maka-agent 0.2.0-dev.4.20260830 → 0.2.0-dev.41.20260918

package/node_modules/@maka/runtime/dist/runtime-kernel.js

@@ -16,25 +16,29 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { agentRunCompositionFromEvents } from '@maka/core/agent-run';
 import { decodeRuntimeBoundaryCursor, } from '@maka/core/runtime-boundary';
 import { isTerminalRuntimeEvent, } from '@maka/core/runtime-event';
 import { isDeepStrictEqual } from 'node:util';
 import { resolveEffectiveOrchestration, } from '@maka/core/orchestration';
-import { DEFAULT_TOOL_MODE } from '@maka/core/tool-mode';
 import { AgentRun, ContinuationStartCommitError, } from './agent-run.js';
 import { createSessionEventMapMemory, isLiveBackendSessionEvent, mapSessionEventToRuntimeEvent, } from './session-event-runtime-mapper.js';
 import { cloneAndFreezeRuntimeSnapshot } from './runtime-snapshot.js';
-import { buildStatusPatch, buildTurnStateMessage, normalizeStopSessionSource, turnHasRetainedOutput as messagesHaveRetainedOutput, } from './session-projection-helpers.js';
+import { buildStatusPatch, normalizeStopSessionSource } from './session-projection-helpers.js';
 import { buildToolsForAgentDefinition } from './agent-catalog.js';
+import { loadModelProjectionTransitionsFromRunLedger } from './model-projection-transition-ledger.js';
 import { HistoryCompactCheckpointCoordinator, } from './history-compact-checkpoint-coordinator.js';
 import { buildResumePlanFromRuntimeEvents, RuntimeContinuationRevalidationError, } from './runtime-resume.js';
-import { buildContinuationReplayPlan, digestProviderReplay } from './continuation-replay.js';
-import { buildRuntimeEventModelReplayPlan, PROVIDER_REPLAY_PROJECTION_VERSION, } from './model-history.js';
+import { buildContinuationReplayPlan, digestProviderReplayAdmission, } from './continuation-replay.js';
+import { admitProviderReasoningReplayItems, buildRuntimeEventModelReplayPlan, compatibleProviderReasoningReplayEventIds, PROVIDER_REPLAY_PROJECTION_VERSION, } from './model-history.js';
 import { consumeRuntimeContinuationStartAdmissionProof, } from './runtime-continuation-admission.js';
 import { matchingTerminalRuntimeEvents, terminalRunStatusFromRuntimeEvent, } from './terminal-run-commit.js';
 import { RuntimeMessageAuthorityInvariantError, } from './message-authority.js';
-import { RuntimeInteractionFailStopError, RuntimeInteractionInvariantError, bindRuntimeInteractionRun, } from './interaction-authority.js';
+import { RuntimeInteractionFailStopError, RuntimeInteractionInvariantError, bindRuntimeInteractionRun, isHostedInteractionRequestEvent, isHostedInteractionSettlementAckEvent, isShutdownCancelledInteractionAdmission, } from './interaction-authority.js';
 import { DeliveryAckQueue, isDeliveryAckQueueClosed } from './delivery-ack-queue.js';
+import { runtimeHandoffPause } from '@maka/core/runtime-handoff';
+import { preserveHandoffOpening } from './runtime-resume.js';
+import { runtimeInvocationRouteForHeader } from './runtime-invocation-route.js';
 export class SessionQuiescentMutationBusyError extends Error {
     sessionIds;
     name = 'SessionQuiescentMutationBusyError';
@@ -62,6 +66,7 @@ export class RuntimeKernel {
     active = new Map();
     backendGenerations = new Map();
     backendActivationBuilds = new Map();
+    backendActivations = new Set();
     stopOperations = new Map();
     stopAttempts = new Map();
     executionClaims = new Map();
@@ -82,8 +87,31 @@ export class RuntimeKernel {
         }
         this.historyCompactCoordinator = new HistoryCompactCheckpointCoordinator(deps);
     }
-    async runBackendActivation(operation) {
-        return await (this.deps.runBackendActivation?.(operation) ?? operation());
+    async runBackendActivation(execution, operation) {
+        const activate = async () => {
+            this.backendActivations.add(execution);
+            try {
+                return await operation();
+            }
+            finally {
+                this.backendActivations.delete(execution);
+                this.backendInvalidations.get(execution.sessionId)?.activations.delete(execution);
+                await this.flushBackendInvalidation(execution.sessionId);
+            }
+        };
+        return await (this.deps.runBackendActivation?.(activate) ?? activate());
+    }
+    readBackendHeader(execution) {
+        // Register before the read: even the store may suspend after taking its
+        // snapshot. This covers all preflight work before the policy activation gate.
+        execution.backendHeaderSnapshot = { invalidated: false };
+        return this.deps.store.readHeader(execution.sessionId);
+    }
+    invalidateBackendHeaderSnapshots(sessionId) {
+        for (const execution of this.executionClaims.get(sessionId) ?? []) {
+            if (execution.backendHeaderSnapshot)
+                execution.backendHeaderSnapshot.invalidated = true;
+        }
     }
     claimExecution(sessionId) {
         if (this.stopIntents.has(sessionId)) {
@@ -188,8 +216,9 @@ export class RuntimeKernel {
         }
         execution.run = run;
         execution.phase = 'attached';
-        if (execution.stopIntent)
-            run.stop(execution.stopIntent.input.source);
+        if (execution.stopIntent) {
+            run.stop(execution.stopIntent.input.source, execution.stopIntent.input.workHubActionId);
+        }
     }
     reserveExecutionClaim(execution, active, run) {
         if (execution.phase !== 'attached' || execution.run !== run) {
@@ -272,9 +301,9 @@ export class RuntimeKernel {
         const execution = this.takeExecutionClaim(sessionId, options.execution);
         try {
             await this.enterExecutionClaim(execution);
-            const header = await this.deps.store.readHeader(sessionId);
+            const header = await this.readBackendHeader(execution);
             let workspaceIdentity;
-            if (this.deps.safeBoundaryResumeEnabled === true && this.deps.inspectContinuationSafety) {
+            if (this.deps.inspectContinuationSafety) {
                 try {
                     workspaceIdentity = (await this.deps.inspectContinuationSafety(sessionId))
                         .workspaceIdentity;
@@ -287,17 +316,16 @@ export class RuntimeKernel {
             const run = new AgentRun({
                 sessionId,
                 header,
+                effectiveToolMode: await this.deps.resolveFreshTurnToolMode?.(header),
                 userInput: input,
                 runId: options.runId,
                 userMessageId: options.userMessageId,
                 durability: options.durability,
-                store: this.deps.store,
                 runStore: this.deps.runStore,
                 runtimeEventStore: this.deps.runtimeEventStore,
                 ...(this.deps.toolBoundaryProtocol
                     ? { toolBoundaryProtocol: this.deps.toolBoundaryProtocol }
                     : {}),
-                repairRunRuntimeLedger: this.deps.repairRunRuntimeLedger,
                 newId: this.deps.newId,
                 now: this.deps.now,
                 ...(workspaceIdentity ? { workspaceIdentity } : {}),
@@ -310,7 +338,7 @@ export class RuntimeKernel {
                     unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
                     updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
                     updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
-                    appendTurnState: (targetSessionId, turnId, status, lineage, options) => this.appendTurnState(targetSessionId, turnId, status, lineage, options),
+                    ...this.messageProjectionHook(),
                 },
             });
             if (options.admitTurn && (await options.admitTurn()) === 'cancelled') {
@@ -362,42 +390,72 @@ export class RuntimeKernel {
             (this.executionClaims.get(continuation.sessionId)?.size ?? 0) > 1) {
             throw new Error('Cannot continue while another run is active');
         }
-        const header = await this.deps.store.readHeader(continuation.sessionId);
-        const sourceRun = await this.deps.runStore.readRun(continuation.sessionId, continuation.sourceRunId);
-        const sourceEvents = await revalidateContinuationBoundary(continuationAuthority, continuation);
+        const header = await this.readBackendHeader(execution);
+        const sessionRuns = await this.deps.runtimeEventStore.listSessionInvocations(continuation.sessionId);
+        const sourceRun = sessionRuns.find((run) => run.runId === continuation.sourceRunId);
+        if (!sourceRun) {
+            throw new RuntimeContinuationRevalidationError('source_identity_changed', 'Runtime continuation source run no longer exists');
+        }
+        const targetProviderStateIdentity = (await this.deps.backends.prepare(header.backend, {
+            sessionId: continuation.sessionId,
+            workspaceRoot: header.workspaceRoot,
+            header,
+            abortSignal: execution.abortController.signal,
+        })).providerStateIdentity;
+        const admissionRoute = {
+            invocations: sessionRuns,
+            targetProviderStateIdentity,
+            targetModelId: header.model,
+        };
+        const sourceEvents = await revalidateContinuationBoundary(continuationAuthority, continuation, admissionRoute);
         assertContinuationSourceUnchanged(continuation, sourceRun, sourceEvents);
         await this.revalidateContinuationSafety(continuation);
+        if (!this.deps.store.hasExplicitSandboxBoundaryDenial) {
+            throw new Error('Continuation requires authoritative sandbox boundary decision lookup');
+        }
+        const inheritedSandboxBoundaryDenied = await this.deps.store.hasExplicitSandboxBoundaryDenial(continuation.boundary.segments.map((segment) => segment.identity));
+        const handoffSourceComposition = continuation.handoffRootRunId !== undefined
+            ? agentRunCompositionFromEvents(await this.deps.runStore.readEvents(continuation.sessionId, sourceRun.runId))
+            : undefined;
+        if (continuation.handoffRootRunId !== undefined && !handoffSourceComposition) {
+            throw new RuntimeContinuationRevalidationError('source_identity_changed', 'Cooperative handoff source has no durable Run Composition');
+        }
         const userInput = {
             turnId: continuation.turnId,
             text: '',
-            parentTurnId: continuation.sourceTurnId,
+            ...(continuation.handoffRootRunId === undefined
+                ? { parentTurnId: continuation.sourceTurnId }
+                : {}),
         };
         const effectiveOrchestration = effectiveOrchestrationForRun(sourceRun, header);
         const effectiveToolMode = effectiveToolModeForRun(sourceRun);
         const claimedAt = this.deps.now();
-        const targetRunHeader = continuationTargetRunHeaderForExecution({
+        const targetOpening = continuationTargetOpeningForExecution({
+            sourceOpening: sourceRun.opening,
             continuation,
             sessionHeader: header,
             userInput,
             workspaceIdentity: continuation.safetySnapshot.workspaceIdentity,
             effectiveOrchestration,
             effectiveToolMode,
-            claimedAt,
+            targetProviderStateIdentity,
         });
-        const claim = continuationClaimForExecution(continuation, claimedAt, targetRunHeader);
+        const claim = continuationClaimForExecution(continuation, claimedAt, targetOpening);
         const claimResult = await continuationAuthority.claimContinuation({ claim });
         if (claimResult.kind !== 'acquired') {
             throw new RuntimeContinuationRevalidationError('continuation_claim_conflict', `Runtime continuation boundary is already claimed by ${claimResult.claim.claimId}`);
         }
         await this.deps.continuationFailpoint?.('after_continuation_claim_committed');
-        const sessionRuns = await this.deps.runStore.listSessionRuns(continuation.sessionId);
-        const existingClaim = sessionRuns.find((runHeader) => runHeader.continuationSource?.sourceRunId === continuation.sourceRunId &&
-            runHeader.continuationSource.sourceRuntimeEventHighWater ===
-                continuation.sourceRuntimeEventHighWater);
+        const existingClaim = sessionRuns.find((candidate) => {
+            const source = candidate.opening.source;
+            return (source.kind !== 'fresh' &&
+                source.sourceRunId === continuation.sourceRunId &&
+                source.sourceRuntimeEventHighWater === continuation.sourceRuntimeEventHighWater);
+        });
         if (existingClaim) {
             throw new RuntimeContinuationRevalidationError('continuation_claim_conflict', `Runtime continuation source already has a continuation child: ${existingClaim.runId}`);
         }
-        const existingTarget = sessionRuns.find((runHeader) => runHeader.runId === continuation.runId);
+        const existingTarget = sessionRuns.find((candidate) => candidate.runId === continuation.runId);
         if (existingTarget) {
             throw new RuntimeContinuationRevalidationError('target_run_conflict', 'Runtime continuation target run already exists');
         }
@@ -406,21 +464,28 @@ export class RuntimeKernel {
             sessionId: continuation.sessionId,
             header,
             userInput,
-            runLineage: { parentRunId: continuation.sourceRunId },
+            runLineage: continuation.handoffRootRunId !== undefined
+                ? sourceRun.opening.lineage
+                : { parentRunId: continuation.sourceRunId },
             runId: continuation.runId,
             invocationId: continuation.invocationId,
-            store: this.deps.store,
             runStore: this.deps.runStore,
             runtimeEventStore: this.deps.runtimeEventStore,
             ...(continuationToolBoundaryProtocol
                 ? { toolBoundaryProtocol: continuationToolBoundaryProtocol }
                 : {}),
-            repairRunRuntimeLedger: this.deps.repairRunRuntimeLedger,
             newId: this.deps.newId,
             now: this.deps.now,
             workspaceIdentity: continuation.safetySnapshot.workspaceIdentity,
             effectiveOrchestration,
-            claimedRunHeader: claim.targetRunHeader,
+            // Round-tripped through the claim on purpose: openInvocation compares it
+            // against the opening it computes, so every continuation proves the claim
+            // still authorises the run about to execute.
+            claimedOpening: claim.targetOpening,
+            ...(continuation.handoffRootRunId !== undefined
+                ? { handoffSourceOpening: sourceRun.opening, handoffSourceComposition }
+                : {}),
+            claimedOpenedAt: claimedAt,
             effectiveToolMode,
             continuationFailpoint: this.deps.continuationFailpoint,
             commitContinuationStart: async (startedAt) => {
@@ -435,6 +500,10 @@ export class RuntimeKernel {
                         partial: false,
                         role: 'system',
                         author: 'system',
+                        modelVisibility: 'hidden',
+                        // The start event is event 1 of the target invocation, so it is
+                        // also where that invocation's opening fact lives.
+                        content: claim.targetOpening,
                         actions: {
                             ...(continuationToolBoundaryProtocol
                                 ? {
@@ -477,15 +546,120 @@ export class RuntimeKernel {
                 unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
                 updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
                 updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
-                appendTurnState: (targetSessionId, turnId, status, lineage, options) => this.appendTurnState(targetSessionId, turnId, status, lineage, options),
+                ...this.messageProjectionHook(),
             },
         });
         this.attachExecutionClaim(execution, run);
-        yield* this.runAgentContinuation(continuation, run, execution, {
+        yield* this.runAgentContinuation(continuation, admissionRoute, run, execution, {
             sessionId: continuation.sessionId,
             turnId: continuation.turnId,
             runId: continuation.runId,
-        }, options.onRunStarted, () => this.revalidateContinuationSafety(continuation));
+        }, options, () => this.revalidateContinuationSafety(continuation), inheritedSandboxBoundaryDenied);
+    }
+    /** Host coordination uses the same Run owner and terminal authority without a provider send. */
+    async *runCoordinationOperation(sessionId, input, options, execute) {
+        const execution = this.takeExecutionClaim(sessionId);
+        execution.hostOperation = true;
+        try {
+            await this.enterExecutionClaim(execution);
+            const header = await this.deps.store.readHeader(sessionId);
+            const run = new AgentRun({
+                sessionId,
+                header,
+                userInput: input,
+                runId: options.runId,
+                userMessageId: options.userMessageId,
+                durability: 'required',
+                runStore: this.deps.runStore,
+                runtimeEventStore: this.deps.runtimeEventStore,
+                newId: this.deps.newId,
+                now: this.deps.now,
+                effectiveOrchestration: resolveEffectiveOrchestration('default', undefined),
+                hooks: {
+                    reserveRun: async (id, nextHeader, activeRun) => {
+                        const active = await this.reserveParentRun(id, nextHeader, activeRun, execution);
+                        this.reserveExecutionClaim(execution, active, activeRun);
+                        return active;
+                    },
+                    unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
+                    updateHeader: (id, patch) => this.updateHeader(id, patch),
+                    updateStatus: (id, status, reason, ts) => this.updateStatus(id, status, reason, ts),
+                    ...this.messageProjectionHook(),
+                },
+            });
+            this.attachExecutionClaim(execution, run);
+            const owners = this.createRunOwnerScope(run, execution);
+            try {
+                owners.bindMessage(this.deps.messageAuthority, {
+                    sessionId,
+                    turnId: input.turnId,
+                    runId: run.runId,
+                });
+                // Keep the execution claim attached until finalization. Stop/drain can
+                // therefore cancel and await this Run without a provider generation.
+                await run.beginCoordination();
+                await options.onRunStarted?.(run.runId, header);
+            }
+            catch (error) {
+                await this.finalizeFailedRunStart(owners, run, execution, error);
+                return;
+            }
+            try {
+                if (run.isStopped())
+                    return;
+                const executed = await execute();
+                const receipt = {
+                    ...executed,
+                    result: executed.result.disposition === 'clarify'
+                        ? { ...executed.result, coordinationTurnId: input.turnId }
+                        : executed.result,
+                };
+                const receiptEvent = {
+                    id: this.deps.newId(),
+                    sessionId,
+                    turnId: input.turnId,
+                    runId: run.runId,
+                    invocationId: run.runId,
+                    ts: this.deps.now(),
+                    partial: false,
+                    role: 'system',
+                    author: 'host',
+                    modelVisibility: 'hidden',
+                    actions: { coordination: receipt },
+                };
+                await run.recordRuntimeEvents([receiptEvent], { requireDurableWrite: true });
+                if (run.isStopped())
+                    return;
+                const complete = {
+                    type: 'complete',
+                    id: this.deps.newId(),
+                    turnId: input.turnId,
+                    ts: this.deps.now(),
+                    stopReason: 'end_turn',
+                };
+                await run.acceptMappedEvent(complete, mapSessionEventToRuntimeEvent(complete, this.runtimeEventMapContext({
+                    sessionId,
+                    invocationId: run.runId,
+                    runId: run.runId,
+                    turnId: input.turnId,
+                })), { requireTerminalWrite: true });
+                yield complete;
+            }
+            catch (error) {
+                await run.recordFailure(error);
+                throw error;
+            }
+            finally {
+                const failures = new FailureCollector();
+                await failures.capture(() => owners.finalize());
+                await failures.capture(() => owners.releaseMessage());
+                failures.throwIfAny(`Coordination cleanup failed for ${run.runId}`);
+            }
+        }
+        finally {
+            this.releaseExecutionClaim(execution);
+            await this.flushBackendInvalidation(sessionId);
+        }
     }
     async *compactSession(sessionId, input = {}) {
         const execution = this.takeExecutionClaim(sessionId);
@@ -503,7 +677,7 @@ export class RuntimeKernel {
             if (this.hasActiveRuns(sessionId)) {
                 throw new RuntimeContextCompactError('session_busy', 'Cannot compact while a Turn is running');
             }
-            const header = await this.deps.store.readHeader(sessionId);
+            const header = await this.readBackendHeader(execution);
             await this.requireContextCompactionBackend(sessionId, header, execution);
         }
         finally {
@@ -518,7 +692,7 @@ export class RuntimeKernel {
         if (this.hasActiveRuns(sessionId)) {
             throw new RuntimeContextCompactError('session_busy', 'Cannot compact while a Turn is running');
         }
-        const header = await this.deps.store.readHeader(sessionId);
+        const header = await this.readBackendHeader(execution);
         const turnId = input.turnId ?? this.deps.newId();
         const run = new AgentRun({
             sessionId,
@@ -526,13 +700,11 @@ export class RuntimeKernel {
             userInput: { turnId, text: '' },
             rootExecutionKind: 'context_compact',
             ...(input.hostedRoot ? { runId: input.hostedRoot.runId } : {}),
-            store: this.deps.store,
             runStore: this.deps.runStore,
             runtimeEventStore: this.deps.runtimeEventStore,
             ...(this.deps.toolBoundaryProtocol
                 ? { toolBoundaryProtocol: this.deps.toolBoundaryProtocol }
                 : {}),
-            repairRunRuntimeLedger: this.deps.repairRunRuntimeLedger,
             newId: this.deps.newId,
             now: this.deps.now,
             effectiveOrchestration: resolveEffectiveOrchestration('default', undefined),
@@ -545,7 +717,7 @@ export class RuntimeKernel {
                 unregisterRun: (active, activeRun) => this.unregisterParentRun(active, activeRun),
                 updateHeader: (targetSessionId, patch) => this.updateHeader(targetSessionId, patch),
                 updateStatus: (targetSessionId, status, blockedReason, ts) => this.updateStatus(targetSessionId, status, blockedReason, ts),
-                appendTurnState: (targetSessionId, nextTurnId, status, lineage, options) => this.appendTurnState(targetSessionId, nextTurnId, status, lineage, options),
+                ...this.messageProjectionHook(),
             },
         });
         this.attachExecutionClaim(execution, run);
@@ -559,7 +731,10 @@ export class RuntimeKernel {
                     runId: run.runId,
                 });
             }
-            begin = await this.runBackendActivation(() => run.beginOperation());
+            begin = await this.runBackendActivation(execution, async () => {
+                run.bindProviderStateIdentity(await this.prepareBackendForExecution(sessionId, header, execution));
+                return await run.beginOperation();
+            });
             await input.hostedRoot?.onRunStarted?.();
             this.settleReservedExecutionClaim(execution, run, { ok: true });
         }
@@ -567,6 +742,7 @@ export class RuntimeKernel {
             await this.finalizeFailedRunStart(owners, run, execution, error);
             return;
         }
+        let notedTerminal = false;
         try {
             if (run.isStopped())
                 return;
@@ -578,6 +754,7 @@ export class RuntimeKernel {
                 turnId: run.turnId,
                 runId: run.runId,
                 runtimeContext: begin.runtimeContext,
+                runtimeContextInvocations: begin.runtimeContextInvocations,
             });
             if (run.isStopped())
                 return;
@@ -604,22 +781,25 @@ export class RuntimeKernel {
                 runId: run.runId,
                 turnId: run.turnId,
             });
+            // Ahead of the usage row, because the ledger seals on its terminal fact:
+            // a note queued behind one this compaction may already own would be
+            // refused, and the reader would never learn the summary was skipped.
+            if (result.outcome.kind === 'failed') {
+                await run.recordSystemNote('context_compaction_failed_open').catch(() => { });
+                notedTerminal = true;
+            }
+            else if (result.outcome.kind === 'compacted') {
+                // Explicit compaction runs on its own turn and never enters the
+                // send-flow note block, so the "compacted" note is written here. The
+                // next user send passively replays this standalone checkpoint, which
+                // `shouldAppendContextCompactedNote` suppresses, so there is no
+                // duplicate.
+                await run.recordSystemNote('context_compacted').catch(() => { });
+                notedTerminal = true;
+            }
             await run.acceptMappedEvent(tokenUsageEvent, mapSessionEventToRuntimeEvent(tokenUsageEvent, eventContext), { requireTerminalWrite: true });
             if (run.isStopped())
                 return;
-            await run.recordStoredSessionEvent(tokenUsageEvent);
-            if (run.isStopped())
-                return;
-            if (result.outcome.kind === 'failed') {
-                const note = {
-                    type: 'system_note',
-                    id: this.deps.newId(),
-                    turnId: run.turnId,
-                    ts: this.deps.now(),
-                    kind: 'context_compaction_failed_open',
-                };
-                await this.deps.store.appendMessage(sessionId, note).catch(() => { });
-            }
             yield tokenUsageEvent;
             if (run.isStopped())
                 return;
@@ -629,6 +809,13 @@ export class RuntimeKernel {
             yield completeEvent;
         }
         catch (error) {
+            // A thrown compaction still owns a fail-open note — but not when the throw
+            // is a stop, which must leave no row. The note goes ahead of the failure
+            // because the ledger seals on its terminal fact; the internal compaction
+            // Turn has no user timeline for a failure banner.
+            if (!notedTerminal && !run.isStopped()) {
+                await run.recordSystemNote('context_compaction_failed_open').catch(() => { });
+            }
             await run.recordFailure(error);
             throw error;
         }
@@ -640,7 +827,7 @@ export class RuntimeKernel {
         }
     }
     async requireContextCompactionBackend(sessionId, header, execution) {
-        const active = await this.runBackendActivation(() => this.ensureActive(sessionId, header, execution));
+        const active = await this.runBackendActivation(execution, () => this.ensureActive(sessionId, header, execution));
         if (!active.backend.compactHistory) {
             throw new RuntimeContextCompactError('operation_unavailable', `Backend ${header.backend} does not support runtime compaction`);
         }
@@ -648,9 +835,7 @@ export class RuntimeKernel {
     }
     async *runAgentTurn(sessionId, run, execution, options = {}) {
         const { steering = false, onRunStarted, initialHeader, prepareBackendActivation } = options;
-        const sessionEvents = new DeliveryAckQueue();
         const { abortController, release: releaseExecutionAbort } = this.inheritExecutionAbort(execution);
-        let flowDone = false;
         const owners = this.createRunOwnerScope(run, execution);
         let begin;
         try {
@@ -661,8 +846,9 @@ export class RuntimeKernel {
                     runId: run.runId,
                 });
             }
-            begin = await this.runBackendActivation(async () => {
+            begin = await this.runBackendActivation(execution, async () => {
                 await prepareBackendActivation?.();
+                run.bindProviderStateIdentity(await this.prepareBackendForExecution(sessionId, run.headerSnapshot(), execution));
                 const started = await run.begin();
                 await owners.bindInteraction(this.deps.interactionAuthority, {
                     sessionId,
@@ -679,135 +865,38 @@ export class RuntimeKernel {
             await this.finalizeFailedRunStart(owners, run, execution, error);
             return;
         }
-        const interactionRun = owners.interactionRun;
-        const messageOwner = owners.messageOwner;
-        let pullSteering;
-        let ackSteering;
-        let nackSteering;
-        if (messageOwner) {
-            pullSteering = () => messageOwner?.pull() ?? [];
-            ackSteering = (leaseIds) => messageOwner?.ack(leaseIds);
-            nackSteering = (leaseIds) => messageOwner?.nack(leaseIds);
-        }
-        const stopBackend = this.stopBackendFor(begin.backend);
-        const eventContext = this.runtimeEventMapContext({
+        yield* this.streamAgentRun({
             sessionId,
-            invocationId: begin.initialRuntimeEvent.invocationId,
-            runId: run.runId,
-            turnId: run.turnId,
-        });
-        if (run.isStopped())
-            abortController.abort();
-        const streamResult = this.runBackendEventStream({
+            run,
+            owners,
             backend: begin.backend,
-            stopBackend,
-            beforeDispatch: () => this.assertRunCanDispatch(run, begin.backend),
-            ...(interactionRun ? { hostedInteraction: interactionRun } : {}),
-            abortSignal: abortController.signal,
-            eventContext,
+            abortController,
+            releaseExecutionAbort,
+            requireTerminalWrite: Boolean(this.deps.runtimeEventStore),
+            invocationId: begin.initialRuntimeEvent.invocationId,
             backendInput: {
                 invocationId: begin.initialRuntimeEvent.invocationId,
                 runId: run.runId,
                 ...begin.backendInput,
                 headAnchorRuntimeEvent: begin.initialRuntimeEvent,
-                ...(pullSteering ? { pullSteering } : {}),
-                ...(ackSteering ? { ackSteering } : {}),
-                ...(nackSteering ? { nackSteering } : {}),
-            },
-            onSessionEvent: async (sessionEvent, runtimeEvent) => {
-                this.assertInteractionPublication(interactionRun, sessionEvent);
-                await run.acceptMappedEvent(sessionEvent, runtimeEvent, {
-                    requireTerminalWrite: Boolean(this.deps.runtimeEventStore),
-                    allowInteractionResume: await interactionResumeAllowed(interactionRun, sessionEvent),
-                });
-                this.observeInteractionEvent(sessionId, begin.backend, sessionEvent);
-                await sessionEvents.push(sessionEvent);
+                handoffBoundary: (signal, remainingSteps) => run.reachHandoffBoundary(signal, remainingSteps),
+                ...runtimeSteeringInput(owners.messageOwner),
             },
-            onError: async (error) => {
-                if (!isDeliveryAckQueueClosed(error)) {
-                    await run.recordFailure(error);
-                    sessionEvents.fail(error);
-                }
-            },
-            onFinally: async () => {
-                flowDone = true;
-                try {
-                    await owners.finalize();
-                    // Release Runtime access BEFORE the event stream closes. Embedded
-                    // queues still emit their final steering → followup projection here;
-                    // a hosted owner is only sealed, then the Host performs that handoff
-                    // under its Session admission gate. The outer finally remains an
-                    // idempotent backstop for paths that never reach this hook.
-                    if (messageOwner)
-                        owners.releaseMessage();
-                    sessionEvents.close();
-                }
-                catch (error) {
-                    sessionEvents.fail(error);
-                    throw error;
-                }
-            },
-        }).then(async (result) => {
-            if (!flowDone) {
-                try {
-                    flowDone = true;
-                    await owners.finalize();
-                    owners.releaseMessage();
-                    sessionEvents.close();
-                }
-                catch (error) {
-                    sessionEvents.fail(error);
-                    throw error;
-                }
-            }
-            return result;
-        }, (error) => {
-            sessionEvents.fail(error);
-            throw error;
         });
-        try {
-            for await (const event of sessionEvents) {
-                yield event;
-            }
-            await streamResult;
-        }
-        finally {
-            try {
-                await this.cleanupRunExecution({
-                    run,
-                    stopBackend,
-                    flowDone,
-                    abortController,
-                    sessionEvents,
-                    streamResult,
-                    interactionRun,
-                    finalizeRun: () => owners.finalize(),
-                    releaseOwner: () => {
-                        if (messageOwner)
-                            owners.releaseMessage();
-                    },
-                });
-            }
-            finally {
-                this.clearInteractionRequestOwners(sessionId, run.turnId);
-                releaseExecutionAbort();
-            }
-        }
     }
-    async *runAgentContinuation(continuation, run, execution, messageOwner, onRunStarted, revalidateSafety) {
-        const sessionEvents = new DeliveryAckQueue();
+    async *runAgentContinuation(continuation, admissionRoute, run, execution, messageOwner, options = {}, revalidateSafety, inheritedSandboxBoundaryDenied = false) {
         const { abortController, release: releaseExecutionAbort } = this.inheritExecutionAbort(execution);
-        let flowDone = false;
         const owners = this.createRunOwnerScope(run, execution);
         let begin;
         try {
             if (messageOwner)
                 owners.bindMessage(this.deps.messageAuthority, messageOwner);
-            begin = await this.runBackendActivation(async () => {
+            begin = await this.runBackendActivation(execution, async () => {
                 if (!revalidateSafety) {
                     throw new Error('Durable continuation omitted final safety revalidation');
                 }
                 await revalidateSafety();
+                run.bindProviderStateIdentity(await this.prepareBackendForExecution(continuation.sessionId, run.headerSnapshot(), execution));
                 const started = await run.beginContinuation(continuation);
                 await owners.bindInteraction(this.deps.interactionAuthority, {
                     sessionId: continuation.sessionId,
@@ -816,7 +905,15 @@ export class RuntimeKernel {
                 });
                 return started;
             });
-            await onRunStarted?.();
+            await options.onRunStarted?.();
+            const stop = options.stopBeforeDispatch?.();
+            if (stop) {
+                run.stop(stop.source, stop.workHubActionId);
+                releaseExecutionAbort();
+                await owners.finalize();
+                owners.releaseMessage();
+                return;
+            }
         }
         catch (error) {
             releaseExecutionAbort();
@@ -827,11 +924,11 @@ export class RuntimeKernel {
             await this.finalizeFailedRunStart(owners, run, execution, error);
             return;
         }
-        const interactionRun = owners.interactionRun;
         let continuationMetadata;
         try {
             continuationMetadata = consumeAdmittedRuntimeContinuation({
                 continuation,
+                admissionRoute,
                 startAdmission: 'continuationStartAdmission' in begin
                     ? begin.continuationStartAdmission
                     : (() => {
@@ -839,29 +936,35 @@ export class RuntimeKernel {
                     })(),
                 ...(run.toolBoundaryProtocol ? { toolBoundaryProtocol: run.toolBoundaryProtocol } : {}),
             });
+            continuationMetadata.sandboxBoundaryDenied = inheritedSandboxBoundaryDenied;
         }
         catch (error) {
             releaseExecutionAbort();
             await this.finalizeFailedRunStart(owners, run, execution, error);
             return;
         }
-        const stopBackend = this.stopBackendFor(begin.backend);
-        const eventContext = this.runtimeEventMapContext({
+        yield* this.streamAgentRun({
             sessionId: continuation.sessionId,
-            invocationId: continuation.invocationId,
-            runId: continuation.runId,
-            turnId: continuation.turnId,
-        });
-        if (run.isStopped())
-            abortController.abort();
-        let streamFailure;
-        const streamResult = this.runBackendEventStream({
+            run,
+            owners,
             backend: begin.backend,
-            stopBackend,
-            beforeDispatch: () => this.assertRunCanDispatch(run, begin.backend),
-            ...(interactionRun ? { hostedInteraction: interactionRun } : {}),
-            abortSignal: abortController.signal,
-            eventContext,
+            abortController,
+            releaseExecutionAbort,
+            requireTerminalWrite: true,
+            recordUnobservedStreamFailure: true,
+            invocationId: continuation.invocationId,
+            ...(continuation.handoffRootRunId !== undefined
+                ? {
+                    prepareBeforeDispatch: async () => {
+                        this.assertRunCanDispatch(run, begin.backend);
+                        if (!begin.backend.prepareRunComposition) {
+                            throw new Error('Backend does not support cooperative handoff composition preparation');
+                        }
+                        await begin.backend.prepareRunComposition({ runId: run.runId, turnId: run.turnId });
+                        run.assertRunCompositionCommitted();
+                    },
+                }
+                : {}),
             backendInput: {
                 invocationId: continuation.invocationId,
                 runId: continuation.runId,
@@ -869,30 +972,76 @@ export class RuntimeKernel {
                 orchestration: run.effectiveOrchestration,
                 toolMode: run.toolMode,
                 text: '',
-                context: [],
                 runtimeContext: continuation.runtimeContext,
+                runtimeContextInvocations: admissionRoute.invocations,
                 continuation: continuationMetadata,
+                ...runtimeSteeringInput(owners.messageOwner),
+                ...(continuation.handoffRootRunId !== undefined
+                    ? {
+                        maxSteps: continuation.handoffRemainingSteps,
+                        // The original user anchor remains in the authenticated replay;
+                        // a physical successor must not invent another user message.
+                        headAnchorRuntimeEvent: continuation.runtimeContext.find((event) => event.runId === continuation.handoffRootRunId &&
+                            event.turnId === continuation.turnId &&
+                            event.role === 'user' &&
+                            (event.author === 'user' || event.author === 'host') &&
+                            event.content?.kind === 'text' &&
+                            event.content.steering !== true),
+                    }
+                    : {}),
+                handoffBoundary: (signal, remainingSteps) => run.reachHandoffBoundary(signal, remainingSteps),
             },
+        });
+    }
+    async *streamAgentRun(input) {
+        const sessionEvents = new DeliveryAckQueue();
+        const interactionRun = input.owners.interactionRun;
+        const stopBackend = this.stopBackendFor(input.backend);
+        let flowDone = false;
+        let streamFailure;
+        if (input.run.isStopped())
+            input.abortController.abort();
+        const streamResult = this.runBackendEventStream({
+            backend: input.backend,
+            stopBackend,
+            beforeDispatch: () => this.assertRunCanDispatch(input.run, input.backend),
+            ...(input.prepareBeforeDispatch
+                ? { prepareBeforeDispatch: input.prepareBeforeDispatch }
+                : {}),
+            hasCommittedHandoff: () => input.run.hasCommittedHandoff(),
+            ...(interactionRun ? { hostedInteraction: interactionRun } : {}),
+            abortSignal: input.abortController.signal,
+            eventContext: this.runtimeEventMapContext({
+                sessionId: input.sessionId,
+                invocationId: input.invocationId,
+                runId: input.run.runId,
+                turnId: input.run.turnId,
+            }),
+            backendInput: input.backendInput,
             onSessionEvent: async (sessionEvent, runtimeEvent) => {
                 this.assertInteractionPublication(interactionRun, sessionEvent);
-                await run.acceptMappedEvent(sessionEvent, runtimeEvent, {
-                    requireTerminalWrite: true,
+                await input.run.acceptMappedEvent(sessionEvent, runtimeEvent, {
+                    requireTerminalWrite: input.requireTerminalWrite,
                     allowInteractionResume: await interactionResumeAllowed(interactionRun, sessionEvent),
                 });
-                this.observeInteractionEvent(continuation.sessionId, begin.backend, sessionEvent);
+                this.observeInteractionEvent(input.sessionId, input.backend, sessionEvent);
                 await sessionEvents.push(sessionEvent);
             },
             onError: async (error) => {
                 if (!isDeliveryAckQueueClosed(error)) {
-                    await run.recordFailure(error);
+                    await input.run.recordFailure(error);
                     sessionEvents.fail(error);
                 }
             },
             onFinally: async () => {
                 flowDone = true;
                 try {
-                    await owners.finalize();
-                    owners.releaseMessage();
+                    await input.owners.finalize();
+                    // Release Runtime access before closing the event stream. Embedded
+                    // queues publish their final steering projection here; hosted owners
+                    // are only sealed, then the Host performs the handoff under its
+                    // Session admission gate.
+                    input.owners.releaseMessage();
                     sessionEvents.close();
                 }
                 catch (error) {
@@ -904,8 +1053,8 @@ export class RuntimeKernel {
             if (!flowDone) {
                 try {
                     flowDone = true;
-                    await owners.finalize();
-                    owners.releaseMessage();
+                    await input.owners.finalize();
+                    input.owners.releaseMessage();
                     sessionEvents.close();
                 }
                 catch (error) {
@@ -921,29 +1070,30 @@ export class RuntimeKernel {
             throw error;
         });
         try {
-            for await (const event of sessionEvents) {
+            for await (const event of sessionEvents)
                 yield event;
-            }
             await streamResult;
         }
         finally {
             try {
                 await this.cleanupRunExecution({
-                    run,
+                    run: input.run,
                     stopBackend,
                     flowDone,
-                    abortController,
+                    abortController: input.abortController,
                     sessionEvents,
                     streamResult,
                     interactionRun,
-                    ...(streamFailure !== undefined ? { streamFailure } : {}),
-                    finalizeRun: () => owners.finalize(),
-                    releaseOwner: () => owners.releaseMessage(),
+                    ...(input.recordUnobservedStreamFailure && streamFailure !== undefined
+                        ? { streamFailure }
+                        : {}),
+                    finalizeRun: () => input.owners.finalize(),
+                    releaseOwner: () => input.owners.releaseMessage(),
                 });
             }
             finally {
-                this.clearInteractionRequestOwners(continuation.sessionId, run.turnId);
-                releaseExecutionAbort();
+                this.clearInteractionRequestOwners(input.sessionId, input.run.turnId);
+                input.releaseExecutionAbort();
             }
         }
     }
@@ -966,6 +1116,10 @@ export class RuntimeKernel {
         };
     }
     async finalizeFailedRunStart(owners, run, execution, error) {
+        // A draining authority refused the start because everything is stopping, not
+        // because this run went wrong, so the run ends cancelled rather than failed.
+        if (isShutdownCancelledInteractionAdmission(error))
+            run.stop(undefined);
         try {
             await owners.failStart(error);
         }
@@ -1038,8 +1192,7 @@ export class RuntimeKernel {
             this.interactionRuns.delete(run);
     }
     assertInteractionPublication(binding, event) {
-        if (binding &&
-            (event.type === 'user_question_request' || event.type === 'sandbox_boundary_request')) {
+        if (binding && isHostedInteractionRequestEvent(event)) {
             binding.assertPendingAdmission(event);
         }
     }
@@ -1070,6 +1223,9 @@ export class RuntimeKernel {
         let terminalAccepted = false;
         let errorSeen = false;
         try {
+            if (input.prepareBeforeDispatch)
+                await input.prepareBeforeDispatch();
+            // Keep the final stop/admission check synchronous with backend.send.
             input.beforeDispatch();
             for await (const sessionEvent of input.backend.send({
                 ...backendInput,
@@ -1085,7 +1241,7 @@ export class RuntimeKernel {
                 if (terminalSeen)
                     terminalAccepted = true;
             }
-            if (!terminalSeen) {
+            if (!terminalSeen && !input.hasCommittedHandoff?.()) {
                 for (const sessionEvent of this.missingTerminalSessionEvents(input.eventContext.turnId, !errorSeen)) {
                     const runtimeEvent = mapSessionEventToRuntimeEvent(sessionEvent, input.eventContext, memory);
                     await input.onSessionEvent(sessionEvent, runtimeEvent);
@@ -1132,6 +1288,7 @@ export class RuntimeKernel {
         ];
     }
     stopSession(sessionId, input = {}) {
+        normalizeStopSessionSource(input.source, input.workHubActionId);
         const existing = this.stopAttempts.get(sessionId);
         if (existing)
             return existing;
@@ -1142,8 +1299,9 @@ export class RuntimeKernel {
             execution.stopIntent = intent;
             intent.claims.add(execution);
         }
-        for (const execution of executions)
-            execution.run?.stop(input.source);
+        for (const execution of executions) {
+            execution.run?.stop(input.source, input.workHubActionId);
+        }
         for (const execution of executions) {
             execution.abortController.abort(execution.cancellation);
         }
@@ -1190,7 +1348,7 @@ export class RuntimeKernel {
         }
     }
     claimRunForStop(sessionId, input, active, run) {
-        run.stop(input.source);
+        run.stop(input.source, input.workHubActionId);
         if (!run.hasPendingStop())
             return this.stopOperations.get(sessionId);
         const existingOperation = this.stopOperations.get(sessionId);
@@ -1204,14 +1362,6 @@ export class RuntimeKernel {
                 delivery: { kind: 'pending' },
             };
         const needsRun = !target.runs.has(run.runId);
-        const projection = needsRun && run.isSessionInline() && !operation.turnProjections.has(run.runId)
-            ? {
-                id: this.deps.newId(),
-                turnId: run.turnId,
-                lineage: run.lineage,
-                projected: false,
-            }
-            : undefined;
         if (!existingOperation)
             this.stopOperations.set(sessionId, operation);
         if (!existingTarget) {
@@ -1226,27 +1376,16 @@ export class RuntimeKernel {
                 sessionInline: run.isSessionInline(),
                 stopCompleted: false,
             });
-            if (projection)
-                operation.turnProjections.set(run.runId, projection);
         }
         return operation;
     }
     buildStopOperation(input) {
-        const abortSource = normalizeStopSessionSource(input.source);
+        const abortSource = normalizeStopSessionSource(input.source, input.workHubActionId);
         const ts = this.deps.now();
         return {
             abortSource,
             ts,
             statusProjected: false,
-            turnProjections: new Map(),
-            abortNote: {
-                type: 'system_note',
-                id: this.deps.newId(),
-                ts,
-                kind: 'abort',
-                ...(abortSource ? { data: { source: abortSource } } : {}),
-            },
-            abortNoteProjected: false,
             targets: new Map(),
             queue: Promise.resolve(),
         };
@@ -1311,29 +1450,11 @@ export class RuntimeKernel {
             await this.updateStatus(sessionId, 'aborted', undefined, operation.ts);
             operation.statusProjected = true;
         }
-        for (const projection of operation.turnProjections.values()) {
-            if (projection.projected)
-                continue;
-            projection.message ??= buildTurnStateMessage({
-                id: projection.id,
-                turnId: projection.turnId,
-                ts: operation.ts,
-                status: 'aborted',
-                lineage: projection.lineage,
-                ...(operation.abortSource ? { abortSource: operation.abortSource } : {}),
-                partialOutputRetained: await this.turnHasRetainedOutput(sessionId, projection.turnId),
-            });
-            await this.appendStopProjection(sessionId, projection.message);
-            projection.projected = true;
-        }
-        if (!operation.abortNoteProjected) {
-            await this.appendStopProjection(sessionId, operation.abortNote);
-            operation.abortNoteProjected = true;
-        }
-        // The Session projection above now reads as aborted. The ledger has to say
-        // the same thing before this stop reports success: a Run left non-terminal
-        // here stays that way, because the stream that would have finalized it is
-        // exactly the one the stop could not wake.
+        // The ledger has to say this turn was aborted before the stop reports
+        // success: a Run left non-terminal here stays that way, because the stream
+        // that would have finalized it is exactly the one the stop could not wake.
+        // Nothing else records the abort — the transcript reads it back off this
+        // terminal fact.
         //
         // Without a Host interaction authority, Runtime owns terminal settlement.
         // A Hosted Run's terminal fact belongs to the Host, which also parks
@@ -1355,8 +1476,6 @@ export class RuntimeKernel {
             target.stopCompleted = true;
         }
         const completed = operation.statusProjected &&
-            operation.abortNoteProjected &&
-            [...operation.turnProjections.values()].every((projection) => projection.projected) &&
             [...operation.targets.values()].every((target) => target.delivery.kind !== 'pending' &&
                 [...target.runs.values()].every((run) => run.stopCompleted));
         if (completed && this.stopOperations.get(sessionId) === operation) {
@@ -1369,16 +1488,6 @@ export class RuntimeKernel {
         }
         failures.throwIfAny(`Stop cleanup failed for session ${sessionId}`);
     }
-    async appendStopProjection(sessionId, message) {
-        const existing = (await this.deps.store.readMessages(sessionId)).find((candidate) => candidate.id === message.id);
-        if (existing) {
-            if (!isDeepStrictEqual(existing, message)) {
-                throw new Error(`stop projection ${message.id} conflicts with an existing message`);
-            }
-            return;
-        }
-        await this.deps.store.appendMessage(sessionId, message);
-    }
     async respondToSandboxBoundary(sessionId, response) {
         const key = interactionOwnerKey(sessionId, response.requestId);
         const owner = this.interactionRequestOwners.get(key);
@@ -1408,24 +1517,36 @@ export class RuntimeKernel {
         const generations = this.backendGenerationsFor(sessionId);
         await Promise.all(generations.map((active) => active.backend.respondToUserQuestion?.(response)));
     }
+    activeRunsFor(sessionId) {
+        const runs = new Set();
+        for (const active of this.backendGenerationsFor(sessionId)) {
+            for (const run of active.activeRuns.values())
+                runs.add(run);
+        }
+        for (const claim of this.executionClaims.get(sessionId) ?? []) {
+            if (claim.hostOperation && claim.run)
+                runs.add(claim.run);
+        }
+        return [...runs];
+    }
     hasActiveRuns(sessionId) {
-        return this.backendGenerationsFor(sessionId).some((active) => active.activeRuns.size > 0);
+        return this.activeRunsFor(sessionId).length > 0;
     }
     runningTurnIds(sessionId) {
-        const turnIds = [];
-        for (const active of this.backendGenerationsFor(sessionId)) {
-            for (const run of active.activeRuns.values()) {
-                if (!turnIds.includes(run.turnId))
-                    turnIds.push(run.turnId);
-            }
-        }
-        return turnIds;
+        return [...new Set(this.activeRunsFor(sessionId).map((run) => run.turnId))];
     }
     hasActiveRun(sessionId, runId, turnId) {
-        return this.backendGenerationsFor(sessionId).some((active) => {
+        return this.activeRunsFor(sessionId).some((run) => run.runId === runId && (turnId === undefined || run.turnId === turnId));
+    }
+    requestRunHandoff(sessionId, runId, pause, signal) {
+        if (!this.deps.inspectContinuationSafety)
+            return undefined;
+        for (const active of this.backendGenerationsFor(sessionId)) {
             const run = active.activeRuns.get(runId);
-            return run !== undefined && (turnId === undefined || run.turnId === turnId);
-        });
+            if (run)
+                return run.requestHandoff(pause, signal);
+        }
+        return undefined;
     }
     updateCachedHeader(sessionId, header) {
         const active = this.active.get(sessionId);
@@ -1433,14 +1554,22 @@ export class RuntimeKernel {
             active.cachedHeader = header;
     }
     async invalidateBackend(sessionId) {
+        this.invalidateBackendHeaderSnapshots(sessionId);
         this.ensureBackendInvalidation(sessionId);
         await this.flushBackendInvalidation(sessionId);
     }
     async invalidateCachedBackends() {
         const sessionIds = new Set([...this.backendGenerations.values()].map((generation) => generation.sessionId));
+        for (const [sessionId, claims] of this.executionClaims) {
+            if ([...claims].some((execution) => execution.backendHeaderSnapshot))
+                sessionIds.add(sessionId);
+        }
+        for (const execution of this.backendActivations)
+            sessionIds.add(execution.sessionId);
         for (const sessionId of this.backendInvalidations.keys())
             sessionIds.add(sessionId);
         await Promise.all([...sessionIds].map(async (sessionId) => {
+            this.invalidateBackendHeaderSnapshots(sessionId);
             const failedGeneration = this.backendGenerationsFor(sessionId).find((generation) => generation.phase === 'failed');
             if (failedGeneration) {
                 const retained = await failedGeneration.disposal;
@@ -1603,6 +1732,13 @@ export class RuntimeKernel {
     stopOperationReferences(active) {
         return [...this.stopOperations.values()].some((operation) => [...operation.targets.values()].some((target) => target.active === active));
     }
+    /** Every run this Session has opened, enumerated from the event spine. */
+    async sessionRunIds(sessionId) {
+        const store = this.deps.runtimeEventStore;
+        if (!store)
+            return [];
+        return (await store.listSessionInvocations(sessionId)).map((invocation) => invocation.runId);
+    }
     buildBackendRecorderHooks(input) {
         const { sessionId } = input;
         const runFor = (turnId) => {
@@ -1614,17 +1750,9 @@ export class RuntimeKernel {
             recordRunTrace: (event) => {
                 runFor(event.turnId)?.recordRunTrace(event);
             },
+            recordSystemNote: (kind, turnId, data) => runFor(turnId)?.recordSystemNote(kind, data) ?? Promise.resolve(),
             ...(this.deps.runStore
                 ? {
-                    recordProviderRequestCapture: (capture) => {
-                        const run = runFor(capture.turnId);
-                        if (!run)
-                            return Promise.reject(new Error('No active AgentRun for provider request capture'));
-                        return run.recordProviderRequestCapture(capture);
-                    },
-                    recordProviderRequestAttempt: (attempt) => {
-                        runFor(attempt.turnId)?.recordProviderRequestAttempt(attempt);
-                    },
                     // Resolved by runId rather than turnId: the canonical record names
                     // the run it belongs to, so it needs no turn-to-run indirection.
                     recordModelCallAttempt: (commit) => {
@@ -1638,8 +1766,23 @@ export class RuntimeKernel {
                         }
                         return run.recordRunComposition(snapshot);
                     },
+                    recordRequestComposition: (runId, snapshot) => {
+                        const run = this.active.get(sessionId)?.activeRuns.get(runId);
+                        if (!run) {
+                            return Promise.reject(new Error('No active AgentRun for Request Composition'));
+                        }
+                        return run.recordRequestComposition(snapshot);
+                    },
                     loadHistoryCompactCheckpoint: () => this.historyCompactCoordinator.load(sessionId),
                     recordHistoryCompactCheckpoint: (checkpoint, turnId) => this.historyCompactCoordinator.record(sessionId, checkpoint, runFor(turnId)),
+                    loadModelProjectionTransitions: async () => loadModelProjectionTransitionsFromRunLedger(this.deps.runStore, sessionId, await this.sessionRunIds(sessionId)),
+                    recordModelProjectionTransition: (transition, turnId) => {
+                        const run = runFor(turnId);
+                        if (!run) {
+                            return Promise.reject(new Error('No active AgentRun for model projection transition'));
+                        }
+                        return run.recordModelProjectionTransition(transition);
+                    },
                 }
                 : {}),
             ...(this.deps.runtimeEventStore
@@ -1654,6 +1797,19 @@ export class RuntimeKernel {
                 : {}),
         };
     }
+    async prepareBackendForExecution(sessionId, header, execution) {
+        const existing = this.active.get(sessionId);
+        if (existing)
+            return existing.providerStateIdentity;
+        const prepared = await this.deps.backends.prepare(header.backend, {
+            sessionId,
+            workspaceRoot: header.workspaceRoot,
+            header,
+            abortSignal: execution.abortController.signal,
+        });
+        execution.backendPreparation = prepared;
+        return prepared.providerStateIdentity;
+    }
     async ensureActive(sessionId, header, execution) {
         await this.clearBackendQuarantineForActivation(sessionId, execution);
         let existing = this.active.get(sessionId);
@@ -1671,8 +1827,16 @@ export class RuntimeKernel {
             const current = this.active.get(sessionId);
             if (current)
                 return current;
+            const prepared = execution.backendPreparation ??
+                (await this.deps.backends.prepare(header.backend, {
+                    sessionId,
+                    workspaceRoot: header.workspaceRoot,
+                    header,
+                    abortSignal: execution.abortController.signal,
+                }));
+            execution.run?.bindProviderStateIdentity(prepared.providerStateIdentity);
             const subagent = await this.resolveSubagentActivation(header);
-            const backend = await this.deps.backends.build(header.backend, {
+            const backend = await prepared.build({
                 sessionId,
                 workspaceRoot: header.workspaceRoot,
                 header,
@@ -1689,10 +1853,9 @@ export class RuntimeKernel {
                     sessionId,
                 }),
                 allowMidTurnHistoryCompaction: Boolean(this.deps.runtimeEventStore),
-                shellRunContextSummary: () => this.deps.shellRuns?.buildContextSummary(sessionId) ?? Promise.resolve(undefined),
             });
             await this.rejectCancelledBackendActivation(backend, header, execution);
-            const generation = this.createBackendGeneration(sessionId, backend, header);
+            const generation = this.createBackendGeneration(sessionId, backend, header, prepared.providerStateIdentity);
             this.active.set(sessionId, generation);
             return generation;
         });
@@ -1725,6 +1888,12 @@ export class RuntimeKernel {
         if (!header.subagentParent) {
             throw new Error('Subagent runtime snapshot requires a linked child session');
         }
+        if (header.backend === 'plugin-executor') {
+            return {
+                systemPrompt: snapshot.systemPrompt,
+                tools: [],
+            };
+        }
         const snapshotDefinition = {
             id: snapshot.agentId,
             permissionMode: header.permissionMode,
@@ -1751,12 +1920,13 @@ export class RuntimeKernel {
         this.reserveGenerationRun(active, run);
         return active;
     }
-    createBackendGeneration(sessionId, backend, header) {
+    createBackendGeneration(sessionId, backend, header, providerStateIdentity) {
         const active = {
             sessionId,
             generation: ++this.nextBackendGeneration,
             phase: 'active',
             backend,
+            ...(providerStateIdentity ? { providerStateIdentity } : {}),
             stopBackend: undefined,
             stopState: { kind: 'idle' },
             cachedHeader: header,
@@ -1858,7 +2028,7 @@ export class RuntimeKernel {
     }
     async flushBackendInvalidation(sessionId) {
         const invalidation = this.backendInvalidations.get(sessionId);
-        if (!invalidation || this.hasActiveRuns(sessionId))
+        if (!invalidation || invalidation.activations.size > 0 || this.hasActiveRuns(sessionId))
             return;
         await this.startBackendDisposal(sessionId, invalidation);
     }
@@ -1895,11 +2065,23 @@ export class RuntimeKernel {
                 this.terminateBackendGeneration(generation);
             }
         }
+        await this.waitForBackendDisposal(sessionId);
+        if (execution.backendHeaderSnapshot?.invalidated) {
+            // A refresh must not wait for preflight claims that may themselves be
+            // waiting on the policy mutation gate. Remember their stale snapshots,
+            // then re-arm invalidation inside activation, after any old disposal.
+            this.ensureBackendInvalidation(sessionId);
+        }
         const invalidation = this.backendInvalidations.get(sessionId);
         if (!invalidation)
             return;
+        // This activation was already admitted when the refresh arrived. Let it
+        // reserve its Run; invalidation must survive until that Run exits (or the
+        // activation fails), rather than disposing a not-yet-reserved generation.
+        if (invalidation.activations.has(execution))
+            return;
         await this.flushBackendInvalidation(sessionId);
-        if (this.hasActiveRuns(sessionId)) {
+        if (invalidation.activations.size > 0 || this.hasActiveRuns(sessionId)) {
             throw new Error(`Backend generation is quarantined for session ${sessionId}`);
         }
         await this.startBackendDisposal(sessionId, invalidation);
@@ -1930,16 +2112,28 @@ export class RuntimeKernel {
     }
     ensureBackendInvalidation(sessionId) {
         const existing = this.backendInvalidations.get(sessionId);
-        if (existing)
+        if (existing) {
+            if (!existing.disposal)
+                this.retainBackendActivations(sessionId, existing);
             return existing;
+        }
         let resolve;
         const outcome = new Promise((resolvePromise) => {
             resolve = resolvePromise;
         });
-        const invalidation = { outcome, resolve };
+        const invalidation = { outcome, resolve, activations: new Set() };
+        this.retainBackendActivations(sessionId, invalidation);
         this.backendInvalidations.set(sessionId, invalidation);
         return invalidation;
     }
+    retainBackendActivations(sessionId, invalidation) {
+        // A cold backend has no generation or activeRuns yet. Retain the entire
+        // prepare/build/reservation interval, not just the shared factory promise.
+        for (const execution of this.backendActivations) {
+            if (execution.sessionId === sessionId)
+                invalidation.activations.add(execution);
+        }
+    }
     async updateStatus(sessionId, status, blockedReason, ts = this.deps.now()) {
         await this.updateHeader(sessionId, buildStatusPatch(status, ts, blockedReason));
     }
@@ -1948,22 +2142,17 @@ export class RuntimeKernel {
         this.updateCachedHeader(sessionId, next);
         return next;
     }
-    async appendTurnState(sessionId, turnId, status, lineage = {}, options = {}) {
-        const ts = options.ts ?? this.deps.now();
-        await this.deps.store.appendMessage(sessionId, buildTurnStateMessage({
-            id: options.id ?? this.deps.newId(),
-            turnId,
-            ts,
-            status,
-            lineage,
-            ...(options.abortSource ? { abortSource: options.abortSource } : {}),
-            ...(options.errorClass !== undefined ? { errorClass: options.errorClass } : {}),
-            partialOutputRetained: await this.turnHasRetainedOutput(sessionId, turnId),
-        }));
-    }
-    async turnHasRetainedOutput(sessionId, turnId) {
-        const messages = await this.deps.store.readMessages(sessionId).catch(() => []);
-        return messagesHaveRetainedOutput(messages, turnId);
+    /** Present only when the store keeps a Session catalog to project into. */
+    messageProjectionHook() {
+        const commit = this.deps.store.commitMessageCatalogProjection;
+        if (!commit)
+            return {};
+        return {
+            commitMessageProjection: async (sessionId, message) => {
+                await commit.call(this.deps.store, sessionId, message);
+                this.updateCachedHeader(sessionId, await this.deps.store.readHeader(sessionId));
+            },
+        };
     }
 }
 function requireRuntimeContinuationAuthority(store) {
@@ -1980,7 +2169,7 @@ function requireRuntimeContinuationAuthority(store) {
     }
     return candidate;
 }
-async function revalidateContinuationBoundary(store, continuation) {
+async function revalidateContinuationBoundary(store, continuation, admissionRoute) {
     if (!continuation.boundary ||
         !continuation.providerReplayDigest ||
         continuation.providerProjectionVersion !== PROVIDER_REPLAY_PROJECTION_VERSION) {
@@ -2007,6 +2196,7 @@ async function revalidateContinuationBoundary(store, continuation) {
     const replay = buildContinuationReplayPlan({
         prefixes: prefixes,
         providerProjectionVersion: continuation.providerProjectionVersion,
+        admissionRoute,
     });
     if (replay.kind !== 'replayable' ||
         replay.plan.boundary.manifestDigest !== continuation.boundary.manifestDigest ||
@@ -2016,7 +2206,7 @@ async function revalidateContinuationBoundary(store, continuation) {
     }
     return [...prefixes.at(-1).events];
 }
-function continuationClaimForExecution(continuation, claimedAt, targetRunHeader) {
+function continuationClaimForExecution(continuation, claimedAt, targetOpening) {
     if (!continuation.claimId ||
         !continuation.boundary ||
         !continuation.providerReplayDigest ||
@@ -2036,38 +2226,23 @@ function continuationClaimForExecution(continuation, claimedAt, targetRunHeader)
             runId: continuation.runId,
             turnId: continuation.turnId,
         },
-        targetRunHeader,
+        targetOpening,
         claimedAt,
     };
 }
-function continuationTargetRunHeaderForExecution(input) {
-    const { continuation, sessionHeader, userInput, effectiveOrchestration, effectiveToolMode, claimedAt, } = input;
+/**
+ * The opening fact the claim freezes for its target invocation.
+ *
+ * It has to be byte-identical to the one the target's own AgentRun computes:
+ * the run compares them before it starts, so a claim can only admit the
+ * execution it actually authorised.
+ */
+function continuationTargetOpeningForExecution(input) {
+    const { continuation, sessionHeader, userInput, effectiveOrchestration, effectiveToolMode } = input;
     if (!continuation.claimId || !continuation.boundary) {
         throw new RuntimeContinuationRevalidationError('source_identity_changed', 'Runtime continuation is missing its durable target-header identity');
     }
-    const source = continuation.boundary.segments.at(-1);
-    return {
-        runId: continuation.runId,
-        invocationId: continuation.invocationId,
-        sessionId: continuation.sessionId,
-        turnId: continuation.turnId,
-        status: 'created',
-        backendKind: sessionHeader.backend,
-        ...(sessionHeader.llmConnectionId === undefined
-            ? {}
-            : { llmConnectionId: sessionHeader.llmConnectionId }),
-        llmConnectionSlug: sessionHeader.llmConnectionSlug,
-        modelId: sessionHeader.model,
-        cwd: sessionHeader.cwd,
-        workspaceIdentity: input.workspaceIdentity,
-        permissionMode: sessionHeader.permissionMode,
-        collaborationMode: sessionHeader.collaborationMode ?? 'agent',
-        orchestrationMode: effectiveOrchestration.mode,
-        orchestrationSource: effectiveOrchestration.source,
-        agentSwarmAuthorization: effectiveOrchestration.agentSwarmAuthorization,
-        toolMode: effectiveToolMode,
-        createdAt: claimedAt,
-        updatedAt: claimedAt,
+    const lineage = {
         parentRunId: continuation.sourceRunId,
         ...(userInput.parentTurnId ? { parentTurnId: userInput.parentTurnId } : {}),
         ...(userInput.retriedFromTurnId ? { retriedFromTurnId: userInput.retriedFromTurnId } : {}),
@@ -2078,18 +2253,36 @@ function continuationTargetRunHeaderForExecution(input) {
         ...(userInput.parentSessionId ? { parentSessionId: userInput.parentSessionId } : {}),
         ...(userInput.agentId ? { agentId: userInput.agentId } : {}),
         ...(userInput.agentName ? { agentName: userInput.agentName } : {}),
-        continuationSource: {
-            protocol: 'continuation_source_v2',
+    };
+    const opening = {
+        kind: 'invocation_opened',
+        protocol: 'invocation_opened_v1',
+        route: runtimeInvocationRouteForHeader(sessionHeader, input.targetProviderStateIdentity),
+        configuration: {
+            cwd: sessionHeader.cwd,
+            permissionMode: sessionHeader.permissionMode,
+            collaborationMode: sessionHeader.collaborationMode ?? 'agent',
+            orchestrationMode: effectiveOrchestration.mode,
+            orchestrationSource: effectiveOrchestration.source,
+            toolMode: effectiveToolMode,
+            ...(effectiveOrchestration.agentSwarmAuthorization !== undefined
+                ? { agentSwarmAuthorization: effectiveOrchestration.agentSwarmAuthorization }
+                : {}),
+            workspaceIdentity: input.workspaceIdentity,
+        },
+        root: { kind: 'user' },
+        source: {
+            kind: 'continuation',
+            sourceInvocationId: continuation.sourceInvocationId,
+            sourceRunId: continuation.sourceRunId,
+            sourceTurnId: continuation.sourceTurnId,
+            sourceRuntimeEventHighWater: continuation.sourceRuntimeEventHighWater,
             claimId: continuation.claimId,
             boundaryDigest: continuation.boundary.manifestDigest,
-            sourceInvocationId: source.identity.invocationId,
-            sourceRunId: source.identity.runId,
-            sourceTurnId: source.identity.turnId,
-            sourceRuntimeEventHighWater: source.position.lastEventSeq,
-            sourcePrefixDigest: source.prefixDigest,
-            replayManifestDigest: continuation.boundary.manifestDigest,
         },
+        lineage,
     };
+    return preserveHandoffOpening(continuation, opening, input.sourceOpening);
 }
 function consumeAdmittedRuntimeContinuation(input) {
     const { continuation } = input;
@@ -2128,9 +2321,17 @@ function consumeAdmittedRuntimeContinuation(input) {
         immediateSource.position.lastEventSeq !== continuation.sourceRuntimeEventHighWater) {
         throw new Error('Runtime continuation durable admission boundary is inconsistent');
     }
-    const replay = buildRuntimeEventModelReplayPlan(continuation.runtimeContext);
-    if (digestProviderReplay(continuation.providerProjectionVersion, replay.items) !==
-        continuation.providerReplayDigest) {
+    const replay = buildRuntimeEventModelReplayPlan(continuation.runtimeContext, {
+        allowRepairedAssistantPrefix: true,
+    });
+    const providerReasoningReplayEventIds = compatibleProviderReasoningReplayEventIds(continuation.runtimeContext, input.admissionRoute.invocations, input.admissionRoute.targetProviderStateIdentity, input.admissionRoute.targetModelId);
+    const admittedItems = admitProviderReasoningReplayItems(replay.items, providerReasoningReplayEventIds);
+    if (digestProviderReplayAdmission({
+        providerProjectionVersion: continuation.providerProjectionVersion,
+        targetProviderStateIdentity: input.admissionRoute.targetProviderStateIdentity,
+        targetModelId: input.admissionRoute.targetModelId,
+        items: admittedItems,
+    }) !== continuation.providerReplayDigest) {
         throw new Error('Runtime continuation provider replay identity changed after admission');
     }
     return {
@@ -2160,7 +2361,9 @@ function assertRuntimeContinuationEnvelope(continuation) {
     }
     if (continuation.invocationId === continuation.sourceInvocationId ||
         continuation.runId === continuation.sourceRunId ||
-        continuation.turnId === continuation.sourceTurnId) {
+        (continuation.handoffRootRunId === undefined
+            ? continuation.turnId === continuation.sourceTurnId
+            : continuation.turnId !== continuation.sourceTurnId)) {
         throw new Error('Runtime continuation must use fresh invocation, run, and turn identities');
     }
 }
@@ -2171,8 +2374,16 @@ function assertContinuationSourceUnchanged(continuation, sourceRun, sourceEvents
         throw new RuntimeContinuationRevalidationError('source_identity_changed', 'Runtime continuation source run identity changed after planning');
     }
     const terminalEvents = matchingTerminalRuntimeEvents(sourceRun, sourceEvents);
-    const terminalStatus = terminalEvents.length === 1 ? terminalRunStatusFromRuntimeEvent(terminalEvents[0]) : undefined;
-    if (terminalStatus === undefined || terminalStatus !== sourceRun.status) {
+    const pause = terminalEvents.length === 1 ? runtimeHandoffPause(terminalEvents[0]) : undefined;
+    if (terminalEvents.length !== 1 ||
+        (continuation.handoffRootRunId === undefined
+            ? Boolean(pause) || terminalRunStatusFromRuntimeEvent(terminalEvents[0]) === undefined
+            : !pause ||
+                pause.rootRunId !== continuation.handoffRootRunId ||
+                pause.successorRunId !== continuation.runId ||
+                pause.successorInvocationId !== continuation.invocationId ||
+                pause.claimId !== continuation.claimId ||
+                pause.remainingSteps !== continuation.handoffRemainingSteps)) {
         throw new RuntimeContinuationRevalidationError('source_terminal_changed', 'Runtime continuation source is no longer terminal');
     }
     if (sourceEvents.length !== continuation.sourceRuntimeEventHighWater) {
@@ -2232,6 +2443,15 @@ function deepFreezeContinuationValue(value) {
     }
     return Object.freeze(value);
 }
+function runtimeSteeringInput(owner) {
+    return owner
+        ? {
+            pullSteering: () => owner.pull(),
+            ackSteering: (ids) => owner.ack(ids),
+            nackSteering: (ids) => owner.nack(ids),
+        }
+        : {};
+}
 class RuntimeRunOwnerScope {
     run;
     callbacks;
@@ -2338,19 +2558,18 @@ class RuntimeRunOwnerScope {
     }
 }
 function effectiveOrchestrationForRun(run, session) {
-    if (run.orchestrationMode !== undefined &&
-        run.orchestrationSource !== undefined &&
-        run.agentSwarmAuthorization !== undefined) {
+    const configuration = run.opening.configuration;
+    if (configuration.agentSwarmAuthorization !== undefined) {
         return {
-            mode: run.orchestrationMode,
-            source: run.orchestrationSource,
-            agentSwarmAuthorization: run.agentSwarmAuthorization,
+            mode: configuration.orchestrationMode,
+            source: configuration.orchestrationSource,
+            agentSwarmAuthorization: configuration.agentSwarmAuthorization,
         };
     }
     return resolveEffectiveOrchestration(session.orchestrationMode, undefined);
 }
 function effectiveToolModeForRun(run) {
-    return run.toolMode ?? DEFAULT_TOOL_MODE;
+    return run.opening.configuration.toolMode;
 }
 function assertNoRemovedChildAgentRunLineage(input) {
     const legacy = input;
@@ -2361,8 +2580,7 @@ function assertNoRemovedChildAgentRunLineage(input) {
     }
 }
 async function interactionResumeAllowed(interactionRun, event) {
-    if (!interactionRun ||
-        (event.type !== 'user_question_answer_ack' && event.type !== 'sandbox_boundary_decision_ack')) {
+    if (!interactionRun || !isHostedInteractionSettlementAckEvent(event)) {
         return true;
     }
     return await interactionRun.canResumeAfterSettlementAck(event);