maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.31.20260913

package/node_modules/@maka/runtime-host/dist/server/execution-composition.js

@@ -16,23 +16,26 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { copyWorkHubAttachmentsToTarget } from './workhub-message-attachments.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
+import { attachmentKindFromMimeType, MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
 import { messageContentDigest, normalizeMessageContent } from '@maka/core/events';
-import { describeChatConfigurationReason, NO_REAL_CONNECTION_CODE, } from '@maka/core/connection-error-copy';
+import { NO_REAL_CONNECTION_CODE } from '@maka/core/connection-error-copy';
 import { generalizedErrorMessage } from '@maka/core/redaction';
 import { emptyPlanSessionState } from '@maka/core/plan';
-import { isDeepResearchSession, WORKHUB_COORDINATION_SESSION_ID, } from '@maka/core/session';
-import { filterModelVisibleTaskLedgerTasks } from '@maka/core/task-ledger';
-import { AgentGraphCoordinator } from '@maka/runtime/stream-graph-coordinator';
+import { readLogicalRuntimeExecutionForRun } from '@maka/core/runtime-logical-execution';
+import { runtimeInvocationOutcome, } from '@maka/core/runtime-invocation';
+import { isDeepResearchSession, WORKHUB_COORDINATION_SESSION_ID, WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION, } from '@maka/core/session';
+import { AgentGraphClientOperationError, AgentGraphCoordinator, } from '@maka/runtime/stream-graph-coordinator';
 import { AgentGraphSupervisorWakeCoordinator } from '@maka/runtime/agent-graph-supervisor-wake';
-import { BackendRegistry, SessionManager, } from '@maka/runtime/session-manager';
+import { BackendRegistry, SessionManager, workHubDirectStopAbortSource, } from '@maka/runtime/session-manager';
 import { buildToolsForAgentDefinition } from '@maka/runtime/agent-catalog';
 import { buildHistoryTools } from '@maka/runtime/history-tools';
+import { buildBuiltinTools } from '@maka/runtime/builtin-tools';
 import { createLocalContinuationSafetyInspector } from '@maka/runtime/continuation-safety';
 import { createConfiguredSubagentCatalog } from '@maka/runtime/configured-subagent-catalog';
 import { buildHostCapabilitiesFromBinding } from '@maka/runtime/skills';
-import { createBuiltinSandboxManager, createSandboxDiagnosticsProvider, isBuiltinFilesystemWorkerSandboxAvailable, } from '@maka/runtime/sandbox';
+import { createBuiltinSandboxManager, isBuiltinFilesystemWorkerSandboxAvailable, } from '@maka/runtime/sandbox';
 import { createFilesystemWorkerLaunchSpecProvider, FilesystemWorkerClient, } from '@maka/runtime/filesystem-worker';
 import { isOAuthEnrollmentProviderEnabled } from '@maka/runtime/oauth-provider-contracts';
 import { loadHistoryCompactCheckpointsFromRunLedger, loadLatestHistoryCompactCheckpointFromRunLedger, } from '@maka/runtime/history-compact-ledger';
@@ -42,9 +45,30 @@ import { renderAgentSwarmSupervisorWake, shouldWakeAgentSwarmSupervisor, } from
 import { SessionActivityRegistry } from '@maka/runtime/goal-turn-lifecycle';
 import { ShellRunProcessManager } from '@maka/runtime/shell-run-manager';
 import { resolveShellPlan, resolveTurnShellPlan, validateShellPreference, } from '@maka/runtime/shell-detect';
+import { Context } from '@maka/runtime/plugin-kernel';
+import { PluginAgentService } from '@maka/runtime/plugin-agent-service';
+import { PluginAttachmentService } from '@maka/runtime/plugin-attachment-service';
+import { PluginApprovalService } from '@maka/runtime/plugin-approval-service';
+import { PluginFilesystemService } from '@maka/runtime/plugin-fs-service';
+import { PluginLlmService } from '@maka/runtime/plugin-llm-service';
+import { PluginShellService } from '@maka/runtime/plugin-shell-service';
+import { PluginUserQuestionService } from '@maka/runtime/plugin-user-question-service';
+import { PluginWebService } from '@maka/runtime/plugin-web-service';
+import { MakaCompositionLoader } from '@maka/runtime/plugin-composition-loader';
+import { PluginToolService } from '@maka/runtime/plugin-tool-service';
+import { PluginSystemPromptService } from '@maka/runtime/plugin-system-prompt-service';
+import { PluginCommandService } from '@maka/runtime/plugin-command-service';
+import { PluginAuthorizationService, PluginCredentialService, PluginSettingsService, PluginStorageService, } from '@maka/runtime/plugin-data-services';
+import { PluginGoalService } from '@maka/runtime/plugin-goal-service';
+import { PluginLspService } from '@maka/runtime/plugin-lsp-service';
+import { PluginSessionQueryService } from '@maka/runtime/plugin-session-query-service';
+import { PluginShellEnvService } from '@maka/runtime/plugin-shell-env-service';
+import { PluginSkillService } from '@maka/runtime/plugin-skill-service';
+import { isHostedExecutionTerminal } from './hosted-execution-authority.js';
 import { createAgentGraphControlStore } from '@maka/storage/agent-graph-control-store';
-import { createArtifactAttachmentResourceReader, createReadImageSnapshotter, } from '@maka/storage/artifact-stores';
-import { isSessionNotFoundError, SessionMetadataConflictError, } from '@maka/storage/execution-stores';
+import { createArtifactAttachmentResourceReader } from '@maka/storage/artifact-stores';
+import { createReadImageSnapshotStore } from '@maka/storage/read-image-snapshot-store';
+import { isSessionNotFoundError } from '@maka/storage/execution-stores';
 import { createExternalSessionAdapterRegistry } from '@maka/storage/external-sessions';
 import { createGitWorktreeChildExecutor } from '@maka/storage/git-worktree-child-executor';
 import { runWithStorageRootLease } from '@maka/storage/root-authority';
@@ -52,6 +76,7 @@ import { createInteractiveContextOffloadReader } from '@maka/storage/context-off
 import { openStorageWriterComposition } from '@maka/storage/storage-writer-composition';
 import { resolveWorkspaceIdentity } from '@maka/storage/workspace-identity';
 import { CanonicalSessionProjectionReader } from './canonical-session-projection.js';
+import { HostPluginDataRuntime } from './plugin-data-runtime.js';
 import { bindHostChildAgentBackend, createHostChildAgentToolComposition, } from './child-agent-composition.js';
 import { HostCanonicalPermissionOutcomeReader } from './canonical-permission-outcome-reader.js';
 import { HostArtifactCoordinator } from './artifact-coordinator.js';
@@ -66,75 +91,88 @@ import { HostContextCoordinator } from './context-coordinator.js';
 import { HostClientCapabilityCoordinator } from './client-capability-coordinator.js';
 import { HostDeepResearchCoordinator } from './deep-research-coordinator.js';
 import { HostDailyReviewCoordinator } from './daily-review-coordinator.js';
-import { createHostAiSdkBackend } from './execution-model-composition.js';
+import { prepareHostAiSdkBackend } from './execution-model-composition.js';
 import { createInteractiveRunComposer, createInteractiveRunComposerFactory, routeInteractiveRunToolSurface, } from './interactive-run-composer.js';
-import { createHostGoalEvaluator, createHostDailyReviewModel, createHostMemoryExtractionModel, createHostSessionEffectModel, } from './execution-model-authority.js';
+import { createHostGoalEvaluator, createHostDailyReviewModel, createHostMemoryExtractionModel, createHostPluginModel, createHostSessionEffectModel, } from './execution-model-authority.js';
 import { HostExecutionInspectCoordinator } from './execution-inspect-coordinator.js';
 import { HostExternalSessionCoordinator } from './external-session-coordinator.js';
+import { HostSessionBundleCoordinator } from './session-bundle-coordinator.js';
 import { HostGoalCoordinator } from './goal-coordinator.js';
 import { HostGoalExecutionCoordinator } from './goal-execution-coordinator.js';
 import { HostHostedExecutionCoordinator } from './hosted-execution-coordinator.js';
 import { HostHostedExecutionRunner } from './hosted-execution-runner.js';
-import { executeHostedExecutionToSettlement } from './hosted-execution-wait.js';
+import { executeHostedExecutionToSettlement, waitForHostedExecutionIdleOrAbort, } from './hosted-execution-wait.js';
 import { beginRuntimeHostDomainModuleDrain, closeRuntimeHostDomainModules, composeRuntimeHostDomainHandlers, createRuntimeHostDomainModule, recoverRuntimeHostDomainModules, } from './host-composition.js';
 import { HostInteractionCoordinator } from './interaction-coordinator.js';
 import { HostInteractiveTurnCoordinator } from './interactive-turn-coordinator.js';
 import { SessionTurnAccessRequestCoordinator } from './session-turn-access-request-coordinator.js';
 import { ensureBootstrapRuntimePolicy } from './bootstrap-runtime-policy.js';
-import { hostedExecutionRunProfile } from './hosted-execution-tool-profile.js';
+import { bindWorkHubRoutingDecisionPrompt, hostedExecutionRunProfile, } from './hosted-execution-tool-profile.js';
 import { HostMemoryCoordinator } from './memory-coordinator.js';
 import { HostMemoryExtractionCoordinator } from './memory-extraction-coordinator.js';
 import { MemoryExtractionSessionLane } from './memory-extraction-session-lane.js';
 import { HostMessageCoordinator } from './message-coordinator.js';
 import { HostNetworkProxyCoordinator } from './network-proxy-coordinator.js';
 import { HostOAuthExecutionAuthority } from './oauth-execution-authority.js';
+import { join } from 'node:path';
+import { toRuntimePolicyProxy } from './runtime-policy-proxy.js';
+import { AcpSetupError } from './acp/connection.js';
+import { installAntigravity } from './acp/antigravity-install.js';
+import { createProxiedFetchTransport } from '@maka/runtime/network/scoped-fetch-transport';
+import { HostExternalAgentSetupCoordinator } from './external-agent-setup-coordinator.js';
 import { HostOAuthCoordinator } from './oauth-coordinator.js';
 import { HostPlanCoordinator } from './plan-coordinator.js';
 import { HostProjectDirectoryAuthority, } from './project-directory-authority.js';
 import { HostProjectCatalogCoordinator } from './project-catalog-coordinator.js';
 import { HostProjectMembershipGate } from './project-membership-gate.js';
+import { HostPluginPlatformCoordinator } from './plugin-platform-coordinator.js';
+import { HostPluginPlatform } from './plugin-platform.js';
 import { RootAdmissionOwner } from './root-admission-owner.js';
 import { RootTurnCoordinator } from './root-turn-coordinator.js';
 import { RuntimePolicyActivationGate } from './runtime-policy-activation-gate.js';
 import { notifySandboxBoundaryGraphWake } from './sandbox-boundary-graph-wake.js';
 import { HostRuntimePolicyCoordinator } from './runtime-policy-coordinator.js';
+import { startHostModelMetadataRefresh } from './model-metadata-refresh.js';
 import { HostRuntimeResourceCoordinator } from './runtime-resource-coordinator.js';
 import { SessionAdmissionGate } from './session-admission-gate.js';
 import { HostSessionCatalogCoordinator } from './session-catalog-coordinator.js';
 import { HostWorkspaceResolver } from './workspace-resolver.js';
 import { HostSessionRetirementCoordinator } from './session-retirement-coordinator.js';
+import { HostStorageMaintenance } from './storage-maintenance.js';
 import { HostSessionRevisionCoordinator } from './session-revision-coordinator.js';
 import { HostSessionEffectCoordinator } from './session-effect-coordinator.js';
 import { SessionContinuityCoordinator } from './session-continuity-coordinator.js';
-import { createSessionTranscriptReader } from './session-transcript-reader.js';
-import { HostSkillCatalogCoordinator } from './skill-catalog-coordinator.js';
+import { createSessionTranscriptReader, } from './session-transcript-reader.js';
+import { HostSkillCatalogCoordinator, SkillCatalogInvocableContextError, } from './skill-catalog-coordinator.js';
 import { SkillCatalogRepository } from './skill-catalog-repository.js';
-import { HostTaskLedgerCoordinator } from './task-ledger-coordinator.js';
+import { HostSessionTodoCoordinator } from './session-todo-coordinator.js';
 import { HostTurnControlCoordinator } from './turn-control-coordinator.js';
 import { HostUsagePricingCoordinator } from './usage-pricing-coordinator.js';
 import { HostWebSearchCoordinator } from './web-search-coordinator.js';
 import { HostWorkHubCoordinationCoordinator } from './workhub-coordination-coordinator.js';
-import { WorkHubActionEffectFailure } from './workhub-coordination-action-gate.js';
+import { WorkHubActionEffectFailure, workHubResumedTurnId, } from './workhub-coordination-action-gate.js';
 import { createHostWebSearchService, createHostWebSearchToolFromService, resolveHostTavilyWebSearchReadiness, shouldResolveHostTavilyWebSearchReadiness, } from './web-search-tool.js';
 import { createHostWebFetchService, createHostWebFetchToolFromService } from './web-fetch-tool.js';
 import { createHostExecutionArtifactServices } from './execution-artifacts.js';
+import { openToolResultArchiveEvidenceReader } from '@maka/storage/tool-result-archive-evidence';
 import { createRuntimeHostWorkspaceExecutionComposition, RuntimeHostWorkspaceExecutionError, } from './workspace-execution-composition.js';
-const CONTEXT_OFFLOAD_READER_LIMITS = Object.freeze({
+const GIBIBYTE = 1024 * 1024 * 1024;
+const CONTEXT_OFFLOAD_LIMITS = Object.freeze({
     ownerMaxBytes: Object.freeze({
         read_image_snapshot: MAX_READ_IMAGE_BYTES,
         tool_result_archive: 0,
     }),
-    // This expand slice opens only the reader path. Zero quotas make accidental
-    // non-empty puts fail closed until the writer/lifecycle cutover lands.
-    sessionLogicalBytes: 0,
-    workspacePhysicalBytes: 0,
+    // Read images are bounded individually and logically per Session. Physical
+    // bytes are content-addressed across Sessions and bounded per workspace.
+    sessionLogicalBytes: GIBIBYTE,
+    workspacePhysicalBytes: 20 * GIBIBYTE,
 });
 export function runtimeHostFilesystemWorkerRuntime(versions) {
     return versions.electron ? 'electron' : 'node';
 }
 export async function createExecutionRuntimeHostComposition(context, options = {}, dependencies = {}) {
     const storage = await openStorageWriterComposition(context.owner.lease, {
-        contextOffloadLimits: CONTEXT_OFFLOAD_READER_LIMITS,
+        contextOffloadLimits: CONTEXT_OFFLOAD_LIMITS,
         afterRuntimePolicyOpened: async (stores) => {
             if (options.bootstrapRuntimePolicy !== false) {
                 await ensureBootstrapRuntimePolicy({
@@ -146,19 +184,55 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         },
     });
     if (storage.contextOffloadUnavailable) {
-        console.error(`[runtime-host] optional context-offload reader could not be opened: ${generalizedErrorMessage(storage.contextOffloadUnavailable.cause)}`);
+        console.error(`[runtime-host] optional context-offload Store could not be opened: ${generalizedErrorMessage(storage.contextOffloadUnavailable.cause)}`);
     }
     const stores = storage.execution;
     let graphControlStore;
     let graphClient;
     let sessionEffects;
     let memoryExtraction;
-    let unsubscribeTaskLedger;
     let unsubscribeTranscriptChanges;
+    let transcriptReader;
     let unsubscribeUsageChanges;
     let workspaceExecution;
     let goalExecutions;
+    let pluginPlatform;
+    let manager;
+    let modelMetadataRefresh;
+    let archiveEvidence;
     try {
+        const pluginRoot = new Context();
+        const pluginAgents = new PluginAgentService(pluginRoot);
+        const pluginAttachments = new PluginAttachmentService(pluginRoot, pluginAgents);
+        new PluginApprovalService(pluginRoot, pluginAgents);
+        new PluginUserQuestionService(pluginRoot, pluginAgents);
+        const pluginFilesystem = new PluginFilesystemService(pluginRoot, pluginAgents);
+        const pluginLlm = new PluginLlmService(pluginRoot, pluginAgents);
+        const pluginShellEnv = new PluginShellEnvService(pluginRoot);
+        const pluginShell = new PluginShellService(pluginRoot, pluginAgents, pluginShellEnv);
+        const pluginWeb = new PluginWebService(pluginRoot, pluginAgents);
+        const pluginSessionQuery = new PluginSessionQueryService(pluginRoot, pluginAgents);
+        const pluginGoals = new PluginGoalService(pluginRoot, pluginAgents);
+        const pluginSkills = new PluginSkillService(pluginRoot);
+        const pluginCommands = new PluginCommandService(pluginRoot);
+        new PluginLspService(pluginRoot);
+        const pluginSettings = new PluginSettingsService(pluginRoot);
+        const pluginStorage = new PluginStorageService(pluginRoot);
+        const pluginCredentials = new PluginCredentialService(pluginRoot);
+        new PluginAuthorizationService(pluginRoot, pluginCredentials);
+        const pluginData = new HostPluginDataRuntime(context.owner.controlDirectory);
+        pluginSettings.bindRuntime(pluginData);
+        pluginStorage.bindRuntime(pluginData);
+        pluginCredentials.bindRuntime(pluginData);
+        const pluginTools = new PluginToolService(pluginRoot, { agents: pluginAgents });
+        const pluginSystemPrompt = new PluginSystemPromptService(pluginRoot);
+        pluginPlatform = new HostPluginPlatform(context.owner.controlDirectory, {
+            composition: new MakaCompositionLoader({ root: pluginRoot }),
+            tools: pluginTools,
+            systemPrompt: pluginSystemPrompt,
+            commands: pluginCommands,
+        });
+        const pluginPlatformCoordinator = new HostPluginPlatformCoordinator(pluginPlatform);
         const openedProjectCatalog = storage.projectCatalog;
         const runtimePolicyStores = storage.runtimePolicy;
         const oauthCredentials = new HostOAuthExecutionAuthority(runtimePolicyStores);
@@ -169,12 +243,28 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         const openedGoalStore = storage.goal;
         const memoryStore = storage.memoryBundle;
         const longTermMemoryStore = storage.longTermMemory;
-        const taskLedgerStore = storage.taskLedger;
+        const sessionTodoStore = storage.sessionTodo;
         const openedArtifactStore = storage.artifacts;
         const openedContextOffloadStore = storage.contextOffload;
         const openedContextOffloadReader = openedContextOffloadStore
             ? createInteractiveContextOffloadReader(openedContextOffloadStore)
             : undefined;
+        const contextOffloadAuthority = openedContextOffloadStore
+            ? openedContextOffloadStore
+            : storage.contextOffloadUnavailable
+                ? {
+                    copyReferences: async () => {
+                        throw new Error('Context-offload Store is unavailable during Session copy', {
+                            cause: storage.contextOffloadUnavailable?.cause,
+                        });
+                    },
+                    retireSession: async (_sessionId) => {
+                        throw new Error('Context-offload Store is unavailable during Session retirement', {
+                            cause: storage.contextOffloadUnavailable?.cause,
+                        });
+                    },
+                }
+                : undefined;
         const openedUsageStores = storage.usage;
         const openedShellRunStore = storage.shellRuns;
         const worktreeChildExecutor = createGitWorktreeChildExecutor({
@@ -189,7 +279,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         // product's existing answer for these rows: this task came from the retired
         // local simulation, configure a real model and start a new one.
         backends.register('fake', () => {
-            throw new Error(`${NO_REAL_CONNECTION_CODE}:fake_backend: ${describeChatConfigurationReason('fake_backend')}`);
+            throw new Error(`${NO_REAL_CONNECTION_CODE}:fake_backend: Runtime Host cannot send on a retired local-simulation connection; configure a real model and start a new task`);
         });
         const runtimePolicyActivation = new RuntimePolicyActivationGate();
         const runtimePolicy = new HostRuntimePolicyCoordinator(runtimePolicyStores, runtimePolicyActivation, applyRuntimePolicyMutationEffects, async (input) => {
@@ -201,7 +291,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         const memoryExtractionLane = new MemoryExtractionSessionLane();
         let runtimeResources;
         let continuity;
-        let manager;
         let graphCoordinator;
         let graphSupervisorWake;
         const graphWakeActivities = new SessionActivityRegistry();
@@ -224,12 +313,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 resourceLocation: { kind: 'runtime' },
             })
             : undefined;
-        const sandboxDiagnostics = createSandboxDiagnosticsProvider({
-            ...(sandboxManager ? { sandboxManager } : {}),
-            ...(filesystemWorkerLaunchSpecProvider
-                ? { getFilesystemWorkerLaunchSpec: filesystemWorkerLaunchSpecProvider }
-                : {}),
-        });
         const filesystemWorker = sandboxManager && filesystemWorkerLaunchSpecProvider
             ? new FilesystemWorkerClient({
                 sandboxManager,
@@ -242,7 +325,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         workspaceExecution = createRuntimeHostWorkspaceExecutionComposition({
             ...(workspaceFilesystemWorker ? { filesystemWorker: workspaceFilesystemWorker } : {}),
         });
-        const taskLedger = new HostTaskLedgerCoordinator(taskLedgerStore, sessionAdmission, stores.sessionStore);
+        const sessionTodo = new HostSessionTodoCoordinator(sessionTodoStore, sessionAdmission, stores.sessionStore, (sessionId) => requireContinuity(continuity).enqueueSessionDomainChanged(sessionId, 'todo'), context.requestDrain);
         runtimeResources = new HostRuntimeResourceCoordinator({
             manager: shellRuns,
             sessions: {
@@ -259,9 +342,13 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             resolveShell: async () => resolveShellPlan((await runtimePolicyStores.runtimePolicy.getSnapshot()).policy.shell),
             onProjectionChanged: (update) => requireContinuity(continuity).enqueueRuntimeResourceChanged(update),
         });
+        archiveEvidence = await openToolResultArchiveEvidenceReader(context.owner.lease);
         const executionArtifacts = createHostExecutionArtifactServices({
+            archiveEvidence,
             artifacts: openedArtifactStore,
             requestDrain: context.requestDrain,
+            sessionAdmission,
+            sessions: stores.sessionStore,
         });
         const builtinTools = {
             shellRuns: runtimeResources,
@@ -271,16 +358,109 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             }),
             backgroundTasks: runtimeResources,
             ptyControls: runtimeResources,
-            snapshotImage: createReadImageSnapshotter(openedArtifactStore),
+            ...(openedContextOffloadStore
+                ? {
+                    snapshotImage: async (input) => createReadImageSnapshotStore(openedContextOffloadStore, input.sessionId).snapshot({
+                        ownerId: input.ownerId,
+                        bytes: input.bytes,
+                        mimeType: input.mimeType,
+                    }),
+                    releaseImageSnapshot: async (input) => {
+                        await openedContextOffloadStore.releaseReference(input);
+                    },
+                }
+                : {}),
             ...(sandboxManager ? { sandboxManager } : {}),
             ...(filesystemWorker ? { filesystemWorker } : {}),
         };
+        const invokeBuiltin = async (name, args, invocation, shellEnvironment) => {
+            if (!invocation.toolContext)
+                throw new Error(`${name} requires an active Tool invocation`);
+            const policy = await runtimePolicyStores.runtimePolicy.getSnapshot();
+            const tool = buildBuiltinTools({
+                ...builtinTools,
+                shell: resolveTurnShellPlan(policy.policy.shell),
+                ...(shellEnvironment ? { shellEnvironment } : {}),
+            }).find((candidate) => candidate.name === name);
+            if (!tool)
+                throw new Error(`Builtin capability is unavailable: ${name}`);
+            return tool.impl(args, invocation.toolContext);
+        };
+        pluginFilesystem.bindRuntime({
+            execute: (operation, invocation) => {
+                switch (operation.kind) {
+                    case 'read':
+                        return invokeBuiltin('Read', operation, invocation);
+                    case 'write':
+                        return invokeBuiltin('Write', operation, invocation);
+                    case 'edit':
+                        return invokeBuiltin('Edit', {
+                            path: operation.path,
+                            old_string: operation.oldString,
+                            new_string: operation.newString,
+                        }, invocation);
+                    case 'glob':
+                        return invokeBuiltin('Glob', { pattern: operation.pattern, cwd: operation.path }, invocation);
+                    case 'grep':
+                        return invokeBuiltin('Grep', { pattern: operation.pattern, path: operation.path, glob: operation.glob }, invocation);
+                    case 'apply_patch':
+                        return invokeBuiltin('apply_patch', operation.patch, invocation);
+                }
+            },
+        });
+        pluginShell.bindRuntime({
+            run: (options, invocation) => invokeBuiltin('Bash', {
+                command: options.command,
+                timeout_ms: options.timeoutMs,
+                run_in_background: options.background,
+                pty: options.pty,
+            }, invocation, options.environment),
+            read: (ref, invocation) => runtimeResources.readRuntimeResource(invocation.sessionId, ref, invocation.abortSignal),
+            write: (ref, input, invocation) => runtimeResources.writeStdin({
+                sessionId: invocation.sessionId,
+                ref,
+                input,
+                abortSignal: invocation.abortSignal,
+                caller: 'model',
+            }),
+            stop: (ref, invocation) => runtimeResources.stopBackgroundTask(invocation.sessionId, ref, invocation.abortSignal),
+        });
+        pluginAttachments.bindRuntime({
+            create: async (input, invocation) => {
+                const record = await openedArtifactStore.create({
+                    sessionId: invocation.sessionId,
+                    turnId: invocation.turnId,
+                    name: input.name,
+                    kind: pluginAttachmentArtifactKind(input.mimeType, input.name),
+                    content: input.content,
+                    mimeType: input.mimeType,
+                    source: 'tool_result',
+                    ...(input.summary ? { summary: input.summary } : {}),
+                });
+                return pluginAttachmentRef(record);
+            },
+            read: async (attachment, invocation) => {
+                if (attachment.ref.kind !== 'session_file' ||
+                    attachment.ref.sessionId !== invocation.sessionId) {
+                    throw new Error('Attachment is outside the current Session');
+                }
+                const result = await openedArtifactStore.readBinaryInSession(invocation.sessionId, attachment.ref.relativePath);
+                if (!result.ok)
+                    throw new Error(`Attachment read failed: ${result.reason}`);
+                return Uint8Array.from(Buffer.from(result.base64, 'base64'));
+            },
+            list: async (invocation) => (await openedArtifactStore.listTurnArtifacts(invocation.sessionId, invocation.turnId)).map(pluginAttachmentRef),
+        });
         const webSearchService = createHostWebSearchService({
             policy: runtimePolicyStores.operations,
         });
         const webFetchService = createHostWebFetchService({
             policy: runtimePolicyStores.operations,
         });
+        pluginWeb.bindRuntime({
+            search: ({ query, limit, abortSignal }) => webSearchService.search({ query, limit, ...(abortSignal ? { abortSignal } : {}) }),
+            fetch: (input) => webFetchService.fetch(input),
+        });
         const historyTools = buildHistoryTools({
             listSessions: () => requireSessionManager(manager).listSessions(),
             readMessages: async (sessionId, abortSignal) => {
@@ -303,7 +483,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         ];
         const hostTools = [...childHostTools, ...historyTools];
         const childAgentTools = createHostChildAgentToolComposition({
-            taskLedger,
             builtinTools,
             hostTools: childHostTools,
             worktreePatchWriteBackAvailable: true,
@@ -313,6 +492,13 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         let resolveAvailableToolNames;
         let resolveNewSessionToolNames;
         const hostChanges = new HostChangeFeed();
+        // Startup, once, in the background: the Host owns the model catalog, so it
+        // is the one process that gets to ask models.dev what is true today. On any
+        // failure the build's committed snapshot stands.
+        modelMetadataRefresh = startHostModelMetadataRefresh({
+            policy: runtimePolicyStores.operations,
+            publish: () => hostChanges.publishConnectionCatalog(),
+        });
         const projectMembership = new HostProjectMembershipGate();
         const workspaceResolver = new HostWorkspaceResolver(openedProjectCatalog, projectMembership, () => hostChanges.publishProjectCatalog());
         const skills = new HostSkillCatalogCoordinator(new SkillCatalogRepository({
@@ -321,8 +507,33 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         }), workspaceResolver, async (input, connection) => {
             if (input.target.kind === 'session') {
                 const sessionId = input.target.sessionId;
-                const header = await stores.sessionStore.readHeaderSnapshot(sessionId);
-                const preview = await requireClientCapabilities(clientCapabilities).runWithSessionBindingPreview(sessionId, connection.connectionId, () => requireToolNameResolver(resolveAvailableToolNames)(sessionId));
+                let header;
+                try {
+                    header = await stores.sessionStore.readHeaderSnapshot(sessionId);
+                }
+                catch (error) {
+                    if (isSessionNotFoundError(error)) {
+                        throw new SkillCatalogInvocableContextError('not_found', 'Session does not exist');
+                    }
+                    throw error;
+                }
+                if (header.isArchived) {
+                    throw new SkillCatalogInvocableContextError('session_archived', 'Session is archived');
+                }
+                let preview;
+                try {
+                    preview = await requireClientCapabilities(clientCapabilities).runWithSessionBindingPreview(sessionId, connection.connectionId, () => requireToolNameResolver(resolveAvailableToolNames)(sessionId));
+                }
+                catch (error) {
+                    if (isSessionNotFoundError(error)) {
+                        throw new SkillCatalogInvocableContextError('not_found', 'Session does not exist');
+                    }
+                    if (error instanceof AgentGraphClientOperationError &&
+                        error.code === 'session_archived') {
+                        throw new SkillCatalogInvocableContextError('session_archived', 'Session is archived');
+                    }
+                    throw error;
+                }
                 if (!preview.ok)
                     throw new Error(preview.message);
                 return {
@@ -340,16 +551,19 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             publish: (sessionId) => hostChanges.publishSessionCatalog(sessionId),
         }, projectMembership, context.requestDrain, new HostProjectDirectoryAuthority(options.projectDirectoryRoots));
         let rootCoordinator;
+        let workHubCoordination;
         let canonicalProjection;
         let memory;
         let clientCapabilities;
         let oauth;
+        let externalAgentSetup;
         let scheduledTasks;
         let scheduledTaskTool;
         let goal;
         let deepResearch;
         let dailyReview;
         const rootPort = {
+            readLatestRootTurnLineage: (identity) => requireRootCoordinator(rootCoordinator).readLatestRootTurnLineage(identity),
             readSessionHeader: (sessionId) => requireRootCoordinator(rootCoordinator).readSessionHeader(sessionId),
             readRootState: (sessionId) => requireRootCoordinator(rootCoordinator).readRootState(sessionId),
             claimStopFence: (input, commitQueueFence, admission) => requireRootCoordinator(rootCoordinator).claimStopFence(input, commitQueueFence, admission),
@@ -362,6 +576,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             hostEpoch: context.hostEpoch,
             root: rootPort,
             durableProof: {
+                readLogicalExecution: (identity) => readLogicalRuntimeExecutionForRun(stores.runtimeEventStore, identity),
                 readRootTurnSourceMessageReceipt: (sessionId, messageId) => stores.agentRunStore.readRootTurnSourceMessageReceipt(sessionId, messageId),
                 readImmutableSteeringMessageProof: (sessionId, messageId) => stores.runtimeEventStore.readImmutableSteeringMessageProof(sessionId, messageId),
             },
@@ -383,11 +598,15 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         const canonicalPermissionOutcomes = new HostCanonicalPermissionOutcomeReader({
             store: stores.interactionStore,
         });
-        continuity = new SessionContinuityCoordinator(context.hostEpoch, (sessionId) => canonicalProjectionReader.read(sessionId), sessionAdmission, context.requestDrain, createSessionTranscriptReader({ stores, canonicalPermissionOutcomes }), (sessionId) => hostChanges.publishSessionCatalog(sessionId), context.sessionAccessAuthority);
+        transcriptReader = createSessionTranscriptReader({
+            stores,
+            canonicalPermissionOutcomes,
+            ensureTranscriptLedger: (sessionId) => requireSessionManager(manager).ensureTranscriptLedgerForRead(sessionId),
+        });
+        continuity = new SessionContinuityCoordinator(context.hostEpoch, (sessionId) => canonicalProjectionReader.read(sessionId), sessionAdmission, context.requestDrain, transcriptReader, (sessionId) => hostChanges.publishSessionCatalog(sessionId), context.sessionAccessAuthority);
         const continuityCoordinator = continuity;
         unsubscribeTranscriptChanges = stores.sessionStore.subscribeTranscriptChanges((sessionId) => continuityCoordinator.enqueueCanonicalRefresh(sessionId));
         unsubscribeUsageChanges = openedUsageStores.subscribeSessionUsageChanges((sessionId) => continuityCoordinator.enqueueSessionDomainChanged(sessionId, 'usage'));
-        unsubscribeTaskLedger = taskLedger.subscribe(({ sessionId }) => continuityCoordinator.enqueueSessionDomainChanged(sessionId, 'task'));
         deepResearch = new HostDeepResearchCoordinator({
             store: openedDeepResearchStore,
             artifacts: openedArtifactStore,
@@ -405,7 +624,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 usage: openedUsageStores,
                 requestDrain: context.requestDrain,
             }),
-            acquireResidency: () => context.acquireResidency('daily-review'),
+            acquireResidency: (kind) => context.acquireResidency('daily-review', kind),
             requestDrain: context.requestDrain,
         });
         let poisonFailure;
@@ -413,6 +632,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         let recoveryTask;
         let rootCloseTask;
         let rootRecoveryCompleted = false;
+        let clientBoundRecovery = Promise.resolve();
         let closeTask;
         let backendInvalidationPoisoned = false;
         let domainModules;
@@ -438,7 +658,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     return;
                 poisonFailure = error;
                 context.retainUntilProcessExit();
-                beginDrain();
+                // Route poison through the kernel; the composition drain entry detaches admission.
                 context.requestDrain();
             },
             onSandboxBoundarySettled: (sessionId) => notifySandboxBoundaryGraphWake(sessionId, stores.sessionStore, {
@@ -461,8 +681,8 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 readSessionRuntimeEventEntries: (sessionId) => stores.runtimeEventStore.readSessionRuntimeEventEntries(sessionId),
             },
             historyCompaction: {
-                readLatestCheckpoint: (sessionId) => loadLatestHistoryCompactCheckpointFromRunLedger(stores.agentRunStore, sessionId),
-                readCheckpoints: (sessionId) => loadHistoryCompactCheckpointsFromRunLedger(stores.agentRunStore, sessionId),
+                readLatestCheckpoint: async (sessionId) => loadLatestHistoryCompactCheckpointFromRunLedger(stores.agentRunStore, sessionId, await sessionRunIds(stores.runtimeEventStore, sessionId)),
+                readCheckpoints: async (sessionId) => loadHistoryCompactCheckpointsFromRunLedger(stores.agentRunStore, sessionId, await sessionRunIds(stores.runtimeEventStore, sessionId)),
             },
             model: createHostMemoryExtractionModel({
                 runtimePolicy: runtimePolicyStores,
@@ -473,42 +693,64 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             lane: memoryExtractionLane,
             acquireResidency: () => context.acquireResidency('memory-extraction'),
         });
-        backends.register('ai-sdk', dependencies.primaryBackendFactory ??
-            ((backendContext) => createHostAiSdkBackend({
-                context: backendContext,
-                runtimePolicy: runtimePolicyStores,
-                oauthCredentials,
-                sandboxDiagnostics,
-                createRunComposer: createInteractiveRunComposerFactory({
-                    skills,
-                    memory: requireMemory(memory),
-                    taskLedger,
-                    clientCapabilities: requireClientCapabilities(clientCapabilities),
-                    resolveTavilyWebSearchReadiness: () => resolveHostTavilyWebSearchReadiness(runtimePolicyStores.operations),
-                    ...(scheduledTaskTool ? { scheduledTaskTool } : {}),
-                    planStore: openedPlanStore,
-                    deepResearchTools: requireDeepResearch(deepResearch).toolsForSession(backendContext.sessionId),
-                    goalTools: requireGoal(goal).tools,
-                    builtinTools,
-                    hostTools,
-                    resolveRootTools: (sessionId) => requireGraphCoordinator(graphCoordinator).toolsForSession(sessionId),
-                    parentAgentTools: childAgentTools.parentTools,
-                    childTools: childAgentTools.childTools,
-                    worktreePatchWriteBackAvailable: true,
-                }),
-                ...(hostedExecutionRunProfile(backendContext.header.toolProfile)?.memoryExtraction ===
-                    false
-                    ? {}
-                    : { memoryExtraction }),
-                artifacts: openedArtifactStore,
-                ...(openedContextOffloadReader ? { contextOffload: openedContextOffloadReader } : {}),
-                ...(storage.contextOffloadUnavailable ? { contextOffloadUnavailable: true } : {}),
-                executionArtifacts,
-                usage: openedUsageStores,
-                childAgents: bindHostChildAgentBackend(requireSessionManager(manager), backendContext.sessionId),
-                runtimeCommitSink: stores.runtimeEventStore,
-                requestDrain: context.requestDrain,
-            })));
+        const hostAiSdkBackendInput = (backendContext) => ({
+            context: backendContext,
+            runtimePolicy: runtimePolicyStores,
+            oauthCredentials,
+            createRunComposer: createInteractiveRunComposerFactory({
+                skills,
+                pluginSkills,
+                memory: requireMemory(memory),
+                sessionTodo,
+                clientCapabilities: requireClientCapabilities(clientCapabilities),
+                resolveTavilyWebSearchReadiness: () => resolveHostTavilyWebSearchReadiness(runtimePolicyStores.operations),
+                ...(scheduledTaskTool ? { scheduledTaskTool } : {}),
+                planStore: openedPlanStore,
+                deepResearchTools: requireDeepResearch(deepResearch).toolsForSession(backendContext.sessionId),
+                goalTools: requireGoal(goal).tools,
+                builtinTools,
+                hostTools,
+                resolveRootTools: (sessionId) => requireGraphCoordinator(graphCoordinator).toolsForSession(sessionId),
+                resolvePluginTools: (sessionId, coreTools) => pluginTools.resolveContributions(sessionId, coreTools),
+                resolvePluginSystemPrompt: async (sessionId, promptContext, baseText) => {
+                    const assembly = await pluginSystemPrompt.assemble({
+                        sessionId,
+                        turnId: promptContext.turnId,
+                        cwd: promptContext.cwd,
+                    }, baseText);
+                    return {
+                        text: assembly.text,
+                        contexts: assembly.contexts,
+                        sourceRevisions: assembly.sourceRevision ? [assembly.sourceRevision] : [],
+                    };
+                },
+                parentAgentTools: childAgentTools.parentTools,
+                childTools: childAgentTools.childTools,
+                worktreePatchWriteBackAvailable: true,
+                resolveProfileSystemPrompt: async (promptContext, basePrompt) => {
+                    if (promptContext.sessionId !== WORKHUB_COORDINATION_SESSION_ID)
+                        return basePrompt;
+                    const admission = await stores.agentRunStore.readRootTurnAdmission(promptContext.sessionId, promptContext.turnId);
+                    return bindWorkHubRoutingDecisionPrompt(basePrompt, admission?.execution.kind === 'workhub_coordination'
+                        ? admission.execution.routingDecision
+                        : undefined);
+                },
+            }),
+            ...(hostedExecutionRunProfile(backendContext.header.toolProfile)?.memoryExtraction === false
+                ? {}
+                : { memoryExtraction }),
+            artifacts: openedArtifactStore,
+            ...(openedContextOffloadReader ? { contextOffload: openedContextOffloadReader } : {}),
+            ...(storage.contextOffloadUnavailable ? { contextOffloadUnavailable: true } : {}),
+            executionArtifacts,
+            usage: openedUsageStores,
+            childAgents: bindHostChildAgentBackend(requireSessionManager(manager), backendContext.sessionId),
+            runtimeCommitSink: stores.runtimeEventStore,
+            requestDrain: context.requestDrain,
+        });
+        backends.register('ai-sdk', dependencies.primaryBackendFactory ?? {
+            prepare: (backendContext) => prepareHostAiSdkBackend(hostAiSdkBackendInput(backendContext)),
+        });
         const runtimeAuthority = {
             bindRun: (identity) => messages.bindRun(identity),
             executeRoot: (input) => executeHostedExecutionToSettlement(requireRootCoordinator(rootCoordinator), input),
@@ -544,7 +786,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     ...(input.boundTools ? { boundTools: input.boundTools } : {}),
                     ...(input.childTools ? { childTools: input.childTools } : {}),
                     ...(input.parentAgentTools ? { parentAgentTools: input.parentAgentTools } : {}),
-                    taskLedger,
                     worktreePatchWriteBackAvailable: true,
                     tavilyReady,
                 }),
@@ -594,7 +835,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     shell: resolveTurnShellPlan(runtimePolicy.policy.shell),
                     skills,
                     memory: requireMemory(memory),
-                    taskLedger,
+                    sessionTodo,
                     ...(runProfile ? { toolProfile: header.toolProfile } : {}),
                     ...(capabilitySnapshot ? { clientCapabilities: capabilitySnapshot } : {}),
                     builtinTools,
@@ -650,7 +891,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                         shell: resolveTurnShellPlan(runtimePolicy.policy.shell),
                         skills,
                         memory: requireMemory(memory),
-                        taskLedger,
+                        sessionTodo,
                         ...(capabilitySnapshot ? { clientCapabilities: capabilitySnapshot } : {}),
                         builtinTools,
                         hostTools: surface.hostTools,
@@ -673,6 +914,10 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 throw new Error(preview.message);
             return preview.value;
         };
+        const recapReadModel = new RuntimeReadModel({
+            runtimeEventStore: stores.runtimeEventStore,
+            canonicalPermissionOutcomes,
+        });
         const sessionEffectCoordinator = new HostSessionEffectCoordinator({
             model: createHostSessionEffectModel({
                 runtimePolicy: runtimePolicyStores,
@@ -680,12 +925,14 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 usage: openedUsageStores,
                 requestDrain: context.requestDrain,
             }),
-            readModel: new RuntimeReadModel({
-                runStore: stores.agentRunStore,
-                runtimeEventStore: stores.runtimeEventStore,
-                projectionCache: stores.sessionStore,
-                canonicalPermissionOutcomes,
-            }),
+            readModel: {
+                getSessionView: async (sessionId) => {
+                    // A Session whose transcript predates the ledger projects an empty
+                    // view, and a recap of nothing reads as a successful recap.
+                    await requireSessionManager(manager).ensureTranscriptLedgerForRead(sessionId);
+                    return recapReadModel.getSessionView(sessionId);
+                },
+            },
             artifacts: openedArtifactStore,
             sessions: stores.sessionStore,
             readSessionHeader: (sessionId) => stores.sessionStore.readHeaderSnapshot(sessionId),
@@ -700,7 +947,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             const header = await stores.sessionStore.readHeader(sessionId);
             const shell = resolveTurnShellPlan((await runtimePolicyStores.runtimePolicy.getSnapshot()).policy.shell);
             const childTools = createHostChildAgentToolComposition({
-                taskLedger,
                 builtinTools: { ...builtinTools, shell },
                 hostTools,
                 worktreePatchWriteBackAvailable: true,
@@ -737,7 +983,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     const [resourcesLive, graphLive, descendantLive] = await Promise.all([
                         runtimeResources.hasLiveSessionResources(sessionId),
                         graph.hasLiveSessionState(sessionId),
-                        hasLiveLinkedDescendantState(requireSessionManager(manager), stores.agentRunStore, sessionId, async (descendantSessionId) => (await runtimeResources.hasLiveSessionResources(descendantSessionId)) ||
+                        hasLiveLinkedDescendantState(requireSessionManager(manager), stores.runtimeEventStore, sessionId, async (descendantSessionId) => (await runtimeResources.hasLiveSessionResources(descendantSessionId)) ||
                             graph.hasLiveSessionState(descendantSessionId) ||
                             graphWake.hasLiveSessionState(descendantSessionId)),
                     ]);
@@ -762,17 +1008,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             resolveChildTools,
             worktreeChildExecutor,
             listArtifactsForTurn: (sessionId, turnId) => openedArtifactStore.listTurnArtifacts(sessionId, turnId),
-            publishChildWorkspacePatch: ({ sessionId, turnId, binding, patch }) => openedArtifactStore.create({
-                id: subagentWritebackArtifactId(sessionId, turnId),
-                sessionId,
-                turnId,
-                name: 'workspace.patch',
-                kind: 'diff',
-                content: patch,
-                mimeType: 'text/x-diff; charset=utf-8',
-                source: 'subagent_writeback',
-                summary: `Workspace changes relative to ${binding.baseCommit}.`,
-            }),
+            publishChildWorkspacePatch: executionArtifacts.publishChildWorkspacePatch,
             assertChildWorkspaceQuiescent: async (sessionId) => {
                 if (await runtimeResources.hasLiveSessionResources(sessionId)) {
                     throw new Error(`Child Session ${sessionId} still owns live Runtime Resources; patch publication requires a quiescent workspace`);
@@ -781,7 +1017,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         });
         graphCoordinator = new AgentGraphCoordinator({
             sessionStore: stores.sessionStore,
-            runStore: stores.agentRunStore,
             runtimeEventStore: stores.runtimeEventStore,
             controlStore: openedGraphControlStore,
             epochStore: openedGraphControlStore,
@@ -815,7 +1050,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             });
         };
         const registerBackendInvalidation = () => {
-            observeBackendInvalidation(manager.refreshIdleBackends());
+            observeBackendInvalidation(requireSessionManager(manager).refreshIdleBackends());
         };
         const registerConfigurationMutation = () => {
             hostChanges.publishConfiguration();
@@ -824,6 +1059,33 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         clientCapabilities = new HostClientCapabilityCoordinator({
             activation: runtimePolicyActivation,
             onModelToolsChanged: registerBackendInvalidation,
+            interactions,
+            grants: stores.interactionStore,
+        });
+        externalAgentSetup = new HostExternalAgentSetupCoordinator({
+            install: async (input) => {
+                const proxy = await runtimePolicyStores.operations.resolveNetworkProxyExecution({});
+                if (proxy.kind === 'credential_not_configured')
+                    throw new AcpSetupError('download_failed');
+                const transport = createProxiedFetchTransport(toRuntimePolicyProxy(proxy.networkProxy, proxy.secretMaterial.networkProxy?.secret));
+                try {
+                    return await installAntigravity({
+                        ...input,
+                        fetch: transport.fetch,
+                        directory: join(context.owner.capability.canonicalPath, 'external-agents', 'antigravity'),
+                    });
+                }
+                finally {
+                    await transport.close();
+                }
+            },
+            readPolicy: () => runtimePolicyStores.runtimePolicy.getSnapshot(),
+            acquireResidency: () => context.acquireResidency('external-agent-setup'),
+            onCleanupFailure: () => {
+                context.retainUntilProcessExit();
+                context.requestDrain();
+            },
+            capabilities: clientCapabilities,
         });
         oauth = new HostOAuthCoordinator({
             runtimePolicy: runtimePolicyStores,
@@ -834,7 +1096,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             acquireResidency: () => context.acquireResidency('oauth'),
             invalidateBackends: () => {
                 hostChanges.publishConfiguration();
-                return manager.refreshIdleBackends();
+                return requireSessionManager(manager).refreshIdleBackends();
             },
             onFatal: (error) => {
                 if (poisonFailure)
@@ -842,12 +1104,16 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 poisonFailure = error;
                 runtimePolicyActivation.poison();
                 context.retainUntilProcessExit();
-                beginDrain();
+                // Route poison through the kernel; the composition drain entry detaches admission.
                 context.requestDrain();
             },
             ...dependencies.oauthAuthorization,
         });
-        const usagePricing = new HostUsagePricingCoordinator(openedUsageStores, context.requestDrain, runtimePolicyActivation, registerBackendInvalidation);
+        const usagePricing = new HostUsagePricingCoordinator(openedUsageStores, context.requestDrain, runtimePolicyActivation, registerBackendInvalidation, 
+        // Name the Task column from the durable session header. Reads by id
+        // straight from the session store, so it also names reserved-role,
+        // coordination, and legacy sessions the filtered catalog omits.
+        async (sessionId) => (await stores.sessionStore.readHeaderSnapshot(sessionId)).name);
         const webSearch = new HostWebSearchCoordinator(webSearchService);
         const networkProxy = new HostNetworkProxyCoordinator(runtimePolicyStores.operations);
         const configuration = new HostConfigurationCoordinator(runtimePolicyStores.operations);
@@ -867,8 +1133,229 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         }, {
             currentGraphId: (rootSessionId) => requireGraphCoordinator(graphCoordinator).currentGraphId(rootSessionId),
             beginNextGraphEpoch: async (rootSessionId) => (await requireGraphCoordinator(graphCoordinator).beginNextGraphEpoch(rootSessionId, (operation) => requireGraphSupervisorWake(graphSupervisorWake).runWithSessionWakesSuppressed(rootSessionId, operation, 'agent_graph_epoch_advanced'))).graphId,
-        }, (input) => sessionEffectCoordinator.nameSessionFromRootMessage(input));
+        }, (input) => sessionEffectCoordinator.nameSessionFromRootMessage(input), context.owner.capability.rootId, dependencies.workHubRoutingModel
+            ? (input) => workHubCoordination.prepareRoutingDecision(input)
+            : undefined);
         const coordinator = rootCoordinator;
+        const pluginModel = createHostPluginModel({
+            runtimePolicy: runtimePolicyStores,
+            oauthCredentials,
+            usage: openedUsageStores,
+            requestDrain: context.requestDrain,
+            readSessionHeader: (sessionId) => stores.sessionStore.readHeaderSnapshot(sessionId),
+        });
+        pluginLlm.bindRuntime({
+            generate: (input, invocation) => pluginModel.generate({
+                sessionId: invocation.sessionId,
+                prompt: input.prompt,
+                ...(input.system ? { system: input.system } : {}),
+                ...(input.maxOutputTokens ? { maxOutputTokens: input.maxOutputTokens } : {}),
+                abortSignal: input.signal ?? invocation.abortSignal,
+            }),
+        });
+        const visibleAgentSessions = async (initiator) => {
+            const sessions = await manager.listSessions();
+            if (!initiator)
+                return [];
+            const visible = new Set([initiator.sessionId]);
+            let changed = true;
+            while (changed) {
+                changed = false;
+                for (const session of sessions) {
+                    if (!session.parentSessionId ||
+                        !visible.has(session.parentSessionId) ||
+                        visible.has(session.id))
+                        continue;
+                    visible.add(session.id);
+                    changed = true;
+                }
+            }
+            return sessions.filter((session) => visible.has(session.id));
+        };
+        const pluginSessionSummary = (session) => Object.freeze({
+            id: session.id,
+            ...(session.name ? { title: session.name } : {}),
+            ...(session.cwd ? { cwd: session.cwd } : {}),
+            ...(session.status ? { status: session.status } : {}),
+            ...(session.parentSessionId ? { parentSessionId: session.parentSessionId } : {}),
+            ...(session.statusUpdatedAt || session.lastMessageAt
+                ? { updatedAt: session.statusUpdatedAt ?? session.lastMessageAt }
+                : {}),
+        });
+        const sessionQueryInitiator = (caller) => caller.invocation ??
+            (caller.scopeSessionId ? Object.freeze({ sessionId: caller.scopeSessionId }) : undefined);
+        pluginSessionQuery.bindRuntime({
+            list: async (caller) => Object.freeze((await visibleAgentSessions(sessionQueryInitiator(caller))).map(pluginSessionSummary)),
+            read: async (sessionId, caller) => {
+                const session = (await visibleAgentSessions(sessionQueryInitiator(caller))).find(({ id }) => id === sessionId);
+                if (!session)
+                    return undefined;
+                return Object.freeze({
+                    session: pluginSessionSummary(session),
+                    messages: Object.freeze([
+                        ...(await requireSessionManager(manager).getMessages(sessionId)),
+                    ]),
+                });
+            },
+            search: async (request, caller) => {
+                const query = request.query.toLocaleLowerCase();
+                const sessions = await visibleAgentSessions(sessionQueryInitiator(caller));
+                const matches = [];
+                for (const session of sessions) {
+                    const headerText = `${session.name}\n${session.cwd ?? ''}`.toLocaleLowerCase();
+                    if (headerText.includes(query)) {
+                        matches.push(session);
+                        continue;
+                    }
+                    const messages = await requireSessionManager(manager).getMessages(session.id);
+                    if (messages.some((message) => JSON.stringify(message).toLocaleLowerCase().includes(query))) {
+                        matches.push(session);
+                    }
+                }
+                const offset = request.cursor ? Number.parseInt(request.cursor, 10) : 0;
+                if (!Number.isSafeInteger(offset) || offset < 0)
+                    throw new TypeError('Invalid Session query cursor');
+                const limit = request.limit ?? 20;
+                const page = matches.slice(offset, offset + limit);
+                return Object.freeze({
+                    items: Object.freeze(page.map(pluginSessionSummary)),
+                    ...(offset + page.length < matches.length
+                        ? { cursor: String(offset + page.length) }
+                        : {}),
+                });
+            },
+        });
+        const describeAgent = (session) => ({
+            id: session.id,
+            sessionId: session.id,
+            root: !session.parentSessionId,
+            status: session.runningTurnIds?.length ? 'running' : session.status,
+            ...(session.parentSessionId ? { ownerId: session.parentSessionId } : {}),
+        });
+        const submitAgentMessage = async (id, message, placement, initiator) => {
+            if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id)) {
+                throw new Error('Agent is outside the current ownership tree');
+            }
+            const content = normalizeMessageContent(typeof message === 'string' ? { text: message } : message);
+            const result = await messages.handlers['turn.message.submit']({
+                originHostEpoch: context.hostEpoch,
+                sessionId: id,
+                messageId: randomUUID(),
+                content,
+                placement,
+            }, {
+                hostEpoch: context.hostEpoch,
+                connectionId: 'plugin-agent',
+                principal: 'runtime_host',
+                acquireResidency: () => context.acquireResidency('plugin-agent'),
+            });
+            if (!result.ok)
+                throw new Error(result.error.message);
+            return result.result;
+        };
+        pluginAgents.bindRuntime({
+            create: async (options, initiator) => {
+                const spawn = initiator.toolContext?.spawnChildSession;
+                if (!spawn)
+                    throw new Error('Agent creation requires an active Tool invocation');
+                if (!options.prompt?.trim())
+                    throw new Error('Agent creation requires a prompt');
+                return new Promise((resolve, reject) => {
+                    void spawn({
+                        agentProfile: options.agentProfile ?? 'implementation',
+                        prompt: options.prompt,
+                        ...(options.signal ? { abortSignal: options.signal } : {}),
+                        onReady: (ready) => resolve({
+                            id: ready.childSessionId,
+                            sessionId: ready.childSessionId,
+                            root: false,
+                            status: 'running',
+                            ownerId: initiator.sessionId,
+                        }),
+                    }).catch(reject);
+                });
+            },
+            resume: async (options, initiator) => {
+                if (options.prompt)
+                    await submitAgentMessage(options.sessionId, options.prompt, 'next_turn', initiator);
+                const session = (await visibleAgentSessions(initiator)).find((item) => item.id === options.sessionId);
+                if (!session)
+                    throw new Error('Agent was not found');
+                return describeAgent(session);
+            },
+            get: async (id, initiator) => {
+                const session = (await visibleAgentSessions(initiator)).find((item) => item.id === id);
+                return session ? describeAgent(session) : undefined;
+            },
+            list: async (initiator) => (await visibleAgentSessions(initiator)).map(describeAgent),
+            roots: async (initiator) => (await visibleAgentSessions(initiator))
+                .filter((session) => !session.parentSessionId)
+                .map(describeAgent),
+            followup: (id, message, initiator) => submitAgentMessage(id, message, 'next_turn', initiator),
+            steer: (id, message, initiator) => submitAgentMessage(id, message, 'current_turn', initiator),
+            inject: (id, message, initiator) => submitAgentMessage(id, message, 'current_turn', initiator),
+            cancel: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id)) {
+                    throw new Error('Agent is outside the current ownership tree');
+                }
+                await coordinator.stopSession(id, { source: 'stop_button' });
+            },
+            whenIdle: async (id, signal, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id)) {
+                    throw new Error('Agent is outside the current ownership tree');
+                }
+                const wait = coordinator.whenIdle(id);
+                if (!wait)
+                    return;
+                if (!signal)
+                    return wait;
+                if (signal.aborted)
+                    throw signal.reason;
+                let rejectAbort;
+                const aborted = new Promise((_resolve, reject) => {
+                    rejectAbort = reject;
+                });
+                const onAbort = () => rejectAbort?.(signal.reason);
+                signal.addEventListener('abort', onAbort, { once: true });
+                try {
+                    await Promise.race([wait, aborted]);
+                }
+                finally {
+                    signal.removeEventListener('abort', onAbort);
+                }
+            },
+            snapshot: async (id, initiator) => {
+                const session = (await visibleAgentSessions(initiator)).find((item) => item.id === id);
+                if (!session)
+                    throw new Error('Agent was not found');
+                return { agent: describeAgent(session), root: coordinator.readRootState(id) };
+            },
+            inbox: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id))
+                    throw new Error('Agent was not found');
+                return coordinator.readRootState(id);
+            },
+            result: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id))
+                    throw new Error('Agent was not found');
+                return (await manager.getMessages(id)).at(-1);
+            },
+            artifacts: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id))
+                    throw new Error('Agent was not found');
+                return (await openedArtifactStore.listPage(id, { offset: 0, limit: 100 })).records;
+            },
+            transcript: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id))
+                    throw new Error('Agent was not found');
+                return manager.getMessages(id);
+            },
+            dispose: async (id, initiator) => {
+                if (!(await visibleAgentSessions(initiator)).some((session) => session.id === id))
+                    throw new Error('Agent was not found');
+                await coordinator.stopSession(id, { source: 'stop_button' });
+            },
+        });
         const contextOperations = new HostContextCoordinator({
             runtime: manager,
             executions: coordinator,
@@ -884,10 +1371,21 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             turns: stores.agentRunStore,
             runtime: manager,
         });
+        // Compile-time guarantee that the three Turn coordinators together cover
+        // every key in TURN_OPERATION_SPECS. Domain composition seeds all domain
+        // operations with the operation_unavailable fallback, so a Turn operation
+        // that no coordinator claims would otherwise be swept into that fallback
+        // silently; `satisfies` turns such an omission into a typecheck error here.
+        ({
+            ...turnControl.handlers,
+            ...interactiveTurns.handlers,
+            ...coordinator.handlers,
+        });
         const turnAccessRequests = context.sessionAccessAuthority
             ? new SessionTurnAccessRequestCoordinator({
                 authority: context.sessionAccessAuthority,
                 startTurn: interactiveTurns.handlers['turn.start'],
+                regenerateTurn: interactiveTurns.handlers['turn.regenerate'],
                 hostEpoch: context.hostEpoch,
                 acquireResidency: () => context.acquireResidency('collaboration-turn-request'),
                 requestDrain: context.requestDrain,
@@ -905,11 +1403,19 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             readSnapshot: (rootSessionId) => requireGraphCoordinator(graphCoordinator).getSnapshot(rootSessionId),
             startTurn: (sessionId, input, _activity, abortSignal, isCurrent) => graphExecutions.run(sessionId, input, abortSignal, isCurrent),
             inspectAttempt: async (rootSessionId, attemptId, turnId) => {
-                const runs = (await stores.agentRunStore.listSessionRuns(rootSessionId)).filter((run) => run.agentGraphWakeAttemptId === attemptId && run.turnId === turnId);
+                const runs = (await stores.runtimeEventStore.listSessionInvocations(rootSessionId)).filter((run) => {
+                    const root = run.opening.root;
+                    return (root.kind === 'agent_graph_supervisor_wake' &&
+                        root.attemptId === attemptId &&
+                        run.turnId === turnId);
+                });
                 if (runs.length > 1) {
                     throw new Error(`Agent graph supervisor wake attempt ${attemptId} has multiple AgentRuns`);
                 }
-                return runs[0]?.status ?? 'missing';
+                const attempt = runs[0];
+                if (!attempt)
+                    return 'missing';
+                return runtimeInvocationOutcome(attempt) ?? 'running';
             },
             recoverContextOverflow: (rootSessionId, { abortSignal }) => graphExecutions.recoverContextOverflow(rootSessionId, randomUUID(), abortSignal),
             shouldWake: shouldWakeAgentSwarmSupervisor,
@@ -938,6 +1444,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         goal = new HostGoalCoordinator({
             store: openedGoalStore,
             stores,
+            readSessionMessages: (sessionId) => requireSessionManager(manager).getMessages(sessionId),
             executions: coordinator,
             sessionAdmission,
             evaluator: createHostGoalEvaluator({
@@ -948,20 +1455,38 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 readSessionHeader: (sessionId) => stores.sessionStore.readHeaderSnapshot(sessionId),
             }),
             admitTurn: (sessionId, text, checkpoint, controlLease) => goalExecutionCoordinator.admitTurn(sessionId, text, checkpoint, controlLease),
-            listActionableTaskKeys: async (sessionId) => {
-                const tasks = await taskLedger.list(sessionId, {
-                    includeTerminal: false,
-                    includeArchived: false,
-                    classifyResumeTrust: true,
-                });
-                return filterModelVisibleTaskLedgerTasks(tasks)
-                    .filter((task) => task.status === 'pending' || task.status === 'in_progress')
-                    .map((task) => task.key);
-            },
-            acquireResidency: () => context.acquireResidency('goal'),
+            acquireResidency: (kind) => context.acquireResidency('goal', kind),
             onProjectionChanged: (sessionId) => continuityCoordinator.enqueueCanonicalRefresh(sessionId),
             requestDrain: context.requestDrain,
         });
+        pluginGoals.bindRuntime({
+            execute: async (operation, invocation) => {
+                const coordinator = requireGoal(goal);
+                if (operation.kind === 'get')
+                    return coordinator.readProjection(invocation.sessionId);
+                if (!invocation.toolContext)
+                    throw new Error('Goal mutation requires an active Tool invocation');
+                const toolName = operation.kind === 'create'
+                    ? 'GoalSet'
+                    : operation.kind === 'clear'
+                        ? 'GoalClear'
+                        : operation.kind === 'pause'
+                            ? 'GoalPause'
+                            : 'GoalResume';
+                const tool = coordinator.tools.find(({ name }) => name === toolName);
+                if (!tool)
+                    throw new Error(`Goal capability is unavailable: ${toolName}`);
+                const args = operation.kind === 'create'
+                    ? {
+                        condition: operation.objective,
+                        ...(operation.maxIterations ? { max_iterations: operation.maxIterations } : {}),
+                        ...(operation.blockCap ? { block_cap: operation.blockCap } : {}),
+                        ...(operation.tokenBudget ? { token_budget: operation.tokenBudget } : {}),
+                    }
+                    : {};
+                return await tool.impl(args, invocation.toolContext);
+            },
+        });
         async function applyRuntimePolicyMutationEffects() {
             try {
                 await requireMemory(memory).refreshAfterPolicyMutation();
@@ -980,6 +1505,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         });
         const sessionCatalog = new HostSessionCatalogCoordinator({
             stores: stores.sessionStore,
+            turnIndex: requireTranscriptReader(transcriptReader),
             runtimePolicy: runtimePolicyStores,
             manager,
             admission: sessionAdmission,
@@ -990,13 +1516,139 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 ? { sessionAccessAuthority: context.sessionAccessAuthority }
                 : {}),
         });
-        const workHubCoordination = new HostWorkHubCoordinationCoordinator({
+        workHubCoordination = new HostWorkHubCoordinationCoordinator({
+            routingModel: dependencies.workHubRoutingModel,
+            requestForm: (input) => interactions.requestForm(input),
+            configureModel: (input) => sessionCatalog.configureWorkHubModel(input),
+            transitionConfiguration: (input) => requireSessionManager(manager).transitionSessionConfiguration(WORKHUB_COORDINATION_SESSION_ID, input),
             stateRoot: context.owner.capability.canonicalPath,
             stores: stores.sessionStore,
             admission: sessionAdmission,
             continuity: continuityCoordinator,
             executions: coordinator,
             sessionActions: {
+                readDelegationRetirement: async (assignment, admission) => {
+                    const disposition = admission
+                        ? await messages.readMessageExecutionDispositionAdmitted(assignment.targetSessionId, assignment.targetMessageId, admission)
+                        : await messages.readMessageExecutionDisposition(assignment.targetSessionId, assignment.targetMessageId);
+                    if (disposition.kind === 'recovering')
+                        return 'recovering';
+                    if (disposition.kind === 'pending')
+                        return 'not_retired';
+                    if (disposition.kind === 'cancelled' || disposition.kind === 'shared_turn') {
+                        return 'retired';
+                    }
+                    const identity = {
+                        sessionId: assignment.targetSessionId,
+                        turnId: disposition.turnId,
+                        runId: disposition.runId,
+                    };
+                    const latest = await coordinator.readLatestRootTurnLineage(identity);
+                    if (isActiveWorkHubRoot(coordinator, latest))
+                        return 'not_retired';
+                    // The same restart window as `stopOwnedWorkHubRoot`: an unregistered
+                    // root is not evidence that its work ended.
+                    const snapshot = await coordinator.read(latest);
+                    return isHostedExecutionTerminal(snapshot) ? 'retired' : 'recovering';
+                },
+                // Resolve and resume only the execution lineage owned by this
+                // delegation. A Session-wide latest-failure query could otherwise
+                // continue unrelated work started directly in the same Session.
+                resumeDelegation: async (assignment, context, actionId, validateFreshTarget) => {
+                    const targetTurnId = workHubResumedTurnId(actionId);
+                    const admitted = await stores.agentRunStore.readRootTurnAdmission(assignment.targetSessionId, targetTurnId);
+                    if (admitted) {
+                        if (admitted.execution.kind !== 'safe_boundary_continuation') {
+                            throw new WorkHubActionEffectFailure('operation_conflict', 'WorkHub resume identity is not a continuation');
+                        }
+                        return { outcome: 'resume_started', targetTurnId };
+                    }
+                    await validateFreshTarget();
+                    const disposition = await messages.readMessageExecutionDisposition(assignment.targetSessionId, assignment.targetMessageId);
+                    if (disposition.kind === 'recovering') {
+                        throw new WorkHubActionEffectFailure('host_not_ready', 'WorkHub is still recovering the delegated execution');
+                    }
+                    if (disposition.kind !== 'owned_root') {
+                        throw new WorkHubActionEffectFailure('operation_conflict', 'WorkHub delegated execution is not resumable');
+                    }
+                    const source = await coordinator.readLatestRootTurnLineage({
+                        sessionId: assignment.targetSessionId,
+                        turnId: disposition.turnId,
+                        runId: disposition.runId,
+                    });
+                    if (isActiveWorkHubRoot(coordinator, source)) {
+                        return { outcome: 'already_running' };
+                    }
+                    const snapshot = await coordinator.read(source);
+                    if (!isHostedExecutionTerminal(snapshot)) {
+                        throw new WorkHubActionEffectFailure('host_not_ready', 'WorkHub is still recovering the delegated execution');
+                    }
+                    if (snapshot.status !== 'failed' && snapshot.status !== 'cancelled') {
+                        throw new WorkHubActionEffectFailure('operation_conflict', 'WorkHub delegated execution is not resumable');
+                    }
+                    const plan = await coordinator.handlers['turn.resume.query']({ sessionId: assignment.targetSessionId, sourceRunId: source.runId }, context);
+                    if (!plan.ok)
+                        throw new WorkHubActionEffectFailure(plan.error.code, plan.error.message);
+                    if (plan.result.disposition === 'parked') {
+                        throw new WorkHubActionEffectFailure(plan.result.reason === 'resume_feature_disabled'
+                            ? 'operation_unavailable'
+                            : 'operation_conflict', plan.result.reason === 'resume_feature_disabled'
+                            ? 'Safe-boundary resume is disabled for this Runtime Host'
+                            : 'WorkHub delegated execution is not resumable');
+                    }
+                    // Root planning authenticates handoff membership. Its source may be
+                    // a physical successor of this same logical Turn, never another Turn.
+                    if (plan.result.sourceTurnId !== source.turnId) {
+                        throw new WorkHubActionEffectFailure('operation_conflict', 'WorkHub resume source lineage changed during planning');
+                    }
+                    const started = await coordinator.handlers['turn.resume.start']({
+                        sessionId: assignment.targetSessionId,
+                        turnId: targetTurnId,
+                        sourceRunId: plan.result.sourceRunId,
+                        sourceRuntimeEventHighWater: plan.result.sourceRuntimeEventHighWater,
+                    }, context);
+                    if (!started.ok) {
+                        throw new WorkHubActionEffectFailure(started.error.code, started.error.message);
+                    }
+                    if (started.result.kind === 'parked') {
+                        throw new WorkHubActionEffectFailure(started.result.plan.reason === 'resume_feature_disabled'
+                            ? 'operation_unavailable'
+                            : 'operation_conflict', started.result.plan.reason === 'resume_feature_disabled'
+                            ? 'Safe-boundary resume is disabled for this Runtime Host'
+                            : 'WorkHub delegated execution is not resumable');
+                    }
+                    return {
+                        outcome: 'resume_started',
+                        targetTurnId: started.result.turn.turnId,
+                    };
+                },
+                retireDelegation: async (assignment, retirement) => {
+                    const disposition = await messages.cancelMessageIfPending(assignment.targetSessionId, assignment.targetMessageId, retirement.cancellationClaimId);
+                    if (disposition.kind === 'recovering') {
+                        return { outcome: 'recovering' };
+                    }
+                    if (disposition.kind === 'cancelled') {
+                        return { outcome: 'already_terminal' };
+                    }
+                    if (disposition.kind === 'cancelled_pending') {
+                        return { outcome: 'cancelled_pending' };
+                    }
+                    if (disposition.kind === 'shared_turn') {
+                        return { outcome: 'not_owned', targetTurnId: disposition.turnId };
+                    }
+                    if (disposition.kind === 'owned_root') {
+                        const identity = await coordinator.readLatestRootTurnLineage({
+                            sessionId: assignment.targetSessionId,
+                            turnId: disposition.turnId,
+                            runId: disposition.runId,
+                        });
+                        return retirement.cause === 'direct_stop'
+                            ? stopOwnedWorkHubRoot(coordinator, identity, retirement.cancellationClaimId)
+                            : stopReplacedWorkHubRoot(coordinator, identity);
+                    }
+                    disposition;
+                    throw new Error('Unhandled WorkHub Message retirement disposition');
+                },
                 assign: async (input) => {
                     const durable = await stores.sessionStore.readWorkHubAssignment(input.actionId);
                     if (durable) {
@@ -1007,7 +1659,17 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                             sessionId: input.targetSessionId,
                             workspace: input.create.workspace,
                             name: input.create.title,
-                            modelTarget: { kind: 'default' },
+                            modelTarget: input.create.defaults?.model
+                                ? {
+                                    kind: 'explicit',
+                                    connectionId: input.create.defaults.model.llmConnectionId,
+                                    connectionSlug: input.create.defaults.model.llmConnectionSlug,
+                                    model: input.create.defaults.model.model,
+                                }
+                                : { kind: 'default' },
+                            ...(input.create.defaults?.permissionMode
+                                ? { permissionMode: input.create.defaults.permissionMode }
+                                : {}),
                             collaborationMode: 'agent',
                             orchestrationMode: 'default',
                         })
@@ -1017,9 +1679,18 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                         .digest('hex')
                         .slice(0, 48);
                     const messageId = `whm_${suffix}`;
-                    const content = normalizeMessageContent({ text: input.userText });
+                    const targetAttachments = durable
+                        ? durable.targetAttachments
+                        : input.attachments?.length
+                            ? await copyWorkHubAttachmentsToTarget(openedArtifactStore, artifacts, input.targetSessionId, input.attachments)
+                            : input.attachments;
+                    const content = normalizeMessageContent({
+                        text: input.delegationText ?? input.userText,
+                        ...(targetAttachments ? { attachments: targetAttachments } : {}),
+                    });
                     const persisted = durable ??
                         (await sessionAdmission.runMany([WORKHUB_COORDINATION_SESSION_ID, input.targetSessionId], async (lease) => {
+                            await input.validateFreshTarget?.();
                             const rootState = coordinator.readRootState(input.targetSessionId);
                             if (!create && rootState.kind === 'reserved') {
                                 throw new WorkHubActionEffectFailure('session_busy', 'A target root Turn is being admitted');
@@ -1028,26 +1699,59 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                             const turnId = steered ? rootState.turnId : `wht_${suffix}`;
                             const runId = steered ? rootState.runId : `whr_${suffix}`;
                             const assignedAt = Date.now();
+                            const delegationId = `whd_${suffix}`;
+                            const supersession = input.replacesActionId && input.replacesDelegationId
+                                ? {
+                                    type: 'workhub_coordination',
+                                    id: `whx_${createHash('sha256')
+                                        .update(input.replacesDelegationId, 'utf8')
+                                        .digest('hex')
+                                        .slice(0, 48)}`,
+                                    turnId: input.coordinationTurnId ?? input.actionId,
+                                    ts: assignedAt,
+                                    schemaVersion: WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION,
+                                    kind: 'delegation_superseded',
+                                    actionId: input.actionId,
+                                    actionFingerprint: input.actionFingerprint,
+                                    coordinationTurnId: input.coordinationTurnId ?? input.actionId,
+                                    supersededActionId: input.replacesActionId,
+                                    supersededDelegationId: input.replacesDelegationId,
+                                    replacementDelegationId: delegationId,
+                                }
+                                : undefined;
                             const result = await stores.sessionStore.assignWorkHubMessage({
                                 assignment: {
                                     type: 'workhub_coordination',
                                     id: `wha_${suffix}`,
-                                    turnId: input.actionId,
+                                    turnId: input.coordinationTurnId ?? input.actionId,
                                     ts: assignedAt,
-                                    schemaVersion: 1,
+                                    schemaVersion: supersession
+                                        ? WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION
+                                        : 1,
                                     kind: 'delegation_assigned',
                                     actionId: input.actionId,
                                     actionFingerprint: input.actionFingerprint,
-                                    coordinationTurnId: input.actionId,
+                                    coordinationTurnId: input.coordinationTurnId ?? input.actionId,
                                     targetSessionId: input.targetSessionId,
                                     targetSessionName: input.targetSessionName,
                                     targetTurnId: turnId,
                                     targetMessageId: messageId,
-                                    delegationId: `whd_${suffix}`,
+                                    delegationId,
                                     disposition: input.disposition,
                                     userText: input.userText,
+                                    ...(input.attachments ? { attachments: input.attachments } : {}),
+                                    ...(targetAttachments ? { targetAttachments } : {}),
+                                    ...(input.delegationText === undefined
+                                        ? {}
+                                        : { delegationText: input.delegationText }),
                                     ...(steered ? { steered: true } : {}),
                                     ...(input.create ? { create: input.create } : {}),
+                                    ...(input.replacesActionId && input.replacesDelegationId
+                                        ? {
+                                            replacesActionId: input.replacesActionId,
+                                            replacesDelegationId: input.replacesDelegationId,
+                                        }
+                                        : {}),
                                 },
                                 admission: {
                                     sessionId: input.targetSessionId,
@@ -1059,9 +1763,11 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                                     submittedPlacement: 'current_turn',
                                     placement: 'current_turn',
                                     disposition: 'steering',
+                                    skillInvocation: { loaded: [], failed: [], receipts: [] },
                                     admittedAt: assignedAt,
                                 },
                                 ...(create ? { create } : {}),
+                                ...(supersession ? { supersession } : {}),
                             });
                             // Keep the durable steering identity and its live queue owner
                             // under one Session admission. A terminal transition must not
@@ -1084,7 +1790,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 },
             },
             resolveCreateTarget: async () => {
-                const { projectId: _projectId, ...target } = await sessionCatalog.resolveExternalSessionImportTarget();
+                const { projectId: _projectId, ...target } = await sessionCatalog.resolveDefaultCreateTarget();
                 return { ...target, permissionMode: 'explore' };
             },
             requestDrain: context.requestDrain,
@@ -1096,14 +1802,23 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             root: coordinator,
             runtimePolicy: runtimePolicyStores,
             nativeEffects: clientCapabilities,
-            createSession: (input) => sessionCatalog.createForHost(input),
+            createSession: (input, toolMode) => sessionCatalog.createForHost(input, toolMode),
             changes: {
                 publish: (revision, reason, taskId) => hostChanges.publishScheduledTask(revision, reason, taskId),
             },
-            acquireResidency: () => context.acquireResidency('scheduled-task'),
+            acquireResidency: (kind) => context.acquireResidency('scheduled-task', kind),
             requestDrain: context.requestDrain,
         });
         scheduledTaskTool = scheduledTasks.modelTool;
+        // Export and import run inside this process because the authority they
+        // need is already held here: the Storage Root owner lock is an election
+        // that refuses a second exclusive hold, its own process included, so the
+        // Host lends the lease rather than electing again.
+        const sessionBundles = new HostSessionBundleCoordinator({
+            lease: context.owner.lease,
+            fenceSubtree: (sessionId, operation) => requireSessionManager(manager).runSessionSubtreeQuiescentMutation(sessionId, operation),
+            onImported: (sessionId) => hostChanges.publishSessionCatalog(sessionId),
+        });
         const externalSessions = new HostExternalSessionCoordinator({
             adapters: createExternalSessionAdapterRegistry(),
             admission: sessionAdmission,
@@ -1114,6 +1829,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             discardImportedSession: async (sessionId) => {
                 const outcomes = await Promise.allSettled([
                     stores.purgeConversationOperationalState(sessionId),
+                    sessionTodoStore.purgeSessionState(sessionId),
                     stores.sessionStore.remove(sessionId),
                 ]);
                 for (const outcome of outcomes) {
@@ -1138,7 +1854,8 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         const sessionRevisions = new HostSessionRevisionCoordinator({
             stores,
             artifacts: openedArtifactStore,
-            taskLedger: taskLedgerStore,
+            sessionTodo: sessionTodoStore,
+            ...(contextOffloadAuthority ? { contextOffload: contextOffloadAuthority } : {}),
             manager,
             admission: sessionAdmission,
             continuity: continuityCoordinator,
@@ -1162,19 +1879,8 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             capabilities: clientCapabilities,
             continuity: continuityCoordinator,
             artifacts: openedArtifactStore,
-            taskLedger: taskLedgerStore,
-            assertNoContextOffloadReferences: async (sessionIds) => {
-                if (!openedContextOffloadStore) {
-                    throw new Error('Context-offload reader is unavailable during Session removal', {
-                        cause: storage.contextOffloadUnavailable?.cause,
-                    });
-                }
-                for (const sessionId of sessionIds) {
-                    if ((await openedContextOffloadStore.usage(sessionId)).references > 0) {
-                        throw new SessionMetadataConflictError('Session removal does not support Session context references yet');
-                    }
-                }
-            },
+            sessionTodo: sessionTodoStore,
+            ...(contextOffloadAuthority ? { contextOffload: contextOffloadAuthority } : {}),
             purgeOperationalState: async (sessionId) => {
                 await stores.purgeConversationOperationalState(sessionId);
                 await openedPlanStore.purgeSessionState(sessionId);
@@ -1220,7 +1926,24 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         });
         const hostedExecutions = new HostHostedExecutionCoordinator((input, signal) => hostedExecutionRunner.run(input, signal), context.requestDrain);
         let recoverySessions = [];
+        const storageMaintenance = new HostStorageMaintenance({
+            artifacts: openedArtifactStore,
+            contextOffload: openedContextOffloadStore,
+            onError: (name, error) => console.error(`[runtime-host] ${name} will retry: ${generalizedErrorMessage(error)}`),
+        });
         domainModules = [
+            createRuntimeHostDomainModule({
+                id: 'storage-maintenance',
+                drain: [() => storageMaintenance.beginDrain()],
+                close: [() => storageMaintenance.close()],
+            }),
+            createRuntimeHostDomainModule({
+                id: 'plugin-platform',
+                handlers: [pluginPlatformCoordinator.handlers],
+                recovery: { state: () => pluginPlatform.recover() },
+                drain: [() => pluginPlatform.beginDrain()],
+                close: [() => pluginPlatform.close()],
+            }),
             createRuntimeHostDomainModule({
                 id: 'memory',
                 handlers: [requireMemory(memory).handlers],
@@ -1243,7 +1966,12 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             }),
             createRuntimeHostDomainModule({
                 id: 'session',
-                handlers: [sessionCatalog.handlers, externalSessions.handlers, sessionRevisions.handlers],
+                handlers: [
+                    sessionCatalog.handlers,
+                    externalSessions.handlers,
+                    sessionBundles.handlers,
+                    sessionRevisions.handlers,
+                ],
                 recovery: {
                     state: () => externalSessions.recover(),
                     resources: async () => {
@@ -1265,42 +1993,76 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 handlers: [
                     runtimePolicy.handlers,
                     connectionEffects.handlers,
-                    taskLedger.handlers,
+                    sessionTodo.handlers,
                     artifacts.handlers,
                     skills.handlers,
                     usagePricing.handlers,
                     oauth.handlers,
+                    externalAgentSetup.handlers,
                     webSearch.handlers,
                     networkProxy.handlers,
                     configuration.handlers,
                 ],
                 recovery: {
-                    state: async () => {
-                        await skills.recover();
-                        await openedArtifactStore.recover();
-                    },
+                    state: () => skills.recover(),
                 },
                 drain: [
                     () => connectionEffects.beginDrain(),
                     () => skills.beginDrain(),
                     () => oauth?.beginDrain(),
+                    () => externalAgentSetup?.beginDrain(),
                 ],
                 close: [
+                    () => archiveEvidence?.close(),
+                    () => modelMetadataRefresh?.close(),
                     () => connectionEffects.close(),
-                    () => (backendInvalidationPoisoned ? undefined : manager.refreshIdleBackends()),
+                    () => backendInvalidationPoisoned
+                        ? undefined
+                        : requireSessionManager(manager).refreshIdleBackends(),
                     () => skills.close(),
                     () => oauth?.close(),
+                    () => externalAgentSetup?.close(),
                     () => {
                         unsubscribeTranscriptChanges?.();
                         unsubscribeUsageChanges?.();
-                        unsubscribeTaskLedger?.();
                     },
                 ],
-                releaseConnection: [(connectionId) => artifacts.releaseConnection(connectionId)],
+                releaseConnection: [
+                    (connectionId) => artifacts.releaseConnection(connectionId),
+                    (connectionId) => externalAgentSetup?.releaseConnection(connectionId),
+                ],
             }),
             createRuntimeHostDomainModule({
                 id: 'client-capability',
-                handlers: [clientCapabilities.handlers],
+                handlers: [
+                    {
+                        ...clientCapabilities.handlers,
+                        'client.capability.replace': async (input, operationContext) => {
+                            const outcome = await clientCapabilities.handlers['client.capability.replace'](input, operationContext);
+                            if (outcome.ok && rootRecoveryCompleted && !draining) {
+                                // Registration completes outside the policy mutation gate before
+                                // recovery selects bindings or composes a backend. Serialize
+                                // reconnects and retain the task for the shutdown barrier.
+                                clientBoundRecovery = clientBoundRecovery.then(async () => {
+                                    if (draining)
+                                        return;
+                                    await coordinator.recover();
+                                    await messages.consumePendingAdmissions(recoverySessions
+                                        .filter((session) => session.toolProfile === 'workhub-coordination-v2')
+                                        .map((session) => session.id));
+                                });
+                                try {
+                                    await clientBoundRecovery;
+                                }
+                                catch (error) {
+                                    context.requestDrain();
+                                    throw error;
+                                }
+                            }
+                            return outcome;
+                        },
+                    },
+                ],
                 recovery: {
                     resources: async () => {
                         await recoverClientCapabilityOutcomes(stores.runtimeEventStore, recoverySessions.map((session) => session.id));
@@ -1353,8 +2115,8 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     executions: async () => {
                         await coordinator.prepareRecovery();
                         await interactions.recoverPendingAfterHostRestart();
-                        await manager.recoverInterruptedSessionsStrict(stores);
-                        await manager.recoverChildWorkspacePatches(recoverySessions.flatMap((session) => session.subagentWorkspace ? [session.id] : []));
+                        await requireSessionManager(manager).recoverInterruptedSessionsStrict(stores);
+                        await requireSessionManager(manager).recoverChildWorkspacePatches(recoverySessions.flatMap((session) => session.subagentWorkspace ? [session.id] : []));
                         await coordinator.recover();
                         await messages.recoverPendingAfterHostRestart(recoverySessions.map((session) => session.id));
                         await turnAccessRequests?.recover();
@@ -1374,6 +2136,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     async () => {
                         if (!rootRecoveryCompleted || poisonFailure)
                             return;
+                        await clientBoundRecovery.catch(() => undefined);
                         rootCloseTask ??= coordinator.close();
                         await rootCloseTask;
                     },
@@ -1470,20 +2233,98 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             handlers,
             moduleIds: Object.freeze(domainModules.map(({ id }) => id)),
             workspaceExecution: requireWorkspaceExecution(workspaceExecution),
+            plugins: pluginPlatform,
             continuity: continuityCoordinator,
             clientCapabilities,
             hostChanges,
+            prepareHandoff: async (hostEpoch, signal) => {
+                if (draining || signal.aborted)
+                    return undefined;
+                const goalHold = goal?.holdForHandoff();
+                const scheduleHold = scheduledTasks?.holdForHandoff();
+                const dailyReviewHold = dailyReview?.holdForHandoff();
+                let root;
+                let detached = false;
+                const cancel = () => {
+                    if (detached)
+                        return;
+                    root?.cancel();
+                    goalHold?.release();
+                    scheduleHold?.release();
+                    dailyReviewHold?.release();
+                    signal.removeEventListener('abort', cancel);
+                };
+                signal.addEventListener('abort', cancel, { once: true });
+                try {
+                    if (!goalHold || !scheduleHold || !dailyReviewHold) {
+                        cancel();
+                        return undefined;
+                    }
+                    await waitForHostedExecutionIdleOrAbort(Promise.all([
+                        goalHold.settled(),
+                        scheduleHold.settled(),
+                        dailyReviewHold.settled(),
+                    ]).then(() => undefined), signal);
+                    root = await requireRootCoordinator(coordinator).prepareHandoff(hostEpoch, signal);
+                    if (!root) {
+                        cancel();
+                        return undefined;
+                    }
+                    const prepared = root;
+                    return {
+                        seal: () => prepared.seal(),
+                        residencies: async () => {
+                            await waitForHostedExecutionIdleOrAbort(scheduleHold.settled(), signal);
+                            const goals = await goalHold.residencies(prepared.executions);
+                            const roots = await prepared.residencies();
+                            const reviews = dailyReviewHold.residencies();
+                            if (!goals || !roots || !reviews || signal.aborted || draining)
+                                return undefined;
+                            return [...roots, ...goals, ...scheduleHold.residencies(), ...reviews];
+                        },
+                        detach: async () => {
+                            detached = true;
+                            signal.removeEventListener('abort', cancel);
+                            await prepared.detach();
+                            // Domain holds stay closed until the lifecycle owner drains us.
+                        },
+                        cancel,
+                    };
+                }
+                catch (error) {
+                    cancel();
+                    if (signal.aborted)
+                        return undefined;
+                    throw error;
+                }
+            },
             releaseConnection: (connectionId) => {
                 for (const module of domainModules)
                     module.releaseConnection?.(connectionId);
             },
-            beginDrain,
+            // Drain may stop graph operators while its caller still owns a Session admission.
+            // Leave that context; each stop still waits on its own Session queue.
+            beginDrain: () => sessionAdmission.detach(beginDrain),
             recover,
+            startMaintenance: () => storageMaintenance.start(),
             close,
         };
     }
     catch (error) {
         const errors = [error];
+        archiveEvidence?.close();
+        try {
+            await modelMetadataRefresh?.close();
+        }
+        catch (closeError) {
+            errors.push(closeError);
+        }
+        try {
+            await pluginPlatform?.close();
+        }
+        catch (closeError) {
+            errors.push(closeError);
+        }
         goalExecutions?.beginDrain();
         try {
             await workspaceExecution?.close();
@@ -1512,7 +2353,6 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         try {
             unsubscribeTranscriptChanges?.();
             unsubscribeUsageChanges?.();
-            unsubscribeTaskLedger?.();
         }
         catch (closeError) {
             errors.push(closeError);
@@ -1534,6 +2374,51 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         throw new AggregateError(errors, 'Unable to clean up Runtime Host execution composition');
     }
 }
+/**
+ * Confirmed direct stop. The action-derived abort source is written onto the
+ * exact root Turn so a retry after a crash can tell WorkHub's own delivery
+ * apart from an earlier or concurrent manual Stop.
+ */
+export async function stopOwnedWorkHubRoot(coordinator, identity, actionId) {
+    if (isActiveWorkHubRoot(coordinator, identity)) {
+        await coordinator.stopRoot(identity, {
+            source: 'workhub_direct_stop',
+            workHubActionId: actionId,
+        });
+    }
+    const terminal = await coordinator.read(identity);
+    if (terminal.status === 'cancelled' &&
+        terminal.abortSource === workHubDirectStopAbortSource(actionId)) {
+        return { outcome: 'stop_delivered', targetTurnId: identity.turnId };
+    }
+    // Registration is in-memory, so between Host restart and execution recovery
+    // this root looks inactive while it is still running. `already_terminal` is
+    // committed as an immutable fact, so only a durably terminal snapshot may
+    // claim it; anything else is still resolving.
+    return isHostedExecutionTerminal(terminal)
+        ? { outcome: 'already_terminal', targetTurnId: identity.turnId }
+        : { outcome: 'recovering', targetTurnId: identity.turnId };
+}
+/**
+ * Route correction retiring the root it is replacing. It carries its own
+ * cancellation claim, but it is not a direct stop: recording direct-stop
+ * provenance here would let replay mistake a correction for one, so the
+ * retirement keeps the neutral Stop source ordinary supersession has always
+ * used.
+ */
+export async function stopReplacedWorkHubRoot(coordinator, identity) {
+    if (!isActiveWorkHubRoot(coordinator, identity)) {
+        return { outcome: 'already_terminal', targetTurnId: identity.turnId };
+    }
+    await coordinator.stopRoot(identity);
+    return { outcome: 'stop_delivered', targetTurnId: identity.turnId };
+}
+function isActiveWorkHubRoot(coordinator, identity) {
+    const rootState = coordinator.readRootState(identity.sessionId);
+    return (rootState.kind === 'active' &&
+        rootState.turnId === identity.turnId &&
+        rootState.runId === identity.runId);
+}
 function sessionExecutionConnectionRef(header) {
     return header.llmConnectionId === undefined
         ? { kind: 'catalog_slug', connectionSlug: header.llmConnectionSlug }
@@ -1574,16 +2459,6 @@ function adaptWorkspaceFilesystemWorker(worker) {
         },
     };
 }
-function subagentWritebackArtifactId(sessionId, turnId) {
-    const digest = createHash('sha256')
-        .update('maka-subagent-writeback-v1\0')
-        .update(sessionId)
-        .update('\0')
-        .update(turnId)
-        .digest('hex')
-        .slice(0, 32);
-    return `subagent_writeback_${digest}`;
-}
 function requireContinuity(continuity) {
     if (!continuity)
         throw new Error('Runtime Host continuity coordinator is not composed');
@@ -1634,6 +2509,11 @@ function requireSessionManager(manager) {
         throw new Error('Runtime Host SessionManager is not composed');
     return manager;
 }
+function requireTranscriptReader(reader) {
+    if (!reader)
+        throw new Error('Runtime Host transcript reader is not composed');
+    return reader;
+}
 function requireGraphCoordinator(coordinator) {
     if (!coordinator)
         throw new Error('Runtime Host Agent Graph coordinator is not composed');
@@ -1655,7 +2535,29 @@ function requireGoal(coordinator) {
         throw new Error('Runtime Host Goal coordinator is not composed');
     return coordinator;
 }
-async function hasLiveLinkedDescendantState(manager, runStore, rootSessionId, hasLiveSessionState) {
+function pluginAttachmentArtifactKind(mimeType, name) {
+    const kind = attachmentKindFromMimeType(mimeType, name);
+    return kind === 'image' || kind === 'pdf' ? kind : 'file';
+}
+function pluginAttachmentRef(record) {
+    const mimeType = record.mimeType ?? 'application/octet-stream';
+    return {
+        kind: attachmentKindFromMimeType(mimeType, record.name),
+        name: record.name,
+        mimeType,
+        bytes: record.sizeBytes,
+        ref: {
+            kind: 'session_file',
+            sessionId: record.sessionId,
+            relativePath: record.relativePath,
+        },
+    };
+}
+/** Every run this Session has opened, named by the event spine that defines it. */
+async function sessionRunIds(runtimeEventStore, sessionId) {
+    return (await runtimeEventStore.listSessionInvocations(sessionId)).map((invocation) => invocation.runId);
+}
+async function hasLiveLinkedDescendantState(manager, runtimeEventStore, rootSessionId, hasLiveSessionState) {
     const pending = [rootSessionId];
     const seen = new Set(pending);
     while (pending.length > 0) {
@@ -1667,16 +2569,14 @@ async function hasLiveLinkedDescendantState(manager, runStore, rootSessionId, ha
             seen.add(child.id);
             pending.push(child.id);
             const [runs, liveState] = await Promise.all([
-                runStore.listSessionRuns(child.id),
+                runtimeEventStore.listSessionInvocations(child.id),
                 hasLiveSessionState(child.id),
             ]);
             if (liveState)
                 return true;
-            if (runs.some((run) => run.status === 'created' ||
-                run.status === 'running' ||
-                run.status === 'waiting_for_user')) {
+            // A run whose events never closed it is still live.
+            if (runs.some((run) => runtimeInvocationOutcome(run) === undefined))
                 return true;
-            }
         }
     }
     return false;