !== undefined && { reliability: this.reliabilityConfig }),
             ...(this.outputSchemaParser !== undefined && {
                 outputSchemaParser: this.outputSchemaParser,
@@ -4955,18 +4632,20 @@ export class Agent extends RunnerBase {
         // it becomes the ReAct loop target (see the chart builders), so it runs
         // once per iteration boundary with the previous call's adapter-reported
         // usage already measured by the meter.
-        const windowStage = this.windowStrategy && this.compactionMeterHandle
+        const callLLM = bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (run.value.callLLM ??= callLLMFor(run)));
+        const configuredWindow = this.windowStrategy;
+        const windowStage = configuredWindow
             ? {
                 strategyName: this.windowStrategy.name,
-                run: buildWindowStage({
-                    strategy: this.windowStrategy,
-                    meter: this.compactionMeterHandle,
-                    ...(this.evictedTurnsHandle !== undefined && {
-                        evictedTurns: this.evictedTurnsHandle,
+                run: bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (run.value.window ??= buildWindowStage({
+                    strategy: configuredWindow,
+                    meter: run.value.compactionMeter,
+                    ...(run.value.evictedTurnsHandle !== undefined && {
+                        evictedTurns: run.value.evictedTurnsHandle,
                     }),
                     agentModel: model,
                     providerName: provider.name,
-                    getRunId: () => this.currentRunContext?.runId,
+                    getRunId: () => run.context.runId,
                     // Value-conditional (the `repeatedCallNudge` precedent): an
                     // agent on the default hands the stage exactly the deps object
                     // it always did.
@@ -4985,7 +4664,7 @@ export class Agent extends RunnerBase {
                     }),
                     ...(pricingTable !== undefined && { pricingTable }),
                     ...(costBudget !== undefined && { costBudget }),
-                }),
+                }))),
             }
             : undefined;
         // routeDecider extracted to ./agent/stages/route.ts (v2.11.2).
@@ -5016,82 +4695,87 @@ export class Agent extends RunnerBase {
         // question a build-time mount can answer.
         const canCallTools = registryByName.size > 0 || this.externalToolProvider !== undefined;
         const hasWrapUp = canCallTools && this.wrapUpAtMaxIterations !== false;
-        const baseRouteDecider = buildRouteDeciderStage(this.messageMiddleware, this.outputEnforcement, stepPlanFor, this.evidenceGate, hasWrapUp, this.claimContract, this.integrityLedgerHolder, 
-        // THE CLAIM SEAM'S RECENCY READ (9.83.0). Value-conditional on both
-        // halves, so an agent that armed neither hands the decider builder
-        // exactly the arguments it always did — and `buildRouteDeciderStage`'s
-        // no-judge fast path still returns the very function reference every
-        // pre-9.83.0 chart was given.
-        this.noticePriorTurnEvidence && this.evidenceGate !== undefined ? true : undefined, 
-        // THE ANSWER TURN'S STANDINGS (9.101.0) — the same value-conditional
-        // trailing positional, for the same reason: an unarmed agent hands the
-        // builder exactly the arguments it always did.
-        this.findingsOptions !== undefined ? true : undefined, 
-        // THE INPUTS LAYER (honesty layer 2) — the same value-conditional
-        // trailing positional: the rows this decider files carry the turn
-        // stamp, and with the evidence gate armed too, the gate's exempt corpus
-        // gains this turn's assumed values, read from the tools' declarations,
-        // and the values the person gave the layer's batch ask (step 4). The
-        // results layer (step 7b) arms the stamp alone — "while any layer is
-        // armed, the one writer stamps the turn" — and nothing else.
-        inputsArmed || resultsArmed
-            ? {
-                ...(inputsArmed &&
-                    this.evidenceGate !== undefined && {
-                    declaredDefaults: declaredDefaultsFrom((toolName, argument) => {
-                        const rules = rulesOf(resolveForLayer(toolName).tool);
-                        if (rules === undefined || isRefused(rules))
-                            return undefined;
-                        return rules.ruled.find((r) => r.argument === argument)?.assume;
-                    }),
-                    answeredValues: answeredValuesOf,
-                    // Under `.time()` (step T7): the turn's time spellings by
-                    // lineage — said ones exempt, derived ones filed, not flagged.
-                    ...(this.timeOptions !== undefined && { timeLineage: true }),
-                }),
-            }
-            : undefined, 
-        // THE ANSWER LAYER (honesty layer 4) — the same value-conditional
-        // trailing positional: the judges file the answer's witness rows, and
-        // every row this decider files carries the turn stamp.
-        answerArmed ? true : undefined);
-        const validatedRouteDecider = this.answerValidationConfig === undefined
-            ? baseRouteDecider
-            : withAnswerValidation(baseRouteDecider, this.answerValidationConfig, this.outputSchemaParser, artifactStore, () => this.consentOutstanding.size > 0, this.outputEnforcement?.outputFormat !== undefined, 
-            // Read only when `agentChecks` lists 'claims' (the agent's own rows).
-            this.claimContract, this.typedNegativeClaimsConfig === undefined
-                ? undefined
-                : {
-                    config: this.typedNegativeClaimsConfig,
-                    phrases: this.typedNegativeClaimsConfig.phrases,
-                    applicationValidation: this.applicationAnswerValidation,
-                    runId: () => this.currentRunContext.runId,
-                });
-        const routeDecider = this.negativeClaimsConfig?.mode === 'prose'
-            ? withNegativeProse(validatedRouteDecider, {
-                runId: () => this.currentRunContext.runId,
-                hasOutstandingConsent: () => this.consentOutstanding.size > 0,
-                structured: this.outputSchemaParser !== undefined,
-                phrases: this.negativeClaimsConfig.phrases,
-            })
-            : validatedRouteDecider;
-        // `.limitsTravelWithTheAnswer()` on a TYPED answer — decided once, here.
-        // An output schema makes the answer JSON, and the appended block would
-        // make it JSON followed by prose, which `runTyped()` cannot parse. So the
-        // limits travel as DATA: the Route decider's terminal decision commits the
-        // fold (`withAnswerCoverage`) and the Final branch projects it onto
-        // `turn_end`. A prose answer keeps the block; an agent that asked for
-        // neither is handed the decider it always had.
         const limitsAsData = this.limitsTravelWithTheAnswerValue && this.outputSchemaParser !== undefined;
-        // With the inputs layer armed, the typed answer's limits carry this
-        // turn's assumed values too — the same rows the prose "Assumed" block
-        // prints (`withAnswerCoverage`'s second argument); a rewrite by a
-        // before-tool chain is read only when the agent has one.
-        const terminalRouteDecider = limitsAsData
-            ? withAnswerCoverage(routeDecider, inputsArmed ? { rewrites: this.toolMiddleware.length > 0 } : undefined)
-            : routeDecider;
-        // toolCallsHandler extracted to ./agent/stages/toolCalls.ts (v2.11.2).
-        const toolCallsHandler = buildToolCallsHandler({
+        const routeFor = (run) => {
+            const resolve = resolverForValues(run.value);
+            const baseRouteDecider = buildRouteDeciderStage(this.messageMiddleware, this.outputEnforcement, stepPlanFor, this.evidenceGate, hasWrapUp, this.claimContract, run.value.integrityLedger, 
+            // THE CLAIM SEAM'S RECENCY READ (9.83.0). Value-conditional on both
+            // halves, so an agent that armed neither hands the decider builder
+            // exactly the arguments it always did — and `buildRouteDeciderStage`'s
+            // no-judge fast path still returns the very function reference every
+            // pre-9.83.0 chart was given.
+            this.noticePriorTurnEvidence && this.evidenceGate !== undefined ? true : undefined, 
+            // THE ANSWER TURN'S STANDINGS (9.101.0) — the same value-conditional
+            // trailing positional, for the same reason: an unarmed agent hands the
+            // builder exactly the arguments it always did.
+            this.findingsOptions !== undefined ? true : undefined, 
+            // THE INPUTS LAYER (honesty layer 2) — the same value-conditional
+            // trailing positional: the rows this decider files carry the turn
+            // stamp, and with the evidence gate armed too, the gate's exempt corpus
+            // gains this turn's assumed values, read from the tools' declarations,
+            // and the values the person gave the layer's batch ask (step 4). The
+            // results layer (step 7b) arms the stamp alone — "while any layer is
+            // armed, the one writer stamps the turn" — and nothing else.
+            inputsArmed || resultsArmed
+                ? {
+                    ...(inputsArmed &&
+                        this.evidenceGate !== undefined && {
+                        declaredDefaults: declaredDefaultsFrom((toolName, argument) => {
+                            const rules = rulesOf(resolve(toolName).tool);
+                            if (rules === undefined || isRefused(rules))
+                                return undefined;
+                            return rules.ruled.find((r) => r.argument === argument)?.assume;
+                        }),
+                        answeredValues: answeredValuesOf,
+                        // Under `.time()` (step T7): the turn's time spellings by
+                        // lineage — said ones exempt, derived ones filed, not flagged.
+                        ...(this.timeOptions !== undefined && { timeLineage: true }),
+                    }),
+                }
+                : undefined, 
+            // THE ANSWER LAYER (honesty layer 4) — the same value-conditional
+            // trailing positional: the judges file the answer's witness rows, and
+            // every row this decider files carries the turn stamp.
+            answerArmed ? true : undefined);
+            const validatedRouteDecider = this.answerValidationConfig === undefined
+                ? baseRouteDecider
+                : withAnswerValidation(baseRouteDecider, this.answerValidationConfig, this.outputSchemaParser, artifactStore, () => run.value.consentOutstanding.size > 0, this.outputEnforcement?.outputFormat !== undefined, 
+                // Read only when `agentChecks` lists 'claims' (the agent's own rows).
+                this.claimContract, this.typedNegativeClaimsConfig === undefined
+                    ? undefined
+                    : {
+                        config: this.typedNegativeClaimsConfig,
+                        phrases: this.typedNegativeClaimsConfig.phrases,
+                        applicationValidation: this.applicationAnswerValidation,
+                        runId: () => run.context.runId,
+                    });
+            const routeDecider = this.negativeClaimsConfig?.mode === 'prose'
+                ? withNegativeProse(validatedRouteDecider, {
+                    runId: () => run.context.runId,
+                    hasOutstandingConsent: () => run.value.consentOutstanding.size > 0,
+                    structured: this.outputSchemaParser !== undefined,
+                    phrases: this.negativeClaimsConfig.phrases,
+                })
+                : validatedRouteDecider;
+            // `.limitsTravelWithTheAnswer()` on a TYPED answer — decided once, here.
+            // An output schema makes the answer JSON, and the appended block would
+            // make it JSON followed by prose, which `runTyped()` cannot parse. So the
+            // limits travel as DATA: the Route decider's terminal decision commits the
+            // fold (`withAnswerCoverage`) and the Final branch projects it onto
+            // `turn_end`. A prose answer keeps the block; an agent that asked for
+            // neither is handed the decider it always had.
+            // With the inputs layer armed, the typed answer's limits carry this
+            // turn's assumed values too — the same rows the prose "Assumed" block
+            // prints (`withAnswerCoverage`'s second argument); a rewrite by a
+            // before-tool chain is read only when the agent has one.
+            const terminalRouteDecider = limitsAsData
+                ? withAnswerCoverage(routeDecider, inputsArmed ? { rewrites: this.toolMiddleware.length > 0 } : undefined)
+                : routeDecider;
+            // toolCallsHandler extracted to ./agent/stages/toolCalls/index.ts (v2.11.2).
+            return terminalRouteDecider;
+        };
+        const terminalRouteDecider = bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (run.value.route ??= routeFor(run)));
+        const toolCallsFor = (run) => buildToolCallsHandler({
             registryByName,
             // WHICH SKILLS DECLARE EACH TOOL NAME (9.86.0) — read by the unknown-tool
             // roster so a role that may not see a skill is not told the names of the
@@ -5146,7 +4830,7 @@ export class Agent extends RunnerBase {
             ...(this.noticeEmptyLookups &&
                 toolGrounding.size > 0 && {
                 emptyLookupGrounding: toolGrounding,
-                integrityLedger: this.integrityLedgerHolder,
+                integrityLedger: run.value.integrityLedger,
             }),
             // THE WRITE SEAM'S other check (9.78.0) — the column-type contract.
             // Value-conditional on both halves for the same reason, so an agent
@@ -5156,11 +4840,21 @@ export class Agent extends RunnerBase {
                 toolColumns.size > 0 && {
                 columnDeclarations: toolColumns,
                 columnCheckMode: this.checkColumnTypes,
-                integrityLedger: this.integrityLedgerHolder,
+                integrityLedger: run.value.integrityLedger,
             }),
             ...(this.externalToolProvider && { externalToolProvider: this.externalToolProvider }),
-            ...(this.externalToolProvider && { providerToolCache }),
-            servedTools,
+            ...(this.externalToolProvider && {
+                providerToolCache: run.value.providerToolCache,
+                prepareProviderTools: (scope) => ensureDiscoveredTools(scope, {
+                    provider: this.externalToolProvider,
+                    cache: run.value.providerToolCache,
+                    callerIdentity: run.own ? run.value.identity : memberIdentityIn(scope),
+                    get iteration() {
+                        return scope.iteration ?? 1;
+                    },
+                }),
+            }),
+            servedTools: run.value.servedTools,
             toolClaimants,
             ...(permissionChecker && { permissionChecker }),
             ...(credentialProvider && { credentialProvider }),
@@ -5168,7 +4862,7 @@ export class Agent extends RunnerBase {
             // or — on a mount — the run its link names (`memberRun.ts`). An accessor,
             // because the chart is built once and the request is per run.
             ...(credentialProvider && {
-                currentRequest: (scope) => this.ownScopes.has(scope) ? this.scopeRequests.get(scope) : memberRequestIn(scope),
+                currentRequest: (scope) => (run.own ? run.value.request : memberRequestIn(scope)),
             }),
             // The claim-check store (9.21.0). Absent → not one new line runs in
             // dispatch: `ctx.artifacts` is the fail-closed teacher and no artifact
@@ -5242,7 +4936,8 @@ export class Agent extends RunnerBase {
             // injections exist; nothing runs until a tool returns an effect.
             ...(this.injections.length > 0 && {
                 leaseTargets: new Map(this.injections.map((inj) => {
-                    const surfaceMode = inj.metadata?.surfaceMode;
+                    const surfaceMode = inj.metadata
+                        ?.surfaceMode;
                     return [inj.id, { ...(surfaceMode !== undefined && { surfaceMode }) }];
                 })),
             }),
@@ -5265,19 +4960,20 @@ export class Agent extends RunnerBase {
             // at construction, and a captured value would be run #1's forever. The
             // tier one is lazy on top of that — an agent whose tools hold no sessions
             // never allocates it.
-            currentRun: () => this.toolRunFacts(),
-            isOwnRun: (scope) => this.ownScopes.has(scope),
-            answeredAsk: () => this.answeredAsk,
+            currentRun: () => this.toolRunFacts(run),
+            isRunRetired: () => run.retired,
+            isOwnRun: () => run.own,
+            answeredAsk: () => run.value.answeredAsk,
             // The time layer: each dispatched call files its `call` row, and the
             // resume door compares a resume's passed `time` with the kept clock.
             ...(this.timeOptions !== undefined && {
                 time: {
-                    takePassedOnResume: (scope) => {
+                    takePassedOnResume: () => {
                         // Only the agent's own resumed leg takes it — never a member's.
-                        if (!this.ownScopes.has(scope))
+                        if (!run.own)
                             return undefined;
-                        const passed = this.resumePassedTime;
-                        this.resumePassedTime = undefined;
+                        const passed = run.value.resumePassedTime;
+                        run.value.resumePassedTime = undefined;
                         return passed;
                     },
                     ...(this.timeOptions.zone !== undefined && { appZone: this.timeOptions.zone }),
@@ -5294,7 +4990,7 @@ export class Agent extends RunnerBase {
                 },
             }),
             emitForRun: (type, payload, runContext) => this.emitLateFact(type, payload, runContext),
-            toolSessions: () => this.toolSessions(),
+            resources: run.value.resources,
             // 8.6.0 — what a run does when a declared credential needs 3LO consent.
             onAuthorizationRequired: this.onAuthorizationRequired,
             // The `'tell-model'` consent record travels OFF tracked state (a tracked
@@ -5302,10 +4998,10 @@ export class Agent extends RunnerBase {
             // these two callbacks are its whole route to the caller. Cleared at the
             // top of every run; read in `finalizeResult`.
             reportConsentOutstanding: (record) => {
-                this.consentOutstanding.set(record.service, record);
+                run.value.consentOutstanding.set(record.service, record);
             },
             clearConsentOutstanding: (service) => {
-                this.consentOutstanding.delete(service);
+                run.value.consentOutstanding.delete(service);
             },
         });
         // v2.14 — Build the NormalizeThinking sub-subflow only when a
@@ -5313,6 +5009,11 @@ export class Agent extends RunnerBase {
         // explicitly set via .thinkingHandler()). Conditional mount ensures
         // zero overhead for non-thinking agents — the chart has zero extra
         // stages when undefined.
+        const handlerFor = (run) => (run.value.toolCalls ??= toolCallsFor(run));
+        const toolCallsHandler = {
+            execute: bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (scope) => handlerFor(run).execute(scope)),
+            resume: bindRunnerStage((scope) => this.runExecution().forScope(scope), (run) => (scope, input) => handlerFor(run).resume(scope, input)),
+        };
         const thinkingSubflow = this.thinkingHandler
             ? buildThinkingSubflow(this.thinkingHandler, this.provider.name)
             : undefined;
@@ -5322,7 +5023,9 @@ export class Agent extends RunnerBase {
         const chartDeps = {
             memories: this.memories,
             // Evidence bridge (#5): closure hand-off to the CAUSAL write mounts.
-            ...(this.causalEvidence && { causalEvidenceSource: this.causalEvidence.collect }),
+            ...(this.memories.some((memory) => memory.type === 'causal') && {
+                causalEvidenceSource: (binding) => componentEvidence(this.runExecution().forScope(binding).value, binding),
+            }),
             systemPromptCachePolicy,
             maxIterations,
             seed,
@@ -5386,7 +5089,10 @@ export class Agent extends RunnerBase {
                     // Route's sixth dispatch value, read only by an agent whose revision
                     // turns the tools off (an enforcing answer validation).
                     ...(this.revisionWithholdsTools() && { toolsOffAfterRevision: true }),
-                    toolOf: (toolName) => resolveForLayer(toolName).tool,
+                    toolOfFor: (scope) => {
+                        const resolve = resolveForLayer(scope);
+                        return (toolName) => resolve(toolName).tool;
+                    },
                     ...(this.toolMiddleware.length > 0 && { rewrites: true }),
                     // The time layer (step T5a): a tool whose period declares forms is filled from the
                     // turn's one window, bound to the person's window, or recorded as the model's.
@@ -5424,7 +5130,12 @@ export class Agent extends RunnerBase {
             // head, in both builders through one helper, reading each call's
             // `ToolPeriod` off the implementation that answered it; absent → untouched.
             ...(resultsArmed && {
-                resultsLayer: { toolOf: (toolName) => resolveForLayer(toolName).tool },
+                resultsLayer: {
+                    toolOfFor: (scope) => {
+                        const resolve = resolveForLayer(scope);
+                        return (toolName) => resolve(toolName).tool;
+                    },
+                },
             }),
             // The answer layer (honesty layer 4): its stage heads the final branch
             // in both builders through one helper, reading only the committed keys
@@ -5442,11 +5153,11 @@ export class Agent extends RunnerBase {
                         standingLine: this.answerLayerOption.standingLine,
                     }),
                     ...(this.answerValidationConfig !== undefined && { validated: true }),
-                    ...(displayNameOf !== undefined && { displayNameOf }),
+                    ...(displayNameOfFor !== undefined && { displayNameOfFor }),
                 },
             }),
             // The prose limits block names an item's calls in the app's words — under the same wiring.
-            ...(displayNameOf !== undefined && { displayNameOf }),
+            ...(displayNameOfFor !== undefined && { displayNameOfFor }),
             // Tool choice by classifier (9.105.0): the mount args on the Tools
             // branch and the key across the sf-llm-call boundary, under the arm.
             ...(this.toolChoiceOptions !== undefined && { hasToolChoice: true }),
@@ -5536,60 +5247,4 @@ export class Agent extends RunnerBase {
 // AgentBuilder extracted to ./agent/AgentBuilder.ts (v2.11.2).
 // Re-export so the 28+ existing import sites continue to work unchanged.
 // Validators + helpers extracted to ./agent/validators.ts (v2.11.1).
-/** How many run ids one instance remembers. */
-const MAX_REMEMBERED_RUNS = 256;
-/** Drop the oldest entries of an insertion-ordered Set or Map past `max`. */
-function boundInsertionOrder(held, max) {
-    while (held.size > max) {
-        const oldest = held.keys().next();
-        if (oldest.done === true)
-            return;
-        held.delete(oldest.value);
-    }
-}
-/**
- * The run options without the time layer's `time` — what the engine is handed.
- * The SAME object when it carries no `time` key, so a run that passed none
- * hands the executor exactly the options it always did.
- */
-function withoutTime(options) {
-    if (options === undefined || !('time' in options))
-        return options;
-    const { time: _time, ...rest } = options;
-    void _time;
-    return rest;
-}
-/**
- * The policy a paused agent run was covered by, read off its own checkpoint
- * (`AgentState.runRedaction`, committed by seed and by every resumed leg) —
- * FAIL CLOSED: a value this library did not write, or a checkpoint whose run
- * kept names out of its records (`redactionMarks`) but carries no policy,
- * refuses the resume (`ResumeRedactionError`) before anything moves. A leg its
- * policy could not keep covered must never start.
- */
-function resumeRedactionOf(checkpoint, trusted) {
-    const state = checkpoint.sharedState;
-    let carried;
-    try {
-        // A carried pattern is a reference to one the resuming side holds — never
-        // compiled from the checkpoint (`redaction/policy.ts` · `policyFromCarried`).
-        carried = policyFromCarried(state?.runRedaction, 'Agent.resume', trusted);
-        // A policy built under ANOTHER vocabulary version is joined with the
-        // current list — the leg is never covered by an older list alone.
-        carried = withCurrentVocabulary(carried, carriedVocabularyOf(state?.runRedaction));
-    }
-    catch (refusal) {
-        throw new ResumeRedactionError(refusal instanceof CarriedPolicyError && refusal.refusal === 'unknown-pattern'
-            ? 'unknown-pattern'
-            : 'unreadable');
-    }
-    // Every leg of a covered run writes its policy into its checkpoint's state
-    // (seed, and `resume` for a resumed leg), so a checkpoint whose run kept
-    // names out but carries none was altered — refused even when the resume
-    // names a policy, which cannot stand in for the one the run was covered by.
-    if (carried === undefined && policyOfMarks(checkpoint.redactionMarks) !== undefined) {
-        throw new ResumeRedactionError('missing');
-    }
-    return carried;
-}
 //# sourceMappingURL=Agent.js.map